Soccer basketball and so on. There's also quite a few nerdy sports like real-life quidditch or segue polo But there's also really cool sport. That's kind of nerdy, but also quite educational and quite a lot of fun I've been told so now Bruno Olivera will tell us all about this capture the flag. Please give a big applause for him Hello folks First thank you for so much for joining me in this talk So as I was introduced we're gonna talk about CTF's and The main reason why we're talking about CTF's so this this is the motivation behind this this talk is about How why play CTF's So just a little bit about me My name is Bruno Gonçalves de Oliveira. I'm Brazilian if that matters I have master's degree in software engineering. I'm a computer engineer. I'm a senior security counselor at first wave spider labs. I Have some certs. I have done some talks and some places and And maybe the most important here, I'm the guni CTF player so you must think about Well, I'm not a lead ex or a hacker or whatever you can call. I'm not that guy. So We will see here just a motivation behind what brought me to this area. Let's say that but a Lot of you can talk but you know there are some discussions related to the penetration test or to CTF players to white hat guys black hat guys and One thing that they will say that the CTF player think they think himself about being a ultra hacker or Just because he got 100 points on the CTL the death on CTF or something like that. So that's not the case, you know What I want to show you it's much more than these is much more than points is much more Then of course technical stuff is the base of everything that we're gonna say here But I don't I don't want to show you some cutting edge Technique or anything like that. It's just why I got To this area and I got so excited So when you're talking about my motivations, so, you know After 10 years doing penetration test things it starts to get Boring, let's put this word. Well, it's all the same. It's not like all the same It's a cool job. I love my job, but you know after 10 years you got limited time for doing stuff You usually got the same thing. Well, if you think about we got lame passwords we got some Usual unpatched stuff we got I Don't know you got poisoning in the past we got our two poisoning now. We got the LL and our poisoning and stuff. So, you know, it's all basically the same and If you think about we got some as I said that there are those certifications like OSCE or SCP from offensive security It's it's good from what we have nowadays, you know, but it's not even close From what the CTF can teach you so that's why I got this Excitement, you know, so that's why I Wanted to you know to explain this to talk about this because I think a lot of people got some You know, maybe boring. It's not all the same Even on offensive security and mostly on penetration test because on penetration test is all Not always but it's very superficial You know, you don't go much deeper on the on software exploitation on finding vulnerabilities on by your hand So when you got a chance for example to try a new a new technique I will show you this later but for example a new vulnerability that came out or a new type of exploitation that somebody just Published it on somewhere else And you've got the opportunity to test that that's that's really great really great because you can you can take these new technologies new knowledge and And apply because well, I always say that Einstein Says sad that the the only knowledge comes from the experience and I totally agree So if you take a book and start Reading about overflows reading about, you know assembly or whatever It's not the same, you know Everybody knows here. I think so. So it's not the same So when you have the opportunity to test whatever you are learning in a real-life environment That will change you That's my best So now One thing very interesting that I would like to say about this. It's like when I was maybe 15 years ago or 17 years ago when I was a teenager very excited about learning Buying books, etc. This kind of you know, I Use I use this word a lot today. That's because I don't I don't know any other word that works perfectly in this case but excitement, you know to learn and This is the good thing about it. So You get all this new stuff. It got back in and I'm now I can say that I'm back like I'm 17 years old again I'm buying books. I'm learning. I'm talking to people. I'm trying to figure it out stuffs So this is the cool thing about this. So that's the real Cool, that's the real motivation behind this talk. It's all that I said now. So I hope you get something and Enjoy So what do you see here? What is a CTF? Why but why right? Why are you gonna play this?  Where? How cool is it? how can I start and Of course, I'm gonna show you some stuff for example, what I'm gonna show you in The technical stuff about it. It's not as I said, it's not a cutting-edge technique, but it's not very common So this is the word It's not common to see so in an environment that for example as as Me doing a penetration test. I have a lot of stuff to check it out Before doing something that's new because I have 60 hours for doing the job So I have to to hack the network before that so if I'm gonna try I always say that I take a lot of time doing this and my wife is here to to To make me not lie. I spent a lot of times doing a lot of time so I try to learn and All this excitement comes back So what is it through the flag? Well our hacking games involving a lot of stuff. So it's basically In the end you have to find some plain test test a flag in something a well or in a system or in an application or Hidden in a in a file So So it's basically like that we are they are running some CTF right now. So it's probably like this So what are what is? What are the set effort about so? It's most forensics crypto web exploitation reverse engineering and low-level exploitation So how how we get it started? So these are some CTFs that It starts very easy, but you see the cool thing about this that's Maybe when you want to take a look that is and try some the first web application that you are Seeing you see that's not it's not very usual because it's the cool thing about step is not very straight All everything is not very straight. So you always have to take a look Out of the box think out of the box to have an idea or what's going on This is probably the main site that you have all information about CTFs so You have all the CTF organizers the CTF teams They write ups and the scheduling so if you want to know anything about CTFs It's there. So you can take a look on CTF time. Or you can see the team you can see the score So the cool thing you can see all the score and the score is annual so You can see who who is ahead you who is behind and which steps they are playing etc. It's a organized site so what you can expect in a In a CTF as I just What you can expect new vulnerabilities as I said So something that just happened You see there. So in a well, we are we are we are talking about good CTFs, right? So Just to make clear. So maybe something that's just published and you see there's a There's a challenge there that that is talking about it. So that's the cool thing however There are old techniques too. I will talk about this later. So As I said before there are new techniques. So maybe a new heap exploitation on Chrome or whatever they apply on the On someone on someone else and you have to to use it there or There is a New perfection of memory for example I think I put on the slide but for example the Intel Put or when I put the the shadow stack so it happened like I don't know maybe last year or something I like the shadow stack and you can apply this technique and what the people are doing to to bypass this and applying the real life so but old shoe and old school and I I said why why old school? Well In our area, it's very easy to to see people trying or wanting join this Offensive security stuff, you know, it's very popular. It's very hyped to be a hacker a hacker So they want to do that. So but now Well, when I started 17 years ago, we don't have we didn't have so much information We have what information we had in the past. It was usually good. Normally it was good But now you have a lot of people talking about a lot of You know, so You you see a lot of information that may be by past the basics For example, they don't know the tree went away handshake in TCP But when a hacker, I don't know web browser, they are fuzzing stuff, you know so when you learn the basics on low level exploitation, for example, there are a paper for That a paper about the hip exploitation. That's very famous. How's of God? How's of everything? I forgot the name of the paper just because I'm nervous not because I don't know Exactly so this paper was published and then in the next one someone this guy published this this guy never came up to see to To say that he did this this paper His nickname is fantasma fantasma ghost may be he's here. So and And the next one they published it someone he didn't put any Proof of concept of his techniques just the techniques and the next frack someone Published the maleus this malefic atom, right? So in this paper that are pox and etc. This is it's a Very nice paper to read. So if you want to join the low level exploitation, it's the basics, you know So that's why old things are cool too because we need to We need to understand the basics before anything. So as I said before new vulnerabilities last last year was released some vulnerabilities in W get and One month later or in the same week. I don't know. There was the second insight 2016 And there was this one ability to exploit. So, you know, you can try that's that's the thing That's the cool thing about it. Yeah, you just saw the pub the paper And you can apply your knowledge or try to exploit to choose in this knowledge. That's cool I was talking about the Shadow stack so in Tokyo Western's MMA 2016. There was a challenge about this and Was very nice. It's just you know, so you have all this Information that you can get from these challenges and apply and learn, you know, well I put some Let's say tips here and how to get started on this area on games so For getting started with exploitation, you mostly need a web server to monitor requests and burp