Everyone, this is my first DEF CON, but I'm not a youngling, so please don't be gentle. I need to touch a frying pan at least twice to confirm it's hot, the second time to confirm that the first wasn't a trick or an illusion. I gotta be totally blunt about something right now. There is zero new information in this talk. None at all. Killer intro, right? Well, at one point in history, clocks were a very commonplace item. Bells were also a very commonplace item. Someone eventually put a bell on a clock, and the modern alarm clock emerged. Nothing new. Suddenly, as common folks are able to wake up on time for our lives. The jury is still at whether that was a net benefit to humanity or not, but you can't argue that it's an extremely useful artifact to come from combining two household items. But today, I want to talk to you about some creative munging. There are incredibly gnarly instances of innovation by combination throughout history. At one point, someone wondered why we push around pineapples and bags of flour in grocery store and wheeled buggies like royalty, but we carry our equally heavy or heavier suitcases while traveling. And now it's hard to find a suitcase without wheels. Recently, really smart people have basically combined Wi-Fi and cellular tech to give us 5G. Looking back a lot further in the 1400s, a German hacker named Johannes Gutenberg probably unrelated to our founder Leonard Kutman, but we'll just assume the hacking community in Germany is pretty tight, so they're probably descendants or time travel buddies or something. Anyway, 600 years ago, a German hacker combined a coin punch device with the concept of setting type from a wine press machine, and this led to the mechanical printing press. This means humanity went from printing 40 pages a day by hand, copying exactly only a few pages per day to now we're capable of 3600 pages per day, the dawn of the information age. Back then, when you can print a book at speed, at scale, obviously, you print the Bible. The rest of that story is actually pretty fascinating as well. So like any good researcher, he disclosed his year 1450 zero day mechanical printing press thought exploit Bible churning machine and his investors took over the company and nosedived it to the ground. They even brought him back on board like halfway through that nosedive just to make sure he was also financially wrecked. So yeah, cool tech, VCs flocked in, everyone gets high on the smell of money. They come down harshly from that high and now there's no cool tech anymore. Clearly, this move wasn't invented in the valley. Not be ending for Gutenberg, but a cool story either way. So we got the printing press. Innovation through combination has been a really cool part of our technical history. I just said our and I haven't even mentioned who I am. Hi, my name is Abe. I am in charge of making sure that everyone has a good time with Greylog after they've joined the Greylog family. In other words, I run the training department. I wasn't always just a meat based instructional video, though I've actually been in cybersecurity for quite a while now. I got my start in the 90s in the same way that most people did with an internet connection, a gross underestimation of authority and a misspent youth. I'm always so glad my mom kept newspaper clippings. You know, Pixar didn't happen, right? So as I grew up, those exact character traits led to a segment of organized crime, a very particular branch of organized crime where I did some cyber security things for Big Brother. Really though, it's Canadian Big Brother, so it's really charming with above average quality of music. After that, I worked in IT and operations for another government entity, local government. Then in true IT fashion, as we always plan for our senior engineers and analysts getting hit by a bus, but in reality, they get hit by a better offer. So it was my turn to get hit and here I am. I'll let the young and hungry keep their pagers or slack DMs or whatever you carry now for late night operations calls. I'll build terrible PowerPoints like a proper manager. Talk me down on the socials if you have any questions about my history that you want me to ignore or to send me memes, memes, days, memes for days, memes for days. Blood the internet. Okay, I'm off track again. Hi, I'm Abe from Grey Logs. I'm the trainer there. There. Enough introductions. I've titled this talk log jamming. Log jamming means a couple of different things. First, it's a bunch of logs jammed together, literally. Since I work for a software company that earns revenue when you send in more logs, you have to go ahead and literally send them all in until it's jammed and we'll figure it out and make it bigger. Second, it means an impasse or a deadlock. In other words, you've encountered a situation that simply can't be overcome. In the famous words of Walt Disney, it's kind of fun to do the impossible. Well, we're not going to do the impossible today, but so we'll walk it back to another quote. This one's from Steve Jobs. Creativity is just connecting things. In our case, we're going to use log jamming to overcome our log jamming. This talk is breaking down some of the highlight reel over my last few years, dealing with security analytics platforms, centralized event management. I'm going to reiterate the challenge of this talk to show you stuff without really showing you anything new or groundbreaking at all, just different uses of old. I'll start with my first tale. It's one of my favorite tales, actually. Sadly, it's a project and the project kind of fell apart for sort of unrelated lawyering reasons and the motivated entities on both sides parted ways, but the good bits are what I'll focus on. So the backdrop. A former employer had a program called Teaching Cities, part of a much larger provincial or federal initiative and current encouraging local government bodies to enable their local government things to be used helping academics in the future generations. In other words, let the school kids get their hands dirty. Great initiative. I think it's super mega cool. Engineering students go out and do their engineers, sorcery on wastewater management or civil construction projects, etc. There's a technical university with a really solid future leaning reputation in the same city as my former employer. This particular school has quite a blossoming security program, actually set of programs at a variety of levels, associates, bachelors, masters, whatever. You can go get your degree and hack the planetology and do your thesis on cracking Gibson's or, you know, nerdery a-a-as on a loop. Whatever happens behind the curtains. I haven't gone. So so we have Teaching Cities encouraging the use of city resources and a hacker school across town. This sounds awesome. The institution approached