Good morning everyone and welcome to the Packard Hackey Village at Deaf Fund 25 in Las Vegas, Nevada. First and foremost, I would like to thank you for all the support and your contributions for all these years. If it wasn't for all of you and for your support, if you would not be here, there's such a big village and such a strong workforce. So we are very, very, very grateful for that. The Wallachieff mission is and has always been on security awareness. This year, the Packard Hackey Village has a number of events and learning opportunities including the venerable Hackey Detective, which is in the Appleton, and Capital Hackeys. We also have a fantastic slate of DJs to keep the village entertained. Okay, keep it nice and entertained and lively. The Gearsheep City and the Honeypots are back. We are also very excited that we have something new in store for this year. Hands-on workshops. There is a tremendous demand for training and continuing education in this field. We hope that you will take advantage of the many opportunities here at the Packard Hackey Village and ultimately at Deaf Fund to learn, to collaborate, and to be inspired. And of course, here we are at the speaker workshops. This is a very special year for this event. The speaker workshop is by the Packard Hackey Village. This is the anniversary of the speaker workshops. We are going to kick it off right off the back with a very, very special keynote. Dan Gears said in this keynote at Black Hat 2014, and I quote, Time security is now a limiting concern. A cop issue is many venues more important than this one. Or in that place that lightly at the 11th hole last year in 2016 in New York City, and I quote, We are now in a national security crisis. Time security crisis. So what does this have to do with the keynote this morning? There are now many people starting to enter or study cyber security, which is very, very welcome for me to see. However, the body of knowledge is now too deep and intimidating to grasp and history is easily forgotten. How did we get into this mess in the first place? In May of 1998, a group of hackers touched a pride in front of a panel of U.S. senators. The hacker group was locked based out of Boston, Massachusetts. One of the members of law protested by what went wrong with White Sox. Lots more on that internet. The software and the hardware are not safe and security is an afterthought. Their warning was a disaster for coal, and as we all know, tragically ignored. On a side note, please read the wonderful Washington Post article. Well, it's a disaster for coal and ignore. Their warning and efforts also drove a wave from many of our careers and lifestyles in this field, including mine. And why many of us are here today at death march. It is my fantastic honor to introduce you all. It's a pleasure to be here speaking today. My first time speaking at the package village. And since it was the 25th anniversary of DEF CON, I've been coming since DEF CON 4. I think I missed a few along the way. But I thought, you know, why not have a bit of a retrospective to talk about how we got here and what an impact hackers had on the security industry and really made the security industry what it is today. It would be very, very different if it wasn't for the input of people who were doing independent research and taking that hacker mindset. So I'll start off where Ming started off here. This was the picture of the gang of us testifying before the Senate in May 1998. Can't recognize me. My hair is a little different. So to go to you, that was a little bigger back then, but you might probably can't see it. But on the placards there in the front, you can see hand-tink-tink buzz while on space road. And this kind of interesting aspect to this is when we got invited to come to speak, we said, well, we'll only do it under our hacker aliases. And they said, why? And they said, because we have day jobs. And back in 1998, if you were called a hacker and you had hands-on keyboards at some IT, in an IT admin responsibility, they might say we don't want someone like that with that kind of responsibility. You might lose your job. So that was the mindset back then because it hadn't changed yet. I don't think you'd have that today.  They'd probably say, hey, we need to give you more responsibility. But back then it wasn't like that. But how did we get to this point? This is around 1998. Things had to happen before that, before we got invited. And what I like to say is we made trouble. We got noticed. And how did we do that? We made people upset. We didn't break the law as far as I can talk about today. But we did make people upset. People didn't like the idea of full disclosure. Microsoft really didn't like that.  They didn't like that because then all their customers, including banks and the DoD, would say Microsoft, your software is insecure, it sucks, fix it. And that costs them money and it makes them look bad. So by causing trouble and causing pain for other organizations, we actually raised a lot of awareness of the kind of problems that were out there. And we kind of stumbled upon this. I can't say that there was a master plan. We just started taking our research and instead of just sort of posing it to bug track and being very academic about it, we decided that we really should be more consumer advocate focused. We should take the research and instead of being just pure technical research, we should think of it as vendors are doing bad things that are harming consumers. And that really started around 95 or so and it changed it from like, oh, I know how to break it to your system to, wait a minute, the vendors are shipping code that is causing this problem for their customers. And I think that was a big sort of paradigm shift that caused hackers to be that force that was siding with the user, right, quite for the user, you know, was that the Tron one. And so by sort of causing trouble, we got noticed. And that is how the Senate came to us saying, you know, you guys have an angle on this that's different than what we're hearing from big vendors. It's different than what we're hearing from the government accounting office which is really just going through a checklist saying, you didn't figure this correctly, you didn't figure this correctly. And that's how the government thought about it. And we basically said, hey, the vendors can do better. They can ship things that are secured by fall. They can ship things that aren't as broken. The problem was vendors didn't know how to do that yet. But we'll get it done. So now I just want to go back to what the computer security was before hackers came onto the scene and started to inject themselves into the dialogue. We had the famous Orange book, Common Criteria, which was basically a lot of things that you should do to build a secure system. You know, you need all those features and functionality. You need your encryption, your authorization. You need your logging and your auditing and all of that. But it left out the fact that there could be mistakes in the software that the engineers might actually make mistakes. They didn't even think about that. This is not in that book at all. Who has software that has bugs in it? Software has always had bugs in it. Yet this was completely ignored in the Orange book. It's like the software was perfect. You'd have great security if you followed the Orange book if you made perfect software. Well, we all know that doesn't exist, right?  You're building systems with bugs in them. And we're going to exploit those bugs and we're going to bypass all of your controls. The other aspect of the way computer security was thought of was SIRT.  