Good morning, everyone. Thanks for being here today. Any, so, okay, let's go. Okay, so submit your assignment for write-ups. So you can submit your write-up now and then the reduction, what is it, 20% reduction per day applies. So that will only apply on the levels that you break from yesterday to today. So if you break two levels and you would have gotten 20 points, you'd get two things, right?  Right, so you don't, you can just submit an additional write-up of those levels that you broke. That would be totally fine. Questions, comments, thoughts on the assignment? No, not right now, we gotta wait. Let's give it like three days for four days for all the reductions to fit in. So yeah, we're happy to discuss. I'll also leave that server up so you guys can play with it, access it, work on the levels, all that kind of stuff. If you wrote any source code, submit it. Deleted them? How are you ever gonna solve this problem again? So just mention it in your report. But I think I set it up so you have to submit something so just submit something. Is it okay to leave all the source files in my home directory and just write about them in the source? No, try to attach them since they're separate systems because I don't want to have to copy everybody's, because some people have like, I don't know, libc source files, everything in there, all directory size. Yeah, you can use our sake to copy from a local folder to your source so you can get a follow-up from there. Cool, anything else? Yeah. The solutions, can I see in the solution? Do you have to be given? No. No, that's why you have another four weeks to keep working on things. Oh, what about before the exam? Because a lot of these problems relate to the classes that we have been taught and if we do not crack all the levels before the semester exam, would you give out the solutions then? No. You can also, if you find there's tons of intensionally vulnerable software online. So if you find stuff, you can email it to the class and say, hey, here's an example of integer overflow vulnerability, right? Here's a program and here's how to explain it. So yeah, definitely leverage all the information that's out there on other stuff. But yeah, we're going to produce these again so don't post your solutions online, all that kind of normal schoolwork stuff. Anything else? Cool, all right. Projects, so I posted some project ideas on the website. So there's two types of projects you can do. You can either choose to do a prevention security library or you can choose to create some kind of automated exploitation tool that will try to automatically exploit these types of vulnerabilities. So you can choose whichever you want. As mentioned previously, your group is either going to be one person or two people. So max two people in your group. I expect these to be done individually or in pairs so I know that you're actually doing stuff on carrying some person who's not doing anything, right? You've all been in groups like that after. Yes, I have a subtle lack there. OK, so some of the ideas. So I'm also open to new ideas. So if you have something new that you really want to try out, email me. I'll see. We'll work on it to try and see if we can make it because I have to get the right level of interesting enough but not impossible. And then I can put it on here so that other people can decide to do these projects. So these are some of my ideas, things that I think would be cool. So prevention. So generally in prevention, the things that I think are really interesting are any kind of security defenses that can be applied automatically. So that require almost no changes to the original source code. To me, that is super cool, really awesome defenses. If you have to say, well, if the programmer writes their code and uses my library, that can also be cool, right? But it then needs to be a little more technically interesting. This is a lot trickier to apply the legacy software. So one of the project ideas here is size aware overflow functions. So the idea is you want to prevent buffer overflow attacks by hooking malloc and hooking the traditional overflow functions to basically keep track of the size of all malloc pointers. And then when pointers are then passed to the traditional overflow functions, right, the ones that we talked about, then you extract that size from that information you're keeping and make sure they're not trying to copy more. So you can actually translate string copy to a string end copy to make sure that it only ever uses that amount of data. So you can use, if you want to do this kind of stuff, also probably add a little more details here. These were kind of my high level thoughts. But LD preload is a mechanism to say that a library should be used when a program is executed. I think actually some of you have emailed me about this, trying to use this to explain some of the examples. So this can be used to actually provide your own version of malloc and printf and some other functionality. So if you use this, this allows you to hook in and basically add protection mechanisms here. This is the way you can do this without requiring any modifications to the source code. This can be applied to any binary. And so yeah, so kind of some high level ideas of how to do this. I also, for most of the projects, I added a stretch goal. So when I was working at Microsoft, I always had our goals for the years and then our stretch goals of where we tried to go. So this would be like, if you do this, this will be like extra credit or something. We'll figure out something good. Yeah, so the idea is, so this you can easily do with malloc because when you malloc memory, right, we know the pointer that gets returned and we know the size that gets passed around malloc. So you should be able to do this and ensure that none of these overflow functions actually overflow one of these malloc-based pointers, right? But as you saw on the homework assignment, right? A lot of these buffers are actually stack-based buffers. And so the interesting thing here is how to stretch and implement this with stack-based buffers, right? Could you somehow try to automatically infer from these functions the size of the stack? Maybe you can inspect the code at runtime. I don't know, there's a lot of cool ways to take this to actually implement something like this. You could pre-compile or maybe you add a compilation step to change all the local buffers maybe to mallocs or something interesting can definitely be done here. So if you want to take it in this direction, feel free to do that. Okay, format strings. So format strings, so basically similar type of things. So you want to hook and provide basically hook the traditional print-out function and provide a safe version that filters out all of those vulnerabilities that we talked about. So the trick here is to remove all possible combinations of percent ends. So you'll actually have to study and understand the format string specification, right? Because if you just filter out percent ends, as we saw, there's all kinds of positional arguments and all kinds of modifiers, right? So that actually makes this a little bit more interesting than I was originally thinking about. The stretch goal would be to think of how to extend this to also prevent information leakage vulnerabilities, right? So this could actually be pretty cool to try to, when the print-out function is called, try to inspect the stack to see how many parameters were explicitly passed to that function, right? Versus, and then that way you could enforce maybe that constraint in the print-out function. So you wouldn't actually be able to access anything outside of that bound. That could be really cool. And, ow, maybe I'll, no, I like this. Okay, so yeah, so I think this one is one of the more simpler implementation-wise. So you need to also write three distinct programs that contain format string vulnerabilities along with reliable and repeatable exploits for them. So this helps you make sure you know about print-out vulnerabilities. Questions? You can feel free to stop me if you want. There you go, cool. Okay, we're gonna get into web stuff. Like hopefully it's Wednesday. So there's also stuff about cross-site scripting prevention. So provide some kind of security layer that prevents cross-site scripting vulnerabilities. You should try to do this in a way that requires minimal modifications to the PHP program. These, obviously, if you have experience in web or web vulnerabilities, this would be a good way for you to go, especially now when we're just getting into that content. Stretch would be to extend this project to prevent context-sensitive cross-site scripting vulnerabilities, which I'll add links here to what exact banding by context-sensitive. Similar thing with SQL injection vulnerabilities. So create some kind of layer or wrapper or something that basically instruments the attacker-supplied variables and checks that those are not used in a SQL query. Cool, also cool things. Prevent second-order SQL injection vulnerabilities. So those are kind of a high-level prevention mechanisms. To be completely honest, I wanted to add stuff in here about networks, but everything I thought of ended up back to just doing SSL, basically. So like prevent TCP hijacking, why we should use SSL, like TLS or something, right? So, but if you have some cool idea there, please talk to me about it. Okay, for exploits, right? Hopefully you kind of got this as you were going through the levels that actually a lot of this stuff can be automated to actually help you do this, right? So, automatic buffer overflow exploitation. So, basically figure out, design some kind of way to describe the vulnerability. Doesn't have to be a language in a traditional sense. It just has to be some way that, so basically, I find a vulnerability, I want to be able to tell your program, hey, this is how you trigger the vulnerability, just the binary, automatically exploit it. So, that's basically what this, you need to do is figure out the length, figure out what's gonna crash it, figure out the knob and the shell code and the offset and all that stuff and figure out the address, all of it automatically. The stretchable here would be work, many of these are just, make it work on a different architecture, right? So, work on 64-bit architecture. In a similar vein, automatic format string exploitation. So, this basically same thing, take a binary, have some way to describe which input is vulnerable and then automatically construct the format string that will exploit that vulnerability. So, you have to find out where that vulnerability is on the stack. So, how many of the positional argument you need, what the output of the string is, what are all the values that you need to send in there. Yeah, this one's gonna be really cool. I think you can definitely do this and it would help a lot. And so, extend the project to work on x86, 64-bit binaries. Okay, in the cross-site scripting world, oops. So, develop a tool that automatically generates a precise cross-site scripting payload. So, a lot of the cross-site scripting stuff uses this huge list of exploits and tries to send stuff to see if they're vulnerable. The problem here is that it goes back to context sensitivity so it depends on where in the HTML page that this output is used. So, what you should do is create a model of the browser's parsing engine, all the characters that transition the browser's parsing state. See where that output is used, figure out what the state of the JavaScript engine or the parsing engine is in at that point and then figure out what malicious characters you need to transition the browser to JavaScript. So, oftentimes it's like bracket script, right? But oftentimes there's actually more complicated or you actually don't even need brackets at some point. So, yeah, your tool should be able to generate the transition that actually does this. And the stretch goal here would be to integrate