The last lecture of the term that's not a review, so Friday we'll review. But today we're going to talk, sorry, this bug on the slide, I'll fix it after class, about Atlantis, robust, extensible execution environments for web applications. So this is a paper by James Mickens and Mohan Dawon. James is a researcher at Microsoft Research, was recently a visiting professor at MIT. And this is really, so this paper takes us a little bit out of some of the sort of core topics we've talked about in the class. But I think it's a nice way to look at the impact of exo-kernel design principles, because the way James describes this is really as an exo-kernel web browser. OK, so no new members of the 100-hundred clubs, sadly, hoping that we'll pick up some over the next week. There's some groups that are getting pretty close. So we're currently at 83% for the course evaluation. So I am going to release a medium answer question, again, as soon as I write. And I promise I will do this by Friday afternoon. I'm going to start writing the exam tomorrow. As soon as I write these questions, I will release them. You guys will have several days to look at them. But I'm hoping that by the time tomorrow rolls around, we'll be at 90%. And I'll be able to release half of the points on the exam before the exam starts. OK, so today, now I thought about writing slides for this, but here's the problem. You can't outmikings James Mickens. This is an actual picture of James Mickens that I found on the internet. I'm not kidding. This is not Photoshopped in any way. It's a little, he's not quite that wide. The picture is a little out of scale. But yeah, so he is also in several bands. All of his bands consist of one person, which is James Mickens. So he's in several one-man bands. OK, so what I'm going to do today, the first time this semester, the first time in 421-521 history, is show a video of James giving the presentation for this paper at SOSP in 2011. Now here's the only problem. And you may be able to tell this already. For some reason, SOSP 2011 was filmed from outer space or something. Like this video is incredibly blurry. That's just not the preview. It's all just about that blurry. So you can't really see it. So what I'm going to do, instead, is I'm going to use James's PowerPoint slides. And I will play the audio and try to keep the slides in sync. So let's see if this works. OK, there we go. Now over here, oh, don't do that. Don't do that. No. This is sad. OK, well, I guess what I'm going to do is go over here.  This is a very traditional model of the browser which had all this coolness and layout and very post-inducing, and all that. And we're going to strut that interface down. We're going to bring it back to the interface. It's long, long, and we're going to very low-level make the interface mess, again, low-level, and stuff like that. And then we're going to allow the game itself to specify a HTML part. It's not going to be without an interface. So what's nice about this architecture is that it allows the page to manage a new blessing, now that it has a lot of this sort of trucking browser that are correct. Now, I know what you're going to say. All right, so I'm going to pause a couple of times during this just to sort of answer questions. So look. And again, this is, I think, one of the best illustrations of the design principles. Feel free to stop. Clearly, James doesn't care if we interrupt him. So if you guys have questions, just raise your hand and I'll pause the video. But despite what you know or do not know about web browsers, and he's going to get into this in more detail, current web browsers are forced to implement this incredibly complex and large API. So modern web browsers do things like layout. They do things like parsing HTML. They have to run JavaScript in the web browser, which is like a Turing-complete programming language. They're forced to deal with all sorts of new media types that are part of the HTML5 standard. And so what happens, and again, he's going to get into examples of this, is that it's very difficult for every web browser, and maybe impossible for web browsers to implement those protocols consistently. So how many of you guys have ever done any web programming or web development? Okay, how many of you guys have ever noticed that things look different on different browsers? The same code. You guys are kind of used to this, but this is ridiculous. This is not okay. We've grown up with this. You guys have grown up in this sort of broken world. Imagine if, because in theory, the web browser is supposed to do the same thing. So imagine if different versions of Linux sort of treated the system call interface differently. So for example, if you did a read on one version, you might get a read from where the last read took place. You might have to move the file pointer on one version but on another version. So it's this sort of, these type of quirks that drive well developers' nuts. And so James' idea is look. And in addition to the correctness issues of just getting things to look right, which is really frustrating for web programmers, there's also all these security problems that are caused by this massive code base that the web, that the browser has to support. And so James' idea is let's, and remember, remember the exo-kernel design principle. Operating systems are in charge both of multiplexing resources and providing abstractions, but they don't have to do both. I don't have to intermix the two. And so what we're going to end up with here is a very, very stripped-down exo-kernel which is responsible for doing very simple things, like he pointed out. For example, drawing pixels to the screen. That's a very simple interface. And everything else that you're used to being part of the browser web stack is now going to come along with the web page. And web pages can specify the execution environment they want. Do you guys understand the design principle here? All right, let me let James continue to motivate this because it's pretty funny. Why do we need another browser? After all, you can occur drawing special friends in exciting months, like Farmville, like Weirdin' That App, like Online Dating, and pictures like this. It doesn't even matter if it's a screen. Now, that's not very sure, but there's a general seeker about the web page, and that seeker is an attribute, but the protocol is actually a huge asset. So what are you thinking about an attribute but a protocol? Well, a browser stack is more than an application to be presented as a better product. If it is more than an application, then we'll see that it's actually a structure and a better limitation than ours. If it's more than a job server, it's more than a site interaction, if it's less than a four job server stack, it's more than a regular structure. And also, the non-mines are a lot of jobs that are interactive as a browser. Now, in no case will you all see that, because I don't know why, so that's what the web protocol is all about. And while we're talking about plug-ins, let's all look at the civil, let's look at the glass, and the width of it. Don't get into video attacks with these new suggestions that I have to bring to my side of the app. And long story short, there's not much time to do that. As it turns out, writing a web browser requires reporting all these different protocols. And don't forget, if you're a web developer, you're already asking which version of the protocol is the brownie that's trying to target. Right? Because they're very, uh, not those ones where there's not all these protocols. So that should be enough. So, there are two locations to the fact that this area of classification is huge. The first location that no single browser will ever get around. I mean, the principle we're told by a professor that standard is important. Right? But in practice, we have to do web models that there's so many standard and they're so complex that it's going to be impossible for any single browser to provide a lot of communication to standard like, please, you know what you're going to do. Now, the second problem that comes with it is that each browser will be able to use in different ways. Okay? This is smart practice. Right? If you make any two browsers you're going to know, fire up, IE doesn't matter. If you want your web page to run on both of those browsers, you're dealing with two sets of documentation works. You're dealing with two sets of documentation efficiently. Okay? So this is an extremely problematic. So you're going to have to use some case study to show you how the browser will build and then will look back at it. Now, that discussion is going to motivate the design implementation on your web browser. You're going to get these slides of implementation and then I will also give you some way to work and I'll teach you a little bit about it. Okay? So I go up and I say, well, man, these web browsers are terrible. It puts the professor's professor in the lab with a game on them and says, J, wait, he's calling. When I go, he's got some trash and he's got some library, but J, wait, he's doing it like that. It's going to hide a little bit of the line in the middle of the lab and it's going to be cool to consider a basis to be running out. So, this is probably going to keep other people attentive. But even if you make them aware of the web browser and they don't want it to be tampered, when essentially you think they're going to tell you, it's going to look like a nice little element of what's in your part of the building. And so, for most people then in these browsers, it's going to take a day or two and then it's going to present a nice browser interface to a new web app. Now, anyway, actually, browsers are murder scenes. Okay?  Like if you guys have written, I use jQuery, right? And probably before seeing some of these examples, I would have responded the same way that these mythical professors that James Benz time talking to would do, which is I would say, who cares, right? I mean, the right way to deal with this problem is to build JavaScript libraries like jQuery that are able to hide the complexity, right? But if you guys have written code for websites, you know. Particularly, I mean, I always find this with layout. I only recently started to actually write much JavaScript and do sort of client-side JavaScript coding, which is really cool. But even when you're trying to get layout, I mean, how many people have had to use weird layout techniques that tried to get things to work on multiple browsers because they just wanted something simple to work, right? Like I want to be able to center something. You don't think that would be so difficult. And yet you end up with four lines in your CSS file, one of which is parsable by WebKit, one of which is parsable by IE version 7. And if you want to talk about IE pre-version 6 or something, just forget about it because it's like a whole different standard for HTML. It doesn't even, it's nowhere close, right? So you have to sort of give up on those people that are using those old browsers. Now maybe those people deserve to be abandoned anyway because they should update IE and stop using IE altogether in general, but anyway. So I mean, if you guys have done Web programming, you've probably encountered these sorts of problems. Despite the fact that things like jQuery have been around for a long time. But so let me allow him to use some examples to try to convince you why jQuery is not a magic bullet. So James said in the first round, round one, let's say you have a very simple web page in here. You've got a plug inside of the data inside of the HTML tag. First, you go right. So the round one does is going to take the station on the form of the DOM tree. The DOM tree is an H that's right at the top of the data structure. We're going to have another verb attack in HTML structure. So my example of one is going to be this event propagation problem. Now, the standard of human life, there is an official looping page in this problem. The category is a target-based model of it. So the looping I have learned, and during the catch-base, the browser is creating the path. And that's a composational tag. All we have is a secondary looping in this case of the web. So the browser can catch a phrase in the event it's a relational tag of the DOM code. So it's having to find the catch-and-hand. The interest test, so that the browser has to set a line. Then it takes you to make a non-prolificative loop. To the loop it's not going to catch a phrase. And then the browser needs a non-prolificative loop. Ah, now we're at the target-based in the natural rate of the minute. So what has a non-prolificative loop in it is well-picked. So we trace that reverse tag in the catch-and-hand. The did tag has a non-prolificative loop in it that has to be complicated on the long-node. It has a non-prolificative loop in it. Now, one. So here's the bottom line. I just want to pour up that main-free base in it. Right? That's all I want. Now, Farfax says, yeah, OK. I'm going to say, yeah, OK. I am not going to say, yeah, OK. I am going to say, I will not support the catch-and-hand. Cheers. Yeah, yeah, the process is good. Now, this is huge and problematic. Why does it have to pull the catch-and-hand? Because if the browser is a non-prolificative loop, maybe, right? Some of these non-prolificatives are wider.  