So, a very warm welcome to Thomas Rote. He is a security researcher, and his specialty is exploiting techniques and reverse engineering and industrial security. And the talk today will be about Skyder, the gateway to Shell. Yeah. And just one little notice. This talk will be in English and will be translated in German as well. Thank you. Thank you. Awesome. Thank you. Okay. Yeah. Welcome to my talk, Gateway to Shell. Who am I? He already introduced me, but still my name is Thomas Roth. I'm a security researcher. I do a lot of low-level security, so a lot of arm-reverse engineering, cold fire, and so on. And yeah, you can find me on Twitter, or if you want to write me an email, feel free to send me one to thomas at stacksmachine.net. Before we start, a short introduction to the background of this talk. So this year I did some SCADA penetration tests, and I found that while the PLCs and so on are pretty well covered in the security research area, I found that all the small devices that surround SCADA environments are not really well covered. So basically, we have the big Siemens PLCs and so on, and there's a lot of research going on about them. But there are also a ton of other small Ethernet devices involved in industrial networks that are not really researched very well yet. And all devices that we're going to talk about are running their latest respective firmware. Unfortunately, there will be zero days. And these are not theoretical attacks. If you go to Shoden or a similar search engine, you can find tenth of thousands of these devices vulnerable and open in the Internet. So let me give you a quick introduction into the terminology in SCADA, because I know in the title I say SCADA, but actually it should be ICS, which stands for industrial control systems, because basically ICS describes the whole system from your supervision, the big room with all the big screens, up to your PLCs, the sensors, the actors, and so on that you will find in your installation. And the term SCADA just describes the supervision and control centers, so the big screens that you might know from movies and so on, where when the bad guy comes suddenly all the lights turn red. Then there's something called a PLC, which is a programmable logic controller. It's basically like an Arduino just for industrial applications. And they are really easy to program, and you can get them from Siemens or Schneider and so on and so forth. Then there's something called an RTU, a remote terminal unit, which is a small device that generally or well back in the day was only used for monitoring. But today you can actually program a lot of RTUs, so it's kind of a mix between a PLC and an RTU, so it's basically a PLC in a remote location. Alrighty, to the actual topic, industrial control gateways. So when you look at an industrial control network, you'll find that there are a lot of different sensors and actors, and a lot of them speak different protocols. So for example, some might be serial, some might be IP, some might be Modbus, and so on. And so you can buy these small gateways that connect all these different protocols to an IP network. So for example via Ethernet, or even via GPRS, or Wi-Fi, and so on. And I've seen them in almost any industrial installation that I've seen. So for example, they're used in power plants, they're used in water dam control systems, they're used to control the power grid and so on. And the security concept is, hey, but these devices are air-gapped, so it doesn't matter really if they are vulnerable or not fully up to date and so on. But that's not really true, because a lot of these devices, while they might be air-gapped, they also have antennas and they are interconnected by a ton of different wireless protocols, such as Wi-Fi, Lora, or GSM, or even proprietary radio links. So yeah, and even the case studies show that basically in this case, you would have a monitoring network that's connected via the cellular network to control the water mains and so on and check the pressure. Or even worse, they even recommend that you connect actors like valves and water level gauges and so on over GPS, which we know is not a secure protocol to do anything that could be critical. Or you have stuff like water storage tanks that are controlled via Wi-Fi and so on, or even public in the internet. So yeah, these devices are air-gapped, nope. So attacking in the field, I already mentioned, if you go to Shodan, you will find a ton of different devices reachable via the internet and even via GPS. So if you live close to, for example, a dam or something, it's kind of interesting to look at an SDR or similar radio equipment to see what's going over the airwaves, because you will find a ton of interesting stuff. And sometimes you can even very trivially get physical access to the infield devices because they might just be in a white box somewhere hidden and if you break into it, you can pull out the SIM card and it will put you directly into the SCADA network if you're lucky. Don't do that, by the way. So yeah, let's hack some gateways. So the equipment you will need to, and everything in this talk was done on this desk just using these devices. So you really, you just need a laptop. You need an oscilloscope or similar measurement equipment just to ensure that you don't burn out your logic analyzer. You need a logic analyzer, a soldering iron, a multimeter and a power supply. And that's really basically it, because you can hack almost any embedded device that's using these devices. And to find potential targets, I have this kind of map where I first tried to understand, can I get the firmware of the device or do I have to somehow, for example, use JTAG to get it out of the device? Can I actually buy the devices at a sensible price? Because some of these devices cost like 600 euro or so. And if you buy 10 of them, that gets expensive very quickly. And so I need to check eBay and see what devices can I actually buy. And they should be a half what current, because if you look at all the devices like 10 years old or so, they're completely broken. You don't even have to look to start to look at their security. So yeah, the first device that I that I choose to really look at was the Moxa W21508, which is this small device, which is also mounted on the board right here. Mainly because I found the firmware was available and it looked like an interesting device because it has Wi-Fi and so if I manage to break into it, I can jump an air gap potentially. And the W21508 is just a simple device server so you can connect any serial device, any RS485 device simply to it and it will be exposed via ethernet or even via Wi-Fi and you can download the firmware publicly and it's available on eBay relatively cheap, so like 150 bucks or something. So I downloaded the firmware and I looked at the entropy of the firmware and I immediately saw that the entropy is very high, which means either it's very compressed or it's encrypted. Unfortunately, using a tool called BinWalk, which is really useful for looking into firmwares, I saw that there's no compression detected and so it was very likely that this firmware image is encrypted. But I noticed on the web page that before you upgrade to version 2.0 or 2.1 of the firmware, you must upgrade to the firmware version 1.11. And I thought, hmm, that's interesting. Let's look at the release notes for version 1.11. And it turns out that 1.11 adds the support for the encrypted firmware. So I downloaded the 1.11 firmware and sure enough it's unencrypted. And if you've ever done anything with ARM before, if you just look into a firmware hack stump, you can immediately recognize whether it's ARM or not, because the first four bits of each instructions are the conditional bits and those are almost always E. So if you see a hack stump and roughly every fourth byte is an E, you know this is an ARM firmware and it's not encrypted or anything else. And so yeah, sure enough, I ran BinWalk on this image. This time we see there's a huge drop in entropy, which is the boot loader and so on, and then a high entropy, which is basically all the compressed file systems and so on. And BinWalk was able to detect the SquashFS file system and extract it for me very, very easy. And so my goal was to extract the firmware, find the firmware upgrade code, and somehow try to decipher the new firmware. And yeah, so I was browsing through the files and sure enough found a file that was helpfully called libupgradefirmware.sharedobject. And if we look into the symbols, which they luckily didn't remove for anything, there's a beautiful symbol called firmware decrypt. So we load the whole thing into this assembler and we see that there's some fancy, oops, that there's some fancy XORing going on in the bottom left corner and I'm going to walk you through what exactly is happening in this code. So basically first there's a variable called password loaded into the register R2. And then a second counter variable is basically set. And it starts looping and increasing always by four and goes through this whole, oops, sorry, my screen's so here. And it goes through this whole XOR shebang and it turns out that this is the obfuscation method for the AS key. So in password, in memory we have an obfuscated key and we can be obfuscated by just implementing the code we see here in C or in the emulator. And sure enough, eventually this will be used as the key into the ECB 128 AS decryption. And so I implemented the whole thing in C. It was almost a copy paste from the decompiler. So you can, in Ida Pro, you just hit F5, copy the C code, add a bit, fix the memory offsets and so on. And you have the whole key obfuscation method, basically reverse engineered almost automatically. And so I compile it and sure enough, moxa key extraction, it turns out that the key is 2887 con 7564. I build a short script to decrypt the 2.1 firmware and this time binwalk finds all the files and we can start reverse engineering the actual firmware. These scripts for this are available on my GitHub. I'll push the actual decrypt stuff after the talk because this is the first time I think this has been released. And so after I was at this point, I knew that the firmware is, I can decrypt the firmware, I can look into it. By the way, it's not signed or anything. The only verification method is CRC32. And so at this point I knew, okay, I can buy this device and start playing with it. And so I went to eBay. I bought one. I got it. I screwed it open and sure enough, there's an ARM processor in there. It's an free scale, which is just a regular ARM processor. It's like 400 megahertz or something. I don't know. And I started probing all the small pins inside of the device to try to find JTAG or serial or anything.  