The problem was this was really a government funded and a government organized with a government mindset. And the mindset back then was sort of like the intelligence communities today is like, yeah, we'll hoover up a lot of information, we'll analyze it, and then we'll give out the information to you that we think you should have, right? So basically SIRT was they wanted to be in control of vulnerability information, weaknesses in software, weaknesses in configuration. They wanted to be in control and manage how the public knew about weaknesses. So if you reported something to SIRT in 1993, it might just go into a black hole and they might stop communicating with you. They said, hey, we're the good guys. Send the information to us and we'll make sure that security gets better. But what we found out was we would send them information and we didn't know what happened to it. We didn't even know if they contacted the vendor. We don't even know if the vendor patched the software or what patch was available to fix the issue we might have told them. So it was a total black hole and it didn't work. So that government mindset of closed controlled information just doesn't work when it comes to securing our world. So in 1993, I was just starting to get involved with the loft at that time and I got introduced to this paper, improving the security of your site by breaking into it. And to me, this was a seminal paper. If you've never read it, go out there and read it because this is what really they really codified, really how the hacker mindset can be used to secure systems.  Look at the technique they're using to compromise the system and then basically test all your other systems to see if they have that problem. I mean, it seems completely obvious today, right? But back in 1993, this was actually a new concept. People who did security for a corporate network did not do this. They didn't do this at all. And so what Dan Farmer and Weetsie Venema did was they started collecting information about how systems were compromised. It was a trust violation with exploiting trust with our hosts. Was it a weak password? Was it a well-known bug? And they started to script these up and put them together. And what they really did was they made information security a participatory sport. There was this give and take between the attacker and the defender where the defender can learn from the attacker. And so studying the way attackers behave or simulating how an attack might happen or practicing red teaming were all things that hackers brought to the table. And they made security an active participatory activity as opposed to a static configuration of features and technology. So around this time, we started to see the first hacker tools. We have so many tools today. It's completely awesome how many people write great tools and put them out there. But these are some of the very first ones that came to the table. I was looking sort of for what was the first hacker mindset kind of tool. And I think it really was crack by Alec Muffet. He came up with the idea that you could test the strength of your passwords and see if they're guessable, right? It makes perfect sense, right? Like why not see if your users are using weak passwords and tell them to fix it, right? But again, it takes that hacker mindset to do that. The normal security person's mindset didn't do that. It took the hacker mindset to kind of change that. And this was a radical notion back then. Again, it seems completely obvious today. But it really was a radical notion. It was so radical that Randall Schwartz, who was assistant administrator at Intel, got fired for running crack on the systems that he was responsible for. He was responsible for the security of the system. He ran crack because he had read about the tool. He understood it. It made sense. I'm going to see if any of my users are using guessable passwords. And someone caught him running this process and doing this. And he got fired and charged with a felony for running a security tool, a hacker tool, right? It wasn't considered a security tool. This example here is a program called Satan that Dan Farmer and Weetsy Venema wrote. And they were automating all the things that they were learning from attackers. I was saying, you know, security network by breaking into it. They said, why don't we automate that? And why don't we script it up? So Dan wrote this tool and released it. And he called it Satan. I'm not sure exactly what a system administrator toolkit or something like that. And once he released it, he got fired from his job at SGI. He was a programmer at SGI. And they saw that he released a hacker tool and they just fired him. They said, we can't have a hacker working at our company that's releasing these bad hacker tools. This was really the first vulnerability scanner. And now it's a huge market. It's a standard thing that you do. But there was someone who had the right to first one and the person who wrote the first one got fired. So I think some of the theme that I'm trying to bring across is progress is made by people who are making trouble. They're doing things that other people don't like. It's not illegal, but they just don't like it. They don't like the idea that these tools are out there that can break into their system because they don't understand. And over the past 20 years we've gotten more people to understand, but there's still things that we have to do to make trouble to keep pushing the envelope. And then Hobbit wrote Netcat in 1996, which if you haven't played with Netcat, at least read the Read Me file. I'm sure here people at the packet hacking village have played with Netcat, but the Read Me file is just an awesome look into the mind of someone deconstructing TCPIP and sockets. As far as I know, no one's been fired directly for using Netcat, but things could still happen. And then on the information resources side, who was sharing the information about all these issues, how attackers were working? It was the hacker community. It was BugTrack, which started in 1993, the same year that DEF CON started in 1993. And that really was the birth of a new form of information sharing that wasn't controlled by the government, wasn't controlled by CERT, it was people talking to other people. And that's really what started the openness that we needed to secure our environment. The next step in this was hackers starting to write commercial software. This was hackers sort of moving into the commercial space. And I think really one of the first commercial software written by a hacker was the Internet Security Scanner by Chris Klaus. And we at the loft started to think, hey, we could make a piece of software that is targeted at system administrators. You know, most tools that hackers write for other hackers are command line tools. You know, Alec Muffet's Crack was a command line tool. What we learned was Windows NT administrators can't use that. So we open sourced our command line version, but we built a version with the GUI so that actual Windows NT administrators could use it, and we sold that. And we said, hey, wait a minute, we can actually make money building the tools to help secure systems. So this again was another change of just becoming more of the security industry at the time. And then around 1998, we started to really interface with Microsoft. And we really started to tell Microsoft what was wrong with their networking protocols, what was wrong with the way that you were building things. And we came up with the notion, much like Dan Farmer and Wheatsey's notion of improving your network by breaking into it. We said, well, wait a minute, what about improving the security of a product by breaking into it? So instead of looking at the whole network and finding the weaknesses in the network, why not look at it, isolate, look at one piece of software. Put that software in a lab environment with your debugger, your packet capture, and other reverse engineering tools, and start to think, hey, we can actually secure software by trying to break into the software. So to me, this was sort of the beginning of the process that a lot of companies use today to actually try to secure their software before they ship their software to their customers. But at the same time, the security industry still isn't woken up. If you were working and doing security in 1998, 1999, they're still doing this. They're selling security features. That's the only thing that they knew how to do to secure a network, or selling compliance. And we all know that this just gets bypassed. You just bypass all those things, and you ignore all the compliance issues. You don't even look at the book and say, hey, let's see if they check this box. I'm