I would say most of the international community have seen the true face of Iran. They've seen the barbarism of this regime against its own people. They've seen how it exports aggression beyond its border and beyond the Middle East. And I think there is a common consensus that this regime must not acquire nuclear weapons. We've had very good discussions on forging a common policy, on trying to work together to thwart the danger. I can repeat again something that you've heard me say many times. Our policy and my policy is to do everything within Israel's power to prevent Iran from acquiring nuclear weapons and the means to deliver them. And that will remain so. But obviously the fact that we in the United States are working together is something that is important for this common goal as well. In addition to thwarting the danger, we also see an opportunity to seize opportunities, the opportunities of expanding the circle of peace. We intend to deepen the peace that we've already made in the Abraham Accords. We discussed some of the initiatives that we are considering doing together. But also to perhaps achieve dramatic breakthroughs that I think could be both historic and enormously significant in our common efforts to bring prosperity, security, and peace to this part of the world and beyond. So with this in mind, I have to tell you that I also believe that expanding the circle of peace, working to close finally the file of the Arab-Israeli conflict, I think would also help us achieve a workable solution with our Palestinian neighbors. For all these reasons, I welcome you once again to Jerusalem. Welcome. Thank you, Prime Minister. Thank you very much. It's very good to see you. And I want to thank you for what has been, as always, a very productive, very candid, and I think important discussion that covered a lot of issues. Just as I did upon arrival in Israel, I had a chance to express directly to the Prime Minister my condolences and that of the United States government for the seven Israelis who were killed in the horrific terrorist attack earlier this week outside their synagogue. President Biden called the Prime Minister immediately after the attack to underscore the United States steadfast support for Israel and its people, a message that I reaffirmed in the meeting we just had. In the context of this attack and escalating violence, it's important that the government and people of Israel know America's commitment to their security remains ironclad. That commitment is backed up by nearly 75 years of United States support. America's commitment has never wavered, it never will. And today, the Prime Minister and I discussed ways that we can continue to strengthen our partnership and our shared security interests. We agree that Iran must never be allowed to acquire a nuclear weapon. We discussed deepening cooperation to confront and counter Iran's destabilizing activities in the region and beyond. Just as Iran has long supported terrorists that attack Israelis and others, the regime is now providing drones that Russia is using to kill innocent Ukrainian civilians. In turn, Russia is providing sophisticated weaponry to Iran. It's a two-way street. Russia's ongoing atrocities only underscore the importance of providing support for all of Ukraine's needs, humanitarian, economic and security, as it bravely defends its people and its very right to exist, a topic that we also discussed today. Now one of the most effective ways to make Israel more secure is to continue to build bridges in the region and even well beyond the region. That's why we've worked relentlessly to deepen and broaden the Abraham Accords and other normalization agreements between Israel and Arab states. Earlier this month, a large delegation from across the United States government joined representatives from Israel, from Bahrain, from Egypt, from Morocco, from the United Arab Emirates, in Abu Dhabi for the first meeting of the negative forum working groups. This was the largest gathering of Israeli and Arab officials since the 1991 Madrid conference. These groups are focusing on issues affecting the lives and livelihoods of all of our people, food and water security, clean energy, health care, education and coexistence, tourism, regional security. It's part of a comprehensive effort to enable collaboration not only between our governments, but also our businesses, entrepreneurs, civil societies, young people. The prime minister has spoken about our ability to do big things together. Well, Israel's greater integration in the region is very much one of them. A few years ago this kind of cooperation would have been unimaginable. Today it is genuinely fostering new opportunities for people across the participating countries to connect, to collaborate, to learn, from teaming up on cancer research to launching new startups in green energy and drought-resistant agriculture, to competing in real sports and e-sports. Each of these interactions helps chip away at enduring biases and mistrust, and this never would have happened without the leadership of the prime minister. We're determined to keep building on that progress, on new issues with new countries as we work to strengthen the circle of peace. These efforts are not a substitute for progress between Israelis and Palestinians. But as we advance Israel's integration, we can do so in ways that improve the daily lives of Palestinians in the West Bank and Gaza. And that's crucial to moving toward our enduring goal of Palestinians and Israelis enjoying equal measures of freedom, security, opportunity, justice and dignity. President Biden remains fully committed to that goal. We continue to believe that the best way to achieve it is through preserving and then realizing the vision of two states. As I said to the prime minister, anything that moves us away from that vision is, in our judgment, detrimental to Israel's long-term security and its long-term identity as a Jewish and democratic state. That's why we're urging all sides now to take urgent steps to restore calm, to de-escalate. We want to make sure that there's an environment in which we can, I hope, at some point create the conditions where we can start to restore a sense of security for Israelis and Palestinians alike, which of course is sorely lacking. We also remain committed to supporting religious coexistence and diversity, including in Jerusalem. We continue to support upholding the historic status quo at Jerusalem's holy places, including the Temple Mount Haram al-Sharif. We're grateful to the prime minister for his repeated expressions of support for that position. One of the things that makes the partnership between us so strong is that it goes well beyond any one American or Israeli government. Few people understand that better than President Biden, who's worked closely with every Israeli prime minister since Golda Meir, and Prime Minister Netanyahu, who has worked closely with his share of American presidents. Quite a few. Throughout the relationship between our countries, what we come back to time and again is that it is rooted both in shared interests and in shared values. That includes our support for core democratic principles and institutions, including respect for human rights, the equal administration of justice for all, the equal rights of minority groups, the rule of law, free press, a robust civil society. And the vibrancy of Israel's civil society has been on full display of late. The commitment of people in both our countries to make their voices heard, to defend their rights is one of the unique strengths of our democracies. Another is a recognition that building consensus for new proposals is the most effective way to ensure they're embraced and that they endure. Our fellow democracies can also make us stronger. That's what the United States and Israel have done for each other over many decades by holding ourselves to the mutual standards we've established. And by speaking frankly and respectfully, as friends do, when we agree and when we do not. The discussion that the Prime Minister and I had today was no exception. That conversation will continue, including with other members of Israel's government civil society, as part of a perpetual process to defend and bolster the pillars of our democracy, which we are both committed to. So Mr. Prime Minister, again, thank you so much for your hospitality, for the very good conversation, and for the enduring partnership between our countries. Thank you. Thank you. Thank you. Thanks everyone. You are watching Live Images, US Secretary of State Antony Blinken and Israeli Prime Minister Benjamin Netanyahu speaking at the podium after wrapping up their meeting in Jerusalem just a short while ago. We're going to get straight to it and unpack exactly what we just heard with me in studio. Danny Ayalon, the former Israeli Deputy Foreign Minister and former Israeli Ambassador to the US and our senior diplomatic correspondent, Owen Altman. And Owen, I'm going to start with you. Lots to unpack. What stood out for you? A lot of comments that we were expecting, and perhaps others that we maybe weren't. Yeah, I'm really interested to hear what Danny Ayalon has to say, whether he gets his gut feeling that this was a good meeting or not from Antony Blinken's body language. Frankly, I'm not so sure. At any rate, you're right. Wide-ranging comments, very carefully worded on both sides. I think it's a credit to both men. Both speaking very carefully, thoughtfully and purposefully. On Netanyahu's part, actually, I found a surprising point of moderation on Iran from someone who has made this his flagship issue going back years. Talking about Israel's red line is preventing Iran from getting nuclear weapons that means to deliver them. Not having Iran be a threshold nuclear state that seems to be, if you take Netanyahu's words at face value, something he's willing to accept. And that is quite a concession from Netanyahu. Netanyahu, there are not words, for example, that we heard from your ear, Lapid, as foreign minister or even, I think, from Nishtali Bennett as prime minister. So I found that to be quite interesting. On Blinken's part, a thicker laying on Israel's judicial overhaul than I think I expected. For example, if you compare it, Benita, to what we heard from European officials, I was there and President Isaac Herzog tripped last week to Brussels. This was a much thicker laying in terms of how he described the judicial overhaul and America's position toward it than we heard in Brussels where it was either not stated at all in public statements or done very elegantly. This was beyond elegant. This was much more direct, again, not fully direct, but I don't think you leave this statement with any confusion about how important this is to the Biden administration.  