us with the idea of putting some dirty, rusty old box on the outer edge of our network and seeing if they can come at it. Cool concept, but a single made to Pone server just sounds boring, right? CTF with a single flag. Come on. It was very little work, but at a very little gain. I'm a much bigger fan of like the train like a fight model. So my response was, hey, university institution people, why don't you just poke around our perimeter network? Use the public IP space and in exchange for this program and this relationship staying alive, give me a report on anything you find. Basically, it's like using interns in a bug bounty program. Anyone who smashes through a perimeter during an introductory university level hacker course is the person that we should be handing a job offer to. My first pitch was met with resistance, actually a hilarious amount of resistance, like bug bounties are an established practice of using interns as an established practice. I mean, they even get paid an exposure or whatever we call nothing tokens these days. Bug bounties exist, internships exist, but nope, we absolutely cannot use interns in our bug bounty program. So let me get this straight. We let inexperienced, untrained university students build bridges over water and expand gas lines and run full ecological maintenance cycles on forests and park lands. But letting them poke at a segmented web servers too risky, huh? What? Because cyber and no one knows what we do here. Fair enough. We've all been there. So myself, a couple of the profs, some of the teaching cities folks anyway, we all listen to the concerns, address them like adults and got underway. The first run of the program went exactly like this, like the point is the proof of concept. My phone rings at my desk one random afternoon and I'll put on my my prof app prof. OK, group one is going to run a basic vulnerability scan. Cool. All right, I'll watch the logs. Oh, I see. I see. Oh, oh, no, never mind. That's just some some, you know, internet wide scanner in France. Oh, I see it now. I see. No, no, that's that shady printer and accounting that port scans the land every time it prints for some reason. Hang on. Oh, there. Oh, no, that's that's not it either. And then I promptly forgot what I was working on and walked away into a meeting. Sorry, group one. Later on that day, phone rings. Oh, I guess we lost you. Group two is going to go now. Oh, excellent. Yeah, let's do this. I'm watching the logs. Oh, group two isn't quite ready yet. OK, waiting. They're having issues running their eighth and ninth Windows server VM on this refurbished Chromebook. OK. And now this time I walked away on purpose. Phone rings again later. We'll get it sorted for group three. Yeah, sorry, dude. It's coffee time. I'm out. No work on break time. You get the idea from, like, my crystal clear acting, like crystal clear acting. So like Hollywood, if you're watching, I'll stand in for the rock or Jason Momoa, whatever you need. But at the summary of this initial experiment, there were technical limitations on mostly on the college student side, but equipment difficulties and networking difficulties from time to time, the occasional disinterested student group and really what like the ultimate way on the project was that it would turn into a huge time commitment on my end for what was largely a pet project. So I had actual things to manage and actual security stuff to do. So this was not going to keep the higher ups at the office happy for very long. This needed to improve. I actually kind of, you know, sending back and doing like a problem analysis. I saw two big problems with this. One, I was the broker for the actual information they needed.  As I was the one with the access to the log data and can interpret it. So I could potentially expose the entire stream of log data to the classroom or whatever, but that would probably have some pretty far reaching and obvious information as concerns. Second, I need to actually isolate the campus data, you know, the from the public scanner from France or whatever I needed. I need to keep those people out and separate in one way or another. So I wasn't doing an analysis on the entire public internet while trying to give them feedback. And when I say all of this, most of the people watching this video from Def Con, there's just a ton of noise on an internet facing system, even at just the firewall level. And 20% of that noise is probably from people attending these talks right now. More than half of that being actual exploitation, definitely coming from people at this event. Anyway, the you all cause that noise. Hackers ruin my day, at least when I was a Fed or a rent a cop version of a Fed. Tilly hackers. So I needed to conjure up the relevant data and separate it from the fluff. And I needed to communicate that effectively and preferably asynchronously to my own life and commitments. In other words, I needed to automate that shiz. The problem one was kind of half solved, but something as easy as a Slack channel. So that's halfway through problem one. Easy enough. Now I can ignore boring actual work meetings and, you know, chat away to cool baby hacker college kids. So halfway through problem one of this Slack channel. Cool. Problem two is a bit trickier. The solution was largely made possible actually by cleverly abusing scheduled policies on a firewall or to gates before you ask. Most UTMs have the ability to schedule policy rules. If they don't, Cron and SSH can step in. But most do, especially large sized, you know, perimeter gear. So I used schedule policies to just crank up the logging and schedule a window for the students. Like dial the logging up to 11. I can narrow it into, you know, either GeoBand or whatever. Dial that all up to 11. This meant I didn't actually have to use any specific WAN IPs either. They could simply work from wherever. Just do it between 7 and 9 p.m. or whatever. So another added benefit was having specific policy numbers now. So with that new scheduled policy, I now have, you know, rule number 510, rule number 512 or rule 500 to 600, which makes searching through the noise data a lot quicker and a lot easier. Basically, the firewall itself is tattooing the relevant data for me just with that policy number. That's fantastic. So now I've got policy numbers that can actually trigger the logic and eventually auto communication. So simple alerts based on hitting those new schedule policies really cleaned it out, but also kind of help them see if there was Internet mess mixed in there. As soon as that was communicated to the Slack channel as well, they could see what they're up against. You were trying something that people are trying every five minutes. Think a little wider than that, right? So feeding even the generic noise back into the channel