Member's statements. I recognize the member from Mississauga Center. Thank you, Mr. President. Thank you, Speaker. Today we are celebrating the International Francophony Day. International Francophony Day. It is a honor for me to recognize all the Francophone students. Pierre-Philippe Lamage students are here today. I would like to recognize all of them. And all the youth from the SEVSFO who are here today to celebrate the International Francophony Day. I would also like to recognize the President of the Assembly of the Francophony in Ontario. As a Francophone myself, I am proud to recognize all the contributions of Francophones in our province when it comes to culture, identity, and economic development. We want to strengthen Francophone community and provide a bright future for them. During the last four years, we set strategies to show our commitments for Francophony. We presented many programs for Francophone. French is the fifth language that is most spoken in the world. Ontario is part of this International Francophone family.  Be proud of our founders. Be proud of our symbols and our interaction with the President. Nancy? Member's statements? The Member for University Rosedale. Thank you, Speaker. I met a mum in my writing, Amy. It was very hard to listen to Amy's story because it felt like her life was impossible. She's a working parent. She's a single parent. And she's also a parent of two children with autism. Her oldest is eight, and he's very high needs. He cannot be left alone.  She needs funding for summer programs for kids with autism, which she is a hard time finding, so that she can keep her job and pay the rent. It is essential, she emphasises this, it is essential for her economic survival that she get help. Without support, Amy describes her life as a living in hell. She has been waiting months for provincial funding. She is eligible for, and it has not arrived. And I will make sure to follow up with the Minister opposite to inquire about her case because she is in distress and she is not alone. There are thousands of people like Amy. I recently spoke to Surrey House. It is a provider of excellent autism programs in my writing of University Road to Stale. And they emphasised to me in that meeting that the need for autism programs is growing while their ability to provide for this need is shrinking. There's more children waiting for preschool speech and language programs and that is unacceptable. I want to see something in 2023 but... Thank you very much. Member Statements, Member for Oakville North, Burlington. Rise today to recognise Hellenic Heritage Month in Ontario. Our legislature is the only one in Canada to officially recognise this celebration. As an Ontarian of Hellenic origin, I am proud to see our rich cultural history recognised and celebrated. The Hellenic community has had a long and proud history in Canada dating back to before Confederation. In Ontario and in my own writing of Oakville North, Burlington, our community has contributed to the province's growth and prosperity by establishing schools, churches and businesses. This month provides an opportunity for all Ontarians to celebrate the contributions of Hellenic Canadians to our province and country. The ancient Greeks whose ideas and innovations in philosophy, science, medicine and the arts laid the foundation for the freedoms and democracy that we enjoy today. On March 25th, 1821, the Greek Revolution began leading to the liberation of Greece from the Ottoman Empire's 400 year occupation. Greek Independence Day celebrates a triumph of this revolution which restored Greece's sovereignty and allowed its people to regain their freedom after centuries of oppression. In recognition of this, I invite all my colleagues to join me at the annual Greek Independence Day Parade this Sunday on the Danforth in Toronto. Thank you. The Member for Niagara Centre. Thank you Speaker. It's honour to rise today to speak about two of the incredible local not-for-profit organisations that operate in my writing. This morning I had the pleasure of joining John Brathwaite, CEO of the Hope Centre in Welland and Christine Clark LeFleur, Executive Director at Port Cares and Port Coburn for the Feed Ontario Breakfast here at the Legislature. The Hope Centre was created in 1974 when a group of concerned citizens and groups in Welland saw the need for an organisation to assist those falling through the gaps in our community. Today they support their community through their lunch program, food bank, housing stability and other programs. Port Cares has been in operation since 1986. They have helped countless folks through their housing and crisis support programs along with their employment and learning services. In January of last year, over 1,700 people were registered with the food bank and that number has now skyrocketed to almost 2,700. These incredible organisations continue to work industriously despite a growing surge in demand. Speaker Niagara continues to be hard hit by the soaring cost of living and rising inflation. People are struggling. We need to support organisations like Port Cares and the Hope Centre by providing them with appropriate, stable, long-term funding and investments in affordable housing initiatives. They deserve nothing less. I want to thank their leadership, staff, Board of Directors and volunteers for their incredible work. Thank you. Thank you, Member Statements. The Member for Brampton East. Thank you, Speaker.  My constituency of Brampton East is home to a not-for-profit youth organisation known as Brampton Robotics. They promote science, technology, engineering, mathematics and commonly known as STEM. Through their robotics program, Brampton Robotics works with youth across the region of Peel to engage and develop skills in fields such as computer programming, simple machines, building robotic technology and using the skills they gain, the group takes part in various competitions ranging from local to international tournaments. On March 4th, Brampton Robotics took place in a province-wide competition where out of 80 teams across Ontario, they qualified for two spots in the World Cup taking place in Dallas, Texas next month. I'd like to take this moment to acknowledge the youth members of Brampton Robotics and recognise them for their dedication and hard work for this amazing achievement. I'd like to recognise Prabhavir Garawal, Harsharan Rakhra, Manjot Dola, Aryan Sharma, Shivan Jiswal, Minheer Grover, Kedir Venekar and Arulini Mutu. Mr. Speaker, it's vital that we continue to support this province's youth and provide them with quality education so they can go on and compose a skilled workforce that will advance the technological, political and economic fabric of Ontario. Thank you, Mr. Speaker. Member statements. The Member for Waterloo. Thank you very much. The Ontario Nurses Association submitted the following recommendation for Ontario Budget 2023. They make sense. They will save lives and money. Retain nurses and health care workers by improving their working conditions and show them respect. Drop the costly appeal of Bill 124, the Superior Court decision which struck down the wage-suppression legislation as unconstitutional. Bargaining good faith, what a concept. Legislate 10 permanent paid sick days for all workers. Create more full-time nursing positions to reach a minimum of 70% full-time. Bolster the health care workforce and plan for the future. Launch a robust recruitment strategy to bridge the RN care gap. Ontario needs at least 24,000 new RNs. Increase the number of RN seats at Ontario universities and colleges standalone programs by 10%. Invest in nurse practitioner-led primary care. Ensure the safety of the nurses and health care professionals. Address violence in the workplace. Stop the privatisation of Ontario's health care system. Cap the percentage usage of agency nurses. And finally, fund public health. Increase the funding to 100% so that every community across this great province has the same services and resilience to outbreaks. Save lives, save money. Invest in the people in our public health care system in Budget 2023. Member statements. Member for Oxford. Thank you very much, Mr. Speaker. March Break is an opportunity for children across Oxford to recharge their batteries. They also get to enjoy the last few days of Oxford wintertime activities, like playing in the snow, skiing, tobogganing, before the mercury begins to rise. After a three-year break due to COVID, it was great to hold my annual skates that crossed my riding. Constituents of all ages came out to show off their skills, or just take it easy with some casual laps around the ring. It was great to see so many smiling faces. Afterwards, everyone got to warm up with hot chocolate while enjoying a cookie or two. On Monday, I held my Ingersoll family skate where a constituent told me how she calls the town the heart of southwestern Ontario because it is no more than an hour's drive to London, Stratford and Lake Erie. My skate on Tuesday morning was hosted in the Colin Campbell Community Arena in Tilsonburg, which was named after the former hockey player and coach who was born there. I was off to Norwich that afternoon where the turnout was beyond our expectations. We had over 100 people fill up. I want to give a big thanks and a shout out to the volunteers, Beth, Michael and Jim, for helping me set up and run the events. I also want to thank the community centres and arenas for hosting. I look forward to holding my family skates again next year with even larger attendances. Thank you very much. The Member for Ottawa South. Thank you very much, Mr. Speaker. Today, across Ontario, Muslim families are preparing for the Holy Month of Ramadan. This Wednesday, Ramadan will commence after sundown. Ramadan is one of the five pillars of Islam, as well as faith, prayer, alms and pilgrimage. Ramadan is a time for fasting and sacrifice. It's a time for prayer, reflection and spiritual growth. It's also a time to strengthen ties with family and your community. I'm looking forward to the many iftars that we're going to have in Ottawa South and to our Muslim friends and neighbours. Thank you for giving your children the gift of faith. It will sustain them. I wish for all a joyous and meaningful month of Ramadan and I know it's early, but let me be the first to say Ramadan will barricade. Thank you, Speaker. Member Statements, the Member for Mississauga, Aaron Mills. Thank you, Mr. Speaker. On February 25th, I hosted a community bowling evening in my writing of Mississauga, Aaron Mills. We hosted the event at the Classic Pole, one of the largest bowling centres in Canada. It was lots of fun and a great success. We were expecting 150 guests at the event, but we had over 860 people ended up attending. I would like to thank the community for participating and for their continued support. On that note, Mr. Speaker, I'm proud of what we were able to accomplish this past month at the Ministry of Tourism, Culture and Sport, where I served as a parliamentary assistant for the past four years. It's one of the province's richest ministries, fostering strong interconnected communities and aligning closely with my own goals of multicultural outreach. My deepest gratitude goes to the Minister for his leadership on the portfolio and for giving me the opportunity to work closely with him. Last week, I was honoured to be appointed as a parliamentary assistant to the Minister of Public and Business Service Delivery. I would like to thank the Honourable Birmier and the Minister for putting their trust in me. In my new role, my goal shall remain as it was always been to make life easier for all Ontarians. I am honoured to be entrusted with this responsibility, so help me, God. Member Statements. Member for Chatham-Kent Union. Thank you, Speaker. I have the honour to spend St. Paddy's Day morning with my friends at Community Living Chatham-Kent to learn more about the Outward Bound Program and to see firsthand their investments and technology made possible by a successful Ontario Trillium Fund grant. This organisation supports more than 550 people and their families across our municipality. Under the leadership of Executive Director Ron Korstein, this amazing team works to enrich the lives of people with diverse abilities by providing quality services and meaningful, inclusive opportunities. Guided by principals to provide services that are basically responsible, person-centred, and based on informed choice and positive outcomes, Community Living CK promotes physical and emotional wellbeing, flexibility and a deep respect for cultural differences to ensure everyone has the opportunity to thrive, be active and contribute to our community. Early in the pandemic, Community Living was quick to adopt technology to ensure these strong relationships between staff, clients and families remained intact. Thank you, Community Living, Chatham-Kent, for all the important work you do every day in our communities and congratulations on your successful grant application. Thank you. Thank you. That concludes our member's statements for this morning. I beg to inform the House that the following document was tabled. An interim report concerning the Honourable Doug Ford, Premier of Ontario from the Office of the Integrity Commissioner of Ontario.