going to attack and see if they check that box. That's just not how the hacker mindset works. So compliance is completely orthogonal to the hacker process. So in 2000, we decided to basically, a lot of people called it selling out, and this is what we did at the loft. We said, let's take all the things we're doing here. The tools we're building, the processes we're using to reverse engineer software, to pen test networks. Let's see if we can just do this as a business. And the headlines were pretty, we're going to use good hackers to fight the bad hackers. People like to put things into simple, easy boxes for the general public. But the idea was that we were going to take all the things that we were doing that we had sort of created over the last few years, and we were going to sell those as services to customers. So I don't think we were the first company to do commercial pen testing. But it definitely put it on the map that you could use these techniques to secure your network and secure your software. So some of the things that we did different, that other security consultancies weren't doing at the time, but seem totally normal today. This was completely new. We conducted our own vulnerability research. It was a consultant, a consultancy that had people going out and pen testing and people back at the office building tools. And doing research. And we came up with the concept of we can help you secure your application by breaking into it for you and telling you how we did it. And then other companies started to follow. You probably have heard of Gardens. Went to Verisign. Foundstone. Went to McAfee. I think McAfee still calls their adversarial security services Foundstone. And then shortly after that we had all kinds of worms that were affecting Microsoft products. Code red, SQL slammer. I mean basically it was pretty much of a disaster.  It was really bad. So Bill Gates came out with the trusted computing memo. And he said we're going to stop everything. We're going to stop building software the way we used to build it. We're going to train all of our engineers on writing secure software because they had a book, Writing Secure Code I think it's called. We're going to train them on that. And then we're going to build secure software. The problem was they all read the book and they all got the training and then they went back to their desks and they still didn't know how to build secure software. They thought they could do it, but they couldn't. They didn't have the capability of making sure that the software they were releasing was actually secure because there was nothing in their, they had secure coding guidelines but there was nothing in their process which was adversarial in nature. There was no process of testing. There was no process of attacking. So they didn't actually know how to write secure software. So what did Microsoft do? They hired a company, started by hackers to come and teach them how to secure their software. So Microsoft hired AdStake. I was there for months at a time helping them write, completely rewrite IAS, helping them secure exchange, SQL Server. We taught them how to threat model. They had no concept of threat modeling at the time. Microsoft likes to talk about how they have stride and they have all these threat modeling standards. They learned it from hackers. Hackers taught them how to do that. What was the hacker mindset for trying to break into a piece of software? So this came from hackers. They didn't understand exploiting heat overflows. Their engineers just didn't get it. We had to teach them that because they weren't going to fix buffer overflows on the heap because they didn't think it was exploitable. They didn't have any concept of fuzzing software. Dave Eitel, who's now a founder of Immunity, wrote the Spike Fuzzer while on the Microsoft campus because he wanted to fuzz the software that we were testing for Microsoft. He said, let me write a general purpose fuzzer called Spike. Then he later open sourced it. One kind of funny aspect of this was Dave wanted to do this using his Linux laptop. Microsoft explicitly said, you can't bring a Linux laptop onto the Microsoft campus. We had to get special permission from some senior vice president and it had to only be in this room and it was tightly controlled. They were afraid that if a little of that software, that GPL software somehow got onto the Microsoft network, their lawyers had them so scared that all their software would be GPL. It was like the GPL virus is what they called it and they thought that using a Linux laptop was a really scary thing. Now, as you can spin up Linux boxes, it's taken them a long time to get over it. We taught them how to do things like find the attack surface. We would do threat modeling with the engineers and they would tell us about all the inputs into the program, what other components it talked to. Then we would run something like sysinternals process explorer and we'd be like, you didn't mention this name pipe, you didn't mention that it read from this file and the people who built the software didn't actually understand how their software worked because they were calling into libraries that were doing things that they didn't understand. We taught them how to go to the ground truth to actually look at what the software was doing. Take a reverse engineering process. They could only think with a forward engineering process so the engineers at Microsoft didn't even know how their software worked. So we taught them how to do that. It's really interesting that Microsoft actually ended up buying the company that made sysinternals. Then this was sort of finally, we look at the Microsoft SDLC as the standard, they like to say we have a great process for building software securely and they were the main contributors to ISO 2734 which is the process for building software. Where did they learn most of the stuff that's in there? They learned it from hackers. We could say that if you think your software is more secure today than it was 15 years ago, it's because hackers taught software vendors how to secure their software. Basically I take this to about 2003 or so where sort of the modern era of security and building software started down to where we are today. So penetration testing once was a scary thing that you hired hackers for and you had to get special permission for it. It's now a requirement.  So now it's a requirement. People have a product security response team to communicate with hackers, right? And developers are using hacker techniques as they build the software to test it in order to make sure that that software is secure. So today we really do have securing your product by trying to break into it. And I'm also happy to say that Bug Bounties came because the idea of someone poking around in your software and informing you about it became a legitimate good thing that companies wanted to reward. So this is really full circle from 20 years ago when if you, you know, there were people that would report bugs and they would be threatened like Mike Lynn was threatened from Cisco and Dmitry Skylarov was threatened, well, arrested because from, he came to DEF CON about 15 years ago, he was arrested because he was going to talk about bugs in DRM. So we've come full circle from people notifying of vulnerabilities and potentially getting arrested to today. It's all a good thing. So now I want to take us to today and where have we come? Where have we come today? You know, it still looks pretty bad out there. I mean, if you see what Petia ransomware worm was able to do on modern, you know, modern networks, huge companies like Merisk and FedEx, the Ukrainian government, it's still pretty bad out there, right? The really crazy thing is nation states are pretending to be hackers. I don't know for sure if a nation state, what released Petia or not Petia, what you want to call it, but I find it very interesting that whatever their motives and what they were trying to do, they were trying to look like criminal hackers, right? So this is now, we've come to this point, that this is just a part, even people that are doing offensive operations for governments, they want to look like us, right? They