Other than the non-prolificative loop, they're a little more minimal. But they still possess a little bit of a characteristic. And then they're non-prolificative, so pour up the line.  So, James Victor's browser is in the end, R2. So, let's say, I have a kind of like NMAX from San Francisco, right here. So I take my mouse and look at that X-box. That's very little to focus on. OK? And I'm tying my key into that X-box. Then I take my mouse and move it somewhere else. And I grab the board, or at least it should. So here's the bottom line. I just want the board that the boy can have if I actually want that. What's going to happen? I even tell your dad. Chrome is going to say, sometimes I'll write it. I'll just have to see what's going to happen. I'm going to say, one board, I'll give you a board. In fact, I'll give you one board. Once again, these non-prolificatives are not for people. I don't really know. I'm afraid of it. So the bottom line is, what I'm going to do is I'm going to specify, now the size of the percentage of the board is young. So the first one, take it here. I want one to be slightly smaller than the other to be as specified in the percentage of the equals in the data size. Basically, I want labels like that. See what the person in the NASA can do. Feed my health, please. I don't trust it too much. Well, I just say, yeah. And then this is going to happen on most of our events. Why do you want that? There it is. Oh, it's there. And in fact, this is why it's so bad. Right?  OK? So what do you have to look at?  In other words, what's in it? Why does it happen? Well, this happens because of the respect of the web page of the developer and yourself. The HTML, the state department, the government, it's all completely different. Basically, you have to develop an informational CSS to this black box partial parameter. And then you go over to that. You get an all string, you get a bitmap. And then whatever happens, acts. Only if you plan a table out of the browser. So John's script is a very introspective one. OK? It's very popular with other people. And so this is very common, if you want to do a full learning action. You want to add a game page to your computer, some cool assets. So for instance, let's say there is a publication of an object, you know, a function on that object. So what you can do with it, enable the browser to just get on the drive. This is a login and reboot. And so if I have a decision to that old member function, then it's going to overwrite that function with a login function. The decision is lost back to the game. It goes back to the game. And then it goes to the number one. And it's back. Well, I can use that. I could run, be there, and go to the web, and go around. See, it's very, very, very much the same. Why does this happen? Well, the reason this happens is because we can see lots, lots of objects in the browser. And they're reflected in the JavaScript. So it's going to get an element that looks like this. An element you're going to find in the add-ins. So you can do the global orchestration, right?  Think of the browser proper as kernel reference equal to a wall. And here, the object, though, is essentially looking at the user layer. So you're going to just add a kernel to a wall there. Now, what happens is that you're going to get an add-in. The browser is going to just unfathom the lease. So what happens is the browser has all these internal references and all the stuff that exists in your world up to the user layer. So what this means is that when you try to do that, when you try to do these static displays, then you can only see that reference that is left on the lab. But when you start sharing anything, and you can create stuff like that, sometimes you disturb a variant of what you've got. Because there's only the one where it runs. And that's why this questioner is kind of a cracker. So this raises a full box question. How do you fix all this? And is that from the night of the day way to the evening? All right. So I think this is a good place to just stop and see if PowerPoint will bring the slide up again or not. Let's try to get PowerPoint another chance. Oh, now it's totally. There we go. All right. So again, the way to map this onto operating systems, particularly on exo kernels, is to sort of think of, and it's more complicated because, which is funny, given that it's a web browser, it's an application. But you can think of the program that's running. So remember back to last class, and when we talked about virtualization, it's a lot of effort made to preserve what it was referred to as the application binary interface. So that's the assumptions and applications that are compiled for particular architecture make that allow them to run on a bunch of different machines that run the same operating system. That's the reason you can use tools that install binary programs on your computer that have not been compiled against the libraries that you're using because there's a agreement between the kernel and the application that is expressible at the binary level. There's agreement about how to perform system calls, what those system calls are going to do, et cetera. So this is a good interface. The problem with web browsers is think about it. I mean, web browsers get HTML sources that they have to convert into both a DOM tree in order to allow them to be manipulated by JavaScript but also render them. So those are two separate places where I can get things wrong. Then the browser also has all this CSS that's supposed to parse. And that's its own language. So I've got to take that. I've got to map that onto the HTML and combine the two in some way in order to affect the markup in order to affect what things look like. Then I've got all this JavaScript that comes down with the page, which is, again, a terrain-complete programming language that is allowed to do all this stuff. And if that wasn't bad enough, JavaScript is maybe the worst language. In my opinion, there's a lot of things about JavaScript that I like a lot. But if I was going to give millions of web programmers a language that they could force other people to run who are only guilty of the sin of having browsed to their website, JavaScript is not the language I would have chosen. It has a lot of these. James just showed you these sort of funky properties where you can manipulate JavaScript in ways that are exciting if you know what you're doing and terrifying if you don't know what you're doing or you don't trust the person who's trying to do it. And so to some degree, you can think of the browser as providing an interface. That's what browsers do. That interface is huge. And it's complicated. And as you pointed out, despite the fact there are all these standards about how this stuff is supposed to work, multiple people and multiple companies at various points in time have sat down and tried to implement those standards and produce very different results. And so that creates all these problems that you're trying to solve. OK, let's let James continue. The design of the page. At the top of it, we're going to have a strong and isolated component. Now, we're going to look at the opposite of the interpreter. It is isolated from being in and out of it. And now we're going to do that in fact, we need to get into this problem. And so this is very, very nice. Once you get used to the process of turning it, we'll see that it's happening because we've used all the special features that influence things of the logic of the interpreter and they show them. So what's the indication of that? And there's no change in its sensibility. We're still showing all the problems we have in the whole structure of the component being bi-optimal. All right, so this is another place where I just wanted to stop and sort of highlight the analogy to the things we talked about in the class. So this is, if you guys remember, back to micro kernels, the idea was I would reduce the, and I think there's more security implications here, I would reduce the trusted code base, the part of the code that really has permission to do certain things. Because in the monolithic browser world, you can think of all of that code, all the code that's required to parse and execute JavaScript, all the code that's required to parse and execute HTML as sort of the equivalent of running in the kernel. It's privileged code. Now it's not running in the kernel kernel, it's running in the web browser kernel, but what does this allow it to do? What are some of the things that a malicious web browser, or if I can trick the web browser into doing certain things that it's not supposed to do, what are the types of things that I can accomplish here? I mean, why would people care about web browser security? Yeah, yeah, so that's a great point. The web browser, you entrust the web browser with a bunch of stuff. Frequently those password systems aren't particularly good, but it's a convenience, we use them to fill in credentials and stuff like that. But what else? Let's say you don't do that. Let's say you don't bother with that, I'm not gonna, I don't trust my web browser to store this stuff. What else is going on normally? Yeah. Well yeah, okay, so the point, yeah, there's a lot of chances for a website. If I can trick you to go into a website, if I can launch a phishing attack to get you to go to the website that looks like that one, maybe you don't, so you might go to a website that's trying to attack you and you might say, oh, I can tell this isn't the, this isn't the Bank of America website. I can see it, it doesn't even look right. And then you navigate away, but in the process, that site has sent down some JavaScript that is running your browser already, okay? So if there are vulnerabilities in the JavaScript evaluation that allow malicious websites to penetrate into the browser kernel, they don't even need to steal your password through some sort of phishing attack, right? I mean, people are a lot dumber than this, right? I had a friend used to work at Facebook in security and Facebook had a bunch of problems for a while because people would essentially cut and paste large portions of JavaScript into their web browser, right? Like, people are that dumb, okay? It's like, click on this link to see the Osama Bin Laden death video, right? And what that link actually does is runs in the context of your current Facebook session and sends spam to all of your friends using JavaScript, right? But people are like, ooh, you know, I don't know what this link is. I don't know why this link is like six pages long, but why not? Why not give it a try? So, but again, so let's say I can get you to click on a webpage that sends some malicious JavaScript down to your browser, but let's say you don't have any passwords or any personal information like credit cards stored in the browser. What else can that code do? Yeah, but again, it's running, remember, it's running as an application, so I'm assuming that the kernel is getting its security model, right? Yeah, maybe, I'm thinking of something more fundamental, yeah. Well, yeah, so you guys have heard of tabs, right? You guys sometimes use like multiple web browsers, tabs, and people do this. So the code that's running in one tab, let's say I've got my actual banking site in tab A and I load some code in tab B that's malicious and exploits a flaw in my browser that allows it to sort of inject code that runs into the browser kernel, that browser kernel can see anything. It's not bound by the cross-site scripting policies. It can certainly log the keystrokes of me as I enter my username and password into the other tab. So, particularly tabbed environments. You can think of tabs as apps that are running inside your web browser. Each tab or each new window, if it's running essentially in the same process, represents a new application that the web browser is supposed to run and one of the things web browsers are supposed to do is isolate those tabs from each other. Otherwise, like if a tab could access data from an unrelated tab, then all bets would be off. There'd be no way to make tabs bouncing safe because one website could just randomly steal stuff from the other website as you type data into it. So that's not supposed to work. That's not supposed to be something that can be done. But if the web browser is buggy and I can exploit a vulnerability, then I can do that. And so here the idea is, let's take the JavaScript interpreter in runtime, which it's very unlikely is necessarily, I'm gonna get right because JavaScript is a programming language. Web browsers include a compiler in a runtime environment. I mean, that's again, and I think it's compiled in JavaScript. Just one of the worst