In the equation of NGN design and the requirements which were presented for NGN, the role of operator, if not the most important one, is something that cannot be ignored as well. In this module, we should look at how the operators, which are the service providers, have a role in the NGN. We'll start with how the networks evolved over time, all eventually becoming the internet service providers. Then, we'd look at the concept of liberation or liberalization, as in today's world. And then, we'd look at the drivers that we can finally extract out of the discussion. Let's start with every network that seemingly became an ISP over time. Initially, when internet was offered through different internet service providers, there was an assumption that ISP is something that is in reality something quite different from existing networks. Because in those days, the telephone, the cable and other kinds of services were also there. But when the internet service providers emerged, it was thought that the ISPs are something quite different. So, the licensing of these ISPs were also different. Their billing mechanisms were different. But over time, it was realized that the existing networks were also utilizing eventually the same hardware, both at the exercise as well as the broadband or the core side, for instance, whether it was cable TV or it was the telecommunication network, both these were using the SDH and PDH transport network. Then, on the access or the customer premises side, the dial up modems or the lease lines were also being used. So, over time, it was realized that if the ISPs which were just using routers and switches could provide internet access by using the multiplexing and the transportation and the access side equipment, so could the other networks. So finally, all the networks started providing internet connectivity, thereby eventually becoming the ISPs. Then, over time, liberalization also took place. Liberalization means that every state-owned service provider, for instance, we had the PTC, Pakistan Telecommunication Corporation, that later became Pakistan Telecommunication Corporation Limited, Company Limited. And over time, we saw that there were acquisitions, sell-offs and licensing which were given to new players. So, new operators emerged with new kinds of services. Now, this liberalization actually gave way to the concept of providing value-added services or something that is providing competitive edge over the existing nation or state-owned operators. In terms of the business or revenue model, traditionally, the telcos were making money on the voice circuits and on the short-message service, that is SMS. But over time, as we are lately observing, the telcos' main market has also become data in addition to the internet service providers. It means voice has now been relegated downwards. Similarly, for other service providers like cable network, the DSL, data is now the first and foremost service. Inherently, all these are based on IP. Why? Because all these service providers have realized that using IP, they can provide services which are more scalable. That is, they can adapt or give these services with lesser qualitative service to more number of users so it can be scaled up with existing infrastructure or more infrastructure could be beefed up in a modular manner. Then the infrastructure provides flexibility. It means depending upon the user requirements, which may be from being very loose, the best effort to the gold or the diamond kind of qualitative service requirement. What it means is that the IP-based infrastructure provides us flexibility. Now, this is the kind of model that made the internet service providers which is all the networks and now the internet service providers to make money on the basis of every customer and every requirement of the customer that could be from being very loose to being very stringent. From this discussion, we conclude that eventually all these service providers or the operators are heavily dependent on the equipment that the vendors or the OEMs provide them with. Since the vendors are now getting wiser and they are investing on technologies which are more strategic in nature, they are all banking on the IP. Number one, IP's low cost switches and routers are at exceedingly low prices available and then this infrastructure doesn't collapse overnight. It's quite rugged and stands long. So the change in the strategic orientation of the vendors is also determining the overall scope and the purview of the providers. Another beauty of the next generation networks services is that the operators can pick and choose and can take the liberty to implement engines partially and it is very much natural to assume that they would like to do that because every telecom or every other service provider is interested in banking on its strengths and then moving or migrating to new services which are relatively lesser risk based. So it means that now we are seeing the operators that they are deploying NGN from their own perspective and as per their own pocket.


Tell me about your program My the Organization that I work for is called Treaty for Education Alliance, and it's an educational program. That's based out of Fort Capel Serving a number of First Nations in the Treaty for Territory, Saskatchewan My name is Laurie Whiteman. I'm the executive director of Treaty for Education Alliance. I've been working with the First Nations since 2009. And the age groups or your target audiences are the individuals, families or other? We serve K to 12 schools through a program through proposal-driven funding that we receive from INAC. We've been working with that program proposal-driven funding since 2009 and we're currently working to negotiate with Canada to get more stabilized funding and to build the organization around an inherent and treaty rights based approach and funding model. So we work with K to 12. So those would be early learners and middle-year students in high schools, high school students, but we also work with families and community members, elders and with the whole community really trying to encourage them to be involved in education and to make connections to student learning. Aim of the programs teaching what subject, healing journey, land-based, combining TK with language. So Treaty for Education Alliance is an education service provider to K to 12 schools. So we've worked to take ownership of our own mandate since we began in 2009, even though we are required to follow certain criteria based on the proposal that's that comes out of INAC. So one of the requirements of our main proposal is to provide services in literacy, numeracy and student retention. So since 2009, we've expanded on that and have really created our own understanding of what literacy is, what numeracy is, what student retention means to us. And then we added community engagement because we heard from all of the nations that we work with and from the elders that engaging the community and learning is an important part of what we would be doing. So there's many aspects to the program now. We've grown over the years. We support teachers in the school, staff and parents and students leadership with their educational programs, with school-based educational programs and with other things that they're interested in exploring and so land-based learning has become very popular and very a very strong focus of many of our communities and we've been working in partnership to build on land-based learning. We call it learning the land and we have a couple of partnerships. One of them is a long-time partnership with the Nature Conservancy of Canada and another is a more recent project partnership with Outward Bound Canada and have been doing some professional development-based modules with teachers from each of the schools to build their capacity to explore land-based learning, to explore working with communities, intergenerational teaching and learning, working with local knowledge keepers and language keepers. Our program, our organization has always emphasized capacity building. So unlike a provincial school district where they would be funded as a central office providing specialized services for schools, we've never had the luxury of having that kind of capacity of resources or people. So we really have to make the most of what we have and I guess since 2009 we've had to really pick a couple of areas of focus to to try to. I think what you're doing is is going to really support that as a resource. It's going to bring people together so that they can share and talk about the work that they're doing and how we can collectively come together collectively to improve that and to innovate and to create and to support one another. Aside from the programs in which you are personally involved, what information do you have on other Indigenous educational programs in Canada? Well, we've we've looked at a number of other Indigenous educational programs across Canada, particularly the ones that are that are doing similar to what we've been doing. So the Anishinaabe Education Network in Ontario has come together similar to us as an alliance to come together to start to build based on what their goals are and what their vision is for education in their territory. Muscovites and Alberta has has also been doing some work in this regard and has signed and I believe recently signed an agreement with Canada, Manitoba has come together as well to start to develop and build on First Nations education in their area. BC has done a number of things over many years in a tripartite partnership with with BC provincial government and with the nations in BC. So I think there's lots of there's lots of really great innovations happening across Canada and into the States.