Talking about Joe Biden as a true friend of Israel, this is a talking point of Netanyahu time and time again. Shouldn't be taken for granted that kind of unambiguous praise for a Democratic American president. It stands out. It stood out here again. So I should wrap that up with Netanyahu. As for Blinken, there's so much more to say. I think we'll probably hand it over to Danny I alone. But again, talking about how far he'll go with Saudi Arabia, for example, again, in his statements about Iran and, of course, Ukraine. And exactly that, your thoughts and exactly what was being said between the lines there. Okay. So there are quite a few nuances which are very important. First one is on Iran. Second is that Iran should never be allowed to develop, attain nuclear capabilities and, of course, the delivery means, ballistic missiles. When you hear the Americans, they say that they're committed not to let Iran acquire. They're not talking about developing. So this is a major difference, a very major difference. Did you say that on display here or did you say a concession from Netanyahu? Well, I would say that it is not different than the traditional American position. And that means they see differently on, you know, as well as much as the timeline is concerned. Israel would like to strike now or very soon from now when they enrich 90%. If you recall three or four or five years ago when Bibi Netanyahu made his famous speech at the United Nations with the bomb illustration, he talked about the red line of 90%. 90% I'm not sure is the American red line yet because they're talking about acquiring. So this is something which has not been resolved and it is quite amazing to see that the two sides after so long are still sticking by their own positions. What the Americans are trying to do is maybe sugarcoat this difference by one, you know, of course, assuring their ironclad, as it was mentioned here, commitment to the security of Israel. And also if we look at last week, Jennifer Oaks, you know, this exercise, which was one of the kind, it was first of the kind because it was the first time on such a massive scale which included air, navy and ground operation. And this is also something where the Americans are doing in order to appease the Israeli mind and buy more time because Israel would like the United States to publicly say that not only options, that all options are on the table, but that a military option is very, very viable if the Iranians will not stop. This has not been happening yet. By the way, Israel here is not alone. Saudi, all the other Gulf countries including, by the way, Egypt and Jordan are with us, but the Americans have not realized. So this is one important difference that you can tell from the two speeches. The other thing is I've never heard an American foreign secretary or a high-level American speaking so explicitly. And here I pretty much understand what you say so explicitly about what democracy means. Usually say shared values and you don't have to explain. Here is talking about the free press, about the rule of law, about the vibrant civil organizations. It has never happened before so publicly which means the Americans are very much concerned. So I'm sure inside the room, the meeting, I'm not sure it was as pleasant as it was reflected with these two speeches. That is absolutely my instinct. And also when you hear Anthony Blinken saying as a friendship that exists, but we will also speak frankly when we agree and frankly when we disagree, alluding as well to the Temple Mount, talking about democracy as well. What did you make of the body language of the way he delivered his message as well over and above the words? I think they are very concerned. They are very concerned about Temple Mount, about the status quo there, about what Israel would respond to this horrific massacre of the seven Israelis that were gunned down by the synagogue in Jerusalem. And the last thing they would like to see is all of a sudden the burgeoning of new Israeli communities into the Samaria. This is something which they are of course very much against. And this is why you saw such a reserved body language by Biden. And also when Netanyahu spoke about he was forward-looking. Expanding the circle of peace. Yes. So of course Biden has to, I mean, Blinken has to follow suit. But he said that this is not replacing a political process with the Palestinians. And I think more importantly, Anthony Blinken left open the real question, which is how far is the Biden administration willing to go to give things to Riyadh to incentivize them to normalize? I mean that's the secret of the Abraham Accords is that the Trump administration gave things to most of these governments to entice them to take the plunge of normalization. And the Saudis we know from even I-24 News' own reporting are interested in getting some of these goodies from Washington. The question is how far is the Biden administration willing to go? I don't know that we got a strong question. I wonder if the enthusiasm that the Biden administration might have for that is in part connected to their feeling about what Israel is doing on these other issues that are in dispute. The Americans can be very tough. And there is a quid pro quo. They are not giving much, you know, free. So they would definitely expect Israeli restraint on the Palestinian issues. They would expect Israeli judicious conduct when it comes to judicial reform here. And they will never say it out loud to link it with how they act upon extending the Abraham Accord or their position on Iran, which should be really linked because Iran is also a threat to American interest very, very much so. So it shouldn't be linked. However, the Americans can make it very, very difficult for Israel really make us sweat when it comes to capabilities and more that we need in order to build a viable military option that we can go by ourselves. We do have the capability, but how effective it is depends on more material from the United States. The connection between Iran and Russia and the issue of Ukraine, talk to us about what you understood was being said very subtly there as well, Owen. Well, first of all, again, this is not for the first time. Regular viewers have heard me say this so many times that it bears repeating how much of a foreign policy gift it continues to be for Israel, for Iran to be taking Russia's side in the war in Ukraine and giving Russia drones that are killing Ukrainians. I mean, it is an absolute gift just dropped in Netanyahu's lap and before that, in Nifali Bennett and Yipir Lapid's lap, it has completely changed the entire discussion around Iran in a way that's great for Israel. But of course, the issue of Ukraine, Anthony Blinken made pains to put that in there as well, saying not only humanitarian aid security aid as well, it was not 100% clear to me how far he went in those demands with Israelis, whether this was there to send a signal to Volodymyr Zelensky that it had been discussed, or whether there was some more seriousness in the kinds of demands made upon Israel. I would lean further than the former, but I admit I'm not 100% sure from those public states. Well, if you're just joining us, let's take a quick listen to exactly those words as we heard them just moments ago out of Jerusalem. Your visit comes at an important time. It's a time where many in the international community, I would say most of the international community have seen the true face of Iran. They've seen the barbarism of this regime against its own people. They've seen how it has aggression beyond its border and beyond the Middle East. And I think there's a common consensus that this regime must not acquire nuclear weapons. And we discussed deepening cooperation to confront and counter Iran's destabilizing activities in the region and beyond. Just as Iran has long supported terrorists that attack Israelis and others, the regime is now providing drones that Russia is using to kill Israelis. In turn, Russia is providing sophisticated weaponries to Iran. It's a two-way street. Russia's ongoing atrocities only underscore the importance of providing support for all of Ukraine's needs. Humanitarian, economic, and security as it bravely defends its people and its very right to exist, a topic that we also discussed today. Danny Ayalon, your insights on exactly what we were talking about now. Absolutely. Iran is on Iran, certainly about the timetable mostly. And when would the United States come out and say very, very precisely and unequivocally that Iran will never be nuclear, including not all options, but a military option. If they say we are preparing a viable military option not to allow Iran to become nuclear, that will speak volume. And we know that the Iranians heed to pressure. The only time the Iranians voluntarily suspended their nuclear program was in 2003 when they were flanked on both sides of their borders. Afghanistan on the east and Iraq on the west with the American forces, they stopped because they thought they would be next. This is what Israel is looking for. Danny Ayalon, thank you so much. Owen Altman, we have a few seconds left. Parting shot, your take on what we saw and what is going to happen in Ramallah very quickly. Well, if anything, what happens in Ramallah, there are differences in a range of issues. There are some agreement on other issues. And by the way, acquire nuclear weapons. Those are the words Benjamin Netanyahu used, Danny Ayalon. I read that as Benjamin Netanyahu, if you take it face value, accepting Iran as a threshold nuclear state, a huge headline in its own right, but not the only one from this very, very interesting set of remarks. And again, country to countries which have some points of agreement but some significant issues of dispute that are not about to be resolved soon. Owen Altman, Danny Ayalon, we could discuss this for another hour. We have to leave it here, but stay tuned to I-24 News. We'll have more analysis and reaction in the coming hours. I'm Vanessa Levine in Tel Aviv. This is Special Edition. Thank you so much for watching. Our coverage continues. Stay tuned. Join us as we meet the people changing our planet and discover the inventions shaping tomorrow. Israel Business Beat Sundays and Wednesdays, 9.30 p.m. GMT. Discover I-24 News Radio. Now you can listen to I-24 News anywhere, anytime for free. I-24 News Radio is the audio live stream of the television network with world headlines every 30 minutes starting from 7 a.m. Tune in for top news and magazines editions while in the car in your office. Join us from your smartphone, tablet, or desktop to stay connected in the Middle East and around the world. Don't wait any longer. Head to our website or mobile application and click on I-24 News Radio to subscribe. Organism that pulsates through millennia. Touch it. Listen to it. Smell it. Taste it. Experience the Holy Land like never before. Holy Land Uncovered every Sunday only on I-24 News. And get to the heart of the story, even tougher to make sense of it all. And that's where we come in. I'm David Matlin and each weekday I'll take on the most important topics breaking down the issues so you can decide for yourself. Zoom in. Each weekday here at I-24 News.


