Octa developers, welcome back to our channel. I am Heather Downing and I'm here with my friend Brian Demers and we're going to introduce to you somebody pretty cool. Recently we had a hackathon for some of the new technology we have coming out here at Octa and we would love to introduce you to the winner of the hackathon. Brian tell us what is this hackathon exactly? Well we had a hackathon for some of our newer technology. Octa is introducing what we're branding as the Octa identity engine and that's more some newer features around policies and how a user logs in and we can get to that later but really what we're interested in today is we want to talk to Matthew McKenzie who is the winner of the hackathon with a great project called Goose Clip. So the name Goose Clip comes from GoOS and then Clipboard so it's origin is in a build command for the Go language. I'm a product developer at heart and I have a particular interest in technologies which have a positive impact so things like medical technology, education environment and in this particular case communication and collaboration technologies so Goose Clip kind of enables us to collaborate a bit more effectively because we have faster networks and more secure networks. The catch line is Goose Clip is pair to pair as a service which basically means it's a tool which can be utilized by other products to integrate pair to pair into their apps. Okay so peer to peer can we have like an example that you can compare certain apps to? Yeah I think we're all used to hearing about crypto and BitTorrent but I think some of the more unknown ones are things like Spotify and obviously Zoom and technologies like we're using at the moment are also using pair to pair. So pair to pair is fast, it's secure and it can greatly reduce costs so egress costs going through the the centralized server quickly can aggregate and for something like Spotify distributing their songs at the start of their company it would be quite expensive for a free tier software suite so they used pairs to distribute that music. I never really thought about how the technology behind Spotify worked I mean I use it almost every day and it's one of those things you know it's it's now the new radio right so whereas whatever 10 20 years ago you used to think about how the radio worked and it was just you know whatever FM versus AM and now now it's a whole other level of things to think about. The foundation story is basically based on pair to pair to what facilitated them to to build it. So how did you even come up with this idea when you were invited to try out something during the octahackathon? Actually the octahackathon itself which stimulated the idea so the idea of creating an authentication or authorization system for pair to pair was quite interesting. I think when you are creating a platform as a service that requires authorization you really don't want to start to control user repositories because companies don't want to give that up right like you don't want to give your user base to a software suite so I had to come up with a process to perform the authentication authorization without actually requiring admin access to the user store so all stimulated by the octahackathon. That's so cool. Did you have you were you working on goose clip before the hackathon or was this an idea in the back of your head or what was sort of the the genesis of this? Yeah so goose clip actually started out as something different so Go OS clipboard it was a clipboard synchronization tool.  Obviously people use a lot of Apple products they used to you copy on a clipboard and you can paste on your iPad for example but across operating systems that's not really the case so that was originally using gRPC which worked well on the local network but wasn't great for cross network stuff so I started moving towards P2P technology and I realized how outlandishly difficult it was. So I kind of thought that the P2P aspect of what I was building was actually probably more important than the original product so goose clip kind of evolved into the thing it is today. Very cool I really like how it started as a clipboard tool. I remember this was years ago but I've done this a couple times too where you play with a couple new technology stacks and you know clipboard is one of those foundational things that you use every day but the synchronization is terrible and even with some of the tools that are out there you know it's it's still frustrating and you know the network limitations and all of that so it's really cool that this is morphed into this more general thing. Yeah I think I ran across some code from Microsoft in 1970s it was pretty scary stuff. Yeah they're dealing with other mine types of different clipboard objects and that's a whole other thing you can go down. Has anybody else started using this too or you kept it all to yourself it's kind of like your own pet project? So no one's using it yet I'm building it out properly with like infrastructure's code and multiple environments and things like that. I used to be CTO of a company so the idea of building it properly from the start is quite important to me especially a product like this is where it should be security based. Very cool so jumping back to the hackathon of how you heard about this all together I want to call out already I showed the link earlier and we'll have the link in the description but really that your demo like even the product aside the demo blew us away all of the judges so I was one of the judges all of the judges hands down were like this demo was amazing so I mean I don't know you mean you could you could have probably just whipped up just the demo portion and impressed us but I you know you said there's some code too so it's all good but yeah so have you done a lot of hackathons in the past or is this or you just you know you like all this speaking and everything? This is my first hackathon got put onto it by a friend of mine but I've made videos before so I used to do a few YouTube videos at the inception of YouTube right when they weren't so professional but I got my premiere pro membership recently so I thought I'd better use it. No it was great we loved the whole the whole reel it was awesome. The intro was actually a bit of a joke so I say Goose Clip is as a P2P as a service and then she kind of sings yeah that's all good it's a hackathon too right you know the big thing is is sort of proving the point and then you know it's one of those things that I never really thought about as much until recently as the selling of the idea of the hackathon at the end is just as important if not more important than than the product itself because you still need to convey what you did clearly to people so there was anything that I've taken away is it's even the the presentation portion is even more important not only a time box but you you also have to have presentation skills I participated in several startup weekends where we had to come up with the whole thing architecture actually had to build it out then put together a demo reel as a whole I had like 48 hours to do it so hats off to you this is not easy for anybody who actually goes and takes it out for it to be done in this time my gosh you should be really proud of it. I think what you said Brian there is like you have to convey the entire story within a very short amount of time so Goose Clip is basically a library or a platform so in order to demonstrate it I had to build other products that use it so it was hard to convey that while I'm showing these products they're not necessarily the platform that we're talking about here it's the thing that's powering it all. Was this your first time working with any Octa products? It was as I said earlier I used to be CTO of a company so the idea of using Octa was quite familiar with compliance and stuff like that the requirement for SSO was quite important but I don't think we ever got quite got around to it but I knew of Octa and I knew it was kind of a global brand when it comes to this kind of stuff. So how did it actually work out this is remember this is new stuff that we're rolling out right so if you could be totally honest like what were the pros and cons of creating like a peer-to-peer app with Octa? Yeah I wouldn't say it's specific to peer-to-peer but I found the experience a mixed bag so it was really good to the documentation was obviously amazing and as a developer that's super important and the diversity and power of what you could do was amazing so I've not quite used an authentication platform like that before. I thought a few simple things were missing so things like regex kind of validation on custom fields didn't exist might be a feature in development still I know this is an early release and I found things like passwordless sign and I actually couldn't pull it off so it's a bit sad for me. It is a newer feature for sure there are definitely some things that we're enhancing as we go with it and so there's unfortunately a little bit of a trick to get it to go it depends on the situation so we are definitely revisiting our docs for that but this is the only way that we get better is if we actually ask people who are actively involved in trying to in your case like invent an application what their experience was so we would love to know anybody who's watching as well like what your experiences are with all of our new features that are coming out because there's a lot all at once we have like our entire engineering department has been doing so many different things it wasn't just one so feedback is the ultimate now have you added off the board to other apps or was it also your first experience with that too? Yeah I've made plenty of apps in my time internal tooling and things like that and obviously app apps for our phones but this is the first time with such a sophisticated suite I think. Yes was there a particular option I guess that you saw that really kind of struck you as more powerful that you didn't expect? I really well the only reason I could really create Goose Club was that you have really powerful custom claims injectors into the tokens so Goose Club actually works by extracting information from the tokens and then it creates a cryptographic hash of that information and stores it in its own lookup table so that's how I can do something like an at brian tag to pair discover between users so it's actually not storing any personal information about brian it's just storing a reduced