want to look like the people that go to DEF CON. They think that's how you hide yourself. And today, hackers are insiders, right? We could be sellouts, we could be insiders, whatever you want to call it. I put the names of some of the companies up here that people have disclosed. I know that the three other guys up there, I know where they work, but they like to keep it a little bit on the down low. Some people are still really paranoid. But hackers are insiders. Much worked for DARPA. He was a government employee working for DARPA funding, using his insider position to use DARPA funds to fund hacker-style projects like Charlie Miller and Chris Velasic hacking the Jeep was funded through DARPA. So now that we're insiders, we're really in powerful positions to actually change things. And that's a good thing. It was basically Windows Snyder and Katie Miseras, who over time got Microsoft to even do a bug bounty program. And they came from the hacker community. And we all know insiders are more powerful, right? But we're getting old. We're old insiders. We need the next generation to keep doing what we did. We need people to still keep making trouble. And I do still see people out there making trouble. I don't know. Most people have probably heard of Justine Bone and her company MedSec, which caused a lot of trouble for St. Jude medical devices by selling their research around how their pacemaker had vulnerabilities that could kill someone, selling their research to a hedge fund that shorted the stock. That's making trouble. That's trying to change things up. They can't do anything illegal. There is a lawsuit out there, but I think they'll probably be okay. And they brought a new mindset into thinking about how can we fix the market around cybersecurity. For a long time, it's been a vendor-customer relationship where the vendor decides how much security they're going to put in their products and the consumers have no visibility into it. It's kind of a lemon market. The consumer has no power over making their world a more secure place in general, the average person. And what MedSec did was by bringing in the investor community brought in another party. They brought in the owners of the companies, the investors who own parts of these public companies and brought them to the table and woke them up to say, hey, maybe the security of these products is going to change how much money they make with this company. So it's not the people who are the employees of the company that were necessary in control. Now, what MedSec did was brought in this other party, the investor community. And we're starting to see more of that now. Poneman Institute came out with a report showing how stocks dip after major vulnerabilities are announced. And the study broke down how much it dipped and for how long the stock dipped. And we found out that companies that had a very good security, mature security posture and had a really good response, their stock dipped less, half as much, and for half as much time. Whereas companies that were very immature from a security perspective and had a really bad response, their stock dipped twice as much and lasted twice as longer. My analysis on that is the investor community sees the vulnerability of this company as, you know, a black swan, right? It's something that, oh, it happened. It happens to everybody, but it's not going to be a regular, recurring event. But when it happens to a company that doesn't have a good response and can't talk about how they're securing their software, the investor community thinks, well, this is going to happen again and again and again. This is actually going to damage the brand and hurt the company. So we're starting to get the investors into a little early days, but I think that that's an interesting new angle.   I don't want you to break the law, but I want you to do something that after you do it, I say, I don't know if that's a good idea. That was my reaction to when I first saw the NSEC incident. I said, really, are we going to go down this path? This is not going to, this is going to tarnish the research community. This is going to make hackers look bad. And then I thought about it and I said, maybe we should give this a chance. Maybe we should let this play out. Maybe there's some big benefit down the road to this. Someone's trying something, but it made me nervous at the beginning. It really did. And so that's my call to you that makes me nervous because I've been doing this a long time. I've seen a lot. I made other people nervous. But do something that makes me nervous and I think that will be pushing the envelope. So I just want to finish here with something a little bit practical and a way that we all can influence the organizations we're in is the concept of security champions. Now I'm in the application security business. I help companies build secure software. And part of it is to build that security culture. The security team can't do it all. You know, pen testers can't do it all, hackers can't do it all. We have to enlist the masses. We have to get them to understand the security mindset. And so the notion of security champion is, you know, take the example of a company that builds software. The development team or every scrum team in that company identifying individual who has the aptitude and the interest and maybe learning a little bit more about security. So there are software developers, their day job. Get them interested in security. Get them some extra training. You know, do some reverse engineering with them. Do a capture-to-flag exercise with them. If you can get, you know, one person in each development team interested in security, it has a huge impact across the organization. Because there's just not enough security people and there's a lot of people building software out there. And I think you can take this to other places to educate people. So I think that is something that we all have a responsibility to do where we work or in our lives is to educate.  But it'd be great if we could get some of those sheep more educated. So with that I'm going to end it there. There's my contact info. If you want to contact me I don't know, Ming, if I went over time if we have any time for questions. We do have time for a few questions and if you have a question for Chris and please have you know, we definitely welcome you because this is a fantastic opportunity right now. The mic is all yours. Hey, good morning. Thanks for taking the time to speak with us. Chris, my name's David. I'm from New York. I just, I wanted to ask you I've read news articles to talk about how difficult it is for companies to keep themselves secure that they're effectively gladiators in this pit going against everyone out there. Malicious and hacktivists and all the like. Have you heard any theories or any proposals that are convincing for how companies can share their data potentially with one another? To say we found this vulnerability this is something perhaps to look for in your work and kind of help bridge that gap and help them unify? So what you're really talking about is information sharing. And I'm a huge proponent of fully open information sharing. All these little pockets of groups, government groups or financial services groups where they share stuff amongst themselves I think that's incredibly inefficient. The idea of DEF CON the idea of bug track where to make information sharing completely open. So I think we should have as open as possible. Information sharing. I don't care if the adversaries get the information too. As long as the defenders work on that information it's better. The problem with open information sharing is that the adversaries take advantage of it and the defenders don't. If the defenders took advantage of it it would be fine. So I'm all for as much open information sharing as we can have. Thank you. Anyone else for questions? Thanks Chris. Do you think that yourself other members of LOFT and other individuals in the early 90s and late 90s received a reward and recognition that they should go to the security sector today? Just for the record I don't unless you convince me otherwise. I don't know. I'm a pretty humble guy. I don't