during their scheduled window helped them really see what noise looked like. So if they wanted to either look like noise or be completely different than the stuff that's already got a lot of rules against it, they had that feedback now. So this shiny, new scheduled traffic all flowed through a totally non-denominational, vendor agnostic, monochromatic blank box product, of course. Actually, wait, no, we're a sponsor right now. We're sponsored. OK, screw that. This all went through Greylog. It all went through Greylog. Super easy parsing engine, simple and effective event engine and great output logic like Slack notifications. So after the first run with live IPS, AV and firewall event data, all being dumped into the Slack channel, just the UTM rules, adding new logic, fine tuning granularity, it blew up so fast it was crazy. Within a few more weekly sessions, we had the spam filter logs for phishing simulation, including a link clicking sandbox that the students actually built, which is super cool. If I remember right, it was some sort of I map voodoo running into cuckoo, all spun into containers, but I could easily be screened out. Anyway, they had an auto link clicking thing that we ran, and if they sent in links, it would click on it and we could see how the rest of it played out, which is cool. We actually got a lot of really good intelligence out of that. We eventually also had a one-to-one replica of a production platform that allowed unauthenticated file upload, so all feeding their locks. So, you know, if they're uploading a whole bunch of shady.js files or whatever about PHP, and we could see that, putting all these various layers into Greylog, being parlayed back to the students themselves as they're trying the exploits. We could even, you know, we'd simulate it at times. Oh, you've got the band for an hour. You've got the band for an hour, right, for 30 days. Ooh, that's a nasty one. You triggered the IPS on a critical. That's, stop halt. And never did we have any issues. So, parlaying it back to the students as they were trying it. I mean, the more I thought about it later, and as kind of time has gone by, the more we realized we're basically describing more or less the automated feedback loop from purple team exercises, except done in a way that I felt most comfortable myself. In other words, it was done completely unprofessionally and totally hacked together. But it was awesome.  So that was my first adventure that I wanted to bring up. Nothing earth-shattering, technical wise, but rather than throwing hands in the air and giving up at our log jam, see the loop back. We methodically attacked the root of our problems and blended the solution together, scheduled firewall policies made for straightforward alert logic into a chat program for feedback. This actually made for a really fun pock for baby hackers. No idea where this project is now, but hopefully someone found my shoddy documentation, blew the dust off and tried again. Baby hacker school. So I've never before and never seen since scheduled policies abused that way outside of maintenance windows or Internet restricted machines or blocking Internet hours because someone works the late night shift and likes to abuse the Internet. Anyway, so that was old tech used in a new way. Speaking of Internet abuse, however, story number two, once upon a time in a land far, far away, I worked for an organization that was building a large equipment operation depot. The building was all done, but nobody was really working in it yet. We went in and suited up a bunch of, at the time, state-of-the-art Wi-Fi. It was going to be so exciting. These particular APs had all kinds of cool tech. It was the first walk about, roaming AP to AP, Wi-Fi where you can go one to the next without dropping connection that I had been part of deploying. It was the first one that I'd been on that had heat maps, density maps from estimated foot traffic, et cetera. It was cool. And speaking of bells and whistles, these APs had some pretty groovy security tech baked into them. Now, caveat, I believe this particular protection has been patched out for a couple of reasons, but I won't name and blame the vendor. If you're Googling, you'll find it from the story. Anyway, there was this really cool security protection against evil twin attacks. It got our attention, how do you protect against that? We didn't know what it was or how it worked. Or anything, it was just two checkboxes, evil twin attack detection and evil twin attack protection or prevention. I think it even said beta or, you know, this feature is incomplete and dangerous or something. Anyway, we rolled it out. Since this building was kind of far, like geographically far from us, we were doing everything remotely, but it couldn't shake like, what does this actually do out of my head? So we remotely activated some laptop in a dock and played with its wifi to broadcast a network with the same name, you know, basically simulated and actually technically doing an evil twin attack. So that's what we're working on. It should have been like an easy detection, right? Like, no, but nothing, like we get nothing. Nothing came out of that. There was no cool evil twin protection, no logs even showing the detection, no like tiny cannons popping out of the access point or flamethrowers, no Bill Murray riding a dinosaur that shot lasers out of his eyes, nothing. Like, total bomber. Dad, it was just, oh, we were so disheartened. Anyway, most people would let that go. But like, I had to know. I'm like, the checkbox is here. Somebody deved this. I want to see what they deved and what it does. So I jumped in a car. We drove down there. Let's see this thing in action. There's a knob that seems irrelevant and all for thoroughly testing it on company time way over scope of the project. So we walked around broadcasting our wifi range. Nothing, not a thing. No idea why, maybe it was propagation time, who knows? Whatever we did, nothing worked. Oh well, evil twin protection wasn't actually in the deployment scope as I kept getting reminded. So I had to give up and walk away. We did, packed up, went home. Exhaustingly. We were eventually able to trigger the detection pretty much by using a few other commercial APs and the evil twin protection was simply cranking the antenna power out of any AP that detects the malicious SSID to 11 or whatever max power is for a configurable amount of time. So in other words, you have your wifi named super ultimate hacker and you set up an SSID called super ultimate hacker. The APs that detect that just crank their juice to 11 for 3,600 seconds or whatever it is. So that's all it was. Is it an hour or two as the default? It was boring and nothing space age at all. I really wanted tiny cannons out of the access point. Anyway, as with any