hash which obviously can't be reversed. Oh yeah we have a like a hooks API as well that helps allows you to I guess kind of hitchhike some additional data into any token as well from an external source if you need to add a little bit more so that's something else that we're going to be coming out with samples for in the future too. Yeah that was useful so I used that with github for example to take the github user to create the again sorry brian but the app brian user tag within Goose Club so it automatically transformed those usernames across which was obviously great. I didn't know that so that's that's even a bigger bonus but the custom claims is definitely one of my one of my favorite features as you mentioned and I think it allows it removes a lot of the need for the storage portion right I mean you don't always want to store your data with a third party right so but but there's there's some decorative data that you can add to the octa side that can make you know your applications easier or you know some third parties so very cool. Is this something that you would consider being proprietary or more of an open source library? I'm a big fan of open source but I think at this stage proprietary just for the fact of security like until you get security audits and you know you really build this out and have a team of engineers on it I wouldn't obviously obfuscation it's not a great source of security but I think it takes a while to get to the point where I would feel safe to open source it if you know what I mean. I took a library through security audit last year I think it was at some point and it was different I've done through you know a whole bunch of internal audits at various companies but never through a third party so that it was a it was a unique experience so I can I can totally understand that. Were there any unique challenges that a developer who's never done a peer-to-peer application might run into when it comes to author I am? Well I think the thing with peer-to-peer is it's normally either anonymous or unauthenticated altogether so when you think about crypto it's anonymous and let's say something like BitTorrent it's unauthenticated I'm not verified that but basically you don't log in or confirm who you are but I think there's a whole world of technologies out there which could benefit from peer-to-peer which is authenticated so things like imagine zoom or again Spotify you want to be logged in and you want to know that you connected to the right people and I think we all remember the zoom bombing that happened a while ago we don't really want that to happen. The unique challenges I think the whole thing's quite unique I've not seen really a peer-to-peer as a service type thing before but it's definitely an interesting world I think it's an untapped world this authenticated and authorized peer-to-peer. Yeah I think the only thing that I've run into I mean I'm kind of big into crypto full disclosure but it is some of the services that are functioning like banks that also want to know who you are for tax purposes and so sometimes that and regulation as it comes down the line. Yeah I've seen some interesting authentication processes there like using a phone number for example it's obviously hashed and stored on the ledger but it allows you to similar things like this out-use attack referencing so you don't need those big addresses big crypto addresses so there's lots of interesting ways to get around this public or zero trust authentication. When it comes to how this sparked like our imagination when we were watching it to your point earlier that this peer-to-peer is kind of a little bit of an untapped area and I think it's only going to grow so is there something that in the future you really would like to also create maybe it's an additional app separate from this or do you see like a big future like to expand this offering? I don't want to confuse everyone but Goose Clip is actually more of a company name I think and Goose Link is the product that we the peer-to-peer is a service so it's a foundational product that allows you to build other products so within the hackathon video I built the Goose CLI so it's a tool built on Goose Link so you can see how you can start to build numerous different things I'm also building a game at the moment on that so I think it's as a foundational product it should facilitate loads of really really interesting products to evolve. How'd you come up with the name? Why Goose? It's actually something my mom said Goose Link she just got it wrong and I thought that was funny so usually everything is founded a little bit on a joke. Yeah naming things is usually you know that's the hardest problem right related to identity you know I know that you guys are both more into the crypto bits than I am but I really had a high hopes for things like identity-proofing like like Keybase and those types of tools but they got bought and sort of less funding over there I guess from now so I think it's really cool but I really like how things like Goose Clip can help sort of help bridge those gaps too as well as like you know I can authenticate you know with some other provider but I can use my tools you know like Goose Link or whatever you know with my third party applications and I don't have to worry about it. With Goose Clip and crypto as well I know this isn't exactly related but you could combine these two things where Goose Clip is like a distribution of content and crypto is almost the you can use smart contracts and stuff to let's say pass along decryption keys after a payment or you know something like that where you start to combine two worlds of peer-to-peck technologies and you can start to imagine quite powerful things emerging because crypto itself is not very good for large-scale distribution. Well I guess it depends on which one you choose for smart contracts. Do you have one in particular that seems to work better that you like? Oh shilling a crypto coin on YouTube. This is really from like a development standpoint like regardless of whatever you want to keep developing with the smart contract is really the question which one do you feel is a little easier in terms of integration? I really like Alrond which is a technology evolving out of Romania at the moment. The reason being that it's you can build with Wassum basically Wassum engines so you can compile any of your code to it and execute smart contracts you basically develop in any language but also they've kind of rebuilt everything to be internet scale so it's a third-gen network. The whole purpose of it being easy to access from people like us this is actually the company that does the phone number so they turn your phone number into a hero tag which allows you to send money without actually knowing your own address so I think it really makes it a lot easier to work with for just normal people and that's the next stage of crypto. I've seen someone say crypto at the moment is like Windows in 1970s you know like it's only for people who want to program off the back of a magazine or really get into the guts of a technology but it will become a more prolific technology eventually. I couldn't agree more I'm seeing a lot of options not just in you know banking and such like that but many different options for it and we're going to be asked I think developers are going to be expected to know how to interact with smart contracts so that it'll be that's my opinion of course sorry to nerd out on you Brian there. No it's all good I find this stuff fascinating I just I just haven't uh I haven't gotten into the hype yet you know I know it's important I know it will be important I think Matthew brings up a really great point about how when it be all when these things become more accessible right I feel like that's really when people can start to understand and sort of simplify these diagrams as opposed to just like you know every time I read about crypto it's well for one every time I read about crypto it's like you know the energy cost right and that's like that's a separate separate problem right but that's what everyone sort of fixates on but you know as far as well we're concerned with is more how do we actually use it right like how do I build things with it? How do we build things that aren't just finance based as well I think it's quite interesting I think that the energy problem has been solved with proof of stake so that's actually one of the main drivers behind me picking a certain technology so obviously yeah Bitcoin, Ethereum, Al, because they're not yet proof of stake but I think by creating technologies you can combine with let's say things like GooseClip and crypto you can start to create new things that aren't just let's trade money for money we can start to build real products that have real world applications that we're used to. I'm excited to hear about what you do next with this because I think you really get like new possibilities which is what we're looking for in the first place when it came to which entries in our hackathon like really would stand out is how do you not reinvent the same wheel how do you like invent teleportation you know let's forget about the wagon and what do we do next that hasn't been done and that's part of why we were so excited to be able to get to interview you today so thanks for coming on to our channel and doing this. Yeah so what's next for you Matthew? So I'm thinking to build out GooseClip as a proper platform so I think allowing users to create their own organizations to start to build with this in a secure way and see where it goes from there. Does that mean that anybody will be able to use it soon? It should be yes you know watch the GooseClip.com at the moment it's just a crappy little flutter single page app but you have any crowd funding for it so that you can afford to keep you know scaling it out? No I'm a bit of a bootstrap when it comes to development because I think once you once you get that funding in you kind of start the clock I've seen a few startups fail getting any kind of funding in so it's a pitfall I want to avoid. Well we're looking forward to seeing more of how this builds out. So I want to thank Matthew and Heather for joining us. Heather you did a great job asking all the questions I wish I wish I could ask questions this well too and of course Matthew great job on the hackathon entry we wish you the best of luck going forward and definitely keep us posted on how everything works out.