the tool with a crawler like an automated crawling system like W3AF as a model there. Blind SQL injection, so this is a tool that actually does exist. So, the idea is blind SQL injection, you actually don't get any output but you do get one bit of information which says if this exploit was successful or not. So, you can use this technique to automatically extract the entire database given this one bit of information. So, that's basically what this project is about. Yeah, and then propose your own projects. I guess I don't have a due date. I was thinking last day at class but we'll figure out a good due date and then you'll write up a two page report about the project, what it did, I did it. Maybe also do demos or something for me and or the TAs. So, we'll figure out that stuff as we get close but now you can start thinking about what project you want to do, if you want to try to do a new project, if you want to do the pairs or by yourselves. All that kind of stuff. So, questions? Yes? For exploitation tools like a format thing, is there a delivery method, no, it's foreign because some of the program, a program makes format symmetry files of the tool that you manage. Is the delivery method assumed or? I think you should know. The program doesn't have to figure it out but you have to have a way to tell your program what it is, right? And it doesn't have to cover every single possible case but it should cover the cases we talked about, right? Arguments, input, maybe, those kind of things. It doesn't need to be crazy complex, like you don't have a language that describes, you send this and then they send you this and then you expect this and then you send the format, right? But it should have like, here's the input, here's, and then here's how I look for the result, right? That's another one, is how do you know the result of that format? Are there already available, I released for all the ones that you talked about? I don't think so. The only one, the blind SQL injection, that tool does already exist but I do think it's super cool and I think it would be fun to do. I don't, this definitely does not exist. It's something that I definitely know can exist and would be really cool. I don't think, I don't think either, so there are, there is a research paper was kind of where I got some of these ideas. David Brumley's group at CMU has a paper on automatic exploit generation. So they, but they're doing complicated, like static analysis, they build up a whole SMT formula based on how to get there and then it can automatically generate input that triggers a vulnerability but you don't have to go that far. I mean, if you want to, that'd be super cool if you want to do the static analysis stuff. I think that'd be cool. Questions? Is this already up or not? Yes. This should be a projects tab, I think. You may have to refresh. What do we need to have a project idea by? I would say end of this week, Friday. That way you have your idea and group all set so you can crank for three weeks and do some cool. Cool. All right. Let's get done with binaries. We talked about all different types of vulnerabilities, right? And so remember, we talked about classifying all of these kind of application level as really the core problem is memory corruption, right? It's that some other process is able to trick us into overriding or changing some value in memory that the programmer shouldn't be able to access, right? So what would be the best if we live in an ideal world, how would you prevent all these vulnerabilities? By coding together? Yeah. Right? Good for these programs, right? Unfortunately, I've been talking about this class, right? This is more or less impossible, right?  One way would be to use a different language, right? Use a language like Java or Python that actually does boundary checking. And so it more or less eliminates these kinds of arbitrary memory writes. But what's the problem here? Performance could be one. What's interpreting your Java or your Python programs? C, right? The interpreter is written in C or C++. And this is why there's still, so JavaScript is, does boundary checking itself, right? But it's running on a C engine and C interpreter, and there's problems in there. And so that's how they exploit memory corruption vulnerabilities through that. You could try to analyze the program, right? Try to analyze the program, find all the vulnerabilities, tell the programmer before they execute it, right? What's the problem here? A little bit to enter in there. Yeah, so actually part of the problem is that precisely identifying every single vulnerability in a program, right, and getting nothing wrong is equivalent to deciding if the program halts or not. So it's equivalent to the halting problem. So we can't solve the halting problem, which means we can't statically identify every single vulnerability in the code, right? This is actually one of those things that is, I can develop a tool that will find every buffer overflow vulnerability in your tool, in your program, right? Every single line of the code, I say, yep, there's a buffer overflow there, there's a buffer overflow there, there's a buffer overflow there. So I'll find them all, right?  So that's the problem there. The other thing, technique is to make exploitation harder, right, make an adversary jump through more hoops in order to exploit the vulnerability, right? So is this useful from a security perspective? Discourages people from trying to get past your security mechanisms? Is it worth their time? Mm, yes. So that's kind of the, goes back to the old joke, you and your friend are running from a bear in the woods and do you have to outrun the bear? No. No, you only need to outrun your friend, right? And then you're fine. So it's kind of a similar thing in our security sense, right? I don't need to be super secure. I actually need to be a little bit more secure where the attacker's gonna attack somebody else rather than me, right? Yeah. Well, other than you might have a thing of honey on you when your friend may not, so. Yeah, exactly. That's a good point, right? So I may be a more attractive target to bear terms, right? Covered in honey. Also it's probably hard to run when you're covered in honey, I don't know. But yeah, right? So still dedicated adversaries, right? They still become a problem, right? And so the other thing to think about is cost, right? How much does it cost an attacker to develop a reliable exploit for this type of vulnerability? If I can make it more expensive for them, then yes, okay, I'm not gonna keep out the nation-state level attackers, right? But I can keep out the random hacker group, right? Like anonymous or whoever who's just trying to do things for the lulls and trying to find things that way. We can also try detecting this, right? So we can try detecting exploits, blocking them. So we can kind of, what you're gonna be doing is doing some kind of dynamic analysis checks, right? So do some kind of checks to see if something's being overflowed if you're trying to copy more than should be. Some of the things that have been done is trying to analyze system calls. So see what system calls the application makes and then if it deviates significantly, stop it and say that there was an attack, right? We talked about detection, right? We do, detection is good, right? We need to know if our systems are compromised but oftentimes it's often done after the fact which then how useful, you know, you do wanna know that you've been infected but it didn't really stop anything. You could detect, you could look at what the code's doing. You could see if it writes code and then jumps and starts executing those code, right? So you could try to develop in some sense some kind of exploit fingerprint like the shell code we were using to like push things on the stack and then jump to things on the stack. You could do some kind of integrity checking to try to check return addresses at runtime to make sure return addresses aren't tampered with. So there's been a lot of research we're gonna look specifically at making exploitation harder, right? So do you think that your job was easy with these exploits that you're writing and developing for Simon 3? No. No, it's hard, right? These things make it even harder, right? We can see that still whenever there's incentive to bypass these things or get around these things, bad guys will find a way, right? And so it's just really this continuous arms race where we develop a new kind of mechanism to make exploitation more difficult and then the attackers go one step further and they find ways around that, they find a more reliable way to do it. So then we figure out what they're doing on that one and then we make something new defense, right? And so we constantly have this trade off. So we're gonna leave this kind of as a, in a historical way of how things evolve. So the first thing they said was, well, whoever wants to execute code on the stack, right? We should never execute code on the stack. So in Linux, there's an NX bit on memory, which is the non-execute bit. So basically, so it's pretty much standard on all systems now. So basically it marks a memory area as non-executable, right? So it's actually one of the flags that we use when we compile your applications for assignment three is we say, okay, mark the stack as non-executable, right? So DEP, so Microsoft also has implementations of this, right? Microsoft is very interested in making exploits more difficult and trying to protect people. So it actually will support it, which is great, the WXORX, right? So you can either write or you can execute to a memory, you can't do both, is in the BSD of BDS. And so we think, okay, well, problem solved, right? The attacker can't execute anything on the stack, but is that the story over? Are we still talking about this? Could someone in the environment variable, I'd say the environment variable is on the stack, right? So that's still on the stack, which makes sense, right? You wouldn't want to execute something in the environment, yeah. There are other locations that data section. Yeah, so data section, right? So what about the heap, right? All we need to do is get to that address, right? Our shell code can literally live anywhere in the program, or if it's like a user's string or something like that, right? The basic idea of the NX bit is that you never want to have memory be both writable and executable at the same time, right? That's where a problem goes, because an attacker can write and then they can start executing from it. So one thing, what? Does this describe, I mean, maybe most programs we write, what about like Java or JavaScript, like a JavaScript engine? Would that work here? Why not? What's the feature of those interpreters that make it so that this doesn't, I didn't have a code generation, what's another name for that? Eval Java. Eval is one, JIT, right? Jitting code, right? So just in time compilation of code means runtime compiling it from Java byte code to X86 code, right? So you have to write that code somewhere, and then you have to change that once writable segment now to be executed and to jump to it and execute that as code, right? So I can easily get around this non-executable memory in a language like that. And oftentimes this is exactly what happens in JavaScript, is essentially what the attacker will do will they will write JavaScript code that when it gets jitted compiles to valid X86 shell code and they try to use an exploit to jump to that shell code which is actually part of the JavaScript execution so that memory is executable, should be executable because the expectation is literally writing memory bits, bytes to it and then executing it. So you think about constants in JavaScript. They're gonna be compiled into constants there and because X86 is very reliant, if you jump to the middle of an instruction it could be something completely different. There also is another way, so this is what, so