well, you can crawl you can brute force you can Check it the request and responses Live, right? So this is a cool thing headers, etc cookies so you When you were talking, I'm not as I said before I'm not an expert in nothing So, but if you wanna when you're talking about web, we have a lot of stuff to do And as you see on that exploitation challenge, we must see some restrictions. For example, this is some Few challenge during the web exploitation. So we have restrictions of space So and you can use that for example, you have remote command execution But you can use this way to bypass the space filter You have well Cross-site scripting cross-site scripting is probably the most fun Because there are a lot of stuff that you can do with cross-site scripting and it's not just for the alert So when you're doing a penetration test, maybe I just ah, I'm just take the Proof of concept on alert and it's good to go, you know But there if you wanna it was if you want to see the flag you have to go ahead Asca asca all injection. Well, this is not work. Sorry So you need something else and there are a lot of restrictions too I didn't put here, but if you If you take a local nascala injections challenge that World is it in the past you have some idea I See I saw some paper in like, I don't know so last week about the PayPal compromising in the bug bug about stuff. Did you read that? So basically the guy said that when you see a file upload a Penetration test are always shakes, you know because something's there, you know If it's not well configured something's there and and something's there too and local falling clue when I talk about local falling clue do you maybe Checking dot dot slash dot dot slash, but the most common Thing that you can do with a local falling clue in a challenge is using PHP wrappers So this is just for example for This will convert the Source code of upload dot dot PHP and you show in coding in base 64 and then you have all the The source code so this is very common to see in a pen in a penetration test No, but in a in a challenge from CTF so What I can say about exploit a web exploitation is about this But of course there are a lot of stores a lot of stuff going on and if you are Involved in if you like web exploitation And you never played city at CTF before you love it Because there are a lot of ways and things should do and Things that you learn and that's the important thing here that you learn and even if you know this stuff I will say I do say share so Someone said before share is scaring Share is scared. So this is the stuff. So why not just publish and I'll write up telling how you did it and And share with the community, you know Somebody else can take this information and learn something from there So it's not just about learn, but it's about teach to And I have to say I got to start on this area really raw on the low-level exploitation and I have good friends behind me On the team that I didn't know but I was invited to the team I started playing and two guys were like really rock stars on a low-level exploitation and I really See me it, you know They helped me a lot and when you if you join a team for example just for playing or For learning teaching whatever you have. It's good to have somebody else for Take you in this journey, you know It's really hard to learn by by ourselves Because as I said before the information now We have so much information about a lot of stuff and This makes everything harder because we don't know what information we can trust and How is reading etc. Ever everything involves that So about reverse engineering some essential tools Well the same there I the pro basic. I Really like binary ninja how there it you is just for elite people. I'm not very used to if I had there and But it of course is a really powerful tool and Really necessary for if you understand that that tool you you'll be good So now of course the bugger etc. I put there all the bg win the bg gdb Just to make it examples, but one thing that I will say in the final. It's that we don't have so many Linux windows exploitation or reverse So that's a shame We know I forgot the the the CTF that that I was playing before and someone put Windows challenge with really high points and In the description said don't be afraid of these windows environment We put a lot of points just because it's a windows, you know And if you take a look in who solve it this challenge just few teams Just because well, we have to normally have to put an environment like a you know install a new windows or whatever so maybe this is the An issue for doing the the the challenge And not now but now is is being very used Is being used a lot symbolic execution Well, if you take a look about symbol symbolic execution, it's about running the application with symbolic inputs So What what does it mean? It means that you don't know whatever? You are inputting You're trying to solve constraints in the execution flow in our case here this this symbolic execution It's a term that's used it. It's very it's highly used in the soft engineering But it's now being applied a lot on the on the security and It's about it. So No, I it's not here. Well, but it's simple. It's You have to go in a way. You have two ways for going or maybe ten or maybe a hundred Ways for an execution So if you open an IDA prop and open an application, you see a lot of jumps and these jumps go to different places So what happened if you go there? You can imagine an application that there is I don't know Maybe I mean you and there's something hidden there and and you have to put a Big number or a special word to go into this jump So this will help you to solve these constraints on the software. We have a lot of framework going on and And these two is really awesome. So I'm gonna show you real fast But if you want to take a look on this later, so of course reverse engineers all about assembly So you have to take a look on data functions and jumps so No, no mystery here So this is just a sample, right? Here we have this function that creates A key and there we have something else And you never go there in this case So here the the challenge was solved just patching the binary from jump not equal to jump so a Little simple stuff, but there's in the past was a lot of using in the crack stuff when you're cracking some software This is highly used just patching a jump or one or two and you're good to go So this this is one challenge. This was one challenge So I wanted to put some sample here. So we're talking about this This challenge from Google CTF from last year Unbreakable so it's It's a tool that you have to put the key the right key there to generate a Valid product key so you have to put a password or whatever and then you generate a key for you so If you put there something like that you have the you have some failure message, etc However, if you go here and take a look on the code. So here it's open with the binary ninja and If you go ahead you see The function that's called when the product the the activation fails and Then so note here. We have the function in the end 50 and we have the when the When this function is called it's because the the product was activated successfully So we have two functions That you can easily see when you disassemble the the software So here are just a simple code using angry and this is all it's pretty much all the code that you can you have You have to use so you put find where you want to to be so Where is your thank you or? Your case here Which function you you want to avoid and This is the altar. I didn't do this one. So this is the altar. So It's pretty much that you have just a cute. You say that's an argument and After this you run the code and you got the The king so You can see that it's a it's a it's very cool because it just made some twist on the reverse engineer stuff because You can just put whatever you want and where you want to execute and try to find a way to be there This is There's no verbose message here But when you put that in your code, you see a lot of things what they're what it's attempting and Whatever just to get to the message so This is it about the I just wanted to put about some sample from using symbolic execution because it's been used a lot actually a plugin that one That's like plug-in of the year from Ida Pro last year was a very cool Plug-in using symbolic execution and it's all click it. I want to hear I want to hear Make it for me. So it's ridiculous. So if you if you are interested in own reverse engineer Just take a look on these two. I just forgot the name as well well Ponce that's cool. That's that's true. So it's Ponce so Take a look if you are curious about it So if you want to get started on low-level exploitation some essential tools Gdb, of course, I Always say that Gdb. It's the the first time that I saw a Gdb in my life said how people do it. It's like It's disgusting You don't have anything It's very very hard to see stuff, but Now we got some a better interface that you can use as gaff and by the way this guy that made Gaff it's in our team He's really awesome. So and this tool is really really awesome really really awesome. You can You can monitor requests for example, it just understands if he can be a user after free It's very cool. Take a look And of course, it's a similar as well in this case by Nero Ninjal other two if you're not familiar with Bound tools and you want to join and I want to It start with this thing You should take it It's a leap for Python that you have a lot of handy stuffs for doing exploitation software exploitation, so It's a numerous you have a lot of stuffs there So if you are doing if you want to join a little exploitation take a look on this and you'll be happy so When you get it started what you should see well first thing check For which architecture is compiled the binary if it's 32 or 64 bits It's security check if it has pie Yeah, relocation read only SLR it's always It's the full so you always have the the libraries being handle my isn't in the memory It's by the full so ever I Didn't see any any any challenge that you didn't have a SLR enabled so then you have pie you have Relocation read only you have canaries and you have annex and noise occultable. So noise occultable is pretty much in all but maybe you see in some In some challenge that are