Jake, how do you feel about banks? I feel indifferent to banks. Okay, how about one they turned into a pub? Oh, that's progress. Yes. Do you know how to untar a file? No, I never remember. I see, I do. It's T-A-R-T-A-R. Dash and your arguments are X-Z-F. Okay. The way I have remembering this, and someone else taught me this, I think it's brilliant, is because you're untarring X-Z-F, X-Taxi files. It's perfect, right? You will never forget that now. No, I'm not going to forget that now. So I had to go and do some work on an older project of mine from some time ago. I'm so sorry. Right, exactly. I don't know if you've had this before where you come to some older code of your own and you're kind of looking through this project. Yes, and you have the Gandalf moment. I have no memory of this place. Exactly that. It just was like someone else had written it and they'd written it. Not very well. Like a wazik, mate. Yeah, it kind of made me feel that even on a project where I'm going to be the only contributor, or if I expect only me to be the only contributor, even then, maintainable code is so important. When I was at the BBC, we had a pattern which I really liked where before we even started on the implementation of a part of a library we were working on, we would first write the docs and we'd write them in line, which is kind of not entirely popular at the moment. But I still liked having the documentation really close to the code because when you were updating one, it reminded you to update the other. But the way we did it is if we were adding new functionality, we would write the docs first before any line of code that showed off the function signature, the arguments, what it returned. And that is the first thing we would code review. We would code review the documentation before any of the code. And one of the things that you would do as part of this is write examples of function usage. And it happened loads where as you were writing the examples, you're like, this isn't fit for purpose. Now I'm actually pretending to be a user of this function. This is actually really hard to use for the common stuff you use it for. Because it's not a particularly attractive part of coding, right?  I'd rather do the new exciting thing than kind of make sure that, you know, me six months from now could read this code. Well, have you ever coded something in a way that you kind of step back from it and you think, ah, this is only four lines now. I'm very, very smart. Yeah. I've actually seen this a lot. And it really, you know, it really bugs me actually because it's like, I've got, you know, four functions that do broadly related things. So what I did instead is I made this one mega function. Mega, not in terms of its quality, but just in terms of, you know, how it sort of, it bakes all those four ideas down into one thing and then you call it four different ways. I've got one function that actually produces the other function. It's almost become self-aware. The code is now writing itself. I am so smart. In many cases, just doing it the simple way, which might be a few lines extra, it might even be slower, but it's only worth, like, removing the maintainability if the benefit is worth it. Like, if that's a hot function, if that's going to be called a lot and the performance benefit's worth it. Yeah, absolutely. This is micro-optimization in some form there and it's not worth doing otherwise. I sometimes find that when I'm reading code for Python projects, I find their code really, really easy to read, even though I know JavaScript a whole lot better than I know Python. Pep 8. Pep 8. Do you think as a community, as a JavaScript community, we need to just swallow our pride with all of these different, like, techniques of, like, writing JavaScript and just, even if it's not, even if it's the one we all a little bit hate, we just, we have our own Pep 8. I think what you're tapping into is actually the cultural requirement. It can't just be, you can't codify maintainable standards. It actually has to be something that's baked into the people that are working on the code that they want to keep the technical debt low. They want to make it easy for themselves and for other people and the people who join the team to actually be able to sort of contribute. And I think that's, it's a crucially important thing. Maintainable code is just a better way of doing it. To the heroes, or unsung heroes of maintainable code. Cheers.


What's going on guys welcome back to the channel Critical Overlord here. So in this video I want to discuss what I believe the character of Trish Jenner has been up for the past 23 years since her previous encounter with the creeper now. The image that you see on screen is from the ending of Jeepers Creepers 3. Everyone who saw that movie in theaters whether you saw it on sci-fi network or whether you saw it when you bought it when it went straight to DVD. You know that at the end of the third film it jumps 23 years ahead and we have a cameo from Gina Phillips who reprises her role as Trish Jenner. She appears to be making a public service announcement of sorts. I don't know where she plans on posting this at. I'm assuming it's going up on some sort of social media platform but I wanted to kind of discuss what that ending tells me she's been up to for the past 23 years. I believe the character of Trish has been obsessing over the creeper ever since she lost her brother Dairy to it all those years ago. I believe she never she kind of probably blames herself a bit. She probably still regrets not letting the creeper take her or feeling helpless as she couldn't do anything to save her brother and her talking into a microphone kind of like what I'm doing right now and looks like she's given some sort of a public service announcement. I believe she is or she has been rallying anyone in the area where she's at I'm assuming she's still near the Poho County area or she is out of this out of that area and she's just now planning to go back to get vengeance on this thing that took her brother all those years ago because she is aware of the fact that it's about to reawaken and she knows that it's in the barn of a local farmer in the area. So maybe she doesn't live in the area anymore but she's still keeping tabs on this monster that's been consuming her life and she kind of suffers from a little bit of PTSD probably as well since she's obsessing over something that occurred 23 years ago and apparently it clearly affected her dramatically. But I think she's been rallying and building support and bringing awareness to the existence of this thing. Maybe she has people who doubt her think she's crazy. I consider playing like a similar role to what Jamie Lee Curtis played in Halloween 2018 but not as on the not as loony as I would say Laurie Strode was. I think Trish would appear much more sane because that's how she appeared at the end of the third film of course they can go that route and have her be a bit unhinged as a result of what happened and her wanting to keep everyone around her safe so that nothing else happens to her family as a result of this entity that she still has no idea what it is. It just took her brother and he was just gone and she felt completely helpless in that situation just watching her brother get taken like that. That ending still to this day the ending of the first film always makes me feel a little bit upset and a little bit sad for the character of Trish because it's like that's just something that I wouldn't want to go through myself and of course that's something that you wouldn't think you would have to see walking in the face of this earth. That's just something crazy to imagine happening. Something that is just terrorizing you and your brother for seemingly no reason in your perspective and then you have no way of stopping this thing and then you end up losing a sibling to this thing and you're helpless as to do anything against it. So I always feel a little bit sad for the character of Trish but for the past 23 years I think she's been rallying a little bit of a movement against the creeper. She's been bringing awareness to his existence.  Maybe she's gotten in contact with the parents of Kenny Brandon. Maybe Darla. Maybe Darla's family were contacted and she told them what happened to Darla. She brought them on and maybe she's gotten them on her side and now she's going to take them. She's going to take probably Sergeant Tubbs. A few other people who may have encountered this thing or think they know what she's talking about or who have seen this thing in the barn and recognized it because they lost someone to it several years ago or they know of someone who lost someone to it many years ago. I think she's rallying. She's getting a community together and they're going to team up and they're going to take this thing out once and for all.  Been terrorizing this highway in the counties that ride along or exist alongside that East 9 highway. It's been terrorizing this this community for several decades and they're tired of it and they're going to take a stand against the creeper once and for all. I think that's what the character of Trish Jenner has been up to. I'm looking forward to see what actually happens if the fourth film does get made. Gina Phillips did state in an interview that Victor Salva already wrote what happened with Trish in between the second film and what's going to happen in the fourth film that's already written. So if we ever get to see that that's completely left up to Victor Salva at this point. But let me know down in the comment section below what you guys think about this. What do you think the character of Trish has been up to? If you haven't already make sure to subscribe and turn on post notifications so you never miss a video. In the description I'll have links on my social media accounts on my Facebook, Twitter and Instagram. You can message me there to let me know if there's any movies, news or reviews you would like me to cover in the future. All that in mind guys I will see you in the next video.