The Tokyo Olympics just ended last weekend, and this was the first time that an openly transgender athlete competed at the Games. Laurel Hubbard is a transgender woman who competed in women's weightlifting, and this has sparked controversy over the fairness of allowing a transgender woman to compete with cisgender women, otherwise referred to as biological females. And that's exactly what we'll be getting into in this video. Unlike a lot of the videos that I make, a lot of you are probably coming into this video with strong opinions one way or the other already. I encourage you to keep an open mind, just as I strive to do when researching every video that I make. For the most part, I'm going to be citing research for pretty much the whole video, but at the end of the video, I will be giving my research-based opinion on the matter. Now, this is a cycling YouTube channel, so why am I talking about an Olympic weightlifter?  Well, this controversy has also cropped up in the cycling world as well. For example, transgender athlete Rachel McKinnon has won two world titles and the world record in the 200-meter match sprint at the Masters Track Cycling World Championships. And these are just two examples of many instances where male to female trans athletes have competed with women and the internet has blown up over it. Transgender athletes are allowed to compete at the Olympics, but there are certain criteria that they must meet in order to be eligible. From the International Olympic Committee's consensus meeting on sex reassignment and hyper-androgenism, female to male trans athletes can compete with males without restriction, but male to female athletes can only compete with females under the following conditions. The athlete has declared her female identity for at least four years, and the athlete must demonstrate that her serum testosterone levels have been under 10 nanomoles per liter for at least 12 months prior to competition. Surgical anatomical changes are not required to compete. The UCI, which is the international governing body for cycling events, has taken an even stricter stance here, requiring that transgender women keep their serum testosterone levels below 5 nanomoles per liter. For the vast majority of us, those numbers probably don't mean a whole lot. So here's some context. The normal range for serum testosterone for men starts at 10 nanomoles per liter, which is that threshold set by the IOC, and goes up to about 38 nanomoles per liter. For women, the range is from 0.5 nanomoles per liter to 2.5 nanomoles per liter. So while the rules set by the IOC and the UCI require that trans-female athletes have testosterone levels below the normal range for men, they could still train and compete at levels above the normal range for women. The questions that arise here are, is this testosterone threshold a fair benchmark to assess whether or not transgender women are on an even playing field with their cisgender counterparts? And also, is testosterone the only advantage that men have over women? After all, it is the only metric that the IOC and the UCI are using to assess fairness. This review article on transgender women in female sports notes a number of physical attributes that are major parameters underpinning the male performance advantage. On average, men have 45% more lean body mass yet 30% less body fat percentage, 33% more lower body muscle mass, 40% more upper body muscle mass, 57% more grip strength, 54% more knee extension torque, longer bones, narrower pelvis, greater force and stiffness of the tendons, 50% higher VO2 max in terms of absolute values, and 25% higher in terms of relative values, 48% higher maximal pulmonary ventilation, larger hearts with a higher cardiac output and stroke volume and finally a higher hemoglobin concentration. There's clearly a long list of physiological reasons why men are generally better at sports than women. Now some of these advantages will be mitigated by hormone replacement therapy or a lowering of testosterone level, for example, muscle mass and body fat percentage. However, some of these advantages won't be affected at all, for example, bone length, height, and dimensions of the pelvis. So exactly how much of an advantage do these physiological differences between the sexes give men? The review further lays out the male performance advantage across a variety of sports. Women sports like running, swimming, and cycling are on the low end with a 10-13% advantage. Downhill mountain biking, tennis serve, golf driver speed, and pole vaulting are all in the 16-22% range, volleyball serve and weightlifting are up to 29-34%, and baseball pitch and field hockey drag flip are as high as 50% or more. This is the performance advantage that men have over women in sports, and if you were to take a man who's received no hormone treatment and put them up against women, it would be unfair. No one is arguing that. It's the whole reason why we have sex segregated sports in the first place. Yeah, that, and also, if I competed in the women's category, it'd be pretty distracting for my competitors and honestly, might cause some crashes. Alright, with that, let's get back to the originally posed question. Does lowering testosterone levels erase this advantage? This study on muscle strength, size, and composition following 12 months of gender-affirming treatment looked at both trans women and trans men, testing leg muscle strength before and after 12 months of hormone replacement. Thigh muscle volume was increased by 15% in trans men, while trans women saw a decrease of 5%. Okay, so when women transition to men and take testosterone, there's a substantial increase in muscle mass, 15% according to this study. But when men transition to women and suppress testosterone, the change is not nearly as dramatic around a decrease of 5%. It is a decrease nonetheless, though. The more applicable question for sports is, what did these changes do to their strength? The trans men increased strength over the study period, no surprises there. What is surprising is that the trans women generally maintained or slightly increased strength. On top of this, despite the robust increases in muscle mass and strength in trans men, the trans women were still stronger and had more muscle mass following 12 months of treatment. These subjects reported no change in physical activity level, and their testosterone levels were well below the threshold set by the IOC and the UCI, and within the typical range for women. This is evidence against the notion that trans women's advantage is erased simply by lowering their testosterone levels. In fact, if you had a group of trans men compete against a group of trans women, it may still not be an even playing field. The point here is that the gap is large, and this is not just one study coming to this conclusion. Similar studies show the same thing, a small decrease in strength in trans women, a large increase in strength in trans men, and despite this, trans women still outperformed the trans men after hormone replacement. Coming back to this review, they echo these conclusions, stating that the muscular advantage enjoyed by transgender women is only minimally reduced when testosterone is suppressed. The research does not seem to indicate that hormone replacement is sufficient to get rid of the advantage that transgender women have in strength. That being said, one issue that I do have with these studies is that they all seem to test untrained individuals as opposed to athletes, which we know can have an effect on studies that test changes in physical performance. It's also important to mention, especially for us as cyclists, that there aren't really any good studies on how transition affects endurance performance. The only one that exists is this one on race times for transgender runners, which looked at race times at various distances in transgender women before and after transition. The results showed that the transgender women had remarkably similar age-graded scores in both the male and female gender. Age-grading is a way of comparing performances of all ages and sexes. According to this study, this would mean that transgender women could be at the same level as cisgender women in these types of events. This study is not without its flaws, though. From the study itself, the races compared had a long time period between them, and only two of the eight runners reported stable training patterns over this time range. Going back to this review, they agree on the value of this study, stating that factors affecting performance in the interim, including training and injury, were uncontrolled for periods of years to decades, and there were uncertainties regarding which race times were self-reported versus which race times were actually reported and verified, and factors such as standardization of race course and weather conditions were unaccounted for. That study was far from high quality, and given that it's the only study we have that comes to that conclusion, it would be quite a leap to say conclusively that transgender women have no advantage over cisgender women in sports like running, swimming, cycling, etc., based on that study alone. What it can do is reinforce a point that I touched on earlier in the video, which is that the gap in performance between men and women in endurance sports is much lower than the gap in strength-based sports. We're talking 10 to 13% versus 30, 40, or 50%. Given this, it is perhaps more likely that an endurance race such as the marathon between transgender and cisgender women could be fair. Going back to this review, they state that circulating hemoglobin, which can affect endurance performance, are reported as 12% higher in males compared with females, and hemoglobin levels appear to decrease by 11-14% with cross hormone therapy in transgender women. Oxygen carrying capacity is also most likely reduced with testosterone suppression. What it really comes down to is that we need more data. The effects of testosterone suppression on VO2 max, left ventricular size, stroke volume, blood volume, cardiac output, lactate threshold, and exercise economy, all of which are important determinants of endurance performance, remain unknown. Until more research comes out about how testosterone suppression affects endurance sports performance, it's really hard to make a conclusion either way right now. So given the data that we do have, what conclusions can we make? Well, evidence that reduced testosterone in trans women results in them losing their 10-50% performance advantage is simply lacking. For strength-based sports like weightlifting, there's really no question. Sure the research is limited, but all the studies are pointing in the same direction, which is that testosterone suppression does not erase the transgender female's strength advantage. And in fact, it really doesn't even come close. Endurance sports are a different story though, because the research is so limited, and the one study that we do have, albeit flawed, did show that potentially trans women could compete with cis women fairly. Nonetheless, even if we do find that endurance sports performance is the same between transgender and cisgender women, which is unlikely seeing as strength is still a relevant factor in these sports, there is still always the potential for races to come down to a sprint finish. And in cycling, particularly road cycling and track cycling, that's actually the norm, not the exception. When assessing whether or not trans women would have an advantage in sprinting, well that brings us back to the data that we have on strength and explosiveness. And trans women would have a clear advantage, and therefore the competition would be unfair. Races are often won by razor-thin margins, and even the slightest unfair advantage could be the difference between winning and not even making the podium. However, insignificant that difference may seem to us. Tell me about it, dude. I forgot to shave my legs before the crit last weekend, and that little bit of extra aero drag is the reason why I got dropped 15 minutes in instead of pulling out the win. Next time, I guess. Therefore, there is a heavy burden of proof placed on those who claim that transgender women competing in endurance sports with cisgender women is fair, and at this point in time, we're nowhere close to meeting that burden of proof. But who knows, maybe in the future as we get more research, that could change. If you strip away the politics on both sides of this argument, this is essentially what it boils down to. In sports, we value both fairness and inclusion. We want people to feel included and be included in sports if that's what they want to do. And research shows that trans athletes have faced real struggles in this area, which is something we should fight to change. But we also want sports to be fair. This is why we don't allow doping. It's why we have different age categories and weight categories in the Paralympics. We want to see people compete on an even playing field. When you ask, should trans women be allowed to compete in women's sports, what you're really asking is which do you value more, inclusion or fairness? Different people will have different answers to this question, but the International Olympic Committee's answer is that they value fairness more. The overriding sporting objective is and remains the guarantee of fair competition. Restrictions on participation are appropriate to the extent that they are necessary and proportionate to the achievement of that objective. The IOC is stating that they restrict participation in order to preserve fairness. Now other governing bodies can have different rules about how much they value inclusion versus fairness, but it's pretty clear from the data that the current IOC guidelines on transgender athletes does not support this fairness objective as they claim. And finally, one side that I often see being left out of this debate is the perspective of the cisgender women that have to compete against transgender women. After all, it is these women who could potentially be losing out on wins, podium spots, medals, Olympic spots, national team spots, sponsorships and endorsements because of these rules. Luckily, I found a study that did seek out this perspective. This study polled female Olympians from this year's games and came up with these main findings. These athletes thought both female and transgender athletes should be fairly included in elite sport. However, there was also unanimous agreement that there is not enough scientific evidence to show no competitive advantage for transgender women. The women also unanimously agreed that the International Olympic Committee should revisit the rules and scientific evidence for transgender inclusion in female categories. And finally, the majority of athletes felt that they could not ask questions or discuss this issue without being accused of transphobia. That wraps up this video, but I want to hear from you. What do you think a solution to this problem is? Should trans women just compete with cis women? Should they have their own category? Should there be an open category? Should the testosterone limit be reduced further? Or perhaps something else? Let me know down in the comments. If you enjoyed this video, be sure to give it a like, subscribe for more science-based cycling videos just like this one, and share this video with your cycling friends. And your sports fan friends as well. I'll see you in the next one.