need any more reward. I've been very successful in my career. I've met a lot of great people. I get to stand up here and talk with you and meet you. I'm fine myself. I don't think I need a presidential Medal of Honor or anything like that. Some of them probably would have a different answer. So really quick. What spaces do you think really need to be made nervous these days? Could you repeat the end? Sure. What places or what sectors do you think really need to be made more nervous these days? I missed the last part again. No problem. What places or what sectors do you think really need to be made more nervous right now? Oh okay. I was missing the nervous word. That's a good question. I know the government is already nervous. I think it's the IoT sector. I don't think they're getting quite the feedback loop that they need to. I think that people are just shipping products and ignoring things. I think the noise level has to be raised there. We saw the Marai botnet was sort of a wake up call. I don't think that changed how people are manufacturing these inexpensive IoT devices that it might cost $50 but it causes a world of hurt. Sort of like dumping your toxic waste in the swamp. Just because something is cheap to do or make doesn't mean it doesn't have consequences. Let's make them nervous. Maybe one more? Absolutely welcome. Absolutely welcome. Great. Thanks for the talk. That's a great talk. I want to ask you sometimes when you get a software you want to reverse. When you look at the agreement one of them is do not reverse engineer. Do you observe it and sit on your hand or you just go ahead and do it anyway? I would go and do it anyway. I think you can't ask for permission. They're not going to give you permission. I would go ahead and do it anyway. As a company it's something that I can't do at work. I need to follow those rules myself. I don't think we would have gotten anywhere with making better products unless people did that. Again, that's along the lines of making people angry. Can you share with us where Weldpon came from or is that completely taboo? No, I can share.  The first BBS I connected to that it had a requirement, I think it was called the works in Lexington, Massachusetts. Jason Scott was the guy who does text files.com. Jason Scott, you probably all know, was the sysop. The BBS was set up that it said no real names. You can't use your real name on the BBS. You've got to put in a fake name. When I signed up for an account I was like, I don't want to spend time thinking of some cool name. All I did was I looked above my desk and I had a map of the Boston area.  That's where I came up with the name. I didn't think I'd be using it 24 years later. That's where it came from. Thank you so much, Chris. Thank you so much. When we received the CFP we were like, oh my god. You know, it's a tremendous honor for you to give the keynote here at the Packet Hacking Village and Speaker Workshops. Personally I cannot thank you enough for everything that you've done for not only the community here but also for me personally and my career as well too. I'm so very, very grateful for that. So thank you for everything that you've done for the community and for me personally. Very special thank you to each and every one of you here who was at this talk. Just looking at this room right now, this is my 11th DEF CON and it really, really does feel like going back to the old days when I first got to a talk at, not a lecture talk but at the Riviera. I mean DEF CON talks, if you could believe, were decided we're just this big. So just like going back to the old days. Thank you all so much. Thank you very much.


Hello viewers, we are going to talk about today reason to teach ethics. It's very interesting and important for the individuals who are already got education or directions about the ethics. But we are to know about why it is important to tell all about them, that they should be told about ethics. They should have an education, they should have directions, they should have enough know that is very needed that we do come towards the ethics because there are certain reasons. One reason is very important about the counter-influence. The children who do not have the knowledge of ethics or the level at which they are doing their work, the children who we tell the ethics, they can counter very well with strong power and they can save themselves because they do not have the communication, very evasive effect. But it is important for them to save themselves. The other reason is that they are not wrongly countered. It is very important for them to understand that the answer is wrongly answered or countered. It is important for them to make their knowledge beneficial for themselves and for their surroundings, for their friends, for those who want to keep themselves safe from those who are countering and attacking with mal-functioning of mal-behavior and they do not know ethics in that way. We also see that sometimes children get influenced in a difficult situation and they are unable to cope with that situation. But if they have good moral abilities, moral and ethical values, then they can understand how to tackle in this difficult situation and they can handle it in a very effective way and effective manner. In that situation, they can do their own success when they are utilizing and practicing the ethical values. And only knowing the ethical values is not only enough, that is more needed that they can exercise and they can reflect according to the ethical values. The benefit of this is that the other person is also becoming aware about the ethical values. The other person is getting an orientation. That is because the other person is not aware of how to exercise the ethical practices. So, when that person got interacted with those who are having the orientation of ethical values, then they can convey to the other person that how these values are good and how that person is becoming more comfortable other than that that they put themselves in another difficulty and they can exercise them. So, in this, we ensure that when the person is exercising ethical values, he gets a self-confidence that he is fully waiting for his soldiers and he is feeling a power in himself and he is feeling unergized and supportive. One of these is self-affirmation. Yes, I have the ability to cope with these difficult situations and develop their own self-confidence. And self-confidence is developed at the same time when their abilities and powers are confirmed and their effects are fixed. And in return, the reactions that are there, they are not like that, they are like the evasive effects. So, we have to be very careful about how we can exercise these ethical practices with the others. And ultimately, when we see that ethical practices, values, are being exercised, then their positive effects are fixed. Certainly, for themselves and for other people. So, we prefer that anybody must have to be oriented with the moral values and they are to exercise for the others and also for ourselves. And we see that teachers, when teaching about the ethical values, they are not only thinking about self, they are thinking about all others. Any other family members, other community members. And the rest is that teachers are to be more beautiful when they are exercising these ethical values in children. And they are reflecting it according to the norms, regulations and very favorite situations which a child is being inculcated to be involved. And in this, we can see that it is a selfless practice because not only for ourselves, we are doing all this for the others. And we are making enough confidence over kids that they make themselves confident, make themselves self-sufficient. And the things they have learned, they are exercising for others because it is a need of the others. Because they did not get a chance, nobody told them. So, when we are interacting, instead of a confrontation, we convey a message. So, we are unnecessarily needed to make these ethical practices a part of our routine, to give the kids exercise in such a way that their routine is to change their life and to change the world in such a way. Thank you very much for listening.