Depression affects many of us around the globe. According to the World Health Organization, 300 million people of all ages battle with it.  It's difficult to catch during the early stages, and most of us realize we have depression when we're deep in the grips of it. Those with this mental disorder feel hopeless, empty or sad, fatigued, irritable and restless. Depression not only takes your motivation away, but you can have problems concentrating and making decisions. Those of us with this disorder can act in ways that will worsen the situation. Here's a list of 10 things depression makes you do. One, isolating yourself. Individuals with depression isolate themselves for different reasons. Some will keep to themselves because they feel overwhelmed socializing, and others believe it's better to be alone. In other cases, the person may feel so much self-hatred that they prefer to not interact with people. Those with severe depression may even stay in their house for weeks. Two, being disorganized. Depression leaves you feeling exhausted, so cleaning your room or home becomes an endeavor.  It becomes an even bigger physical challenge to walk around your room because everything is on the floor. Living in a cluttered place leaves you feeling uneasy, but the lack of energy doesn't help. Three, poor hygiene. Depression zaps all your energy.  Those without depression may see this behavior as lazy, but the truth is showering or changing into clean clothes is exhausting and painful at times. Four, struggling with sleep. Depression affects your sleeping schedule. Some of you may stay up and sleep very little. It keeps you up with your intrusive, unwanted thoughts. These may end up making you feel anxious all through the night. In other cases, some of you will sleep excessively and still feel unrested. Five, catastrophizing every situation. Depression plays tricks on your mind, making you believe negative things. It can get to a point where you're constantly looking out for bad things to reassure your pessimistic thinking. Every time something bad happens, you use it as evidence to prove how bad life is. This slippery slope makes it difficult to see life under a brighter light. Six, terrible eating habits. Those with depression will either eat too much or hardly anything at all. Some of you may find yourself in the kitchen eating everything in sight, trying to eat away the emptiness or sadness you're feeling while others don't have an appetite and may even feel disgusted by food. In other cases, some of you may feel so exhausted that the thought of preparing a meal is overwhelming. Seven, lack of motivation. Depression steals your interests and desires right from under you. Your favorite pastimes and hobbies no longer satisfy you. Slowly you find yourself feeling dead and numb inside. If you aren't careful, you'll end up staying in bed all day. Eight, evading your problems. Depression by itself is overwhelming. You can feel devastated and out of control most days, so trying to face situations and problems head on is difficult enough. Instead, you ignore or set the problem aside and this in turn can bring trouble because it will continue to pile up. Nine, feeling guilty and feeling self-hatred. If you allow depression to take over your thoughts, then you'll most likely feel self-hatred. You'll continue to talk down to yourself and this often leads to the development of self-esteem issues along with poor self-image. Eventually you'll believe you aren't worth it anymore and some people with this mental disorder can even feel guilt by thinking all their problems are their fault. And 10, living in fear. People with depression fear that terrible things will happen to them. In severe cases, some of you will sabotage a good situation believing that it will turn bad. Other times individuals will reject opportunities and stop pursuing their dreams. It's a twisted way to protect yourself because this prevents you from living and achieving amazing things. Depression affects us in different ways. A list mentioned in this video contains some of the common behaviors those with the disorder have. Do you agree with these points? What other behaviors have you noticed? Let us know in the comment section below.


Hello and welcome to our talk top-down and bottom-up exploiting vulnerabilities in the ulti cloud era Before we begin, let's talk a little bit about who we are so My name is Sharon Brazil of I'm a vulnerability team risk vulnerability research team lead at Clarity and with me is Uricats our senior security researcher at Clarity and we're part of the team that Researching and trying to find vulnerabilities in all the equipment so you can see in our background and In the picture in front of you our cool lab. This is our playground that where we're trying to find and exploit vulnerabilities We're working with different vendors to find vulnerabilities disclose the vulnerabilities to the vendors and Basically what we are working with them to fix any security issues that we're finding and Eventually, we're Publishing our research on the vulnerabilities that we're finding so you can see the table in front of you of some of the vulnerability that we found in Many of the ICS vendors. We're also participating in different competitions We've participated in poem to own in 2020. We've participated in Defcon ICS CTF and where we won the first place and we're doing and conducting lots of research and competitions in those areas so With that we would like to discuss today a little bit about SCADA infrastructure and the cloud so we would like to Describe what it means of ICS security in the cloud what it means to have infrastructure in the cloud and how can devices ICS devices and all the equipment can communicate with Cloud infrastructure outside the parameter and outside the OT network. So let's start with What is a typical SCADA infrastructure so we have the Purdue model as you're all aware of We have in a couple of layers that in each layer we have different devices with different capabilities and roles in the lowest level in level zero we have a field devices field devices or actuators and sensors They are communicating. They're sensing and Doing actual and physical work in our world above that we have PLC's so we have the brains PLC's and RTU's and above that we have HMI's and Engineering stations that are controlling and interacting with the PLC's so for example if I would like to download code to the PLC I would use engineering station to program The logic and transfer it to the PLC In which the PLC will The adjust the logic will execute the logic and control the field devices the sensors and the actuators So if we're taking this image or the Purdue model to be very concise we can see here just engineering station and the HMI communicating and interacting with PLC's and the PLC's are connected to valves in this example and The PLC's are actually doing something physical Sorry the valves are doing something physical in our world where the PLC's are controlling those valves and Humans the engineers still parators are controlling the PLC's through the engineering station and HMI the engineering station is meant for programming and configuration Mostly while the HMI is mostly for data acquisition and for the engineers to understand What's going on within the process? so if we're We're for taking this further today. There is Huge trend to move everything to the cloud It started with IT infrastructure servers are no longer physical boxes They're kind of a server somewhere in the cloud and it's starting to Get into the ICS and OT networks too and we're seeing more and more devices starting to be controlled and Managed by cloud-based infrastructure and we're also seeing this through cloud-based Cloud-based SCADA infrastructure as well. So Why do people want to move to the cloud? There are a couple of reasons first of all telemetry so All the devices are transmitting telemetry always to the cloud So it's very easy to control and understand what's going on in all of the devices There are nice dashboards and trends and graphs So it's easier to understand what's going on in terms of telemetry and logs The management of logic can be done through the cloud So usually there is a console management that you can go into and Manage all of the devices that are being controlled by the the cloud infrastructure Which means we can download logic through the cloud to all the devices at once. So it's very easy setup We can have lots of diagnostics and troubleshooting because everything is connected to the cloud You don't need to be inside the network You can be somewhere in the internet just go online to the website the console management that is exposed to the internet and Diagnose and do some troubleshooting get all the logs and manage the The fingers manage the logic of the devices and control the devices Remotely without the need to be physically inside the network and obvious obviously It's a centralized view of processes and redundancy. So when we're talking about cloud-based infrastructure, we're we're usually Talking about lots of instances in different regions So we have lots of redundancy and we can control and manage all of the devices that are directly connected to the cloud so if we're taking this a bit further and We're Re-evaluating the new Purdue model. So basically it's all broken. We don't have these layers anymore because all the PLC's And when we're talking about ICS infrastructure