Percolate on a particular mix of odd and inspiring news headlines in Windy's Coffee House. Newsmakers with a pen shot for the unknown, unexplained and unusual share their experiences with UFOs, ghost encounters, near-death experiences and more for your own unique blend of Windy's Coffee House curious. And now, here's Windy. Glad to have you along. There's so much going on this year. It's just really, really already going by fast. Now we're going to go into the truth or consequences of lying. They're going to detect whether you can lie. Converis, the eye detect, my guest, next on KCMO Talk Radio. KCMO Talk Radio, Windy's Coffee House. Thank you for tuning in. I think you're going to find this interesting. These are new products, new technology, and we are really going into, I guess, future. Future escape when we're talking about this one. This is called, and we're just going to do an overview, something that is better than a lie detector. It's called eye detect, all right? And if you are not familiar with how a lie detector works, because not everybody is, and we haven't had to undergo all this, but what this does is give you an almost an immediate, an account of what's going on with your eyes. And maybe you've seen it in, there's, I think, remember Stargate. Is it Stargate or something like that where they have a little character and they put the eye on them and the little camera detects whether they're lying. It's some kind of totally fantasy, sci-fi fiction. Well, guess what? Not anymore. And so to talk about this, I have one of the authorities here, because I wanted to figure out what direction it was going and what we could count on, because this could be something that's a game changer just in the realm of any kind of legal, in terms of, you know, if you're putting the polygraph off the chart and putting this in there, then it also goes into human resources. It goes into all sorts of technologies that we will soon find antiquated as a result of this new product. Todd Mickelson is here and he is with the company Converis. Is it Converis or Converis? It's Converis. Okay. Yes. All right. Todd, first your background. What do you do and what is this product? So I am an entrepreneur. I've been involved in several startup companies, mostly in the high-tech area over the last 30 years. And this is the latest company that I've been involved in. I'm the CEO and we saw a great opportunity to take some science that came out of the University of Utah by the same professors that digitized or computerized the polygraph in 1992. They began research in this area of alternative ways to detect if someone is being deceptive or if someone is lying. They were seeking something that is non-intrusive, something that's accurate, something that's immediate, something that's non-biased. In essence, an alternative way to detect if someone is being deceptive. And what they found is the eyes are, in fact, the windows to the soul by analyzing changes that occur in your eyes as you answer a series of questions presented to you on a computer. We can detect with a high degree of accuracy if you're being deceptive about the answers to the items that are presented to you.  So that's like a coin flip, 50-50. That's correct. There are a lot of individuals who presume that they can tell if someone is lying based on their facial expressions, based on their mannerisms. Do they look up or right or look down to the lower left as they answer a question? The science and the studies that have been done on that type of approach indicates that on average, people are only 50% to 54% accurate in terms of determining if someone is lying in that situation. The exception would be a parent or a spouse perhaps who really knows the individual and can detect those tales. What we do is we analyze changes using an infrared camera in the eyes that you can't see with the naked eye. And it's based on the premise that when we lie, it takes more mental effort, more cognitive load, if you will, to tell a lie than to tell the truth.  It's exhibited by them dilating up to a tenth of a millimeter. So once again, something you can't see with the naked eye, but with an infrared camera and eye tracker that's capturing these minute changes up to a hundredth of a millimeter at 60 times per second using a computer algorithm we can detect. We can first of all capture those minute changes during the course of presenting a series of simple questions to the individual on the computer screen. And then we can analyze that data that's captured instantaneously with an algorithm that tells us with 86% accuracy or more whether or not the person is being deceptive about that topic. And how does that compare with a polygraph? So the polygraph has a range primarily because with a polygraph you have a human being that is presenting the items and analyzing the results. In the case of a really broad set of questions like what would be presented in a pre-employment screening test on topics such as, you know, have you used illegal drugs say in the last five years? Those are referred to as screening exams and the published results from the American Polygraph Association indicates that the accuracy is between 72% and 82% for a screening exam for a specific incident exam or an investigation. Something that is more specific like were you at the scene of the crime when it occurred? That range is anywhere from 80% to 90% accurate. So we're 86% accurate across the board and it's consistent. We don't have any inconclusives. So that's another difference in the case of the polygraph. They have up to 15% of the tests that are given that come back as inconclusive where there just isn't enough data to make a decision one way or the other. In all of our tests that we have performed in the field and in the lab to verify what our accuracy is we make a determination one way or the other in all cases. Okay, so if somebody comes back and says, but it didn't work, it malfunctioned.  These tools measure physiological changes against the baseline and in some cases for one reason or another that we can't explain. Some people react physiologically different than others and that's why they're not 100%. They really should be utilized as a data point for making a decision as opposed to a definitive decision upon which you take action. So, you know, we don't get it right every time but it certainly is a data point and we believe it's more consistent and it's more fair because it's in essence a sensor that captures the data and then a computerized algorithm that determines whether the person is credible or deceptive. Okay, and the reason I find this so fascinating is because this is probably, you know, a template for future types of tech that will give us a lot more information about our world than we have had available prior to these types of programs but this is a game changer. It's a real game changer. I've got to take a break but we're going to come back with Todd Nicholson who's talking about Converis and the product that we're talking about is eye detect but there's another one called identity detect. All right, and we're going to get into that too and find out for one thing, you know, what situation you would be facing if you had to take one of these little tests and what, you know, what that might reveal all across, I guess, our government, our human resources and just general basis of determining who you're going to hire for the next program, corporations. There are a lot of uses I can see with this. So, hang on, and again, Todd Nicholson, my guest, talking about the new AI using some form of computer program to determine whether or not you're lying or you're telling the truth. All right? Back next with more of that on Wendy's Coffee House, KCMO Talk Radio. KCMO Talk Radio. Hi here, I'm Wendy, my guest. We're getting into the truth of the situation. Truth or consequences? Truth or lies? Deception? Are there ways to get around these kinds of things when people, you know, you know, darn good and well, they are not telling the truth and you don't want to call them on it, but it's really obvious. And is there another way that you can do that gently and still forcefully enough to say, see ya, you know, and I'm not going to say the word, but you know, the BS detector, how's that? Well, there's a pro, actual product out now. Converis is the originator of this product. It's called iDetect. It is better than a lie detector, a polygraph, okay? A better lie detector than a polygraph. Maybe I should say it that way. My guest is Todd Mickelson and he's going to tell us about the product and more, there's another one called iDetect. These things are coming on the scene. They are being incorporated into current use, whether it's government or corporate or all across the globe. This is just the beginning and that's my view of it anyway because these things are so effective and they take the middleman, the human factor out of it by, you know, are you having a bad day at work? Did you read it wrong? Did you misplace the equipment? Did we have a lightning strike? That kind of stuff. Todd, this is, I think in so many ways, a real game changer in terms of getting, in corporate use or in government use, intelligence use, a product that will give you a very extremely accurate result when you're trying to figure out if somebody's telling a lie or telling the truth. I'm kind of frightened, to be honest. Maybe I don't want to answer these questions. Intimidated, how's that? You shouldn't be intimidated. Hopefully, you know, our goal in producing iDetect was to help protect countries, corporations and communities from corruption, fraud and threats. And those are the areas in which iDetect is being used today. We have over 400 customers across 40 countries running tens of thousands of these exams today. And I can just give you a few examples in each of those areas where iDetect is being used. First of all, to protect countries or us as people, we have some governments that are using iDetect to verify if people have ties to terrorism. Because it's a product that is consistent and computer-based, it can scale, it can be used on hundreds or thousands of people. Very quickly, the test is less than 30 minutes, and basically the person sits down in front of the computer where there's an infrared eye tracker, and they are presented with the same questions that they'd potentially be presented with in order to get a visa. Those questions would include things such as, do you have ties to terrorism? And with iDetect, within minutes after the test is completed, we can know whether or not the person potentially has ties to terrorism. It's an actual test that is being used today by some governments who are wary of people coming into their country that may have ties to terrorism. We have corporations and law enforcement here in the U.S. that use it for screening potential hires, so it is more of a pre-employment screening situation. What are they asking? They're asking whether or not, in the case of law enforcement, the individual has issues with illegal drugs whether they have specifically consumed illegal drugs in the last two years or last five years, depending on what the role is. They also will ask whether or not they have been involved in any serious crimes, crimes that would be characterized as a felony or a class A misdemeanor. And finally, where they have worked, where they have gone to school, and where they have lived. Things that go into doing a proper background check if they haven't been truthful about some of those pieces of information, then the background check won't be as effective.  