Howdy. Today, we're going to build a confidence interval for a population mean. You measure 26 textbooks as weights, and you find they have a mean weight of 55 ounces. Assume the population standard deviation is 8 ounces. Based on this, construct a 90% confidence interval for the true population mean of textbook weight. Round to three decimal places. We will use technology for this. So in this example, sigma population standard deviation is known. So we can actually use our standard normal RZ distribution. Out of all the information they gave me, I know that the sample size is 26. I know that the mean weight X bar is 55. And I know that the population standard deviation is going to be 8. My confidence level in this case is 90% or .9. This is what I need to put into Google Sheets. So I will go to Google Sheets and make sure you go to the data list tab. And I will focus my attention down here on the one variable confidence level P value Z distribution. We're using Z because we know sigma. We know the population standard deviation. X bar is 55. Sigma is 8. Sample size is 26. Confidence level in this case is .9 or .90. And this gives me a confidence interval of a lower limit of 52.419 and an upper limit of 57.581. And that's all rounded to three decimal places. So the true population mean for textbook weights is between an upper limit of 57.581 and a lower limit of 52.419. You can also write this in interval notation as well. So the correct interpretation is with 90% confidence. The true population mean of textbook weights is between 52.419 ounces and 57.581 ounces.


Let us start with the topic today, which is malware. So this is just an introduction to malware. We won't get into any great detail into any particular kind of malware, but we've all been had some experience or the other, we've heard something about these different things. So the first thing is worms, viruses, spyware, botnets, trojans, etc., etc. So what's the main difference between a worm and a virus? Worms and viruses both refer to malware that replicate themselves. This is the most important issue.  So the same thing about the cyber malware, they replicate and sometimes at a very fast rate. So a virus latches itself onto an executable file. It cannot exist without latching itself just like a human virus that infects like the flu virus, for example. It latches itself onto an executable file or program, while a worm is typically a standalone program. A virus infects a file and uses it as a host from which to infect other files, while a worm spreads typically from one computer to another computer.  So you are induced into, for example, downloading it onto your system, into your cell phone, etc. But unlike viruses or worms, Trojans, by definition, do not replicate. If it replicates, then it would be a worm. A Trojan is typically activated by action on the part of the victim. Trojans may enter a system in several ways through email attachments, through file sharing software. It could come from a website or through cell phone downloads. So there are many vectors of propagation as far as Trojans are concerned. Going down specifically to worms, and later on we'll talk about whatnets to. Some of the different classes of worms are internet scanning worms.  Email worms, Melissa and Sobegg. P2P worms that spread in P2P networks. Very interesting worms like Sammy and Santy. And as we examine some of the case studies, the first question to ask is, what is the vulnerability? Whenever you see any attack, you must go back and say, what is the thing that caused this attack? And then mobile worms like Kabir and Comwar. Some of the relevant questions to be asked in the context of malware, what vulnerabilities does a worm exploit? How does it select its targets? How is it carried? How does it infect other hosts? How is it activated? Is it human activation or automatically activated? How fast does it spread? What harm does it cause? Are there any preventive, detective measures against such attacks? And if so, how effective are these measures? So let's try to answer at least some of these questions in the context of one or two worms. The other development that took place about 15 years ago was the unleashing of polymorphic and metamorphic worms. So you may be aware that the earliest antivirus products worked by looking at payloads of typical network packets and examining a sequence of bits, which was the signature for a particular worm. So the worm writer got very smart and decided to dodge the antivirus software and came up with something called polymorphic and metamorphic worms. So most worms and viruses have unique and distinct signatures, typically to start with a pattern of bits, usually assembly language code. Not everything is assembly. It could be also JavaScript. It could be PHP, et cetera. So a pattern of bits, usually assembly language code, which appears in all instances of the worm. So that was the earliest kinds of worms. Worm and virus signatures are the key to detecting them. However, there are sophisticated code obfuscation techniques to evade detection. So they tried to dodge detection by doing something very interesting, which is one such technique is the use of encryption for disguising worm code. Different instances of the worm may use different keys for encryption. Thus they might fail to match any existing worm signature. Such worms are said to be polymorphic. So you have polymorphic worms, you have metamorphic worms. If it's just a bunch of assembly language code, you very well know that there are so many different ways in which you can write the same program. So if you're just looking at machine code in the worm payload, you might actually fail because you can write the same program in about 10 different ways. So would you have then 10 different signatures for a given worm? And of course newer and newer mutants are coming up all the time. So it's very difficult to keep up with the signatures for worms. It's very difficult to update the database that often, the database of worm signatures. The first case study I would like to talk about is that of code red. So this happened about 12 years ago. Code red was an internet scanning worm carried in an HTTP request messages, targeted at a web server. It's the Microsoft IIS server. Several million of them were an active deployment at that time. So the first thing the worm writer does is he asks himself the question. If I'm trying to target something is that machine very, very pervasive. Do I have lots of Microsoft IIS servers in deployment around the world, for example? Second thing, is there a vulnerability? And the answer is yes. A buffer overflow vulnerability, we talked about it yesterday and we're gonna have a demo of this today. A buffer overflow vulnerability was discovered in the Microsoft IIS web server and a patch for this vulnerability was developed a few days later on June the 18th. I believe the year was 2001. The first worm, the first version of the worm was unleashed. This used a random number generator to generate new addresses of machines to infect. So the question is how do you select your targets? Which IP addresses? So what does it do? It uses a random number generator to generate new IP addresses of machines to infect. Now how does it know that that machine runs the IIS web server? So it's got to be lucky.  Now he's just hoping that this machine with some arbitrary IP address that he's just generated also has the IIS web server on it. Not only that, it should not have been patched. Correct, otherwise it will not be infected. So it generates this random number generator to generate new addresses of machines to infect. However, the same seed was used for the random number generator in every instance of the worm resulting in the same machines being infected again and again. So you infect one machine, the worm code over there looks and scans around to see other machines to infect and infects other things. Again, the probability of infecting another machine is not very high because as I said, it should be a web server, IIS web server, and it should be unpatched. However, it used the same seed. So the same machines were being infected again and again and this was taking place on July the 12th. So roughly a month after the machines were patched and the machines were patched approximately a week before this vulnerability was found and this information disseminated to everybody. Now the worm writer was quite smart. He noticed that too many machines are not being infected. So a second variant of this worm was unleashed shortly after on July the 19th. So about a week later, wherein a random seed was generated in each worm instance. This had a dramatic effect on worm propagation. About 360,000 machines were infected in just a span of 14 hours after the launch of this new version. That is on July the 19th. So we're talking about one week later than the first version. The infection phase continued until July the 20th. So all of them were infected until July the 20th at which point the worms moved to attack phase. So they are sitting down there for a day and then they were instructed on July the 20th. At this point, until July the 28th, they launched a denial of service attack on the White House webpage, www.whitehouse.gov, and defaced the webpage with a phrase hacked by Chinese. So this is actually what they did. It was basically somebody out there, we don't know who's the worm writer, but somebody who's trying to show that he can do a lot of harm. He can deface webpages and he can compromise lots of machines. So hundreds of thousands of these machines were compromised and he deliberately chose this thing, this IS web server, because he knew there were many, many deployments, hundreds of thousands of these around the world. Guess what? Another worm writer comes up three years later and comes up with this slammer worm. The main differences are both exploit the buffer overflow vulnerability. However, the target in the first case was a web server. The target in the second case was a Microsoft SQL server 2000. So most of the deployments around the world are Microsoft servers. So that's a very, very low-hanging target for most worm writers. Interestingly enough, in the first case, the protocol was TCP. So it was actually HTTP on TCP. And in the second case, it were UDP messages to this SQL server. The payload now, so you can see the improvements. First you're using UDP, which everybody knows is a connectionless protocol. So obviously the latency is going to be less. Not only that, the payload in the first case was 4 kilobytes, 4,000 bytes, and was reduced drastically to 384 bytes in the second case, in the case of SQL slammer. The characteristic of the first one was it was latency limited. So what limits the spread of this worm was the fact that was latency or time or delay. On the other hand, the second one was limited by bandwidth. So if you had more bandwidth, you could spread faster, but there are bandwidth limitations. And then the infection rate doubled every 37 minutes. So the number of infected machines doubled every 37 minutes, while in the case of slammer, it doubled every 8.5 seconds. So in a matter of less than an hour versus 24 hours, huge number of machines were actually infected. It's very interesting to see what is the effect of this thing and to