Welcome to the workshop, which title is Testing Smart Contracts with Waffle. My name is Bartek Rutkowski. I work for TrueFi and I'm also one of the contributors to the Waffle open source library. And I'm going to take you through some of the key features of Waffle and we're going to code some stuff together. So this is what we're going to start with as the internet situation is not great. Some of that want to go through the tasks with us. I recommend cloning the repository right now and going so in the read me there is going to be a small section that's going to describe what you need to do basically is just installing the dependencies and doing some few basic steps. So yeah, I'm going to wait a second for everyone to do that. Okay, the URL is going to be visible also later on. So moving on, there are two basic approaches to testing smart contracts. One of which is testing smart contracts with other smart contracts, which has its very nice properties, but also the other approach is to test smart contracts with JavaScript or TypeScript code. And that's something that we're going to focus on. It has some nice things about it. So first of all, it's very easy and intuitive. So it is very fast, which is important if you want to test drive your code or if you want to make sure that the tests are being added to the code as it's being created all the time. It's also very, very flexible. I would say even more flexible than testing Solidity with other Solidity code. And it's also kind of de-app native in a sense that you interact with your smart contracts the same way your application is going to interact with your smart contracts later on. And then moving on to the WAFU itself, which is a library that utilizes JavaScript and TypeScript, it takes a very, very minimalistic approach. So it's not a very large framework that forces you to follow some certain rules, but it rather provides you with some set of utility functions that just help you with the largest pain points. Also it's blazing fast. As for the JavaScript or TypeScript library, because some of the Solidity testing can be a little faster, but as for a TypeScript framework, it is extremely fast. It also has a very nice and friendly syntax, and it obviously is open source. So anyone having any issues or any problems can reach out. And also if anyone has any ideas what we can improve, then they are welcome to do so. And also what is very important that WAFU works well with hard cut. So if you are already using your hard cut setup, then you can use some of the features of WAFU as a plug-in to your hard cut setup. So you can use either WAFU standalone as a complete testing solution or as a plug-in to hard cut, which is very nice as well. We're going to focus on using WAFU standalone, but recommend checking the documentation for the hard cut integration as well. And what WAFU actually does, so it takes you through all the steps of smart contract development. So first, it helps you compile your code, nevertheless, this is Viper of Solidity or Solidity. For most people, it's probably going to be Solidity. If you are team Vitalik and you prefer Viper, then yeah, you can use Viper as well. Then you can deploy your code, whether you want to actually prepare a deployment script for the main net or some other actually working network or just deploy for the testing purposes.  I'm going to dive deeper into that later on. And what are the WAFU components? It's TypeScript, obviously, with Typed Chain. It's Mock and Chai, which are JavaScript libraries for just JavaScript testing, but we utilize them here as well. And Ether's JS, which is a very nice library that wraps all the complexities of interacting with the Ethereum network. So now, what the whole process looks like? So first, we need our Solidity code. In this case, this is some Solidity file called exchange.sol, which is some smart contract. And then we need our configuration for WAFU. This configuration that we see here is not actually a needed configuration because these are all the default values. So you don't need to create that configuration. You can just keep completely this step, but mentioning this if you want to have something custom. And then we run a command, which is just invoking WAFU. And WAFU will produce byte code, the ABI, which is going to be helpful when interacting with smart contracts. And a flattened code, which is helpful if you, for example, want to verify your code on EtherScan or a similar site.  So basically, you only need to import the artifact from the Solidity, from the smart contract compilation. And then you need to use the deploy contract function. Super easy. First argument is who is deploying. Second argument is what is being deployed. And the third one are the arguments for the constructor of the function. Important thing to notice here is that the token object that we are creating here, which is the instantiation of the token, is tied to the wallet that deployed the contract. So whenever we're going to be interacting with the token, we're going to be interacting from the wallet. So the wallet is like the default center of the transaction. And we can change that by just connecting the contract to some other wallet. So by invoking contract.connect, we can have some other person, some other wallet interacting with the contract. Oh, thank you. I think I'm going to find some charger or someone will help me with that. Thank you. Thank you very much. Yeah, that the computer is on low battery. Moving on, moving on. So now interacting with the network. So there are basically three pieces of the interaction between the user and the network as a whole. So first we have our Dapp or a testing suite or a script. And that Dapp or whatever else uses a JSON RPC interface to talk to, to interact with any Ethereum node, which is like one of the nodes from the Ethereum network. And we're going to break down all these like three pieces and how sort of to wrap all that. So it's, so it makes sense from the developer perspective. So first of all, we have the node, the node itself. Usually instead of talking to the node or talking to the network, we use some API like infura alchemy, or a default provider injected into the browser by the metamask. But also we can use an emulated network like ganache or, or, or every VM or whatever else that is just localization that simulates the behavior of the Ethereum network. So before we can run our own Ethereum node at B, the hero of the community, which I obviously recommend, but I understand this is not the case for each solution. And then when we have the JSON RPC level, we need to wrap the JSON RPC complexities with nicer functions. So we have two libraries, two main, two major libraries that, that help with that. One of them is Ether's JS. Second one is web free JS. So basically web free JS is older. Ether's is like the preferred one by, by me myself and a lot of, a lot of my colleagues. But just to mention about that, that there are two of them at least. Yeah. And what Ether's JS does is that basically it wraps the whole management of the keys. It helps you construct the transaction. So as we see here, we have the private key. Then from the private key, we can create a wallet object. And then we can add a provider of the network. So sort of connect the, the wallet to a link to the particular node, to the particular API of the, of the extreme network. And then instead of just constructing some very bulky JSON and creating a HTTP request and sending that to the node, we can just use like, like a simple call like wallet dot get balance and we'll get our balance. And then there's JS also helps us override some, some additional properties of the transaction. So with it, there's JS, we can not only construct like a basic transactions, but also override gas limit and nonce value, chain ID, whatever else. And then if we construct that transaction, this is like the very bottom line. We can just add all these overrides and perform like a very custom transaction. And now we dive into the actual features of the, of the waffle. Right now we are sort of discovering the whole environment that's around, around the core of the presentation and what waffle can do on the testing field. So first of all, we can have like a basic testing so we can just invoke some function or we can have some value and we can demand the quality. So first equality, but necessarily doesn't necessarily need to be equality. We can just, we can also have, we can also expect the value to be within a range of some values or to be close to some value, which is kind of dangerous because obviously in the smart contracts, we want everything to be a super sharp and super precise, but in some cases, for example, if we are doing some calculations based on time, this is not going to be super precise and you can use something like this. Then we can test all the events and that's sort of corresponds to what I was talking about when it comes to the de-up nativeness of JavaScript testing because events are not crucial to the logic of the smart contracts themselves, but very often they are super important from the de-up standpoint because we need to be notified about some certain action that happened and we can test that very easily with waffle by just expecting some transaction to emit an event with some arguments or like emit multiple events or whatnot. We can also test external calls. So in this situation, this is a very simple thing because we just call a function and then expect the function to be called, but we can have a very advanced use cases where we have like a contract, calling other contracts, and then we can check whether some particular contract within the whole call stack was called by some other contract with some particular arguments, which can be quite powerful and allows us to check some of the complex cases of many smart contracts interactions. Then we have the reverts, which are also super cool to test, super, in my opinion, syntax is super cool and which are obviously super important to test. So first we can just test whether something is reverted, but we can also be very precise about the reverting reason, so what the error is. And also we can, which is one of the newest features, we can check the arguments of the reverts, that's one of the newest features of the Solidity and we have the reflection of that in WAFU as well. Then we have wrapper for the token balances, as this is something that we test very often. So we can check whether some transactions modifies balance of some tokens on some wallets, so we can do this for just one wallet that we expect some transaction to modify the balance of a token, of a wallet of particular value, or we can perform that for a pair of wallets or a triple of wallets or whatever, or whatever else. We can also have mock contracts, so mock contracts are just like artificial things that pretend to be smart contracts, so we can set up a mock contract, deploy a mock contract and then very easily define the behavior of the mock. So basically just say that mock when called, when like a particular method on the mock is called, is going to behave in a certain way. So this is going to return something or is going to revert. We can also specify the arguments and we can just basically model any behavior on the