that is connected to the cloud all the PLC's all the HMI's all The engineering stations are basically controlled and managed through the cloud So there is no longer a need for the Purdue module because everything is connected and managed Through the cloud all the PLC's are connected to the cloud from one side and the cloud or the management Console which is basically a website in the cloud of which engineers operators administrators Can log in to the internet in to the web page in the internet somewhere in the cloud we're seeing and Control and manage these devices. So if we're re-evaluating the The little screenshot that we've seen before so the engineering the HMI and the PLC now We don't need to be in the same network because the PLC's are connected directly Outside to the parameter connected directly to the cloud, which is a server somewhere somewhere in one of the cloud providers such as AWS, Azure or Google computer GCP so we're having the functionality of the HMI and the engineering Provided through the console management in the cloud where engineers can just go online to one of the websites and Manage the devices that are controlled by the Management console and the scatter infrastructure through the cloud So everything is much easier for engineers and asset owners because now they can control all of the equipment Through the cloud which means through the internet and they don't have to be physically present inside of the network So what kind of roles do we have with this kind of new infrastructures? So we have the same old roles such as programmers that are writing the logic We have management which are kind of the People are managing the OT managers that are managing the operations and managing the process So they're doing kind of view reports with kind of HMI functionality or device commissioning when they're buying the devices And we're also having the administration level which is responsible for creating the accounts and they're responsible for security So all of these different roles are communicating To the cloud-based management console. So they're communicating with the management console somewhere in the cloud basically and usually it's a website where they can go online log in and then Depending the functionality they can program they can upload Program or logic to be transferred to the end device to the edge device or they can view reports It's kind of a HMI screen. You would say or Do some kind of administration processes such as creating new accounts for engineers or OT managers or Fix permissions and policy for other users. So all of these world roles or different personas in in This infrastructure are communicating with one Entity which is the cloud-based management console and everything from there is flowing To the PLCs or to the end devices which can be other devices than PLCs and control and Manage these end devices through the management console So this is the new era where everything is connected directly to the internet and there is no no longer need for VPN accesses or other kind of Being physically present inside the OT network. This is the modern era now, let's we want to give you an example because All we said up until now is kind of abstract their PLCs and devices connected to a cloud-based management console and we have Engineers communicating with this console to control the end devices, but let's give a Real example and we have Codesys. So Codesys is European company It's a it's a great Fendall. We're working closely with and they're developing Their development system which enables programming and configurations of PLCs So you can you can use their platform to create logic and download this logic to the PLCs the PLCs are usually running the Codesys runtime, which analyzes and dissect the logic that you the engineers are writing using the Codesys development system and The PLC using the Codesys runtime can execute the logic to control field devices Such as actuators and sensors. There is a variety of PLCs and vendors that are using Codesys as part of their runtime Engine so we have WAGO and we have ABB AC 500 with PLCnext and then many more and Codesys can even run on Raspberry Pi and And other platforms as well. So here is an example of Codesys IDE As you can see It's kind of a basic idea where you have the target the PLC target and you have The IDE interface where you can write the logic. It can be a ladder diagram where it can be structure text or other ICS related programming languages and you can compile the logic and transfer it to the Codesys runtime Which it sits on one of the supported PLCs and platforms. So this is a Codesys IDE and Codesys development system. Now Codesys took this one step further and Created their own automation server. So instead of managing PLCs back-to-back kind of with The necessity to be in the same network. They've created the Codesys automation server which allows Codesys supported devices to be connected to a centralized cloud-based management console where asset owners can manage PLCs remotely So basically they can just like we discussed previously they can manage and Control all of the supported PLCs remotely through the cloud for every instance every every device that is linked and associated with the cloud and Codesys are providing lots of features above this cloud platform So basically they're offering HMI capabilities with their with their WebVisual platform. So basically you can create screens that that you can see through the A kind of a nice GUI of what's going on in the process because the PLC is Sending telemetry and data all the time to the cloud. So you can visualize all the process Using their webVisual features and you can also use their kind of engineering working station capabilities to create logic using using their IDE transfer it to the cloud-based platform Which is the automation server and download the logic and configuration to all the connected PLCs again everything through the internet so basically when you're Setting up your account in Codesys automation server you will receive your own AWS based instance and you can see here an example of such an instance and this is a Personal instance for each account that you can just go online to this instance and control all the associated Linked devices. So let's see an example real quick Here is an example to devices that are being controlled through this platform So basically what you're seeing here is a website somewhere in the internet using one of the instances that Codesys created for the account and You have all your linked devices To control so you can go in into one of the devices and do a download logic You can change configuration You can change settings on these devices and everything will be Transferred and downloaded to the PLC because the PLC is directly connected to the cloud platform Now Codesys took this even one step further and created the Codesys store So basically it's like the Apple store or the Google Play Store where you can download applications But just for your code and your process So basically you can download examples of already created applications or you can download libraries or you can download Clients that will be run on the PLC and you can use the store to accelerate the development cycle and Use code that other people wrote without inventing the wheel. So if someone else wrote the code to Process some kind of a mathematical Algorithm so you can just download the the library that he created and maybe pay for this if they're selling this With by money or not or you can download for free if The developers are offering this for free, but the basic idea is the same you can just As a developer you can offer your own code or libraries or programs that others can download and use in their projects So this is an example of AWS IoT core client that is being offered for free as you can see here And other developers and asset owners can download and use this library for free to integrate their PLC with AWS IoT platform and The final feature that we want to discuss Regarding Codesys is the web vision. So it's visualization Kind of a HMI in the internet browser via HTML 5 so we can create all these kind of different screens To interact with so basically the PLC's that are linked to the cloud are sending telemetry and data all the time about trends about tags about any anything that was configured in the logic and You can create screens that will take off the aggregated data to present In a very nicely presented view and gooey just like a normal HMI Just in the cloud just in a screen That is based on HTML 5 and it's very easy to control and create nice screens that anyone can access with the proper ACLs so We have engineering working station and we have HMI and we even have the Codesys Store to create download applications and we have every all these services in one platform That is connected through the cloud through the internet and all the connected PLC's can be managed to control and Present information everything directly through the internet. So this is a great example To what we discussed earlier now. We wouldn't like to discuss a wago. So wago is a German company European and company They have two main product PLC products, which are the 750 and 750 exterior and the PFC series PFC 100 and PFC 200 We mainly focused on PFC 100 and 200 and this is an example for a PLC that is Linux based and It is running the Codesys runtime so it has a great integration with Codesys and All the