somehow model it. So this is somewhat of a research problem. What are the number of infected machines? So these are some of the parameters. Let N be the size of the total population. So this is what's called the Simple Epidemic Model. This model is used to simulate or to model a spread of human diseases like say for example, smallpox. Let N be the total size of the population. This is the population of IAS web servers, for example. Let IT be the number of infected individuals at time T. The number of susceptible machines at time T is then N minus IT. So N is the total number of machines that is supporting the IAS web server. And I is the number of machines at time T that's already infected. So the number of machines that remain to be infected that are still susceptible is N minus IT. Let beta be the infection rate that is each infected person or machine attempts to pass on the infection to beta susceptible machines in one time unit. So now the question is, can we write a differential equation for this to model the spread of this worm? And let's see how fast it propagates. So the following differential equation captures the number of infected machines at time T. So the incremental number of new infected machines in that little interval of time DT, let's call it DI, then DI is equal to beta times IT multiplied by the rest of the thing times DT. So that is to say, the reason for this is very straightforward. You must have seen this differential equation in different contexts. There are I-infected guys. Each of these I-infected guys tries to infect beta times DT guys in an interval DT, correct? Because the infection rate is beta. These are the infected guys at time T. Each of these guys will infect, in an interval of time DT, each of these guys will infect beta times DT other guys. But will all of them get infected? Well, some of them are already infected. So it will not increase the infected pool. It will only increase the number of infected machines if the machine is not already infected. And the probability of not already being infected is N minus IT divided by N. So this is the probability of not being infected. Only if it's not infected, can it add to the number of infected machines. So this is a differential equation. And the solution of this, if you integrate, you will get this. Any guesses as to what this thing looks like? So many labs around the world actually started to model these things and took measurements and so on and so forth when they saw such a huge amount of traffic directed on port 80 and trying to target these IS servers. So a lot of labs around the world started to save this traffic for later analysis. And indeed they came up with a similar kind of equation. So you might have seen again this thing. The graph for this looks like over about a 24 hour period. You can see that the number of infected machines is increasing dramatically. This is what's called the logistic curve or the S curve. You might have seen this in neural networks and other things, the logistic curve. So it's increasing dramatically out here. And the model says it will go on increasing and sort of saturate. But really speaking, what happened was the number of infected machines started to taper off and in fact decrease a little bit earlier. Now what is the reason for this actually? So this model is not perfect. It started to, it increased and then it started to decrease after a while. And the reason for that is in reality, many of the machines got to be patched. So these are all the, at this point in time, the susceptibles are only the machines that were unpatched. So again, look at the time frame over here. Sometime in June, this vulnerability is detected. Which vulnerability? The buffer overflow vulnerability. One week later, Microsoft announces the patch. Now some guys are not very cautious. Some of the system administrators, they didn't patch the machine. A huge number of machines around the world were not patched. People ignore these directives. They were not patched. So a lot of machines are potentially infectable. So all of those machines contributed over here. So they all sort of started getting infected once the worm was unleashed over a 24 hour period. And then what happened is, system administrators were warned that this worm is moving at a fast pace. So they started patching their machines. So that value N, which is the total number of susceptibles, that value itself decreased. We had this N, which is the total number of size of the susceptible population, that itself began to decrease. And as a result, since some machines got patched, they got rebooted and so on and so forth, they were not infected in the end. But still the number of infected machines was very large, as you can see. So this is a nice model that has been built by some research groups around the world.  And this includes things like email worms and P2P worms. So topological worms are so-called because the vulnerable machines can be represented as a graph, with the nodes representing the vulnerable machines. An edge between machine A and machine B suggests that A knows or stores the address of B and is capable of directly infecting B by sending it a malicious payload. So one of the questions I presented earlier was, how do you know which machine to infect? Which is a valid machine to infect? So over here you have a topology, actually. Every node in this graph, A is supposed to know or store the address of B. So for example, if you have a phone book and you have a worm that is spreading through the cell phone network, then one ready way of doing that is I just look at the phone book and my cell phone and I know whom to infect by just looking at those addresses. So topological worms have focused targets. Their immediate targets are their neighbors who in turn spread the infection to their neighbors and so on and so forth. So if I'm over here, then my immediate targets in this graph would be all the addresses that are in my phone book. So if I have a mobile worm, for example, it would first spread through Bluetooth or MMS or whatever is the propagation vector, it would spread through all the people in my phone book. And then it would look at the phone book of those victims and would spread through all those people and so on and so forth. So that's why they're called topological worms. The best examples of topological worms are email worms and P2P worms. Another example of a worm is something that you have seen a little bit about yesterday, web worms, very interesting. Sammy and Santy are two examples. Sammy is the one that actually exploited in XSS vulnerability. So the XSS worm, Sammy. So this is a very interesting thing. This guy was trying to design something and he never expected it to be so successful. His name is Sammy Kamkar. The XSS worm, Sammy, was unleashed in October of 2005 by Sammy Kamkar. It infected the social networking site MySpace. Social networking sites typically allow users to create, edit, and save their profiles, making those profiles accessible to some members, to their friends for example, who are some members of the social networking group. So you can read my profile if you are my friend on some social networking site. Sammy added a bunch of carefully crafted, so this is what he did now. He started thinking, thinking, thinking. He's well aware of XSS.  So that's the first thing. Now very clever JavaScript. If you Google around, you will find that JavaScript and you can try and understand it. When a visitor to Sammy's website, say V1, downloaded Sammy's profile onto his browser, the JavaScript and Sammy's profile began to execute. This caused Sammy to be added as a friend in V1's profile and also to include the message. But most of all, Sammy is my hero. So this is the JavaScript that got infected. So when I looked at Sammy's profile and downloaded it, say I'm Sammy's friend, then what will happen is the JavaScript in Sammy's profile will execute. Okay, because that's in a webpage, correct? And anything that's JavaScript will execute by my browser. So that thing began, this is a persistent XSS attack. So that thing began to execute and what does that thing do? The first thing it does is it uploads the infection to my profile. So I am V1, V stands for victim. I'm the first victim who's reading Sammy's profile and my profile gets infected and Sammy's added as my friend. And the next thing is, somebody else starts looking at my profile and then his profile gets infected and so on and so forth and this worms started spreading very rapidly. So some of the details are in the textbook and the actual details of the code you'll find on if you Google around. Within 20 hours of the first visit to Sammy's profile, Sammy had been added as a friend to more than a million user profiles. This rate of spread was even faster than that of code read. Now, how did the worms spread? So one thing is we understand how XSS, the vulnerability, but the difficult part is, how did this thing actually spread? That's the whole thing about a worm. How does it replicate? So how did the worms spread? Any MySpace member can update his profile after logging in. After V1 logged in and viewed Sammy's profile, the malicious JavaScript embedded in it began to execute and as part of the execution, the JavaScript uploaded itself onto V1's profile on the MySpace server, thereby infecting V1's profile. Okay, so so much about, so these are just brief introductions to different kinds of worms. We have looked at now internet scanning worms. We've said something about XSS worms and topological worms. Another very interesting thing, which could be pretty devastating in the future, because so many cell phones exist today, more cell phones than laptops. So this is a potential problem for the future and that is mobile malware. So once again, what is the vulnerability? So mobile malware exploit a number of vulnerabilities. Some of these are features of the Bluetooth protocol. If your cell phone is Bluetooth enabled, others are software vulnerabilities that exist in the implementation of the Bluetooth protocol stack. Most of the vulnerabilities are of the social engineering type. You carelessly accept some download from some place which is not really secure. On many cell phones, users can download new applications. So in the old Symbian operating system, for example, these were packaged in SIS files, Symbian installation source files on the Symbian OS. Today, one of the most popular OSes is Android and still you have lots of infections as everybody knows. So many of our students over here are designing worms for the Android system and even botnets based on the Android. So some of the earliest mobile malware were packaged in well-formed SIS files. The installer was tricked into believing that this was an update of an existing application. So this is a very nice thing, just update this application because it's got some new features. So you download that application and lo and behold, the installer replaced the existing application with malicious code. So whenever the application was invoked, it was the malware that also ran. So I downloaded this application and I was not careful to see where it came from. That's the vulnerability. So another common vulnerability as far as mobile malware is concerned is placing the cell phone in discoverable mode. Now, when