not enough it's not enable When it's not enabled It's probably because you have to create some special shell code for that You have to being smart you have to be creative to to create your alphanumeric a with 50 50 bytes or 40 bytes or 30 bytes. I don't know and That's cool stuff So when you're checking that you you you have an idea on what you're dealing and maybe it's all Enabled and maybe it's not maybe it's just one or two, etc So what are the inputs? This is a very important stuff. So You should locate where you can put some data maybe You have to jump around to get something executed Maybe you have to combine two inputs to get an overflow enough by one for example So Where you can put the data it's very important You of course check the problematic functions before anything check that if you have if you have a string copy of have a F Gats or something like that Probably the the the starter the starter problem is there. So you have to take a look and of course for dealing with heap check the memory allocations and see if you are writing data in the same memory allocation or Whatever check what is doing now we have the stack clash Are you are you familiar with the stack clash technique that was launched one month ago? so basically it's when you get the stack overriding by the the heap or the other way around So a very cool paper by the way and keys of course, this is well not common maybe in some entry level stuff, but maybe you have to To exploit a string copy you have to do a summer reverse engineer and see That there is a key that you need to put in the first input for getting to the second input, etc So about the memory allocation. So when you see mostly all the the The heap challenge you have to define some length How many words you put there or how many sub allocation will be there? So this is very important when you're talking about memory allocations So this is another Another sample that I want to put here. It's a file stream point overflow That's found on the see the file challenge on pal navel. So this this is pal navel this is pal navel stuff It's not it's like it's open Every day. So if you want to join there now you have you can create you have a lot of cool challenge there Related to Low level exploitation none was Trivial none even the first one is not not that trivial. So that's cool. So you see that so If you're familiar with this technique, this is not It's not a very common technique you If you if you look for this information if you look like this file is three pointed overflow You see something like you you see something there, you know, but if you don't know What you're looking for so for example in this case. Well, I show you so in this case we have only The noise equitable enabled and the allocation read only was just partial So if you're able to overwrite the got The global offset tables you were able to do it because they are Relocation read only. Yeah, it's just partial, but it's not the case as well So here's the The software it's a very simple software you can open read right to the screen and close and Then you go out so The first time that I saw that I saw well, you can open a file in the system. So If you're familiar with a low level exploitation in Modern computers or anything like that, you see that the first thing when you don't have You're not able to write a shellcode or you don't have any space that is executable on memory you have to use Rob payloads So when you use Rob payloads, you need Well, that's not what I'm Would say but The thing here is that you can open read any file and you need a leak from the system to use The library C for example when you're talking about the unit stuff So you need a leak you need you need somewhere that's leaking an address from library C Then you take the base and then you find whatever function you want to call and then exploit so in this case a File in the system when a when a there's a file in the system when the software is running that It's proc self or proc the number of the PID maps and this file leaks The addresses including the library C in this case You wouldn't be able to see in the first time The address the base the address Just because there's a limited number of bytes. That's being show it. However The the file is never closed when you open that you have to close So if you read one more time you get the second The second part of this bite So the file be the files will be split in for example I don't know if you have I don't remember maybe it's 40 bytes You have like 40 bytes each time that you're reading so think about that I always say that when you solve a challenge, it's very easy after all After solve it everything is easy when you're doing it's very hard So keep that in mind because sometimes you want to show that stuff and you show very straight first up in a penetration test When you're showing in your report, you don't don't really show your attempts You really you just show your way for doing it and somebody maybe somebody that's not Related to the to the area can't take a look say that was easy, you know, I He found a Microsoft SQL with FCA with no password. Well, you found that but you find after scanning I don't know maybe 2000 computers and in a port now very different port So that's one thing that you keep in mind after you saw the after you see the The right up so whatever you're you're you're doing it's very easy Trust me. I spent a lot of times on this one Then well, you got that so if you I read one more time one time I read one more time and then I put on the screen and then I Get the libc base, you know, you can see there. So this is very important. Normally They will provide you the libc that they are using because the offsets from the functions are different Or in the other way, they want one day when they want you certainly will know that An address of puts an address of Another function and the difference between these functions can lead you to discover the the library see So this is one thing So then we have the leak so now we have to find the vulnerability because in this in this challenge the leaking was not really the problem, but In the most of challenge it is the leaking is part of the problem. So not in this one So here we have F scam I scan F and I have closed there So we know that skin F. It's dangerous in this time I I Can overwrite the F close argument in this section in this in this software So What I can do from there. So that's the point. This was very easy If you take a look you go ahead and open a file try a billion bites And then you go to really try a billion bites, you know Every space that you have to put bites put it and and and try it. So in this case Was in the exit menu When you put along a long Input you overwrite the F closes. So from there after spending some Few days, I mean, I think so. I don't know I Discover that so when you're closing a file You have a file a file structure in the in the memory that contains Mostly where the data on the file is and some headers and some stuff from this From this file and a lot of stuffs in one of these stuff It's called IO file jumps if you take a look in a file structure in a in memory You see All this structure and it's calling in the end the structural IO IO file jumps these are these file jumps. It's a functioning in library C So what you can do from there if we overwrite this function what we get it? So what we should do? Well, we leak it the library C. So we're good. We know what's the library C is so We find the system. This is the way that you find so This is the offset. So this is the the library C provided by the the challenge and I try to find system And this is the number of bytes more that you need to it should do the math after the The base library C so when you got this so in this case, I don't know you can just Do the math just that address plus these address and you got the system function So I Create a file structure on memory and I put a system as IO file jumps so Here as I we don't have pie enable so sorry I keep I can be here So there it's where the data is so after after you're debugging you see that this Data there will be allocated on the memory our own is on this address. Is that these address? Then we got in the end Instead of the IO file jumps we have a system so We have we are calling the system function instead the file jumps And in this in this in this place. Normally is the header of the file structure. That's it starts with f bad Oh, oh something so in this case this this data will be allocated exactly on SP plus four bytes and When you check that You see so what we did here We create week we We trigger the overflow and then we can overwrite the address that we are that we will be using the nav clothes so this address is this address just Just below the 32 ways Then we got the the file structure so this is the file structure that you're dealing the the three last lines and our file structure sets that our IO file jumps. It's a system and our and the argument for the For this is the slash beans slash bash So in the end you get executed and you got a shell so This is what I was talking about. Well, we need to This information was very helpful to me to understand a lot of stuff It may be just giving a talk fast like this. You don't don't get the point It's not it's not getting the flag for me. It's not just getting the flag, but it's it's trying to understand what I don't know and This was a case like this. I didn't know about this kind of overflow I didn't know how to to exploit this stuff and I learned Some cones about the CTF Gassing so in a lot of CTFs you have some gassing stuff so something that's not technical you have to guess well, it's not my thing and Most from the most of the CTF players too. So that's not the thing I I like and nobody likes actually as I said before 99% of the it's Linux for exploitation so you don't have a chance to to deal with this Windows stuff or new taxes and new techniques involving Windows. So that's a shame Well, I'll put it here self-disappointment because when you were lost 40 hours of your life doing trying to do something that you can't get it man It's hard to swallow, you know but in the end of the day you see that You could learn you saw a lot of stuff But this is something that you you have you know to wait And sometimes are very hard So 72 hours will not be enough for a common guy like me, you know So that's it Lessons learned from here To me it's about learn learn learn learn Share is care so take a look at what you're doing try to Spread your word and share what you learn it or what you're doing that will be helpful for someone This is pretty geek But having fun and knowledge. Well, you know, I'm not this kind of a very geek guy, you know this guy I Drink I smoke I do a lot of stuff, you know, but I have a lot of fun with CTF It's really good. And as I said before Well, I don't know if I put well I put here in conclusion of that I could go back to my roots, you know where I came from where why I'm in this area Why I'm doing this Because in the in the beginning was like I was Very excited. I want to learn I want to do stuff and then I got a job, you know, you have a family two kids Here do your job, you know and jobs always job, you know You can have the most fun job in the world if you have a boss and you have or you have a client It's a job, you know In the end of the day, maybe you're not that Happy with what you're doing. So when you got this free time and got some space for doing whatever you want to do It's cool. And in my case, I got back to my roots. I got back to to learn to read To exploit to Paul So that's the that's that's the thing. No, it's really fun again. And And Paul is just pure excitement again So, you know, we are in the in a penetration test.  