test that leads to complete disappointment, we literally packed up our gear left and enabled and didn't turn it off. Who cares? It's boring anyway. What does do something? So a few days later, our test alarms light up like Christmas tree about an evil twin attack. Yes. Awesome. It's not even one of our test systems. This is a legit real hacker in our parking lot. Yeah. The entire security team is feeling like a badass level somewhere between hackers and sons of anarchy right now. Someone is going down and we are the super humans that are causing this. I don't think anyone really stepped back and thought too deeply about how much energy we're putting into an alarm that we couldn't even manually trigger on the test day. But that's not really important right now. We have a live hacker on the hook. We dove into those logs headfirst with various faces and started looking around. We quickly learned a few key pieces of information. First, the MAC address was not a well-known vendor address. It was an actual known vendor. Just none of us recognized the name. It was in the thing. We're just, what is that? Second, the AP and the parking lot had the greatest signal strength by far with the next two being roughly equal. In other words, our MacGyver super ultra genius napkin math triangulation told us that the hackers should be out in the parking lot. So it's most likely at this point a nation state team in a series of black panel vans with a special forces strike force all around us in the bushes and along the neighboring fence line. It's a privacy fence. So this is entirely possible. It could just come 10th mountain over the hill in tanks or whatever. Probably North Korea, Russia and China all charging over the fence at the same time to attack our parking lot for some reason, at least our Wi-Fi. We detected an evil twin attack. What other scenarios could there possibly be? We eventually remembered in all of our excitement that we actually have security cameras. So we pulled them up and as it's loading we're all waiting, we're all waiting. Looking at the parking lot, you wouldn't believe what we saw. You ready? Nothing. Not a single vehicle. No black van, no special forces team, literally straight up 100% nothing completely bare bones empty parking lot an empty stretch of concrete. We actually saw the same protection pop on and off a few times over the stretch of an hour or two. That was it. Never a vehicle showed up. So a small team of security and IT operation nerds put their tails between their legs and went home that night with completely broken hearts. I'm sure there was at least one pair of superhero pajamas worn to bed just to feel better. Well, redemption was still possible. About three days later, the alert occurred again. This time, plot twist, parking lot wasn't empty. However, after driving around, doing some range checks, some strength testing, we confirmed this evil twin attack had to happen within the area of the parking lot, at least within a couple of feet of the area of the parking lot, but it was empty on the screen every time or verifiably not belonging to one of the vehicles in the parking lot. We were complex, totally cum perplexed. We did have one new piece of information though. The MAC address was the same vendor ID, but a different MAC, the same weird vendor. Well, we got that alarm a day or two later and then again and then again one more time. So now we're nowhere near as excited, but we've just kind of still telling all of our friends and family that we have an ultra-patient APT level MAC address spoofing campaign going on, but these international criminal supervillain spies were not going to outsmart us. One of our group had the genius idea of seeing if we've ever seen this MAC address or vendor before. We actually have. That vendor ID has popped up at one or two other sites occasionally. In these other instances though, the MAC address didn't change. Same device had a history of occasionally connecting to our public Wi-Fi. Now just to remind, this is a public Wi-Fi network that spans across one of the larger cities in Canada. So it's not a tiny network. We had no idea what these devices did and still no idea what it was. The nature of our logging infrastructure meant we didn't have records of what traffic these devices were generating when they connected. None of them were recent enough for that logging. The IPs were all long recycled to other devices. Another interesting note, these devices, the ones that we had previously seen, hadn't connected in months. This is springtime, so that actually becomes an important fact of the story. We enabled some pretty detailed layer two logging and filtered it down for that particular vendor ID across our whole infrastructure. Now remember, not everyone's from network operations, but remember if you're running a homogenous network as in everything from the same brand and product line, which really nobody is, then it's actually a pretty big challenge. Unless you're doing that, then it's actually a pretty big challenge to monitor traffic from layer two filter. In other words, a specific series of MAC addresses onto what actual traffic they're doing, what is the actual traffic they're generating, web traffic or API, whatever else it is. We can do packet capture, which is ungodly expensive resource-wise, or we can use a NetFlow variant, which is spotty at best, that's sampling. We wanted to know the traffic being caused by a specific brand of network card. In the end, we finally had it. We tagged the DHCP logs and added some additional information. So we pulled a lot of stuff off our Wi-Fi controller, added a little bit to kind of generate our own sessions, and then tagging those sessions from the first level of NAT device. So as soon as they go from one brand of Wi-Fi controller across a router, you've now lost that MAC address information, which is what makes this challenging. You've now lost that. So we had to kind of give them a fake session that carried over to the next set of logs. Hey, if you've seen this session, add it again. Great. And so we were able to carry that on. So we now have traffic logs. The traffic from these highly advanced adversaries, when we finally got it, when we finally got it, we couldn't believe it. The traffic was to, I don't remember the exact URL, but something along the lines of api.webersmartgrilling.com. Our enemy that was gonna roll over in tanks was a handful of smart barbecues. Our nation-state level threat actor was a tool used to not burn chicken. Given how much we had hyped up this whole thing in our heads, it was definitely a solid laugh cry moment, followed by days of uncontrollable giggling. Like seriously, we had this hyped up in the office. It was pretty good. We were all pretty convinced we were gonna completely uncover some huge, like the Illuminati at the least. Note, note completely overpriced hot dog cooking tech had us baffled for weeks. The rest of the pieces started instantly making sense. Other folks who lived close enough to our facilities to leech-free wifi simply hadn't barbecued yet this season. And now that we had all the, we did have one piece of the mystery left to solve though. This all started with an evil twin detection on our access points.  