What's up everybody, it's JayZ here for jazzyofrajaskieskatespace.com just sold out 17-18 prism cello one-pack break random teams number 16 This is where to win 12 spots in OR random teams. I believe number five that is also sold out I'm gonna show you guys item description page as you can see number 17 is also sold out Which we'll be doing next in a separate video But this is gonna be break number 16 and we're gonna give away 12 spots in OR We're gonna do is randomize customer names teams open up the cello pack distribute the hits out Then at the end of the break will randomize customer names again in a separate dice roll randomizer And the top 12 out of the 30 will win a spot each in the OR random teams Number five So good luck. This is number 16 roll it Five into two seven times. Good luck one two three four five six and seven Ryan Donna Dennis seven times one three four bulls down in the wizard Ryan with the bulls Michael with the jazz Scott with the mavericks Michael with the caliphers Josh with the raptors Ryan with the kings clean with the heat Kevin with the lakers Aaron with the blazers Greg with the or gregors or the pistons magic Ryan with the nicks Ross with the pelicans as well as Ryan with the nugget uh nuggets Zach with the thunder Michael Hughes with the rockets Kevin with the bucks Chad with the cavaliers Ryan with the spurs as well as the teawolves Matthew with the warriors Ryan with the hornets Zach with the hawks Rocio with the 76ers Ross with the 70 uh the sun sorry Oliver with the Celtics Kevin with the pacers uh Kevin Mendoza with the grizzlies Roberts and that's and then Dennis with the wizards so there you go now i'm gonna quickly um alphabetize it i'll close the trade window no one's gonna trade and then we'll give away some mixture spots at the end of the break Silver Wesley Matthews Maurice Harkins Raptors Green Silver Gorn Dragic Chandler and here's the red white and blues green favors Michael Kidd Giltress all right so there you go now let's switch scenes give away some spots guys remember top 12 after two and a six eight times get in one two three four five six seven and eight the final time top 12 after eight times Rob i think you were last but mojo i forgot to put a star though Matthew Kevin Mendoza Michael Kevin M Quentin Ross Michael Hughes Ryan Rocio Oliver and Gregory I remember correctly top 12 after eight times there you go congratulations guys you guys are now in the mixer number 17 to be coming up next


I don't know if this is normal but it's making me feel very guilty. Honestly from all the messages that I receive I can tell you that 90% of all people regardless of gender will fantasize about their ex during masturbation.  I guess that's why so many people watch porn while masturbating because the story is already there.  Most people will either go back to something that they enjoyed in the past or at least partially something that they're familiar with. Your ex is most likely going to feature in it. And so to answer your question one yes it is very normal almost everybody tends to do this so don't feel guilty about it. Two you wanted to know how to get rid of this fantasy. This fantasy will run its course at some point. Every fantasy stops being exciting after a while. Just wait for it to pass out of your life. And finally if you're still feeling guilty just think of this fantasy almost like a sex toy which comes out for a specific time or specific purpose and when you're done with it it gets washed, cleaned and put away till you are ready to use it again. Honestly this does not have any more space in your life than simply a useful tool.


Hello and welcome to the session. Let us discuss the following question. Question says, find the ratio in which the line segment joining the points minus 3,10 and 6 minus 8 is divided by minus 1,6. First of all let us understand that if we are given a line segment AB where coordinates of AR, X1, Y1 and coordinates of BR, X2, Y2 and P divides the line segment AB internally in the ratio K is to 1, then coordinates of P will be KX2 plus X1 upon K plus 1, KY2 plus Y1 upon K plus 1. This is the key idea to solve the given question. Let us now start with the solution. Let us assume that point minus 1,6 divides the line segment joining the points minus 3,10 and 6 minus 8 in the ratio K is to 1. Here we can see this is a line joining points minus 3,10 and 6 minus 8 and minus 1,6 is a point which divides this line in the ratio K is to 1. Now let us assume that coordinates of this point are X1, Y1 and coordinates of this point are X2, Y2. Rarely we can see X1 is equal to minus 3, Y1 is equal to 10, X2 is equal to 6, Y2 is equal to minus 8. Now using key idea we get coordinates of this point is equal to K multiplied by X2 we know X2 is equal to 6, so we can write 6 multiplied by K plus X1, X1 is equal to minus 3, so plus minus 3 upon K plus 1. Now K multiplied by Y2, Y2 is equal to minus 8 plus Y1, Y1 is equal to 10 upon K plus 1. Now we know coordinates on left hand side and coordinates on right hand side will be equal only when this expression is equal to minus 1 and this expression is equal to 6. So we can write this implies 6 K minus 3 upon K plus 1 is equal to minus 1, we know this expression can be written as 6 K minus 3 upon K plus 1. Now simply find we get 6 K minus 3 is equal to minus K minus 1 multiplying both the sides by K plus 1 we get this expression. Now adding K on both sides we get 7 K minus 3 is equal to minus 1. Now adding 3 on both the sides we get 7 K is equal to 2. Now dividing both the sides by 7 we get K is equal to 2 upon 7. Now we get ratio K is to 1 is equal to 2 is to 7. So we get the point minus 1 6 divides the line segment joining the points minus 3 10 and 6 minus 8 in the ratio 2 is to 7. We can check this ratio for Y coordinate also. Now let us make a check for Y coordinate also we can write minus 8 K plus 10 upon K plus 1 is equal to 6. Now multiplying both the sides by K plus 1 we get minus 8 K plus 10 is equal to 6 K plus 6. Now transposing light terms we get minus 8 K minus 6 K is equal to 6 minus 10. Now this implies minus 14 K is equal to minus 4 we know minus 8 K minus 6 K is equal to minus 14 K and 6 minus 10 is equal to minus 4. Now dividing both the sides by minus 2 we get 7 K is equal to 2. Now dividing both the sides by 7 we get K is equal to 2 upon 7. Now this implies ratio K is to 1 is equal to 2 is to 7. So this verifies our answer. So our required answer is 2 is to 7. This completes the session. Hope you understood the session. Take care and have a nice day.