great features that I mentioned earlier can be used with the wago so basically wago runs the Codesys runtime and The Codesys runtime can communicate with other Codesys related platforms and systems So this means that we can control our wago PFC 100 200 using Codesys automation server and basically manage all of our wago PLC's through the cloud So the wago PFC 100 and 200 is a is a basic PLC It runs it has lots of functionality that most of PLC's Contained these days support of all standard field bus protocols and Ethernet standards such as profit bus mod bus profit Ethernet etc. And it has lots of interfaces such as RS485 and RS232 and As I've mentioned it is running The Codesys runtime, which means it has great integration with all the Codesys platforms And even the programming can be done through Codesys and we will show you a couple of examples very soon So let's take a look at how the attack surface is changed after moving through the cloud And to do that we first need to understand what attackers are trying to achieve and it's pretty easy in the ICS world Attackers are either trying to gain money or to cause damage and Attackers reaching an OT network have a few options They can start by shutting down equipment randomly stopping PLC's and This is sometimes effective and really noisy More complex attackers will try to modify parameters And that requires a bit more knowledge about the operation itself and knowing what to change Another thing we can we see is Attackers wiping data and gripping data and this is mostly for money. We see that in the latest transfer attacks So Our traditional ICS attack looks like is the first attackers need to Bypass many protections and firewalls to even reach the OT network and Even if they reach a computer inside the network, they have some challenges most of the equipment is Backed up or has redundant equipment to take its place. So if an attacker stops one PLC the redundant redundant one will start working and There are also many safety checks along the way. So attackers really need to have a good Coverage of over the OT network in a in order to really cause damage in cloud attacks The thing that separates attackers from the OT network is usually just username and password and when attackers Gain access to a cloud. They have a full view of the operation and can instantly modify parameters and Change values in PLCs In our research we developed two main methodologies for cloud attacks The top down and the bottom up the top down starts with attacking an engineering station Then going up to the cloud and attacking all of the managed PLC The bottom up attack starts with the PLC Then we climb away up the cloud to take control over the entire operation So let's start with the bottom up attack we use the Wago device to demonstrate this attack and Wago devices have a configuration port open on port 6626 and this is used for the initial configuration like setting their hostname or subnet for the device This port remains open after the initial configuration, which gives us a big attack surface So we found two vulnerabilities in the IO checkt process And a shared memory overflow and the stock buffer flow Let's start with the shared memory overflow The IO checkt has a white register command which writes to a certain memory location and this is limited by the count parameter We found out that that the count parameter is checked for every table that you can write for except for table 99 Which is also Stored in the shared memory region So we were actually able to use the white register command to write more than the size of table 99 and Overflow it into another memory region And the memory region is in the shared memory. So by itself, this is not that useful The second vulnerability we found is in the Response for the read variable command The read variable command assumes that the maximum size is 1400 bytes and this is the maximum count This is the maximum count size But if we are able to write more than 1400 bytes, we are able to Read more than that. So the read register command for table 99 can return more than 1400 bytes and copy that to the stack buffer of the response and In that way, we can write our payload using the write register command and While reading it with the read register command overflow the buffer with our payload So this is the output of a script that runs the full remote code execution So after we got our remote code execution, we started looking for ways to get up to the cloud and We discovered the code sees a web-visual option This option. Let's you write the JavaScript and HTML pages on the PLC and present them remotely This option is also open from the cloud, which means that any Operator of view in it will have a cloud cookie So if you have control over the PLC itself and We can change the JavaScript for example We can change it to get the cookie from the person unit and Create a user for the cloud where we control the username and the password So this gives us a new user in our control in the cloud So let's chain it all together. We start with a read and write register buffer overflow That gains us remote code execution on the rubble PLC then we change the JavaScript to Create a new user in the cloud and we use that cloud to take over the entire operation so starting from PLC and Going up to the cloud and using that to Manage and control the entire operation the second method we developed is the top-down attack the top-down approach starts with targeting and engineering station and We decided to look at the code sys packages Packages are just normal zip files, which contains dependencies and sometimes even dealers We discovered that those packages are not signed and we can change them to contain our malicious code So we actually made a package That when an engineer installs that would get his code credentials from the engineering station and send it back to us So once we have access to the cloud we can change run modes of the PLC is Stop them or even a change process values But the holy grail of attacks is to actually run native code on the PLC is This is not yet published so we can't speak about details here but we actually managed to Run native code on the waggle PLCs from the cloud So once we have the cloud credentials We were able to execute code on all of the PLCs in the operation So a quick recap on the top-down attack We create a malicious package uploaded to the code sys store operators install this package and The cloud credentials of the operators are sent back to us then we can do whatever we want with the With the operation and we can stop PLCs. We can run code. We can do anything we want with the operation So starting from an engineer Moving to the cloud and then to all of the devices in the operation That's it for today. Thank you everyone who attended our talk in Defcon 29 ICS Village We hope you enjoyed our talk about attacking cloud-based infrastructure in ICS and If you have any questions now, it's the time. Thank you very much


to the speed of light, a cloud of dust, and a hearty high old silver, the Lowl Ranger. The gold rush of 49 brought the first gradient flux of settlers into the western United States. And for many years afterward, gold was the one thought in the minds of the immigrants. The rich soil and grazing land meant nothing to them. But the mass threat of the plains was able to vision the future of the new country more clearly. It was he who persuaded the men who came as prospectors to remain as farmers and cattlemen. It was he more than any other man who made possible the winning of the west. Returning with us now are those thrilling days of yesteryear. From out of the past come the sudden whoop-beats of the great horse silver. The Lowl Ranger rides again. Hello, Silver! We're just a hurry! Come and play in the... High on a hilltop, the Lowl Ranger and Tonto had rained in their great stallions. Below them stretched the valley, a wide green plain, cut by a river that sparkled under the summer sun. Look, Himasavi, you should search from one end of the west to the other and never find better soil. And you'll find right there. One day on those miles will be divided into farms. There fell already. Those caverns below us? The people in those caverns are perfect examples of the men and women who seek wealth everywhere except where it exists. Right at their feet. What do you mean? I'm crying about them back at Mayville. They're farmers and their families from the east and the middle west. But it wasn't the opportunity to get sheep land that brought them here. They came only for gold. They took out homesteads there in the valley because it gave them easy access to water. They filed on the homesteads themselves because they didn't want others to come along later and claim that site. But it's not the valley they're interested in. It's those hills to the west that have been prospecting those hills for months, even the women. Or at least those who haven't children too young to be left alone. They locate gold, it'll be a miracle. The mere willingness to search for what isn't enough, you need experience and the proper equipment. They might stumble over a dozen rich grains and never recognize them. Not right. Well, all the time, if they'd only realize it, they'd make themselves prosperous just by farming the land they'd already held title to. Then he'd be cool. Very human, cameos, I mean. And so is the other man's game that seems to promise wealth. Never your own. You shouldn't say hard, high, bone, best pony. Exactly. Well, Senator, we better be riding on. When we're coming back this way in a few weeks, why do that? Sooner or later, they're going to awaken to the fact that gold isn't as ploddyful and as easily found as they were led to believe. When that happens, they'll face a choice. They turn to their old homes or live here on different terms. You think they'll leave? I think they will. But if they'd remain, they'd give the west what it needs most of all. Honest, hard-working citizens, building a prosperous community. That'd be a good thing. And if we must have them, we'd do all that we can to bring it about. Come on. Get them up, Skull! There's a long range of prophesies. The men and the women in the valley failed in their search for gold. It was a discouraged group that gathered in Zeke's cottage cabin one night. Besides Zeke himself, there were his wife Martha and the younger couple. Tal and Laura Munson, their nearest neighbors. Two others were present, men who did not belong to the little community. The owner was known as Stade Wiley and his companion simply as Jake. Gold was the one topic of conversation, but the Zeke put a stop to it. No, folks, ain't no use. It was just a pack of fools to come here. Where gold's been found, it's all took up. And that it ain't been, it'll take smarter folks in us to locate.  