I mean, now we're kind of, we've narrowed it down to someone publishing our wifi name on a freaking barbecue. But we actually went as far as using our security camera, zoomed all the way in to find the right brand of barbecue in the nearby backyard, because you'd see it from the top of our building over the fence. So we politely knocked on the door and explained our situation. The particular barbecue user found the whole story side-splitting hilarious. We asked them, you know, how are they configuring their barbecue? After assuring them we're not pulling the plug in your free internet, continue to leech-free wifi. We barely scratch our bandwidth capabilities. We just want to know what happened.  They can both connect to wifi and use cloud services to push your grill notifications back and forth. Or they can be configured kind of non-cloudy as a local wifi AP. So this particular user decided to name their local barbecue wifi with the same network name as our public wifi, so they didn't have to switch their phone settings back and forth. They could just sit near the barbecue and it should work. That was the thought in their head.  All of their devices went completely haywire so they would take the motherboard of their barbecue back to the hardware store and get a replacement for another. Changing Mac addresses. So we've now narrowed down why we had changing Mac addresses and the evil twin attack. Tried it several more times until eventually gave up and just gave it a proper local name and away it went, so we never saw them again. And then some folks from the city started knocking on their door asking about their smart barbecue. So that was the fun one. They're potentially a clever way of just not having to switch your phone's wifi. It didn't quite work, but the moral of the story is leaching public wifi for your barbecue might end up with advanced persistent civil servants knocking on your door asking questions. So to summarize, we combined DHCP logs to summarize the tech at least. We combined DHCP logs to NAT device logs to web traffic and DNS logs to make, it took some pretty serious finesse to get those all talking to each other, but it was doable. And eventually we're able to filter on vendor Mac IDs and any other aspect of that change is totally possible. How be it, if you wanted to drastically cut down on some time and effort in doing it in gray log, you'll want the MongoDB lookup table. So if you're small scale, check out the small business or upgrade if you're doing this at the office. So anyway, that was one. That was a big case for how before I got to gray log, we ended up on enterprise. On to my last tail. Now this one isn't even so much as a tail as an entire category of function and against. This concept actually came from a portion of the gray log analysts class where I asked guests to just tell me stories like the ones I've told you now. One of the better ones by far was a fellow who really enjoyed playing tricks on his relatively non-techie family. So this last story has a pretty simple premise. When you have a security analytics platform that can also execute code. In other words, one of the event notifications for gray log is running a script. You have a security analytics platform that can also execute code, run that script. You now have something that can monitor for events then take actions. The scripting part allows you to take any action. What this means is you actually have a giant if this then that engine. When something happens, do something else. The world is your oyster and this is how we abuse oysters. This particularly shifty student at his usual home network monitoring going along. It was actually just Syslog from a really boring commercial Wi-Fi router. He started parsing the Syslog events at one point and tagging the DHCP records with the owner of the devices. He started building up a bit of an impromptu active asset management system. So when the kids will call them Phoenix and Phalanx or whatever their names were came home, he added a field to the log saying Phoenix Apple Watch or Phalanx's Xbox. Most of the stuff is kind of in there unless they've renamed it something silly. At one point or another, he was trying to build a bit of a digital notification system, a vendor agnostic version of the Zoom attendee announcement. Kyle has joined the meeting, but instead being Phalanx has entered the building. That was the end goal. While testing it out across his Sonos system or Google speaker group, whatever it was, I believe it was Sonos, he used some sample MP3 files before working on the text-to-speech component. So he used these sample MP3s to just kind of grab and use this as part of it instead. It never made it to the text-to-speech phase. He happened to choose some sample MP3s that kind of randomly matched the personalities of his family members.  How perfect is that? No, I don't want to simply regurgitate someone else's story. So I obviously had to set up some POC for this myself. Great Scott, this was fun. Check out my test sample video. My kids are really weird. Now, unfortunately due to calendar-giving snafus, I had to ship this talk before I could see this all the way through to my end goal of every time the word Minecraft was Googled in my house, play this sample video on every TV. I did, however, get the latter part going without any issue and so, I'm even able to run persistently through the house.   Movie file, set up properly. Hopefully that worked, it's a one-liner. We're serving it up, just Python HTTP server and behind my lovely face is the fuller. Here we go, are you set it up? Let's see what we got when we run it. Quick hijack of the Chromecast. An angry kid. If that isn't modern-day parenting at its finest, I don't know what is. I wish I had more time and then we could talk about stories like this all day. One more time, I'm Abe. Find me posting nonsense on Twitter, LinkedIn, GitHub. You can follow me at Big Abe20, follow at Greylog for awesome stuff. Big thanks to everyone at Blue Team Village. More shout-outs to everyone at DefCon29. You've put on a really awesome show this year, despite the learning opportunities. See, always a manager. And thanks to my team at Greylog for always moving the finish line and making a great tool. Last and most important, thanks for checking out my talk and staying right to the end. I will see you all around. Enjoy DefCon.