design decisions ever made in human history, right? But we're stuck with it, right? We're living with it now. We're living in that world that we created. So I can do that, but I can sort of avoid giving it access to some of this underlying state. And that's the goal of the micro-colonel browser. But as James was pointing out, that still leaves me with these, stuck with a particular browser's implementation of a particular standard, right? So I can't necessarily use this to fix some of the cross-browser incompatibility problems because if I have multiple micro-colonel browsers, they all do things a little bit differently. All right. Okay, so let's do the same process of finding that code of the network, and it's going to be perfect. Now, at this point, do you want to accept that the standard is low and has to be? In this case, let's negate the barcode to the barcode we have here, find that we're great. So if that barcode, I don't actually do anything like a boundary or anything like that. And so, what happened next? You lived from a specific way to do that. That will be a significant amount. You know, I don't know if I can find it, get it over with it. What happened with this one? All right, so does this make sense? So essentially what I'm doing is I'm replacing these fixed components that are involved in web page parsing and running JavaScript with components that the page itself specifies. And then, if you'll notice here, the Atlantis kernel interface. So before this interface involved running JavaScript and parsing CSS and interpreting HTML, now it's bitmap rendering, right? Creating and destroying frames, windows, right? Messaging between frames. It's really simple stuff. Low-level GUI events like clicks and key presses delivering those to the page. And then, of course, dealing with various types of HTTP sockets that would be probably used by most modern web pages, by JavaScript libraries to do, to sort of create interactive web pages, right? So I've taken this big, buggy, complicated, huge, you know, standard of an interface, and I've reduced it down to the tiny, tiny number of things that a web browser really has to allow pages to do. And I can potentially do these very safely. And I've moved all the complexity up until this upper layer, which the page itself can actually specify. So the page knows exactly how its HTML is going to be parsed. So let me try to explain what's happening here, if you guys haven't done, don't understand how web browsers work. So again, I mean, the interactivity of web browsers you guys are used to is entirely due to the fact that there's a programming language called JavaScript that's running in your web browser, and it is able to manipulate the page at runtime. So if you guys use things like Gmail, or any sort of, basically, if you use a modern web page, you know that this happens. There are changes to the web page that happen that don't involve you doing anything. And even if you do do things frequently, the changes to the web page are caused by JavaScript. There's JavaScript that runs in Gmail when you perform a certain action, and it does a bunch of stuff. It probably sends a message to the server saying, she just archived this message, and then causes the message to be removed from the list of messages that are in your inbox. That's all JavaScript, but that page is being manipulated at runtime by, that's sorry, the page is all HTML. It's being manipulated at runtime by JavaScript. And if you want to see how bad the world is without these features, how many people have tried using Gmail without JavaScript, like the super slow connection version? I don't even know if that's still available.  It's really sad, you have to click, you have to hit buttons all the time. It's really terrible, it doesn't refresh itself automatically, it's just not good. Unless you have a problem with email, and email addiction, in which case I would strongly encourage trying that because it will probably help you. But here what's happening is that, what I'm doing is let's say there's a comment box on the page, and you've entered some information into that comment box. And what I'm doing is I'm taking the parent element, or I'm taking some element on the page and I'm replacing it with the data you typed. So for example, you might have entered something and do a comment box, and you hit submit, and in the past maybe what would have happened is that submit would have caused a post to the web server, and the web server would have responded by redrawing the entire page, but we live in the future now. And so JavaScript does this internally, just updates an element on the page using the data that you've entered. The problem is, if this is poorly done, now there's ways to do this safely, this is a bad example, don't write this code, but if this is poorly done by the JavaScript developer or by the website developer, they may have caused the web page to execute JavaScript code in that pages context. So you, and this is sort of what created these problems, these certain Facebook vulnerabilities that people discovered. It was there were ways to get Facebook, if you cut and pasted certain code into Facebook, to run that code, that JavaScript code, as Facebook. So Facebook's JavaScript libraries, because of the cross-site scripting policy, have access to all this internal information, all these data structures about you that they use to render the page, things like who your friends are and stuff like that. And they can issue requests and queries to the server to find out other stuff and those queries are coming from the page and so the server is gonna respond to those queries. And so if you can get a website to execute JavaScript code that you wrote, you can exploit that website in all sorts of fun ways. And if that website's a banking website, you can imagine all sorts of nasty things you can do. So this is bad, okay? And this is something that we would like to avoid. So, and James will talk about how you can use Atlantis to avoid this type of thing, because the thing, the problem is again, web developers do this stuff, they're not all heroes. They don't all see you, they just get to you, and you get time, you get to know them, and you can do some more in the back of the show how you listen to them in the paper. It wasn't nothing about this architecture that now we don't have to wait for the browser to open up an interface with any question of integration. You can just do the back of the page, pull over there, and it's on here. And so the query shows that they load on the script. All right, so just to try to explain this completely. So what I'd like to be able to do is take the JavaScript on the page, take the page, and alter the way the inner HTML property of DOM elements works. So that when I assign to it, or perhaps when I read from it, I want it to sanitize its content. So I want it to take its content, and there's ways to take that content, and if it's JavaScript, if I can detect this JavaScript, I could just fail or crash the page or whatever, but I could also take that JavaScript and run some text replacement on it to convert it to text that is not going to be interpreted by the web browser's JavaScript. So at that point, the web browser would be like, this is weird, I don't know why this person wrote a bunch of JavaScript into the comment box, but that's cool, I'll just put it on the page properly formatted, and I don't know why. Maybe it's a coding website, maybe that's what they wanted to do, right? But it won't execute the code as JavaScript or try to avoid. Okay, I'll just go through the rest of the slides. So they chose some performance results, you might think that there's a penalty to doing this, it turns out the penalty is pretty slim in most cases, and look, this is a prototype, so you can imagine optimizing this in the future, and then he goes through some related work. So any questions about this? I think this is a nice project. What were we talking about? Yeah, yeah. No, no, no. Okay, sorry, let me make this clear. This is a developer mistake, right? This is a developer error, but the point is that it's possible that I want my web browser to fix things like this automatically. So I might want to say, this particular version of the DOM tree does not allow inner HTML things to be set to JavaScript or be executed as JavaScript, right? And so the idea is this is, yeah, if I have access to this code, I can fix it, right? If I don't have access to this code, right? And that's why I'm saying I can just, if I realize this is a problem and people are exploiting this vulnerability, I don't have to wait for developers to fix their web pages, right? With Atlantis, I can just fix the web stack, right? And do it that way. Or a developer that's worried that their page might have this vulnerability, or a company that's worried can fix it in one place and then use that runtime on all their web pages and fix all the problems at once, right? So that's the other way, this one. Questions, yeah? Yeah, so there's definitely some penalty the first time. So what they do, of course, which is the obvious thing is they hash this, right? This is sort of like other static browser assets. So the question is don't, isn't this gonna cause page load times to go up quite a bit? Because the first time I load a page, it uses a new Atlantis set of libraries. I have to out down those libraries and execute them? Yes, absolutely. I think James's argument would be that there aren't going to be very many of these. They aren't gonna change that often, and so the penalty is sort of minimal because I download it once and then a bunch of pages use it. And I can keep it around, I can cache it the way I cache other static browser assets, right? Good question. Yeah, uh-huh. Oh gosh, I will confess, I have not looked at the paper details recently. Can you ask the question on Piazza? And I'll answer it. Yeah, sorry. I've been caught. Yeah, this is just a cool, I just like the idea of this paper. The implementation is interesting to those, and I will be happy to answer that question. Other questions? Yeah. But remember, so remember, the page gets to specify its own resources, right? This is what's critical to understand about it's very similar to an XO kernel. So an XO kernel application can be compiled against libraries that are built that use the XO kernel interface, but it can use whatever one it wants, right? So this is sort of the dream of XO kernels. I could have a Windows flavor library and a Linux flavor library and a BSD flavor library, and an application gets to choose whatever it wants, right? And when it's loaded, it sort of says this is the runtime I wanna use. Atlantis is very simple. So pages have full control of this. Can it expose pages to vulnerabilities? Of course, right? That, you know, again, no one is ever really going to know everything about how a particular library works, particularly a third-party developer, but what it would allow you to do is, if you're a developer and you wanna make sure your page is safe, not only do you have a lot more certainty about layout, but you can use a library that's updated frequently that responds to security vulnerabilities, right? It's a lot easier. So this is another interesting point about this product. It's a lot easier to patch something that gets loaded at runtime than it is to patch the thing that's loading it, right? So people may have been ignoring the Windows Update thing for weeks and not seeing that there's a new version of IE available, whereas the page can respond immediately. So as soon as there's a vulnerability located, the developer of the library can fix it and the page can get the new code. But this is a huge problem, actually. So just anecdotally, this is also something that frustrates Google about the Android ecosystem, because Google is very good about patching Android to respond to security problems. But the problem is, they patch it, they release a new version of Android to the vendors and then it sits there for days, weeks, months sometimes. So they have these security concerns about Android because of something they've known about. They fixed it three months ago, but sadly you don't have it yet because Verizon has not decided to roll a new platform update. And so that's sort of a similar analogy of what would happen in a browser. You have to rely today on Microsoft, Mozilla, Google to fix browser security problems. With this architecture, you don't have to do that. You can get the fix as soon as it's available. And I'm sorry, you have to rely on those companies to fix the security problems and push updates in a timely way. And to be honest, I mean, how many times do you want Chrome to update per day? With this, you can update the library much more quickly. That's a good question. All right, so on Friday we'll do, we're just gonna do sort of an open mic, ask me anything style review session for the exam. Hopefully by that point, you guys will be at 90% and I'll have released half the exam. So I will see you guys on Friday.