BU Today reported that there are 93 students who claim Ukraine or Russia as their home. As for how you can help them, it's easy. Just be there. They need support. They need a listening ear. Hope has to be one of those things that we still keep for ourselves and that we extend to them. Dean Elmore was one of almost 200 who attended BU's Ukraine Town Hall on March 17th, where international relations professor Igor Lukes was one of the panelists. Lukes knows from personal experience the value in simply showing you are concerned. You know, as someone who experienced occupation, I can tell you that the first feeling you have is that of loneliness. You feel abandoned, but always start by expressing concerns, sort of breaking through the shell of loneliness. Tanya Letus moved from Ukraine just three months before the invasion. She started the Instagram Boston Support Ukraine and was happy with the response from local college students. I'm just so surprised that the entire world is actually standing up here for us. Letus says the most important thing you can do is attend the rallies, join the movement and educate yourself. We are feeling lonely too, but as we come together we feel empowered. This rock that is normally painted in Greek letters is now painted blue and yellow in support of Ukraine. With BU TV 10, I'm Megan Klein.


Thanks, hello everyone. I think Shubham Stocks sets a good pre-context for my talk on how to go about doing things. So today the aim of the stock is to guys give you an idea how to have a successful bug bounty platform. And if you want to set up a bug bounty program for your organization, how do you go about it? What's the, what all it takes to run a successful bounty program, right? So let's get kick started. So first thing about me, I'm currently head of security privacy interest at a hot star. Before this, I was with Ola, before that Flipkart Adobe. What I love to do is solve security at scale. That's one of the first fun thing that I love to do, right? Why am I talking about bug bounties? Is because long time ago I was, I wouldn't say a bug bounty hunter. I would say security researchers who used to do sort of bug hunting when there wasn't a bug bounty programs such and I've done quite a few then. From then onwards, I moved from that side of the table to this side of the table where four years back, sorry, I launched a successful bug bounty platform for an organization that I used to work with, right? And I'll take you through the journey of how things happen and what all it took to do that. So before starting, let's have a quick glimpse of what's a bug bounty program, right? I think this picture depicts it clearly, what's a bug bounty program, right? Like it's shake up a tree to get some money out of it. And harder you shake, the more money you get, right? To summarize in points, it's like, it's a platform where you receive recognition, reward bounties for submitting vulnerabilities, right? Why it is such a thing now? Because bug bounty hunters or white hat hunters get paid around roughly two and a half times, two point seven times more than an average software engineer. And in India, it's very different. It's like it can go up to 16 times, right? That's why it's a big thing now, right? Why do we need a bug bounty program, right? Well, according to a recent research, probably it's IBM or so forth, I'm not too sure, where they said cyber criminals have said for them to breach any network, it takes 10 hours, right? If we have to make sure our organizations, our infrastructure is secured, we have to work the way they do, like something the previous talker explained a lot, right? Now that's why we need the support for the whole bug bounty or white hat community together to make it work. But this is important. Bug bounty is towards the last thing I wanna do. It's not the first thing, it's not the fundamental thing. It's the process to identify bugs that have slipped through the cracks, okay? And that's why you deploy a bug bounty program, not a replacement for your security team. That's really important. History of slightly, some issue about bug bounty. What I recently got to know, the first bug bounty came in 1983 with Hunters and Wedding Corporation. Then Netscape, Navigator 2 launched one in 95, Tomozila, Pontoone, Google, Facebook, to now all the telecom operators have it, payment companies have it, all the governments have it, hotels have it, adult website have it, right? And it goes from, it has gone from this to finding bugs here and getting this as a gift as well, right? And that's how it transitioned in the last probably two and a half decades. Today's agenda is gonna be understanding what are the use case for you to consider to launch or not to launch or to have or not to have a bug bounty program for your organization. What's the parameter you should think on? What are fears, concerns, having a bug bounty program? What things that you run into you haven't thought through while having a bug bounty program? Understanding who does it apply to, right? Here we have organization from 10 people startup to a big like 1000, 10,000 people corporations. Does it applies to all? What's the thumb rule to understand who does it applies to? Dark side of having, not having one, right? If I don't have one, what are the bad or the worst thing that can happen to me? How to launch your own bug bounty program where things, essentials before setting up, launching one, what are the logistics you have to take care? How do you make sure you run a successful one, right? Couple of pitfalls while you're running and how to avoid them? And some yarn from my side, right? Okay, now before I give you all that theory of what's needed, what's not needed, I wanna give you a quick walkthrough of how I did it for years back at Ola, right? Now, when I launched at Ola, it was just two of us, me including in a security team and we're doing so many things and we thought of launching a program. We had our own things done, which I'll walk you through. And when we decided we wanted, like ideally, probably some of you have interactive bug bounty platform or commercial one. So you know it's like you submit something by a form, someone sends you an email, then there's interaction happening over email, all of it, right? My aim was, it's two people team. If I get 10 bugs in a week, I cannot manage that because I have to do a lot more work. How do I go about automating all of that stuff? The aim was like, can I have click buttons where I just click and everything happens? Like it sounds a bit fancy, but we did achieve to a good level in terms of how do we go about doing it? So that was my aim. Now, doing that, so that's the way I wanted to. And post that, what I wanted to have is all the things that would be coming in how I would be counteracting with them, right? So this was aim of how should a bug bounty platform I should build, right? And I'll also talk about why not use a commercial one in slightly couple of slides later, right? So ideally, as I said, there's a communication channel and everything follows. For me, if it's an email, then it becomes a hard thing. Hey, have I replied to those researchers? Have I fixed those bugs? It's hard to follow up all of those things, right? So what we did is I have video and I have images of these, videos to explain to you how I did it. So just to kill you, again, the vision was, can I have things at the click of a button and how do I explore with minimum hard work put in place with maximum automation to do all of it, right?  Okay? You submit the bug. It's all received. Now, ideally it goes to an email account that we had. Okay? Now, the point was, I cannot monitor email accounts so we need some kind of automation. We, at that point in time, using a ticketing system called JIRA. And we went ahead exploring how we could abuse and exploit JIRA in a good way to automate all of it, right? Probably workflows and things that I'll show you here, you haven't seen, you would have thought JIRA exists that way, but it does. And probably after 20 days of exploration, we did a lot of stuff. I'll first show you what it works. Let me pause it here. So what happens is the moment you submit a bug, it goes in email and we wrote a JIRA handler to monitor that email and then it comes to JIRA. The moment it comes to JIRA, it keeps moving, okay? We had, let's say, some artificial intelligence to understand the criticality of the bug so we can monitor on how, which are critical bugs that needs to be looked at because if I'm getting 100 bugs, I need to first focus on the critical P0 bugs, right? Then it gets a lot of details. It has a security where we created this to understand each bug and how do we measure, or monitor each bug and that we're talking to the same person who has submitted X bug, but for that particular bug, right? All of those things comes in an email, right? Now, if few of you have interacted with JIRA, you know there are workflows that are refined where you have buttons to do things, right? So now, when this happens, we wrote a JIRA post trigger which sends an automatic email the moment it receives a JIRA ticket to the customer, to the third party researcher saying that, hey, we have received your bug, this is your identifier to use further and give us some time to validate this bug. This is all automatic, no one's doing. The moment, I'll show you how it's done. And okay, now, as I said, right? We had few things done. A bug could be valid, invalid, I'm not able to reproduce, duplicate, won't fix out of scope. Email is an option that we had, how we can interact with the third party researcher or the bug bounty hunter in terms of over the communication. So, and the whole security team needs to just work on this JIRA, where everything they say goes as a comment. Every reply that customer says comes as a comment. So everything is tracked here and we just click buttons, hey, it's valid, it's not. Right? So, I'll show an example of send email where if I have to talk with a customer saying that, my bad, talking with the researcher saying, hey, can you help us with some more details or hold on for some long? So, you understand, we just, the security team just says thanks for submitting, nothing else, right? What happens at the back end, it's all post things and triggers that we wrote. Let it refresh. The JIRA adds couple of headers, footers, signatures, the