You have to To Understand and to see how how cool it is and that made me better on job as well So sometimes I was, you know, I have 40 hours and I Found this I found that and now I have to say in the in the last in the last years that I was not playing and After ten years doing the same thing. I was like, you know Doing the job, but now the thing changing, you know, I mean, I'm another person related to that and that's In that school So some resource Steph time again You can check that later. This this is a Video cast if you can say from captain Dragon sector captain. He Shows a lot of good stuff there. So if you want to take a look on mostly on low-level exploitation, these guys Really awesome. We have live overflow level flow. It's a little bit superficial, but you can start it with it. So So this is it You have any questions? Thank you Yeah, thank you for this very exciting talk. I guess I know what I'll be doing the next few weekends Thank you So now we have about 10 minutes left for some Q&A time Are there any questions if they are? Yeah, there's already someone lined up if it's okay a technical question So when doing binaries How do you deal with the GDP offsets being different than when running the binary normally? because Like let's say I have the address of a variable that somewhere but when I load it in GDP locally It's always different. It has oh, yeah with the name with the environment variables and so on When it when it with environments, oh, yeah, but when you cannot attach to a running process per se to get the variables real offsets it can be problematic when you develop the actual Payload, oh, yeah, so if I understand write your question or talk of variables in the in the environment for example Bash equal no, no, let me rephrase so when you run a binary normally Everything is at some addresses. Okay, but when you run it in debugger in the debugger The addresses are different the offsets. Okay, so there are there are few protections ancient debugging for example The main protect that you can attach before the the debugging so or you can using a LED preload for example and Using another another library to to start your software for example if we're talking about Linux and you start You can you can create a binary That will be loaded before the software with a deeper load exactly that will bypass the protection It's one of for example. It's a this is a very old protection by the very old bypass by the way so nowadays I Don't really know which which another Protection in Windows we have a lot of stuff going on and I'm not very familiar But in Unix I'm not I'm not very familiar with others Protections, but one way to do it is using a deep reload So you compile you compile with our binary if you take a look at a deep reload bypass the bugging stuff You'll see a lot of binaries that do this job Okay, and it's the key to do one more so for a student who cannot afford an Ida Pro Or yeah community edition could work or binary ninja play games Is like doing just the GDP with the Atari or Pita or I don't know pointy with you or what you showed all right you think for let's say higher level CTF Yeah, so kept the stream So well Because the licenses can get quite Yeah, well you have a lot of I use Ida a lot But you can use some another you're talking about Windows stuff No, but when you want to do like static analysis on something So now what you do you're you're talking about be a part was equitable elf or whatever Like any binary that you need to reverse. I'm not sure like Don't yeah, well if you're talking about Linux we have the binary ninja. That's a cool. That's awesome, too I talked just a little bit about this, but There's a lot of plugins and it's in Python and you can write your own and now now you can use Symbol execution, but it's just for P a elf. So when you're talking about P You were your rights the community edition. It's it's very Well, it's not that bad. I don't use Many many things from the community edition, but yeah, you're right the plugins that are very cool You won't be able to use it But if you're dealing with another the cool thing about the Ida product that it supports a lot of architecture, right? support arm support SNES, so yeah Unfortunately, there's no water really around Now that I can say here as expected cool Thank you Any more questions, please line up at the microphone Okay, maybe in the meantime iPhone question for you. So Do you think or maybe it's already the case that? CTFs will be as popular as exciting as other e-sports So if there's a new one published is there like a rush and people refreshing the leaderboards? Yeah, you know in Brazil we are having it's it's a CTF That's a very and very very in trial level, but they're they're trying to do some cool stuff for example for the public You know because what's the deal about sport because as a CTF player? I just want to play I don't I don't care But the excitement for the public is the key for the the the games going very popular, right? So for example, they they the guy showed me a CTF in I don't know somewhere in Asia that we know they have a lot of explosions ever player was be Was being recorded his face his scream. So it was like, you know, it's like It's like a rock star women the guy was there playing and everybody was watching and every time that somebody got a flag Some explosion came out was like very well if they if they could do that Maybe not as popular as a Soccer my baby as popular as Legend of something legal that I don't know Yeah, another YouTube video for me to check out when I got back home. Yeah somebody else So thank you guys. Yeah, and thank you again very much


We have studied quantum mechanics a little bit and we have studied how quantum mechanics can give us a very intricate view of atoms and molecules. Now the question that one could think of at this point is is all this true? Because all right we have done some calculation, we have done some mathematics, we have formulated some very nice theory but how do we know that all this is true? I do not remember whether I have said this already but Max Planck one of the founding fathers of quantum mechanics had said that experimental results are the only truth, everything else is poetry and imagination. So, no matter how elegant the theory is until and unless it is backed up by experimental observations we are never sure that all that discussion is correct. And the experimental manifestation of quantum mechanics is really very elegant. In fact, quantum mechanics if you remember started off from some experiments and all those experiments involved interaction of light with matter, radiation with matter, black body emission, photoelectric effect, line spectra of hydrogen, all these were experiments that led to quantum mechanics. And this interaction of radiation with matter goes by the name of spectroscopy. What we will do in this course very briefly is that we are going to talk a little bit about electronic spectroscopy which has got to do with transitions involving the electronic energy levels that we have studied in atoms and molecules outside the lab in day to day life. Actually these electronic levels or you can say electronic spectroscopy is manifested in all these colors that we see. We live in a colorful world and all that color arises out of transitions involving electronic levels. So, electronic spectroscopy is essentially a study of colors well not completely because it also involves ultraviolet colors that we cannot see but colors nevertheless. So, today we are going to develop the very basics of electronic spectroscopy that gives rise to this colorful world that we all live in. And at the very beginning let us set something straight. Let us say let us remind ourselves water molecular orbitals. We know what electronic configurations are but we will revisit that in the light of molecular orbitals and we want to state very clearly what electronic states are because as we are going to say again there seems to be some confusion about this many times. And we are going to do this using an example a very simple elegant example of formaldehyde. When we talk about formaldehyde we are not going to talk about the sigma electrons. See all these molecular orbitals that we studied about we know that there can be sigma molecular orbital there can be pi molecular orbital there can be non-bonding orbitals also orbitals that are localized on one of the participating atoms. We are not going to talk about transitions involving sigma orbitals because if you remove electrons from sigma orbital that essentially means fragmentation that is also within the realm of electronic spectroscopy we are not going to go there. We are going to only talk about the spectroscopy that does not actually breaks up the molecule into its fragments. We are going to focus in our discussion of formaldehyde on this pi and n non-bonding orbitals on carbon and oxygen centers. As we know the lowest energy out of them is the bonding pi molecular orbital and let us to forget let us remind ourselves because this definition is actually written wrongly in many of the good books that we study. A molecular orbital is an acceptable one electron wave function for a molecule it is a wave function. So, lowest energy bonding pi molecular orbital then we are going to have the corresponding anti-bonding pi star molecular orbital and then we are going to have the non-bonding orbitals on oxygen that energetically lie between pi and pi star. So, pi n pi star that is the order. Now, how many electrons do we talk about? When we talk about n we are going to talk about only one n because it is the same thing. So, 2 electrons in pi, 2 electrons in one of the non-bonding orbitals of oxygen and pi star is empty. What would the electron configuration be? Before that let us remind ourselves that then the highest energy molecular orbital that is occupied is actually the non-bonding orbital.  