mock. And then the example of the usage of the mocks would be like this. So we have some setup that would return contract and a mock here C20 and then the mock, we sort of like program the mock to return some value and then we can, for example, check whether our contract correctly reacts to the value returned by the mock. So in the first case that our contract after examining the mock will return false or in the second case it will return true because the mock just returns some value that we expect or do not expect. And the last major feature are the fixtures. So this is an extremely powerful thing because normally when we have like a set of tests, basically like a good rule of testing is that all the tests should be, shouldn't depend on each other. So each test should have like a separated setup. We should be able to change the order of the test and everything should still work. So basically what fixtures allow us is sort of reverting the state of the blockchain to some other state from the past. So basically we can perform some setup transactions, deploy some contracts maybe perform some initial transactions and then save that as a fixture and then revoke the fixture in each test. So each test starts with the same state and we do not need to redo all the transactions and perform all these transactions. Again, we just sort of point to that state in the past that we want to sort of start from this particular moment and that actually is one of the things that make Waffle so fast. Because, yeah, and now this is going to be like a first full setup of the tests. So actually this is going to be shown also later on a sort of a cheat sheet when we start coding, but here we can go through the whole thing. So first we need to import the stuff from Chai that we need. So we need the expected utility. That's the most important thing. We need a type from itters that defines contract and then from Ethereum Waffle we want a deploy contract function, we want a mock provider function, which is the emulated network that we're going to be using instead of the actual Ethereum network in the tests and a solidity, which is just the object that contains all the custom matchers. And then we import the contract itself. So we inject the solidity matchers into the Chai itself and then we can start writing our tests. So here we can see that we created this provider. So we create this emulated virtual network. Then we create some wallets. In this case, only one wallet, which is called Alice. We create some contract and then in before each setup, this time we are not using fixtures. We just deploy the contract and then we can have like a, in this case, free tests that just assert some certain properties of the contract. Yeah, and now it's time to it's time to dive in. So we're going to have two difficulty tracks. So first is going to be like a beginner track. So you can use already done a smart contract code that we have in the repository that you downloaded. Or you can go through the advanced difficulty track. So basically start with an empty smart contract and test drive your code. So this is an interesting technique that instead of just writing the code and then testing whether the code is correct, you first write the test, see that the test is failing. So you are make sure that the contract that you are testing does not have this particular property or this particular function. And then after you have the failing test, you implement the smart contract logic and then see the test passing and then do a necessary factoring if you need and then repeat. So go on to the next property of the contract that you wanna add. And what we are gonna be working on. So the first task is gonna be to create a very simple splitter smart contract. So a contract that is gonna have a split function and when some if is gonna be sent to that function while the function is being called is just gonna split the ether in half and send to different addresses. And it's gonna revert when the value of the if is gonna be zero. And if the value of the if is not divided by two, then we're just gonna refund the remainder to the original sender. And we want to write the test for that. And task number two, which is they're gonna be sort of actually quite a few of them and you can do them in any order. So first, at the proper event when the split happens, so just to signalize that the split was called with a particular result. We also want to signalize whenever the non zero remainder was returned because we have that function as well. And we also want the owner to be the only person that is allowed to use the contract. So the split is gonna have a restriction that there's only one owner who can split the ether using the contract. And then we can also use a dynamic array of addresses. So maybe these are not gonna be set for good in the smart contract but they are gonna be arguments to the function. And maybe we're gonna have like more addresses than two, maybe three or four or just a dynamic number of them. And of course we want to create tests for that. So that's like a cheat sheet that I'm gonna stop on. So first QR code that you have is a waffle documentation that should help you with everything. The bottom QR code is the repository that we are gonna be working on. On the left you see the list of the tasks that are to be done. And on the right you have a sort of a basic template that shows you what's the general idea of the test and how they more or less should look like. Yeah, so if you have any questions or if you need help with something then feel free to reach out. I'm not the only person here to help. I have Daniel Przemegeniuszina from my team here as well. So if you have any problems or any questions we're here to help you. Okay, should I add something? Yeah, so are there any questions? Do I need to repeat anything? Is everything clear? By the way, question, where are you guys able to download the repository? Because the internal situation is not great so if anyone was downloading was, yeah, okay, I see some thumbs up. So I guess there was a success. Okay, cool. Oh, that's a good point. So actually I'm gonna switch from the presentation. Oh, nice. So here's the repository. This is what it looks like. So the first thing is the contracts folder. Here there is the ether splitter, the empty one. So if you go for the solid implementation yourself then you should start your work here. If you wanna use the already created contract it's gonna be here, the ether splitter ready with the split function. It doesn't have all the features from the task too. You can add them later on. And then the test section. So first there's some reference in the template file and the tests themselves should go into the ether splitter the tests where everything is set up. And here you can also see that we use ether splitter. So we import the empty ether splitter. If you want to use the already created one you should just swap the name here from ether splitter to ether splitter ready which basically would be just uncommenting this line and then commenting this one and that would make the change for you. Okay, yeah, read me, that's, that makes sense. So actually I'm gonna. Okay, so first of all you need to have the node installed and which I would guess that most of us you should have that installed already. Then you will need yarn to install the repository. If you don't have it then here's command for you to run, so we install yarn and then cloning the repository, entering the repository directory, installing the repository, and then the two commands that you're gonna be using more frequently, yarn build compiles the code and the yarn test runs proper tests. Yeah, and also some documentation sling if you need something. Okay, so I think we're gonna give you some time now and actually I think in a few minutes maybe we're gonna do some live coding if someone is gonna be lost and show you some of the things that are here. But for now, giving you some time. So, okay, so I'm Jen. I don't know, there's a kind of panel stuff like that. Apparently. Yeah, since I'm just waiting for an install in the dependencies. Anyhow, well, I really interested in writing some tests and when it comes to web two, there are tons of the methodologies and the tips for writing tests, right? So kind of, for example, is a writing kind of given when then pattern or BDD or the behavior driven test or that kind of things. So that kind of things in web two. So when it comes to web three, it seems like the security is also important. So I think that the mental model for testing in the web three world is really important. So I think, so I really wonder that you guys are thought in the testing especially in the web three world. Yeah, absolutely. So I think that one super important technique and sort of like mental model around like not only testing but developing smart content as a whole is that test driven development because like when you're like writing so I'm actually making people stand up. So if you're writing a solid decode, it's super important that the contract actually does what it needs to do. So that you don't have some unnecessary lines that you don't have any things that were put somewhere and you thought that they were gonna be useful but then at the end of the day, they ended up being not useful that all like cost gas. And this is all like a bloat that needs to be reduced. So a very nice technique is to actually test drive your contract. So actually write a very explicit expectations about your code and define what behavior you want to achieve from the contract and then implement only the code that sort of like performs the logic that is required to fulfill the sort of to make the test pass. Yeah, and then you need to go like through the whole stack. So there is sort of no differentiation like whether you should use unit tests or integration tests or some other type of tests you probably need to use all of them. So it's the easiest to just test drive your code using unit tests.  