And sure enough, I found that there's a full serial console available inside of the device on these pins. And if you boot the device, it even tells you please press enter to activate this console. And so you do that and you are root on the device. So that's kind of cool, but that means that you won't require physical access. So it's not really a vulnerability, but it's very nice to have when doing security research because it means you can suddenly debug all the code on there. And so if you write an exploit, you can just attach GDB to the binary and start very, very simply writing the exploit. So at this point, it was time to look at the available services on the device. So for example, there's a web interface. There's a proprietary configuration protocol. There's Telnet. There's SNMP. There's a serial driver protocol and so on. I started looking at the web interface and there was cross-site scripting. There was cross-site request forgery. There was insecure authentication where they basically hash on the client. So they have some JavaScript that hashes your password and then locks you in. Then there's a command injection which lets you execute code as root. There are stack overflows. And just a week ago, there was a zero-day released for the web server. So yeah, demo time. So just let me open up the Moxa page right here. And so this one is authenticated. So I'll just enter the default password, which by the way, in the field, 90% of the time, these devices will be configured with default credentials. But still, so if we just start browsing through this thing and go to the basic settings, we can start with a simple cross-site scripting just in the device name. So for example, we just paste in some JavaScript, submit the whole thing, and hello 34 C3. I know what you're thinking, cross-site scripting, come on, that's not a vulnerability, that's just nothing. So let's look at the ping test that's integrated into this device. And finally, a different device from Moxa that runs an entirely different firmware had the same vulnerability in the past. But if I just paste in my ping, so my IP address, a semi-colon, and then for example, I cut ETC past WT and activate N, sure enough, here we go. Kind of handy, but yeah, for sure not intended. Alrighty, but I know what you're thinking, right? Like these are authenticated bugs in the web interface. So we need something unauthenticated, we want something that's like cool and real exploit, right? And so I decided to look at the this custom TCP protocol which runs on port 4900. And my goal was to reverse engineer the whole protocol and build a fuzzer for it to find vulnerabilities. That turned out not to be necessary. So during some testing, I just sent a lot of bytes onto this thing and enabled crash debugging via the serial console. And sure enough, it crashed and put my program counter right to<PHONE_NUMBER>. Wonderful. Thank you, Moxa. So demo time. So let's increase the size of this a bit. So I built a small script which is called Moxa Pong and I'll just supply the IP address to it. Let's see. Opening a second shell to connect to the VNETCAD. Here we go. We have a root shell on the device. So yeah, that was the Moxa W2150A, basically rolls of the tongue. And so the next device I decided to look at was the advantage EKI 1522, which you can find right here. And it's again just a simple serial device server this time without Wi-Fi, even though they are available with Wi-Fi. It comes with two Ethernet ports, two serial ports and so on. I basically followed the same steps again. So I looked at the, I downloaded the firmware, I looked at the edit using binwalk and this time we see almost no entropy. So this guy is basically completely unencrypted. And again we saw it's ARM32 bit. It runs a Linux kernel 2.631 and a Boa web server where the last update was in 2005. And the firmware I think is from 2017. So these are kind of outdated. And I found during the initial analysis just of the firmware that the main binary to look at will be this edge server binary. And so I loaded it into Ida Pro and looked at the different things it calls. And there are a lot of calls to functions like string copy, to system, to sprint, and so on. They're generally kind of considered unsecure. And sure enough, during static analysis I found that there's some code for sending an email as an alert, for example, when the system reboots. And the full command invocation is mail X dash S blah, blah, blah, blah. And we have control over some parts in the string because we can configure the two address in the UI. And if we look at what's happening here, it basically just sets up this format string, then it goes to include the subject, and then it gets some arguments from the stack. And basically calls into system. And so there's no filtering going on at all. So we have a non-filtered part of the system invocation code execution. And this was before I had the device in my hand. And this is kind of a funny story because I first bought because it was just 40 bucks, I bought this device, which in the firmware has the same buck, but the mail functionality is broken, so I couldn't test it. So I had to go to eBay again by another one, and yeah, by the bigger one. And so I ordered the bigger one on eBay. It looks like this. It comes with a Cavium CNS CPU. It has JTAG exposed on the bottom there. And serial console is available again without any authentication. So beautiful. You just connect your bus pirate or your UART adapter to it. And you have full serial console. So again, we had to look at finding vulnerabilities for this device. And there are again a ton of different services. There's like a web interface available. There's a proprietary configuration protocol that's based on UDP. There is Telnet. There's SNMP. There's a serial driver protocol and so on. And again, looked at the website and again, cross-site scripting, cross-site request forgery, command injection, broken authentication, which basically if you look in from one computer, it uses I think HTTP digest authentication. You can connect from a completely different computer and it doesn't ask for a password. I don't know why that is, but yeah. I was thinking I was doing something wrong, but it turned out it was just broken. And there's again a stack overflow in another protocol. So, I guess again, demo time. Let's first look at the device itself. So we have a nice device description here. This is just a basic web interface. And we can again just copy in some basic JavaScript. Hit the save button. Reload. And there we go. Cross-site scripting yet again. Okay. Again, not really interesting, right? So let's look at the stack overflow. Again, I have a small script advantage. Pawn. Forgot the IP there. And we have Netcat running on there. Sure enough. There we go. That's root on the advantage device. Again, the stack overflow. Yeah. So two of three devices basically broken already. Let's look at the next one. This one is the Lantronics EDS 2100. And this one is kind of interesting because it's not ARM. And I normally, I almost exclusively do ARM. So this one was kind of interesting. And this device, which is mounted somewhere right here. Yeah. This device comes with a serial, to ethernet, secure device server. It has two serial ports. It has ethernet. And you can buy it in two variants. One comes with Linux. And one is Evolution OS, which is, I guess, a proprietary operating system from Lantronics. And I'm using the Evolution OS variant in this talk. Looking at the firmware, it turns out it's unencrypted. And it's cold fire architecture, which I've never done really anything with before. And there are no obvious external software components. So if you go through the firmware, you'll find there's an SSH implementation. There's an SSL implementation. But it's not open SSL. And it's not anything very well known. And the same is true for the web server. And so there's not really anything that's well known. And this time, while probing the device, I did not really find anything interesting in terms of serial console or so. But I just found a potential debugger port. But I didn't have a fitting debugger, unfortunately. The CPU is from NXP. It runs at 160 megahertz or something. Yeah. This time, we actually have a web interface with Telnet, SSL, and it even has a file system. So you have like FTP and TFTP, which allows you to download the configuration, upload the configuration, and so on.  And it's not really clear what's set up by default. But yeah, you get the idea. And this time, the web interface was surprisingly secure. So there was no cross-site scripting. There was no command injection, because there's also not really a shell that you could execute commands into. But I still found some stuff. One is the configuration injection, which allows you basically to change the format of the configuration using a different field. And I found an authentication bypass. So I was able to write a small piece of code that takes a while and then completely removes the password from the device. Demo time. So if we connect to the Lantronics device, it will currently ask for a password, which, in theory, we don't have. Let's clean up here a bit. I don't know. I think it's just... And let's run Lantronics on. Oh, that was fast. I hope that worked. Yeah, sure enough, the password is gone. Awesome. To be honest, I didn't expect the demos to go so smoothly. So I put in an hour for the talk, but this went very well so far. So that's cool. So before we finish already, some other devices are even worse. So, for example, as I mentioned, I bought some other devices. For example, this advantage device, this moxa device, and this Lantronics device, which are basically the predecessors of the other devices. And those guys are really interesting to look at, one could say. So some of those are running ECOS, which is an embedded Linux platform, which was last released in 2009. And some devices run a Linux kernel with the 2.4 version, and you see Linux without any memory protection whatsoever. So even a small stack overflow in one of the user space applications gives you full root access to the device, because you can directly exploit the kernel. And there are unfixed public vulnerabilities. So in the first penetration test that I did, that included actually this device, a moxa and port, a small one, I found that using SNMP walk, it gives you back the administration password via SNMP. And so I went online, I tried to report it, and it turns out it's well known, there's a Metasploit module for this, and it's unfixed. And these devices are still in support, so I don't know why the vendor is not patching this. So in the summary, we have trivial vulnerabilities in most devices, or at least all that I've looked at. There are no security mitigations whatsoever, so they don't even enable the compiler flex that you just set, and then you have at least some kind of stack protection and stack cookies and whatnot. And some vendors are really bad at responding to vulnerability reports, so I'm not going to name the vendor, but on Twitter I asked them to please give me a security contact, and they responded, please use our contact form, and I said, I did three times, I send you emails, you're not responding to me, and so they stopped responding to me on Twitter too. So how to mitigate? Well, the only way that I would see to mitigate against this, and I'm more on the deconstructive side of the story, is defense and def. So never directly expose any of these devices to the internet. Even if they say they support VPN, even if they say they are a secure device server, whatever, just don't do it. Get a real VPN gateway, and make sure that you never rely on a single level of, for example, encryption. So for example, WPA2 was broken by the crack attack, and they actually released a patch for it after two months, and these are still two months where you are exposed to vulnerability on your potentially mission critical system. Also never use GPRS for these devices without VPN, because it just, it will go wrong. Aki, yeah, thank you. I guess now we have time for Q&A. Thank you all for coming. Thank you very much for the talk. So we have very much time for Q&A, so please line up to the microphones, and we have someone at microphone for already. Yes, hello. Thanks for your talk. This is, obviously this is a problem, this is a part of a bigger problem of security in IT, right, in anything related to any kind of technology, and this is only going to go worse with time, right, internet of shit, I mean things, and so on and so forth. So my question is, you gave some ideas how to mitigate this in this very specific area, like use VPNs, et cetera, et cetera, but my question is, so hacker community is not very, let's say, interested in regulation, right? When we see a government trying to do something with technology, that usually goes bad, we have this idea in our head that okay, this can only go, like this can only go bad, right? So my question is, do you think that perhaps there is some space for regulation here? There's definitely space for regulation, but I think regulation does not solve the underlying technical issues. So these devices, it's 2017, and these devices are using C code. That's just asking for trouble basically, and so we really need to see the shift even in the embedded world to switch to memory safe languages, for example Rust or something similar, and really to stop using C in this kind of context. I don't think there's anyone who can... Thank you. But there's definitely space for regulation. Thanks, there was a question from the internet. Hello, okay. Yeah, the internet wants to know why you are not naming the bad vendor, because it looks like it's the only option basically if they don't respond to you. Let's say I ask them on Twitter, and my Twitter is right there, and if you click on, Twitter replies. Yeah, somebody just posted the link on IRC. I did not name them, just for the