Ladies and gentlemen, the story you're about to hear is true. The names have been changed to protect the innocent. Dragnet, brought to you by Chesterfield.  By America's most popular two-way cigarette. Chesterfield, they satisfy millions.  You're assigned a robbery detail.  She can't describe her assailant. He's still at large. Your job? Find him.  On every count, they satisfy millions. They'll satisfy you. Chesterfield is the cigarette proved highest in quality, low in nicotine. The cigarette tested and approved by 30 years of scientific tobacco research. The cigarette with a taste and mildness you want. Yes, the Chesterfield you smoke today is the best cigarette ever made. Best for you. It all adds up to Chesterfield's world-famous slogan. They satisfy. Regular or king-sized, try Chesterfield today. The documented drama of an actual crime. For the next 30 minutes in cooperation with the Los Angeles Police Department, you will travel step-by-step on the side of the law through an actual case transcribed from official police files. From beginning to end, from crime to punishment, Dragnet is the story of your police force in action. It was Monday, January 14th. It was raining in Los Angeles. We were working the night watch out of robbery detail. My partner's Frank Smith, the boss of Chief of Detective Stad Brown. My name's Friday. We're on our way out from the office, and it was 1147 p.m. We got to 7982 Oakwood Avenue, front door. What is it? Police officers. We'd like to see Miss Grippin. How do I know? Big part. How do I know your cops? Here's our identification. I'll hand it here. Pardon? Pass it through the door. I want to see it good. All right, there you are. Yeah. What do you think? Well, your guess is good as mine. Come on in. Thank you. Hurry up. Don't let all the rain in. Yes, ma'am. What if I have my identification back, please? Take your coats off right here. I don't want you tracking water through the house. All right, could I have that identification card? You don't mind my being so careful about what's happened here. I've got to take all precautions, you know. Yes, ma'am. Come on into the sitting room. I'll take that card. Thank you. Which one of you is Sergeant Friday? I am.  That's right. Who's he? This is my partner, Frank Smith. Uh-huh. Well, sit down. Here's your card. Thank you. Can I get you anything? Cup of coffee? Maybe some hot cocoa, ma'am? No, no, no, thank you. I'll suit yourself.  We understand you know Mrs. Kiran. We're neighbors. Uh-huh. Maybe you can tell us what happened here tonight. Seems like you'd have the story being cops and all.  All right. I was here tonight watching the TV, just gone out to the kitchen to get a play to snacks for the late show. You know, kind of like to munch. Uh-huh. Well, all of a sudden I heard this scream real loud. I wasn't watching the television right then, so at first I thought it was from the set. You know, like a drama. Yes, ma'am. I didn't think nothing about it right then. Got myself all settled for the movie, and then I heard another scream. That's when I knew there was something wrong. How's that? There was a quiz on the television, no reason for any screams. Right then there was another one. Then I knew it was from next door. Yeah. So I got my coat and umbrella and went over there. I see. Knocked on the door, but didn't get no answer. Well, I went into the house. All dark, not a light on. Went right in and called Mrs. Kiran call to her. Uh-huh. Didn't answer, but I could kind of hear something off to the back of the place. Uh-huh. Sounded like somebody crying. Kind of like a whimper, soft. Yeah. I came from the back of the house in the bedroom. You didn't see anybody else in the house when you went in, did you? If I had, I'd have told you before this. Go ahead, please. I got to the bedroom and opened the door. I couldn't see anything at first. Uh-huh. Then I was about to go on in, and this man jumped out at me. He was in the bedroom, was he? Yeah, I must have been hiding in the dark and heard me coming, and he got back so I wouldn't see him. Then when I opened the door, he jumped right out, almost scared me to death. Well, what did he do? Just jumped at me and ran out of the house. Right through the front door, I heard it slam. Uh-huh. And then I heard the crying again. It was sort of off to one side of the room. I couldn't see right away where it was coming from. Uh-huh. I turned on the light and right away I saw her. She was laying on the floor. Oh, it was just terrible. Room was all tore up. All thrown around, a real mess in her land right there in the middle of it, all beat up. It looked like whoever'd done it tried to kill her. What'd you do then? Call the police. Dialed O, told the operator to send a policeman. It wasn't long before they was here. It seemed like there was a hundred of them, all over the place. All right, Mr. Griffin, I wonder if you can give us a description of the man you saw. Other officers asked me the same thing. As much I can tell you. Just all of a sudden, he was there, and then he was gone.  Certainly, I guess I know a man when I see one. Been married to one for 22 years. Yes, ma'am. Can you tell us anything about him? I just got a glimpse of him, not good. I can't tell you anything, but how he looked. He was standing in the dark when I come in. Next thing I do, he jumped past me and went out the front door. Yes, ma'am. Would you know him again if you saw him? I don't think so. Just a glimpse, that's all. I'd like to help, but there isn't much more I can tell you. All right, ma'am. How is Mrs. Karen? She gonna be okay. Well, she'd be in the hospital for a few days, but she's gonna be all right. Can she able to tell you something about the man who did this? No, ma'am. Seems like she'd be able to describe him. Must have been there for a good half hour. How do you figure that? Must have been at least that long from the time I heard the first scream till I got over there. First off, I didn't think it was real. Thought it was on television. Yes, ma'am, you told us. Must have been a half hour. Now, did Mrs. Karen have any enemies that you knew of? Well, there's some people who didn't like her. A couple right here in the neighborhood, but none of them that would do a thing like this. How'd she and her husband seem to get along? I mean, did they have any fights? Yes, that's right. All the time. Seemed like they was always battling about something. Would you know what caused the arguments? Mostly about her, another man. He thought she was running around on him. He used to fight about it. A couple of times, he said if she didn't stop, he's gonna kill her. Was that true? You mean about her and the man? Yes. Well, it might have been. For all I know, it didn't pay much mind to their troubles. Seems like I had too many things to keep me busy without getting mixed up in their problems. All right, Ms. Griffin, we'll leave our card with you. If you remember anything you think we'd be interested and we'd appreciate a call from you. If I think of anything, you get one. Thank you, ma'am. Don't it seem kind of funny to you? Well, what's that? How Mrs. Curran can't tell you anything about the fella? Don't that strike you kind of odd? How do you mean? Well, if somebody is in my house for that long, I'd be able to tell something about him. Something for sure. I guess with the lights off, maybe she couldn't see. Then again. Yes, ma'am. Maybe she don't want to tell you. Frank and I drove back to the office and put in a call to Georgia Street Receiving Hospital. We talked to Dr. Sebastian and found that the victim had recovered to the point where she could be moved to her own hospital. We also talked with the officers who were with her. They told us that the woman hadn't given them any new information and that they still hadn't been able to contact her husband. While I checked the crime lab, Frank went down the hall and ran the names Irene and Tom Curran through our and I. 2.14 a.m. We met back in the squad room. How'd it go in the crime lab? I got it all here. You want to take a look? Yeah. Beginning to look like we got a good case against the husband. Yeah. Now here. Here's a picture of the room. The woman was found about here. See? Mm-hmm. You can see the way the stuff's scattered all around the place all through here. Yeah. Looks like robbery. Well, he wanted to look that way, maybe. What do you mean? Well, on the dresser drawer here, the boys in the crime lab found $120 in cash. All the thief had to do was open the drawer and he'd seen it too. Oh. Well, how about the entrance? That's something else that doesn't seem to gel. They checked all the windows and doors. There's no sign of any breaking. She must have opened the door for the thief. Well, that means it was somebody Mrs. Kiernan knew, huh? Yeah, it kind of looks that way. Anything else we can use? Well, take a look here. Here's a picture of a footprint Lee Jones found on the earth beside the path. The way it looks, the thief left the path when he ran from the house and stepped in the soft dirt. Do us any good? Well, not much. The ground was wet. Must have been a good impression, but the rain broke down the walls. It's not much good to us now. That's it, huh? Yeah, Lake and Prince didn't come up with anything. How'd you do? Well, nothing on the woman. Husband's got an arrest record. Yeah. Got it right here. Mrs. Kiernan impinged 18 months ago on a beating charge. Refused to prosecute. Same thing a year ago. And here, besides her complaints, he's been booked for ADW and suspicion 2-11. Doesn't he big time? No, never drew a conviction. No. Now, Joe, the thing I don't understand, if it was her husband, why doesn't she beef him? He wasn't worried about having him arrested before. No, no, no. There's something wrong about it. There's gotta be an answer someplace. You tagged the stats office? Yeah, I gave them what we had on the guy. They're gonna start a run on the ammo in the morning, but they got the rest of this information down to them. Yeah, we can drop it off on the way out, huh? Right. You got that list of the husband's friends? Uh-huh. Let's talk to them. Maybe they can tell us where he is. Okay. Hot shot. I get it. What is it? Stats office is gonna have to wait, I guess. Huh? 1824 studio court. Well, that's a couple of blocks from Kiernan's. What's the call? Woman's slugged. We left the office and we drove over to the address Code 3. It was a small