there's a type of exploitation technique that originally started as return into libc and it's related to the control of the EVP that we talked about in here. So the idea is if we control EVP, right? Or even if we control the stack, right? So the stack has the function frames of every function that's being called up until that point, right? So we saw the frame, we know it contained the arguments, the save evp, the save evp and the local variables, right? And then we saw that when our function returns they use that save evp value. So normally we use our shell code address, right? To jump to. The idea here is instead of jumping to my shell code the things that I wanna happen are already libc functions often, right? So there's the system call, right? So what if we, so we completely control this call stack now. So what if we change this call stack to make the program think that it came from a libc function and all the arguments to that function also live on the stack so we can then change the stack to look like it just got called from there. And so it will jump and start executing a function that already exists. So we're taking advantage of code that's already there written and loaded by the application. So that's kind of the general idea of these techniques is we're gonna create a fake call frame that looks like it came from some trusted function. And so control flow will go, we'll change save evp to then point to there not to our shell code, but it will still accomplish the same goals that we want. So any function that's currently linked used by the application we can use this technique to. So we can get it to call any function we want. So often if system is used, right? So system takes in one character pointer argument that is the string to be executed. This is just like if you type this into bash. So we can get the function to then go back and return into system. Then now we've actually controlled the code very well. We can even do tricks like we can do string copy to copy shell code wherever we want. So from the stack to somewhere that's actually executable, we can also do that. All we have to do is we have to find the system function in memory. And to do this we've seen we can use debuggers, we can try to use the proc file mappings. But we can figure out where this system call is actually being loaded at runtime. So to see kind of how this works, right? So we have our buffer, we have save dbp, save pip. And we first wanna call, so it's gonna string copy our input into buffer, right? So we're essentially creating now a new call frame. And before the only thing we cared on that new call frame was just save pip, right? That was the only thing we cared about. But now I want this function to go and call system, right? And this is gonna call system if save dip is overwritten with the address of system. And then above that is going to be the fake caller return address. We have to pretend like we called system from some other function. I believe there should also be a fake evp on here which is not on here. And then the address of slash bin sh zero, right? So we already kind of know how to use this. We can use, well, if we can get this string somewhere into this function, right? It's not too hard. It can be somewhere here in our buffer. As long as that string is there, we provide the address of that string. Now when system executes, it's gonna look up the stack, see which is the argument to system. It's these bin sh and it's gonna execute bin sh for us. So the idea is when we call return, right? Our stack pointer's gonna be here. And that way we've created a new frame with a new save dip, new save dvp and arguments to system. And our system starts executing as if it was called. Right? And we can execute system. What's gonna stop us from calling a function that already exists in the program? Right? Nothing. Why do you need a big evp? Would it just like a big evp? You need both. You need both two space there. Because it's gonna look for the argument at, it's gonna create a new evp, which is gonna be where the stack pointer is, and then it's gonna look up eight for the first argument there. And so the crazy thing is, right? Once system executes, right? It's gonna do whatever we call and then when it returns, it's gonna return to wherever this return address is, right here, which we can control. So we can actually use this technique to chain multiple functions together. We can create this beautiful call stack of all of these functions of who's calling what. And when they'll return, they'll just call one after the other. So they'll call. And this is how we can do all kinds of crazy stuff with, like, we can do the string copy so we can first put call set UID because sometimes if the program is dropping privileges or trying to save its UID, right? It's trying to save the effective user ID. We have to wanna put it back by calling set UID.  And so we can chain these together. When the original function returns, it's gonna call system. And then when system returns, it's gonna call back into set, oh no, sorry. Yeah, when the original function returns, it's gonna call set UID. And then when set UID returns, it's gonna call system. So in this way, we can chain these functions together. And then we can even try to, so we string copy here, right? So we're gonna string, yeah. So when you return system, you cannot directly call a set UID, right? When you want, say that again. When you return to system, you cannot use system or set UID. No, system will only execute things like in batch, right? So I think it will do a fork and then an exec and then do whatever it's gonna do. I'm trying to do that for the way it's gonna do it. Yeah, so you need to, well, I believe system may also drop privileges. Yeah, I think so. If the set UID is not the same as the effective user ID. So yeah, you need to do this first is, it's a combination, I forget exactly how it's done, but basically like set UID equal to the effective user ID. So if you do those and then do system, that should work fine. So we can even copy the shell code. We can get this to copy our shell code to an executable place and then execute it. So we can copy, so this first string copy is gonna copy our buffer and our new frame onto the stack. Then when this original function returns, it's then going to string copy, it's gonna copy the address of our shell code into wherever some place that is executable. And then when string copy returns, we can have it return into this executable area that it just created. So in this way, we can actually get the program to copy our shell code from someplace that's not executable to someplace that is executable. We can also write all the memory mappings of what's writable or executable the program controls. So we could even call those functions to change the stack to be executable and jump onto the stack. But we have to be a bit more precise when we're doing this. So you can see that yes, the job of the attacker does get more difficult. And what we're doing here is we're actually jumping to the start of each of these functions because we want that entire behavior of these functions. But this behavior can actually be generalized to execute arbitrary functions. Yeah, so basically we can do, so we can see we can do, so actually this, so we saw we can chain it and we can do this arbitrarily many. So we can, yes, okay. So the idea is we can execute arbitrary sequences of functions, right? So we've seen move EVP into the stack pointer, pop EVP, ret, right? We know these are the function epilogs and we know that we can use these, or we know that what these do is it sets the stack pointer to the current base pointer. It pops the current value that's on the stack into the base pointer and then it returns based on that other value that's on the stack right above that saved base pointer and starts executing there. So what we can do is take advantage of these little chunks of code, right? These little chunks of code change the stack, also move things and then return. So if they have some other side effect, we can try to create a number of fake function frames that point to bits of code like this that do these little things, right? So let's say, I don't know. The thing that was before this was add one into EAX, right? So if I call into there, I know I'll increment EAX and then I'll start executing at whatever the function frame is above that. And let's say there's another one that will X or EAX with EAX and there's another one that will move EAX into EVX. So now I'm building up essentially a language of little tiny gadgets that do like one little thing and by combining these together in an arbitrary number, I can perform arbitrary computations and in effect use whatever my shell code would do, I can make the program do that. So the basic idea is you put all of this here so you're exactly the point I wanted to make. This is actually just doing epilogues to... Yeah, this is, oh, this, okay, I see, I see. This is using the epilogue to change the base pointers and the stack pointers. So to change where the function frame is. Yeah, this isn't too important. What I was talking about, what I was talking about was return oriented programming. So this is when you generalize this completely by using snippets of code. So just a little thing followed by a return instruction. And this was actually one of those things. So return to libc had been around for a while. People kind of knew intellectually that this was a problem. But it really wasn't until, well, attackers or actually don't know if the academics came first but the idea, this was a technique that was used to build up arbitrary functions. That's right, this is the paper. So the geometry of innocent flesh on the bone. So the idea is there's still, we're reusing the stuff that's left there on the bone of the x86 code. And the idea here is that a large enough x86 executable code, right? So the beautiful thing about the code of the application is the code of the application is fixed and never changes the address of the code. And that code is executable, right? So the address doesn't change and it's executable which gets around all of our requirements. We just need to build up enough stuff for it to do. Okay, let's go here. Yeah. So the idea is you use these little gadgets and you're able to see this as well. I'm gonna do this to work. The idea is, yeah, so you put the addresses in here. So you first go into here and this will pop ECX, pop EAX and return. So you can get values into ECX and into EAX, right? And then if we go execute y, it will dereference ECX and move that into EAX and then return. So we've essentially been able to copy this value into this destination address. So just by using this incredibly simple gadget, we've been able to write to a memory location. And so you can build this up to do more and more complicated, interesting things. So our return into programming is how almost all of the new exploits work on Windows and all those kinds of things because they're incredibly reliable and they get around all of these defense mechanisms. So, okay, so that was one idea is like, okay, it looks like the stack not executable, right? Let's make memory not executable. Another idea is, hey, part of the problem is they're overwriting the return address, right? So let's prevent that. We don't want them to overwrite the return address. So then they added what are called canaries. So one of the original papers on this was a paper at Usenek security in next time you ate called StackGuard. So the idea is that you put a canary value after the saved. So you have saved EIP and then canary value and then save base pointer. And then that way you can check. So there's different types of canaries you can do. So you can put special values on there. You can put a random canary. So every time it program executes that canary is random. You can XOR some random value with the return address and then before you return, you check, you do that