Probably Latrine, Latrine was like, yeah like those bathrooms did not smell good. You have to clean them up after like everyone showered so it's like humid and an already summer environment when I went. Like some of the stuff would fall apart and you just didn't want to clean that stuff so I was glad I didn't have to do that so sorry people that did Latrine. I'm not really familiar with all the details but I would say worst job would be Chow Runner. I personally got picked for Chow Runner from day zero. I was Chow Runner for three weeks straight and I had a really hard time with memorization and trying to get it down and you basically have to announce your flight into Chow breakfast, lunch and dinner in front of four or five MTIs maybe even more and they critique you the whole time and will scream at you for a long time before you get it. What do you want? Put the paper down! What do you want?  I don't hear you. Oh now I get called a sir. Now I'm a sir. Are you talking to Grace or are you talking to me? Oh man I had the worst job being the Latrine chief or being on the Latrine crew which is terrible you do not want that or the utility crew you do not want either of those two. I couldn't think of a more horrible job if I wanted to. Because every day you get inspected on your dorm and those are the two areas that get the most marks or get the most discrepancies you don't want that. Latrine queen uh you got to deal with so many people to get that Latrine clean and they always find something. Our Latrine chief like killed it though he did great we barely had any days that we failed Latrine but yeah so Latrine chief.   My opinion dorm chief is the worst job at BMT I just think that they have the most responsibility to everyone and the MTAs really rely on them to be the supervisor when they're not around and when it's just a flight and that can be really hard to do when there's 50 guys all messing around you know jump and fighting each other and yelling at each other so to have to monitor that and make sure nobody gets in trouble for it especially people are walking in and out of the dorms that's got to be a tough job I wouldn't want it I don't think I could pull it off that's a lot to ask. I'd say is either Latrine crew, child runner for some people, I personally enjoyed it or being dorm chief because dorm chief you have a big responsibility of taking care of the flight when your TIs are not there. The worst job to have at BMT although it's not like a really like an official job definitely Latrine crew on details. I was on the train crew on details and scrubbing toilets for like 50 girls is not the most fun it's pretty gross. There you go that's pretty gross and it's just all together not fun and like they're super strict on how like clean the bathrooms have to be so I would just definitely not recommend being on the train crew if you can avoid it.


The craziest thing I've seen someone put in their body, part one. Here we have an x-ray of a drug smuggler, someone who swallowed many packets of drugs, also known as a body packer or a drug meal. This patient swallowed each of these individual packets and who knows how long it took, but the only thing to do for this patient is watch and wait because eventually, it'll all come out the other end. Make sure you follow me to see more crazy things people put in their body.


If you try and chase two rabbits, they both get away. So pick which one you're going after and go grab that sucker. And there was a study that I saw, and this changed everything for me, because I also was someone who could easily chase the shiny and chase the flashy, try and do multiple things at once. I saw a study that was done by a gentleman named John Berardi, who started a company called Precision Nutrition. And he did a research study, and he found that when they had one group focused on changing one singular behavior at a time. And when they only focused on one behavior, they had an 85% success rate. In the second group, control group, they had them try and change two habits simultaneously. And the percentage of success dropped down to about 40%. Less than half of that original group. And then just for giggles and smiles, he had a third group try to change three behaviors simultaneously, and their percentage of success dropped down to about 4% or 5%. So just by diverting our focus and attention from one to two or one to three, we go from 85% success down to 4% or 5%.


This is Doctomer 90270A. We are here at Summit Automotive in Fond du Lac, Wisconsin. You're new and used light-duty truck headquarters today. We are checking out this super clean 2015 Chevy Silverado 1500 crew cab short box. This truck has the 5.3 liter V8 motor has been fully safety and inspected by our service shop has a fresh oil and filter change. All the fluids have been checked and topped off and this truck is 100% ready to go. Summit White is the color. We shoot all of our videos in 1080p 60 frames per second. So if you have HD capabilities on your computer tablet or smartphone device turn them on right now because it is like you are right here looking at the vehicle with me and definitely your best way to check out the vehicle quality and condition wise before seeing it in person. It does have power running boards there. If you want to check out more photos of this truck in the upper right-hand part of the screen is a link right to our website. Click that and check us out there. This is XD Series painted and polished aluminum 18 inch rims. BF Goodrich All Terrain LT 275 5565 R18 tires with about half the tread left. It has a rough country suspension lift kit on it. And the frame and underbody is in really nice clean condition. Front fender is in nice shape. It has the projector lamp headlamps, the factory fog lights and the front bumper parking sensors. The front bumper looks like it is in really nice condition as is the grille and hood. Passenger side fender. No dents or dings on that. And the passenger side rim. No scuffs or scrapes there. As you go down this side of the truck take note of how clean the body is, how reflective and mirror like that paint is. And we take these HD videos so if you are far away or even if you are close by and just cannot make the trip down but you are still interested in purchasing the truck you can see the truck, hear the truck and have confidence in the vehicle that you are looking at before you even get here. In fact we offer a Summit Auto Fastpass option in the upper right hand part of your screen and link right to our website where you can apply for financing. Get pre-approved, see a payment quote. Even appraise the trade off from the Comfrey own home. See the frame and underbody is in pretty nice shape. Has those power boards back here on this side as well. And all the rockers look really good too. This back rim is in nice shape. It does have a dual exhaust and rough country shocks in the back as well. Back tires have just as much tread as the front tires. Z71 off-road package gives you the skid plates. That is a Gibson dual rear exhaust. You get the rear bumper steps, full towing package which includes the receiver hitch four pin and seven pin wiring and the tailgate is in really nice condition. I didn't see any major dents or dings on that. Has a locking tailgate with the