record. So we have a question from microphone number two. So you've shown an exploit for the last device that disabled authentication. What did you use to achieve that? So this one is unpatched and not yet fixed, so I would rather not disclose the details yet. Microphone number one, please. I wonder if you've also been looking at building automation systems, control systems, or just industrial automation control systems. So you can use these devices basically wherever you want, and I think some of the moxa ones are used in home automation, but I've looked at, I guess, Crestron, it's called, but not in a lot of detail, so I'm more on the industrial side at the moment. Thanks. Microphone number three. Hi. Any field experience or even just opinions on using industrial strength Raspberry Pi hardware with community supported Linux distributions or something like OpenBC, whatever on them? Yeah, so I guess the big trouble there is support, right? There are some German companies and so on that provide support for industrial Raspberry Pis and even like nice casing and so on, but I'm not sure if really Raspberry Pi is the way to go here. I think there are boards that are, the problem is not the underlying stack, right? It's not the hardware really that's the issue, it's the software, and you will have the same issues on the Raspberry Pi. So yeah, I guess you could buy these devices which are like industrial grade shockproof and whatnot and put some Linux on it and do it better, but I don't think that the hardware or platform will change anything at the moment. So there's another question from microphone number four. Hi. More social question. Did you get in contact to any development team, software development team in any of these companies or might it be that there is no one behind the emails and everything? So I guess some of these companies are really so big that they don't reply to you if you don't have a support contract with them. But for example, the support of the ones that are not on my Twitter is kind of decent when it comes to security reports. And so my next steps will be to go via the ICS cert to report them. So yes, there are development teams that will get in contact with you just not from all vendors. Thank you. We have another question from the internet. Hello. Okay. The internet wants to know what to do about because there are a lot of old devices in the field. How do you propose a vendor should deal with legacy devices and updates? Yeah. So keeping legacy devices supported is very expensive because for example, if you buy a Qualcomm chip, they will eventually drop support for the Linux kind of weight and so on.  But then you actually have to invest the money to regularly provide the updates and ensure that your devices are secure. The problem is that the lifetime of industrial installations currently is much larger than the lifetime of these processor supports and so on. So I guess we'll have to get used to upgrading our hardware regularly or switch to or figure out a different way of deploying secure software onto them. But I really think the underlying problem is that we are still using memory unsaved languages. And I guess the fact that there's cross-site scripting just shows that there's no security awareness really at those vendors whatsoever. That's some of the vendors. So microphone number two, please. I was wondering, you mentioned that some of these facilities use GPRS. Do you know if they have mostly their own closed infrastructure or if they're using general consumer telecom stuff? So they will use commercial networks mostly, and then they have custom APNs which have an IP sector or something similar to their premises. But there's also a company that sells industrial control SIM cards which give you a public IP and you don't want to search on shoulder for that vendor. Yeah, thank you. So there's the question from microphone number three. Hi there. Isn't economics meant to solve some of these problems? We're not talking about dirt cheap devices. Surely at 300 bucks you should better hire someone who's read Security 101. How long before large organization gets the result of their security audit and goes to the aforementioned vendors and says provide us something that's not trivially hackable, otherwise we stop buying your rubbish? Well, I mean it's the same in all of IT, right? So everything has vulnerabilities and yes there should be market pressure but that's why I'm trying to raise awareness for the issues that these devices have. Thanks. So there's another question from the internet. Yep, the internet wants to know how and if it's a good idea to raise awareness in public because they think it's a good approach to make people, the public know that well infrastructure in the city is at risk. Sorry, could you repeat the first part of the question? Yeah, they want to know how to raise awareness for this in the public. Good question. I guess we need some news articles or something about this in regular paper but I personally think it's just an accident waiting to happen. So eventually someone will turn off the lights in a city or wherever will open a flat valve or something and that's when the awareness will start. There's another question from microphone number four. Okay. For what kind of industrial processes are these devices you just demoed used? So I've seen them in power utility. I know they're used in water, water dam control systems they're used in connecting a CNC machine to the network they're used in connecting all kinds of stuff because if you have a big plant you have a ton of different sensors so you might need a water level sensor and for whatever reason you only can get it with a mod bus and then you need to convert the mod bus to a TCP and then you need one of these gateways and so I've seen in one cabinet 20 of them so they really used a lot I guess. Okay, thank you. I just retweeted your tweet to Star Alliance. Thank you. So there's another question from the internet. Yeah, the internet wants to know how if you did any research on MQTT for example from like back of users? I actually talked to someone who recommended me to look at back of yesterday but I've not looked at them whatsoever yet. And there's another question from microphone three. Okay, could you show the Moxa web panel because I would like to double check which browser they would like you to see their web page and I think this browser isn't very secure. Okay, let's take a look. Yeah and undergo a head web server there is small print. Nice finding. That's probably the issue. Any more questions? Any questions from the internet? Hello, okay. The internet wants to know how a memory safe language would prevent the authentication bypass you showed? That one would not be protected against but protects against a ton of other stuff. It's just one example of where the industry needs to change. We need to stop using memory unsafe languages. We need to start really thinking about security design from the start and we must not in 2017 there's no excuse for having cross-site scripting or anything on the web page. That's also if we in the Lantronics website if you click logout it tells you logout is not supported in your browser. Probably because I'm not using Internet Explorer 5. So there's another question from microphone number three. Any remote part of the exploit where you did a buffer overflow I think? Yeah. What I'm wondering is aren't it like very standard to have ASLR on these devices? No, it should be but it isn't. Okay, thank you. That was pretty much my question. Okay, is there another question from the internet? No, it doesn't seem like it. One just came in. Okay. If you want to hurt. Okay, no. So all right, give a very warm applause to Thomas Road again.


So, if you want a great movie from early 80s with great acting, the psychology of dreams and projecting your dreams and other people's dreams, it's pretty cool. Definitely check out The Sender. And until next time, keep drinking.


Hello and welcome to the Jenkins documentation office hours. Today is August 3rd and this is the EU-US edition. Today we have myself, Breva Roxton and Mark White, and on our agenda today. So we have some new blog posts to highlight at the next LTS baseline. The weekly release for this week, last week's weekly and LTS releases. There was a security advisory published last week. Some notes on Google Summer of Code, the Java 17 transition in the documentation, a couple of pull requests of interest, and some notes on DevOps World Tour. Is there anything else that we should add to the discussion or put on the agenda for today? I was thinking of my infamous PR regarding the automatic update of dependencies in the documentation. Yeah, it didn't work as expected, but we shall maybe discuss it. Quite the opposite. I think it worked beautifully. Okay, there are some improvements that are probably going to help, but I definitely want it on the agenda. Absolutely. Okay, thank you, Mark. Yeah, go ahead and add that then. So make sure that's in here. Okay, fantastic. Thank you, Bruno. Anything else to put on here? Okay, first up. So for blog posts, so we actually published the July newsletter this past Monday or Tuesday, I should say. So that, sorry, Wednesday, yesterday. So that's available now, because it's great. We were able to get it out a little sooner than later this month. So really nice work done here from everyone, thanks to all of the SIG leaders for their input and their additions. And yeah, we want to see more about what we were able to accomplish in July, the Jenkins newsletter is available. In addition to that, we had our, so for the Google Summer of Code, we just had our midterm presentations a couple weeks ago, and there is a blog post just kind of recapping that, explaining some of the insights and work that our participants have done thus far and where things are heading. And finally, we published a blog post to share the announcement and transition of Java 17 usage in the documentation. So this is now live, explaining what kind of happened, some background as to why and what that means for Jenkins users. Ultimately, we just want to encourage people to use Java 17 if they feel like they can. It's just going to provide more benefits and tools. So why not jumpstart that? Next LTS baseline. So it's been decided it's going to be 2.414 at this point. So 2.414.1 is currently set to release on August 23rd. I'm working on the change log and upgrade guide at this point in time, drafting it, putting it together. And the release candidate is planned to be available for August 9th, so one week from yesterday. And yeah, there's still need to be some security backports between now and the release. But other than that, it does look pretty good. Most people have voted for it and are in favor of it. And yeah, more come there. We had weekly 2.417 release successfully. So good to go on there. And last week, we had LTS 2.401.3 release and weekly 2.416 release. Things to note here is that they were security releases. So the Jenkins security team did publish those and release those. They also published a security advisory last week, just to note that there are issues affecting Jenkins core and plugins. So if you need for further information here, there is plenty of insight that the security team is provided. Next up, so for Google Summer of Code, again, the midterm presentations happened towards the beginning of July. So works being progressed very well, thanks to all of the participants for their work and their efforts here. They have presented and have, we actually recorded that as part of the webinar. So they are available. You can check that out from these links. Actually not that one, but Jenkins Online Meetup has been recorded just like we do for all of our Jenkins meetings. So this is available on YouTube as well. And something that I wanted to share is, again, just a preview of the project, the building Jenkins.io with alternative tools. This is being worked on by Von Diezing. And this is the demo site for using Antora as for the Jenkins.io site build. It's got really good clean visuals to it. It's presented very nicely. Functionally, it lends itself to just a little bit more clean navigation and various other parts of just navigating the Jenkins.io site. It looks really good. I think there's a lot that still, there's still definitely work that