And then if you test drive all the functions, test drive all the small bits of the logic that you need to put in place, then you probably want to move on to the integration tests and see how larger transactions, how like more complex cases resolve, how performing multiple transactions in a row affects the state and sort of like how this whole thing behaves. And that's sort of also not the end of the story because then you need to have like the whole or you should have the whole like testing deployment should play around with the whole thing. You need to, you also probably should develop like the app or the script that is meant to interact with the smart contracts in parallel to the smart contracts themselves. So all of like these two like remain in sync. Yeah. I don't know if there are any other tips that I can think of. Maybe someone can add something. Okay, actually maybe someone has any more questions. And yeah, oh yeah, the microphone is coming. Do we have a speaker? Is there a Viper support? Yes, so basically the only thing that's so on for Waffle, the only thing that's different for Waffle and the Viper is that you just need a different compiler and then you basically end up with like the very same compilation products, which one is like the bytecode that's just gonna go straight to the chain and the API. And all the abstraction of like wrapping the calls with like itters.js is also like the same for Viper and SolidV. So yes, definitely there is Viper support. You just need to use a different compiler, which is also like, I think you need to specify in the Waffle config that you are compiling not SolidV but you're compiling Viper. Well, that should be it. I'm pretty sure this is somewhere in the documentation. I don't use Viper personally, so I'm not very familiar with that setup, but yes, Viper is definitely supporting. So can you also expand the discussion about testing in Solidity and testing outside Solidity because that's kind of a hot topic with other frameworks like Foundry that they use Solidity and they have limitations or things that need to be work rounded. What is your view on this? Sure, so actually I think that the main advantage of using Solidity testing is the fact, so there are two things, okay. One is the pace, so the testing in Solidity is definitely faster and just having everything inside of the EVM just makes the test run faster, so which might be important for some people and it is sometimes actually important if you want to run the tests very frequently which makes sense and you should do that, so this is a nice property, but then if you have some continuous integration system on your repository then it's probably not that important because even the JavaScript tests are not gonna be that long, so that's one thing which is just the performance which is better on the Solidity side and the other is the fact that when using TypeScript or JavaScript tests, there is this JSON RPC middleman and there is also like casting of all of the types, so for example when you call a function and then something is being returned, this is like some JSON and the big number that's being returned from the Solidity or Viper code is just a very large number that's not able, that JavaScript is not able to process so you need to cast it, you need to have special types and there were times when it was actually a problem that we didn't have good implementations of big numbers and some people were just casting to strings then comparing strings and this wasn't great, but now I think that it's not that much of a problem anymore of course, like you have all the native types and native type compatibility within the Solidity itself and while using JavaScript or TypeScript, this is sort of external and some casting so on and so forth, but I think this is not that big of a problem. I think at the end of the day, the bigger difference is like sort of collapse to what you just prefer from the sort of developer experience standpoint because I truly believe that both of these approaches can be just very precise and it can really clean your code from any bugs or any errors and are just both very good, yeah? How long the same line is that I'll talk about is have you yourself or seen instances where you're actually testing the user interface so you're basically doing the same UI testing to do it with Web2 and Solanium and then actually kind of dropping down to Solidity by executing it, for example, through a browser?  Yes, and actually perform transactions, though in this case we would need something that would just work very fast. So we, as a Ethereum network, we wouldn't use like a test net or a main net, of course, but just an emulated network, yeah? I might try to expand. So what we do in TrueFi, we run the whole blockchain with ganache or hardhat. We also run a local digraph and then we run the frontend and click through the frontend sending the transaction through MetaMask on this local network. So this is what we do, but it's separate from waffle, right? Okay. Hey guys, did you manage to download any Starian build, et cetera? Yes, you did? And how is it going? We failed, yeah, so my proposition is we are going to plug in different computer and live code with you. And if you didn't manage to download it, you can come here and we can do it together. So it's more interesting and some people don't have computers so you can do it with us here. How does it sound? Great, yeah, so let's start. Okay, so I'm swapping the HDMI to some other computer and we're gonna live code. Yeah, and let's start with this task one and Przemek will... Go on the stand. Yes. All right guys, so do we have volunteer to start the first task? We'll go the harder track. Yeah, so come here. And big round of applause for our volunteer. Come here. Yeah, so task one is we have an empty contract, empty test, and we're starting with writing test for one functionality of the contract. Then we write the function in the smart contract and then the test should pass. So, some technical problems, give us one second. So we're basically going to mob now. Yes, per programming for now, but here mob. Yes, so we want to write at our splitter. So just a simple exercise. We take an ether value to the function of a smart contract and divide it into two addresses and make sure to return the remainder if it's an odd value. So just something simple. Hey guys, can you see the text? Great. I'm trying to find another state of... I need another each state. And it won't test this leader function, right? Yeah, so we are going to start from the first test. Which contract is it? Ether splitter or ready one? We just want to see how the function looks like. Right now it's Ether splitter and empty. I guess we just have to call the... To what's this called? Ether splitter. We have an instance of splitter below. So take a look at line 30, 31. Yeah, there's splitter already deployed. There are addresses to be used. Yeah, we have an instance of splitter and we have some accounts like Alice, Bob, Charlie and David. We have to catch the value, right? Does it return something? No, it doesn't. So you want to test the balances of the accounts before and after. Something from there. Why? Yeah, because right now you use the Ether splitter, which is not implemented. Take a look at the contract right here. This one. Yeah, right now we use this, which is not implemented yet. Do you want to implement this or do you want to use the implemented one? Let's implement it. Okay. Yeah, so that's normal. That's when we do like TDD, like this is driven development. And we want to call some function and see the results of the function. Then we just have like error and we need to first create a signature of the function. Let's leave the message to the party. Let's, maybe let's start with just the function. Let's make the test pass maybe. Let's build. Let's keep the return, just make it public. Looks nice. We can save it and then build, right? And then run our tests, see that it works. Here, yarn build then. Yeah, so we need to run yarn build in terminal. So can you, this? And probably, yeah, here we use yarn, so yarn build. So now we are compiling our Spark contracts with Waffle and could generate types with type chain. And now we can run yarn test to see that our tests are passing. Let's see. Yeah, for now, great. It works. So now let's, maybe here we have like this split and now what we want to see? We want to see that as a result of split, some balances will change. So what should we put here? We have, what addresses we have? We can use Charlie and David as those two. Yeah, so we have Charlie and David. These are like random addresses. And as I understand, we want them to get, let's say, let's send one ether to split and splitter and then expect these two addresses to just get. Yeah, can I? Maybe let's expect what is before. So let's say that, so I test the Charlie and maybe David has zero before. So maybe let's start with just one address, just Charlie. Okay, so we can do like proper TDD, which is just start with simple example and then go to more advanced ones. So right now what we want to do is to first check that the initial balance is equal zero, then call this split, splitter and split and then let's expect, for example, this balance to be equal one. Or let's say 10 into five and five, right? Okay. We've just one, right? Yeah, I'm gonna instance a big number for that expresses one token. So one token, let's use this, okay. You will need to import big number. Oh, okay, it's, yeah, there it is. Actually, you don't need big number. You can do it differently. You can use properties of itters. You can call, no, no, no, not like this. You can leave it, can I show you? Okay, yeah, show like this. So we can, not like this format. I always format one. Let's import itters. And now one token should be one eater, right? But you probably want to move it higher so you can use it in this split function. Maybe. It's good. And second, because we want to pass this as a value. So these are those overwrites. All right. Yeah, and this will be this value. That function doesn't receive any. Yeah. So this will be this message value and, okay. And what do you expect next one? This is an eater's instance. Maybe we can just divide. Right, let's start with one, just one under it. Okay. Do it one. And it should pass. Okay, our terminal is broken. Our visual is to be called is broken. Yes. Okay, it doesn't expect that. What if I do try to do this? No, it's not format eater, it's parse eater. Parse eater. I always come up with this tool. Parset company. Yeah, second value. Or should I come to you? Second value. Why is it complaining? Oh, yeah, yeah, it's because it's not payable in the actual code, security code. Yeah. Payable. Good catch. Yeah. Oh, yeah. All right. Okay, you need to build. We're using actual TDP. Wait, so you need to build because we changed the smart contract. So we need to build it and then test it. No, sorry. I'm used to use it alongside hard hat. It's just one comment. Yeah, good. We're on a red test, so now we can implement it. Nice. Do you want to break or do you want to continue? Let's continue. Okay. Yeah. Let's go on. Oh, we should. Yeah, so we need those two addresses. So you can either take them in the split function or take them in the constructor. The two addresses that will be splitting. Oh, we're the hard code. Yeah, it's hard code. Let's keep it simple because we only have two addresses. Right. It was Charlie and Bob. Yeah. Bob and Charlie. Or Reciber one or Reciber two. We're gonna take the two addresses that we split in the constructor. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah, so we have a constructor with two addresses and we'll be splitting the funds into those two. Maybe we can start implementing the split right away. We have the message value. So we'll do address one that's transfer or send. The message value is the amount that was transferred through the payable function. Gently test. So this would be half of it, right? Okay. What's going on? Ah, yeah. Let's run. Our code is hanging again. Not yet, but it's hanging. So we don't have a lot of time, but if anyone would like to continue, we'll hang around somewhere here. We can help. Okay guys. We need to finish. So we didn't manage to do a lot within a short period of time and not very perfect internet situation, but if any one of you wants to continue, then we are here like outside of the room and we have our booth. So you can drop by, we can talk and we can help you to continue with everything. So yeah, thanks a lot and see you around at DevCon.