Have you, Martha? I think so, Laura. They'll know what else to do. What are you and Kel planning on? Hmm, ain't exactly made up our minds yet, ma'am. Ain't still hoping to find gold, are you, Kel? No, wouldn't say that, Zeke. But I've been wondering if maybe it wouldn't be the wisest thing to do to stay on even without the gold. Why? Tell them about the taters you planted, Laura. Taters? That's enough to do us. Calum, my family don't think it's a meal unless me have taters on the table enough. So I thought I'd just see how they do. What happened? Oh my, when I dug them up, I could scarcely believe my eyes. Twice as big as they ever grew back home. And, Keith, where have you never had anything else to do in all your born days? It's a lie. What do you think of that, Zeke? What do I think? We're in a last to just one thing. Taters? Anything else when there's no place to sell them? Yeah. Didn't think of that. Then you'd better. Farmers no good unless you've got a market. What do you say, Spade? You never farmed a record, but I guess you do good with me there. Rise, you are, Zeke. I don't want to discourage you folks none, but if me and Jake was in your fix, I'd like a red hustle of where we'd come from. Yes, sir. You fellas was just about raised in the West, wasn't you? Well, don't you think some day farming a tearfella?  Not a chance.  But, Jake, I was thinking... No, I've been here quite a spell. In all them years, the number of folks living out West ain't even doubled yet. That is, when the girls all been dug up and the last of the buffalo killed and the beaver gone, I'm willing to bet no whites will stay on. They'll let the Indians take over again. This will just be a kind of a desert. And it sounds like sense to me, though. Thanks. And thanks for helping us try to find gold. Oh, that's all right. Me and Jake were glad to do it. I'd like to help our folks to don't know the ropes. We're just sorry we couldn't help you and make you chillin'. We're just the same. It was mighty decent to you fellas. And a danger to you. We're together. How's he? You really think you're post-hate, sir? Yes, sir. How about the other folks? I don't reckon we'll all do the same. I ain't heard nobody but Cal here mentioned they wanted to stay on. I just thought they'd do it, Cal. Sure, I know. You just didn't think things all the way out. Uh-huh. You'd soon have been sorry if you'd stayed. Well, Laura, then that means you'll go when we do. Of course. Sammy can get the school and back heat so he can get here. Laura, you'll find you'll be better off in every way. I see we ought to get ready to travel soon as we can. I'll talk to the others. That'll be a sorry day for us, folks. You can leave and enjoy it knowing you. It'll be lonesome when you're gone. I could wheel head over Texas way. Well, stay. Let's be gettin' back to camp, huh? Yeah, we are. We are. Seema, if you'd seen him like I done, you'd be excited, too. What'd you see, lad? Two real outlaws. I know there was outlaws. The one with the red skin, but the other was masked. It covered his face like this. Seema, just like this. Outlaws. I reckon that settles it. When outlaws start to come, I see it's time for us to go. Well, we'll be moving along, folks. We'll be seeing you again before you leave. Goodbye, Seema. Goodbye. So they're leaving. And they thank us for taking them where we knew Doggone well they weren't gold. When are we headin' for Texas, please? Texas? Who said anything about gold in there?  It was the next day that the Lone Ranger rode into the secret camp he shared with Tonto. Hold this over. Hold this over. Tonto is lucky we did return. And trouble? I'm troublein' the ordinary way, Tonto. But those homesteaders are doing what I predict that they would. They're making money to return to the East. How you know? I met a trapper who left the hills for Maybill. He stopped overnight with him. I don't think so. I can understand that this apartment had not found any gold. I can understand why they might wish to return to their old homes. But there's one thing I can't understand. What that? My two fellows called Spade Wally and Jake are so interested in that departure. Me nor Spade. I want that trapper gathered. It seems that Spade and Jake have been spending quite a bit of time with those homesteaders. They've gone with the men to the hills enough to help those people. Maybe. They represented themselves as many experienced in prospecting. That trapper said he saw a sign that showed they'd taken those homesteaders into reflection where any prospecter would know gold couldn't be found. That's deep saying. He didn't mention it to the homesteaders themselves because he could see they thought a great deal of Spade and Jake. He started it with none of his business. Maybe it wasn't. But we're going to make it ours. Better than anyone. Right now. But the minute it gets dark. That evening Zeke and his wife adjusted themselves for their evening meal and the door of their cabin burst open. What the... Don't remain on-site and watch the horses. How to do it? He's the outlaw of chemistry. You'll get us to that. I need to be tempted to reach for that rifle. What do you want? I want nothing. I'll talk with you. I'll talk with me. Strangely, I don't waste words with cooks. You get out of my house. Please, you'll get mad if you do something terrible. Neither of you will be harmed this time. You have my word for that. Zeke, you might as well make up your mind to talk willingly because I'm not leaving until you do. What do you want out of me? One good reason why you and your neighbor should pack up and return to the east. You're right in the center of a new homesteaded here. You could title the soil that had never been cloud. Soil that'll drill anything. We didn't come out here to farm. I know that. We came for gold and there's none to be had. So we're heading back where we come from. To return to farms that were worked out years ago. To return to a crowded territory where you'll pay good money for land not worth a fraction of this, which you can have for nothing. What if we can? What goods are to us? Like I told my neighbor yesterday. What do you want money for? And that's a fool question to ask, isn't it? You can raise all the food you need as plenty of wood for fuel. As for clothing, if you can't make yourself, you can get by part-time. Any storekeeper would be glad to say it's rare for the things you could raise. Even so, it won't always be like that. One later will be a hundred men and women and it's different for everyone who's here now. You will have a market. You will have as good a market as a man could want. I've been told different bachelors that know a heap more about it than you do, I bet you. Yes. And they say folks are even, not common. It's getting worse, not better. Who told you that? Oh, you wouldn't know them. I asked you a question. Well, if you had to know, two fellows that were raised in the west stayed while his partner's here. Oh, sure. You know them? No, but I've heard of them. Well, if you have, I kind of think I'd rather take their words. I agree. And you're still determined to leave. I don't know your gains, danger, but whatever it is, it won't work.  