So if somebody was to embellish on their little curriculum on their resume and say, well, I got a Ph.D., well, maybe not that high, but I went to a certain school that's better than another school and I finished the program or I also am fluent in certain other abilities. And then as they're talking and responding to those questions, you're going to know that doesn't match without even looking at the piece of paper. That's correct. Now, obviously, the tests need to be constructed in a way that there's clear differentiation in what you're asking. We all know that people lie or embellish their resume, for example. They may make it sound as though they were the key contributor on a given project that generated significant revenue for the organization. In reality, they were a member of the team, but they weren't the leader perhaps. Those kinds of things are hard to detect. And so we focus on more discrete things such as, you know, did you lie on your application specifically about where you went to school? Oh, lovely. What degree you received, where you lived, or where you have worked. And those are more cut-and-dry things that we can test on that the system will register properly. And we know with a high degree of accuracy if the person is lying. Now, the other thing that we didn't get into the intelligence that identity detect. Now, is that different than eye detect? It is, yeah. So eye detect uses an infrared camera, as I mentioned, to capture up to 60 measurements per second as someone is sitting in front of a computer answering these questions that are presented to them. And they're simple questions to which they answer true or false. Identity detect is a product that we designed that could be run in an online environment or via a mobile app specifically to verify if the person is who they purport to be. And as you can imagine, that scenario is more specific. It would apply in a situation where perhaps I'm getting set up with a financial institution with a bank account or with a means of transferring funds from one account to another. And it's really important that the organization confirm my identity. It may be a government organization that's interested in whether or not the person asking for a visa to travel to that country is in fact who they purport to be. And so the test needs to be, you know, no more than three minutes. In some cases, you know, as short as a minute. And it needs to be something that can be done over a standard web browser or a mobile app on a smartphone. And so we don't have an infrared camera that can track changes in the eyes. Rather, we capture subtle variations in their motor nervous system as they interact with either the app or the web browser to where they're entering the information. And much like our eyes change, when we lie, there are physiological changes in our motor nervous system that affects how we respond to a form that we're filling out when we're lying about the information that we're putting in that form or how we navigate a web page and click on various buttons to respond to a series of questions that are being presented to us. And it's those subtle variations that we capture. Okay, we're going to take a quick break. I'm going to come back in a minute. But the press release I saw, Identity Verification Technology by Converis only takes three minutes, okay? So maybe you can address that when we come back out. Because that's amazing. Amazing. It's that quick. Okay, so hang on. Again, we're talking about Converis and truth or lies or maybe consequences. Next on Wendy's Coffee House. Can we get what we deserve? KCMO, talk radio. Hi there, I'm Wendy and my guest who's with me talking about lies, deception, dishonesty and truth. And they've got a product that will figure this out very quickly with pretty much... I mean, this is really accurate. 80% or 86%, I'm sorry, for Converis, the eye detect. And that is just mind-boggling to see that this technology is... And I'm sure it's going to get even better as it continues. This has only been... This is pretty much relatively new, what, the last three or so years. It was released in 2015. But we're talking about the kinds of things it can be used for. And when I was looking at one of the press releases that came out earlier, that Identity Verification, this is a little different than the eye detect. The Identity Verification takes three minutes. I guess I should say, how does that change things now with the current arsenal of identity, whatever we have at our disposal, Identity Verification systems? Is that like a leaps and bound forward? Well, I think it is. There is a lot of challenges today with people's identity being stolen. And there are new technologies that have come out that help with some of that. Most of those technologies, however, don't address the core issue of, is this person really who they purport to be? So I can steal someone's password. It can even create a fake federal, ID that I present that has my picture on it, so it looks like me. And those kinds of things can be beaten. What we've done with Identity Detect is provide a way in which, in under three minutes, we can present either a series of questions to someone on a web browser or through a mobile app that they respond to that will help us to know with 90% accuracy or more whether or not that person is really who they purport to be. And imagine, if you will, coupling this capability with some of the other traditional methods. Organizations are now moving more towards biometrics using facial recognition, using fingerprinting, even an iris scan. Well, that biometrics is only as good as your ability to know from the get-go whether or not that person is who they purport to be. Because if you take their fingerprints and they're representing someone else, obviously those fingerprints are going to be validated each and every time that person presents him or herself. What you want to do is capture at the same time you capture the fingerprints whether or not they are who they purport to be and then couple those two concepts together so that you can then just use biometrics moving forward to verify that the person is who they purport to be. With this, unbiased, nobody's there. There's no middleman. Again, this is technology. This is all computerized. That's correct. There is no test proctor like you'd have with the ID Tech test to make sure the person is following instructions and sitting in front of the device. In this case, literally it is embedded in the workflow of your process. So if you're applying for a visa to enter the country and the government agency that is verifying your details, they can embed identity detect in the context of that visa application process and present you with a series of questions to verify if you really are who you purport to be. The same would be true for a banking transaction where today you may get a text message that comes back saying, did you just perform a given financial transaction and before the financial institution allows that to go through, they wait for confirmation back from you via text. Someone could have spoofed your phone, logged in as you, and be responding as you. Identity detect could be coupled with that capability where there's an additional step in the confirmation process and we present through that application a set of simple questions that you respond to or a form that you fill out and we capture your motor nervous system subtle differences as you're responding and we compare that against your baseline and can now in less than three minutes if it's a forms-based prompting then it's less than a minute whether you are who you purport to be. Okay, I'm assuming that this technology is basically improving as you begin to roll out these kinds of programs because I think identity detect was after the eye detect and do you see these things changing significantly in the next five or ten years? Absolutely, I mean on a monthly basis we come out with new capabilities and improvements in the accuracy as we run more and more tests and capture more data associated with real-world situations we can use machine learning to harness that data and improve the overall algorithms and the accuracy. Are you seeing people switch over now to eye detect versus a polygraph? Yes, in certain situations where organizations would really like to know if people are being deceptive but yet a polygraph is too intrusive you get hooked up to various cables if the exam is done properly it's a minimum of 90 minutes that just isn't feasible in some situations whereas eye detect is a non-intrusive presentation of items that people are used to responding to on a computer they're filling out a job application for example presenting a series of simple questions to you that are pertinent to the job and you simply respond by interacting with the software and while that's happening we capture it. I felt less intimidated when I was reading the list of things if I would be filling out topics related to bribes cybercrimes, drug trafficking and money laundering unauthorized transactions I think I can answer those questions That's correct It won't nail me on that I think in terms of game changers what you're talking about with this technology and coming online other things that will probably follow that very quickly I think you're going to be very popular So people do want to connect It's Converis, right? It is Converis.com Truth validated is a nice mantra That's really the goal We believe that with truth societies will be safer organizations will be more successful We're helping create an environment of trust and amongst our customers who have deployed iDetect in a broad way they've seen that to be the case They get different classes of applicants people who know that they're coming to work for an organization that rewards and cares about the integrity and trust of their employees and that has an effect overall on their success because studies that have been shown where there's fraud involved indicate that in 70% of the cases that fraud is associated with someone internally with an organization So if you can cut that out that plays a major role I appreciate you talking with me Thank you for your information Converis, truth validated, my guest Michelson, thank you


Yup, it's come to this. I don't really need this. I just didn't feel like putting product in my hair. Besides, it is phoned in Friday It's the sad liquor store in Glendale that just keeps on giving. Did you know quantro used to make more than just triple sec? It's true. They used to be kind of like bowls or to Kuiper. They made apricot brandy, creme de cacao, creme de mint Which regrettably brings me to this guy. I don't know how old this is. It may be from the 60s All I know is this label and what's inside both used to be green. Hope I don't die It's it used to be green. It's yellow now, which is unfortunate But I do love the way it looks swirling around the inside of the glass. This used to be premium stuff Kind of smells like alcoholic toothpaste, but for all I know that's the way it smelled when it was new It's a mid bomb for sure. It doesn't taste off, but the mid-flavor is a little overpowering Audrey do you want to try this? Quantro creme de mint When I first tasted this I was a super key and I'm making a cocktail with it But I think I might know just the thing to mix it with 12 seconds later That's right I made a stinger the classic turn of the century cocktail that your grandfather used to drink and yes I use that insanely good cast strength cognac from the other video. Let's try it. This is so boozy Yes, it's all booze. I know that the cognac really does a good job of punching through the intense mint flavors I can't say that they go especially well together. I probably won't make this drink ever again. Am I sorry. I made it Maybe a little probably doesn't help that. I've only had coffee to drink so far today. I'm a little jittery Audrey do you want to try this? Well, that's the start of my day if you liked it hit like consider subscribing if you haven't already and if there's something You think I should try it. Let me know in the comments stay safe all device professionals and seriously Thank you for watching my videos. Thank you for commenting and liking and sharing them with your friends It means the world to me. Josh get out. Yeah, never again