What is pi star? That is the lowest unoccupied molecular orbital lumo. Our transitions are going to involve these occupied and unoccupied molecular orbitals. They can involve other orbitals also. So, what is the electron configuration for this ground state that we have written already? The 2 electrons in pi orbital and 2 electrons in n orbital. So, the electron configuration is going to be pi 2 n 2 and we will be explicit and write pi star 0 also. So, this is the electron configuration for the ground state and this ground state, ground electronic state is called the S0 state. Why 0? Because it is the ground state. Why S? Because it is a singlet state. Now, one can develop a more correct and more sophisticated treatment of the singlet triplet business by talking about the spin wave functions. But for the purpose of this course we are not going to go there. Let us just look at the simple picture that we have drawn here. Here the 4 electrons that we have drawn they are all paired up. So, since all the electrons are paired that is called a singlet state for now we will use this simple example. Now, let us come to this transition. Let us say I give light of sufficient energy. Energy that matches the energy gap of the non-bonding and the pi star orbitals. Remember Bohr resonance condition is h nu equal to delta E where nu is the frequency of light h is Planck's constant delta E is the difference in energies of the 2 energy levels concerned. So, when we give light of the correct frequency that matches Bohr resonance condition one can expect that there is going to be a transition from n to pi star. Whether the transition actually takes place or not to what extent it takes place we are going to come to that slowly. For now let us just assume that it does happen. What will happen then? An electron will get promoted from n to pi star. Remember something there is something called one photon rule which says that one photon can only cause the transition of one electron. One photon cannot split up and cause transition of many electrons. So, let us say one electron is now promoted from Homo to Lumo and let us also say that the spins remained paired. So, if the electron in Homo has up spin the electron in Lumo has down spin. We will come to the other possibility as well shortly. But for now let us work with this. Now, I hope you agree with me that the energy of the system is going to be more energy of the molecule is going to be more when an electron is promoted from Homo to Lumo. Energy is different configuration is also different. What is configuration here? Now, there are two electrons in pi one in n and one in pi star. So, this electron configuration is pi 2 n 1 pi star 1 and the way I have drawn it the electrons are paired. So, I get another singlet state and since the energy of the singlet state we agreed is higher than the ground S0 state we call it S1. So, what is S1? It is a singlet higher energy state or singlet excited state of the molecule. It is also called the n pi star state because it has a reason out of a transition from an n to pi star molecular orbital or you can think that in this state it is the n and pi star molecular orbitals that are singly occupied. So, now see we can think of this transition the one that we have drawn here into pi star as S0 to S1 transition also. It is the same thing just drawn in different ways. But this is where I actually get annoyed when people say this. This is where we need to remember that S0 S1 these are molecular electronic and energy states. So, molecule goes from S0 to S1 when the electron goes from n to pi star with the spin paired. Please remember electron does not go from S0 to S1. I keep hearing people saying electron goes from S0 to S1 that is that makes no sense. Electron you can think it goes from the non-bonding orbital to the anti-bonding pi star orbital which causes the state of the molecule to change from S0 to S1 n pi star state. There are other ways of designating this transition using the symmetry or what are called term symbols in this course we are not going to get into that. But please remember S0 S1 these are molecular state. So, molecule goes from S0 to S1 when the electron promotion takes place from n to pi star MO with the electron paired. There is no reason why electron can go only from n to pi star. It can also go from pi to pi star. Let us say we consider that transition and we consider that the electrons are still paired. Electron in pi MO post excitation has let us say up spin and then electron in the pi star MO has down spin. Now this can be up that can be down does not really make a difference. The energy gap is more. So, naturally the molecule is going to be promoted to higher singlet state. So, this singlet state is called an S2 state with electron configuration pi1 n to pi star 1. What would be another name of this S2 state? This has arisen out of a pi to pi star transition. So, it is also called the pi pi star state pi pi star singlet state. So, these are the singlet states that we talk about they can be many more singlet states. You can have transition from lower orbitals, sigma orbital. The only problem with that is that then the sigma bond will break. You can have in principle pi to sigma star n to sigma star transitions also. But that those will lead to higher energy S3, S4 so on and so forth states. But just looking at these states can something else happen. Can we have transitions involving the same molecular orbitals but different molecular states? Actually we can. Let us say we have this same n pi star transition. But remember what happened last time? Last time the electrons remained paired. The electron in HOMO had the opposite spin as the electron in HOMO. This time let us say they have the same spin. There has been a spin flipping. This kind of a state is called a triplet state. Why singlet, why triplet? We will come to that shortly. Perhaps I should have said it earlier. So, this is a triplet state. And it turns out that this state actually has a little lower energy state. See it is still an n pi star state like S1. But it has a lower energy than the S1 state. There are many different ways of explaining this. But I do not want to get into a hand waving argument. Just believe me when I say that when we express this problem in terms of this spatial and spin wave functions, the spatial wave functions involving involved in the S1 state and the T1 state are actually different. And so the energy is that the expectation value of energy that we get using those different spatial wave functions of the molecule using the molecular Hamiltonian, they are also different. That is what I want to say at the moment instead of going into things like Hohenstuhl and all. What would happen if there is a pi pi star transition? But this spins would remain parallel. Then I get T2 state, a pi pi star state which would be lower in energy than the pi pi star singlet S2 state. So, what we learn from here is that for electronic states, the energy depends on configuration including spin state. It is not enough to say pi 1 n 2 pi star 1. You have to say what is the spin wave function. We have not really discussed spin wave functions here. So, we have to say whether spins are paired or not. Then only can you talk about, then only do you have a complete description of the electronic state? Then only can you talk about what kind of energy it is associated with. So, not only the spatial part but also the spin part plays an important role in determining the energy of the electronic states. And finally, we have come to what we should have said earlier. What is the meaning of singlet and triplet? Well, capital S is just the sum of all the electron spins. So, if you just look at this diagram here, this is plus half, this is plus half, half and half minus, this is plus half, this is minus half. So, half and minus half is 0, this is plus half, this is plus half. So, that gives me 1. So, capital S is 1, 2s plus 1 is 3. That is why it is a triplet state. Of course, you can think that what would happen this minus half and this is minus half. Well, it is conventional to take them as plus half and I define like this. What it actually means triplet state is that there are 3 different spin wave functions associated with that spatial part. If you are interested in this, please see the lectures of my course on atoms and molecules, quantum chemistry of atoms and molecules. We have discussed this in more detail in that course. So, capital S is simply the sum of all these spin well Ms values and 2s plus 1 comes from here.  