key, all of it, right? We could write anything that we want to. So, if you have seen commercial platform, that's like timeline that goes through where you interact with the researcher, we do it via JIRA because we can do it, the whole organization is used to use JIRA, right? Now, let's mark a bug valid. The moment you mark it valid, the flow changes to, okay, fix in progress. Researcher gets, again, an automated email that, hey, you know what, you have spotted a valid bug while you evaluate here things that you need to look for while we are working on it, right? Now, then it goes to a fix in progress where engineering team fixes it, they mark it fix, then it goes to QA team, they mark it QA done, no regressions, then it goes to security team, they say, hey, you know what, there is no security bypass, then they mark, hey, verify from the security researcher itself and it issues an email to the security researchers that we have deployed a fix, how about you go and see if they are bypassers or the fix is good enough, right? We have fixed it, how about you just verify it's good enough or not, right? So, security team is just clicking buttons ideally, doing nothing, right? This is another awesome thing, right? So, the moment we want to close a bug, obviously it's a valid bug, we have to figure out how much do we have to pay out to the researcher. So, we created another Jira project, pay out which only security team and the finance team had access to, what we said it's an all automated way, the moment I click on, sorry, click on close, it creates a new ticket where we can just enter the amount, I'll just show you.  And then the finance team can close the loop. So, we enter the amount, it's a test, and we close, okay? Now, what do you see here? It's a new, it's not coming in, okay? For some reason, the bloating is getting disconnected, okay? So, as a pay out ticket was getting created, which is not visible here, and if I refresh my Gmail account, the researcher refreshes his Gmail account, a new email gets triggered to him, asking him about, again, tons of things in terms of, hey, here is something that we are paying you out, here are the details and everything, right? So, this was the front end of how security team has automated everything and they, so at Jira, you could just create dashboards so I know how many bugs are open and which state, how many critical bugs are there, how long, are we taking to fix critical bugs, all of it together, right? Okay, here is something that I'll show you how we abuse Jira in a good way is, this would be probably the most mess up the workflow of Jira that you have seen, would be something like this. So, right? I cannot tell you, like, after I was done with this, I started even, when we wanted to hire a Jira admin, I started interviewing Jira admins because I knew so much about Jira, think that it had, was really, I didn't knew that Jira could do so much, right? How we created bug mandlers, post triggers, pre-triggers, triggers to itself, right? So, yeah, so now let's see the workflow that I was talking about. So, what happens is if anyone of you have used Jira or any ticketing system, you know from, you have like four or five state on how things flow, right? Here what we had is, here what we had is something really hard, like just opening an issue, sends an email, it can go to x states, I'll just, like, I have images on this which I'll walk you through, but just a quick find through of how things could be done. How much effort went in just designing this because it becomes, it becomes like, hey, if this effort we haven't put in, we wouldn't be able to automate the thing that you saw on the front end of the Jira. This is all that went in doing all of it, right? Reopening, I'll talk about reopening and how after closing, it creates a new ticket for payout, right? That's how it does, and it's a bit messy up, right? So, if I have to go just, so, so as I was showing you, right? Something happened. So we had post function, we wrote all of that, right? So it's as simple as we went ahead, created a post function, posted a groovy script of whatever we wanted to do, whether fetching an email from account handler, how to push it, and all of that was done at Jira. This was a one-time activity that we did. This was a one-time activity that we did which gave us enough bandwidth to manage things. So now, as a security or the triage team, we just had to click buttons, and it goes to the right people, whether finance team, engineering team, QA team, or security team, or the researcher for that matter. So this is something which we did, okay? What happens, I'll just walk you through, is, as I said, right? Whether the priority comes in by default, we wrote a post function for that. We, so Jira, this key that you see here is created by Jira itself, nothing else, because email comes, form submission comes to an email then to Jira, right? Everything is done at Jira and itself, right? Now, after this researcher receives that email from an open state, it can go to either of those five states that you see, out of scope, won't fix, invalid, duplicate, valid, right? Now, the moment we mark anything, it sends an email as I showed you. Now, just telling you, right? All the arrows that you see, these are triggers in itself, like close has three, four triggers. This is something while designing, probably I took around just one week to 10 days to design this workflow, because if I launch bug-bound T without having this workflow, it's gonna be manually managing all, because I have to figure out what state it goes to and what all it can happen, right? So, from fix, from fix and progress to fix, there was so many things that needs to be happening at the same time that we have to design and prepare for. So, the point is how much effort went in at the one time to automate all of it, right? The moment we have fix and progress, again, it goes to QA state where a QA can mark it, so everyone was involved, the whole organization knew about this, that you were launching this. We had things, like, I'll walk you through the theory of how did we prepare for all of it, is everyone was aware we had proper SLA in place and completely automated. So, this is where an email goes to third party researcher to validate that we have identified, verify the fix that we have deployed to the bug, right? That's where he replies, yes, no, and see, the close itself can happen from so many places and so many things that needs to happen at the closed state, it has to create a payout ticket, all of that, right? Told you, you could have a payout, for sometimes you want to just pay out goodies, we need to have an option for that. Amount that we have to pay out, it comes in and the payout email that goes, so we need to have a bunch of these information, right? Whether we have to send goodies to you, you want Hall of Fame or not, this is a different identifier from the bug you have submitted because this goes at the payout ticket and this is something that finance team keeps a track of things, right? That's it. Now, this was how we automated all of it, right? But before even we went to the stage, there was a lot of backend things that went in where we had to prepare everyone for the bug bounty itself, right? Where should we have it, should we not have it, all of the agendas that I talked about would be here, right? Cool. Consideration for the bug bounty program. So here the problem is few companies launch a bug bounty program for the right reason, few do it for not so the right reason, right? Some examples or some reasons where if we're launching bug bounty for this purpose, wouldn't be a good idea, right? You think crowd sourcing security is a good alternative to have a replacement for our security team, bad idea. You'll only pay out for the bugs people find. Now you don't have to pay a full-time researcher, you just pay out for the bugs anyone find. So if you think having a team to exploit your system before you have enough security in place, think about it, right, because bug bounty hunters are people who want to exploit system, like the last talk, you saw how we can go about exploiting, where people pay enough money just for something that was committed to GitHub, right? You think, hey, you know what, this is a nice way of getting assessment of an application done. To avoid bad VR situations because there has been a case probably a year to year back where a food tech startup was forced to have a bug bounty program because of the way they didn't have it and some researcher went ahead or publicly and they were in a situation. Now we need to have one, right? You don't want to be in a situation that and you start having bug bounty program, bad idea.  No, the reason you should be thinking of plus the season is a good idea, right? The first thing is to understand attackers approach, like when a bug bounty hunters or white attackers test your system, you understand from what all things people are looking at your apps, from what all different perspective they are looking at your apps, right? You want to have an open connect with the security community. The point of security community is not, hey, I'll pay you, just do it. It's all about how you build a repo with them to make sure they help you and how would you help them? Apart from bug bounty itself. You should understand if you have baked in security and a security team, you want to understand the resilience and the robustness of those baked in security mechanisms that you have. You could get a variety of outputs over a longer period of time because as people at the security team tends to have a bias because they know this application or services are good enough always. So they tend to have biases and that's where a bug bounty hunter can help you if things have slipped through the cracks. How to go about building a detection preventer system? So this again is a very good point where you don't understand what kind of people will attack you so you can build a robust detection and monitoring system, right?  