You say you are. But I doubt that you will. Let's go, son. What can I say? He and the others are going on. There's just one way we can stop them. How about running while Jake and Spade want them to leave? Now to continue our story. After leaving Zeke got his cabin, the lonely Ranger and Tonto did not return to camp. They traveled west for two miles, and then suddenly the masked man pointed ahead. I can't fire Kimosabi. He's leaving. Hold it. Hold it. Well, Jake and Spade. That's a camp. I think we'll do a little investigating. What do you mean? I don't know, but since then we're off to the left. Yeah, I mean no place. Well, then mightn't that a royal? We'll have cover enough to approach them without being seen. Maybe we can hear them talk when I believe no one's around. We'll find out what we have to know. That's full of IDs. Let's head to that a royal. Easy, son. We can't risk being hurt. Get him up to the scalp. Come on, old fellow. The lonely Ranger and Tonto suddenly approached Jake and Spade's campfire. In a better part of an hour, and then stole back their horses, he returned to camp. During the next few days, the homesteaders devoted all their time to making ready for the journey east. Foods were packed, wagons were prepared, and supplies gathered and loaded. Finally, all was in readiness, and early one bright morning, the homesteaders gathered for the start. Zeke standing beside his wagon caught side of Jake and Spade and tailed the two men. Come here. Where? See, you've got your bedroll strapped to your saddle. Oh, Lord, oh, Lord, oh, Lord. You fell it pulling out right away. Yes, as soon as we'll see you folks off, Zeke. Howdy, ma'am. Good morning. After you get started, are you, ma'am? Oh, my, yes. I'll be so glad when we're on the way. Just getting ready has been terrible wearing. Oh, I get it has, ma'am. Well, Zeke comes kind of hard, but if you hadn't used enough leaving right away for Texas, I don't suppose you'll ever meet up again. No, no, I reckon we will. But if you're ever near Zane's here, you'll just have to let us know. That's your home? That's where we're used to live? I reckon that's where we'll end up. Don't want to rush it, but I think your friends are already waiting on you. So they are. All set, folks? Well, we're going right now. When I start up, I can follow. Oh, here, ma'am. I'll help you out. Hand me the whip, honey. Yes, ma'am. Thanks. Well, Spade, here's where we have to say goodbye. Hope we meet somewhere else sometime. That goes for you too, Jake. Bye, folks. Get up there. No, Spade. Well, Spade, where the room would last? Yeah. Now what? Wiggle it out of sight, and get rid of that federal right for the boys. Elements safe for shorter cells, and hope centers are left, and work taken over. Right. Hello, what is this? Hope. What do you mean, the homestead? What about Jake and Spade? What are they doing? Jake, ride. Other punters, stay good. What do you do now? What we heard this fella say the other night. How do their friends must be a good distance from here? Not price. Well, we'll give them a chance to get to the valley and make themselves at home. Then we'll stop the homesteaders. That's good. They're going back to the valley. When they get there, how do things will start happening? Until that day, the homesteaders headed eastward, making camp just before night. They resumed their journey early the next morning, with zeke-cutter wagons still in the lead.   Get along with ya! That's a little more of a thing. I'm all right. You ain't said much this morning. What are you saying? Mm-hmm? Oh, you guys don't know. Don't look at it. Oh, silly. You're too good. But there is something, huh? No, I wouldn't. Maybe you could see it. There's something kind of foolish. You'll just laugh at me. No, I will not. Well, I will not. Cross my heart that long. Honey, what is this? I'm trying to home-sick. Home-sick? Well, if that don't beat all. Yeah, I knew you'd laugh. Look, guys smart. We were heading home. But Morky asked first. Didn't think it would be there the minute we decided to start. Did you? Uh, I didn't mean to be with you. What? Uh, and I'm home-sick for the belly. Did we just laugh? Oh, I know it's silly. I'll laugh. Well, why in sumka didn't you say so before? But you were so anxious to leave. Don't see where we had much choice. But I thought from the way you thought that you couldn't stand it any longer. Did you kind of feel it? What? What? With the creeps and all the intrigues running up to the hills, and the crowds, and the good way the air sniffs. In the prime hunting, no neighbors crowding you too close, and, hey, what's the matter with me? Sound like I was lazy, don't I? Morky, you need better forget all that. Think where we'd like to be the counts. It's where we can make the right kind of living. Yeah. We'll go up. What? You hear anything, honey? Well, that's it again. Wait. Hey, look! There's a fellow to yell at. See him on his white horse? And there's a pink. That's a risk in riding the tip. Mine's stars, Morky. That's the masked man in that engine part of his. Yeah. Hold on, please! Line up! Ahola! Get up there! Get up there! It's Ahola! Get up there! Come on! Please! Line up! Not for you, mister! Get away! Come on! Get up there! Come on! Come on! Come on! Come on! Come on! Come on! Get quite okay! All men down, come on! Pull back, boys! Back to me! Pull waters! Pull, pull here! Pull, pull here! Get quite okay! Pull, pull here! Pull back! Come on! Come on, boys! Pull him down! Harder than you and look!  Don't shoot, fellas, don't shoot! What are you saying, Henry? What are you after? Oh, if you were turning your wagons around and heading back for the valley. Oh, no, we're not. Very well. Tell them what I am riding there. And you don't get Zeke back until you join us. Hey, no, wait! Well? You can't go to harm him, are you? You won't shoot him or anything, will you? I won't harm him, and it isn't a hold up. I want you to go back to the valley, nothing more. Zeke stays with me until you do. You'll have to go back. You'll have to. What do you say, Paul? No, no, no, no! That looks like your answer, mister. We go back to the valley. Good. Turn your wagons around and follow me. Go, go, go, go! Hi. We're almost there. Pretty close, son. Another hour, maybe? Yes. Well, you've got much more than we can do. Everything is pretty. No, you sure got me there. But I... All I can say is I've been watching them riding up ahead of us. And that's when Zeke had been doing a heap of talking. So it looks to me as if Zeke was half as mad about the whole thing as he was at first. Well... Well, never have you done anything. There's no use of guessing. I reckon when we get there, we'll find out all the ways to find out.  Get on! Get up, sir! In time, Jake had ridden to the hills. He returned hours later with a gang of a dozen men, a bearded hard face lost to sickly made themselves at home in the cabin Zeke caught or vacated. He spent the night drinking and gambling, slept late the next day, and when they were finally awake and dressed again, he came surely in carlson. Come on, come on! Who went to this hill, dog? He's a drop left in it. I used to do this myself. Oh, you were too far gone to recollect this. You're lying! Boy, who has your rotten hide? I'll take you or bust you or... You will! I'll take you or bust you or... I'll cut it out, you two! Jake, you ought to have more sense. Can anybody start a fight and I'll take him on myself? He set everybody said! There'll be no more of that talk. If we have to fight among ourselves it'll start everything we work for. How can that be filed?  Then suppose one of you get rich, and runs to them whole citizens how and why we want it out of here. here. Then where'd we be? Well, I think it's what we do there. Maybe to get even.  Anyhow, we got work to attend to. Well, the location knows it's a problem. There's not a word you'll find. And each one of you choose your own home space. Diver states to get offset. What for? We can't file on them yet. They'll find we've been gone long enough. It won't hurt to get that much out of the way, will it? So when anybody's coming along, they lose that first thing. Space, what do you mean? Outside, look outside there. Well, I'll be. They came back out of my way. And they brought them back. There's a mask man with us. How about doing your part? There were any good fixes to face. What's with the old mister? He ain't nothing to him, but it's plenty to me. You're right to me. You waited till we were gone, then called in your crooked friends and planned to take our home space. We'll give them up. They still have the rights to take them back.  But when you're at the then, no time to go further west by way of an instant. If you get these people to leave, this is your space. How do you know that? You and Jake talked too much one night when you thought you were alone. You deliberately discouraged these people, urged them to leave, and came here to help yourself. You don't get out. There ain't enough of you to make it. You hear that, man? These farmers want more. Come on! Let me go, man! Let me go, man! Let me go, man! Let me go, man! Let me go, man! Led by the lone ranger, Tyrone, the farmer's clothes in on Stade James. The cherries were smacked, bottles throwed, no quarter was asked, no quarter was given. Stade rotting desperately against the masked man was the first of the outlaw to try for mercy. Leave me go, masked man!  Leave me go! On your way! On your way! Come on, get going! If you don't want to use concern here after the next minute, we'll start again when we're left off. We'll greet you so we can put up the lesson we'll remember. I don't think we'll make any more trouble for you. You're not a stranger. How do you walk him, fellas? It was like him two to five. Yeah, I've seen him. Hey, look at them prists. Look up your horse. You can't get away from here fast enough. I should have known earlier, if the railroad was becoming good at selling. This is the only logic. A rudder can follow. He can sell at the land it needs for good sales. And still have plenty left for sales. Right. Listen to me, folks. I want to say that now we've got your best visa law for calling this barrier home. Thank you very much. And it ain't going to be Friday because we're going to build up. Folks will support for this land. And I'm here to say it takes fighting for something to really make it sure. Oh!