needs to be done, but for the most part, this is a definitely, I think this is a very nice improvement over the existing site build. And the big thing here is this allows us to have version documentation. So instead of constantly having to worry about the documentation changing and what version a user might be on, this gives us the ability to have all the documentation available and users can pick and choose what version they're on to get the corresponding documentation. And that just makes life a lot easier for any users that are looking to get info for maybe a couple versions older that they might be interested in the Java 11 versus the Java 17, for instance, as a recent change. And so having that version choice is huge. In regards to the Java 17 transition, so this is mostly complete. The only item that has not been completed yet is the Windows installation instructions. This has more to do with the fact that the Jenkins version currently used in the screen shots is much older than we would like it to be. So this needs to be updated accordingly. It does have one mention of Java 8 in one of the folder structures, but outside of that, it's really more just making sure the screenshots are upstate relevant to what people are doing now than anything else. And when we shoot the screenshots, we'll naturally get Java 17 there. And if we don't, we should force ourselves to do it. Yeah. Yeah, absolutely. And we should not take it in program files Java, because that's not where Eclipse installs there anymore. I'm pretty sure anyway it's not. Gotcha. And I'm currently working with my IT department to figure out best course of action to get me on Windows so that I can get these screenshots, worst case scenario. If anyone wants to assist and take some screenshots, feel free. The Jenkins issue is available. So on GitHub, you can see here what the work's been done and where we've gotten to thus far. And yeah. So open for anyone to take over if they want to, but I am working on that. We've also added an instructions page for the Java 11 to Java 17 transition. Darren Pope's created a video for it. So I'll make sense to you include here and provide instructions on folks upgrading. Biggest thing here is not only upgrading, but making sure that all install plugins are updated as well, both prior to and after the upgrade. This ensures that the compatibility is there. And then on, in addition to the Java 17 transition, Mark's actually submitted a proposal this week about what the action plan is for Java 11, Java 17, and Java 21 support in Jenkins. Now, Mark, I got a pretty okay idea of all this. Would you like to give an overview of this and kind of share more about this? Yeah. So I would like that. So if there are multiple parts and pieces to this proposal, it just happened to work well that it could all sit in a single proposal. The proposal is publicly readable. So the link in the documentation office hours agenda will get people to this document. But the concept is first, let's talk about Java 11, because Java 11 is the immediate and most pressing question. Java 11 support will end from Eclipse, Temeron, Red Hat, and Microsoft in October 2024. So the Jenkins project's rules about support is we don't support something that an upstream vendor stops supporting. So the end of life for Java 11 means it's end of life for Jenkins as well. But we need to get the message to Jenkins users. So the first step of the proposal was let's accept that October 31 is the end of life. And then the second step was let's put the administrative monitor that we had done something like what we did for the Java 8 to 11 transition. Let's put that in, in a weekly in October, so that it will naturally appear in a December in the December LTS, that is the 2.426 roughly dot one initial LTS. The idea being we give weekly users 12 full months of warning that Java 11 is going away. And we give LTS users nine months plus. So the idea the idea is Java 11 support will end. We're not changing that. And since Java 11 support will end, we're not going to extend the Jenkins project support of Java 11 beyond the lifetime of the Java 11 upstream maintainers. It just doesn't make sense. So Java 11 story, I think is pretty clear there and Tim Jacome and others. So Kevin, you as the docs officer, others have said, yes, this seems like a reasonable plan. So Java any questions on Java 11 before I go on to the next part of the story?  Yes. What do you mean by what was written? We have to give something like nine months of warning for users to transition. What do you mean by transition? I mean, people will just have to have for their controller, I guess, more recent version of the JDK, but it won't change for their agent for the job. If they still need JDK eight for their job, they still can have JDK eight, am I right? Well, so it depends. Good, very good question. So the transition is a transition of control, the Java virtual machine that's running the controller and the Java virtual machine that's running the agents. It does not. So they must run them both on Java 17, but that does not prevent them from using that Java 17 executing agent to invoke a Java eight compiler or even a Java six compiler, if they wish, they can run any tool they'd like, including Java versions. And there's really good support in Jenkins for the concept of a tool so that they can choose to run Java eight, even though their agent is running Java 17. So maybe I don't understand what is difficult for a transition, except having a recent version of the JVM on the controller and a recent one for the agent.  Well, so, so you are, you are close, but not quite because there is there is a particular job type in Jenkins. There's a particular job type in Jenkins called the Maven job type. It's affectionately called the evil Maven job type because, because evil in the sense that it is strongly coupled to the Java version that is executing on the agent. And it is tightly coupled to that Java version. Therefore, when they upgrade their Java version on the agent to Java 17, all of a sudden, their Maven job types execute with Java 17. And the solution to that is stop using the evil Maven job type, use pipeline. If you can't use pipeline, use freestyle. So it's much, much better to you to get off the Maven job type to something else. And that is that has been our recommendation even since Java 11. The Java 11 transition at 2.361 had exactly the same scenario where you would, I was running Java 8, but I had a Maven job type, I've now switched to Java 11. All of a sudden, that job job is now running with Java 11. And I have to either adopt that, adapt that job to the fact that it's now running in Java 11, or I've got to change the job type from Maven to pipeline. Oh, I didn't know that. Thanks a lot for the explanation. So is there a depreciation warning something that will tell the users, please stop using the Maven type of job on not at all, you know, even when they are creating some new Maven type? So we've put, we've put disclaimers about 12 months ago, I think it was, we put disclaimers and clear statements of the risk into the Maven plugin documentation. But the challenge is Maven job types were some are some of the oldest job types in the Jenkins infrastructure in the Jenkins environments. And therefore their maintainers are much less likely to look at documentation than anybody else. Because hey, it just works. Why should I look at documentation? It still works. And if it doesn't work, I have to go investigate. Got it. Thank you. So, so the Maven job type is one where we continued to have to remind people, here's how you handle Maven job types. Many of the problems have already been encountered in the eight to 11 transition. So I don't think it will be quite as vocal a group that's saying, Hey, but what about my Maven job type? So, so did that address your question, Bruno? Oh, yes. Thank you. Okay, great. Kevin, any questions from you on Java 11? No, that all makes sense to me. And thank you for going through and explaining all that Mark. Okay, so then the next part of the story is Java 21 Java is, is improving. And in September of 2023 Java 21 will release. And a number of us in the Jenkins product project are already running Java 21 early access, the unreleased versions, and getting reasonable and good results. So the question then was when should Jenkins support Java 21? And here what I've got a commitment from the infra team led by Damian DuPortal is that they will provide Java 21 infrastructure using early access builds so that we can do the work in core and tooling and in documentation to describe Java 21, even before hopefully it's released in September, with the expectation that by end of October will have Java 21 support officially in a Jenkins weekly. So any questions on Java 21? Now in terms of what that means, I don't think we we should change the Jenkins documentation to recommend Java 21 beginning in October. I'm not ready for that yet. We may, but that's that's a separate discussion for me right now. Getting people onto Java 17 is a good thing. So then the next next part of the story is Java 17. And here the Java 17 thing really what we're doing is preparing with Java 17 for a coming day. When we drop Java 11 support entirely from Jenkins and Java 17 becomes the new required version. And the more people we get onto Java 17 before that date, the happier the users are right dropping dropping Java 17 support forces them onto Java 17. I'd rather they go there willingly at their pace over the course of the next nine or 12 months. And then we drop Java 11 support in a and that's one that's missing actually from this proposal is when does Java 11 support cease? We know it's well it ceases in at least at October of 2023, but I don't have that assigned to a version number. Kevin, if you'll scroll to the bottom, maybe we can use this as an excuse to look at it. So further down a page or two, there's a list of releases and their dates. There we go that one. Okay, so if we look at this, it would likely be September 4, 2024. Oh yeah, okay, it's listed here actually September 4, 2024. The 462 approximately release is when Java 11 would no longer be supported. It will just you can't even run with Java 11 at that point, which means a weekly four to six weeks prior to that would be the one that would drop Java 11 support. So it'd be a weekly in August at that point then. Yeah, likely right August or late July. Yes. Yeah. Gotcha. So that's sort of that. Now there was one more question raised by Damian DuPortal and I like it's good that people think, okay, we talked about Java 11, Java 17 and Java 21, but what about Java 8? Exactly, Kevin's got it. So what about Java 8? And the question is, well, but wait a second Jenkins doesn't support Java 8. That's true. Jenkins Core does not support Java 8. Jenkins tooling does not support Java 8. However, we still have Jenkins infrastructure that's supporting Java 8 because we don't want to break these old plugins that haven't yet updated. Kevin, if you just change the styling from heading to to text, we get the right right size. There we go. Okay. So we get the benefits. So Java 8 is still available from our infrastructure and the infra team updates the versions to be sure that they're latest patched versions because we don't want to we don't want to be keeping Java 8 if we're not keeping it current. So the infra teams idea is we'll keep doing those updates so long as they're pretty cheap and we won't ban Java 8 from the Jenkins infra until Java 8 is no longer supported by the OpenJDK project. And that goes all the way I think until October of 2026. Now we don't have to live that long. We could stop earlier. But the reality is we got plenty of room before OpenJDK stopped supporting Java 8. Yeah. But is there any incentive we could think of to help plugin maintainers to switch to JDK 11 or 17? Well, certainly all the incentives are there that modern tooling is much, much better than the old tooling on which they're based. But they've already had those incentives for what 15 months, 18 months. And so those incentives weren't enough. So I think the next step for us is to look at in the advocacy and outreach SIG should we make a key theme of Hacktoberfest plug-in modernization especially for these older plugins and accept that some of us who are willing are going to have