But again, bug bounty is not a replacement for your penetration testing team. It's just an additional step to understand the things that have fallen through the cracks, right? Now, what's the fear of a bug bounty program, right? This image depicts clearly what's the problem with a bug bounty program whether it's a real bug or it's a fake bug, right? For me to identify it and I'm scared of it, it's gonna be a problem, right? So the biggest problem organization have having a thinking of a bug bounty program is can I trust these people? I don't know them. I don't have an NDA with them. I don't know how would they go about. So can I trust them, right? It becomes too risky because I get a nub for an organization point of view because if I say I have a bug bounty program, it puts too much attention to me. Now, people who probably listen and care about me want to get easy money out and I become the center of attention. Do I want to be? It becomes a bit risky, a great area, right? Will I get bombarded with vulnerabilities? Like how would I handle the scale of issues that would come in, right? I have a quick stats to answer you this. Does it gives license to people to exploit our apps, right? I don't want people to exploit our apps. As a CEO of a company, I wouldn't want that ever, right? Having a bug bounty program doesn't define anything where it's wrong, it's right, right? Can I have a PR incident? Like the example I can talk about here is I have an image later where someone submitted a bug to Facebook. The team said it's not a valid bug. As a proof of concept, he went ahead, posted. The vulnerability was he can post on anyone's wall and the guy went ahead and posted on Mark Zuckerberg's wall. Now, if that happens, do you think whoever is responsible for security and Marks calls him? How would he respond, right? It's hard to manage, right? The last example that I gave to you. Some may have opinion, it gives a, it's a rewarding behavior for having, sorry, rewarding a bad behavior itself. Yes and no, right? Like you're saying, I'm gonna give you money if you find a bug to my app. It helps you, but it does reward you a bad, rewarding a bad behavior, right? So, okay, I'll just move around. So, this is a stats from Hackers Trophy where they talk about valid issues.  Two at Facebook, out of 100 submitted bugs, only four bugs are valid, the rest are invalid. Now, all of them, so three are commercial platform to manage bug bounties to have the own bug bounty programs, right? Now, think for those two companies where it's 5% and 4%, the best bugs are invalid. Like, if they have automation, someone is clicking invalid for like 96, 97 bugs, correct? So, how should I have it or not, right? So, pointers of now, we talked about what are the actual use cases to have a bug bounty program, what are fears and concerns of having one, right? Now, let's talk about how do I identify should I have a bug bounty program as an organization or not? Because I could be a payment company, I'm already compliance with RBI, PCRDSS, XYZ, right? I'm all good, why do I need to have one, right? I'm a CRM or ticket management startup, right? I know the person who's submitting via an email ticket and I have a team inside who manages all those tickets. I know those two people, do I need one, right? E-commerce cab aggregation, right? It's like, if I have to ship a product to an e-commerce, I know his email phone address. What bad could, like, what's the export that could happen? The same goes with cab aggregation, right? The customer's gonna onboard my cab. I know his pickup address, drop address. Why do I need a bug bounty program? Non-ID companies, HR, finance, supply chain, do they need one? Content website where there's future generated contents, it's like, hey, I don't care about anything. People can post anything and that's it, right? Communication platform like Slack or anything where two people talking to each other, they know each other, right? I'm talking to, let's say, Kiran here.  How can a bug bounty program add the value for those organizations, right? Online registry, like NPM talkers, like DevOps conference, you think like it's all trusted, signed, everything is there. We know what happened with Docker a few months back. We know what happened with NPM a year or so back, right? Now, how do I define there's a thumb rule to understand is my organization eligible to have a bug bounty program or what's the timeline for an organization to have a one, right? The point is bug bounty program, as I said, is a good to have feature provided you have a security team, right? Whether you have 20 people startup, whether you are a startup which has just interacted or has API integration with all the other apps. The point is if you have enough decent security in place, you can live without bug bounty program. It's always a good to have thing, but a security is a must have thing, right? Security evangelization. So understand, security is all about exploiting and exploring the nuances. In an, as a logical statement, payment companies is all good. Docker registries are all good, right? A security guy goes ahead and exploits the nuances, which becomes a problem. As a company, payments are all set up sorted, right? Dark side of not having one, right? Let's say, here, now I think probably whatever category I fall into, I don't think I need a security bug bounty program, right? Well, if you don't have one, so I have presented here two points of view from the searcher's point of view and from organization point of view. From the searcher's point of views, see whether you have, whether you don't have, researchers won't stop poking holes around in your website or app, right? You can't stop that. You cannot say, hey, I don't run, why are you wasting your time and asking me to pay you for the bug that you have found? That's a valid statement, but they are there, it's internet, everyone can do what they want, right? From a researcher point of view, it comes to like, hey, they found something, they're not able to contact the right person in the company and it's a critical bug, it's getting ignored, it's not getting fixed, so they think because it's a critical bug, the right way to go about it is writing publicly about it, right? Versus for an organization, it's like, hey, writing a full disclosure becomes a problem, right? I don't want people to write about what kind of bugs people found on my application, right? Bombarded with simple issues, people threatening and bug bounty hunters, your logs got lit up, believe me, like people's gonna run all kind of scanners to do all of that, okay? You can't close high critical bugs in a timeline, right? In a few days, you cannot do. How would outside world react to that? Hackers discuss vulnerability or they sell on the dark web, so you think, hey, not having one is better because I don't know if they sell it outside, right? How to go about launching one? So we have talked about consideration, we have talked about fear and concerns, who does it applies to, and the dark side of not having one. To launch one, I'll just quickly rush through because I have just 10 minutes left. So you have seen a demo of how it looks like the automated way, but a lot more goes in without that as well, right? The first thing is the ingredient itself, like you need to have a platform, you have to engage researchers, to set up the workflows, how would you try it, all of that, and how would you pay, right? So that's a 50,000-feet view of what needs to be there in a bug bounty program. If I funnel it down for you, a 30,000-feet view is where you want everything operated. Who doesn't want to be a rich rich where everything happens all by itself? To do that, to build that kind of an automation, what you need is a communication channel, a ticketing system, well-communicated SLA because engineering team do not have understanding of how critical the bug is, and you have to get, depending on the RC, or the remote code, or the command execution, you want to get it in a few hours' fix. So this has to be set up with your engineering team as well. No one should have access to your bug bounty tickets as well apart from the security team. What's the workflow? The thing that I showed you, I know I'm a bit rushing through, you can catch me offline, but I just want to give you an idea and cover the whole set of slides. So workflow, what you need to have. So what I showed you is one way to have it, not the best way or not the right way. That works for me, may not work for you, right? How would you set up things with payments team, logistics for bug bounty, buy-ins from legal PR team, measurement of KPIs, how successful is your program, right? Evangelization. So the biggest thing is, before launching one, you want to go, if you're responsible for security in your team, you want to go to leadership, hey, we want to launch a bug bounty program. Now, these are things they are concerned about. You should have answered to these things before reaching out to them, okay? So this image depicts what their concern is. How would we handle all the attention? What if people, instead of reporting exploit vulnerabilities, is it good to ask people to exploit a system? Like, think of this, instead of your DevOps shoes, think from a CEO perspective, would you want that? That's the leadership problem they have, and you have to make them comfortable before launching one, right? The precautions, if you can't patch things within a defined SLA, do we need a formal one or if someone submits, we'll pay them out? This becomes a problem because if you have bug bounty program, you have defined out-of-scope, in-scope vulnerabilities. If you don't have one, they can do whatever you want and you're gonna be in a bad shape, right? Why can't we do with third-party security testing companies? Does it put a target on my back, right? If you could give your leadership team confidence on these things, they can help you to understand how does they value infrastructure importance in the organization, and with the budget, obviously, right? Finance team, India specific, okay. Finance teams work in a very standard way. It's been there for last, I don't know, a couple of decades. They work for everything. They have to give money out. They need a PO invoice or anything.  