So guys I am back with another need for speed unbanned video and today I'm going to showcase to you guys a simple method in how you can get infinite money as a new player or an existing player it doesn't matter. How's it going guys my name is DPJ and if you do enjoy the video leaving a like really helps out and if you like what you want to see more be sure to subscribe. Okay so this is probably more so for the newer to recent players because if you're a player who's played this for a few hours now you can probably collect more money doing races but either way you'll probably get here 2500 every 30 seconds that's actual money you'll get for this so doing this as a new player or a recently new player this will help you out an absolute turn and well to do it guys it's so easy it's unbelievable I wouldn't even call this a glitch probably an exploit it may be patch you know later I'm not sure okay so what you need to do guys is erase until you have that five heat rating so the please are on your ass this is the highest rating you can get in the game now you need to do this by racing within the same day and collecting up those heat ratings they need to get to a five like you don't need to get to a five but you're only going to get 2500 every say 30 seconds when you get a five you'll still make money with a one two three and four rating heat rating but to make the most of this you want a five heat rating and well once you have that guys all you got to do is come to this point on the map you can see right here on your screen now when you actually get here guys which is absolutely bizarre how this works all you need to do guys is drive behind these pillars holding up this bridge and if you drive behind here slowly as you'll see on the screen now and I'll demonstrate this to you guys a few times for some reason the police just lose you yes I know this is bizarre but it absolutely works so what I was doing was I was coming around the back of this guys I was just slowly crawling towards the front you'll notice sometimes at the front you'll get teleported back but either way you still lose the police now in that rare case a police car does follow you behind here simply just drive out the front end do a little circle and come back in and the best part about this if you have got a five heat rating nine times out of ten you're going to have a helicopter on your ass or another police car right in the vicinity so all you got to do guys is once you've lost the police just drive back out get caught by the helicopter or another police car and drive straight back in I was lucky I had one of the bigger police cars off-road vehicles get trapped at the front of these pillars so I could simply just drive out reverse out hit the police car and drive back in and trigger another police chase and then lose it straight away and eventually I was just using the helicopters as you're seeing on screen now so you just drive behind here lose the police drive back out get spotted by the police again and drive back in now if you do this 30 times you will get an additional I think it's 3500 on top of the money you're making and you will unlock a few of our unlockables too by evading those police chases but yeah guys it really is as simple as that now remember once you've clocked up the set amount of money you want you have to make it to a safe house if you get busted by the cops while you lose that money so you need to make it to a safe house so be careful about that so obviously lose the police and make your way to your nearest safe house there's probably multiple uh places on the map you can do this but for me so far this is the best I have found and it works an absolute treat because like I said you're underneath a bridge as well so when you do get caught by that helicopter because you're underneath a bridge the helicopter loses you too so yes guys there we have it now I'm not sure how long this will be in the game so take advantage of it while you can I'm pretty sure they will stamp down on this and uh easy ways of making money but hey if any more pop up I'll be sure to have you covered right here on my channel but guys if you enjoyed the video leaving a like who the helps out if you like what you see you want to see more be sure to subscribe and hopefully guys I'll see you on that next one


Now sometimes the concept of enthalpy is a little difficult to grasp, so let me give you an analogy. Say you're a stall holder at a market and you're selling cherries. Obviously the amount of money that someone pays for your cherries depends on how much they want. So usually you'll set a unit price of so many dollars per kilo. Now there's obviously a relationship between the price per unit, the price paid by the customer, and the mass of the fruit that they want, and we can write that relationship as the price per unit, which is in dollars per kilo, equals the price in dollars over the mass of fruit that they buy in kilos. So say a customer hears about your cherries and knows that a friend of theirs bought 1.5 kilos of cherries for $12. They could work out the price per unit using this relationship. We've got the price per unit is the price over the mass, and that was the price was $12, and the mass of cherries that they bought was 1.5, and 12 divided by 1.5 is $8 per kilo. So that's the unit price that you're selling your cherries for. Then there's the case where you as the stall holder can use that relationship to work out how much a customer must pay. Say someone wants 2.4 kilos of cherries, so you have to work out the price. So you rearrange that relationship and the price that they need to pay equals the unit price times the mass of fruit that they're going to buy. So the unit price is $8 per kilo times by 2.4 kilos, which equals $19.20. So that would be the price that they paid. So that's the second case where you'd use this relationship. The last case where you'd use this relationship is if a customer comes up and says, I've got $6, what mass of cherries can I buy? Or give me $6 worth of cherries. So you have to work out the mass of fruit that they need. So you rearrange the relationship and you'll get that the mass of fruit equals the price that they're going to pay over the unit price. So they've got $6 over the unit price of $8 per kilo. 6 divided by 8 is 0.75 kilos. So they get that many cherries. Okay, so as long as you know two of these three things, the price per unit, the price of the fruit, or the mass of the fruit, you can work out the third missing thing.


So, we have some absolutely chilling news regarding freedom of the press, and I'm sure that most of you watching already know that WikiLeaks founder Julian Assange was arrested today. And his arrest came after Ecuador revoked his asylum status, which then allowed UK authorities to come in and arrest him at the behest of the US government who issued a warrant for his extradition. So this is a really important story, and I hope that everyone is concerned about this and is as concerned about this as I am, because regardless of how you feel about Julian Assange, the implications of this with regard to freedom of the press are broad. So to give you just the basic facts of the case, CNN reports the US Department of Justice confirmed Assange had been indicted on a single charge of conspiring to steal military secrets with Chelsea Manning. The former army intelligence analyst who supplied thousands of classified documents to WikiLeaks. The Department of Justice said that the indictment signed on March 6th last year and unsealed Thursday alleges Assange conspired to assist Manning in cracking a password on classified Department of Defense computer systems. Now there are two additional things that I think we need to make clear here. First of all, this has nothing to do with the 2016 election, nothing. This is about the 2010 Manning leaks where Chelsea Manning gave Julian Assange information that exposed war crimes that our government was doing. This was information that was obviously in the public's interest because our tax dollars were funding these crimes. So I think that we have to know about this. So that's important. So if you're still bitter about the 2016 election, you have to put your feelings aside here because this is more important than that. Second of all, it's not illegal for a journalist to publish information that was leaked or stolen. However, if they assist the whistleblower with that process, then that's really the only caveat where the government can get them. And they are claiming that Julian Assange did in fact assist Chelsea Manning. However, if you look at the details, that charge is actually very dubious because first of all, as Aaron Matei points out, the attempt to get the password to these computers wasn't even successful. And this is evident based on the language that they use, claiming that in the event she quote would have been able to obtain these passwords, then it would have been the case that Julian Assange had assisted her successfully. Now second of all, before he even allegedly attempted to assist her with this process, she had already provided him with information before he supposedly tried to help her crack the password. So those are two really key details here, which makes this charge completely dubious. Now third, the Department of Justice claims that he actively encouraged Manning to provide him with more information after she had already given him stolen documents. But as Glenn Greenwald points out here, this is a standard procedure for a journalist. It's literally them trying to criminalize journalism because if you are a journalist, then obviously you're going to want more information because you're building a story. You're building a case. So the fact that he was encouraging her to get him more information, that's a nonissue. That's just him being a good journalist. So these charges against him are absolutely dubious and it really doesn't seem like they have a case against him. But nonetheless, if they want to convict him, they're going to find some way to do it, which is troubling because think about the implications of this. In the event, a US journalist, for example, publishes leaked information about the Saudi government and Saudi Arabia then encourages the US government to extradite that American journalist to Saudi Arabia. Isn't that problematic? Isn't that troubling? Because if we're setting up this new precedent where governments are complying with foreign extradition requests of their own citizens, then the implications that this has for journalism globally, it's horrifying. Because if you're a journalist and you fear that you will be prosecuted for whatever dubious reason for publishing leaked or classified documents, which is protected under the Constitution, but if you're worried that they're going to get you because they're going to claim that you assisted in that process, then what does this do? It's going to dissuade journalists from seeking out this information that they need to publish. It's going to dissuade them from wanting to release this information that is in the public's interest, which means that they're not going to be an effective check on government tyranny and government abuse. So the implications from this are absolutely vast. And I'm honestly shocked that so many liberals even are celebrating this. I mean what we're witnessing here is an overt attack on freedom of the press. And we're watching democracy die before our very eyes. We're slipping into authoritarianism and I'm not being hyperbolic. Democracy in America has been dying now for years, but I mean it hasn't happened rapidly. There's no sudden change, no revolutionary change, and it's happening really gradually. So what allows people to adjust to it?  