to adopt those plugins in at least long enough to modernize them and release a modernized version. Because right now we've got a number of plugins. They're still using Java 8 on ci.jankens.io. And unless we significantly reduce that number, it's difficult to say, oh, we'll accept that we're just going to break builds on ci.jankens.io for these old Java 8 plugins. Any questions on Java 8? So just to clarify, Mark, so really it's just going to kind of keep status quo for the time being until we get to the point of saying this needs to stop or we need to move everyone forward. That's Damian's suggestion is he sees no reason for it not to continue the status quo. And I agree with him. I think so long as it's low cost, I'd rather not have to tell people your old plugin build is now broken. It doesn't help them. It doesn't help us. An adopter needs to be able to start to adopt the plugin from a place where it's successfully building, which means Java 8 for some of these old plugins. And so let's keep it at least until the point where the infra team says this is becoming too expensive. We have to stop. And that's all that I had on Java, unless there are other questions. I don't have any other questions. You do a really nice job of explaining all that, Mark, and walking through everything. And it looks like we're in a good place to be for what the next steps are going to be. So yeah, thank you very much. So next up, so open pull requests of interest. So the administering Jenkins on Kubernetes and scripting and security page are ones that we've discussed previously. We're not going to go into them necessarily right now. I would like to take time, however, to look at Bruno's pull request that we discussed earlier. This has been merged and implemented. And we've seen a several pull requests open up about updating versions throughout the documentation in various places. Yep, that was the beginning of the chaos. But I'm pretty sure it's these ones here that are all made by GitHub actions, if I'm not mistaken, right Bruno? Yes, it's using a digital line to make these PRs. But yeah, the proof that it's somehow working more or less with some errors here and there, I've already submitted a corrective PR that has been merged, but there are still some things to work on. For example, I'm using the latest node, not LTS, the latest node image whatsoever. And we have to see if it's still working after the update or not. Some voices say it would be better to keep LTS. Some voices say no. We'd like to have the latest version. I mean, the middle of the bridge, I don't know. I'll do whatever you feel. Yeah, so Damian's point is valid. I think he's right. I am persuaded that he's right and I'm wrong. So that when absolutely we should stay with LTS if we possibly can. Yeah, I will try to modify my rule so that it only finds the latest LTS and not the latest one. But yes, we are progressing. Merging it allowed us to find some flows, but that's okay. I'll correct them and that will maybe prove useful later on. Definitely. I mean, yesterday alone, we've got a handful merged and stuff like that taken care of. So definitely it was working. Definitely. Yeah, I mean, it's working. It's done its job. It's getting it done and updating some stuff after the facts, make sure it's more accurate. It sounds like just kind of normal work to be done, normal updates to be had. So I mean, this is great. And thank you very much Bruno. This is, yeah, this is great. This is fantastic. Thank you. Thank you. Is there anything else you want to share on that? Bruno? No. No, I'm good. Thank you. Okay. Okay. Great. Just want to make sure. Thank you. And then, so last on the agenda I had is just again, reminder for DevOps World Tour registration is now open. It's a different format this year than it has been in years prior, where this year it's going to be several smaller dates and locations. New York, Chicago, Silicon Valley for the US, Singapore in China and London for the UK. And so Mark's actually going to be giving a talk at the New York, Chicago and Silicon Valley ones. Thanks to him for doing that and coming up with this talk. He's been getting a lot of work done on that. So really excited to see what that looks like. And if I'm not mistaken, so Olivia Lame has, has agreed to the London and Singapore. Yeah. Okay. And then sorry for that Mark. Yeah, then Tim is Tim Jacome. As far as I know, any team has agreed to do London. Okay. Got it. I had it backwards. So thank you for clarifying that. But yeah, so registrations open now. The idea is that it will allow us to get to more folks in more places without having it being concentrated in one place in like a few days time span. So a little different, but the idea and the goals are the same. So it'll be interesting to see how it shapes out, but really exciting. And so that is all I had on the agenda for today. Is there anything else anyone would like to add or throw out there before we wrap up? We were thinking of making a demo of Ashford's work, but we're almost out of time. So I won't be able to make a demo in less than one minute. Oh, darn. Okay. Well, let's, let's table that for now then and we'll put it on the agenda for next week and we can do a demo and I'll give you some time that way we don't have to do it on the fly or anything. I know that's not an issue for you, Bruno, but yeah, if we can give you a little time, that'd be nice to thank you. I don't want to rush through it and not give it the attention it deserves. Thank you. So thank you. I'll make sure. Yeah, recordings and here it'll be available 24 to 48 hours. And until next time, thank you very much for coming as always. Take care and have a good rest of your day. Thanks a lot. Bye bye.


Flux at the glitch as we like to call it because it's it's still a part of the same family It kind of came from where we started right we started off as a company that created content for the way back in 2009 We've seen that part of our business evolve I think it was a lot faster than the rest of the business and so we realized that a there was a It's an interesting point of time in the whole content space Where the whole point of branded content has kind of really evolved So there are brands on one side and there are creators on the other side I don't think as much as we like to call people directors producers I think creators are what we have in the market right now and we saw a gap there We saw a gap people who understand both sides and how can you bring that together? We were also launching a bunch of custom services within our content business So we and when we looked at it in terms of when we have our own studio for brands We're really doing real-time content when we're doing content on a slightly larger scale So a brand today doesn't create one film or two films in a year creates what five hundred pieces of content in a year How can we make that a more ROI focused yet keep the quality premium? So our studio part of it came from that We've delving a lot more into long-form branded content over the last year or so kind of going back to what we were doing in our Early years and the learnings from that and bringing that back in and the third part is because there's so many people whom we work with who are creators beat from the Comedy space be it from the tribal space and people are doing a lot of stuff kind of turn to us for advice from time to time What we realize was that's a great. That's actually an important role We've started playing with a lot of creators saying okay adding a branded to your content is not necessarily a bad word We can make it seamless and kind of we like to call it Tender for branded content is what we're trying to create here saying how can you make that really work out So when you look at all these pieces we realize that this needed to be under a singular umbrella And that's why flux to the glitch kind of claim in and and we said let's evolve that as a division of Of our overall agency business. I think it gives it a lot more focus and it gives it a lot more growth potential and Yeah, so we're building an interesting team of people who really going to be doing that as It's actually been great. I think we spend the first two months really speaking to people I think we've spoken to people across all all group of agencies across different categories different functions and what you overwhelmingly seen is a Lot of positivity and a lot of I think it's it's camaraderie in that sense So we we got what we wanted in terms of a set of people who really want to work with us And we really want to work with them and kind of coming out of the best solutions out there in the market for for clients So it's it's been great So I think we've started off on a bunch of projects together We're doing a bunch of stuff in the background together be it in the content space be didn't what we can do for individual brands And some of those are going to start coming out over the next couple of months, but I think it's been a great start so far We always like to say glitch never has a five-year plan We have one year if not a six-monthly plan, but in the next five years I think what we really wanted to be is a company that's really evolved for the market That kind of taps into every need of a client I think we we we come up with terms for agencies we call them we call them mainland we call them digital I think the whole point is I think glitch will ideally be the go-to agency for clients And we go to glitch to get any need that we have service I think that's what we really want to evolve and we really want to focus on evolving our people and kind of spreading our culture Internally as well as beyond because I think that's really important to build the right kind of talent for the market So that it's the right kind of people who are working with brands across the world


It's Hop along Cassidy With action and suspense out of the Old West comes the most famous hero of them all Hop along Cassidy star in William Boyd The ring of the silver spurs heralds the most amazing man ever to ride the prairies of the early West Hop along Cassidy This famous hero thrills his 60 million fans with action and dangerous adventure In the role of Hop along Cassidy is the popular star of the motion picture series William Boyd And now another exciting story of the early West the shell game The hoof beats of Hoppy's horse at the moment are ringing on the cobblestones along the waterfront of no less a place than old New York City Longshoremen turn and stare at the unusual sight of Hoppy in California in their gala silver studded rodeo Shaps riding down the broad dirty street Study in the warehouse front as they ride along Our train heads west in less than two hours, California We have much time to defend social calls on your old girlfriend dog gone and hoppy The address she gave me is right on this here block. Oh, but that was two years ago Maybe this business Lil inherited from her uncle fold it up or move Sounds like shooting back among those ducks that hash knife Lil She always was kind of soft on me. Oh, she was a little shy, but mighty loving that girl. Yeah Wait, whoa, what is it? They're on the corner of that plate glass window. Can you read those words through the dust? Carver trading company. That's it. That's Lil Carver's warehouse.  You remember Hoppy. Hi, Lil Do I remember Hoppy the most famous cow wrangler in the whole dead burn country? I take it easy. Lil when it comes to fame.  You ain't doing too bad It's a living but there have been times out of traded at all for just one evening's walking hand-in-hand with you Under that Texas moon honey boy come here, California.  