We cannot identify his validity. Couple of thousands of rupees, right? Good luck setting up with that, right? How would you validate to searchers? If I have given him money, how do we get a receiving thing from a researcher that they have received and they are the right person to receive? Like, this is a typical finance mindset. You have to convince them to have bug bounty program too, right? How do you verify the person who submitted the bug and who's sent his account details are the same person? Do you pay in dollar or INR depending how many countries do you work in, right? You need Pankard details. Where will you store the Pankard details? Tax deduction, budget utilization. So it's like, for finance team, these two images depicts what they worry about, what their concern is, and how do you help them to fix these things that, hey, you know what I've taken care, I can catch hold of this rat and that dog, right? Security team, preparation is really important, right? I'll quickly rush through. The point here I'm trying to say, before launching one, you should have fixed all the known bugs. If you haven't, you should have planned on how to handle the PR incident that can happen for a non-fixed bug, right? You need to have an awesome monitoring in place. That image depicts clearly. You don't know what can go wrong. The point is how you can plan things, not prevent. Detect things and plan things that if they go wrong, you'll get to know, okay? Automate things as much as possible. Legal PR team. So again, the image that I talked about, someone wrote on Zuckerberg's wall saying, hey, your team is not able to understand the security issue and here's a proof. This is important because this protects your company in a really good manner. Whether you need to have a cybersecurity insurance. Yes, that's a thing now. And how would you handle PR incidents, right? Logistic issues. Now, we launch bug bounty program, but your Consurgers Service or your admin team cannot be sending 20 goodies every week. You need to have planned that, set up that process completely, right? Just rewind. You've got a leadership bind. You've got budget approvals. You've got financing to fund your things. You have sign off from legal PR team. If things go south, how would you handle? You have taken care of logistics, rules, scope. The security team has taken care of. You have an automated platform to take care of things. Now the question is like, fine, the demo was good, but after this whole theory, it becomes too much. Like, why do I need to manage? Like, I can go with all those commercial platforms, right? My answer to that is why not, right? It's a one-time thing where you do invest as a one-time activity, okay?  I took around 20 days to, because I was exploring G-right cell, versus a commercial platform where it's a turnkey solution. You get out-of-the-box reporting, but you've got to pay a platform fee. For every bounty that you pay, you have to give a cut of 20, 25% to the fee, to the platform, all of that, right? So if I have to summarize, I'll say, it's like, do I want that? Damn yes, okay? But having that, can I maintain it? Question for you to ask, if you could maintain it, go ahead, non-shopping. Versus, should I buy a Model Tesla 3 for $50,000? Versus that. A bit of exaggeration, but I hope you're trying to get the point, right? I'll skip through this. I have do's and do nots where you, I'll just say two things. You need to have your scoping done properly. What's in a scope, what's not in a scope? Else you're gonna have an awesome time, and in a bad way, okay? You need to have awesome monitoring in place for everything, right? Do not have your WAF enabled on bug bounty pages because people will be submitting payloads which are attack vectors and WAF gonna block all of it. So plan around that, right? Don't expect people to read your policies, understand how should they go about it. They're gonna go all berserk. You have to figure out on how you're gonna handle all of that, right? To summarize, if you have a security team like this, or you don't have one, because it's as good as not having one, you're gonna end up doing that in a bug bounty platform. It's just gonna be burning your company's money, right? Notes, I'll just say, prepare well. Bug bounty, understand the importance of bug bounty. It's not cost-effective for penetration testing. If you think of hiring a bug bounty program, understand properly what your hiring strategy is. Like at first it looks good, but it's a gray area. I won't say yes to hire or no, not to hire. You have to plan. I can give you inputs on what to do, what not to do, later, and it does require effort technically, financially, human resources, whether you have commercial or this, because if you have a platform, you're gonna say valid bug, not valid bug, respond to him. That's what you're gonna do, regardless. You build or you buy, right? So it takes investment, and are you ready for that investment? Not financially, right? That's all I had. I'm up for question, I hope I'm in time. Thank you. Any questions? So say for like a regular-sized startup in any sector, would you recommend that they go with a third-party bug bounty platform, or in which place would you recommend that they make? So as I said, this slides the peg. So if you could afford that, yes. If you think as a one-time investment, you need to figure out on how to automate. Let's say if you're an organization, you don't have JIRA, you need to find a way of how to do what I've done, right? If that's too much, yes, you can go ahead. So I'm not saying the needle moves, this is better, that's better.  So, yeah, sure. Hi, at the start you mentioned that you received a lot of issues, and somehow you managed to categorize those issues. Yes. How did you manage to do it at the start of it? Sure, so just to give you guys an idea, the start of the program, when you say, hey, you know what, I'm launching a bug-oriented program, I'm gonna pay you out this much, there's gonna be a flood of bugs that are gonna coming in, valid, invalid, all of it, right? The point was, if someone is submitting, hey, you have trace option enabled, or option enabled, or your Apache version, this is visible, you don't care about that. Versus someone is saying, have on an XSS, SQLI, remote code execution, all of that, right? Now, so that's what we did an automation in JIRA, hey, if these lies in these kind of categories, let's put them as P4. I may look at them because I've defined an SLA, P4 I look in, let's say in a week's time. P0 I look in few hours, few minutes, P1 I look in couple of hours or a day's time, okay? So how do I handle is we did categorize in terms of how do we filter out those bugs and put them as a priority as P4, so not a problem to look at right now. So that was our logic of saying, hey, these bugs I don't look at, and JIRA puts them as P4, so we don't look at them. So the way it used to work with us is when we open a JIRA dashboard, we have P1, P2, P3, P4 with aging, when it came in, all of that, right? What our focus was P1, P2, and P3, right? This is something I can look. That's how I did, right? I'm not saying that's the only way you could go about doing all the way you want to. Yes, so all this automation that we did because we had JIRA, so either I had to build something or I explore JIRA, right? So I said let me explore how can I explore JIRA in a good way. I found all the things that I could do in the tool that I build, or anything that any commercial platform has where you have a timeline, comment section, sending response, assigning it to people, all of that existed with JIRA, but for a general person, JIRA is just a ticketing system. We thought let me explore how can we do it? So all automation that we saw, we did it in JIRA itself. Yep, you had questions, right? So for example, if there is a red team. Okay. So the responsibilities which they will have, so is there any difference between the responsibilities between the red team as well as in the bug bounder? Yes, there is. See, as a point, red team does act as like a bug bounty hunters, but they know they don't want to flood your system, they want to go ahead and see how far they can go to exploit system, being undetected, but they just don't want to say then, are connected with tons of scanners and flood you to see what works, what doesn't work. They have an understanding of what methodology to follow to go about exploiting system. Bug bounty hunters, because it's a thing now, people run scanners, people run so many things, they see, okay, in one platform someone got rewarded. So like last talk showed you, a key put up in GitHub, one of the companies paid $7,000, the other company paid $15,000. Now, would a red team do it? Probably, probably not, but it's something you should have monitoring in place regardless, right? Bug bounty hunters is like, okay, you know what, I found something, pay me. So the idea of what red team does versus what the mindset of a bug bounty hunter is different, they just want money. The easy, simple bug which can make them earn money is something they look for. While red team is like, how can I sophisticate my attack? Go ahead and exploit system. In your experience, has an employee or ex-employee ever abused the system? Sorry, come again? In your experience, has an employee or an ex-employee ever abused the system? Like they know the vulnerabilities, and then? People do it all the time. You've been able to catch just kind of issues? Yeah. So that's what I'm saying, the point of while you do it for this, or you do it for something else, right? How do you build an awesome detection system? Okay, because what you don't know, you don't know. The point is, hey, I'll just give you an example. You say one of the talks that was today, right? Talking about login OTP, right? Now the point is, ideally, no one can exploit my OTP, right, or no one can log in via my OTP, bypassing an OTP flow, logically, right? That's why I say that security is all about exploiting the nuances. Now, if someone has a valid OTP in your DB and is still logged in, has a session, that's a problem, right, but you'll say, logically, that's not possible. I agree, but security is all about exploiting that. Now, can you put an alert around that? Ideally, you shouldn't get those alerts.  But put up an alert, if it ever goes wrong, how do I detect it? Can someone sign up with the invalid phone numbers? No, because they have to fill an OTP, but if you find someone signing up with less than 10 digits in India, let's say, send it up an alert. You should, the point is, how awesome detection system can you build to catch all of this? If you don't, you're like, hey, my security team would do it, my bug-bound hunters would do it, that's a wrong mindset itself. Any other question? Cool, thanks.