you do this, you enable the attacker to obtain the Bluetooth device address of the victim's cell phone. So this BD address is basically a MAC address which everybody knows is 48 bits. So knowing these BD address, that is Bluetooth device address, the attacker could attempt to exchange files. So this is part of the protocol. Once you know the BD address, you can exchange files using something called the object exchange protocol, OBEX protocol. This is used to transfer images, business cards and other files between two Bluetooth enabled devices. So here again, you've got a vulnerability and besides exchanging images and business cards, you might also exchange malware. Another vulnerability, so there's a whole list of vulnerabilities as far as mobile malware is concerned. Another one is related to social engineering. User authorization is usually required before a file can be accepted by a smartphone. The smartphone usually prompts a user to enter his or her pin as a way to confirm whether an external file, for example, should be accepted. Now wait, some operating systems accept file transfers without user authorization. So they bypass this to make it convenient. Some smartphones allow users to disable the authorization required because it's a hassle to always say yes and no and to type your password and so on. So some smartphones try to be nice to the users by allowing users to disable the authorization required option for file transfers. Also it has been estimated, so these are some reliable estimates, that between seven and 25% of the users indiscriminately accept files or MMS attachments because they bear some very flashy kind of header. You acclaim your price for one crore rupees or something of that sort. Some examples of this, one of the earliest example was the Kabir worm, which attempts to discover other Bluetooth enabled phones which are set in discoverable mode. When it finds such a phone, it sends the worm payload in an SIS file. So this is again related to the earlier Symbian operating system. The receiver needs to accept and install the file. Kabir's payload was mostly benign, so it was not really, it didn't really cause harm, it was just a proof of concept kind of worm. Kabir's payload was mostly benign, typically displaying Karebe, just some name on the screen. However, the continuous scanning for new victims, don't forget one of the main jobs of a worm is to spread. So it's continuously scanning for new victims on an infected phone, and this depletes the power of the infected phone. Next was another worm that came which had two vectors of propagation. One was Bluetooth, and the other was multimedia messaging service. It used MMS to spread to different contacts in the smartphone's address book. So the earlier question, how does it know who its victims are? Just look at the phone book and you have a whole list of people out there you can infect. It required user interaction to be installed. It entices the user with catchy subject headers such as Happy Birthday. Once it infects a smartphone, it attempts to discover Bluetooth-enabled smartphones and pass on the infection as an SIS file to them. So notice the two vectors of propagation, MMS, where you discover your victims using the phone book or address book, and the other is Bluetooth, where you use Bluetooth in discover mode. If it's in discover mode, then you can discover it and infect it. Okay, so from that, we move to now one of the most common types of malware, something that's getting increasingly problematic today, and malware design and so on has moved now just not only for having fun creating a new malware, let's be a hacker just for fun, but also for financial gain. So that's now with Botnets. A Botnet is an army of compromised computers or bots connected by the internet and remotely controlled by a Botmaster. So the new thing about bots is that they're under control of a Botmaster, unlike a Worma virus, which has no further communications with whoever unleashed it. While in this case, the bot is continuously or at least periodically in communication with its Botmaster. The earliest Botnets were a collection of zombies that participated in distributed denial of service attacks. Today's bots, however, are much more sophisticated. They may comprise tens of thousands or even millions of bots. So very serious problem because you've got this whole army there just waiting to do what you wanted to do. You're all waiting to accept your command. The emergence of Botnets, as I mentioned before, is closely related to the motive of financial gain. So I boast that I've got these one million bots under my control, these one million infected machines under my control, and I can command them to do whatever I want at any point in time that I want. Then I go to the market and I say, do you want to buy 100,000 of my bots?  So so much, so many $100,000 you pay me and I will give you say 100,000 of my bots from my one million bots. Often used to send spam mail on behalf of third parties. Bot programs may contain keyloggers and other forms of spyware that capture sensitive personal information such as passwords and credit card numbers and send these to the bot master. So now that becomes a very dangerous thing because many people would like to have a database of credit card numbers to do business with or even to commit fraud. Botnets have been used as an extortion tool. Pay up or your website will be bombarded by a DDoS attack. So I've got all these guys just waiting to attack you.  One important difference between a bot and a computer infected by a traditional worm virus Trojan is that a bot needs to communicate with specific nodes in the botnet. So this is another thing. You communicate to receive fresh commands. So every say week, you might receive a new command. Early botnets used an IRC internet relay chat IRC server as a command and control server. A channel on such a server was used to convey the bot master's commands. Now the problem with this is if I've got an IRC server, law enforcement might come and notice it and might arrest me because I'm the one. I'm the bot master and I'm deploying this IRC server to issue my commands and so on. I can be detected. So what do you think they did? The second generation of botnet used a P2P network. A more recent trend has been distributed and decentralized botnet architectures. So nobody really can figure out who I am, who's the brain behind this botnet. Distributed and decentralized botnet architectures which leverage existing highly scalable and robust P2P networks. P2P networks are sort of in a sense anonymous. So you don't know who's the bot master and who are the guys who are disseminating his commands and so on. The connectivity of P2P networks ensures that even if a large number of bots are disabled, so it's very fault tolerant, even if a large number of bots are disabled, the rest of the bots continue to do their master's bidding and stay connected. Moreover, there are no fixed CNC servers making it hard to detect and incapacitate a P2P based network. If there is a single bot master sitting down somewhere, you can almost be sure that within a few hours or days he will be detected. So the best thing is to create a P2P network and disseminate commands through some of your Chamchas or cronies. So let's see the picture over here. This is the bot master and there are all these nodes in the P2P network and I choose some of these cronies and the thing on top that you can see. So this is the bot master. These are all the nodes in the P2P network. Now there are two types of nodes, one with those crosses and one without. The one with the crosses are the infected guys and the ones without are the uninfected. And the bot master actually uses a set of bots to disseminate its commands. So these commands actually move back and forth. They actually spread through this P2P network just like you would exchange music files and so on and so forth through a P2P network. Now these guys are responsible. So he dynamically changes these guys. So these are his cronies at one point in time. These cronies might become another set of these infected guys at another point in time and they disseminate commands to these guys, the infected guys. And typically these infected guys are asked to go to a particular website and retrieve the commands from that website. So on Wednesday, for example, they might go to this website but I don't want to be detected so I dynamically change the URL. On Thursday I might say go to this website and I'm continuously evading law enforcement by changing the website. So if you think it's this website, tomorrow it's this, then I've changed it again to this and so on and so forth. And finally one last case study on the Storm Botnet. So this was first detected in January of 2007. It's other names are PCOM, Nuvor and Zelatin. So Storm Bots are infected in stages. The most common vectors for propagating the primary infection are email or infected websites. So you get an email, the typical thing.  Email was sent with sensational subject lines so you're induced to read this thing because it sounds so sensational. 230 people die as Storm Batters Europe. Likewise, users were lured into downloading free but infected files from websites. Download this file, it's going to give you some best music of the last one year, for example. So you're lured into downloading that thing. Containing music of various pop artists. The primary infection instructed the victim to join the Storm Botnet, which is embedded on top of a P2P network. That P2P network's name was the Overnet P2P network. Now this network itself is based on a well-known cadmilia protocol which employs a distributed hash table based routing protocol which efficiently locates a value corresponding to a given search key. So you're searching for a given song, for example. Now suppose a peer X needs to access a file. It would perform a search based on a search key which could be the hash of a file or the hash of the file name. The result of the search is the IP address and port number of the peer hosting that file, say Y. So once I know who has that song, I X would go directly to Y to obtain a copy of that song. So this is the same way I'm going to leverage this to obtain a copy of the malware. So both node IDs and search key are drawn from the same space of 128-bit numbers. So once part of the botnet, so this is the interesting part, it's not just a static thing, it's very dynamic. Once you're part of it, the bot was programmed to receive the second and subsequent injections of malicious code. One of the injections instructed the bot to propagate email viruses. Another injection received some days later, instructed the bot to launch a DDoS attack on a target specified by the bot master. So you can ask it to do anything that you want and you have got so many of these things under your control. Now what I would like to do is to continue the discussion because this is one of the most important vulnerabilities, the buffer overflow and the XSS. So right now we will continue the buffer overflow vulnerability because I didn't manage to do it completely. You can actually see how this is done, how this is defended against, and you can try it out both in your college with your students and teach the other teachers also about buffer overflow.