house set well back on the lot. When we got there, a felony car out of Hollywood division had already arrived and the crime lab had been called. The victim was identified as a Mrs. Milo Hudson, age 42. An ambulance was dispatched from Hollywood receiving hospital and she was given first aid. She'd been beaten about the head and shoulders. As soon as the attendance had finished, Frank and I talked to her. If you'll just tell us what happened, please. Awful thing. Most awful thing ever happened to me. Yes, ma'am. Did you get a good look at the man? Pretty good. Not real good, but I did see him. Could you describe him for us? How do you mean? Well, how tall was he? I guess about as tall as you. He'd be about 5 foot 11. If that's how tall you are? Yes, ma'am. How about his weight? Is he heavier or lighter? About like him. That'd be about 180, huh? I guess so. I don't know, but I guess that's about what it is. What about his face? Did you see that? Yes, sir. Got a good look. You'd know him again if you saw him, would you? I certainly would. Never forget that face. Not if I live to be a hundred. I'll never forget it. Well, could you give us a good description of him? He had dark hair, almost black kind of curly. Little wave right here in front. Had blue eyes, dark blue might have been kind of hazel color. Dark. Was he clean shaven? You mean did he have a mustache? Yes, ma'am. No, didn't have anything like that. Was there anything about him that might make it easier for us to identify him? I don't think I know what you mean. Well, did he have any scars, any birth marks, anything like that? Let me think. Seems there was something, but I can't remember what. This man say anything to you? Not at first. When he came in, he didn't say a word. Just pointed the gun at me and motioned back into the house, like he wanted me to get back there. Uh-huh. But he did say something to you later, is that right? Yes. Well, we got to the bedroom when he started to go through the place. I told him he'd better get out, because my husband would be coming in any minute. I see. He smiled and said he knew George didn't get home till 4.30. He used your husband's name, didn't he? Yes. Come think of it, he did. I didn't pay much attention to it before, but he did. Do you think you ever saw that man before? Not that I remember. But you're sure you'd know him if you saw him again. I sure would. See, I remember what it was about him. Yes. You know, you wanted something about him that would make it easier to tell if he was the right man. That's right. He had a scar. Small one right here, by his eye, made it look like his left eye was real big, gave him a funny look. Uh-huh. Is that what you meant? Yes, ma'am. I wonder if you'd come down to the city hall and go through some pictures for us? Well, I want to do everything I can to help. I'm supposed to check with my doctor if he says it's all right. I'll be there. When would you want me? Well, if you could make it in the morning. If the doctor says it's all right, I'll be there. Okay, thanks, Mrs. Hudson.  Might be better if you did. George likes to sleep late and I don't drive. All right, ma'am. We'll call you in the morning. Sure. I hope you can catch the person who's done this. Lord knows how many more people he's going to hurt. Yes, ma'am. Just seems to know all about people. When they're going to be alone and all, seems to know all about them. Uh-huh. You knew right where everything in this house was, all the way. It's not tea. You're sure you never saw him before, is that right? Positive. You don't forget that kind of face. See it once and you remember it all your life. Well, has there been anybody new in the neighborhood? I don't understand what you mean. Well, like any salesman, door-to-door canvases, anything like that. Residential neighborhood like this, there's always somebody around trying to sell something. Must be a couple of people a day come to door. But I'm sure the man who hit me wasn't one of them. All right, ma'am. Thank you very much. Not at all, Sergeant. I want to do all I can to help you get him. Do you have any idea who he is, where to find him? Not very much, Miss Hudson. Terrible to think about it. Men like that roam in the streets. Woman isn't safe in her own home anymore. We'll get to him, ma'am. I should hope so. But what do we do in the meantime? Just sit here and wait for this lunatic to kick the doors down? Well, we'll do everything we can. Awful. I'll never forget how he came in here, shoved me around. Just never forget it. Well, that makes you even. What? He won't either. We got out of supplemental broadcast killing the description of the suspect, and then we continued to talk to the latest victim. She was unable to come up with any additional information. 4.30 a.m. The crew from the crime lab finished up their investigation, and Frank and I went back to the office. We left the description of the suspect at the stats office, and we asked R and I to check the oddity file for a possible identification on the scar that the suspect had. 5.21 a.m. We signed out of the office. The next day, at 9.26 a.m., we met with Chief Brown and Captain Donohoe, and we went over the case with them. Because of the method of operation used, it became apparent that the thief was acquainted with the habits of the people in the neighborhood. Two additional teams of men were assigned to the case, and they began to canvass the area for information on people who appeared to be loitering in the vicinity. It was also decided to assign three more police units to patrol the streets during the night hours. We checked all F.I. cards that had been filed in the area. That afternoon, Milo Hudson came down to the office and went through the mug books, but she was unable to make an identification. She was shown pictures of Tom Kieran, the husband of the first victim, and she stated positively that he was not the man who'd beaten her. The list of possibles came back from the stats office and was checked without result. A week went by. In spite of the additional men involved, the suspect hit three more times. In each case, the M.O. was the same. In each case, he escaped. However, we were able to get a little more information on him. We had the artist and crime analysis division draw up a composite picture of the suspect, and we had it distributed to all officers in the city. The daily papers ran out on their front pages. Thursday, January 24th, 5.20 p.m., and we got back to the office from dinner. I want to call Fay and tell her it looks like a late night. All right, I'll check the book. Anything? No. We'll call her from Pinky. Yeah? He and Lightner talked to that magazine salesman. Check out? No. The guy just got in town a couple of days ago. The description's pretty far off. Oh. I got it. Robbery Friday. Yes, ma'am, that's right. Well, we can take it. All right. What's that address again? Yes, that's Studio Court. Yes, ma'am. We'll be right out. No, no. Don't do anything. If he wants to leave, don't try to stop him. That's right. We'll be right there. Woman out on Studio Court. Yeah? Says she thinks the suspect's in her house now. You are listening to Dragnet, the authentic story of your police force in action. Meet the Tom Harmans. You know Tom as Michigan's All-American football star. Now, a top sports announcer. Mrs. Harman is the motion picture and television star at least Knox. They're typical of people everywhere who are saying Chesterfields for me. I like regular-sized Chesterfields. Half for years. They're best for me, at least I think so. Because of that Chesterfield quality. That's the way I feel about them, too. I've always smoked Chesterfields. Now I go for the king-size. Guess I like a longer smoke. No king-size cigarette satisfies like king-size Chesterfields. For the taste you want. The mildness you want. A really refreshing smoke every time. Change to Chesterfield. Regular or king-size. America's most popular two-way cigarette. Frank and I left the office and drove over to the address we'd been given on the phone. As we pulled up in front of the house, we could see a man standing on the porch. We got out of the car and we went up the walk. At the front door, we met the woman who'd called. She said that the man had rung the doorbell and had tried to force his way into the house. We'd gone home and then she'd managed to stall the man until we got there. We took him back to the city hall and talked to him in the interrogation room. He identified himself as Victor Nadal. Frank went down the hall to run him through records and identification. Oh, the trouble you guys are causing me, no reason for all this. What were you doing at that house? Trying to earn a living. You have to force your way in to do that? That old broad's off her rocker. I didn't try to get into the place. She says you did. She's flipped. Where? Tracked out in the desert. Who do you work for? I don't think I'm going to tell you that. You're not going to get them a note. We're going to find out anyway. I don't want you to save yourself a lot of grief and tell us. If you get paid, you'd dig it out. You ever been arrested? A couple of times. Where? Oklahoma. What for? Call it hijacked. Robbery? Same thing. You ever do any time? No, I couldn't nail it down. Where do you live? Got a room down on his fifth room in privileges. Who do you work for? That's your job. How long have you been in town? A couple of months. You've been working for this real estate company since you got here? Yeah, I got the job a couple of days after I got off the train. How'd you get it? Answer's an ad. You ever see that woman out on studio court before? No. You don't know her? I told you. She'd have no reason to tie a bad beef on you, would she? She's doing it, ain't she? She's kind of silly without any reason in it. No, she's a woman. That's all they need. All right, empty your pockets out on the table here. Why? Come on. We're not playing games. You're empty your pockets. What's this all about? What are you guys trying to prove with all this strong? We're trying to find out why you wanted to break into that house. I told you I didn't break into the house. You said you didn't know her. That's right. You never saw her before. That's what I said. And why'd she build a thing like this?  