shock down assist. It has a spring and bed liner, LED bed lighting and that tiger soft tonneau cover is in nice shape. Didn't see any rips or tears on that. Has another rear bumper step there that goes down. And as you go down this side of the truck, just as clean as that passenger side, this back rim is in nice condition as well. And the back tire is just as much tread as the rest. And down the rest of this side, very nice and clean. The only thing I really saw on this truck, there's just a couple little rock chips on that fender flare and the passenger side one. But other than that, this truck is pretty much as nice as you can get. Has the telescopic tow mirrors so they telescope out like so. They also fold in like so. Inside the LTZ package gives you the tan leather interior. There are no rips, there are no tears on the seats. Really nice condition, both these seats are heated. Factory all-weather floor mats throughout, auto headlamps, turned out four-wheel drive, factory brake controller, power windows, power locks, power mirrors, and memory driver's seat. As we hop inside the truck here, you can see that this one has 78,303 miles. You get the Z71 instrument cluster. Comes with the heated leather wrap steering wheel, Bluetooth and information center controls on the right, cruise controls on the left as well as your forward collision warning, heated steering wheel controls, steering wheels in really nice shape. Comes with also the six-speed automatic transmission with the optional tab shift. You also get the factory navigation system part of the Chevy MyLink system. This is also where your backup camera shows up. And you can do all that other stuff on there as far as like Pandora and the weather or all the apps that you can sign up for. CD player.   Down here you get three USBs, two power points, and then a 110-volt, 150-watt plug-in. You've got your all-weather floor mat on the passenger side, and the passenger seat is in excellent condition as well. Headliner is nice and clean. And up here you get your map lights and your HomeLink buttons for your garage door security systems and lighting systems. You also have on-star capabilities in that rearview mirror. We'll take a quick look at the back seats, and then we will check out under the hood. So you can see those step bars there. They are AMP Research Step Bars, and they work really nice on this truck. Back seats are just as clean as the front seats. No rips or tears back here. All the seatbelts are nice and clean, as you can see. And the seats are the same thing. You get that power sliding rear window with the built-in rear defrost. These seats do fold up for extra storage, and there is a storage tray back here as well. Factory floor mats back here. And very nice all the way around. We'll take a quick look under the hood. I would personally like to thank you for checking out the video today. And hopefully, from this HD video, you will have been able to tell just how clean this truck is all the way around inside and out. Under the hood, we have the 5.3-liter V8 motor, engine bay very clean as well. It runs very smooth. This truck has been fully-safetyed and inspected by our service shop. It has a fresh oil and filter change. All the fluids have been checked and topped off. This truck has been gone through mechanically 100% and is 100% ready to go. To see more pictures of this truck we have here one of our other 450 new and used cars, trucks, SUVs, minivans, Wranglers, half-tons, three-quarter-tons, one-tons. You name it, we got it. Go to our website www.summitauto.com. Pull pictures and descriptions of every single vehicle from two locations, all at summitauto.com. If you'd like to check out more HD videos, you can go to youtube.com. Remember to like, subscribe, and share on this video and all the videos that you see there. In fact, in a second, you will see links to subscribe to our YouTube channel on your left. We have heavy half-ton truck videos like this one on your right. If you have not been to our website, on the bottom link to this vehicle on our website, click those, check us out. And we really look forward to helping you with this super clean 2015 Chevy Silverado 1500 crew cab short box with a rough country lift LTZ. Thanks again.


For more videos on people's struggles, please subscribe to our YouTube channel. Hello and welcome to another episode of Around the World in Eight Minutes, a show by People's Dispatch. In this show, we bring you stories of struggle and resistance against authoritarian repression and capitalist exploitation. In this episode, we'll be taking a look at the resistance by students of India's Jawaharlal Nehru University against a proposed fee hike and various restrictions by the administration. In our second story, we'll look at the massacre of an Indigenous leader and four Indigenous Guards in Colombia. And finally, we'll go to Lebanon, where after days of protest, the Prime Minister was forced to resign. We begin with a student strike at the new Delhi-based Jawaharlal Nehru University in India, which entered its third day on Thursday. The strike was called against a proposed fee hike and efforts to privatise hostile services to the installation of water and electricity metres. The students are also opposing restrictions imposed by the university administration. These restrictions include dress codes, hostile and library curfew timings, as well as restrictions on the access of public spaces like the famous Parthasarathi Rock area on campus. According to the new measures, the hostile rate would increase by a whooping amount of 2000 rupees, which is around 28 US dollars. This is in addition to the decision to impose water and electricity charges. On Wednesday evening, a massive protest broke out at one of the girls' hostels, Koina, against a new draft hostile manual, which was passed by the university. The students and the students union condemned the university's action of calling in the police force during the protest at the hostel. The proposed measures were passed in the Interhall Administration meeting by the JNU administration on Monday. The IHA or the Interhall Administration is responsible for managing and running hostels on the campus. The administration arbitrarily decided to convene the IHA meeting to pass these draconian measures without allowing the mandated representation from the JNU students union or the JNU SU. In an inspiring form of resistance, JNU students double-locked the office of the Dean of Students, which looked into students affairs, noting that the behaviour of the Dean is unbecoming of JNU staff. Last week, the university administration had attempted to double-lock the student's union office, saying that the union election held in September is not recognised. After massive resistance from students, the administration backed down. In September, a united left front panel had managed to secure a massive victory in the union elections, defeating the far-right Akhil Bharati Vidyarthi Parishith. Jawaharlal University is a government-funded institution in India and is recognised for its academic excellence and progressive campus politics. The university fee structure is highly subsidised and is known for quality and affordable higher education, which is accessible to the poorest of the poor in