I ain't caught my breath. I Didn't know folks were so free with a gunplay in New York, Lil they ain't you must be cops after one of them waterfront gangs Oh, well, like I always say the only reason folks don't mind their business is they haven't any mine or they haven't any business Let's get back to my office and said I already sent my help home We'll be able to chew the fat without the usual racket I've been a phone food child and telling to set a couple extra places for supper tonight That's might a nice of you, but we're leaving in less than two hours our train We've been with the Great West rodeo at Madison Square Garden show close today great day Why doesn't somebody tell me these things we would have called on you before but Honey, I just ground up a sample from this hundred-weight of black pepper Oh, yeah, you sell that stuff too. Well, I buy and sell just about everything honey boy from the looks of the stuff You got pile up here. I can believe it. This pepper just arrived from Shanghai aboard the freighter diamond Hold out your hand hoppy and I'll pour you a sample. I want you to smell what real peppers like now wait I'm at wait. You don't have to pour that whole sack into my head there. You can tell it's fresh by the way Watch it My my nose ain't the same since I once had it broken in two places. You should keep it out of those places Say I know it should be seen and not hurt I'll move back a bit. Then we are where did you come from put down there? Don't move. Don't move or I'd shoot Now back to hop along Cassidy and our story the shell game Couple of hours before they're due to catch a train out of New York head and back west with their rodeo show Hoppy in California visit one of California's old girlfriend's hash knife little cover who now runs a warehouse on the waterfront While shown hoppy a sample of a new shipment of pepper. They're held up by a skinny little gunman with an English accent He orders Lil into a storeroom. Get inside quick. Do as he says Lil keep your hands up.  Why are you so none of that so help me? I All right I'm going to cross over to that room.  Yeah He's running into a police trap. I know look. He's heading toward those ducks.  Where is he? Where's that pole cap line over there for the dogs? Lil the police just shot him dead California sure taking a long time talking to that police sergeant out front. Oh still I gotta get this bandage Fesson my ribs were only grazed Lil not ventilated.  Oh Here comes a honey boy now California. Did you find out who that gunman was? That their police fella said he was a smuggler smuggler Yep, name of English Eddie the police at Hong Kong cable the New York lawman to be on the lookout for him He was stolen away on some freighter They thought and and sure enough they find him on this here ship the Diomede the diamede. Yep, but he give him a slip that is until he run into us Well, what was he smuggling? I don't know you police sergeant said something about him running a thing called the Duke export company in Hong Kong what? Yeah, but seems that that was just a blind He disappeared from Hong Kong and well, you know the rest of it. What's the matter Lil? Well, nothing. I'll be except that I was planning to bid on a shipment of stuff tomorrow morning That was putting up at auction for freight charges a Shipman of abalone shell sent by the Duke export company of Hong Kong. That's mighty interesting Who will they ship to? Well, some ombre who never even showed up name of Simon Turner Bologna shells a bologna.  Oh, no, what are you worrying about? I can put you both up at my place I got plenty of room Of course, I was sorry we had to miss our train yesterday, Lil, but after tasting these flapjacks I'd say it was worth it. This is the best breakfast since we hit, New York You just share a mouthful of me. I sure hate to leave Let her write down the address of the apartment here, California So you can write Lil direct when you get back to bar 20. Yeah, yeah, good idea. Got a pencil. Yeah, right here in my pocket Are you hmm? That's funny. Oh Shucks, what is it honey boy? Oh these cartridges I took from that home breeze gun yesterday Yeah, I forgot to give them to the police when we give them the gun Well, I reckon Lil can take care of that. Be glad to hoppy. I'll gather them off the table here for you late What's your matter? Nothing especially just this cartridge light. I don't think there's any powder on it The lead is loose too. I think Yeah, I can pull it out with my fingers Look, it is empty. Yeah. Hey, wait a minute. What is it hoppy? There's something inside the case a rolled up piece of paper Okay, can you get it out just a minute There Why would that buzzard load has gone with a dummy cartridge probably got it mixed up with his regular amination There's writing on this bit of paper. Yeah. Yeah, I see. Oh, what does it say hoppy? Can't make it out. Just three words black cat Salem hmm what in tarnation? I don't know. Well, I let the police worry about it here You take it give it to him on you. Sure thing hoppy. Oh Great jumping bullfrogs. Look at that clock. I gotta get down to the pier that auction starts in 20 minutes See you two got nothing to do till train time. Why don't you come on down with me to the auction? Hey, that's a rip-snorting idea. Be glad to go with you. Lil Now lot 1621 Two and a half tons of fine oriental abalone shell with high mother referral content All right, folks, who'll open up two and a half tons of $10 $10 50 dollars by a fraction of their shipping cost come Looks like that fat old army in the audience. He wants them to live. Do I hear $60? $60 that's telling them $60. I hear 100 $100 the gentleman said $100. What's that old gold one and four? 150 I hear $150 200 They worth it 250 that'll stop the lady with a green all-street feather in a hat says $250 going 300 350 and I ain't work easy li'l 500 li'l. No, you can't leak us. Five hundred five. Do I hear more? Will you accept my kick? Hey mister the rules call for spot cash. The bid is $500 cash going going Sold to the lady with a green all-street feather for $500 It sure was sweet of you in california to help me load all them shells and storm away here in the warehouse hoppy That was some job. We were glad to do it There's a big wagon pulled up in front and guess who's getting off with two tough looking numbers We haven't got time for guessing games california a train leaves in an hour.  I was hoping I'd get you in before you closed to the day. Well, we're just about to See Suppose you've been busy examining those high priced tabaloni shells, eh? You think there was it? I don't know. We haven't opened the crates yet You haven't there Mrs. Carver and dr. Sydney trotter the trotter laboratories. This is my assistant, will he Frankly, I was quite bewildered as to why you should be willing to pay so fantastic a sum for those shells You seem to be willing to pay even more Ah, but my dear sir for me. They have a remarkable value The unique balance of calcium carbonate in the south china sea abalone shell Gives it a great advantage for certain medicinal experiments being conducted by my laboratories. So Mrs. Carver and pay you six hundred dollars cash for those shells. So good my wagon is outside and my men are waiting Willy you and Oscar pull up there doctor We just spent the whole darn day storing the stuff away now These boys gotta catch a train won't tomorrow do I'm afraid not my experiments cannot wait Beside my men can handle it by themselves. They don't need any help from your assistance. Oh, the point is my friend I'm closing up and tomorrow have to do Yeah, you distress me, madam Willie they refuse to make delivery. Maybe this changes their mind Will the gun like that looking me in the face? I could change anything except my opinion of you, will they Keep your opinions all we want are the shells Right into that back over this gentleman and shall I say lady? Hoppy california and lil are held up by a so-called dr. Sydney trotter After tying the three of them up in lils office trotter and his two thugs take lils crates of abalone shells and drive away Darkness has fallen as hoppy finally gnaws through the rope around lils wrists Enabling her to reach for some shears on her desk and cut them loose There, okay, hoppy. Thanks. Where are our guns on top of that captain?  I'm going after those road agents.  Let's go Hoppy, what about our tree? We missed it an hour ago. Don't gong them horse-grown street cars Out of the way. Take it easy lil. Let's use our head to pull up here We'll never get anywhere riding around the night like this. We've lost them dead burn it Hoppy, I'll catch them wall-eyed coyotes if it's the last thing I ever do Let's find the shipping office that put on that auction this afternoon Maybe the auctioneer knows our fat friend dr. Trotter. Well, what are we waiting for? Let's go Did you find that auctioneer in the shipping office? Yeah, he says he never saw a trotter before and doesn't know who he is Lil I've been thinking those shells were shipped for the duke export company Another word by english eddie who stowed away on the same ship with him He addressed them to some lumber. You apparently doesn't even exist named simon turner Now, why would english eddie want a fool with a mess of abalone shells? Could be the captain of the diamond might give us a clue The captain of the who? The ship that brought those shelves over from china Fell at the shipping office said the captain is living aboard while she's in port. Come on topper Might it nice of you to go to all this trouble captain taking us down the ship hold I'm glad to be of any assistance. Mr. Cassidy. Is this where you found english eddie hiding out? Yes, um Him um crates the shells another cargo He got away from my man when we first discovered him after arriving in new york Left in such a hurry forgot to take his coat Funny thing fill these pockets with abalone shells. Oh, what happened to them those shells in these pockets? Oh and tossed them back into the crates He'd opened a number of crates and the shells were scattered everywhere. What'd he do that for? Searched me Probably never would have been caught if he hadn't come back to the ship day after we docked and Trying to get back down in the hold Don't ask me why Police had been alerted by then of course and Well, you know the rest of it. Yeah I see your men didn't quite clean up all those shells off the floor. Where? Over there. What's done to those pipes of the wall near the floor? Well, it looks like there's a couple of dozen jammed under there. Let's have a look I'd like to examine a few of those shells Sure are big, ain't they?  What? Under here where the edge of the shell curves inward Same Looks like it's been filled with some kind of seaman. Exactly Captain if you don't mind have you got a little hammer I could borrow Oh gone at hoppy that ship's captain has already notified the police So why are we still galloping through the night? And if those pole cats are going to be caught we got to catch them while the trail's still hot No horde trail You remember that piece of paper we found that empty cartridge case from the english eddie's gun? Yeah, it said black cat Salem Couldn't that be the name of a ship the black cat out of Salem hoppy and my business I know just about every ship that ever comes in and out of new york and there ain't no black cat Well, it could be a smaller vessel most of the small fry dock over on the sound or over on sheep's head bay off brooklyn Wait a minute. I just thought of something There's a street a Salem street in brooklyn running right down to sheep's head bay with a pier at that end Well, come on. Let's give it a whirl Well, this is it Salem street pier and nary a boat in sight hold it over there in the moonlight fat boy's wagon sure is But there ain't nothing in it. Where do you suppose they took them shells wherever they took the boat What boat take a look at that sign on that post you can read it right well in this bright moonlight Yeah, black cat daily fishing parties captain willy all big willy that big baboon who is with grotter That sees like glass you can still see the wake their boat left when they sailed out of here We can follow it like a trail. Hey, there's some lights over there a boat house. We could rent us a boat Yeah, I think we'll catch them yet. Come on This wake we're fine is getting brighter and heavier. It won't be long now I hope not. Oh, my stomach's beginning to back up and turn around try to hold out california I aim to climb aboard hoppy. We'll run this thing close under a stern california Now grab the lifeboat and climb aboard. Well, what about me? I'll be missing out on all the fun You go back and call the police. I want to turn those armors over to somebody when we bring them back Hey, am I seeing things or are them lights ahead? Yeah It's their boat. All right dead ahead the black cat I only hope the sound of the engine will drown out our motor. All right, get set california Okay, grab for that light boat that we pass under jump Now back to hop along cassidy Confound it will it there must have been another creek But mr. Trotter you yourself point them out to us. We take every creek you say Maybe english said he make a mistake Impossible English said he never made those kind of mistakes Would he write me he was enclosing diamonds in 20 shells and then send only five But do not blame me. I told you to put in a claim for the shipment before it was actioned off Oh, you incredible blockhead. I should tell him I suppose the deadie duke and I did business together With him wanted by the police of three continents. That's all I had to do to put us all behind bars.  