I walked up to the door and asked if I could talk to her. Just try to talk to her. Right away she starts yelling at me to get away, get off the property. Why didn't she leave then? I wanted to make a sale. You must have figured she wasn't interested. I needed to make a sale. I haven't been doing too good. Had to make a sale or I'd have lost my job. That's a reason to act like a tough guy, isn't it? All I did was try to talk to her, talk her into buying a lot. You got a funny way of doing it. I thought maybe she was going to call the police, make a complaint. She'd have done that. I'd have lost my job, sure. And that's all there is to it. I'm telling you the truth. You've got to believe me. You've been working in the neighborhood before? No. It's the first time. I've been kind of sick the last week. This is the first time out for me. First time I've been around here. Where'd you work before? Westlake area. You ever have any trouble there? No, none. Why'd you make the switch then? Just thought I'd try a new territory to see if I could make up for the week I lost. You got anybody go back up this story for you? People at my rooming house. I'll tell you. In a couple of weeks I'm kind of flew. I'll tell you. Joe. Yeah. See you in a minute. Cool. You want me to wait here? That's right. Just sit there. What do you have? Looks like we nailed the wrong guy. What do you think? The call just came in. Radio car picked up a fellow on Rosewood Avenue. Cool.  How about the description? Matches the suspect right down the line. Victor Nadel was booked in at the main jail pending further investigation. We were unable to connect him with any robbery but Perry Thomas of the city attorney's office issued a complaint charging violation of section 415 of the penal code. At 746 p.m. the suspect we'd gotten a call about arrived at the city hall. He was fingerprinted and checked through R&I. We found that he'd served a year and a day in New York state for breaking and entering. He'd served a sentence in the state of Washington on similar charges. Physically he matched the description we'd gotten from the victims. While Pinky Mead and D. Lightner contacted the women and asked them to come down to the office, Frank and I questioned the suspect. Rudolph Marnell, is that your true name? Yes, sir. Where do you live? My home's out in Hollywood.  Ledgewood Drive, 2917. You ever been arrested? Yeah, you know that. It was a mistake, though. Both times? Well, the second time was because of the first. What do you mean by that? I want you done time. It seems like anything goes wrong. The cops are on your back just like this. You want to tell us what happened out there tonight? You mean on Rosewood? That's right. Big misunderstanding. Well, you tell us about it, won't you? I wanted to use her phone. I don't know. I guess she got scared about something. All I wanted to do was make a call. If I could phone. Next thing I know, she's screaming up a storm. There's cops all around me. According to this report, you didn't stop when you were told, is that right? I guess so. Well, there's it, isn't it? Yeah. Why'd you run? Well, I didn't know what was going on. I got a record.  As soon as I heard the sirens, I took off. I guess I didn't hear that cop tell me to stop. Yeah. It's kind of hard to believe. Well, you believe the woman who says I tried to slug her. You believe her, but you don't believe me. You see, that's what I meant. What's that? There's a dozen cops right behind you all the time waiting to stop on you. You ever figured that you helped build it that way? Well, it reads good, but you ain't got nobody on your tail. All right. Now tell us again about tonight. I told the cops who picked me up. I told the cop who fingerprinted me. I already told you once. Now, how many times you want to hear it? Until we get it the right way. Well, how are you going to know? We'll find it. Come on. We're down at the interrogation room. Go ahead. Down this way. Go ahead, right in there. Sit down. All right, Marnell. Now let's clean it up. What do you mean? You know we're going to have no trouble making you on these things. We've got the victims on their way down here now. As soon as they identify you've had it. So save yourself a lot of time in trouble if you cop out now. I'd like to give you a hand, Sergeant. I really would, but there's nothing I can do. I don't know what you're talking about. All right. What were you doing on January 10th? 10th? That's right. What day was it? Thursday. I don't know. It's a long time ago. It's hard to remember. How about the 11th? Same. I don't remember. The 14th? Yeah. Yeah, I can tell you about that. All right. Go ahead. I got through work and went home. You improved that? Well, sure. Ask my wife. She'll tell you. All right. How about Wednesday the 16th? Black. You don't remember what you were doing on the 16th of January, huh? No. Is it important? It's going to be for you. How about the 17th? That'd be Thursday. That's right. I stayed home and watched the wrestling on television. You improved that, didn't you? Sure. I had some people in to watch the matches. Give us their names. Yeah. Who was wrestling that night? You want them all or just the main? How about the Sammy Windup? Let me think. Yeah. It was a tag team match between the McLean Brothers and the South Twins. You're sure? I'm positive. How about the 19th? What'd you do then? 19th. That would be a... Saturday. Well, I'm off Saturday. I don't remember too good. Probably came home sat around the house, drank beer and loved. Mm-hmm. That was Saturday the 19th. Yeah, the 19th. How about Monday the 21st? I bowl that night. Where? Lanes out on sunset. Bowler all the time? Yeah. You bowl every Monday night? No, not every week. Usually it's on Tuesday. Why'd you change this week? Well, some of the guys couldn't make it Tuesday, so we changed the day. Anything special to you about January 14th, 17th, 21st? What do you mean special? Well, your birthday, your anniversary, something like that. No. Just regular day. That's right. Nothing to make them stand out. No. Then how come you can remember what you were doing on those days? You can't give us a story to fit January 10th, 11th, 16th or 19th. I don't know. What are you guys trying to get me to say? What are you trying to get at? The truth. Well, I'm giving it to you. We can't see it. How come you remember those days? I don't know. I just do. That's kind of funny. I couldn't remember what I was doing last week. I'd have to sit down and think about it. I don't remember. You knew right away, didn't you? Like it was important for you to remember. You keep trying to build an alibi, don't you? Look, you asked me where I was. I told you. Let's have the names of the people you say you were with. You're going to talk to them? That's right. Well, maybe they won't remember. I think they will. But what happens if they don't? Then you're in big trouble. And you're holding a lot of it right now. Let's have the names. Sure. I've got nothing to worry about. I'll give them to you. Here's a pencil. Paper there. I don't know all the addresses. We'll look them up. You're going to have to talk to them, huh? Sure. You think they won't stand behind you? No, it's not that. And what is it? Well, just that they don't know I've done time. Maybe when they find out, they'll try to get me. You know, say they weren't with me, they might do that. You're like that woman, don't you? Yeah, just like that. People don't like you much, do they, Marnell? Hmm? Seems like everybody's trying to get you in trouble. I want a lawyer. You want to check, Frank? See if the victims are here. Yeah. Well, what's going to happen now? Well, you've got some people we want to see you. Who are they?  No, you can't make me on those jobs. We think we can. Let's try. You take this thing into court and they're going to throw it right out. That's the way you got it figured, isn't it? That's right. Go ahead, Frank. Bring them in. All right. I said I want a lawyer. What? I said I want a lawyer. Well, you'll get one. Yeah, and a jury. I want a jury trial. You've got a choice. You bet I have. You bring all these women down here to point me out. Well, this isn't going to work.  People who don't like me. I want a jury trial. A judge and a jury. All right, you'll get them. I'll make you a bet. Hmm?  The names were changed to protect the innocent. On May 16th, trial was held in Department 98 Superior Court of the state of California in and for the county of Los Angeles. In a moment, the results of that trial. Now, here is our star, Jack Webb. Thank you, George Veneman. You know, the Chesterfield you smoke today is the best cigarette ever made and best for you. Now, that's a fact. And to my way of thinking, it's the very reason for you to change to Chesterfield. Try them either way, regular or king size. If you try them, I think you'll say with all of us, Chesterfield's for me. Rudolph August Marnell was filed on for four counts of robbery in the first degree, five counts of burglary in the first degree, and five counts of assault with intent to do great bodily injury. He was found guilty by a jury trial on all counts and received sentence as prescribed by law. Robbery in the first degree is punishable by imprisonment for a period of not less than five years. Burglary in the first degree is punishable by imprisonment for a period of not less than five years. Assault with intent to do great bodily harm is punishable by a term of from one to 20 years in the state penitentiary. You have just heard Dragnet, a series of authentic cases from official files. Technical advice comes from the Office of Chief of Police, W.H. Parker, Los Angeles Police Department. Technical advisors Captain Jack Donahoe, Sergeant Marty Winn, Sergeant Vance Brasher. Heard tonight were Ben Alexander, Virginia Greg Helen Cleave. Script by John Robinson. Music by Walter Schumann. Hal Gibney speaking. Watch an entirely different Dragnet Case History each week on your local NBC television station. Please check your newspapers for the day and time. Chesterfield has brought you Dragnet, transcribed from Los Angeles. Filter cigarette smokers. Here is headline news. Nationwide demand for L and M filters drops price. Now you save up to four cents a pack, 40 cents a carton. Now everyone can afford a Baraka's highest quality and best filter tip cigarette. Remember, only L and M's have the miracle filter tip containing alpha cellulose. You get much more flavor, much less nicotine. By L and M filters, the distinctive monogram cigarette at the new low price. L and M filters.