All right, just listen to your inspiring Klaven rebuttal. It's a show I did a few days ago, where I went after Klaven's critique of Iron Man. It may be quite dubious about modern conservatives. Absolutely. With that said, what do you think of the older generation of conservatives? Specifically one of my years went to Milton Friedman. So I don't think Milton Friedman was a conservative. I think he was more of a small L-Libiterian. I don't think he considered himself a conservative. I can't think of many good conservatives. Buckley was awful. Irving Kristol, two cheers for capitalism, not three, only two. You could go on and on and on about the conservatives and how bad they were. And now they're even worse. They're getting worse over time. But they've always been bad. I mean, I ran, criticized the conservatives in the late 1960s. They were already awful then. Now, as for Milton Friedman, I mean, I have a mixed view of Milton Friedman. Overall, I think he did a lot of good. I think he's a great communicator. I think he manages to communicate economic issues succinctly, powerfully, with great reason, great examples, and passion, and passion. He's a great speaker. But he also did a lot of damage to the cause by not grounding his economics in a moral foundation, which he could have had because Iron Man was right there.  And this is, I'll say the same thing about Hayek and Mises and all of them. People like Rothbard retarded the progress by millennia because they explicitly rejected irrational ethics, even though they were exposed to it, and then embraced a completely unbelievably irrational philosophy, a subjectivist morality that was completely irrational, that led him to be an anarchist and all that. So I think Rothbard has and will have retarded progress towards true liberty for a long, long time. But Friedman Hayek, Mises, were more influential. And if they had embraced even some of Rand, even the framework Rand presented, the idea that you need a morality of individualism, even if they didn't agree on the details, that we would be today 30, 40 years ahead in terms of our fight for capitalism, for freedom, for liberty. Now, again, I think Friedman, good economic work, I think some of it's bad. His whole monetarist theory accepts the existence of a Federal Reserve. He accepts the existence of a Fed, he accepts the existence of government money. I think that's a huge mistake, hugely wrong. So I think he made a mistake by not taking the Austrian economists more seriously. Now he changed his mind about the Federal Reserve towards the very end of his life and became a free market in banking as well. But his main problem is that he didn't see. He didn't have to be a moral philosopher. He just had to give credit what credit was due to the moral philosophers. It's the only important moral philosopher at the time, which is Ironman. So while I'm a fan of some of his economic presentation, particularly his ability to take very abstract concept and concretize them, simplify them, make them easily graspable to people. It's what I try to do, but he was the master of it. I admire him for that. I think he had real problems and did real harm in other areas. You know, anyway, so that's, I think the Federal Reserve is a big one. And he's responsible for the negative income tax and withholding tax was withholding tax is a Milton Friedman idea. It increases efficiency of tax collection, but it's horrible. Imagine if you had to write a check to the government every time you paid your taxes. Maybe people would have a better grasp on how much they pay and how bad it is. What we need today, what I call the new intellectual would be any man or woman who is willing to think. Meaning any man or woman who knows that man's life must be guided by reason, by the intellect, not by feelings, wishes, whims or mystic revelations. Any man or woman who values his life and who does not want to give in to today's cult of the stare, cynicism and impotence and does not intend to give up the world to the dark ages and to the role of the collectivist. Broads. Using the super chat. And I noticed yesterday when I appealed for support for the show, many of you stepped forward and actually supported the show for the first time. So I'll do it again. Maybe we'll get some more today. If you like what you're hearing, if you appreciate what I'm doing, then I appreciate your support. Those of you who don't yet support the show, please take this opportunity, go to uranbrookshow.com slash support or go to subscribestar.com uranbrookshow and make a kind of a monthly contribution to keep this going. I'm not sure when the next...