Mrs. Kerber lied when she said she hadn't opened those grates. That is it. She lied She took those shells perhaps He'll ask her to turn back I'm afraid we'll have to pay mrs. Kerber another visit willy Tonight can I spare you the trouble? Daddy willy don't try reaching for that shooting iron. You too dr. Trotter. How did you get aboard? Does it matter? Nice little assortment of diamonds you have there on the table There's quite a mess of broken shells. I know this I have a few diamonds myself to match yours doctor In fact the whole pocket full Here Well, he's what you're looking for where you you did find them with the cooperation of the late english eddy duke You see he laid them aside in the hole of the diamond for his own use in america Only it wasn't america he ended up in but in another place where he doesn't need his diamonds And neither will you gentlemen where you're going?  Huh? What do you mean? Well, look at the cranes we missed and getting ourselves nearly shot and drowned and half dead of sea sickness And in the end what happens the government pays us a hat full of money for our half of the fine They slapped on them smugglers. Well, it isn't that I go around looking for trouble Wish I had a chance to shed it all at once like you like me. What are you talking about?   No, sir marriage ain't for california carl Ah marriage is a great institution. Well, if it's so great, why ain't you ever married? Well, california I'll tell you it just doesn't seem to me. I'm ready for an institution Oh you need Oh shucks Goodbye from hoppy in california We'll be back soon. And of course, we hope you'll be with us Hop along Cassidy star and william boyd is transcribed and produced in the west by walter white jr The shell game was written by urban ashkenazi All stories are based upon the characters created by clarence e mohford. This is a commodore production


Hello friends, I am Sanjay Gupta. In this video, I am going to demonstrate you how you can find and replace element in 1D array. Before starting, you can note my information. You can visit or subscribe my YouTube channel through the URL youtube.com slash sanjaygupta underscore tax pool. You can download my programming app Takim is available on Google Play and you can connect me connect with me by following the details which are available in front of you. Now coming on to the topic, here in this video, I am going to implement a program in C language, which will find a particular element and that will be replaced by another element. So for that purpose, I am including a header file that is stdio.h. Then I am implementing main function. Inside main function, I am declaring an array. Then N1, N2 variables and then I. Now with the help of printf, I want to show this message on console that is enter 10 numbers. To receive 10 numbers, I am implementing a for loop which will repeat 10 times and this loop will repeat scanf statement. So with the help of this for loop and scanf, 10 elements will be received from user and those 10 elements will be stored at different indexes inside a array. Now I am again implementing a printf statement which will ask enter the number you want to replace scanf %e and %n1. So n1 will receive the number which user wants to replace. Again printf enter the number which you want to place. So to receive this number, I am again using scanf and this time m%n2. Now you can see, first of all I have received 10 elements inside array using this printf for loop and scanf. Then using another printf scanf segment, I am receiving the number which user want to replace or you can say user want to find the number that will be replaced by another number. Then again printf and scanf is written. This printf is showing the message enter the number which you want to place instead of the number which user wants to replace. So in short n1 will be find out and it will be replaced by the value which is stored inside n2. So n1 will be replaced by the value which is stored inside n2. So now for this purpose, I am again implementing for loop. Now here I am implementing if condition that is a of i double equals to n1. So if array element that is stored in a of i is equals to n1. So it means that number should be replaced. So for that purpose, I am writing a of i equals to n2. So if a of i is equals to n1, then a of i will be containing n2. So n1 will be replaced by n2. So this way, all the elements which are equals to n1 will be replaced by n2. Now after completion of this loop, I have to print the updated array. So with this printf, the message updated array will be displayed on console. Now to display all the elements, I am implementing this for loop along with printf. So this printf will display all the elements which are available inside array on console at last return 0. So friends, this is the complete implementation which will find out a particular number and that number will be replaced by the another number. Now I am going to execute this code. You can see it is asking for 10 numbers. So I am entering 1, 2, 3, 4, 5, 1, 2, 3, 4, 5. Now it is asking for the number which you want to replace. So I am entering 1. Now it is asking the number which you want to place in place of 1. I am entering 9. You can see the output. At first position earlier there was 1. This time 9 is available and at second position after 5, 1 was available. This time it is showing 9. You can see the entered array. 1 is available twice and this time 1 is replaced with 9. So this way I have applied find and replace on 1D array. A particular number has been found out and that number is replaced by another number. So the number which I want to find out is available in n1 variable and that number is replaced by the value which is available inside n2 variable. So I hope you have understood the concept behind this program. If you want to watch more programming related videos, you can follow this URL youtube.com slash sanjay gupta underscore tag school. You can also download my programming app tag MS which is available on google play. So keep connected with me and learn programming because programming is very easy. It is a fun. Thank you for watching this video.


Everyone, welcome to this special CUBE Conversation here in Palo Alto, California. I'm John Furrier here at Scheidemulam, Senior Vice President Product and Strategy at Rubrik here in theCUBE. Thanks for coming in today, great to see you. Pleasure, John. Pleasure to see you. So big news, you joined Rubrik, Senior Vice President. Last time we spoke to you in theCUBE, you were at Splunk and then you did a stint at MuleSoft, a very famous public company, sold to Salesforce for massive amounts of money. Now you're here at Rubrik. Thanks for coming on. What's the story yet? What happened? Well, you know, Bipol, our founder and I, met a few years ago, we were introduced. I guess it was about two and a half years ago. I was running Product Manager and Product Marketing at Splunk at the time. And he just impressed me with his vision of what he was trying to do with Rubrik. The company was significantly smaller than it is today. And talked about his vision to really disrupt this $30 billion market and do it in a way that was very cloud-based, revolutionary, allow companies to extract much bigger value out of the secondary storage arena. And I thought, wow, sounds exciting. But at the time I was just about to take a bigger role at Splunk, my timing was off. And so it didn't work out, but we kept in touch and we touched base again early this year. And I was just so impressed by what he had accomplished with Rubrik in less than four years from zero to 300 million run rate. The executives that he assembled around the company, the progress that the business had made, the customers, the expansion into the cloud arena, the innovation, it was just one of those opportunities you can't walk away from. And so I jumped on it. It's a classic Silicon Valley enterprise story. If you look at the funny, he's been on theCUBE so the folks watching, check out the CUBE video on YouTube or thecube.net, Bitpulse CEO, founder of Rubrik, great interview. But it's interesting. I mean, there's a lot of money thrown at Rubrik. They're growing like crazy. It's the classic rocket fuel going after the story. But there's a unique product angle here that I think is interesting and you're in charge of products and technology for the company. But you've also had a journey in the enterprise. You've Splunk was a very successful company. MuleSoft, very successful SaaS company. Sold to Salesforce, huge tower in San Francisco. There's a new kind of generation shift happening with cloud computing that's forcing enterprises to change their infrastructure. And this is beyond just backup and other things. This is a generation, once in a generation shift in B2B. How's it changed things? And you've seen a lot of the enterprise action over the past decade or so and more. But right now it's more than ever. What's the big shift? Obviously cloud forces a lot of change. What's the impact of the customer? You know, I think there are two phases to that. I mean, there's one that we are serving a market, this backup recovery market, represents a massive area of investment for companies. I've seen stats that suggest that there's six X's as much spend on storage infrastructure for the secondary arena than there is for production grade systems. And so, but yet this market just hasn't seen innovation since data domain and- So tons of money but nothing happening. Nothing happening. So we came in initially with a whole new, very customer centric approach that delivered all of the complexity that this market had seen before, shrink wrapped into a modern era software platform running on commodity hardware. Our customers can be up and running less than an hour. They can archive and leverage the cloud. And so it's driving both TCO benefits, agility of the business and allowing them access to move workloads to the cloud, manage the cloud in ways that they'd never seen before. And so I think certainly that has been one big part of the success of rubric, but I think more broadly on the cloud, we're seeing many companies are really in a hybrid mode. They are moving from on-prem. They're leveraging MSPs. They're starting to build certain businesses in the cloud and the ability to manage all of that centrally in a way that is governed properly and allows them to extract real value from it is something that's really resonating for our customers. What was the reason why you joined rubric? I mean, everyone has a reason. I see you met people who gets keeping in touch. Was it the team? Was it the technology? What was the one thing that you were attracted to that put you over the top? One thing, I've got so many. That's the most important thing. Yeah, I think I'm going to force you with three answers on that one. You know, I fell in love with- I'll still ask you to rank them by one, two, three. I'll end with the last one on the product. I fell in love with Bitbol.  