Can everyone hear me okay? Am I loud enough this morning? Do you want me to use the other mic or everyone can hear? Excellent. All right using WordPress API for some people. I hope this doesn't go over your head I'm trying to make sure that I'm speaking to everybody in a way that you can understand the real benefit of using the WordPress API to sync an app Now a little bit about who I am. I have a website Divi framework. I've been making some plugins and stuff It's kind of in beta. It's not really ready yet, but take a look at it. Follow us on Twitter I have MRK websites or MRK development any of those around You know Twitter Instagram LinkedIn all that kind of stuff. That's where you'll find me In this shot. I was actually shooting a screencast tutorial in the rainforest Because why not? so the great thing is is with the internet and stuff you can work anywhere and WordPress gives us so much freedom Gives us the freedom to do a lot of different things. So what do I do? Will I do training? Me and my wife have actually been traveling around Australia in a Winnebago Being paid to train a large Australian corporations offices It's pretty cool And we still run our business by using WordPress the internet and our wonderful MacBooks So by doing all of that we have really found that we love doing training Also make websites, of course WordPress all that kind of stuff love my Ionic stuff angular, you know all those different things. I really love geeking out on all that kind of thing And particularly I've been enjoying VR stuff lately VR video VR photos, you know and incorporating that into the web It's all pretty interesting stuff So why do we use WordPress? Well because it's free But it's not just because it's free. It's because it gives us freedom to build so many different things You think about it. Where would we all be without WordPress? You know, you would have had to have paid for some proprietary code You would have had to spend a lot of money You might have had to develop something on your own for a long time But the wonderful thing that we have with WordPress is it's free and we all contribute to this stuff all the time And it's fantastic There's also lots of users and lots of developers Which means that most of time if you can't fix something somebody else has already fixed it and I love that Simpsons episode where Homer is at the bar. He's talking at Ma when he says can't someone else do it? And like that's your term. That's what you should say. That's your pitch to run for Office and he everyone starts marching around and can't someone else do it? And the great thing with WordPress is most of the time when you guys go to do something Someone else has already done it and that's awesome. I love that because ultimately we're a little bit lazy sometimes So where are we going? then Kate well, we're just continuing to travel around and enjoy ourselves and Continue to make great things But as today, where are we going? Well, we're going to be talking about the rest API particularly in WordPress So what is the rest API? It's a way to get data out of your WordPress site in an easy to consume way for a lot of apps So normally all your data is in a web page, isn't it? And it's nice and well displayed for us to look at it But with the rest API Computers don't really want to pull in your nicely styled HTML and try and pass it and turn it into something for an app They want to be able to get the data and nice little controlling structures It's so that they understand what it is so they can do something with it Okay, so you can get like a list of users you can get a list of blog posts You can get all your different posts actually in a very simple list in an easy way for your application to deal with it That's basically what the rest API allows us to do So when do you use and should you consider making a native app? See everyone got really excited in the early days about apps didn't they and every business just was like I've got to be in the store and get an app and there was apps for a dentist There was apps for the hairdresser There was apps for all sorts of businesses that really weren't appropriate for apps So when should you consider building an app? Well, first of all How often does anybody here install a new app on your phone and actually use it regularly adopt the usage? Doesn't happen very often. Does it? We'll adopt websites a lot though So if you're trying to reach a new audience an app is probably not the way to do it because You have to get them to install the app So you still need a great website you still need web content and unless you're gonna do something I think that's actually stepping up above the content and that functionality of a website. Why would you need to make an app? You don't So the way I like to think about it is there's really two use cases of when you need to make an app The first is when you have a community of people and you want to get something in the way of that regular relationship Regular relationship is something like a school and that's the one I'm showing you today You see those parents have a daily relationship. Don't they with the school? they're dropping their kids off all the time and quite often there's communication issues because we all know that kids quite often don't Deliver the notes home to mum and dad right and There's you can't trust a five-year-old to be your communication channel As a private school when that private school might be charging thousands of dollars a term To be able to you know teach that student So it's really important in this case to have the app to help assist with that communication Okay Really good use case of an app another good use case is when you can't actually deliver what you want to deliver Properly on the web so another one. I'm gonna talk a little bit about today is a VR app that we're starting to develop Now we can't deliver the 4k VR video over the web API because it keeps dropping frames and a lot of things Just can't handle it But if you happen to know what an Oculus is or a HTC Vive VR headset They're excellent at dealing with this high-level video. So we're using the WordPress API to deliver that to a desktop app in this case So we can deliver the very high quality video to those devices that can make the most of it And these videos are kind of around 250 to 500 megabyte 250 to 500 megabytes here a minute All right, so you have a four minute video you got two gigs It's a big video Even my MacBook Pro can't play it. So that's a that's a Good advantage there. So the advantage of the local installation is I can use local stuff I can use those local features. Okay Really good use case of the rest API with apps There's also some bad things as well. It's not all rainbows and twizzlers it's There's issues isn't there What are the issues? Well, first of all, I've got to manage an app. I've got to deal with the app store I've got to deal with app updates deal with platform updates got to deal with debugging and testing and when that comes to Android That's pretty hard. There's a lot of different Android devices out there. It's getting easier But there's some disadvantages in that case because managing apps is not easy Okay, it's another bunch of skills that you have to add in there There's another bunch of expenses that you add into your build So, you know, you have to really consider Strongly if you want to go down this path Okay, you've got to really take a strong consideration before you pick an app But if you've got a real reason to get in that relationship if you've got a real reason to deliver that content Then I think it's well worth considering the rest API for delivering that information So our first case study today is the parks Christian school now the parks Christian school we've been making their website for years and They wanted to get an app for one very simple reason where I am in parks It doesn't take long out of town before you get very patchy internet And what we're finding is our emailing out this giant printable PDF to everybody. That's their newsletter And that didn't really work real good because it took ages for the parents to download it And that means they weren't reading it because they just simply couldn't download it. It just took too long Because I've got patchy internet So we started on HTML emails But then a lot of these parents weren't actually reading their email very often They just go into it once a week because they have to load up the internet and it was painful for them to do so So we created up and the app sits on the phones and synchronizes down It gives us the ability to deliver this content to Those parents and synchronize it. Okay This means that we can send the instant notifications. We can do calendar integration and things like that and that's all inside this app So when we add an event to the CMS in WordPress, it's instantly added to the app Inside the app I can then add it to my calendar with a native button So that if it's important for myself Because my students involved in that particular event. It's just a simple click of the button and it's added in That's pretty cool The great thing is that we also caches So every single time we pull that data down and there and McDonald's having a coffee. They're on the free Wi-Fi and they get it It stays in the app Okay, that means when they're out on the farm, they're in an area where the internet's slow It doesn't matter anymore. They've got the cache data held inside the app, but I'll show you that code shortly To build it we used ionic version 2 at the time it was beta, but I liked it so we used it anyway and We just fixed the bugs as we found them and submitted patch things and there's nothing wrong with using beta software if you test it for Use case right and it's open source. So if you guys find bugs in beta code Well, it's a good idea to tell someone about it and submit a patch So that's what we did It's got fantastic scaffolding tools and it's very simple ionic version 2 what I really liked about it It's sometimes when you build things you end up with what we call spaghetti code You'll stuff all over the place and very quickly it gets a little bit out of hand and you're a bit like What happens if I pull this and before you know what a meatball falls off that way? You know, oh, I better not pull that I'll pull this thing and nothing happens at all, you know And you realize there was no dependency on that thing at all You don't even know why it's there But you end up with some real messy code But I want it version 2 gives us some real neat setups And it has these scaffolding tools as well so that you can really just say hey Create me a new page with a controller and that kind of stuff almost like how we make post types I guess in WordPress with the CLI tools You know you make a new post type and what happens in the WordPress backend you get a new menu, don't you? You get the read and update areas you get categories and things like that So this is very similar as what we're doing here in Ionic and we mapped them up So we pull the data in can we read that? It's a bit too small or All right, but basically this code kind of does everything and We just we construct a URL here to get to the data So let's take a look at this a little bit more carefully. Which buttons the start one is it? There we go, right? So we've got the host so this is just coded in our app because we're using proxies when we developed it But that's just the parks Christian school WP Jason is what we the data that we want and we want all the posts of a type And a page number So this one here will give us if I put Post in there post type post or post type page or post type event. You get a different type of item, don't you? So if I want all my events just shove event in this post type and you construct in class So this page is just page one. Give me the first page of my events and I'll get my data out And basically this is our local storage So here what I've done is I'm getting a couple of different bits and pieces of code if you guys want me to do more Code as well can show you the actual project Do you want me to do that or who wants to look? All right, there's a few okay. We'll open that up. All right So we've got basically a mapping here some HTTP. We grab the local storage and bang. I just load it We get the post type get all the data and we load it It Looks pretty simple to me. I Hope you guys kind of find it simple Okay, so this is what I was talking about see how we've got our pages here on the left hand side So just here. There's all my pages Inside the app So I've got events FAQ news, etc So if we open up the news and look at the HTML here We can see this is using something that kind of looks a little bit like short codes doesn't it can I zoom that I don't normally have to Zoom my code so Yeah, that's right. So here what we're doing is we're taking Our content I've got a refresher button here to refresh it I've got a card