Hi, my name is Mustafa. I'm from Turkey. I'm already an English teacher. I graduated from Uluda University at the Faculty of Education, English teacher training. I worked in some private companies and some private colleges for many years, and I've been two times in Europe, and the first one was really very, very excited, exciting, and I was excited, really, because we could have the chance to see Lady Diana and Prince Charles. They came for the festival's opening in North of Wales. And the second time I decided to go out for by each hiking, and this was also a very, very good experience to me when I was undergraduate. And after completing my university graduation and then I began my professional career, I either worked as import-export executive and also worked in some private colleges. And then I had an idea to have an accredited certificate, then searched on internet that I saw ITT was one of the best, really, and then sent some messages and replied me in a very short time. I really, from here, I would like to appreciation, send my appreciation. Thank you, thank you very much to all ITTT family. They are very kind and soon in reply. And in a very short time, I completed my education and 120-hour staffel course. And now I'm excited waiting for my certificate. And for the next one, hopefully, I can have the chance to go on business English. So, if you have an idea to go out abroad and teach in there in some countries, and of course, absolutely, I recommend you to choose ITTT, TEFL or TESOL courses. And hope to see you in some countries somewhere, maybe. And till then, see you, bye-bye.


one megapixel per second DAC, dual one megapixel per second ADC, parallel capture so you can do camera input. We've got some code. Yeah, we did some tests. It's impressive. It's incredibly fast. I try to fix this. I'm having audio issues, but I think you can hear that now. I'm just unable to monitor sound. So sorry about that. I was having YouTube difficulties. I think we were streaming other places except for YouTube, but we're going to start this all over again. Hello and welcome to JP's product pick of the week. It's me, JP. We are here to check out a very cool, very exciting return of a product pick, a favorite of mine. It's been really hard to get the chip on this one for a couple of years now. So we've been out of stock. It's been a long time since you could get these, but they are back and they are back with the vengeance. We have a bunch of them. So what I'm going to do first of all is send you to the URL. If you want to go get them, head to that QR code, head to that URL right there. This show is broadcast from right inside of the product page, and you'll see that we've got a 50% off discount on this product pick. You don't need a coupon code or anything like that. It's just simple. During the broadcast only, this ends when the broadcast ends, you can get the discount. It's right there listed on the page. Throw them in your cart. You can get up to 10 of them if you're really super hyped about this product. They should be in stock. Don't panic. We've got a lot of this chip, so we're happily returning to bringing this one back in force. But if you've been dying for them for a project, go ahead and get some because they are half off today. What I want to do before I go further into it is have Lady A to jump back quite a bit in time from when this was first really available and tell you all about it, so take it away, Lady Aida. The Feather M4. Wow, you've been waiting for this. Feather M4 featuring the SAM D51 processor, running at 120 megahertz, 512K of flash, 192K of RAM. M4 has floating point support, has memory caching support, which is really great. I've been turning that on and using it in the Feather form factor you know and love. Got NeoPixel, got 2 megabytes of flash, got some proto area. We're using the SAM D51 J19. The reason Feather took a little bit longer than expected is we originally designed this with the J19 and then realized that it doesn't have I2S. The I2S was the last thing we checked and we realized for some reason that size chip didn't have I2S enabled. Why? I don't know. It's going to be great. So quickly we designed it to use the 64 pin QFN J19. Now you have I2S, we know I2S works, we've tested it. Dual 1 mega-cent per second DAC. Dual 1 mega-cent per second ADC. Parallel capture so you can do camera input. We've got some code. Yeah, we did some tests. It's impressive. It's incredibly fast for circuit finds. Of course, you can use it with Arduino. We have a working Arduino core. It works great. We've tested all of our feather wings with it. But if you're using with Circuit Python, you're going to be very, very happy. You're not going to run out of memory and it's going to be very speedy. The floating point support in particular because variables in Python kind of naturally become floating points, those are very, very, very fast. But everybody knows what they're getting. They're getting like the feather compatibility with all of our wings and then this ultra-high-powered fast chip, a wonderful display of high-powered electronics. And that's the new products. All right. Hey, hopefully she finished talking because I can't hear her. I can't monitor her audio right now. But that is it. That's this product right here. This is our product pick of the week this week. Oh my gosh, this old friend. This one has been a long time coming. It is the Feather M4 Express. One of my favorites, one of the original high-power, high-octane, heavy-duty feather boards. This one uses the At-SAM-D51. It is a powerhouse of a chip. You can run Arduino on it really well. You can run Circuit Python on it incredibly well, especially with floating point math. This one has that separate floating point capability, which is fantastic. What else? It's running at 120 megahertz. It has 2 megs of SPI flash, 512K of flash, 192K of RAM. There is a dual DAC on here. So this is one of the few where there is an analog pair, so you can do stereo right off of the board. We've got the A0 and the A1 pins that are both DACs, and we have a bunch of ADCs as well, so you can read in as well as write out analog, lots of analog on here. This one also, one of the things I really love about this is it has this lovely little prototyping area right here at the bottom. So if you have a small circuit you want to add to this, and you don't want to add a lot of breadboard or protoboard or even one of the screw shield breakout boards, protobords, you can use this little proto area here. There are a set of ground and 3 volt pins at the edges, and then you have this little grid here of pins that you can use. I'll show you an example of something here. You can see I've just added a potentiometer right there. So if I wanted to add a potentiometer, in fact forget about all this other stuff. Let me take this off of this board. Here you go. Here is the Feather M4 with a big huge potentiometer on the end. You could add all kinds of things, all kinds of little circuits on there depending what you need. In this case I've also extended its capabilities out by quite a bit, adding it onto one of these Feather Quad boards, so let me go ahead and change the focus on that so you can see it a little bit better, and I'm going to go ahead and fire this up and show you a little demo of a few of these boards in action with our Feather M4. Let me grab the cable here. This one uses the USB-B cable, micro-B, by the way, and I'm going to just improve that focus just a little bit more. Okay, so you can see here I've got the Feather M4. I'm also using a couple of I-square C boards on here. I have this seesaw joystick Feather Wing here. You can see I'm updating some analog values there. I've got a little OLED display Feather Wing. I've got a little Neopixel Feather Wing, and then also I have my little knob here. So what I'm going to do is I'm going to go ahead and light this up, light up those Neopixels, and you can see I'm using my little knob to adjust some brightness values there. I can hit the different buttons here to change some colors. We can run a little Neopixel animation there. Let me lower that brightness a little bit and rerun that. It's a little dark. There we go. And I can even adjust some of these color values with my joystick here. So this is just an example of the kinds of things that you can add onto a Feather, but this is a really great Feather to add onto. In fact, I've used this one for a lot of projects. If you want to take a look, here is the product page right here. This is product ID 3857. And if you scroll down, by the way, look at that price, $11.98. Great price for the Feather M4. Heck of a capable chip. What I'm going to do is scroll down a little bit and we'll get to the, there we go, the Learn Guide for this. This is the primary guide, Learn Guide. If you click on that, that will show you everything you need to know about powering the board, using the board. Don't forget it has LiPo battery charging on it. It has the same pinout as all of the typical Feather pinouts. So you can use a huge variety of Feather wings on top of it. We've got the pinout listed here. So you can go through and check out what, look at, look at how dense that is, that little graph there. You get a lot of capabilities on the pins. And if you take a look at one of the other links that's here, so see all guides. This will take you to a Learn Guide search that shows a ton of different projects using the Feather M4.  