XOR again. And the key point in here is that you need to check before you actually do the return instruction. So you check to make sure that, so every now and why it's called a canary, right? So in like coal, it must be true. I don't know if they still do it, but in like miners when they, so apparently like canaries respiratory systems are very sensitive to like particles and that kind of thing. So when people are like mining or doing something kind of dangerous where there might be particles and that kind of problem, they'll bring a canary down there with them. And so if the burb dies, that means there's a problem in meaning to leave. Yeah, it is kind of terrible, but these are digital canaries. So no canaries were hurt in the making of this sacrifice. And so the downside here is you need to recompile the program in order to add these canaries in there. And this can introduce obviously some overhead, right? Every function returned, you have to do this check. Maybe every function call, you have to set up this unique canary, right? So all these kinds of overheads. So we saw it. So if you've tried to just compile some of these examples and do these simple buffer overflows, you'll see the stack smashing protection, the stack canary. So this is why that we do the fStackProtectorNo or fNoStackProtector. Yeah, and also what they'll do is they'll try to rearrange the memory of the function such that it's less likely that the program is executable, right? As we saw, if your buffer overflows local variables, you can control those local variables. So what they'll do is they'll change the way they compile the program such that the buffers are toward the top and the local variables are on the bottom and there's a canary between those and the after the buffer, but before the saved values. So yeah, so this actually was a huge problem on I think level 13 where I had to rewrite it so that we get around this and do exactly what we wanted it to do. Yeah, and so there's all kinds of how to protect stack smashing attacks. Unfortunately, these can be bypassed, right? So one of the ways is you try to break the canary or, yeah, or if you can overwrite and you control the address of where to overwrite, instead of overflowing the buffer, just overflow those four bytes of that return address. If you can figure out kind of where the address of the buffer is, you know it's the address of the buffer plus the size of the buffer to EVP plus another four and then you can just overwrite directly that memory address, right? So this is another instance where we have the defense mechanism that only kind of captures or prevents a very small segment of vulnerabilities. So you can overwrite pointers in the function frame. You can do all kinds of stuff, you know, it's a good, it helps prevent kind of garden variety basic stack overflows, but it still doesn't fix all kinds of vulnerabilities. Also, if you have a long running process, if you're able to guess the canary, right? If it's just a 32 bit value, maybe at some time you'll get it, maybe you can leak memory, you can use two more, two exploits, sorry, two vulnerabilities, leak some memory to leak the canary and then do the exploit. Other steps, right? So maybe you kind of got the impression, hopefully, part of this, that guessing addresses is hard, right? You have to be very, very, very precise for these exploits to work, right? So the other idea is, hey, let's make this part harder, make guessing harder. So how do we make guessing things harder? Randomize it. Randomize it, yeah, exactly. Just like we saw at TCP, right? So the next one is address space layout randomization. The idea is, okay, every time the program runs, let's change where the heap, the stack, the code, and the dynamically linked libraries are, right, what their addresses are. Unfortunately, it's not as easy to do as you might think. So stacking heap are easy because nobody, the addresses of the stack and the heap are supposed to change every time the program is on, right? But things like the program's code, that thing is fixed. If you looked at a bunch of object dumps of functions, right, they don't jump to labels, they jump to memory addresses, right? And the same thing with dynamically linked libraries, right, so that's why we have the global offset table that says where to go and where to jump to. So yeah, so this is actually really difficult. The libraries have to be rewritten to be positioned independent. Oh, you have to rewrite a lot of features here. And this makes return to little C attacks a lot harder, which is good. And so for 32-bit systems, actually, right, because you still do need, you can't just randomize something so that the stack and heap are right next to each other, right? Because they'll overflow. So there's actually not a lot of entropy in these ASLR systems on 32-bits. So yeah, you could try 32,000 attempts pretty quickly, right? Then break that, especially on a server that's running continuously, right? So you only need to get that right once to exploit it. 64-bit architectures make this much more difficult. Unfortunately, like I mentioned, rewriting the program's code is a lot more difficult. So rock or return-oriented programming techniques are still very effective. In addition, ASLR, right, oftentimes if you're just moving things down, right, even if you move the code somewhere, usually if I can use one information disclosure vulnerability to find out some bytes of the program, I can easily calculate the offset of where it was and then change my exploit to match that offset. So yes, it makes things more difficult, but then now attackers just change vulnerabilities together. So ASLR is enabled on Linux, except on our server where it's disabled. Yeah, so the curl does this with the L-floater. It does stack ASLR. It doesn't do libraries. I think it does libraries. There's all kinds of different types of ASLR you can look up that does something you're interested in. You can still do this. Well, we can disable it. There's actually this. If you don't want to disable it for the entire program, you can run a bash instance with ASLR disabled so that you can test these things out. As we've seen many types of randomization, if we can guess or just brute force, then we're good, right? And as we saw, right, if we can make the knob slide as big as we want, doesn't really matter. Like we can make it very, very, very, very large, right? So even if you randomize it, if you're trying to hit a large target that's slightly moved, it's not gonna take that much to hit it. So yeah, you either have to leak, basically leak the address or hijack the control flow, basically. So use some kind of Rop attack that's reusing code that's already there. Okay, the other technique is to, people say, okay, the basic problem when you boil all of these attacks down is that, the program has some control flow, right? This function should call this function, which should call this function, and then it should return back up that, right? So this is the control flow of the program. You can statically look at a program and understand the control flow. And so why don't we enforce that at runtime and say that only a function can only call functions that it knows about and it can only return to functions that should have called it, right? Function point is? Kind of with function point. I mean, you can statically analyze it and you can see, okay, function A calls B and B is only called from A or C. That means when that returns, it better only go to A or C, otherwise I know there's some type of vulnerability, right? And you could do this for every return statement in your program, automatically enforce this. So this was a paper at CCS 2015. And so, yeah, you basically try to figure out all the control flow of the program and you enforce this at runtime. The problem is that there was just recently a paper at Using Security called Control Flow Bending that said in a large application, right, you have functions that are called from multiple other different functions, right? So this type of thing is kind of precise. So imprecise for checks. Okay, when the function is called, it can only return to some place that I've seen it statically that it could be called from, but it doesn't check that that's actually who called it in this instance. So they showed that on a large program, there's actually enough variation to this control flow graph that you can execute arbitrary computations, reusing what already exists in the graph. So it's not the panacea that we kind of hope for. And the problem is this is, all these techniques assume a very strong attacker who can read or write, or they can write any memory address, right? So once you do that, you kind of, it's game over. All right, we're in the end game here. So just to go over some tools perspective. So you've been writing shell code, which is awesome. Hopefully maybe you found some tools or some other cool things. Metasploit is a whole framework and tool set that supports exploitation, remote code execution. It has some cool things like you can have different types of shell code and you can tell it what characters are not allowed. So you can do some polymorphic shell code. It has a free version you can download, you can run it, you can test it out. Scott also has, I believe, actual reliable exploits for different CVE vulnerabilities. Do not run these or test these on real systems, right? This is your daily ethical reminder to not do that. If you want to kind of get into this more, Collie Linux is a Linux distribution that has basically a bunch of security tools on it, already pre-installed, so you don't need to find them installed on yourself. Kind of fun to play around with. And so basically, as we've seen, right, you find a vulnerability, choose a payload, figure out how to encode that payload into the program and try to exploit that program. So anyway, so we've seen all the different ways that applications can be exploited, right? This class should make you incredibly paranoid, right? As software developers, don't trust anything. RGV, don't trust it. RGV0, don't trust it. Input from the user, don't trust it. Input from the network, don't trust it, right? All this can be controlled by an attacker, right? And so you need to code very defensively as you're doing this. So we can saw that unexpected inputs. We saw that the environment, right? Path variables can completely change the execution of the program. The home environment variable. And it's oftentimes not explicit in the application that it's using these variables, right? It's often relying on a library function which is using those environment variables. And so really, you really have to think about, okay, how can I sanitize things? How can I make sure things are safe? And how can I understand these environment dependencies? So in my mind, I see everything hopefully moving towards, I don't know if Rust is the answer or one of these other languages maybe go, probably not go, but right, some kind of language that provides memory safety also helps mitigate a lot of these vulnerabilities. But don't be lured into a false sense of security thinking I'm coding in Java. There can never be a security problem in my application, right? So not only are there other types of vulnerabilities that we'll talk about, web vulnerabilities that still exist in every language, but there's a tax on the logic of the application, right? So one of the classic examples is being able to, in an e-commerce application, being able to purchase an item for negative quantity, right? So I buy like two MacBooks and two negative MacBooks and like an adapter. And so then I paid $30 for four MacBooks, right? If it allowed me to do that, right? So, and this is the application is, there's no memory corruption or anything. The application's doing what it's supposed to be doing but the logic of that application is wrong. Right. Cool. All right. Here we got here, we'll start on web on Wednesday.