her they're going to be tightly wound together and I'll show that in a second and then what we're going to do is we're going to write a quick smart contract and the way we're going to do it is using scaffold eats debug page so this is what scaffold eats looks like you can go to debug contracts and you can see your contract oh do we see a new contract come up there let me do it again we should see a new contract right here yeah we're not so something's wrong ok let's see if this comes up there we go and then if I yarn deploy dash dash reset let's see if we see it again what I'm checking here is am I deploying a contract and is it showing up in the front end there it is ok yeah so watch this contract address am I deploying the same contract over and over again but I get a new address here every time that's what I want to see ok time to write a smart contract right that's what really here to do is build on top of ethereum we saw some simple smart contracts earlier there was like a UINT and a counter scaffold eats lays out all of these data types for you really kind of simple template format here just an example smart contract we're keeping track of an address a string, a bool, a number right UINT so unsigned integer with 256 bits a map in right that's kind of like a hash map then we get in here and we show like events you don't need to know that yet constructor if you're a programmer you can kind of intuitively understand that like oh that's the thing that's going to run when I deploy the contract modifiers we don't really need to get into but here is the main function here there's a greeting so there's some greeting that's stored in this contract and then there's a function that allows people to call set greeting and set that greeting so I've got a burner wallet a private key and local storage I'm going to fund it with my local blockchain and then I'm going to go set the greeting so I'm going to go talk to my smart contract I'm going to say hello world this is going to send a transaction and that transaction is going to edit the state of the smart contract which is divided here in the smart contract and let's tinker with that a little bit so this is a payable function here which means that I can send money along with my message so if I send in one way and hit go something else happens it basically checks to see if the value is greater than zero and sets this premium flag for some reason we have some variable called premium and if I don't send any money premium is false and if I do send some money premium is true very simple code someone said earlier that solidity is going to be the easiest language it should be almost like an embedded controller you're writing very simple code that has to run exactly the same every time we have this function in our smart contract that lets someone set a greeting and then we have some extra code in here that does some different logic based on that okay so as you're going through and you're playing and you're learning someone already mentioned this but I'm going to show it again I think Kevin you mentioned this what you're going to want to do is go to solidity by example solidity by example has all of these really great examples of how to build things in solidity for instance if you wanted to learn about mappings we were just talking about that you can kind of just copy and paste so what happens if I put a mapping in here and I redeploy my contract well hopefully I'm going to see a new mapping there we go there's my map and I can access that I can send it an address and get some value back so for some address I'm going to get some number back and so let's just go ahead and set that so let's say in the constructor the map of this dude's address equals I don't know what should I make it equals 100 let's just say 100 okay and then let's deploy it so when the smart contract gets deployed it's going to set the mapping for this address the number for this address to 100 for some reason I don't know we're just kind of arbitrarily writing code and tinkering with it and testing it right but let's go see that that works let's paste in our address and let's do a read and it is 100 great okay so this is how you tinker with Solidity and after you go through speedrun ethereum or even before you go through speedrun ethereum you're going to want to be able to do this if you want to learn how to write smart contracts you want to get into this feedback loop where you can go find the next concept that you want to learn maybe it's arrays you can paste an array in here and you can see what it looks like and you just want to get in that that groove of trying things tinkering and then testing your assumptions what happens if we deploy this let's go ship it I have no idea what's going to happen I'm guessing we're going to get an array that has three values one two and three and let's go see right okay there's the array what's what's value one I think it's one oh no it's two what's value two it's three all right all right zero index okay so our array is there and it has values in it right we're able to go find these concepts at Solidity by example bring them into our smart contract and deploy them all locally and tinker with them and that's because scaffold eth is set up to do this for learning how to build your contract I think I'm supposed to go tell 12 30 is that right anybody know I think it's 12 30 yeah I yeah yeah yeah okay so we know we know how to hold funds now right if you want to hold funds on Ethereum you basically have this great big number and elliptic curve you right you have a special math trick that allows you to do that right and we know now how to tinker with Solidity by using scaffolding and there's a lot of details in between those two things that you'll have to fill in by yourself and I would recommend after today going back home and going to speed run Ethereum and going through these things at your own pace but we're going to speed run through them today so the first challenge is just an NFT challenge and I think I have up here somewhere all you're going to do is just go deploy an NFT and it's going to teach you about burner wallets it's just going to get you set up with the environment then we'll go through the staking and the token vendor you guys will do that later today and then you get into like dice game where you're learning randomness you learn how to build a dex which allows you to swap in a decentralized way we talk about state channels and scaling we talk about multisig and signatures SVG NFTs this is just a really focused curriculum that's meant to take a technical person and just give them the download of how to build on Ethereum as fast as possible so you've got the speed run which is your curriculum you've got scaffold which is like helping us right now tinker with our solidity but then let's deploy like an app live I think I have just enough time to probably like tinker with some kind of quick app that we could deploy live so I'm going to trash my entire smart contract here and I'm going to make like the dumbest smart contract ever what do I want I want a UN 256 counter right no no no let's call it price let's talk about money let's make it public price and I'm going to set it equal to 0.001 Ether and then I'm going to have a function called increment right what do you think that's going to do okay so now I need a counter now I do need to counter public counter right if you're a coder all of this should be very obvious to you what's going on here I'm writing the simplest dumbest code ever here we have 0.1 Ether we saw earlier you use way verse Ether and whole numbers and all of that decimal math is not for the EVM you don't want to do any it doesn't want to f around floating point math I think we already covered that mostly okay so increment right we're going to increment and what we're going to do is we're going to make sure they pay some money right this thing is like a vending machine in the sky that anyone can get to and not even I can stop right I'm building an unstoppable app that anyone can get to and what does this magic app do well it takes in some money I guess and it increments a counter okay so what do I want to do here what I want to do is I want the price to go up on a curve what I'm going to do is say price equals price times 102 divided by 101 now why didn't I just use a decimal there no floating point math right okay so our counter goes up our price goes up anyone can hit the increment button pay some money if they don't pay money it's going to fail if they do pay money the counter is going to increment and the price is going to go up 2% just a really weird kind of little price curve we got going on here but this is a cool little smart contract let's go make sure it works let's go deploy it and try it out and this is what you need to do you'll tinker with your smart contract and you'll get in this mode of tinkering and testing your assumptions let's see where are we at here something's not right oh constructor arguments I do not want any constructor arguments and I don't want this here here okay let's try that again I'm deploying a very simple smart contract here there it goes okay we can see the smart contract we can pay right so I'm going to pay the price and I'm going to hit send here and this should increment the counter there we go so we see the counter goes to 1 now if I pay that same price again it's going to fail and it's going to say not enough ether right I need to pay this new amount notice it went up by 2% and when I pay that amount it goes up by another 2% and we see our counter increment okay so our app is working I'm happy with the smart contract let's pretend that you will spend days or months building a really good smart contract and you will build tests for it and it will be awesome but let's pretend I did all of that and now I'm ready to build a front end on top of this app so we've been tinkering around in this debug contracts tab making sure things work but if I move over to the home tab we're going to write some goal write more you'll probably spend more time writing the react than you do the solidity which is very sad but that's how building decentralized apps works right now that's the state of the art so I'm going to clean out a bunch of things on this home page and then we'll write a little react I think I'm just going to make a button that does that lets you click let's see maybe I'll I'll read from the smart contract and then I'll write to the smart contract I think those are the two examples you need to see to be able to build an app so we are using what's called wagme you can go to wagme.sh for the docs we're also using tailwind css and daisy for components we're using nextjs for our app but wagme brings in that use account that gives us this thing right here it gives us this nice address here so now I'm going to read from the smart contract so to do that I'm going to use scaffold contract read and I'm going to read well let's see contract name is going to be your contract and function name is going to be this is really cool so remember how our smart contract is getting injected into our front end when I open this quote it's going to go to my smart contract and it's going to figure out the variables within the smart contract and prompt me with that so what do I want to read do I want to read the counter or the price I was going to read the price but now I kind of want to read the counter because that's kind of cool and then we'll get some data back and name it to counter and so now we have this variable in our state called counter and maybe I'll make like an h1 tag and throw the counter inside of it and hit save it doesn't like that does it what doesn't it like about that maybe it needs to be dot two string yep that's it alright so now we have a count yeah it's a two right there oh man where's our h tag that looks that's yeah come on uh slash div I don't know what style I want here though or class name here we go class name uh I have no idea I should look this up okay forget about all this stuff I'm just going to make a b and a slash b and yeah yeah yeah hard hitting stuff yeah now we should have a div and it's bold it's still not putting it on the next line here we go keep going keep going there we go there's our counter okay it's on its own line now for goodness sakes okay now let's increment the counter right so we're reading from the smart contract that's rad actually we need to read one other value we need to read the price also so I'm going to copy all of that and get price and price and now down here we can call this the count and we'll grab another one all right how's that look that looks great okay I actually want to format that make that look a little nicer I'm going to say format ether and I'm going to bring that in from oh gotta smell it spell it right there we go bring that in from vm hit save there we go now it's point zero zero one count goes up okay so we have the count we have the price we're able to read from the smart