When we have paired electrons, plus half minus half that gives me capital S of 0. So, 2s plus 1 is going to be 1, that is called a singlet state. For now, let us be happy with this simple definition. Another very important thing before we move on to something else is to realize that the energy gap between S0 and S1 state are quite large. It is in the order of electron volts. So, if you use Boltzmann distribution, you will find that S1, S2 these are not going to be populated in the ground state, only S0 will be populated in room temperature. So, S1, S2, T1, T2 can only hope to get populated if you shine them with light or if you use some other sophisticated technique to populate the higher excited state. Now, let us come to this question. Just because states are there, energy gap is there, if I supply if I supply photons of the correct energy, is a transition going to take place? I told you the answer is no, let us dwell a little bit upon that. Some transitions are allowed and some are forbidden. They are forbidden even if Boltzmann's condition are made. And that comes from well that is understood by a little more sophisticated quantum mechanical treatment using something called time dependent perturbation theory. Once again I have a course in NPTEL on molecular spectroscopy. There we have discussed this in much more detail. Whoever is interested is welcome to see those lectures. But from there we get something called transition moment integral and whether transition moment integral is 0 or not determines whether a transition is forbidden or not. If you have not followed anything that I have said in the last couple of minutes, just delete it from your memories. It is okay. We will just take it axiomatically that not all transitions are allowed. There are allowed transitions and there are forbidden transitions. And in case of electronic states, since the energies are determined by not only the special part of the wave functions but also the spins, both parts of the wave functions have a role to play. So, some transitions are forbidden by spin. So, selection rule, a selection rule tells us which transitions are allowed. A selection rule arises from spins and the spin selection rule is delta S is equal to 0, which means that you cannot have this transition. Even if you give light that matches the energy gap between S0 and T1, that transition is forbidden by a spin selection rule because there delta S would be equal to plus 1, not allowed. Another selection rule that is there for your electronic spectroscopy is orbital selection rule. Sometimes called symmetry selection rule, it arises out of symmetry of the special wave functions of the molecular orbitals that essentially says that transition can only take place between orbitals of compatible symmetries. What I mean by compatible symmetry that will require further discussion. We have discussed it in the molecular spectroscopy course and also in another, yet another NPTEL course on symmetry in chemistry. For now, we will just go back to our example of formaldehyde and we will say that this orbital selection rule actually forbids this n pi star transition. And an easy way, even though not completely satisfactory way of thinking of the situation is that, see where is this n orbital? It is in the plane of the molecule, is not it? Formaldehyde. Where are the pi pi star orbitals? They are above and below. So, special overlap between the n and the pi star orbitals is very small. So, electronic coupling is poor. So, it is not so easy to perform a transition from n to pi star. For now, let us be happy with this. If you are not happy, you are welcome to see those lectures in little more advanced courses. So, n pi star transition is forbidden by orbital selection rule, L0 to T1 or Sn to Tn or Sn to Tn rather, they are forbidden by spin selection rule. And actually spin selection rule is much more rigid, but we will come back to that. So, what we have just said is that this S0 to S1 transition is actually forbidden by orbital selection rule. But does it not take place? Actually, it does take place to some extent because selection rules can be made to break down. Breakdown of selection rules can lead to what are called partially allowed transitions. How does that take place? Well, again, this is a scope for a wider discussion. For now, let us just say that spin selection rule can break down by what is called spin orbit coupling. Spin as we know is associated with an angular momentum and there is something called an orbital angular momentum for the electron as well. These two angular momentum are vectors and you can have vector sum. This vector sum is not easy to do because spin is in some other space, not really in physical space. But one can do it and this leads to spin orbit coupling. And it will be sufficient if you understand for now that when spin orbit coupling happens, what happens is what was a singlet state? After spin orbit coupling does not remain a pure singlet state. It actually mixes with triplet state. So, it is partially singlet partially triplet. Not so easy to understand if we just draw these pictures. But if you think of wave functions, both singlet and triplet states have their own characteristic wave functions in the molecule. What we are saying is that by spin orbit coupling, this singlet and triplet wave functions can actually mix with each other and form sort of mixed kind of wave functions. And that is what provides a conduit for crossover from singlet to triplet or triplet to singlet in some cases. So, spin orbit coupling can cause a partial breakdown of spin selection rule. And orbital selection rule can break down to some extent by what is called vibronic coupling. Coupling means interaction. Well, vibronic means coupling between vibrational and electronic wave functions. What are we saying? See, this orbital selection rule as we have said, they arise from symmetry of spatial wave functions. Now, when a vibration takes place, then the molecule gets distorted. And this distortion causes symmetry breaking of the wave functions along with the molecule. And because of this symmetry breaking, something, some transition that was or vitally forbidden can become partially forbidden. They become what are called vibronically allowed, partially forbidden partially allowed. So, electronically forbidden transitions can become vibronically allowed because of symmetry breaking. And as it turns out, it is easier to cause a breakdown of orbital selection rule. That is less stringent than the spin selection rule. So, you often get what are called vibronic structure in the spectrum as we are going to discuss in the next module. So, in the next module, we are going to start from here. We said that this transition is being allowed or forbidden. This is not a 1-0 situation. This is a graded. So, you can have color that is, it is not as if something is bright or dark. You can have different shades of colors. Well, different intensities of colors, different shades may have got to do with different wavelengths. So, this is quantified by something called Lambert Beer's law. And from Lambert Beer's law, we will get an idea of exactly what is the extent of allowableness of a transition. We will start from here in the next module and go on to different kinds of transitions and what actually absorption spectrum look like.


I'm standing next to a forest that has been severely impacted by the mountain pine beetle. As you can see, many of the trees have been removed in what foresters call a salvage logging operation. Salvage logging is simply the removal of dead trees from a forest affected by a disturbance in order to recover economic value that would otherwise be lost. In other words, salvage sales provide a way to generate income from timber killed or damaged by insects, disease, fire, or high winds. Salvage logging often also includes the cutting of live trees at the edges of beetle infested pockets where trees are still green but currently infested. These trees are likely to eventually succumb to the beetles and are sometimes harvested alongside the dead trees to slow the spread of the beetles. Cutting these additional green trees also increases the economic viability of the timber sale and can be beneficial for overall forest health. Many forests in the western United States are severely overstocked, resulting in trees that are susceptible to a number of other issues as well, including wildfire. Clearing all dead trees out of a dense stand such as this through salvage logging can often reduce the need for further cuttings later on. Usually with salvage logging, foresters are trying to establish regeneration of young trees as quickly as possible. Therefore, it is ideal to leave a stand as open as possible to maximize the amount of sunlight that reaches the ground. Income generated from salvage logging sales can be put back into forest restoration efforts. For the University of Wyoming Extension, I'm Tina Russell, Exploring the Nature of Wyoming.


More than 20,000 AT&T workers have gone on strike across the southeast over unfair labor practices and bad faith in contract negotiations. The strike started on Saturday and includes technicians and call center employees. I'm a service technician with AT&T here in Athens, Georgia. So what are you guys doing out here today? Our contract ended August the 3rd. We extended it a week. Our bargaining team and the company couldn't come to an agreement. Their bargaining team cannot make the decisions that need to be made, so they're not getting anywhere in negotiations. So CWA District 3 has called a strike for unfair labor practices. If you're not going to send people to bargain that have the authority to make decisions, why are we bargaining? AT&T posted a $19.4 billion profit last year, but if you think the communications workers of America or CWA are out asking for more money, you'd be surprised. We're just trying to get a fair contract so all of us can come out here and provide for our families and the ultimate is providing service for the customers. So AT&T wants to get rid of your benefits? They want to charge us more for our insurance and health care and stuff like that. There's a proposal for a cut in pay and raising our rates for our benefits. Do you think it's fair that they're asking for a cut in pay? I don't think it's fair. We all come out here and work our 40, 50, 60 hours a week and we're compensated very good for it and we'd just like to keep what we have. So we're not asking for more. It's the most modest demand you could possibly imagine. What the heck? These people are just trying to live a life, trying to work a job, trying to do the best they can. What's crazy about what they're asking for? Nothing. Strikes in Athens are few and far between, but with AT&T hiring non-unionized workers and CWA determined to hold out. This one might last for a while. Want to support the workers on strike? If you're a UGA employee, you can join their union. The United Campus Workers of Georgia is part of CWA and is available to any UGA employee. To join, head to www.ucwa.com slash join.