It would immediately jump out because it would notice how hot that a boiling pot of hot water is. But if you just stick a frog in a pot of water and then you gradually turn up the heat, well it's going to be able to adjust to the gradual temperature increase and not really know that what's being done to it is harmful. And that's really what we're seeing here when it comes to American democracy. And if you can't have freedom of the press, then democracy cannot thrive. Now another thing that I want to touch on here is that when Julian Assange initially published the Manning leaks, Obama's Department of Defense chose to not prosecute WikiLeaks itself because they were worried that obviously that would pose a threat to freedom of the press. Now they aggressively went after Chelsea Manning, but they chose not to go after WikiLeaks because they didn't want to set this precedent that allowed for journalist outlets to be prosecuted for the publication of classified documents because obviously that is protected under the First Amendment. However, when Trump came to power, it was evident that there were people in his circle hell-bent on taking down WikiLeaks and Julian Assange. And after previously saying how much he loves WikiLeaks, Trump is now playing dumb saying that he doesn't know anything about WikiLeaks. And ask yourself this, after it's widely believed that WikiLeaks was releasing the Clinton emails at the behest of Donald Trump and creating this imbalance of information where we knew what the DNC was saying, but not what the RNC was saying after it was widely believed that WikiLeaks was doing this to assist Donald Trump, well, why would Trump officials then turn around and want to prosecute WikiLeaks knowing that they were assisted? Well, it's because WikiLeaks exposes information about the US government.  And that's what we're seeing. That's why Trump's administration wanted to go after WikiLeaks.  This was evident since before he got elected when he was running as a candidate. We knew that he was warning that he wanted to bring back libel laws. And he often refers to the press as the enemy of the people. So, of course, if he thinks this will set a new precedent where he can then prosecute journalists who publish harmful information about him, then he's going along with it and playing dumb when it comes to this issue. So, it's odd to me to see this unholy alliance between the Democratic Party loyalists, the resistors, if you will, and Trump's administration because this is harmful. And they don't care that this is about the 2010 leaks where Manning exposed US war crimes. They're just glad that Julian Assange is being brought down. That's all that they're happy about. They're just glad it's happening after screaming about wanting to protect freedom of the press. I mean, this is literally only empowering Donald Trump to more aggressively crack down on the press. So, I mean, this is absolutely troubling. And I want to read to you the ACLU statement because I think they do a good job at putting this all into perspective. Ben Wisner, director of the American Civil Liberties Union's speech, privacy, and technology project issued the following comment in response. Any prosecution by the United States of Mr. Assange for WikiLeaks publishing operations would be unprecedented and unconstitutional and would open the door to criminal investigations of other news organizations. Moreover, prosecuting a foreign publisher for violating US secrecy laws would set an especially dangerous precedent for US journalists who routinely violate foreign secrecy laws to deliver information vital to the public's interest. Wisner added, criminally prosecuting a publisher for the publication of truthful information would be a first in American history and unconstitutional. The government did not cross that Rubicon with today's indictment, but the worst case scenario cannot yet be ruled out. We have no assurance that these are the only charges the government plans to bring against Mr. Assange. Further, while there is no First Amendment right to crack a government password, this indictment characterizes as part of a criminal conspiracy the routine and protected activities journalists often engage in as part of their daily jobs such as encouraging a source to provide more information. Given President Trump and his administration's well-documented attacks on freedom of the press, such characterizations are especially worrisome. Now on top of that, I do want to share some reactions from people in the political world because I think they provide us with some really valuable insights. So Edward Snowden tweeted out images of Ecuador's ambassador inviting the UK's secret police into the embassy to drag a publisher of, like it or not, award-winning journalism out of the building are going to end up in the history books. Assange's critics may cheer, but this is a dark moment for press freedom.  Be quiet, behave, toe the line, or you will pay the price.  This is the real threat to press freedom. And that's absolutely it. Anyone who purports that they are free speech warriors, the Dave Rubens and Ben Shapiro's of the world, they should be screaming the loudest right now. But let me just say this, I am incredibly, incredibly proud of progressives because they've been the most vocal here about this. So this is something that is incredibly important that we have to fight and speak out again. So I'm going to link you to the WikiLeaks Defense Fund. And that'll be in the description box if you want to donate. Additionally, if you live in DC, if you live in the UK, there will be planned protests. So at the time I'm recording this, I don't have specific information. But if you're able to attend those, that would be absolutely phenomenal. What we have to do now, all we can do really is make as much noise about this as possible, share this information and share to people the consequences that this will have. And most importantly, educate them because people don't know that this really could be incredibly problematic going forward when it comes to freedom of the press. We really shouldn't have to spell this out for people. But in a really polarized environment where everything is left versus right, we've got to step back and understand that this is about democracy. This is about freedom of the press and everyone should be outraged and shaken to the core over the arrest of Julian Assange.


Hi everyone, I'm Tanya and okay so my previous job I was like a web app pentester and then I started working at Microsoft and they like let me do whatever I want to Azure which is really cool and I realized that like everyone I know is like can you show me how to do a pentest in Azure and I was like uh maybe I should write a talk.  So she's not here because she got offered so much money that she had to go do something else and I have to say if I got offered that much money I'd probably go too. But anyway so she's really amazing and we wrote this talk together. Okay so where are we gonna, oh yeah I have to stand still. What are we gonna talk about today? So we're gonna talk about doing it yourself. We're gonna talk about doing a security assessment yourself before calling a pentester.  People aren't even ready for the pentest and so I want to show you all the stuff that because if I come in and then like everyone if the security's like here then you're not getting your money out of me. Does that make sense?  Okay so here's the mandatory about me slide. This is the one where like we prove that we're qualified to do our talk. I like punk rock and I'm Tonya Janka. On the internet she acts purple. I work at that startup company. I don't know if you've heard of us.  I'm totally obsessed with a wasp. It's ridiculous. I'm part of Wosec women of security so if you're a woman and you want to make more female friends or work in security you can talk to me and oh also I speak French in case anyone wants to ask questions in French if you're shy. This is Terry. Terry's awesome. I'm Terry's biggest fan. She's a badass cloud hacker. I want to like put over top of this just badass cloud hacker and she's like no Tonya just remain calm. She's a lot more serious and like very professional when she presents and I'm the silly one. So she's been programming forever. She is so basically she does cloud security training and testing and she has a wealth of experience that's just out of this world and I learn from her every time I see her. So Wosec security assessment it's not pentest slightly different. So we find all the vulnerabilities and gaps and then try to help you fix them. Right so we're going to do a lot scanning. We're going to talk to people. We're going to if you'll let us look at like our architecture review we might threat model things and then at the end just the same as a pentest we give you a report except for like it's just I don't know I prefer security assessments but pentests are cooler. Okay so as a pentest so similar to a security assessment except for you burn everything down. It includes exploitation, pivoting to other areas. There may be targets, objectives like things you're supposed to steal. Basically we're trying to prove the systems can be broken into. Terry's way better at this than I am. I'm more like I'm going to help you set up really good policies and do this and do that and she's more like and then everything's on fire. But you still have to do a report. There's no getting around it. Okay so why would you want to do it yourself? Why would you because like we're expensive, pentesters are expensive. Also like almost no places have their own pentesters on staff. Like unless you work out a big startup like I do you can't usually afford like a team of pentesters. You also want to have like not the same pentester come every time because you want a fresh set of eyes but security assessment you can do that yourself. So we're going to go through a big list of things that I want you to go look at if you have Azure. Okay so who here uses Azure? Awesome. Okay I want all of you to have good experiences because then my boss will think I'm cool. No because I want you to be secure.  Okay so first thing do not test the Azure fabric. You don't want make Chris off to be angry at you. You don't. I don't either. So that means the infrastructure, the fabric of the cloud like that's the thing that is us. That makes us unhappy.  It's just so much easier because if we see something we might just be like no. Right because we're trying to protect all the people and if what you're doing is kind of like out of the blue and weird we might not understand that.  Thank you. We'll watch out for that. Okay so here are things that are out of scope. So there's a lot of things I'm not going to cover in this talk. Sometimes after talk people feel like you didn't cover this I'm like yeah that's not what the talk was about. So I'm going to give you a list because I only basically talk about app sec all the time. So we're not going to talk about DevOps security. We're not going to talk about application security, API security, password management, physical security, enterprise security.  We're only going to cover that. There's also going to be after this slide no more Rick rolling. That's the last one. Okay so let's do this. Okay so the first thing you want to do is define the scope of your assessment. Right? Guess what's bad? It's testing a thing you're not supposed to and then your boss getting pissed.    