Wanted to be very careful about how how large I grew it and how quickly because it was important to me that I was setting up the right kind of boundaries and the right kind of foundation so that when I did start bringing people in I knew I knew what you know how to bring them into that situation and not feel like we were just running from thing to thing or you know having some kind of a culture you know ready to to bring people into so I remember your pitch deck so so tell us tell us a little about that foundation and tell us how you arrived at that foundation you know for anybody listening if you're thinking about starting any business or even a boutique creative agency what was that foundation you thought about before you even before you even went out and looked for that first client


or something. I think it's actually the 8th of October. I know it's 919 a.m. out to run a whole bunch of errands including picking up some more pieces for the art room floor. If I go get them hopefully we can get the installation done ASAP just makes it a little bit faster because the install faster because the installers don't have to go to Lowe's and go get it hopefully that's a that's a thought behind it anyway.  I'm going to go try to get them all done this morning before lunch. I check out the local Dollar Tree stuff like that. So let's get going. I do want to say two things. One, I have recently started a Patreon page. The link is in the description below. I have not started it with the intention of pulling content from YouTube. Nope, nope, nope, nope. Some content may be on YouTube that's a speed through but then if you want the full explanation of what I've done and why I've done it it'll be over on Patreon. It's just an effort to raise some funds and start having the art pay something. I don't need to discourage or offend anyone by doing it and I put off doing it for a really, really long time. It's more like a subscription or class page at least that's how I'm going to run it. It's not a free let's beg for money page and there are classes available at almost all the price levels from the lowest to the almost highest. So including some old classes from Crazy Island University and stuff that I actually filmed even before that. So none of it is super great film filming quality but I think there's some good information there and if you are a former Crazy Island University student and you're upset that I've done that because you paid something you know more for the classes message me because we'll work out something. Also in the live broadcast yesterday for intervals of sanity with my friends Peg Robinson, Cindy Utter, Carla McCants, Vicki Brown and Leslie McGrath. We went off on a tangent about big girl panties and it turned into something I think might be pretty special although evidently some people are taking offense. So we are going to get an oversized large pair of panties. We're going to decorate them as the artists we are and then we are going to accept donations for ovarian cancer and the names for everyone who donates will be put into a hat and one winner will be drawn that will get those pair of panties and it's just a way of raising money for a good cause bringing attention to the huge gigantic problem that cancer is especially cancers like ovarian cancer that have almost no symptoms until it's too late. So and Peg Robinson my friend, dear friend and our fearless leader over on intervals of sanity is an ovarian cancer survivor. So I guess there was some backlash last night on other channels and I'm not going to go into details but we don't mean to offend anybody we're just trying to it did start out as a you know a funny joke and then quickly turned into a fabulous idea that we think could really raise funds for a really good cause. So we're going to do that and we encourage other artists to do the same and yeah let's get together and you know show the world the power that we women and artists have to raise money for a really good cause and you know try to bring an end to horrible diseases like ovarian cancer. So anyway that's my little speech for the for the day. I'll put the link to the fundraiser page on I think it's on a faith on Facebook in the description below and yeah I think it's going to be a lot of fun and it will be of course funny because it's a gigantic pair of panties and you know we're going to paint it and it's going to be funny um yes and we're going to have fun with it but all joking aside cancer is a big problem and the big pair of panties hopefully will emphasize that big problem that it is anyway that's it my speech for the day I'm going to go run my errands I'll be back. The trees next to Joann's I don't really need anything but we're going to pop in and check it out. I don't know what it is about dollar trees but they're always in the worst shopping center in not a great neighborhood like traditionally at least in California. The tiger doesn't seem to be any different anyway all right I'll be back. Big Joann store much bigger than the one we had in San Jose so tempted to buy some knit fabric for a project I've been thinking about and or planning for quite a while now but they only had the fabric they didn't have the notions I would need I know a sewing project um so I'm just this tempted to order online and that way get everything at once that I might need and I don't need to do it right now because I can't get to my sewing machine anyway so on to the next place. Hey guys um we're going to make some eco-printed paper today I had most of the stuff to do this with already I'm not going to give you specific instructions because it's not this particular way of doing it's not my idea I saw it on someone else's channel and I'm going to link their channel in the description below I recommend you go watch it she talks about what she uses why she's doing it what works what doesn't so I'm going to experiment and play with what I have last night my husband and I went for a walk and I picked up some things from nature and put him in a Ziploc bag and stuck it in the fridge so that they don't get too wilty and then I just went outside to the backyard and picked some more things so we're going to give it a try um per her recommendations I have three bottles spray bottles one is the pink one is vinegar and water the blue one is alum powder dissolved in water and this one is coffee and water so we are going to see what kind of prints we can make and I will be right back say like she says in her video some of the bit of residue on the paper that you have to then gently wash off and if you've used printer paper like I have um if you're not careful you're going to get little tears um so be careful um I wouldn't probably with this iron method use paper that's too thick because you do kind of need to press and I don't think too thick a paper would work very well but that being said probably something that has more cotton rag in it might but look at these look at these I will probably be scanning some of them my Etsy shop which is something she does on her channel but I haven't watched those videos yet Mary may Mary I think that's anywhere her channel small art um she did um boiling on her channel I won't be using one of my kitchen pots I'm going to go thrift for one so it's going to take me a little bit to get set up for that but I love these the plain leaves didn't do much they did a little bit they didn't do too much on this one I just completely like they're almost dry they're not completely dry the flowers from my yard did a great job and the leaves did better if you sprayed them with the alum and some of the vinegar and then did a a top spray of the water down coffee then you got and you really had to like put the iron on them a little longer than the flowers to get a print but when you did if you had the right leaves you got a really interesting print so give it a try and go watch her I'll link both videos that I mentioned in the description below go check them out and uh yeah show them some love like share and subscribe that's it for right now I hope you all have a great day don't forget to do something nice for yourself because you deserve it and be a decent human that's it bye hey everybody it is Tuesday October 9th I think it's just before one o'clock that I know for sure um still trying to figure out when the mail comes here at the new house you know what day of the week and stuff like that I or I mean time of the day the day of the week hello um and so it's not here yet I'm gonna go back and check in a couple hours so it might not come until after lunch I don't know I do know I'm expecting a bunch of mail today so anyway that's it for the moment I'll be back hey guys it is um Wednesday October 10th and our one of our guys is here he's demolishing the back fence actually he's got a pretty I don't know if you can see between the bushes here from on my phone but he's got you can see him walking there he's actually in the five foot space between our property in the back neighbor he's got most of the boards off he's working on this corner on next