Good afternoon. So I am very excited for this talk, not because the speakers, the audience get to hear the answers to your questions, because I get to hear the answers to your questions. So take us on a little bit of a journey to begin with. You are very ambitious and very driven. Did you always know that you wanted to be a founder? That's a very good question. I believe my parents knew. So that's interesting that I think that I always had a sense of freedom and leadership that I actually wanted to involve in my role. So you see, I'm 33 years old. So at the time, I was little. None of these jobs were actually existing. But I knew that at some point I actually wanted to become an entrepreneur and have my own venture. I do believe that also, for me, always, SKY has been the limit in what I've tried to do. And so I've always wanted to push myself as hard as possible. And that's since a very young age. So in a way, yes, I think I knew without knowing. It doesn't surprise me. So first job was at Google. Why? Very good question. So actually, I always wanted to work for Google at some point. It's a company, especially, I would say, 15 years ago, that was for me the growl. And I got lucky enough to work with the EMEA CFO at Google, where I actually learned so much about how to run a great company. What struck me at Google is that you get to learn how to become the best manager and the best leader because they hire the best manager. And they have the best HR team to actually put in place the training and the process to get there. And I learned actually so much to actually create pigment. And that was, I would say, the first experience that led me to create pigment. And so you always wanted to be a founder. You went off to Google. You learned how to hire. But then you went to become an investor. So why that pit stop? Sure. So actually, it's interesting. But I think I kind of retro-engineered what happened in my career. I got the luck to actually work for Index Ventures with Ophelia actually. And it's one of the best VC fund in the world. And the reality at Index is that you get to see the best founder in the world all day long. And you see what it takes to create the best company. And you see the grit and the passion that these people have and the difficulties they're also facing every day. And I think for me, this experience was actually completely instrumental in helping me to understand how and what it takes to create pigment. And so when you came to that moment, when you decided you wanted to be a founder, was it that you had the burning idea for pigment? Or you saw these founders were meeting them and you just decided you wanted to follow in their journey? Yeah, that's a very good question. And actually, I realized that, especially with the topic I'm actually tackling, it's a topic that I saw everywhere, meaning that when I was working for Google, so the idea with pigment just so that everyone knows in the audience, we are replacing Excel. And the idea is that Excel doesn't work when it comes to actually manipulating large amounts of data. And pigment is here for that, to help you do that in the smoothest manner in the most collaborative way. And so when I created pigment, actually, the idea came from what I saw. At Google first, because I was working for the EMEA CFO and I saw that, obviously, Excel Google Sheet were not working well when it comes to planning. And then as an investor, it was interesting to see that probably the only problem that was not tackled well by entrepreneur was planning strategy decision making and actually manipulate data, not only to understand the history of your company, but to plan the future. And that was a problem across the globe for all the best fast-growing companies preparing for an IPO, post-APO, and that really gave me the idea of starting pigment early on.  One of the sadder part of the jobs is that you come to realize that, unfortunately, a lot of companies don't work out. And there's a lot of risk in startups. So how did you come to the idea, like, how did you have such strong conviction that pigment was worth leaving the investor all for? Sure, so I think there are many things. So the first one, as I said, I saw it was one of the biggest problems to solve today. Because I saw it in every single company we would invest in, but not only. I saw it at larger companies in the like of Google, but very much any Fortune 500 companies facing that issue. And I knew that even, you know, with early stage company post-series, they are also facing that issues early on of not being able to actually manipulate data the right way in Excel. And so I knew I had the conviction that first it was a real problem. And the second reason I would say is what I would call founder market fit. The thing is, first of all, I had experience as an operator on the topic. And in order to create the company, you not only need experience, but you also need the sort of surroundings around the company to actually be successful. And what I realized is that obviously, thanks to index, I had created the most powerful network of founders, of companies, of operators that could actually become the first customers of pigment because they had the pain. And it was the same with my co-founder. So actually, my co-founder was a co-founder and CTO of Criteo. So it's a company that IPOed on the NASDAQ in 2013. And for him, he was probably one of the strongest CTO. And he is one of the strongest CTO and co-CEO of pigment with me in Europe. And what you need, obviously, is you need to build in order to replace Excel. You probably need the best engineering team in the world. And so here, we realized with Romain that for this adventure, we were not only able to probably create the best product in the world because we could build the most incredible engineering team. But also, we would probably have the first investors to back us because of the network that we both have. We would be able to sign some incredible brands. So today, we have signed Gong, for instance, which is the fastest-grossed sales team in the US. We've signed Deliveroo in Europe, Blabla Carmano, Mano, et cetera. And this is thanks to the trust that we can bring to the market. And of course, the West comes quite easily after that. So take us through some of that early journey and the transition. And I can certainly talk from my own experience going from being just an investor to founding Blossom. You suddenly realize that you have no time. It's not just the day job. All the other work comes in the after hours. What were your first learnings about going from being an investor to a CEO? So here, I think there are many learnings. But the first one is that in order to be successful, it's all about the team. And it's all about the early team members that you are going to hire. So for us, we needed the best-injuring team. So we started by hiring the best of the best-injuring talent we knew. We needed to create trust in the market. And our first business hire was a fantastic hire because he knew the topic really well. He was in the shoes of being an analyst. And he did a wonderful job there. We needed the best product. And so we hired the biggest expert probably in the ecosystem that knew the market in and out. And that could tell us all the pitfall about what could be wrong there. We hired the best designers. And now we are hiring obviously the best execs that can bring us to the next level. So I would say that the first thing is that you need to delegate as much as possible by finding the best talent for every single area. Then another important point is that you have no time. But time is not the most important. The most important is your energy because you need to manage your energy every day. And it's all about that. You need to understand what are the most productive moments of your day where you should really spend, dedicate the most of your energy. You should actually not travel too much to actually keep your energy to sell to customers, to sell to new hires, et cetera, et cetera. So for me, it's all about energy. I'm making sure everything I do, I do it at more than 100%. And I remember those when your first year when I would come to Paris and I'd meet with other founders or other investors. And there was such a buzz about the company. Did you know they hired that product manager from Datadog? Did you know that they hired? You did that very, very well. Having come from being an investor and not necessarily being hiring every day, I think even from when we invested, you've come from 15 people to almost 70 today, what did you need to learn about making those hires? Like what are some of the best tips that you can give to other founders starting out? Sure, so there are many things I can say. The first thing is that every hire can make or break a team. That's very, very true. So everyone you hire, you need to hire very, very carefully. And you need to understand at every moment, think basically six to nine months in advance to make sure that you know who you will need at a certain point in time to do certain things. And for us, that has been the case in the beginning. First of all, we needed to launch a product that would be a no-brainer in the market. And that meant what you said, all about the team. Like no investor, no customer will trust you if you don't have the best team out there. And I saw that when I was an investor. This is the essence. This is the most important things for your first two years. And if you do that right, I can tell you that you are very, very likely to be successful. Then, obviously, what you need to do at the same time is to put in place a machine. You need to put in place a sales machine, a customer success machine, and you need to be able to understand what it takes to scale. So I would say that you need to stay agile and not go too fast. But at the same time, it's important to know that once your product is ready, you can launch it at scale. And for us, here, we actually brought along some fantastic execs actually from Facebook Workplace, the head of global business actually at Facebook Workplace that actually started to build the sales team on the head of customer success of Facebook Workplace that is also building the customer success team for us. So these were actually very important hire to put in place the machine. And then I would say that from an engineering and product perspective, it's always about raising the bar higher and higher and higher and thinking about who do you dream of hiring to actually make the most incredible product. And for us today, to give you an example, it's all about making sure that everyone can use pigment and it's all about the product and the design. And let's pause quickly on some of those hires because Julian from Facebook, I think he was there for seven years and Rebe was there for five years. And I think a lot of companies at your stage would have thought people of that caliber and of that talent would have been unattainable. But you managed to sell them and they were very excited about the mission. What are some of those key ingredients when you're trying to get those great people to join you at a very early stage when it's quite a risky proposition for them? Yeah, that's a very good question and it's also something I learned as an investor, I would say, is that sometimes we forget that we are all humans and we are actually here to make people convince them to spend the next 10 years with you. And it's one of the reasons I chose Ophelia as a partner is that I wanted to actually spend the next 10 years of my life working with Ophelia because I know how great she would be as a partner. And for me, it's the same with everyone we hire. It's like, yes, we are early. Yes, maybe we haven't realized not even 1% of our vision, but it doesn't matter. You are going to come for us, for who we are actually as people and you have to understand that we'll do this adventure together. And this is something you need to convey and it takes time. For some of our hires, it actually took us more than six months to hire them. And it's fine, it's absolutely fine. If you plan in advance, it will actually work really, really well to do it this way. And you should never compromise quality over speed. You should always think about who is the best talent at this point and put more than all of our energy to do that. So to give you another example, with all the talents that we hired, especially at the beginning, whether it's our first business person in the name of