and for all the items that I get out of that request that I showed you earlier I'll just loop through them and this just maps up. So it's very similar to looping over posts, isn't it? And you can see that all this is really nice because these are all components They're a bit like short codes when you have a short code. Everyone here know what a short code is So should the short codes? Yep. So you put parameters in a short code Don't you when you get a much more complex thing than the code you had to write it's shorthand And this is very similar But these are called directives in Angular and this is what we did to create these items And then we have an infinite scroll component at the bottom here and that does all our scrolling for us So that's pretty much it Now this got created Almost for us. We've got some scssc That's complicated Didn't have to do anything didn't have to style anything. It just kind of does it and This is what we call type script Type script is a way of writing our JavaScript that gives us types Okay, so normally one of the problems with JavaScript is if I send In an object and it's a number and I do the wrong thing with it All of a sudden it turns into a string and I do one plus one and it equals eleven instead of two All right, because you didn't have a type You didn't say this is always a number or this is always a string Now in some cases you do want one plus one to equal eleven in other cases You want it to equal to and in that case what you do is you define how that operates by giving it a type Okay, so here what we've done We've imported our Angular core component I've got my controller the provider is what actually provides the data I've got my date display pipe and that's a tool that we're using to format the dates Okay, so pipe is kind of like hey I want to put one thing in one end and get it out the other format and so you throw it through a pipe They call it an Ionic I've got my data in the page and of course I got my Google analytics item to track the analytics and All I really do then is just grab my component get the template URL tell it the provider tell it the pipe Man it kind of just all works like magic really It's really cool It actually didn't take as long to build this app. It was about three days From start to finish to build the whole app. I mean that's cool and it's very easy to find something So it's like oh, I've got a problem with my news provider. We'll just open it. There it is right there That's it That does all the magic of dealing with the rest API for me It's just that I mean that's just so easy It's amazing. So really all we do is just pull in a couple of components Grab the path to the rest API and all the data. It's given to me pretty simple For a lot of guys you're probably looking at this code going. Yeah, that looks simple, but I don't know how to write that well I'll put a post up on my website and give you guys the code if you want just take a look at it I mean, it's it's not that much rocket science. Ionic is very simple to use and Yeah, we've we found it to be great for us It's saved us so much time So were there any real challenges with this app? There were of course the big one was that we're in a beta setup at the time Ionic version 2 is now stable. So all those problems that we had are gone It was really just finding out how to do things because it was very early on in the development of Ionic version 2 It just meant that you know, it took us a while to find some documentation and out of the three days of development We probably spent one day researching Just trying to find stuff that other people had written and I'm terrible at writing blog posts and things like that and putting stuff out there I need to do more of it to share this kind of stuff Because once we share it all of a sudden it becomes so much more valuable to everybody This app had a certain amount of value But if I share it to you guys it actually becomes more valuable Because people can use that information can't they it goes beyond just these people at the past Christian school using it So where do I want to go with it in the future? At the moment, we don't have an automatic instant notification I'd love it if when you post something to the news on WordPress that you could put a flag on it and say Send an instant notification about this. It's important We don't currently have that so we have to go into another app to send the instant notifications It's a bit of a pain and I'd like to fix that The other thing I want to do is add some classifications from the API to notifications So for example, you could say all right, I've got a kid in Kindergarten, and I've got a kid in year six send me the notifications for those class use All right, so you just say I've got an enrollment year of this and an enrollment year of that there we go That's the student right there That needs to get those notifications so that you can send something to the parents say remind are there's a special assembly on for The year six kids this morning at 10 30 and they're all gonna sing something and do something cute And then the parents don't miss it right The engagement stats need to be improved a little bit We're just doing some simple stuff like you saw that simple little controller I did with Google Analytics just checking the views But I'd like to actually know what people are pressing and just a few more event hooks You know like people actually adding stuff to their calendar or not We don't really know Because we're not tracking it so I'd like to add those things in the other thing I'd like to do is make a login for the teachers to be able to send instant notifications to those groups So mr. Westcott comes along logs in and can send a notification to all the primary school kids parents Just bang, you know, that'd be great But the way it stands right now you can't do that and out of all of that it'll ultimately drive more engagement with the app So the next one I want to talk about is farm VR. You can take a look at this website We've integrated some nice VR stuff in there. It's still a work in progress We expect this to be launched in about four weeks time Tim I took that photo for him. That's near the dish in parks If anyone knows where parks is we've got a big satellite dish there And this is just on the road in a sorghum paddock there took this photo about four five six weeks ago something like that So why do we need an app for high res VR content? So we're going to be making a desktop app in this case and pulling the data in we're going to be using ionic again Everything I showed you before we're just going to take that stuff Throw it in there and get the data out. But what we do with that data is going to be different So we've created a custom post type in the website and this post type allows us to have different resolution videos All right, so I can set up four videos for one video that I'm actually going to deliver one will be the 4k Full higher res VR video that when you put it on the HTC Vive honestly like it's like you're actually there It's amazing We've shot some stuff and you put the headset on it. Just it's just phenomenal like you literally feel like you're there I did one where I walked out on the cliffs off Phillip Island Up onto the with the the sea all the waves were coming in and you know birds flying overhead and oh Gee, it's amazing. It was just absolutely amazing stuff. It blew my mind Got me really excited about the VR stuff So we're gonna pull those high res videos into the desktop only if you're on the website You'll be able to download it But there's no point is even trying to play it because even on my MacBook Pro here with a 2 gigabyte graphics card It drops frames. I can't handle it It's too much if I actually watch these videos on my Samsung gear and the Oculus headset I can watch it for about 10 minutes. Then I've got to put it in the fridge to cool it down Literally I actually put the phone in the fridge Right, it's not an exaggeration. That's what I do because you have to cool it down So you got to put it in the fridge for about 10 minutes watch for 10 minutes Put it back in the fridge for 10 minutes to manage the temperature of the thing Right, it's full-on video. It's great fun though Right, so we're gonna do these vibe apps and then possible mobile apps in the future for the Samsung VR store So we're gonna use the electron desktop toolkit for this Is anybody here use the atom editor? Yep, that's electron anyone here use slack Yep, that's electron Right, so electron is a way that we can use HTML to make desktop apps pretty awesome stuff, right? I Think it's amazing So we're gonna be using that and use the same ionic stuff the same everything suck it all in bang We've got a desktop app for Vive all those videos will download in a queue suck out of the Amazon cloud and download Onto your device and then you can experience these great videos that otherwise we can't deliver on the web right now So we can't actually deliver this content on the web. It's not possible You just can't handle it the thing just just just you know unless you want to cook eggs on your laptop There's no real point in trying to do this But it works great if you've got a vibe and a liquid cool desktop with all that stuff. It really does So I'm gonna pull the data in then we store it locally But in this case, we're not really talking about storing HTML data or JSON data was talking about storing the actual large downloaded files So it's really just going to be a download manager, right? It's not like you're going to go into this app and actually experience all the farming stuff It'll just be really download lists, you know So when will it be released we're actually aiming for around the first week of April and we expect this to come out so keep an eye on farm VR dot com dot au you can take a look at it now and You know, that'll be great. Now the thing is right now. I haven't actually told you anything that's real synchronization. Have I? Because we're pulling data in We're syncing it locally from the cloud, but we're not actually ever pushing anything up. Are we? See when you want to do that a couple other issues come out and I thought I'd just share those how am I doing for time guys? Well 15 cool. All right, this will take about five minutes and then we can do some questions so first of all right now With WordPress the authentication for a native app Is not ideal We rely a lot on cookies for authentication right now with WordPress And as a result if you're on page and you want to do editing and to do apps and things like that with like angular or view JS or Something you can use these JavaScript libraries to because you can log in Check your cookie that you logged in and then pull the permissions out of WordPress to be able to do things with the API But when you're on a mobile app, where are you going to put the cookie? You don't have them do you don't have like a same session state? So normally what we do is we have what we call an authentication protocol It's an agreement a way of operating your authentication Now at the moment there are some plugins for WordPress that can do this But they're not really core tools that you can use reliably Okay, so that the problem with this is you might end up having an authentication plug-in You might get your app going and WordPress might update Which you want to update because there is a major security flaw and your app will break and Then you've got to submit something to the App Store and Apple is notorious for being really fast Getting you in the app store. No as a matter of fact it takes a while sometimes you're talking two weeks So your app could be not working and not allowing people to log in and use it And if you've got in the way and manage to successfully get in one of those Relationships and all of a sudden your app stops working for two weeks Who here would keep an app on their phone and keep trying for two weeks? To try and reuse it again. You wouldn't would you you just go?  