Here's one that I had on hand. This is my Piano Cade. So this is using the Feather M4 and a little breakout so that I can attach to a whole bunch of buttons, arcade buttons that light up and a joystick. That is just one of the many, oh, here's another one. This was a little game Dazzler graphic card that you can plug a Feather into. The Feather M4 is a really great one for that. And on and on and on. So go check out some of those Learn Guides to get an idea of some of the projects you can do with it. And like I said, it'll work really well under both Arduino and Circuit Python. I believe this also is one of the boards that you can run the Teensie Audio Library inside of Arduino on since it's an M4 chip. And we ported that. You should be able to use the Adafruit fork of that. I don't know if I can confirm that. I don't remember if I've done it. I've done it on some other of our M4 products. But it might be one that you could use for that in case you don't want to use Synth.io on a Circuit Python side of things. You could use Arduino on that. And like I said, you've got a pretty decent analog output, stereo analog output right on the board. Or you can, of course, use I2S if you want to plug out to a really high quality amplifier. Let's see a question from Sam J. Ohio with Arduino. Can it play MP3 off of SPI and use the DAC? I believe it can. I've played MP3 off of this board on, in fact, let me show you a Walkman project right here. I've got a double check if this uses. Oh, no, that's a different one. I use this RP2040. But I believe it can. I believe you can play MP3. If anyone has experience with that, please answer in the chat. By the way, if you're wondering who I'm talking to, there's our chat right there. We have our Discord server over at itafrew.it slash Discord. Look for the live broadcast chat channel. See Grover says, love that feather.  Yeah, M4 is a powerhouse of a chip, really terrific platform for a lot of your Circuit Python and Arduino needs. Let's see. If you wanted to, by the way, just take a look at this demo again for a moment here. This is one I created in Circuit Python. So here you can see some of the stuff we're doing. We're importing a bunch of libraries, including CSAW, so we could use this little joystick here. We're using a OLED display and display IO. I have the Neopixel running inside of this little feather wing right here. I've added an analog IO so I can do the potentiometer that I bolted to the edge there. This uses a CSAW button mask set up for reading those buttons. So it happens very quickly. We just get a bit mask of all the buttons that are being pressed. We've got a couple helper functions there for some color stuff. And then the main loop here, we're just checking the knob. If it changes, then we'll go ahead and adjust the brightness. If we're holding down this top button, then we change the joystick. We can change those colors out. And then we've got some static colors there, as well as a little color cycle that we can press there with the top button. So this is a typical set up here on the Feather M4. Just grabbing a bunch of different libraries. Got plenty of space for them. Lots of memory, lots of speed. So we are so excited this one is back in stock. Like I said, it's been a while. Last, I think, was a couple of years ago, maybe, that we sold through these. And it was just that dang at SamD51 chip that we were waiting on. But we've got buckets and buckets and buckets of those in. So we are making the M4 Feathers again. So this is your opportunity to go grab some. Head to this URL right here, like I said. And look at the price on this thing. It is $11.98 right now. Hopefully it's still in stock. I'll refresh. Yes, they are. So you should be good to get those. Oh, look, it says I last purchased it on May 4th, 2022. All right, that's the last that we had it, actually, a little more recently. I think there was a long while where we didn't have them, and then we were able to do a small run, and then they've been gone since then. So order history on Adafruit is really helpful for figuring out when I got stuff. All right, I think that's going to do it for today. Thanks, everyone, for coming and stopping by. Remember, head on over to that URL if you want to go pick up some of these boards. That is my product pick of the week this week. It is the Feather M4 Express, the return of the Feather M4 Express. Thanks, everyone, for stopping by for Adafruit Industries. I'm John Park, and this has been JPE's product pick of the week.


For those of you looking to ride into the new year, a group of bicyclists are preparing for a brisk ride around Lake Bemidji. For nine years, the Burr-Midji New Year's bike ride has taken place no matter what the weather conditions may be. The ride is free and open to anyone who wants to brave the bitter cold elements and kick off the new year in a healthy way. Bikes will stage at Cabin Coffee in downtown Bemidji at 12.30 with the ride beginning shortly after at 1. Generally speaking, there's a hard course who go the 17 miles around the lake. And then there's a group of us that just depending on the weather and our desire, we'll go anywhere between two and maybe ten or so miles and, you know, do some fun things like bike around on the lake a little bit or bike around Lake Irvin or whatever suits our fancy. Now anyone interested is invited to just show up New Year's Day between 12.30 and 1 o'clock PM and then afterwards participants will gather for warm food and beverages at Cabin Coffee House. If you've enjoyed this segment of Lakeland News, please consider making a tax-deductible contribution to Lakeland Public Television.


Our next caller is Kate from California. Hey, Kate, how can we help you? Hi, guys. Thanks for answering my question. I really appreciate it. Yeah, let's go. So I started weightlifting probably like five years ago, and at the time I was very active in Brazilian jiu-jitsu. So the training that I did really was just to compliment my martial arts. Since then, I have not been training so much in BJJ, and I just want to focus more on my physique. I've never followed a structured program, so I was really interested in choosing one of the maps programs, and I had my eye on anabolic. I have a question, though, as regards the, what do you guys call it, like the little extra add on programs? Maps mods. The mods. Yes. Yeah, my shoulders are something that I really want to see some more development in, so I was wondering if I could add one of the shoulder mods to maps anabolic.  I just think you'll get great benefits in your shoulders just from running anabolic, and before throwing more volume on it with like a mod or just trying to add more, like follow the program, and then transition into a program that was designed to sculpt and bring up body parts. OK, are you still doing Brazilian Jiu Jitsu or anything else, or is this going to be pure now resistance training? It's pretty much pure resistance training. I have about four or five days during the week that I do like to go to the gym. I do cycling and running on the side, but that's more like a fun thing for me. OK, yeah, so I'm with Adam. Maps anabolic, now that you have the choice in maps anabolic to do two or three foundational workouts a week, I would recommend that you do three. And then the trigger sessions, if you want, you can focus on your shoulders with the trigger sessions on the days in between, and you should see significant progress with strength, muscle, and body sculpting. So let's go in that direction. After you do maps anabolic, the three foundational workouts, the trigger sessions, after you complete it, then move to Maps Aesthetic, like Adam said. And then let's see what happens to your body. But I think you're going to do phenomenal. You're going to see a lot of great results, especially if you really focus on those trigger sessions, hitting them multiple times a day, which a lot of people don't really read that part. And I want to emphasize that because you're going to get that recovery. And also, it's going to help you to boost your performance going into the next workout. Now you said you don't have maps anabolic, correct? I do not. No, I was, I've been scrolling through all the programs. I'm going, OK, which one's for me? Well, Kate, I want you to check under your chair right now. My cat's there. You get a program. We're sending maps anabolic to you for free. Oh my gosh, thank you. Everybody gets maps. All right, so we're going to send that over to you and then follow it like we just said. And please keep in touch. Let us know what your progress is. More specifically with the trigger sessions, I think I would actually do. So when you do your trigger sessions, you'll see, and listen, watch the videos, make sure. Here's a mistake. Everybody thinks that trigger sessions are like another workout. The intensity level is supposed to be a lot lower. You're not trying to just get in a pump. That's right. You're just kind of getting a pump.  There you go. Every trigger session. And we do like three rounds of that. That would be like my prescription to you before we scale into Maps Aesthetic. Sounds great. All right. Let us know what happens, OK, Kate? Thanks. Super excited. Thank you, guys. No problem. Under her chair. It's under your chair. You're trying to say that for so long. Well, you know what? Because you have their email, right, Doug? You have her email already or no? Jerry does, yeah. It's too bad, Doug. Because if you had it right away, it would be kind of cool to him already be sending it, and then you steal the sender. Check your right pocket. Just kidding. Check your email right now. Boom, it's there.  Just because she stopped Brazilian Jiu-Jitsu and is focusing entirely on resistance training. She's going to get the benefits of that. Oh, yeah. She's going to build some good muscles. That's why I like this question. Because again, it highlights all of our tendency, I feel, is just humans, right? We want to do all of that. I want to build my shoulders. So I see you guys have a mod program. I see you have a program that's for aesthetics. But you're going to get tremendous benefits from just running anabolic. And if you want the max benefits from the mod, the max benefits from aesthetic, then you will follow it in that order. If you jump. There's steps. You don't want to do all the steps at the same time. That's right.


I've rejected 900 plus design resumes before interview because they all made these four deadly application mistakes. Number three, too wordy or lengthy. Unless you have over 10 years of design experience, a one page resume is enough. Delete experiences slash skills that are irrelevant for the job or too obvious. Make every bullet point short, precise, and value based. For example, specific action, outcome slash impact of this action. Number four, shiny designs, shitty content. A pretty resume means nothing if it lacks key information filled with grammar spelling mistakes.  Put the effort to review the content of your resume. It shows that you actually care about the job for those with the four deadly mistakes.