Gillon, Ben, our first product manager, our first designer, Renault, Mark, Seb, Etienne, Niko, et cetera, et cetera, all of our first engineers. They all came because they spent a lot of time talking to us, talking to our investors for some of them, talking to perhaps our first prospect, customers, et cetera. And that's what makes them come, is to see that we had a full ecosystem behind us. There's a very common saying about entrepreneurship. The highs are high and the lows are low. And I strongly believe that a lot of just being a great entrepreneur is having sheer determination and perseverance. But I don't think anything prepares you for those low moments or the hardships. Was that a surprise to you coming into being a founder and how did you learn how to deal with those moments? That's a very good question, but I had never had a law probably because I don't think I'm not a brain surgeon here. And so, in a way, I see pigment as just the best experience of my life, right? Like, every day I'm working with the best talents, trying to build an incredible product that will impact, hopefully at some point, billions of people. And so, in a way, for me, what's important is to realize that I'm so lucky to be in this situation and that even if something doesn't go right with pigment, it's clearly not the end of the world. And I'm always trying, as soon as we have a problem to find a solution in the next hour to that problem. So I would say that in a way, and this is what it takes to be an entrepreneur, is that you should never be depressed or sad with a law because this will happen every day. But I can tell you that if you always keep trying to learn with these lows, you will never, never, never be entrenched into something that put you in a sort of bad direction. I always think it's how you deal with them and go in the next day even brighter-minded. So let's change tack a bit. Hiring is also clearly integral to building a business, as is fundraising. Or now on the other side of the table, you've raised about $100 million from some of the world's best investors, Green Oaks, and I'll include Blossom in there as well. How did you think about picking your partners for each round and what that you learned from being an index informed your decisions about picking a partner both for the seed, the series A, and the series B? I think that's a very, very good question, and I think I can bring a lot of insight there because sometimes, especially today, as you probably all know, money is becoming more and more commodity in a way because obviously the market is high, and so I would say that it's very important to know who you are going to pick and to spend time with as person before actually engaging any further. And so for us, what was important again is to think ahead and say who do we actually want to spend the next 10 years of my life with and who can actually be an ally if there are some low moments at pigment, if things don't go right, people that can also bring things to the table such as a network, for instance, intros to the best company, intros to potential hires, intros to people that can be salt leaders for pigment, et cetera. And so I've always been thinking every time we did a round about what do I need for the next year or the next two years to actually be successful and is that person gonna bring that? But not only is that person is someone that I actually want to partner with forever. And I think sometimes founders make a mistake of picking a brand or picking evaluation, picking a specific term sheet. I would strongly not recommend to do that because I can tell you that the best investors anyway will give you the most reasonable term sheet and they will know what your company is worth and they will try to be as founder-friendly as possible. So what's important is really the person in front of you and also making sure that this person is here for the long run. And Ophelia was here for the long run, she created Blossom, she's a founder, I know she will stay there because that's also something that can happen is that her partner leaves and then you get someone else actually taking care of your company and that might actually harm the company in the long run. And you should never be afraid to negotiate as much as possible to get the person you want at the table. And you need to listen to what this person has done before. You need to do as many ref checks as possible with other founders to know as much as possible about how this partner actually behaves. And this is what we did for every round we actually mentioned to raise. And how did you take the time to get to know these partners or potential partners? Yeah, so I think obviously it's a two-way relationship. So what's important is actually when a partner wants to make an investment you should let him the opportunity to look at a full movie meaning that they shouldn't come.  That doesn't work. I mean, when you're on Tinder or whatever if you look for a date, it's not a one day. Like you need some time to know the person and to actually start thinking if you want to be with that person forever. So here it's pretty much the same. It's like you need to build a relationship early on.  Like because your time is very limited and it should be focused on your team and on customers. So you need to see how this person behave and how much he can bring before the round to the table. Is the person gonna actually intro me to the best companies of his portfolio to actually help me start something? Does he have an idea about someone I could recruit, et cetera? These are the things that are important. And I mean, you should really look for every single signal to see if something, you know, could look wrong in the relationship. So I think many founders forget that in the investor-founder relationship it's actually the founder that's the customer. And I joke with everyone that you're the one that works me the hardest because you know what to get out of your investors. Is that something that you learn during your time at INDEX and why is it, you know, exactly how to get the help? 100%. I saw actually the best founders getting a lot from investors. And I think, again, here, I mean, it's not about money.  So they know more than you on everything. They know more than you on go-to-market. They know more than you on what makes a great VP marketing. They know more than you on what it takes to close a deal. So you need to leverage them as much as possible.  But also, you need to push them as hard as you can to get the most out of them. And this is usually very much linked, as you know, to your network and to what you can bring to us. I think another thing that founders often forget to do is references. I mean, VCs always take references on founders that they're going to invest into, but talk us through your approach for how you reference the partners you're gonna choose. Yeah, so again, this is super, super, super key. You need to speak to founders of the portfolio that are working with that partner to understand really what the relationship is and how much this person can actually adapt to your own company and how will she behave and how this can actually play in the long run once again. And so here, you need to spend time. If you can speak to like 10 founders and understand what you need, do you need actually a partner that will leave you alone because you actually don't think you need help and it's fine and then maybe you just want someone that is already at 15 boards and what you care about is the brand and you want to have a great brand because it's important for your business. Maybe you want someone that is very hands-on that will help you with hiring. You need to think about that in advance and reflect that with founders, I believe. And you've just raised 75 million from Green Oaks and you did that, which I think will be great to tell the audience. You did that just after giving birth to twins. Tell us a bit about how you manage it all because that's quite phenomenal. Yeah, so my twins are actually six months old and I have to say that I'm so lucky actually to have twins because it really helps me prioritize today. And I think first of all, you know, I'm very happy to see that it's actually very easy if you do it right, if you're well-organized to run a business that obviously, you know, hopefully will become one of the most successful startup out there. And at the same time, I have a family. And what's important here is first of all, you know, to get surrounded by the right people. And I'm very lucky to be, you know, surrounded by a wonderful husband, a wonderful family. And I have helped, you know, coming from everywhere. But at the same time, it's important to pick your battles during the day. And it's important to actually review things, say no to things, you know, for instance, if an investor asks me to come visit him in San Francisco today, I will probably say no. Like you have to pick your battles. I came to slush because it's my favorite conference in the world, I have to say. And so I'm very happy to speak in front of you. But you know, I'm doing an in and out because I have a family now. And so during the day, it's the same. Every day I'm thinking, how can I be as impactful as possible in everything I do and everything I run?  It helps you keep hiring the best people for every single function. Is there anything that you've changed in your calendar since having the twins? I have to say that in a way, yes, and in a way, no. So I used to work really 24-7. And now, obviously, in my calendar, I'm blocking time, you know, morning, evening to actually enjoy my kids because it's just extraordinary to see them grow. But at the same time, you know, it doesn't prevent me to do everything that I need to do. Obviously, also the weekend is not much more about work but about, you know, taking care of the family. But actually, it's great. It really helps me take a step back and keep my feet, you know, in the ground and work there.   And so, you know, for me, it's the same. It's pretty obvious that I've always wanted to have kids at some point and I'm really lucky to have twins. But it's not a topic. My co-founder has three daughters, age between, let's say, two and 10. And, you know, no one asks him about that. And it works really well for him, too. As long as you are surrounded, I would say that, you know, it's fantastic to do both. So you have all this capital on the balance sheet now. What does 2022 look like for you? So for us, I do believe that with pigment, you know, we actually managed to prove that our product is already a no-brainer in the market because we, you know, we managed to win incredible deals with the best companies in the world.  And so now, obviously, the second step is about scale. And it's about, you know, showing to the world that, you know, we will become the number one leader and that we will be able to replace Excel for your sales planning, for your revenue planning, for managing your budget, your expenses, your workforce, et cetera. And so we want to do that as fast as we can by creating the best product, keeping hiring, obviously, the best team, the best designers, and also on the other side, obviously, accelerating from a sales perspective in Europe and in the US. So I think we have time for one more question. So what one last tip would you leave the audience with as you are now almost over two years into starting Pigment and you have a very bright future ahead of you, what would you leave the audience with? As a tip, you mean something? Yes. I would say, especially at the beginning, trust yourself. Trust yourself with everything you do because I tell you, I can tell you that really, I can see now the tipping points, now that we've signed the best logos and that we have managed to put together an amazing team. But I can tell you that every day, from the first day, you have to believe in yourself because everyone will make you doubt. You will talk to some prospect that will be like, oh, no, actually, I don't need a tool. And now that they see Pigment, they're like, this is what I need today, right? And so we really had to strongly believe in what we were doing in order to actually create Pigment. And this is the number one thing. The second, as I said, is the team focus on the quality of the team to build the best company out there. And I think if you have these two elements, you're good to go. And obviously the best partners. Wise words. Thank you so much. Thank you to everyone for listening. Thank you.