The team that he's assembled to me was just so paramount. I wanted to be part of this organization. And honestly, I'm humbled to be sitting around the table with folks like Murray Demo, who's our CFO, and Mark Smith, our head of sales, from Arista, and Kara Wilson, our CMO. And we just keep bringing these incredible individuals to the company to lead the org. I'm truly humbled to be sitting around the table with them. So that excitement, by the way, goes all the way down. The folks that have been hired into the organization are quite remarkable. But the thing that really, from a product perspective, that really is exciting to me is that not only are we disrupting this $40 billion market in a way that's really connecting for our customers, we're doing it in a way that is thinking ahead. We're not treating this backup arena as some blob that's going to sit on tape somewhere. We're building it as part of an integrated management platform that then allows our customers to extract higher value services and insight from that in a way that they've never seen before. So Radar is a, we've had some incredible innovation over the last four months that have been with the company with the release of Rubrik Alta 4.2, a new product Radar for ransomware protection. We've talked about our AWS competency and advancements there. But Radar is an example of a service that we are building on top of this data management platform that delivers higher value for our customers. And I am so excited about the exponential growth and value that we're going to deliver to our customers as we continue to deliver more of these services. You get the technology, it's a great team. You go to market, it's going to be interesting.  How has the product road map shifted from classic old school product management to now because it has to be a service. This service is out there, still low commodity hardware. Software is driving the value. That's where the hardware gets sold. That's what the cloud gets sold on. It used to be the other way around. Your hardware drove what you can do with software. That's been flipped. Yes. How are you guys working that in the equation? Software first, cloud first? I mean, how do you explain it to customers? Well, we were always a software company and we built Rubrik as a very modern era, expandable platform that runs on commodity hardware and can archive and move workloads to the cloud at its core. I mean, our founders came from companies like Google and Facebook and had really come from this world. And so our customers were able to get that value quickly and I think that was a big part of what attracted them to Rubrik. But if you really fast forward into the future, our vision is to have a ubiquitous, centralized data management platform from which our customers can govern, manage and establish rules that govern all of their applications that they protect across cloud boundaries, across private clouds, traditional infrastructure, cloud workloads, and we really think that's connecting for our customers. Talk about the product roadmap. Obviously you're in charge of product and strategy. Obviously you have a great market entry. The success has been documented. You guys have been one of the fastest growing companies in Silicon Valley. It has a couple of years. I've seen the success. You always have a big party at VMworld. It's your big show there looking forward. It's going to happen again this year. I heard there's a big performer there coming last year. It was great to have to see the warriors there. But product is interesting because if you're a startup, you want to have a beachhead, secure a core positioning, and then look at kind of holistically what the customers might want. Can you share some insight into what that product roadmap is and how are you guys fortifying your core and what are you adding onto the roadmap? Yeah. You know, the first thing that we did when we came out was to provide the capability to protect your data, make it really easy to use, archive to the cloud, and we focused on VMware and hypervisors. And it was very well received. And over the years, we've expanded to support other areas, other data, other applications. And so our strategy certainly is going to continue to do that with the vision of protecting all of our customers' applications and data, regardless of where they reside, whether they are traditional infrastructure applications running on prem, in private clouds, or new modern architectures that are running in the cloud, the ability to manage all of that, it's certainly going to continue to be one of the directions of the roadmap strategy. The other is, as I mentioned, we're not really looking at these protected images as black boxes or tape images. We're going to enable our customers to extract value out of them in a way that they haven't seen before by introspecting this data and revealing insights from it. Ransomware are- So what's the current situation so why can't they get that today? Well, I think typically these images are stored in a proprietary blob format and you can't really see much in there. You can't unlock it at all. You can't unlock it and you don't really know much about what's even in the black box. And so we were, from the beginning, we started capturing metadata that allows customers to classify this data and get insight into, well, what applications are actually running in this particular snapshot. And so we continue to extract that level of value that is really connecting for our customers and allowing them to resurrect, move workloads, introspect for compliance reasons or otherwise in ways that I think are just really important. That's great. Things like GDPR, for instance, alone is a great use case. Absolutely. All right, so what's the big picture if you had to go talk to your friends and say, hey, I joined Rubrik and they say, hey, I've never heard of Rubrik. What do they do? You don't say backup, you say data company. How do you describe the company? I talk about a company that's providing data management for non-production systems and allowing customers to extract value in ways that they haven't seen before. And I think candidly, John, when I have been very fortunate to work for some great companies, I have never seen an opportunity as exciting and as big as what Rubrik represents. It's just so important to our customers. Everybody has to protect their apps and we're able to do it in a way that's going to allow them to extract so much more value. And when was your official start date? You started what, a couple months ago? April 1st. April 1st, like four months, roughly, yeah. Exactly.  Have you described the DNA of the company? You know, I'm really thrilled. I am really thrilled to be part of this organization. There's a deep sense of culture. One of the things that attracted me early on was there was an article written about BIPL, talking about radical transparency, open boardroom meetings. I'd never seen that before. And you know what it's about? It's about employing empowerment. He is so committed to that, to making sure that we are able to set everybody up to deliver their best in the organization. And I think it's spot on. It's why we're innovating so quickly. It's why we're attracting such top talent at all levels of the organization. And it's why I'm so confident about the future of this company. That's great. You know, one of the things too, that I want to get your thoughts on, because you're seeing cloud disrupt a lot of things and it's certainly a great opportunity for you guys. And you know, we're seeing it out there when we talk to end user enterprises is that the common answer is we know cloud's there, we got to go there. But the one thing that's interesting is they all say cloud, no matter what we do, when we talk about cloud for them, it makes them change their infrastructure. Yes. And what they do in the cloud. So it's a rethinking of things. So that's one. So that's opening up new markets. So the question for you have is, as you guys look at new markets, things like public sector, for instance, we're seeing a real story today. It's looking at an angle that Oracle's challenging Amazon for the Department of Defense deal. So public sector and global public sector, not just in the United States, is a very interesting market. How do you guys do and say that market? I know you're strong in the enterprise, but what's the public sector angle?  We are. And I would say there are multiple motions, in addition to the public sector example, we're seeing a lot of global 2000 organizations moving to manage service providers. And so that's an example of a private cloud model that really works for a lot of folks and federal organizations as well, really looking to have a tenant, well-secured service model for their various agencies. And that is very aligned with what we're doing. In fact, in our Alt of 4.2 release, we talked about Envoy that really advances how service providers can and manage service providers, even within organizations, can actually enable more self-service and capability in that regard. We see these varying segments. Can you see public sector as an opportunity for you guys? No doubt. In fact, if you look at the rubric customer base today, it really spans the gamut of markets across the board, including public sector and state and local agencies as well. Well, we know you got a great relationship with Amazon Web Services, AWS, your competency partner of them, which is the highest award or level you can get. What is your relationship with the other clouds, Google, Microsoft, Alibaba, and others? How do you guys relate to those other clouds? We, our customers run on all platforms and we, Rubric does have a relationship with Microsoft certainly. In fact, we have a co-sell agreement with them. We support Azure at a relatively deep level, same thing with Google Cloud. We enable our customers to... You're agnostic on cloud basically. We are agnostic and the point is that I think every one of these cloud platforms has their own unique angle and value and we want to enable our customers to really leverage the platform of their choice. So a lot of young people are looking at career choices and some of the jobs that are out there that haven't been invented yet, as school starts to figure out quickly starting to see computer science, women in tech is booming, you're seeing a lot of different new kinds of jobs around data science for instance. What do you advise young people who are either in high school or college who are thinking about careers, you don't have the classic, I'm going to be a software engineer, you can be software developer, software artist, there's different jobs in management, marketing, all kinds of different scopes. What's the current track that you would recommend people to explore if they were interested in getting in tech? You know, I think there's, it's remarkable to me to see how the internship programs have evolved and how active there are. I was initially recruited into Oracle directly out of college and it's a very regimented process of recruiting from college. Well now you've got these internships and I tell you some of the interns that have worked with companies that I've been a part of have just impressed the hell out of me. So that's just a great way to get in to see what it's about and to have an opportunity to add value and every single time one of those interns does something remarkable and it happens all the time there is an offer on the table for them to come back to. So I think that's a very good way with many of these organizations to get in. I mean it's so interesting. I mean we do a lot of interviews and there's no classic cookie cutter job anymore. I think you're starting to see interdisciplinary opportunities that are coming up. Some computer science, a little bit of sociology or business mixed. It's very interesting. Almost an alchemy of different projects out there that people can get involved in. Absolutely. Open source certainly is a big one. And it's fun because when we get new college grads we just give them an opportunity to do a lot of different things and rotations and that helps them also sort of get a sense of where their passion lies and what they want to do and it's exactly the right thing to demand as you're coming into the workforce. It's interesting. At Google Cloud I was talking with some folks over there and the women in tech conversation and opportunity recognition and the level up. There's so many new opportunities that anyone of any gender or race can come in and quickly level up. Yes. I mean because it's so new that technology with cloud is kind of interesting. Yes. I mean I think it all comes down to your personal ability and commitment and work ethic and drive and there's no end in sight to what's possible. Shai, well thanks for coming on theCUBE. Great to see you and congratulations on your new role. Thank you, John. At Rupert, great company right down the street here in Palo Alto. Rupert, new Senior Vice President, product and strategy here inside theCUBE. For CUBE Conversation, I'm John Furrier here in Palo Alto in our studios. Thanks for watching.