I know I've been one. So you want to talk about like is data part of this? Is application security a part of this? Because some of them think that it is and some of them think it's not. And I assure you everyone has a different opinion. I've learned because sometimes they're like oh but you're also going to fish our employees and like no what? You don't want me for that. Everyone has different skill set right? So definitely in this network security is part of it. Access control is going to be a part of it. You need to make sure that each thing is and you want to make sure also that they're not like hey you're supposed to test that and you didn't. Right? So you want to make sure everyone's on the same page. Also often they want to talk about methodology. I've seen a lot of people point to like that. Appendix or methodology web page and it's like copy and pasted and I'm like no. I like I try to explain to them what I'm going to do with like real words that they understand and then actually like write it into an appendix so that they know because I just want them to be comfortable and I'd rather spend a bit more time but that's me. Okay so also are you going to only do cloud stuff or are you going to do internal stuff or do they have a multi-cloud instance? So a lot of what is happening right now I'm not sure if you're aware but so a lot of people are so super-duper-duper in bed with one cloud provider they realize like that is a lot of eggs and only one basket and so what they're doing is they're doing two clouds and they have them talk to each other. They have secure stuff in between and they monitor and both are both clouds in scope. You definitely want to make sure that you know that before you get in trouble. You also want to know if you're supposed to test the incident handling or not. Make sure the incident team knows you're coming. You know that. Okay so you want to make sure that each thing that is or is non-scope. Okay here's the scope of our assessment so we made this talk because I was like trying to so I have like this little show with my friend Nancy and Francesca and Nicole and basically so we just like live stream us being nerdy and so I really wanted to have Terry on so I was like let's do a pen test of our website so we did one as so we did one of devslop.co that's my open source projects website it's ugly I know and so we did also my entire Azure subscription at that moment. We did the SQL database for the app the network stuff I was supposed to have deleted from previous demos but had forgotten and the VMs and there would have been containers but I didn't have any so haha Terry couldn't get them. We didn't test the web app itself because we already do that on the show all the time so that is our scope that we set and we made a video just as an FYI and we were a bunch of articles which I'll share at the end so you can see like in detail all the steps we did and demos and stuff so that and then there's like a checklist that's written down for you so just you know I'm not going to leave you hanging. Okay so the very first thing that Azure will so Azure will nag you it will tell you like this is bad and so the very first thing that always tells you is like go so go check that every single subscription has multi-factor authentication on this is the keys to your kingdom this is the keys to everything ever so it will give you 50 Azure security points it'll congratulate you and be happy it will nag you constantly if you don't do it because MFA multi-factor authentication is so important I was supposed to wear a t-shirt on stage but they didn't have my size but anyway so I made a video about how to do that so on the bottom a bunch of these things are gonna have links and it's either an article or a video about how to do the thing that I'm talking about because again I don't want to leave you hanging sometimes I find it pressuring I go to a technical talk and then I'm like oh that's cool how do I do that or like I look it up and there's like 50 pages I'm like which one's the one that I should look at this is the one I think you should look at but anyway so number one is that you should do that I don't know if anyone follows me online but I've been hassling the crap out of all so I'm from Canada that's why I say a boot yeah I like I don't think that it's weird but anyway so I like I so we only have six banks in Canada unlike America where I hear you have at least 10 and so like only one of them uses multi-factor authentication I'm like yo I gave you all my money I really want to be secure so I've been just hassling them over and over and then so I wrote an article about multi-factor authentication and I'm just it's really really important and so this is just very dear to my heart that I want us to protect all of our customers okay next so identity and access management so you want to make sure that you have roles set up you can make your own custom roles almost everyone does like if you're an enterprise if you're you know if you're a startup whatever if you have six people you don't need to make your own roles but if you have like 20,000 people you're probably gonna have things that are very special for you want to make sure people have the right roles so if I'm a DBA I should have database owner access but I'm not DBA so I should not have it and Azure actually always complains to me about it so you shouldn't have DB owner Tonya I'm like I know so you want to go and verify those you can set those in policies within Azure you can create your own custom policies when I used to think of policies what I thought of was because I worked for the Canadian government and it would be like a website of like white like space and then black text that would just go on endlessly and and it would be boring and I wouldn't understand what it meant but when we say policy here what we mean is it's like a list of rules are kind of true false that you've sets and then it goes in it checks for you in real time and says that guy doesn't have MFA on that websites available via HTTP no that's and so it tells you all the policies that you've broken and so that's what we mean when we say policy so I don't know about you but when I hear policy I think of a lot of text and you also want to make sure that you're doing least privilege so again don't give Tonya database admit owner access because she's not DBA another thing you want to verify is that you're using service accounts when you should use service accounts so if I am a person that is using our network I am I'm Tonya jank on the network but when I make the Devslop app and it needs to talk to my database it shouldn't be Tonya's credentials because what if I quit right or like what if I become evil okay what if I quit and so the idea is that then you have this service principle or a service account that does this you should never be having your apps call things with some developers credentials that's very dangerous that also means that that developer has superpowers you don't want that you want to see Tonya did this but the Devslop database made this request and that they're separate so you when you look at logs that they make sense okay and these apply to everything in Azure you can you can set up a thing for literally everything because that's how it works this can work in multi-cloud situations so if you extend Azure AD onto your premises or into like let's say AWS or GCP it will monitor all the things there so you can have it do all the stuff there or you can use a different identity system within Azure and it also works for Azure stack so Azure stack is like where you have your own data center and you're like no way I'm putting that in Azure but I really like Azure so we're going to bring Azure home and so then here's like so we have this thing called Microsoft learn which are basically free lessons and so I made one I did not make this one but it's basically there around like 45 minutes to an hour like walk through with sandboxes you can try things and play with them and so I made one it's like five security things developers need to do before they pushed a prod but so basically like we have one on most of the things because we want you to do it right okay this is a terry slide so pretend I'm being very serious okay so account structure and governance so this is probably different than in your home data center if you have an on-premise site or if you have an on-premise data center so everything goes down kind of like this you can have this top view where you see everything right or if you're me pretty close to the bottom and so I can only see me and then like my teammates because that's how we've arranged it of course I was like I should use security for our whole team they're like please remain calm no you cannot look in your coworkers subscriptions but anyway so you want to make sure that you have policies and that they cover everything you want to make sure that people only have access to things they're supposed to for instance you don't want me being able to add security to everyone else's apps without their permission all these things so first accounts management group subscriptions and resource groups resource groups are like a directory or a folder in Windows they're not like a real thing they're not like it's not like a network security group it is not protected it's just like oh I'm going to put all the things for this project in this bucket but everything can see everything else just to be clear those are not security borders those are just for organizational purposes so please don't assume that when you put something in a resource group okay but you can give permissions to resource groups okay so who's heard of sis the security for yeah it's under for security internet security it's like crowd sourced security knowledge which is really really really cool and they have best practices benchmarks and there's so much cool stuff so a whole bunch of people so like we contribute to it and we also benefit from it and lots and lots of governments do especially in the United States okay so sis as this is kind of famous for their 20 critical controls so when we're creating all these policies in Azure and by we I mean like they did the hard work one of the things they decided to do is like oh like what if you could just check if you're following the sis benchmarks what if you could just check to see if you're HIPAA compliant so we've added I don't know if I have a screenshot of that but we've added a thing where you can just go check and it'll tell you one by one if you are or not compliant to these and it'll point you to where you're not compliant and you can click it and then you can go down and once the lectures over then you can go fix it well I don't know I think that's pretty cool because I like it when I get point rather than like you have a vulnerability is not up I like to have it be like this virtual machine does not have this enabled or this one's missing this patch I like it to be really specific okay so here's some sample controls inventory and control of software assets who has a perfect list of every single app that is in their cloud or on-prem yeah exactly right so this will tell you so this is an assessment and then there's controlled use of administrative privileges guess who doesn't get administrative privileges at work I know right only see level of executives need that okay so I'm on top of so it oh here it is is here's where it will assess sis benchmarks so we have one for Azure exchange server IIS etc a lot of companies do this because we want you to follow best practices so we want to make it easy so you can go and download the CIS benchmark and have like this checklist of things to check but like I said in Azure it's automated so you can go through and then click on it and it'll tell you okay another thing you can do is you can download images that are already hardened and set to this that's cool I'm lazy I don't want to do things twice if someone else can do it for me that's awesome so we have I believe 126 as of May when we made this slide not bad right okay so one more example control so ensure that restricted access to Azure AD administrative portal is set to yes so then it actually gives you the exact here it is step by step like what menu you click on exactly where you go um Microsoft is Microsoft right it's going to be like glossy we want to hold your hand we want to make sure you know what I mean like it's not like an open source project where it's like you just have to download these 25 other things and compile them yourself and then also you know what I mean like I don't know so we're really won't want you to get to the end okay so then um so my favorite part and the thing that you should probably look at right after you ensure MFA is turned on is that you should just go to the security center um I have a link at the bottom so I'm not I'm not doing a demo one because I don't have time and two because I'm afraid of the internet here and I was just like I am not willing to sign in and use my I'm just not willing to do that on this and it's sorry no offense it's not you it's all people know in this room um but so this is like the start of what it looks like and there's three sections so the first one at the top you can see policy and compliance so we have a secure score was a secure score I know people like oh gamification blah blah blah when I worked in like a not in a sock but like I was on the instant response team and like the enterprise security team it was really hard for me to show my boss I was doing a good job because he would only see me when there was an incident or not at all right so then like if he didn't see me for a month it's like oh it's time you've