contract we're logged in as this person and showing it but now we need to write to the smart contract we need to be able to from the front end make a transaction that hits our smart contract so we're going to use another hook that's used scaffold contract right right to that same smart contracts our contract name is your contract well man zoomed in and the function name we're going to call let's see I don't remember what it's called it's called it's called an increment it's pretty easy yeah okay now there's some value that needs to go in here which is the price I think and then there are some odds there are no odds okay there we go let's see there now cool what how did price change types that's weird okay let's go back to price two string something weird is happening we'll find out in a second okay so hopefully what we're going to do is we're going to call increment we're going to pass in the price paying the money there's probably some right async here that is our function okay so now I need a button that calls increment and let's see what happens on click we're going to call increment and we're going to say increment what do we got that looks terrible give us some style class name equals button button primary notice how much time I spend on the react versus the smart contract that's really sad okay now if I hit increment does this work yes our counter is counting and our price is going up and I'm paying a new amount each time on a curve okay so our app is built let's pretend like I spent a lot of time on this and made it look really nice too but to rewind a little bit we wrote our smart contract we tinkered with the solidity and got it right then we wrote kind of a dinky little front end and now we're going to deploy all of those things together we'll deploy a front end that people can use but first we need to deploy our smart contract to a live network okay let's deploy this thing live so you know what like all this money is getting locked up if we put this on a real network I want this money to go somewhere let's see let's do a let's just make it way cheaper yeah yeah yeah because I don't want to spend a bunch of real money let's start let's go back to our contract and let's make it like zero there we go okay now when I'm doing this deploy here I'm just deploying locally what I want to do is deploy to the blockchain or a blockchain so I'm going to do a yarn deploy and then I'll do a dash dash network and then whatever blockchain I want to deploy to either Ethereum or Sepolia or base and this isn't going to work but let me just do it real quick to show it it's going to say that I don't have any money because when I'm deploying on my local chain I have a bunch of free money but on a real chain I've got to pay real money so I need to yarn generate sorry this is so small you can follow these docs you don't really need to know all these exactly I just want you to have the general idea of what's going on here I just generated one of those private keys remember the private key that we had local storage the private key just great bit number I generated one of those and I hit it in an environment file and it just gives me the address here so I'm going to use that same punk wallet I'm going to use some of that money earlier I'm going to switch it over to we were on optimism earlier I'm going to switch it over to base and I'm going to send in like five bucks or something I don't know oh I only have four dollars so hopefully this is not very expensive okay I'm going to send in three dollars and hope that's enough to deploy a smart contract we'll find out also there's something I'm remembering I need to take this out we don't want console law there's like a whole package that helps you debug you don't need that introduction okay let's see what happens when we yarn deploy to base now what's that oh base yeah base is a L2 is that what you're asking what is base yeah base is an L2 so we consider Ethereum L1 and then there's these other blockchains that run on top of that and settle to the L1 so base is just an L2 that is an optimistic roll up that settles to Ethereum okay but something is still not working here and I don't know if it's because I don't have any money is it funds okay so yarn account let's just make sure we have some money on base I don't know if the money that I sent in actually went yeah I don't think it did it's internet again let me try one more time I just wasn't able to like send the money to the dude hit send please go please go okay that time it went alright let's try to deploy again oh something's happening something's happening we're putting our smart contract out on a live network that anybody can talk to yes it worked we just deployed a smart contract to a live network and paid real money smart contract that anybody can interact with it's dumb as hell but as a programmer you kind of get what's going on here right we made a price curve and some mechanism here it's going to lock the money up doesn't make sense in a lot of ways but in another way it's really cool because that thing that we just put out there like I said not even I can stop it this thing is going to exist forever and not even I can stop it and that's really powerful if you think about building apps and uptime and redundancy you're building apps that are hella redundant they're better than nation states in a lot of ways okay so our app is our smart contract is deployed but now we need to deploy our app and point it at our smart contract so people can use our app right now if they wanted to use our smart contract they would have to like go to Etherscan and talk to it directly and that's not any fun at all so we need to make one change here I need to put my app on base so we've been talking to hardhat the whole time our local node if I change this one value here well I'm going to change a couple of values but you don't need to do this I'm just doing this because it's assuming that I just changed that I changed it from hardhat to base now our whole app underneath shifts over to base this is really powerful because now my whole app is now running on base if I click any of dresses it's going to take me to the base block explorer and if I hit debug on contracts here is our smart contract on base we can click this and we can go look at it here's the contract I just deployed right let's see what did it cost to deploy this thing two cents it costs two cents to deploy that smart contract to base that's awesome that is something has happened in here that is really cool ok so our smart contract is out on base and I have an app here and technically I can hit the increment button and I'm going to do that actually let me connect my metamask we saw metamask earlier and you'll notice that scaffolding bumps you over to the right network and then let me just hit increment with my base account yes there we go so I'm going to pay 37 US dollars 37 US cents and I'm going to increment a counter on a smart contract on base it looks like it works ok now we want to deploy our app live I'm going to yarn versell yolo prod I love this command it's ridiculous yarn versell yolo prod like don't do any checks just ship it put it out there ok that looks good no sure ok so that's going to take a couple minutes to ship the app but then we'll have basically a live app that's at a URL that anyone can go to they can connect their wallet they can hit the button and it's going to talk to our smart contract that we wrote in like 4 minutes and hopefully this shows you that you can tinker with Ethereum you can start with speedrun ethereum it's a very polished curriculum but you can always just dive over to scaffold E and you can have this same setup on your local machine you can have a local chain a local dev server you can tinker with your smart contract then you can deploy it you can build a front end for it it's a live app that anyone can use it's just going to take a while for this app to ship let me see if I've covered everything in my notes here yeah there's a few things I didn't cover but that's ok we sent money we did the dice sort of yes ok so you know you know how a wallet works you know how to send funds you know that there's no central authority it's just a big number that is your private key you know how to tinker with solidity right maybe solidity still a weird language to you but you can always go to solidity by example copy paste those things into your scaffold E and tinker with building your own smart contract then you can build your own app by writing all the react and doing all of this painful stuff that I did here but that gives you a nice front end where you can read and write to your smart contract then you deploy your smart contract live to a network and then you deploy your app live to Vercel and basically you've built a decentralized app and anyone can fork it hopefully you make it very open source we're very open source here and that's it oh look it looks like it's live let's go see oh it's still deploying darn it let's see is there anything else I want to show off before we go any questions I could definitely answer some questions if you have them oh yeah here we got to do stickers too I'll wait for this thing to deploy but before it does I've got this the buffalo and the zebra here from the NFT example I have those here and I think they're mostly set up but I'll pass them around while we're waiting for the app to deploy so here take a buffalo and pass it along yeah split it in half boom boom take a buffalo and pass it thank you yeah have a zebra too here comes a zebra yeah and so these are the NFTs that you'll mint when you do the NFT example speedrun at the earlier definitely open to questions if anybody sorry go ahead yeah any question for us here you go have a zebra okay let's see if our app is live is there a question yeah let's go another one here hello thanks for the speech pay for me a remix I'm not familiar with scaffold so I hope like equivalent to like remix but live locally it's very similar to remix in that you have your code here and you can tinker with it it's a little cleaner than remix and it's local so remix is in a browser very powerful tool for tinkering around scaffold eat is that same sort of UX but local on your own machine and then you end up being able to make a few more tweaks and deploy the app live so remix doesn't have the front end that we have here it sort of tries to auto generate the front end like our debug tab but it doesn't have the app building functionality that scaffold eat does so scaffoldies is like remix to tinker around but then you like go into front end mode and build your front end to talk to your smart contract so it's basically like a remix of steroids yeah yeah remix is awesome though I'm a big fan here you go thanks what is hard hard Sepolia all these terms hard hat is mentioned earlier hard hat and foundry are two different tools that you can use to compile your smart contracts and it basically compiles the code that we saw here into byte code that deploys to your so that's like a compiler testing environment hard hat and foundry Sepolia is a test network so we deployed to Ethereum but if you don't want to spend a bunch of money or you're still learning and testing you can deploy to a test network where it's basically a free network that has a faucet that you can get some extra ETH and then deploy your smart contracts there and tinker around first and then base and optimism are kind of like in the middle there where they're cheaper and faster but they still are live production networks does that answer that awesome let's see if our app is live yet here oh yeah here it is here it is here it is that's got to be that right there here we go ok so this if you go to this long ass URL right here anyone can go to it you can connect your wallet let's go with yeah just made a mask again I guess and I can increment a variable by paying what am I going to pay now 38 cents there we go so now our account goes to and I just used a live app within 30-40 minutes I was able to build a smart contract tinker with it, debug it, get it right and then build the front end on top of the smart contract deploy the smart contract live and then deploy the app live pointing to the smart contract and so you can do that too at home and to learn how start at speed run at the area thank you thank you so much Austin that was amazing and if you want to get into the weeds of development yourself please come back here at 1.30 between that time we'll have lunch there is a food room that we can access I'll show you where yeah make sure you come back at 1.30 here hello everyone right after this we will have a break until 1.30 and we have a dining room for VIP for the guests of STH and all the people who are in this room currently can also be invited to have lunch with my speakers and our dining place is for you to go out of the public that is the house and the next to the main street if you are standing from the outside then it is right on the left the whole house