మకల్ల్ల్లాలోలౌంనాస్త్చవరరనిందరకీన్స్ంతోటాలాలారిరోటర్ు లమపావికాడిలిందినిని. చిర్సింట్ప్చి మారిమస్కిఆదింనోదింవాగాస్చాట్చినిదింమారిట్చానేటిప్చికింరికానోది మతూటాంఙతూవసకింటరో మ్తాసింకువా. is to an internet that truly push people fast, where individuals can shape their own experience and where people are empowered, safe, secure and independent. So today I am gonna talking about here why web application security is matters. So if my facilitation is basically an introduction of why web application security is matters. So you don't need to be a tech guy or a gig guy, you can be a new one. So okay let's start. So you might think on my presentation that what is open sacs. Open sac is actually it's called open source application security. So we are here it's called FOSS, FOSS is free and open source software. So we are here to present you an open sac that open source application security things. Most of us code and open source at github. We create software, we create tools, we create projects. But not all of us care about the security things. That it might be hacked or it might our my data can be stolen. So we don't care about this. And the other thing is why website is called web application security is very non and common word in this work. So how many of know about or WSP, how many of know? Okay that's cool. it's called open web by stupid security project is very non it's like a very good documents on internet you can learn about web looking security is totally open source and it's like there have a document like a Wiki page you can learn about so many open source related security projects you can learn about the penetration testing you can learn about how you can secure yourself or how you can penetrate your system so you can learn about the memory source how many things on that. So the question raised all time why should I care about security, how many of you care about your own security here, how many of you, and how many of you don't, how many of you not, no one, okay that's good, that's great. So we all care about our own security, when I talked about this kind of presentation in last one year, I see that most people don't care about security and I ask them why, they say that I don't need to care about, then I ask them please give me your Facebook password, then they don't give it to me. But it's fine now that everyone is care about security, everyone is focusing on security in these days and is going to very popular these days right now. So what is actually web application security? Web application security is in my perspective what I can say that it's not and technical thing is just like an attitude. So if your attitude is just like secure, you can be secure in online. But here is that what is web application security is combination of people, it's combination of process and it's combination of technology. So if you are people, if you can feel that you want to be a secure or your system can be a secure, I think like in this time, everything is hackable.  So everything is hackable, none of thing is secured but we have to care about it that how our data or how our system can be secure. So here is CMS, open source and custom web application. So most of the time we ourselves use CMS, we use open source products, we use our custom web application projects. So most of the CMS, we believe that just like WordPress, most of the people use WordPress one there for their website, for their blog, most of the use JUMLA or other things. But we don't think that we believe that their system is very secure but yes that their system is secure but they have some lurking on behind you, you should put your password strong, you should protect your admin panel. So here the people process technology, if you care about this all things like if we raise awareness, if you do lots of training, if you push lots of guidance, if you secure our when we code, if you secure our development, if you secure our code review and if you do security testing, security configuration, application virus, automated testing, then we might say that yes, then maybe it can be secure. I am not telling that it can be secure perfectly 100% but it can be secure 95% if you follow this process. Okay, so here I am telling about the key web application security vulnerabilities they have session before maybe they talked about the top 10 security vulnerabilities but I am just again recalling it, they have some common security vulnerabilities have on online and one is access as it means cross site scripting, they have CSRF, cross site request policy, they have session hijacking, they have school injection, they have IDOR, they have RFI, they have LFI, they have RCE. So in every security vulnerability is very critical and your data can be stolen by any of this. So if you want to know more about this, you can go there, they have a link on there, you can go there, you can learn more about it, you can know more about it, how this can be done or how the hackers is hacking you or how you can protect yourself. Okay, so I am going to describe you some little bit penetration testing for the beginners to how you can test your system or how you can protect your system. So let's get ready. Okay, so the lesson first lesson is you have to be patient. You know hard? Who know hard? No one, okay, no need to know hard. So at first the security things are the most of the people think that it may be so hard, so I mean so hard it looks like so hard, it sounds so hard but trust me it's not so hard, it's a funny work. It's a funny work but you have to be patient in your inner that okay, I am going to do this. Okay, the second thing is average operating system arguments, average browser arguments, average language arguments. It's not mandatory to code in C, it's not mandatory to code in Python, it's not mandatory to code in languages, you can use any language, any language if you code securely, if you code well your system can be secure. So you don't need to arguments in any of things that if I use Linux my system can be secure, if I use Windows my system can be secure or if I use any other operating system my system can be secure. It's not like this, you can use anything. Okay, the other thing is do not use automated scanners. So we most people or those who do penetration testing, most of the people use the automated scanners and they think the scanner why you don't find bugs. They say they scan it by the automated scanners, they bought the software and they scan it, the software said there is no bug, they said okay I am secure, no one can hack me. But trust me you are the most vulnerable person. So at online, if you search online that web application security scanner, first and first you can find acrylics or just like other softwares. So it's because I am not saying that they are not good, but they are good but don't try to use this kind of softwares, it will be harmful for you, it will be also stolen your data because this is not open source product. So we don't know how these things are going on the site or on your website. So the second thing is learn to code. I am not saying to, I put Python first because I am a Python lover but I am not saying it will write code on Python. You can write code on anything, you can write code on PSP, you can write code on anything, whatever you like. So you might question that do not use automated scanners, so you might question me what we use. Okay they have several tools. This one is called bug suite, this is most famous on penetration testing system. They have all subject security, they have end map, they have general discovery, they have pirates. All of these are security tools but this is not automated tools. You have to know first how these things can be done so that you can use these tools. So this is just like an intercepting tool. You can intercept the browser request here, then you can do something here on the inner side. If you want to know that why we can find it, the bug suite can find this link, the jab proxy can find this link, the end map can find this link, the DNS recovery can find on this link and pirates can find on this link. You don't need to write up, I will give them my slides so you can watch it later. Okay, so now you might ask me that I am not a tech guy, I am not a gig guy, I am not a hacker, I am not a security researcher. So how can I know the updated, because every day they have some security, they have some zero day rising, they have some exploits coming. So you might ask yourself how I can know that, how can I know that the updated exploits. Okay, they have several websites, the most famous one is called exploit database. It's called exploit DB, you can go there, search your CMS name or you can search anything there. Every day they have updated, express updated. They have another one, it's called 127, it's mean lead day, you can find on that site. They have another one, it's very famous, it's rapid seven. You can also search on there, you can just search on your CMS system or you can search on your plugin system. Whatever you like, you just need to search there. If you find anything related to your plugin, related to your CMS, related to your software, you just need to check and there have also patch on there. They will write there how you can patch your system. So it's very easy and it's very effective to secure your system, to secure your website. In this time most of us have a website, most of us like to write blog. But we don't know how our data can be stolen, how things can be done. So if you want to know more about the exploits things or the updated exploits, you can find all of this on here. They have some zero days, which is made by the hackers, they don't like to delete. This is the different thing, but most public express can be found here. So this place is not for the web developers, but I request web developers to practice on this gown. But this is basically for the penetration testers who love to penetrate, who love to break the system and who love to do some security resourcing. So if you want to be a hacker, the word is just like people called it, oh they are not good guy, they are bad guy, we have to avoid this. Trust me, we are good guy, we are not storing your system, we are just avoiding you. Okay, so if you want to start penetration testing, they have to open source, one is called DBWF, which is main diamond web server. This is a project, this is an open source project, you just need to install it on your local host or you can install it on your web server, whatever you like. They have all the common web applications that they have on there. So you can check, you can test yourself how good you are on the testing security. They have another good one, I personally like this, it's called BWAPP. So you can also install it on your system, you can search, you can find bugs or you can test yourself. And trust me, the web application security things or if you are a good penetration tester, your career would be great. Because this time in this generation or next 50 years, the security research salary would be the most highest one. If you go to the hacker one, if you go to the bug crowd system, they have lost of freelancers. And you see that, the last time I remembered that 2 months ago, they have on Russian hacker, which is a freelancer hacker, who find a remote code application, Bhullanavati on the Facebook and just for one Bhullanavati, he burned at 40,000 US dollars. Just one hour work, just one hour work. So if you want to see, if you don't trust me, go to hacker one dot com, go to bug crowd dot com. Just sign up there, you will see that how they paid. They have all the great organizational company have on there, just like, we might think that Facebook is very secure, they have good developers, Google is very secure, they have great developers. This is not like this, with the security research are securing them. They just pay back money to us. They have a platform called, they have their website, we test it, we report Bhullanavati on that. If this is very, then they pay pass back. So if you want to be a security researcher or if you want to start your career on security field, I think, I prefer you should choice this, because you can be rich within one year, you can be rich. Okay, so they have one, this is our very new web-based scanner just for developers. It's called Mozilla Observatory, it's made by Mozilla. So if you have computer, you can scan your website now. So I can, let me show you. Is there have internet on it? Internet? Okay, so here is the website, you just need to go to MozillaObservatory.com. Sorry, it's the observatory.mozilla.org. Okay, so you just need to go there, you can scan your any website, if you scan just like phosashia.com. You can see that what they are using, what's not secured or how they can improve, what have lackings