been working and then when he would see me my name was a swear word and so here I can say like look I went from 48 to 550 like I've done I've checked off these things so you can see like your mark go up of when you improve different things and it also helped you know like what the biggest bang is for your buck like if it we give you five points it's a low priority if we give you 50 points that's the highest you can get and that's for turning on multi-factor authentication and so then also regular regulatory compliance so ISO 27001 etc so you click on those and as best we can we're going to tell you where you've done a good job or not okay this is the part where you can figure out who is or is not covered by Azure Security Center so there's like a free version and then there's like the paid version I work there so I have the paid version the free version is completely awesome and then the paid versions like even better basically you get a bunch of extra tools that we made and you want to make sure that at least the purple is at 100% or the blue you do not want any in the gray of not covered it's free come on so you don't want anything to not at least give you like the list of things you're missing right okay oh and I have like little links at the bottom to all of these because I felt I didn't have enough time to explain all of them and I'm so worried how much time do I have okay sorry okay I better move it all right so and this is where you set security policies those are the things like the checklist will basically like one of the things for instance I want I only want my apps to be available via HTTPS I do not want HTTP to be available external anymore that's my personal policy slash that's what Microsoft also wants so and so like that is one of the things that would be in my custom policy so you can set your policies here okay so cloud security zero trust you can do zero trust in your own data center however okay who's here has heard of zero trust okay yeah so the idea is is what we used to do is we would have firewalls we call it zoning or network security groups and just firewall and everything inside it's like you're probably okay we're all in the data zone everything's probably fine but then if a bad person a malicious actor got in then they could just pivot to any any of the other ones and get all of the things but now with zero trust you're just nothing trusts anything and the reason why this is important is because of pivoting and if you do it for everything it's a lot easier I'm going to show you like a way that you can do it in Azure and we have like a couple automatic things so you can do this in regards to ports you can do this in regards to firewalls you can do this in regards to your apps okay terry made this graphic she I told her to print pictures or stickers of it I love it I want to stick her on my laptop hackers hard flat networks okay so um don't have a flat network that's what this slide means basically like good points for good network design basically follow best practices of networking in the cloud right like some things don't change when you move to the cloud okay next um has anyone seen this article um vignesh uh wrote it and it's about how basically there is a vulnerability and confluence where everyone just left something open and then he managed to report on over 50 um uh bug uh bug bounties in like just a few hours and he was really happy and so sometimes if you find one vulnerability you can just go to all of the bug bounties and get the money and he did that and it's just a lesson for all of us that we need to make sure everything is following zero trust okay network security groups also known as firewalls it's just like zoning and that's what we call it in Canada um okay so yes we should um basically what we used to do is we used to have most the ports open instead now we have all the parts closed except for the one you need and is the next one zero trust no okay never mind I'm gonna tell you more about closing ports in a second another cool thing another cool feature is network watcher and then there's a section and it's really small and it's highlighted there on the left and I know it's hard to see but it says effective security rules so the network will it's like wire shark kind of but for Azure and it's part of it and so you can watch everything as it goes back and forth um but then there's like a special security sections where we just highlight that it also so like let's say that this is what your app looks like then you can go in there and I know it's hard to see because it's small but it will actually map it all out for you visually which is pretty sweet no more sitting there with Vizio for 10 hours trying to make this oh my gosh um so Azure makes us own a firewall we basically make one of everything now except for password managers and so we have a firewall it's just like a regular firewall except it's from us um and you can use it to set up these privileges rules you can put it around storage accounts logging always turn on the logging right no heads nodding um so you can turn on logging and then um you should turn on monitoring okay next VPN virtual private network we also have one of those I feel like Terry's slides are so much prettier than mine this is a Terry's slide so this is what it looks like um but we also have something slightly different in Azure called Azure Express Route so what a lot of people are doing is they have so no one's like oh tomorrow we went to the cloud like we went on one day it usually takes a few years and basically the new things go there and a transformation or migration takes months to years right so in the meantime we have Express Route which is a VPN in between you um and Azure and they also make sure that you go really really really really fast okay next Bastion host so who here has heard of a Bastion host okay who here calls it jumpbox because that's what I call it and Terry and I are both like what are you talking about okay so it's also a jumpbox so you can have the box that you go into from outside the network and then you hop you jump to the other or you bastion you jump to the other boxes right but instead of that a thing that you can do now is called just in time which I'll explain in a minute okay I'm going to talk about a couple things that are only available in Azure which means awesome okay so adaptive application controls that's wait listing just in time VM access that is instead of a jumpbox network hardening um which is not in preview anymore it's out now uh it just tells you like this is bad you should change this it just helps you harden your network it's really cool file in time and then you have to preview anymore it's out now uh it just tells you like this is bad you should change this it just helps you harden your network it's really cool file integrity monitoring which I feel goes really well with the first one wait listing so if any of the core files within your system changes it tells you right away because something bad's happening so oh yeah so we're going to talk about that one first oh and that one too I recorded lots of demos and then realized that I had less time okay just in time is like a zero trust for ports so it closes all of your ports um that's one of my apps call or one of my virtual machines is called devslop decheck and it's part of the devslop project and I have OASP SAP installed on it and so I have all the ports closed 100% of the time if I want to use one of the ports I have to make a request let's see if I have yeah so I request access and then I tell it how long I want it for so for um 8 8 or 3 3 8 9 so I want to already pee into it so I click on I say only my IP address so it means I have to have use multi factor authentication to get into the Azure portal and then I have to have like access to go into there then I turn it on and then it's on for only three hours and you have to be coming from my IP to get in and then there's a 64 bit random character password that you have to do so between all of that even though I live stream I'll go in and I'll be live streaming no one's come in pretty good so instead of a bastion host I do that adaptive application controls wait listing um it's basically so again on the same virtual machine I have OASP SAP installed which is a hacker tool right like I could do malicious things if I were malicious with it so I really don't want anyone else using it so I have wait listing turned on when what that means is system things can run on the virtual machine because it's windows so the basic windows stuff and zap and the zap API because I call it and nothing else can run on there so if someone tries to install something on it it won't run and if someone tries to change one of the core system files it will alert me and that won't run because of file integrity monitoring so together it means my VMs pretty damn safe especially with all the ports closed yes I'm okay so another thing that I like to do is so Azure will set up alerts I don't know if I have time to tell the story of Azure telling on me my second week at Microsoft I like okay no I don't and so anyway it will give you alerts that are really great and so you can turn on threat protection which will stop things and also alert you for storage and also for your databases it's um it's not a web application firewall it's at the network level next a WAF a web application firewall that is at the application level as opposed to the network level who here's heard of a WAF awesome so guess what we make one so here we have the WAF application firewall rules and they call them the OWASP rules but they're actually the core rule set rules which is an OWASP project and you can have level 2.7 or you can have level three obviously you want the new one who's like oh give me the old rules no one anyway okay so network watcher not only um can you see um all sorts of things going back and forth like you can watch the flow of traffic so yeah there's some there's some wire shark for us I was going to say doesn't this look oh that is wire shark you're like is this Terry's slide I can't tell um okay so there's a whole bunch of network tools including so there's intrusion prevention intrusion detection um there's DLP there's DNS there's firewalls and WAF so firewall network level oh two minutes okay there's stuff we also make a sim sorry we also make a sim it's called sentinel and there's a company named sentinel one and we're not the same thing but they're also cool um and then we also have advanced data security so you can classify your data so you know when there's an incident if it's the end of the world or if like you can go get a snack um and we'll also we have we can run automatic VA's all the time okay so I'm really sorry but I only have two minutes and I'm just gonna skip to the end where we do the checklist with you okay so here are the things I need you to go check and then you can go watch this online after set your scope only only check things in scope verify account structure identity access control all the same best practices apply it's just different settings right you already know all of that set an Azure policy and then if someone is not obeying it go buy them donuts and ask them nicely and then after go check turn on Azure security center so after you turn on MFA turn on Azure security center at least on the free level it's free and then just go through and do all the recommendations and fix them use the cloud native features so there's threat detection adaptive application controls file integrity monitoring just in time and now there's network security hardening and follow the network best practices like they all still apply so network security groups routes access network watcher firewalls express route jump boxes and make sure you're on top of your alerts a thing that you can do is you can like go through and start customizing them so it stops of learning you on things that are annoying there's a lot less alerts in here than there are on other sims I've used because we know ourselves as opposed to when you plug in a different Sam you have to teach it for a long time oh I'm so done done I'm done now I'm done okay so what we learned today other than we're done we learned this and here's the resources just take a picture of this that's it thank you