here that's the invoice to if I clicked on it it would go to the invoice we're gonna pay the full amount out what's this gonna do when we pay it well it's you want to first think accounts receivables going down that's what you because this form is linked to the accounts receivable the other side is gonna go into a cash account either the checking account or the clearing account in our case the clearing account let's save it and close it and then we'll check it out and then we'll go to the balance sheet over here we will run it once again and if we go into checking out the checking going into the checking to check out the checking we could see that we have the deposit down here wait a sec is that what we just did I can't know no no no no no back we're not going into the checking account we didn't put it in the checking account we put it in the clearing account get your head in the game for crying out loud alright I'm a little tired today it's it's Sunday I mean payments to deposit so there it is there's a payment so so there it is that's the one alright let's go back the other side is a reduction to the AR the our account the pirate account are and so we're gonna go down and say that we've got the the payment there looks good let's go back we also have the sub ledger account which should still tie out so if I go to the sub ledger on the right I run it again Anderson disappears because Anderson does not have an outstanding balance we're at 43 207 50 that should still tie out to what's on the balance sheet 43 207 50 if I go to the first tab then and look at all the sales transactions then the open transactions it has now disappeared if I go to the paid transactions that's where it still lives and you can see it's paid and everything there if we do that on the invoice side we can check it internally there so if we had to communicate with the customers we could say we're currently looking at the unpaid this one was paid boom Anderson's there's the Anderson's let's go to the customer we can look at it in the customers and this one is not open anymore but has been recently been paid so I could use that filter and then here's Anderson let's go into Anderson here and we could see the payments have been made so that payment was for if I go into that payment it gives us the detail on the right I'm gonna close that and then if I edit it or view it on the left or on the right that was there's the invoice invoice one zero zero one I can link to that invoice if I close it out and open the invoice this way or if I just click on the invoice you can see what has happened it was open it's been paid it has not yet been deposited if I was to edit the invoice we could see it that way Tom be in as well and so we see it that way as well movie be in very nice movie super cool be in I'm practicing my spanglish with the Spanish and English movie super nice be in okay then next alright let's do another one I'm gonna go back to the customers notice when I go back to the customers here I'm not going up top I'm using the internal I don't have to use this up top because QuickBooks basically has all of the navigations within the website so then we're gonna say let's do another one and look for the open invoices again open invoices this time we want Eric music let's go into Eric music and so we can see we have an open invoice very easy to see I do in 32 days okay so I could make the receipt payment here or let's make the form this time and do it that way drop down we did an invoice let's do a receipt payment and then we'll just type in up top Eric music Eric music tab and then there it is it populates down below I'm just gonna tab through it we want it on the 25th that's good it's gonna be a cash payment as well because we're gonna imagine taking these out of the undeposited funds and putting them in at one time or the payments to deposit it formally called undeposited funds until the QuickBooks wanted to change it I think randomly just to change something they could put it on the time clock the time clock that the that they did something yeah we were working on this statin the other thing we had to change this statin we put it we changed the account name from here to the other name we build that out at like three three months worth of work and whatnot and so you know that's how it goes that's why we have all these changes with QuickBooks online I think but any case it is what it is it's it's an improvement they're gonna get it perfect okay there's the 30,400 so it's a received payment form so what's that gonna do it's gonna reduce accounts receivable the other side's gonna go into a cash account in this case not the checking account to the payments to deposit account and the sub ledger of accounts receivable will be also impacted tracking it by customer let's save and close it and check that one out go into the balance sheet get it right this time it did not go into the checking account see I'm I've got my head in the game my head is in the game alright and then we're down here Eric music there it is it's a payment form looks good let's go back the other side reducing the A to the R the R we've collected it collected on it and we we didn't have to steal their car or their you know all their Tylenol off of their porch for the last month to pay off the guitar bill so that's nice but even if we did at least they we they owed us the money this time so we put our pirating skills to actually good use collecting that debt but in any case if I go to the sub ledger and I run the report or pie or the pill popping klepto we put our pill popping klepto skills to work for good that time any case so we have our two we've got a two customers we're at twelve thousand seven fifty seven fifty that's the new balance if I go back to the balance sheet there's the twelve thousand seven fifty seven fifty there as well if I go to the internal forms and check that out we can go into the all sales and we can we can say it's the paid items so now we're in the paid items we have Eric music in here we can look at it in the invoices as we know the paid items are what we look at are looking at right there it is if we go into the customers then we can say recently paid customer and we're going to say recently paid Eric music we can go into it we have a we have a beautiful image of what is happening we can see exactly what is going on here because these the everything is connected together so if I go into this one for example I can see the history of it if I view or edit it I can see the invoice here if I and I can link to it if I close it out I can also take a look at the invoice I forgot to look at what the invoice was but it was this invoice of the other two are bills you can see it's paid haven't yet deposited it and if I view the invoice by editing the invoice you can see that it has been paid in full very nice muy bien muy be to the super cool and muy super cool be in any case that wasn't that good of Spanglish deals for the love of God meals do better okay what was I doing then oh also note that if you go to the deposit form up top if I go into the bank deposits now you can see that with these deposits


Sometimes we inadvertently replace God's face, superimpose over God's face, someone else's face. And we think that God sees us like they did. It could be a disapproving, significant person in your formative years.   It would be hard for you to do that and believe that right now. But I think it's true. Have you guys got the help?


You start noticing that there is noise when you walk and there is noise when you wash your hands.   That reminds you how things are working normally for when you heard before. He was a very memorable patient and he was also our first patient that was implanted with a metal device. I really remember his story. I lost my hearing 30 years ago and I regained it back 20 years ago. I first saw him in 1996 but about 10 years prior to that he was traveling in Europe for work in Croatia which is where he is from originally. He was involved in a very severe motor vehicle accident with life threatening injuries. He was hospitalized and treated. Part of his treatment was with antibiotics. We know now that those antibiotics can affect the hearing organ causing significant damage. They were able to save his life but in the process he did lose most of his hearing. At that time we had this relatively new technology called cochlear implant. A cochlear implant is a device that bypasses the inner ear and directly stimulates the hearing nerve and allows people to hear and communicate again. That was a device that we considered for him and after a long time of evaluating and discussing the options he did decide to proceed with the cochlear implant. In those days we expected enhanced lip reading, perhaps identification of male or female voices and maybe some sound awareness and quiet. I never in my wildest dreams expected somebody would be able to have a full conversation with me even with the back turned to me occasionally with background noise. Technology has progressed tremendously over the last 20 years and so Mr. Zurga was our first person who was implanted with the MED-EL device which at that time was fairly new in the US. MED-EL is one of the oldest cochlear implant companies but it was new to the US at that time in the 1980s where we had patients who were losing their hearing or in a situation like Mr. Zurga and there was nothing we could do. There was really no medical treatment, hearing aids didn't help and so patients were left in a world of isolation. This technology has changed the world for these people and it's changed what my practice is. It's a significant part of my practice and it's my favorite part of my practice to be able to give people the gift of hearing. The first thing when I was switched on I was able to make a phone call to my mom. That was all very, very amazing. Mr. Zurga's processor has been replaced so before he came here he was using an old processor which was a large box that was worn on the body and now the appearance of the implants is so much different because the external device can even be just a disc that fits over the magnet that sits behind the ear or a small device that fits behind the ear. With MED-EL product we don't want to ever leave our patients behind and so whenever we come out with new external products we make it backwards compatible. So patients who were implanted 20 years ago can use the newest external technology today. So Mr. Zurga started with a body worn device that was the size of a bottle of cigarette box with a cable that went up behind his ear to now where he wears a device that's completely behind his ear with a small coil and battery life. We want to bring our patients forward.