I want to send you the bill to get the hells of my life back Things like that because hey users sometimes we get like that. We're just impatient and well we feel horrified This thing doesn't work But now that happens the good news is is rest and and the API is going to be getting some Oh off 2.0 So all of 2.0 is the easiest way to deal with your authentication Okay, we that's what we want and I found out we're going to get it Which is fantastic So I don't know how long that is away But once I was too becomes part of WordPress all of a sudden this synchronization stuff is going to become possible So let's talk about syncing data now. So WordPress and has one Powerful flaw. It's the thing that makes it powerful that actually gives it this flaw and that is post We extend post types all the time This is what sometimes gives us problems with Divi websites Because it uses posts a lot to extend and do things. It's all extending posts, you know We're commerce. It's the same thing, isn't it? We extend posts to all these things like variants and product types and things and all of a sudden We have this one table in our database that's getting hit a lot To deal with just about everything in our website So the post table is Powerful it allows us to do a lot of things, but it's also a weakness when it comes to dealing with the data So let's think about what we're going to do here. We want to pull down some data and synchronize now Let's say I've got a to-do list I've got my list of items on my to-do list and I created to-do list on my mobile app But I don't have connection to the internet What ID do I give that item? I don't know what it is on the WordPress app I've got 10,000 users creating to-do items How do I know what ID it is? I don't but I've got to give it something to make it relate to that list and to be able To be usable in my app. So I'll give it a temporary ID or give it a local ID Then I get my internet connection back and it has to synchronize that item with the cloud because now I want To be able to log in on my website To do with my to-do list because I'm at work. See I was on the train adding to-do list items. I'm in a tunnel No internet Get to work. That's got to have synchronized somehow in there and still have all the relationships that I set on my device So what do I do? There's two ways you can do with this But they all really deal with a lot of code. The first one is you have a local ID and a remote ID Does that make sense? I have an ID locally That just relates to your app on your phone But then when it pushes it into the cloud it gets an extra ID, which is the post ID Okay, and then you update it that way By synchronizing the two that gets really messy when you have lots of different content The second way to deal with it is you have a temporary ID and then when you update it You get the ID out of the WordPress cloud Out of the REST API give it back to you and you update the IDs The problem with this is if you have lots of related data all your relationships break and you have to have special cascading queries and The local databases in apps aren't very good at doing that You know so you end up on a right all this code just trying to deal with synchronizing quite simple objects and In my opinion WordPress is probably not the best tool to use for this Okay, if you've got things with this two-way sync going on a lot I wouldn't pick WordPress to build that kind of stuff I'd pick something that's specifically made for dealing with API's Specifically for mobile apps with libraries that help you do this One day it might be able to do this really well, but for now I would probably be considering other tools. Okay That's it. Thank you very much. I hope it didn't bore you for this morning And I hope you guys learned a little bit of something about how to do this as I say Follow my website and things and I'll put up some code links later today So you guys can get access to that code and if there's any questions fire away Oh one other thing as well the only stupid thing to do a question time is not ask a question So please just ask Yes Yep Yeah, it does We don't go over about 10 megabytes Yeah There's about 20 items in there in each area because the thing is we're storing JSON data It's very light. So when we pull the rest API what happens that pool of data that we get We just store it as exactly the same file format So then we didn't have to have any interpreters. So the thing is if we created it and put it in a database We would have to make a layer then to say Pull this thing from the rest API Then put it into the database Then pull it out whereas if instead all I do is I grab the item and every time just shove the file off to the side Then if I go out to the cloud and at times out all I do is say instead return this local packet of data Yes, we do so as the image comes down it runs through a case for again shoves it to a local one That's why we had that URL as a parameter and what we do is we change the URL to a local URL instead We save the file as a full query string or as a file name and this then means that as it pulls it down We just save it in it as a text cache basically as a local storage text cache. Yeah Does that make sense? Yeah, we found that to be really easy actually Yeah Like This is exactly right one command. Yep, you just pull the libraries in so there's anyone here used npm libraries like no Do anything like that go pull these sorts of things same sort of stuff. All I do is say ionic publish Android I get an Android app. I haven't used react native. Unfortunately I Likeed angular views for a long time. So for me moving over to react wasn't worth the investment in this particular app usage scenario so Well, I would say react is not a framework as much as it is a library Ionic is a framework. This means that everything you need in the framework is already there You don't whereas react your pool libraries in right from all over the place Angler and I on a frameworks So I don't need to go and find something to run my SCSS. I don't need to find something to do my type scripting I don't need to find other libraries everything's all built into the one thing with the commands and the tools to do it and I Personally prefer the framework approach when it came to the apps Although I really liked the look of react for You know using as an extra library and things like the WordPress backend. That's a great usage of it It's a library in that case that makes sense Yep Yeah, sure. All right divi framework.com. We've really enjoyed Divi We found it very very easy for our customers to do things, but we found it had a few minor weaknesses So what we did is fixed them and made plugins So we've got things like a breadcrumb module, right? We all like using Yoast SEO when the breadcrumbs so we made a breadcrumb module that does that and then we like using advanced custom fields So we made a tool for our post types that makes it real easy to use Divi to lay out the detail page And as we started building all this stuff, we're like, hey people might want to use this too other people might actually buy it Let's test that out and we'll make Divi framework.com So we've just been converting all our plugins to the point that they can be purchasable and usable We've got all the API is already working all our plugins are used on about 50 different websites now And they're getting very stable. So we really just need to pull our finger out and get our documentation done Don't we? Yeah, we've got a knowledge base layouts pre-made layouts for things Yeah, all sorts of stuff different types of posts for FAQ modules Just all sorts. Yeah, everything we kind of made for all our customers. We've just started to turn them into products Appsellerator was one of the big ones one of the things we wanted to make sure we're gonna use is Skills that we already had we've got a lot of JavaScript developers We didn't want to go and start writing Java and Objective C, right? So you're right that means you have to write the app twice So we looked at that other dot net thing as well. I can't remember what it's called now There's like a dot net library so we were looking at things that where you write the code once and it renders out multiple times So we looked at Appsellerator phone gap Ionic and when I was using Ionic I found Ionic version 2 and I just fell in love with it. It was just easy and elegant. So that's how I came up with that solution We've done apps for Appsellerator though. If you look at my portfolio the live video streaming I did for Vans and Billabong they were all done in Appsellerator titanium What sorry Yeah, okay, no, let's have to take a look at it. Yeah Yeah using native Yeah, Accelerator is the same it goes through a bridge to a native Yeah Yeah, same as Appsellerator actually that so the great thing for you guys is think about this when you build an app with phone Gap quite often everything that you're looking at is actually HTML. It's in the browser But it's just wrapped inside the app Some of these newer tools what they use is the actual native components. So instead of using a HTML button It's HTML. It's a real button That's taken out of the native environment and as a result you get faster apps by doing that and some of the new JavaScript things They go through a bridge interpreter So you end up with the JavaScript on one side and it runs through a bridge interpreter So I think what do we do it do it use a bridge for to join two areas So when you throw the code through the bridge it comes through the bridge and at the other end all those things are mapped to native components and They turn them into native views instead So if you want to do things I don't know if anybody knows about the Android stuff where you can now view the Android app without installing it. Have you seen that? So you can now use Android apps without having to install them So you can Google something come up and say oh, yeah, that looks cool This is the thing on a store you click it and you can actually use parts of the app And just download just the parts of the app that you need natively to maybe do a check out And then you can use things like Android pay and all this sort of stuff, right because you got the native environment there Now these kinds of tools use the bridging to get there And if you use bridging you can do that because you can make partials of your Android app I don't mean you don't even have to install it People can use it up without installing it It's going to be a massive breakthrough for Android because let's face it It takes us quite a lot to go and install an app But if we can use it before we install it well, that's really something and for people with low bandwidth usages That's really big too So you can check that out. That was at Google 2016 at the next Yes No, we're not using Firebase. Firebase wasn't released when we released this This app's already 18 months old or something Yeah Yeah Yeah Yeah, I think we'll take a look at that when we come to redeveloping But yeah, I think that's a good idea And there's a question up the back as well For VR For farm VR, we use if you look at the little eye in the corner of the VR images, click it It takes you through to the component that I use I use the Google web VR HTML components and someone turned it into a shortcode And I built a Divi component on top of that So that we can easily just like you basically just drag and drop the box Click it and that's available on the Divi framework website as well The VR tools The other one we use is Flow Player and we're looking at using Flow Player So we can do video playlists Flow Player has a VR playlist And just before we left Vimeo released 360 videos on Vimeo So we're now considering maybe using Vimeo instead of the flowplayer.org VR tool Because we don't have to pay for it Flow Player, you've got to pay for it, right? Yeah Why are you using any third party or program-based authentication around that at the moment? We made our own OWLTH 1.0a And then we didn't like it So we then built our own REST 1 about two years ago With OWLTH 2 And we actually used to use that for an app that I've since discontinued called Mockup App And it was a way to be able to take screenshots and load them into devices So if I wanted a shot, if someone sat here on their laptop with my screenshot in it You could upload the screenshot and do that So it would mock that up for you It was pretty cool, but it just didn't take off And I'm not very good at marketing or advertising, really So it just didn't really work But what we did with that is I wanted to have people pay on a WooCommerce site So I could do all of that and authenticate with the app that way And we had an OWLTH 2.0 integration to do that And to deliver the permissions to the app that was written in Laravel With various Angular stuff to create all the views using Canvas stuff Then we threw that whole Canvas object at the server It would render out the big nice images for us It was pretty cool for a nerd But obviously the end customers just didn't think it was worth paying for And just one of those experiments So we baked our own in that case And I've really just been waiting for the native stuff I should probably pull my finger out and help you guys a bit But I'm a little bit busy travelling around doing other stuff So alright, I guess that's it for now, Ralph If anyone wants to ask anything else, please ask me outside Thank you