will come the lattice work and then the posts the whole thing has to come down the whole thing's rotten and we did not know it but there's a retaining wall um back there so we're gonna that's also rotten so we're gonna have to replace that too and I just keep hearing kaching oh yeah yeah anyway that's it for the moment I'll be back so we found out some problems with the fence in the backyard because there's a retaining wall back there we didn't know about that wasn't even built correctly so we're having that repaired and I locked myself out of the house yeah what a Wednesday I'll be back still drinking my morning coffee it's Thursday morning October 11th I almost said May I really did I have no idea what time it is I just know it's morning still I always tell by the morning light coming in these windows um I don't think it's 10 a.m. yet I think it's early we can actually walk to the kitchen and see um see it's not even 11 o'clock it's 8 53 a.m. anyway I am waiting here on the fence contractors they're going to be working on the back fence we'll talk about that in a minute because I have no idea what I said in yesterday's clip so I'm gonna maybe be repeating myself a little bit I also am waiting on the bug people to come spray one more time this quarter and then they won't be back for a couple months um the houses hasn't been lived in much so like any new home that's been kind of vacant or semi vacant um you know there's usually some issues with insects or whatever so um the last house we bought there was but it was vacant a year and a half um and it had an ant and spider issue also so I don't know we seem to like those kind of houses I don't know uh anyway so we have bug service um but when we were having the old backyard fence demolished yesterday um unbeknownst to us because it wasn't disclosed and the contractor because you couldn't see it um with the fence up you just you couldn't even tell he had no idea till he started demolishing the fence there's a retaining wall back there four feet from my patio holding my backyard up and it wasn't built correctly it was rotten and falling down and yeah just tack on another you know I don't know 1500 to my bill if it's less than 4000 I'm going to be shocked as crap for one little back fence that's probably I don't know 35 40 feet it's not that big not compared to the old house but you know anyway wasn't disclosed we had no idea wasn't built correctly it's not to code probably there's nothing can we can do about it but I let our realtor know talk about stressful and then I also sorry I'm switching hands my arms tired um I also realized last night that I hadn't heard from the Lowe's flooring installers yet even though I went and picked up um all but one piece of trim that's in I told them I don't want to wait for the last piece we'll install it ourselves when it comes in um they said okay we'll get the installers to call you and set something up I haven't heard anything that was all Monday so I called this morning and he very nice young man named Mike said they haven't called you yet I called I messaged them you know Monday I said no he said I'm gonna get hold of them again and see what we can do because I still have a floor so I can only run so much art business without my stuff so I really really need them to get that floor in so I can try to get my room semi back together it's been since August now just not okay with me I'm just done with that part um the San Jose house still hasn't sold we still own two homes we're paying a bunch of different money loans to people and yeah bleeding funds at the moment so put some good energy out there that it sells and that the right people just haven't you know seen it yet but that they will and you know I have also been hearing about people because of the storms um losing everything they own I've heard of a couple people that I know that are friends of friends that are actually passing from cancer and just you know I wish them all well my troubles aside I wish them all well um I know one person in particular I won't name names or anything that is passing actually from cancer and I wish for them a peaceful passing that's just horrible and um yeah so it's been quite a week I also have to go grocery shopping today but I can't go anywhere until the contractors come and the bug people come so I did my daily postings I do need to update the website um again for the design team and yeah I've got a little bit of video to edit I've got some the design team call which there will be one for 2019 by the time you all see this that application should be out so I will link it in the description below but as of the filming of this clip I haven't made the official design team call yet but there will be one for my product line for 2019 I have to um make some tweaks to the application and then get that clip filmed and get everything out on YouTube so it's always something all right and I got asked yesterday if I would do some water well if I'm going to do any more watercolor tutorials the answer is yes but I have to be able to get to my stuff I really I tried to film something the other day and I was on the floor and that was just yeah it didn't work for me and I couldn't stand up straight afterwards anyway I just got a message from the bug people they'll be here between 8 and 12 it's after 8 so maybe closer to 12 all right I'll be back I just spent a minute talking to the phone and the record button wasn't on you know it's just going to be one of those days I don't know what to say the bug guy is gone um Scott my contractor fence guy is working on the fence and I need to go to the grocery store and bandits in his crate so he's safe and sound taken a nap snoring like the old dog he is so I'm gonna head to the store and I'll be back hey guys good morning it is 8 43 a.m it is Friday October 12th don't get all excited or anything I only know that because I'm sitting in front of the computer yes I still have no floor in the art room but they're very nice gal Debbie over at Lowe's and the guy that works in the flooring department Brad over at the Tigard Lowe's are working on it thankfully I am not blaming the delay on the staff at the store but there is a lack of communication between the contractors on the store which I think is a problem and the store is woefully understaffed like I can't even tell you guys how understaffed it is I've never seen a hardware store that needs more employees so desperately um anyway waiting on the tree guy to come and a tree guy hello fence guy to come and continue work on the fence and the surprise retaining wall we didn't know we had um he's going to be back Scott's going to be back today to dig the rest of the holes and get the posts in um he had some trouble with that yesterday he ended up having to run an auger and then he had problems with the auger and like yeah it was just like a comedy of errors and one thing after the other so anyway um he's working on that and um we also um are um expecting my brother to come into town today so I have to go pick him up at the airport I was just doing today's thoughts on Facebook about that um that was one of the things that was in today's thoughts because it is funny I'm a bit nervous I used to get lost trying to pick people up at the San Jose airport um keeping in mind I grew up in the California San Jose Bay area um yeah so finding pdx that's going to be a lot of fun I'm going to need early lead need to leave early and I need to get gas yeah so anyway um I need to update the website again uh in the next couple of days so I'm going to try to work on that today in between picking up people and everything and um yeah sometimes I'll be back good morning everybody see technically it's still morning it is 11 uh o'clock ish I am covered in dog hair mr b is in the back seat and um you can't see it but yeah I'm just covered in this um we are headed to our first trip to the v e t so uh the new one so wish us luck I'll be back all right guys that's it for the week mr bandit checked out just fine his blood work did finally come back a couple days after the last clip that you saw and he um is just fine and he's getting older but he's he's okay um that's it for the moment I have a busy week ahead and there's a lot going on I'll clue you in when I can um don't forget to um keep an eye on the Etsy store because there's new stuff coming out um pretty regularly right now as often as I can get it out and I've got a bunch of designs in my head I need to get out um on paper or electronically so I'm going to be working on that uh in the coming week or so and then um talking to my vendors to see who can make me what um that's it for the moment um have a great day have a great week do something nice for yourself because you deserve it support your small youtubers and your small shop um creative shop owners um like of course myself I would appreciate it Mike Deacon Shannon Green and there's a number of others why don't you leave your favorite one in the description below that's it for right now like share and subscribe and I'll see you soon bye guys