Alright, in this video, I'm going to show you how to sell photos from your phone in stock photography. I'm going to start off with some of the most common questions about cell phone stock photography. Then I'm going to go through how to set up the apps on your phone that you need to be able to sell your photos in stock photography. And lastly, I'm going to walk you through the workflow. Take one of my cell phone photos, and I'll take it from taking the picture all the way through getting it sold online. So when you get done this video, you'll be able to sell your cell phone photos as stock photography. Let's get into it. Now the inevitable first question that comes with cell phone photography is, is the quality of the cell phone photos good enough to sell as stock? Well, the answer is pretty simple. For the most part, if you have a phone that was made in the last two years, that phone's camera is good enough to take photos that could be sold as stock photography. Now although all newer cell phones have cameras good enough to sell as stock photography, there are still some certain types of photography that camera phones aren't good at. The main one being low light photography. So if you have one of the really new phones that just came out that has some better low light features, this may not apply to you. But for most phones made in the last couple of years, the low light photography isn't good because they have a lot of noise, and that's just because cell phones have a much smaller sensor. So although, you know, if you're taking photos in really good light, those ones will be good enough to sell as stock photography. But if you're taking photos in like a dimly lit bar or trying to take like night milky way shots, those ones may not be good enough to sell as stock photography if you take them on a cell phone. Next I want to get into how to set up your phone and what apps you need to sell your photos as stock photography. Now I know that about half the people that watch my videos are very new to stock photography and probably never sold a photo as stock before. And that's fine. You're going to be able to go through things in detail. But the other half of people already are selling their photos as stock probably from their DSLR or their mirrorless camera. Now for the people that are already selling their photos as stock, you may want to skip ahead about a minute because I need to spend a bit of time just walking through how to set up your accounts for stock photography before I get into how you actually set up the apps and the software on your phone. All right, if you're brand new to selling your photos as stock photography, the first thing you need to decide is where you're going to sell your photos. Now you have two main different types of sites you can use to sell your photos as stock. One is your own website and the other one is microstock sites. Now the main difference is that microstock sites already have a lot of buyers searching for photos on their sites whereas if you set up your own website you're probably going to need to do some marketing or some social media marketing to send buyers to your site so they can see your photos. So if you already get a lot of requests to purchase your photos as stock, maybe you've got a large following on social media and buyers are seeing your photos there or you have some other way to get your photo in front of buyers, you may be best to set up your own website and just sell your own photos as stock and then you can use your social media to send buyers to your website. Now there's lots of different sites that you can do this with but I personally recommend using Smugmug and I've got some other videos on this channel about how to set up Smugmug to sell your photos as stock and I'll put a link up here to some of them. Now if you don't have a way to get your photo in front of a lot of stock photography buyers, no worries you can just use the microstock sites. Now they are going to take a much bigger cut of the photo sale because they're the ones that are bringing in the buyers but you can get started much easier than your own website. Now there's lots of microstock sites out there that you could use but what I recommend is starting off with Shutterstock and Adobe stock because they're the biggest ones and once you get successful on those sites you can start uploading your photos to other sites. I've got other videos on this channel about how to set up your Adobe stock and your Shutterstock account so if you need to do that I'll put links to those videos up here. Now personally I upload my photos to a lot of different sites including Smugmug, Adobe stock and Shutterstock and I'll be getting into exactly how to do that from your phone later in the video. Alright so if you made it this far in the video you should now know which sites you want to sell your photos as a stock and the next thing is you need to get those apps installed on your phone. Now there's two main types of apps you're going to need to sell on your phone to be able to sell your photos as stocks. The first one is photo editing apps and then you're also going to need photo uploading apps. Now the reason you need photo editing apps is you're typically going to want to tweak your photos a little bit before uploading to the stock sites. I'll typically bring them into a photo editing app and maybe I'll change the crop a little bit, straighten it out. Sometimes the contrast, I'll change that a bit or change the exposure a little bit just to kind of make the photos pop. I don't do major edits when I'm selling photos from my phone like I would on a desktop sometimes but you typically are going to want some sort of photo editing app to do some tweaks to the photos. Now there's definitely no shortage of photo editing apps on the app stores so you may already have one you like and that's fine. If you don't, I typically recommend using Snapseed or Lightroom. Those are kind of my two favorites. If you don't have an Adobe subscription then you probably want to go to Snapseed because it's free and it's a great little photo editing app but I personally use Lightroom on my computer so I also use Lightroom on my phone so that I can keep all my photos in one spot. However, all these little photo editing apps work the same way. Let me show you how I edit one of my photos in Lightroom before uploading it to stock. So here I am on my phone in Lightroom. Now I have all my phone photos. They auto add to one of my albums here so I can go in here. And typically what I'll do is I'll go through and I'll star the ones that I want to upload so I don't upload every photo to stock. I typically take like 10 photos of a subject and I'll choose the best one. So here's one here that I took when I was just out walking. This is actually right behind my house and we recently had a lot of snow and then it melted and then a lot of rain. So there's a field here that's flooded. It's all nice reflection. So I thought I'd go in and take a photo. So this is the one that I'm going to edit in Lightroom. So I'm going to edit here. And typically the first thing I'll start off with is doing a bit of cropping. So I'll take a look at the crop. I kind of like that crop there. I just want to maybe straighten it a little bit straight. There we go. So I think that looks pretty good for the crop and the straight. Now what I'm going to do is go in and change some of the light first. First I want to go through and I'm going to try to bring some of the shadows up and some of the highlights down. You can see how those clouds are kind of blown out a bit at the top there. And I think I'm going to also just bring down the exposure a little bit. I'm just trying to get a nice looking photo here. Maybe the shadows up a bit more and I'm going to bring the contrast a bit more. So again, just kind of some minor tweaks to the photos.  Maybe like that. So that looks pretty good. So again, I don't do a lot of editing on my phone. Just kind of some minor edits before I upload them to the stock sites. Now to save it, you just click the share button up here. And then what I want to do is I want to export it. I choose exports that I can go through and I want to always do the largest available dimensions and set the quality to 100%. So what this is going to do is it's going to take the edited photo and export it to my phones that I can upload it to the stock sites. All right, great. Now we have a photo that we can upload to the stock sites. Now how you're going to upload to the sites used to sell your photos is stock really depends on the sites you've chosen. Some sites have contributor apps where there's an app that you can use to upload your photos. Whereas other sites don't. And then you need to go in with your browser to the website to upload the photos. Now, I'll put a list up here of some of the most common stock sites and whether they have a contributor app to upload the photo or whether you need to do it via the browser. Now, uploading to all the sites is definitely the most tedious part about selling your photos at stock. You need to upload them, give them titles and descriptions. Also, it's really important to give them keywords as well, too. And I've got lots of other videos about how to do keywords on this channel. So I'll put some links up here and you can go and find those as well. All right, now, personally, I don't have the patience to go to multiple different sites and upload my photo and choose the keywords each time, which is why we develop the PhotoLU app. Now, what the PhotoLU app does is I can open the PhotoLU app and then what it will do is suggest keywords for me and then it helps me upload my photos to all the different sites at once. Now, the PhotoLU app is available on the Apple App Store as well as the Google Play Store. So I'll put some links down in the description below that you can use to go directly to the app and install it on your phone. Now, if you're following along with your phone on this video, really appreciate it. If after you install the app, if you just give us five stars, it really shows me that these videos are useful as well. It really helps our rankings and helps more people find the app. If you're not following along at home, feel free just to go down and like this video because that helps out as well. Now, I'm not going to go through how to set up PhotoLU and the PhotoLU app to link it to all your different sites because I've got another video on that. And I'll put a link to that video up here. But what you what I'd recommend is that you set up the PhotoLU app on your computer, on your desktop, because it's a lot easier to do, I find, than doing it on the phone, although it is possible to link your stock sites from the phone if you don't want to do it on a computer. So here I am in the PhotoLU app. I've already logged in and this is my homepage so I can see photos that I've uploaded in the past. I'm going to go over here to the upload tab. Now I'm going to choose a photo from my photo library. And what you want to make sure is to choose the edited version. So that's typically going to be the most recent one. So I'm going to choose that photo. Now I can choose which sites that I want this photo to be uploaded. So you can see these are all the sites that I've already linked to my PhotoLU app. So I'm going to upload it to all of them. So my social sites and my stock photography site. So I'll click next. Now I want to enter in my title and description. So that's the title and description that I'll use on my social sites. But I also want to enter in another title and description for the stock sites, one that's more keyword rich. Next, I need to enter in my keywords. So what I can do is go out and there's a number of keywords that are suggested, so I'm going to go through and choose the most appropriate ones. And once I've chosen ones from suggested, I'll typically type in a couple more that the A.I. Suggesting algorithm couldn't find. Next is my Facebook post. I'm just going to use my social title and description for that one to move on. Now I'm going to enter in the tweet. I'm going to use my description. And just add in a hashtag. Now I want to do my shared Instagram. So I'm going to choose the title and description. And then choose some of the appropriate hashtags. I can also choose different popularities. I'm going to move to the most popular ones and see if there's anything in here I like. Now I can also manually enter some in. Now I can check to make sure that I've entered everything correctly and just click save and post now to have it uploaded to all of the sites. Now, as it gets uploaded to the site, you can pull down to refresh the page and the icons will change colors. Now, a green icon represents the fact that it was uploaded and no further action