All right, settling down. So the good news is that you only have to listen to me for a few more seconds applause So please welcome Eric and he'll be talking about the blame game or the Strangeness around security compliance like this. Yes, okay Slightly scary this so, yeah welcome the talk was supposed to be the absurdities of Compliance free best in the secos the absurdities of security compliance. This is shorter. It fit on the slide Does this even work of course not Yeah, I found it also it needs to be in range or something Why sort of this is very weird, okay? It's infrared, right? Okay, cool. Yeah, yeah Away with you.  So might say something about that Our approach and the tools we use I'm not going to spend too much time on that because I have no idea what I Could possibly be telling you guys, but we'll find out and then some ideas some Advice for the future if you end up in this situation I'm here because I've been used for using free BST since early 2000s privately mostly Ever since I remote upgraded my slack wear to free BST. That was all sorts of fun. I was bored at work I absolutely love open source especially our variety of it The type of help I'm getting from the community in my daily work is incredible. I absolutely love it I was I landed in the payment industry in 2003. I had no idea where I was going to was pure coincidence Incredibly steep learning curve When it comes to the security requirements, it was truly Wild West from my perspective in the beginning and I'd like to try and show how it's become a little bit Westworld. I'm not sure I'm succeeding idea being Someone thinks they're in control now But when they lose it, it's gonna blow up bad, but that's for another time And I've been speaking about this for years mostly over beers to people who probably didn't care So let's see how this works out Modern my company has been doing in-house developed software and hosted it on free BST since around 2003 All my fault When you're shopping online And you're asked to authenticate in some way or other Here in Norway, it would typically be using bank ID. There's national ID schemes you will have similar things in other countries or simple boring stuff like a password or an OTP sent to you by SMS something like that That typically hits us or one of our competitors because what we do is we help the banks Authenticate you as card holders during the payment process We make software for everyone involved in a payment process the banks on one side Then you have the merchants and processors like Amazon and PayPal on the other side of the pond And then you have the card companies in the middle trying to keep control of everything This particular protocol that allows this to happen is called 3d secure some of you might have heard of it It's also known as verified by VISA Mastercard secure code back in the day. They all change names now And Sorry, yeah, so the whole idea is to let the banks Intercept the payment process so that they can make sure that you're allowed to use whichever card you're currently trying to use when you when you pay The banks will sell it to you guys as card holders as Secure for your security. It really has nothing to do with that. This is all about shifting blame elsewhere Someone did something absolutely brilliant back in the day. Sorry. I went too fast here there When this protocol was implemented They gave all the web shops all the merchants out there a huge carrot if they even tried to make use of this protocol They would automatically lose 90% of the risk with online transactions Which meant that all these risks that had traditionally been on the merchants was shifted to the banks So the banks had to you know Scrambled to him to implement some sort of authentication and not all of them were able to do that But they can choose freely how to do this Which is why we have some really crazy authentication schemes out there including please wait Operator from the bank is going to call you And then you have to wait until you get that phone call and then they will ask you Okay, what are you up to and then they might allow your transaction or not? That's quite common in the US At least it used to be and now we have this beautiful new PSD payment service directive to in Europe Which means that they have to implement strong authentication not going to spend time on that but it's a good thing finally and They're nowadays trying to use to risk look at your payment history and all that stuff to figure out if this is even necessary, but Too much about that This is what we do I Have spent too much time comparing myself to you know doctors who save lives and that sort of thing, but that's what we do So sorry about that In the online payments worlds that I'm exposed to You have these three players you have the guys who decide how we are supposed to do things then you have Pretty much everyone trying to cover their asses in somewhere or other usually by pointing fingers and then it's us You know we're like at the bottom of the food chain is when when all the blame has been shifted somewhere It finds its way to us somehow I said in my abstract that we prefer to be there That's probably because we haven't been hit really hard yet. I might change my mind about that But so far at least it means we can own our own mistakes So that is the one nice thing about it We have a whole bunch of security requirements that apply to us the most important one that Some of you or many of you might have heard of is the PCI DSS Payment card industry data security standard It is supposed to cover all the payment industries including this hotel and us and any merchant online anyone handling card numbers There are so many exceptions to that that it's not even funny, but we're subject to that one and it has a Sort of a sibling called the 3ds as in the 3d secure specific requirements Then we have the different payment schemes visa mastercard and the others They have their own idea of how things should be done then we have legal requirements. That's It's always been there, but it's only recently been enforced in any meaningful way. So we're actually somewhat grateful for that it Helps a bit and then every customer again, they need to cover their asses So they might have to make it look like they're inventing some sort of requirements that we have to follow So that we have done something wrong when shit hits the fan So yeah the Wild West that's a While ago so no relevant security requirements that were being enforced Maybe except in the US, but not even really there. It was just everyone did whatever they wanted There were so many cases of fraud and fallout of various kinds. It's like It's like violence and theft and stuff back in the day You didn't hear about it because you know no Twitter Back then you had all this stuff, but it didn't usually make it to the news because online shopping was still kind of tiny But I haven't I don't have the numbers But I'm pretty sure that a larger percentage of transactions were fraudulent back then than they are now a huge by a huge margin server on the desk The industry was literally shit scared about that and there were so many of them I mean, I've been in a company where we had servers under people's desk it doubled as a developer workstation So yeah, and then you have the you know all the receipt stacks in shops in hotels You know you have this receipt stuck on a pin With full card data or even they ask you to write down your card number expiry date and this code on the back The so-called password that they come up with it's It's absolutely crazy and crypto really who has time for that as in CPU time really so We got some requirements PCI DSS was an attempt to have a coherent approach to all this But it's dank. It was Again lots of Kobe paste and Basically, none of the auditors had really any idea about this, but they were well paid So they were ticking boxes for you So called qualified auditors, they were popping up everywhere Some of them were you know in the business for three or four months So they were auditing a few companies giving you pre-filled pieces of paper Taking a bunch of money and then they disappeared again Absolutely terrible, then you had the visa Three dissecure requirements They were actually kind of interesting because they were based on the physical card world which has been there for a long time So these requirements were more mature more thought through a bit overkill given that You know this was no not producing cards and shipping them by mail and that sort of thing But at least they they were strung together, but we had some interesting audits anyway, not entirely terrible But it got so bad because suddenly the card companies they had to start Fighting for attention because you had the PCI taking over and you had all sorts of other requirements taking over and the card companies themselves Started being less and less relevant in the security requirements, and they didn't like that at all So I mean I like this picture. Yes, it's by the book So some of the things we've experienced this is the first part of the absurdities thing We've been asked to look for data that cannot possibly exist again requirements come from a different world The world of physical cards where you have the magnet strip on the back So even though we're doing only online stuff We've been forced to use Various approaches to looking for stripe data on our servers It we do look for card numbers stored in log files and all that sort of thing. That's easy, but the stripe data now That's hard We had people come and take Pictures with their phones. I mean back in 2005 ish six ish phones and cameras interesting combination They came into the data center wanted pictures of my password files Because that should prove that the passwords were encrypted and Then so at some point we were asking for an auditor that new Unix and I said I will use grep to look for card numbers Yeah, but I you have to document that grep can do regular expressions Believe it or not. One of the big card companies published a set of official or regular expressions to look for card data And they suggested we got this tool I don't remember what it was called spider or something some alpha build for free BST existed binary blob They wanted us to run this I suggested using grep Yeah, we did use grep because we don't run untrusted binaries usually But yeah Yes, that's the binary blob We were two guys We had an office about a third of this stage But yes, we had to have a visitor badge system for our office because otherwise We couldn't be sure that whoever was in the office was actually employed in our company or not Oh, this is my absolute favorite And Auditor was connected to to the big, you know projector like this like I am now and he was bringing up our documentation on his laptop he was typing in a URL in In his browser and he thought he had focus on his screen Too bad focus was over there in the browser window. We had there So we got his browser history Yeah So this was the first PC I audited we ever had and The auditor took the pictures he took all the screenshots from our wiki all the scanned documents and stuck in a folder on this desktop of his windows XP laptop Next to a folder for one two three ten fifteen twenty of our competitors customers other banks etc etc and Then he brought up his browser history On the same lap. Oh, I absolutely love that When they asked yes Top-level level one. Yeah, so When after the audit I