on their site. So it's very good tools, you can scan your own website here. And it's totally open source, so you can also recommend us anything or you can contribute on GitHub. Okay, so here I said, when I only care about security, I love to dance. And everyone care about security, I love to dance with them. So I believe and I wish that in this room after my session, you all will care about security. And you will try to learn more about web application security. And if you have a domain or if you have a system or if you have a website or web server or anything else, you should learn something to know how you can protect yourself. If you are not interested in penetration testing, I'm not requesting you to do penetration testing. But if you have a domain or if you have a system or if you have a website, I am requesting you to learn something a little bit about how you can protect yourself, how you can secure your system because in this time, the data is every day, the data is stolen, you can see the big organization or big companies are storing your data every time, they are following your all movement, they are following your all website, they are following your all passwords, everything. So we have the rights to protect ourselves, our privacy is ours. So I am requesting all of you, those who are not that much programmer or developer, but you should try to learn something about your web application security or about your system, how you can protect yourself. Okay, I am done here. Any question? Okay, please. Okay, so for web apps, they have many different layers, sometimes they ask for user information and a lot more is information at the end. So when you do these scan like the observatory, does it kind of drill down into different paths? No, it's just checking your data request, why it is going. Okay, let me show you. So when I enter the address, do I enter the page with all the input fields or do I just put in the front page? No, you can... I am not a developer. You just need to scan that just a website link, you don't need to do anything. You just need to scan that just a website link or you can also, if you are good in docking, it's called Google dock. You can add some line on that, but it's a tricky thing. But I am requesting if you are beginner, you just need to write down your website URL, just URL without STTP. Just write down its click scan and see what output is going down. You have seen this before. Essentially, you enter the URL and it does some basic checks on whether or not you have been using STPS. Yeah, yeah, yeah, yeah.  It will test a bunch of headers that you are protecting yourself against with respect to say inside your... Yeah, yeah, yeah. So it basically does a bunch of checks with respect to your web server, I would say. And that's where it gives you the entire reporting you need to protect yourself from incoming requests which are possibly the issues by adding these headers into your X or X configuration. Yeah. I guess that's a good start to have an intelligent conversation with my tech guy. Okay, okay, okay. You have great stuff. Yeah, so I am basically a free-start web developer so I really love the content of it. So as a front-end person how can I make my websites more secure which is the one of the things that I can start working on and make my stuff more secure. The website is enough. Okay, I have a good great document for it. We have a booth on Mozilla there. You should collect it from me after this session. Okay. Anyone? Okay, I think I am done. Okay, so thank you so much, everyone for being here and thank you so much to listen to my boring lecture because the security lecture is called so boring. It's not interesting. It's not funny thing. They do not have any funny thing, funny image or just like this but I tried to add some funny image here. Thank you so much again and if you want to follow me on Twitter if you want to follow me on Twitter or if you want to check what I am doing you can check there. That's it and if you want to have a discussion or chat with me they have a Mozilla booth on there, on the fast food you can go and meet with me. Thank you so much everyone.


Tickets are back. What's up guys, welcome back. My name is stress here on thumbs up run where we talk about buying tickets, selling tickets, making sure that you have all the fun with your tickets. Today we're talking all about events. What's going on? Let me tell you, things are back, things are happening. Events are going to go on. Tickets are being bought, sold, traded, transferred. All the things are happening with tickets. So with events going back online, there are three main things you need to know to make sure there are no surprises when you're going back to those events. Let's begin. Number one, seating manifests.  As we've discussed in other videos, there are certain protocols in place to ensure people are seated within a certain distance away from each other. So generally it's about six feet. As different events and different venues start opening up further and further, they're slowly adding more and more available seats into the venue. So there's a lot of seats that are coming available and it's really important to know that seating manifests how they actually lay out the different event. It's constantly changing. And as a result, you got to be very careful when you're buying your tickets because these seating manifests are very fluid, very liquid. So the seat you may be buying may actually end up moving. So you got to make sure you pay attention to all the news going on. With Major League Baseball, almost every single team has now announced that they are going to have some level of fans in attendance. But with that, they still make sure that everybody's staying safe, staying in a good distance apart. So the seating manifests, they are constantly moving where people are actually allowed to sit, where they're not allowed to sit. And even just recently, MLB, they actually had to cancel a whole bunch of events and just reissue all the barcodes, all the seats for them because seating manifests were just, it was just too much. They announced, oh, this venue will only allow 10%, this venue will allow 25%, this venue will allow 15%. And then they said, oh, no, we need to make some tweaks and changes because, oh, they're too close to the players or, oh, I think this person is saying too close to that other guy over there. And then there's just, there's too many things going on. So with all these leagues trying to rush to get people back into events and venues, it's possible that there may be some issues and errors as they slowly get themselves back up and running. So with that, make sure again, you double check your seats both when you initially buy them and two, before you actually go to the event, double check, make sure your seats are still where they're supposed to be. It is possible that they have changed. So again, pay attention, check your emails, check your alerts, check your text messages, just stay informed, make sure your seats are where they're supposed to be. Excellent. Number two, make sure you pay attention to any rules or disclosures that relate to getting into that event. Every single venue, every single state, every single province, every single country, they're all running different types of requirements to get into events. Sometimes it might be, have to get a negative PCR test. Other times it could just be, do a self-assessment before you get into the venue. Could be temperature checks. Could be a whole slew of different things. So again, you gotta make sure you double check what are the requirements to actually get into that event so that you aren't gonna be denied at the gate. That would be bad. Don't, we don't want that. It's really interesting, right? So some venues will say, no, no need to actually show us a negative test. Just come in, make sure you do a questionnaire beforehand before you can get here. Other venues though, they're actually even being more cute. They're not just saying, oh, you need a negative PCR test to get into the venue. Some of them are saying you need a negative PCR test just to sit within certain regions of the arenas if you're getting too close to the players. They wanna make sure that their players are protected. They wanna make sure that you're protected. They wanna make sure everybody's protected. So they put these rules in place to make sure that you have that negative test. So if you show up to the venue, they say you need a negative PCR test and you say, I don't have one. That could be bad. So again, double check before you go to the event what the requirements are to actually get into the building so you don't have any issues getting through that gate. And lastly, number three, we're talking about ticket transferability. So some teams, some venues, some events, they are limiting the ability to actually transfer tickets, sell tickets, move tickets to friends and family.  You can't give it to anybody else because what they're trying to get at is really contact tracing and saying, we wanna make sure that the people who are buying these tickets, we know who they are, we know where they're sitting, we know where they're gonna be at all times. We know everything about you and we don't want you giving your tickets to anyone else. In theory, this sounds like a great idea. Unfortunately, it can lead to some potential problems. Say you get sick, for example, your friends can't make it, your family can't go with you anymore. You just don't wanna go to the event anymore. You don't feel comfortable. If your tickets are not able to be transferred along, then it could be a problem where you're just stuck with these tickets that are worth nothing, can't sell them, can't get rid of them, they're just garbage, essentially. Garbage! I don't find this too often, but it does trickle in here and there. I've been seeing it with season seat holders specifically. They've been having the issue where they aren't actually eligible to transfer these seats. So again, double check, take some time. Before you buy those tickets, make sure you see what the rules and restrictions are if there are any, because you don't wanna end up in the situation where you're stuck with some tickets because they said you can't move them. You know, those are basically the three main things you need to know before you go ahead and actually start getting into events because if you aren't informed, you're gonna run into some problems, you won't be able to get into the event, you're gonna be sitting next to someone where you're not supposed to be. You're sitting in the wrong seats. There could be a whole lot of problems and we don't want nobody to have some problems. Now, if you enjoyed this video, be sure to hit the like button down below so I can go ahead and make some more videos for you guys. If you really love this video, though, be sure to hit the subscribe button down below as well because that number, that button, it's feeling a little bit lonely. I think it needs a bit of love, so just, just, just tap it. Just tap, tap, tap it. Just, just, just tap it. I'll wait for you. Perfect. All right. And I think that kinda covers everything. So, see you guys next time.


All the wickedness that mankind can produce, we will send unto them only you and Tear until it is done. Use it to activate the mech and clear a path no is nearby. I will mark its location on your hut. The entire ship. Your equipment launcher has been completed. Four frag grenades. Is my time again? Let's see if you're strong enough to survive this curse. He is weak. Your hate must match his will. Only then will secure your place in the new world. A gun is nearby. A relic from your past. The priests have kept it hidden from you in this remote location. This is the site where the invasion began. The oldest and most corrupted location on the planet. The Ark fought hard, but they were eventually driven out by the demons. A goal to destroy the heart. But a consumption of earth will not be stopped until the last priest and his guardian are destroyed. Fire assistance in order to locate the fighters. I will calibrate the force. This industrial campus belongs to the headquarters of the Resistance. Evacuation is your duty. To suffer for the UAC is a privilege. Portal is ready. Not my best Ark complex. Warning, BFG-10000 is firing. Our source of the BFG-10000 should be of interest to you as well.


know, most people in their minds are like, okay, I'm thinking of a spectrum at one end, someone's not very autistic, you know, not autistic at all. Now the other hand, they're kind of a lot more autistic in the middle. You've got you've got someone who's sort of in the middle, middling autistic. That's the way that a lot of people view the autism spectrum. And it's an incorrect way of viewing it.