is required, whereas a blue icon is for sites where you still need to go into the site to resubmit them and typically the stock sites require that. Now, isn't that easier than uploading the photo individually using eight different apps or your browser? The next thing I'm going to do here is I'm going to go through and upload it to Instagram. So down to the bottom, I've got a shared Instagram and I can post this photo Instagram. The reason I post it to Instagram is although I can't sell my photos from the Instagram app, what I am able to do is get followers on Instagram and then they'll go back to my smug mug site where they can purchase my photos of stock. All right, great. Now you've got your photo uploaded to all the sites that you want to sell your photos of stock. Now, some of the stock photo sites have another step where you need to go through and submit it. Let me show you how you do that with Shutterstock. So here I am in the Shutterstock contributor app. I'm just going to go over and click on the arrow for the submit content section. Now, you can see that the photo is already here available because photo Lou has already uploaded it to Shutterstock. So what I need to do is just click on it and then I can click on edit. And you can also see the description I entered into photo Lou is already here. All the keywords are already here. So what I just need to do is go through and choose a category. Add any releases if I had them and then just submit it to the stock site. So that submission has now been successful and it's waiting for Shutterstock to review it before it goes on sale in the Shutterstock site. Now, if this is your first time selling a photo line, that may seem pretty complicated, but once you get used to the workflow, I think you'll be able to find that you'll be able to go from taking a photo to uploading it to all the different sites within a couple of minutes, as long as you're going to use in the photo Lou app to streamline the workflow. Now, if you have any questions about this, feel free to let me know in the comments below. Also, my YouTube channel is all about making money from your photos online.  Best of luck selling your photos online.


My name is Thomas Pesquet, and I'm a French astronaut for the European Space Agency, speaking to you from space. From this special viewpoint, I can see cuts in the Amazonian forest, salt erosion that paints the rivers, red or brown, shrinking lakes and so on. I see firsthand the damage we are causing to natural resources and biodiversity, which are so important for people and our planet in general. It is painful to see, but it is also driving me to take action and share the initiatives that work against climate change and its consequences. Did you know that climate change is a cause of hunger and poverty besides destroying the home and livelihood of people around the world? It is also changing the quality of food, the nutrient content of crops, for example, and it is driving the spread of pests and diseases and animals we depend on. At the same time, intensive farming is putting pressure on natural resources. The world really needs to favor more sustainable farming that protects the environment. We can help choosing foods produced with sustainable methods or foods that use less water from irrigation to produce and are kinder to the earth's soils. On earth, you have lots of ways to make the food journey shorter. You can choose local and seasonal foods and reduce your carbon footprint. You can also try to grow your own food at home. Right now we are experimenting on how to grow chili peppers on the International Space Station. It's good to learn about growing food because it helps us develop a greater respect for it. Back on earth, we are all one crew on board a spaceship called Planet Earth. Together, we can make space ship earth sustainable for ourselves and for the future generations.


OK, Kam Slater, reallity check radio. Here with Winston Peters now. Winston, looks like you're back in Parliament with a team behind you. Well, I'm very grateful to the team and I'm also grateful for those voters that brought us back because we've done the impossible and that's so important in this campaign. There's a lot of people, listeners and reality check radio that are sitting on a webinar right now. Have you got a little message for them? They're probably not going to stay too long with us and we'll be broadcasting this later but have you got a message for those people on reality check radio? Well, simply that a grateful thanks goes out to them because it's impossible in this environment to actually get back to the circumstance we're in but with their help we've made it and the Parliament will have a watchdog, someone watching every day to make sure we keep the system honest. Just speaking about that watchdog role there, the numbers look a bit baked in now but of course there's special votes to come which could be a surprise for everybody. You're looking just a bit under 6% which is what 7 MPs, something like that. Do you see yourself being in government with the National Party at some point or do you think you're just going to wait and see? Well at the time of this interview it's much more clever to wait and see because a lot could happen even now and always celebrate this one thing. Whatever we're talking about you could not do an issue back in Parliament. Of that we're assured. Obviously if you were in government there's a couple of things that you've said were very important. One being of course the inquiry into the COVID debacle. Will you still be pushing for that even if Christopher Luxon doesn't give you a call and have you formed part of the government? Well you can have an inquiry by way of parliamentary questions every day. We're going to have a proper inquiry within a year, finish it off and respond to the people who have been in our view misled, maltreated and it is there to be considered in the considerations going forward. So we're going to press on with that no matter what happens tonight. This campaign everybody wrote you off and then David Seymour and the Labour Party attacked you and you're back in Parliament now. Have you got a message for either of them? Well in the big picture we're looking going forward at ensuring this country recovers its economic and social circumstances from what is a clear position of crisis in so many places and whatever they might have said that's their job but that's our job now. We're going to go out and fix these fundamental things up with our economy and our social life. I mean that's the thing isn't it? Christopher Luxon is going to now have to sit down and get an actual state of the accounts and things might be a little bit different from what they've promised. Oh I know that about it. I mean I thought that when they were talking about the pre-view that's a pre-election fiscal update on the 12th of September they hadn't seen with clarity and acuity the true state of the economy. They need to open the books tomorrow and the next week and find out the true circumstances because they look and will be much worse than we thought. Chris Hipkins has been talking it up all week that there was a surge on that they were going to come back. You stated quite clearly you wouldn't work with Chris Hipkins or the Labour Party. Are you satisfied with the result that Labour looks like they've got about 25-26%? They need to understand that when they got the election victory of 2020 it wasn't them and tonight they've found out by themselves they were a mess month after month and this is a massive loss from having more than half of Parliament last time to now having such a small number in Parliament. It's been a shocker for them and I hope the day and their supporters will have learned some lessons from it and there I say at the mainstream media and their work supporters so to speak. The mainstream media have certainly been running an agenda against New Zealand First. The National Party and the ACT Party also pretty much didn't send too many people our way certainly on my show but I found the New Zealand First candidates were willing and able to come at the drop of a hat onto the show. I look this is a long term matter here. We're looking going forward at a party that's on the rise again that they all dismissed, they all shut down and they so malevolently treated but in the end we've got to be grateful for small nurses in this context. We are on our way back big time. It'll take a little time to ensure that the system understands that. Winston Peters is always the comeback King.  No, I truly haven't. There's too many similar songs. There's a lot in folk songs and singing that's about politics and often the message is more with greater clarity in singing than there is in actually speech making and if you've seen the last four months of sausage rolls and ice cream, people are going to find out very shortly what that means. Chris Hipkins is going to have to buy his own sausage rolls from now on. Look, we always knew that he was going to be a problem that he wasn't up to it but then as it turns out nor was his predecessor. No, anyway Winston you're back in Parliament and you can be very pleased with that result. We've got to wait for the specials of course and that's always your refrain isn't it after every election? Well, you know, people have all sorts of thoughts and be cheering from the rafters but the big picture going forward is as it always was going to be, how good will our country be as a result of tonight's election and what have we think? We've got to make sure we get a far better outcome than we were living through. And that's the key thing. You can make promises all you like during an election campaign but now the rubber hits the road and you've got to look into all of the accounts and see where we're at. I have a suspicion that Grant Robertson has left the cupboard literally bare and there's no reason of debt that we're going to take a generation to pay off. Look, I don't think the commentary and even the economists quite got what happened here. If you go from the preview, that's the update just before the 2020 election to where we would be in 2023 and going forward there's a massive change there. I don't actually read what was going on. They were just too close to it and not looking, stepping back forward and examining it. For example, had a budget of $19 billion more than we did in these four predictions. That's a colossal amount of money. And there's a good chance that Grant Robertson might actually be out of Parliament if Labour doesn't get any list MPs. Is that a good thing? Look, the fact is he tried and he found out that in the end. Pollux is not about the Beltway. It's not about the experts. It's not about a group of university-trained people. Most of them have never done any business in their life. It is about the people and tonight the people have spoken. And I hope they understand that. Better still going forward, they learned some dramatic lessons from it. Whether you're in government or without government your comments are that there's going to be a watchdog someone that's going to hold the government to account or keep control of what's going on. This does though give New Zealand first a good footprint to go into the next election, doesn't it? Well, it's always about rebuilding and going forward. It's only a three-year term, so to speak. But our job is to make sure that those people, that the people voted for us for a certain purpose get us to fulfil that purpose. And that's keeping an eye on things, making sure the public hear the facts and not be drilled down on hype and spin that we actually go forward with our eyes wide open right here and right now. That's our purpose, and we are very, very good at it. That's what our history has been. To say things and do things, to raise a roof where nobody else would raise a finger. We're going to go forward doing that. Well, Wilson, congratulations on getting back into Parliament and I'll leave you now to organise the rest of your evening and watch the rest of the numbers roll in. Thank you very much. Thanks for the time on your show all this time because in the prison climate having independence of messaging, so to speak, is important. It's the essence of the fourth estate in a democracy and we were losing it. Well, that's what reality check radio is all about. It's about giving voice to every political party and every candidate that's out there. You know, we've done over 200 interviews in the election campaign. A fair few of them with New Zealand first, but that's because they always said yes. And that's our mission. Our mission is to challenge the mainstream media and to get the truth out there and you'll welcome any time on my show. Thank you very much. Thank you. Thank you.