called the boss of this guy and told him about this story He just said I think you will not be receiving a quote from us for next year So the low point of my career was after a lot of back and forth with these requirements And they were developing and it was getting difficult and especially the ones from visa They have they have essentially three large regions in the world and they each have their own auditing authorities It's the same document, but different authorities with different interpretations Which meant that our competitors who were usually in the US or? Asia or somewhere they had reasonable auditors that would go in and say okay, this is the security problem You have to solve. How did you do it? While the guys from visa Europe they did not so we went there to talk to them and explain this and say hey You're making our lives really difficult because we have to do things that are absolutely absurd This was the response. I got We are not in the business of level playing fields. They didn't care and they had no interest in caring The same guys also told us how but we don't audit you for the money We're only taking 15,000 euros of you for the privilege of being audited plus the time and material of the auditor Plus a hundred thousand euros protection money every year. So, you know, but not in it for the money at all Love that So as time goes by and the requirements develop some of them grow up The PCI DSS is getting better. It is currently a decent security standard Our audits tend to be useful to us We find stuff we fix it we have we get help and everything and they are not as Locked down to a windows group policy as they used to be More problem focused and solution focus as in they don't tell you how to do things as much as they used to But what the problem is and the type of approach you should have You can actually do stuff on other platforms than windows But they still have a password policy in there that sucks and that you simply cannot do on free BSD, which I'm getting back to They've the other set of requirements from visa. They are so absurd at this point that you cannot even read them They have copy pasted stuff from their own documents Indenting doesn't make sense grammatically. It doesn't make sense. You're it's like Making pigs fly. It just cannot you cannot conform. There is no way logically impossible and They actively reduce security and this is my favorite kind of requirement, of course a colleague of mine said what they asked us to do Was that we have to have a strong password on the route account We cannot disable the route account entirely Because the requirement says you need a password and that password needs to be split in two halves and given to two different people So it's like telling us Sorry Telling us to take a solid brick wall Put in a door with a strong lock on it. My preference would still be the brick wall but you know This is probably the one time I've outright lied to an auditor and said yes, we did this We've never had passwords for route really These guys these guys go for naming not numbering. I get it Another nice Absurdity was when they told us so I mentioned before OTPs via SMS one-time passwords when you're chopping or something These guys didn't understand that this is fundamentally different from a static password when you use the same password all the time So they told us you have to secure this OTP The same way you would secure a password Which means you have to use an hsm to encrypt them now for those who don't know an hsm is one of these crypto units that someone else They spoke about earlier They cost a lot of money. They're either a PCI card with some physical security on them or it's a network mounted unit We use the network mount the rack mounted variety.  So if you try to take it out of the act stuff will blow up inside It that's kind of cool So how do we encrypt an OTP and send it to someone? Do is ship an hsm to everyone? I Mean you have like the 15 kilos of hsm in your pocket that you pull out every time you know that doesn't work, obviously Oh, we we've done that we've done that There was a time the the supply would not under any circumstance ship these hsm's to Tallinn Estonia This is a part of the EU But they were so afraid of this because it sounded eastern block and all that so they refused to ship them So they shipped to Norway put them in our check-in luggage and we flew over Yes, we see when carrying hsm. Oh and of course Auditors not understanding how TLS works that you have a server and a client the server decides on the crypto But if we're sending stuff to someone they decide on the crypto then we can't make sure they're using an hsm So the auditor told us yeah, but how about you be the server and they be the client? How do you even compute that? Yeah, exactly, so is there some sort of sanity coming They're gone the requirements from from all the card brands on requirements are basically gone because the PCI has grown up And taken over all this stuff. They all agreed that okay. We let we use the PCI standards that all of them sort of to achieve much the same and It has the PCI has gotten these new extension covering what we do what visa used to ask for and the others and Then we got regulation that is almost sane GTPR is awesome for the consumer for people in general PSD to Tears down some of these walls that all the banks and other others in the business have been building up to keep business in Their own hands, so it's funny. I'm getting mails from my bank now telling me I can use One online bank to check that my accounts in another bank because they had to open up APIs and everything to talk between the banks. This is awesome. I mean It's a tiny island of awesome, but it's still awesome I like it and it helps guide all these requirements and temper them so all the requirements that come out of the US They are tempered by European regulation Which means there are some things that even though it's required of us We simply cannot do it like having a camera behind my back in my office.  They have no idea Which means they either have a checklist that you asked to fill out or Or you have you have to take them to school through every single requirement and this is so Tiresome and then even though they've sort of given up control The card companies they haven't really so they're inventing all sorts of other ways to keep control This is the West world so they think they're in control They're not really so they don't even know when things start slipping and then you all still have all the people who are Trying to cover their own eyes as they haven't understood that all they need is a certification that we passed a certain set of requirements So they invent their own and that's usually copied and pasted just stuff in a different order But it's still mostly based on some ancient PCI so it might not even be compatible anymore So we've literally been asked to specify the kind of lighting We have outside our premises and in this case our office actually which is completely relevant and We still don't know Sorry, why they asked this we have no idea, but we had to try and find out somehow How does how often does police patrol outside your offices? How should I know this is not the US where you can pay the local sheriff to check by a couple of times a day Do you have a priority phone number for the emergency services in your area? I was so pissed off when I got this one in my lap because there's a hotel across the road Please go there first. If there's a fire go to the hotel. Don't care about us. I don't care people don't die and When you have a guy coming into your office and he and his Bosses have already decided that your business is worth the sorry the data you process for them is worth 400 million US dollars That is a very big number anyone would be interested when they see such a number So he has this on a piece of paper It says modern MDP and our address phone numbers everything on top and then it says the the the name of the bank You know huge US bank everyone's heard of it and The 400 million USD is also in big fat letters. So you can see this from 100 meters away And this is in his briefcase and he's carrying this through the airport and his next stop is St. Petersburg This is the single Biggest liability that our company has ever been exposed to I'm sorry. I'm trying to find that never mind Because imagine someone seeing that document It's about a company in Tallinn and it's 400 million dollars if you can get our our hands on 1% of that data and we can get 1% of the value of that data You can still pay a lot of hackers and hookers and whatever else you need in order to get to us so war stories and all that How have we gone about doing this and as I said before I don't think I can teach a lot of you a lot about free BSD So I won't even go there But feel free to ask So it's about thinking about security first and then compliance. It's not free, but it's easier mostly that one if you can show that you don't even trust yourself that goes a long way towards Convincing your auditor that at least you don't trust anyone else. You shouldn't be trusting and This one has got me out of so much trouble that we we might choose solutions that don't necessarily follow people's expectations But being able to explain why we've done certain things. That's a big deal Because it me it it helps show that you have understood the underlying challenge and you've solved that It doesn't matter exactly how and you have to be able to show That your choice is deliberate You have to be able to show that this is the end of a thought process Not that the thought process started when the auditor raised the question If you can think quick enough to come up with something at that point, then you're really good I would like to hire you and This is something that always brings a lot of discussion and this depends very much on what industry You're in and what kind of data you have and what kind of attack vectors and everything but generally It kind of sucks to find out three years down the lane that you had three four or five audits Everyone said it was all was hunky dory and then someone's been in your systems all the time Because as soon as you have an audit and you pass you think everything is fine because whatever was there you must have found it by now, right? So people spend a lot of time trying to prevent a break-in, but if you already had if you find An open hole in your wall. It's not enough to plug you Do you have to go check if anyone actually got in and surprisingly many don't get this? so detect before you try to spend too much time trying to prevent because Yeah, you should of course try to do both but We have our servers in a data center. We have a rack in the data center with our stuff and I do at some point. I just said to say yeah, whatever the data center is doing It's okay if someone managed to get to my rack and get to our equipment. They're probably there with a forklift anyway What can I do? so no amount of you know Colonel auditing is gonna help you then and Dual control Physical dual control Goes a long way to convincing an auditor that what you're doing is Okay, because especially in a small company When you have to share hats you wear a lot of hats If you have dual control meaning that you need to be two different people From the company to access your server rack for example it means you can show with a very high degree of Certainty that no one has been playing around there on their own and then make sure that whatever you really want dual control for You can't do remotely. So this is one of the nice things with a network mount the Iraq mounted HSM There are certain things you simply cannot do you cannot remotely insert a smart card in it To do administrative administrative operation. You can't remotely turn physical keys This is very visual, but it it's also very nice to just close off entire categories of requirements so The tools we use I didn't say so before but we have been putting a lot of effort into just staying open source all the way so a Lot of these auditing requirements will assume that you're using some sort of commercial Tools for various parts of your compliance work. We didn't do that so lately we even have our routers on BSD which is really nice. I really