The second of our architectures is tagging. Tagging is a supervised learning where we have a sequence of words, for example, and every word has a label on it. So we have the word I which would be then labeled pronoun. We have the word went which is labeled verb. The word to which is labeled preposition. The word and which is labeled conjunction. And one could either pre-train again using a self-supervised model where you predict the next word given the preceding words, and then take the exact same hidden state that's passed out of the neural net to the next iteration of it, and use that same hidden state into another simple neural net that predicts the output using a softmax and some other functions. Or one can directly train this up as a entirely supervised model. This is a fairly easy model to train because there's a direct mapping from each word to its hidden state, given the preceding hidden state, to the label. And this is used a lot for trying to label, for example, named entities. Is this word referring to a person? Is this word referring to a country? Is this word referring to a city? Is this word referring to none of the above? So labeling every word with what sort of thing it is.


Good afternoon everyone, this is Melissa with thestockswish.com and welcome. Welcome to BBBY. This is an amazing golden gap that shows the power of the gap. This happened a little week ago. This is last Thursday, January 9th. Today is January 16th and look at the move that the stock has made in just a week. The high of the gap here is $72.25. Low today in BBBY is $66. Beautiful $8 move. And actually I saw this yesterday and I thought this might have been over temporarily yesterday. Look, look what it did today. It opened and ran down the planet again today. This is the power of the gap. You can see BBBY. You can see how this extension on this and really, let's just look here and see. Here you see where it went to. It may push back against itself here temporarily, but I still think this has a look here. Here's the next area in this. So a swing trade in BBBY, you know, you could have been out of it today or yesterday. Longer term here down into $64, $63.50, really $61, $60 bucks, look at that. Very, very damaging gap and this again teaches you and tells you the power of the gap because the stock closed up here. This is on the 8th. This is on the 4th at $79.68 in the morning, the day of the gap. This was last week. Look at what it did. It's a day trade, gap down, held and it has run off the planet. This was a really, really beautiful play here back on the 9th. Now again, I don't do anything but day trades. So I'm day training the stock intraday and I'm flat every day by 4 o'clock. But you see if you wanted to take these as swing trades or core trades, a beautiful extension on this. This is all based on the power of the gap. I originally created my system to rate gaps. I was looking to find a way to see in the price points how weak the stock was, the stock symbol, the price of the gap, to be able to trade it for utter total, just incredible weakness as it turns out because my system is so specified, so specific, so focused in the detail of reading price weakness that as a bonus, my rating system teaches people how to take these trades, these gaps, as an intraday trade and a swing and core trade. I never made the system for that. But I've been tracking this now for quite a while here to see really the follow-through of this continuation. It's amazing. It's amazing. The fact that a stock like this can drop on the day this much and have a bar like this on the day, the day of the actual gap, have an extension like this where it's over $3 and then continue on a fall off the planet into itself even after the fact to run down $8 is amazing. And that's the power of the gap. That's why I like to trade gaps. That's why I like to do gaps. That's why I like to make money on the short side in gaps and you can see here when people are long a stock and they are all of a sudden either A, down money when they were up or B, they were up and now they're up but not up as much, not up as much by a lot. Do you see how this creates the panic where the selling comes in and in and down and pushes it down? This is selling, selling, selling, selling, selling. That's what's making this push on down here. That's why there's absolutely no green at all. That's why the green is a dink.  Because there was no one that was short BBY. If you were, it was crazy. No one was short the stock. People were long the stock and then the gap happened. So all of this is selling. It's creating a selling pressure and it's coming into it. And that's where when you short things, when you see the selling pressure, when you read it in the gap, you're making money on the short side by shorting into the selling that's taking place. It's the selling, the selling pressure that helps to push, that first of all, A makes the gap. And the second of all pushes these things in these tremendous directions because it's like a dump. It's a dump when people are long the stock. They're dumping it. They're saying out, out, out. Some of them are getting out and they're down. Some people are getting out and they are still up but they're not as much as they were and it's painful. It's painful to be up in a price stock where you're up money at over $80, $80, $50 and then all of a sudden you get up in the morning and you've given back $10, $10 worth of profit. That's painful. It's more painful to be down but either way it still smacks. And so what's the right thing to do?  They say, oh, and not everybody understands gaps.  And then eventually they say, wait a minute, maybe we should. Yeah, let's get out. Oh, we better. And then they get out. And so do you see how it's lots of times when you see something gaps against you, the good thing about learning gaps is not only can you learn gaps to trade in the correct direction of the gap when it's a highly rated golden gap over 20 points. You also can use my system to exit along. You could be in this long. You get up in the morning, you rate the gap. The gap rates over 20 points. As a bearish gap, you say, oh, I better get out. I'm getting out. I'm not going to hold this long. I better get out. This is real. This is happening. Militious shorting this, I better exit my long and then you get out. The system teaches how large institutional money is actually taking a position in the stock, whether short or selling out of the longs, either way or both. And that means you want to not be against those people. You don't want to be against those people. And so if you're along the stock and you see this selling pressure come in, you need to exit it. Because it's going to push it down and it does push it down and you see how this is. This is the amazing thing about gaps. There's no reason as far as I'm concerned to trade any other strategy. Why would you? Why would you need to? You don't. You can day trade and swing trade and core trade. One strategy using one rating system. It's an amazing thing. And again, I did not make up my 26-point rating system to swing or core trade. But by golly, it can be used for that purpose. And even I, even I sometimes when I see these moves and things, I'm like, and I love it. Because even though I didn't play BBBY every day in the last week, I love seeing this thing. I do it the day of the gap and sometimes I do continuations. But I haven't been in this for a week and still I'm in love with this thing. Why? This is like a vertical drop. It's a vertical drop. It's a vertical drop out of the sky. It's really, really good. So this is Melissa with the stockswush.com. If you would like to learn my Golden Gap point rating system, the 26-point rating system to learn how to rate gaps to find these stocks to play in the day, to make these money in them as intraday trades, day trades, swing trades, core trades. And to see them, spot them, get the conviction in them, and know that there's true weakness here when you get the rating over 20 points. You can email me at molissa at the stockswush.com for more information. There's a Golden Gap class this weekend. Saturday and Sunday, January 18th and 19th. If you would like more information or want to sign up tomorrow is the last day to sign up for the class. Feel free to email me and I'll send you the information molissa at the stockswush.com. I still have a few spots left. It's a great time to learn how to trade gaps right here during the first quarter earning season. What an amazing move in BBBY. Golden Gap, fantastic, beautiful show weakness. This is Melissa with the stockswush.com. Have a great evening, everybody. Relax, enjoy your night, and have a good one.