like that The only closed source software we have is the stuff we develop ourselves and you may boo. I think it sucks But then again, I've seen the source. It's okay Um So probably the The one that the most important underpinning of being able to comply is About providing forensics data when shit hits the fan and that's where the kernel audit logs come in I'm gonna complain about them in a couple of slides, but they're really really important And it's it's easy to turn on it's very hard to do anything useful with them Then we use Freemius the update and PKG. I remember spending a couple of weeks trying to implement tripwire at a point This is very long time ago before we had these tools, but those actually do Almost everything you need them to do they can check the integrity of what you have installed as long as you don't build your own Kernel and world and everything. It's actually quite okay PKG does its job You need to know a little bit of what you've done yourself and keep track of this, but they can do it PCI requires a web application firewall. I think the concept is weird But mode security you can actually do that with engine X now On stock free with the and it works surprisingly. Well, we had some interesting Cases where engine X would blow up to like 12 gigabytes of memory usage per worker or something But it looks good now one of my colleagues is maintaining the live mode security port My skill for data Oracle actually told us at the point that we have the second largest my skill installation in the world I don't think that's true any longer, but it's pretty big. I think we're handling like five times 15 terabytes online storage at any given time and My skill can actually log access But good luck finding in that documented anywhere. You can actually do it It's it can log to syslog and it gives you everything a PCI auditor will ask for surprisingly PfSense Siricata tools that most of you will know on some level or other puppet for config management ZFS Whenever puppet runs in one of our jails, it will tell the host to snapshot the jail before it proceeds And if that fails, it would just bomb out. That is very nice when you have to show rollback capability Love put here and Bonchelle and all that it's nothing really out of the ordinary the kernel auditing is the only thing that we're Kind of struggling with and that a lot of people probably don't use Check the man page It will give you lots of data, but you can tell it only is you know save away some of it So be careful with that Don't try to do a lot with the data on the server where you're collecting it get it out of there and process it elsewhere one exception being BSM trace Which is seriously undervalued it can look at the events from the audit pipe and Tell you when a certain chain of events happen So for example, if the triple W user just forks a process that is bad That means someone on my tomcat And that is a beautiful way of showing that hey, I will pick it up if someone gets in that way You can do similar things with the you know engine X users or whatever and that is pretty simple or brute force login attempts that sort of thing so Check it out. It's cute, but I'll get to that so you have different philosophies in the industry. I'm sorry. I'm going a bit faster and someone showed me a sign here So Probably the biggest one here is again They need you to have to store away the last 10 passwords used for a user on the system I don't know how to do that on free BSD 15 years later. I still want Everyone expects a large organization we started out as two people now we're eight in our hosting business Doing the work and it's still small compared to what a lot of the auditors expect It's not very open source friendly because you cannot equate Linux with open source because Linux comes with corporate stuff so although the Software is technically open source. They don't like the open source community Also because all these hsm's they require drivers and that sort of stuff unless you use the network units that kind of sucks And just because you're compliant doesn't mean you're secure and vice versa So you have to keep an eye on both Interpretation Everyone will interpret the standard differently even Two auditors from the same company shall not be mentioning names Will have wildly different interpretation of the same requirements So make sure you know it before they do what the requirement actually says And choose your auditor wisely For PCI you can actually choose your auditor which is nice which means you can Make sure they're technical Make sure they understand technical things because this is technical Anyone who tells you differently is wrong. Yes, there's a lot of business processes and all that stuff But at the end of the day it's technical How will your auditor handle Alternative solutions if you haven't done something by the book. What have you done? Are they able to interpret and understand what you have done? And will they help you find a solution Uh, sometimes the auditor will say I can't but my colleague over here can and that is perfectly fine Do the does the auditor trust their own judgment? This is probably the hardest one because they again are part of the blame game So if we're broken our auditor will burn So does the auditor trust their own judgment well enough to actually give you a pass?   It's going to happen. They're gonna think it's a linux And don't talk about jails if they clearly don't understand what you're talking about But everyone understand virtual virtual machines and think that's a good thing.  So do your homework Read their requirements and find out where they come from. So you can show that yeah, this has already been asked and we did it like this Because it's already covered They all come from the same place, but they might be different generations of requirements. So It can be interesting anyway They will typically recognize your PCI certificate, but not necessarily it depends if they know someone on the board in which case they might not It's um, it is a somewhat small industry and you People have spoken to each other So I have a couple of complaints about the current state of affairs The kernel auditing stuff is awesome, but it's not done There's not a lot of good documentation or examples. I mean if you look at the the trusted bsd website for example, it's so old It's not even funny I'm not sure a lot of people are using this Who's using the auditing framework in any capacity? Excellent one two a few Not a lot And come on I don't know we're what 20 years in and we still don't log the jail ID of something that's happening This is just not okay, but I've been Yelling about that for 15 years now and nothing's happening. So I haven't yelled in the right direction. I guess Package base. I know there was a talk about that here just before I came on I was panicking over there. So I didn't get it someone summarized for me But I really look forward to that And then it's the whole jail orchestration thing. There's a lot of interesting Work going on there. I have a colleague is working very hard on getting things to work I can't wait for that But that's something that we should have had a while. The train sort of It's it's out there somewhere. We really need to catch up but We have the basic technology in place and it's beautiful so Thank you everybody everyone who's been contributing Awesome work organizers of this event. Thank you very much. It's been very exciting Everyone else pitching in and somewhere or other my esteemed colleagues who have Been surprisingly quiet through this Tommy from nixu who has been helping me with the slides as I panic the worst here. That was awesome. So, um Thanks for all the beer and Do we have time for questions? Cool anyone Do you have any do you have any suggestions for making the audit process in the compliance part of it better and making You know audits better Um, can you refer repeat? I'm not sure I got it Do you have any suggestions on how to make The process of auditing or you know making the standards and the auditors more well informed on How is oh, I see. Yeah, so So how we can improve the auditing process essentially, um I don't know that's an uphill battle Because we're again, we're at the bottom of this. We were all the blame is being shifted. We can't really do a lot Uh until very recently We haven't had anywhere where we could complain if we thought our auditor was doing a shit job or was plain old wrong We could not complain to anyone It's like if you have a problem then just find a different job So honestly, I don't know Is there a set of problems relating to free BSD which came up repeatedly during the audits something like If free BSD had this workaround or If they could teach the auditors about this it would simplify your life um How free BSD has been if at all a repeated sort of challenge during the audits Um, it's not a linux That that's that keeps coming up This is a linux, right? Well, yeah, so jails. What what's it actually called? It's it's like VMware, right? No, not really The big one that so this whole password history problem Is one But we've solved that by saying okay on the application level. We have Different password implementations obviously on system level. We don't use passwords. We use, you know Hardware as his age keys So no password policy required But I have to admit that sometimes it would have been nice to have a more flexible password policy in the PCI where you can say that Okay, nowadays people don't change their passwords every month because they use password managers, for example Or storing the 10 last passwords. That's actually a potential liability in itself But then you have the other side of the fence where these requirements come from who say that this is the only way to Make sure that you actually have new passwords every time. I'm I'm not sure. I don't like that Have you thought about just storing the hash? Like that's not that's bad, but it's not Yeah, sure But it's if if you attack it using a pattern, you know You assume people just add a number or something then it's very easy to verify this Oh, yeah, I'm very so so PCI level one for years and I came up with very creative ways to explain things. Yeah, so we just don't What about uh, Kerberos do they still require I use Kerberos because I could enforce The password change time. Yes and then propagate it. So again, um Kerberos or LAP that sort of thing Could use it We have chosen not to because it's simply more complexity than I think it's worth So we just don't use passwords on the system level and when we do have passwords on the system level they can only be used Physically onsite under dual control which just removes the whole problem Then you just argue the password doesn't actually matter because you still need two people and two keys Uh, when I was at the University of Oslo What we did with the password changes was that we stored the hashes for I think the last three or five hashes and then when the user Tried to set a new password. We would use the new password as the basis for a dictionary attack on the Existing on the old salted Beautiful and so we would so we we would have for instance just adding a number or Incrementing a number at the end of the password would have been that would be rejected because the dictionary attack would Would succeed against the old passwords I see Again, um We've had a lot of ugly implementations to try and comply throughout but removing the whole class of problems by not using passwords Has turned out for us to be the simplest solution Anyone What does the standard say and what did you do with respect to passwords that services used to authenticate to each other? Do you use SSH keys or or TLS or anything to authenticate to mysql and we use So I mentioned I use puppet Everywhere puppet has the nice side effect of also being an internal CA So if you're careful about how you use it, you can actually use that to authenticate all your hosts to each other because every node in the network has Certificate issued under this CA so you do have Mutual TLS level authentication um It depends on your environment whether this is good enough or not But in our case that has gone above and beyond what has been required More if nothing else, then thank you very much for your attention