the country. The semester fee in JNU is around $4, while the hostel fee for a semester is just around $10. The university has a long history of students' resistance against various attempts by the administration to increase the fee and do away with progressive policies, which have been the bedrock of affordable higher education. Here is a look at some of the protest videos. In Colombia, the rampant persecution and assassination of Indigenous people continues. On October 29th, four members of the Indigenous Guardia and Indigenous Authority were killed in an armed attack in the Taquayo town of the Toribio municipality in the Cauca department in Colombia. In addition, six other people were seriously injured. The Association of Indigenous Cabildos of Toribio, Taquayo and San Francisco, Project NASA, through an official statement, said that the unidentified armed men, allegedly members of the Dagobarto-Ramos dissident group, ambushed the bus in which the Indigenous guards were travelling and opened fire indiscriminately against them. The Association reported that the attack continued for more than 10 minutes, and the attackers even fired at the ambulances transporting the injured people to the hospital. The Association called on human rights organizations, international organizations and the national government to pronounce, accompany and support the NASA people. Among those killed in the ambush were Cristina Bautista, leader of the NASA Indigenous community and members of the Indigenous Guard, Azrubal Kayapu, Heliodoro Finescu, Jose Harardo Soto and Jamez Wilfredo Soto. The Regional Indigenous Council of Cauca also condemned a massacre perpetrated by the armed group against the Indigenous community. The CRIC demanded that the national government guarantee the life, the right to life and physical integrity of the Indigenous people. The National Indigenous Organization of Colombia also denounced a massacre and held a press conference on October 30th to reject the ceaseless aggression against Colombia's Indigenous people. During the press conference, the Indigenous leaders held President Ivan Duque's administration responsible for the massacre and genocide and said that it had failed to provide the necessary security to the country's Indigenous population, despite constant denouncements from Indigenous organizations over threats to their physical safety. The organization demanded the immediate resignation of the Ministers of Defense and Interior, who they claim have done nothing to prevent the persistence violence in the region. The organization also gave the call for a national mobilization for life on November 8th. Senator Gustavo Bolivar and Aida Aveya called on people to take part in the vigil in the evening, the Plaza de Bolivar, to commemorate the victims of the massacre. Two weeks ago, the CRIC had also denounced a murder of Toribio Canoas, an Indigenous Guard in Tacueyo. Earlier, in the month of August, number of incidents of violent killings of Indigenous guards and leaders were registered in Cauca. According to the ONIC, in 2019, more than 120 Indigenous people have been killed in the country. Cauca is one of the departments most affected by the armed group violence in the country, where Indigenous people are the main victims. The Indigenous Guardia is a humanitarian mechanism of civil resistance of Indigenous communities of North Cauca that is spread to Indigenous, Afro-descendant and Pesin communities across the country. The members of the Indigenous Guardia defend the ancestral territories and people from actors that attack them. That is the reason why they have become the main target of drug trafficking, illegal mining and other paramilitary groups operating in the country. Since Duque took office in August 2018, the humanitarian crisis in Colombia has escalated not only for Indigenous communities, but for all those who fight for peace, structural change and rights. Instead of taking structured measures to eradicate violence from Indigenous communities, Duque stigmatized these communities and their social struggles. In our last story in Lebanon, Prime Minister Saad Hariri submitted his resignation to President Michel Aoun of 229th, fulfilling one of the main demands raised by the ongoing protests in the country. The people welcomed the resignation, but have refused to end their 13-day-old protest until all their demands are met. Although, reports say that many protesters have lifted some blockades at several places after an appeal by the army. Popular protests erupted across Lebanon in October 17th. In opposition, to the government's move to introduce several new taxes, including a $6 monthly tax for calls on popular social media apps. Though the government announced a withdrawal of all those taxes, the protests have since turned against the entire political class in the country, holding them responsible for the economic problems and blaming them for indulging in a massive loot of public money. The Saad Hariri government had tried to placate the protests last week when he announced a series of reforms, including cutting the salaries of most of the government officials and politicians and initiating certain welfare measures for the poor and unemployed. However, despite the announcement of these measures, protesters refused to move away from the streets and even intensified the agitation while giving a call for a general strike. Most of the educational, financial and commercial activities in the country have been shut for nearly a week and protesters have blocked the main streets and roads. Though people in the streets express their happiness after the resignation of Hariri, it is unlikely that they will end soon. The protesters have been demanding large-scale systemic changes in the country's polity under a transitional technocratic government. Though no formal demands have been presented, anger against the confessional representation system established after the Civil War years as a compromise among the warring factions is obvious. According to the confessional compromises reached during the Taif Agreement in 1989, Lebanon has devised a system according to which major sects in the Lebanese society get a quota in parliament. The major political posts in the country are also allotted on a sectarian basis. For example, the Prime Minister of the country will always be a Sunni, the President, a Christian and a Speaker of the Parliament, a Shia. Protesters think that such fixed quotas on the basis of sectarian lines have kept the country divided, helping the political class exploit these divisions for their gain. They held that such divisions are breeding the corruption and inefficiency, which in turn is responsible for the economic problems of the country. Lebanon has a high massive public debt and increasing youth unemployment. The government has often been blamed in the past for the failure of basic public service delivery, including its inability to deal with last month's massive forest fires. That's all we have for this episode of Around the World in 8 Minutes. To read more about these stories, visit our website peoplesdispatch.org and follow us on Facebook, Twitter and Instagram. Thanks for watching.


Small groups so if you have questions feel free to just raise your hand or shout them out whatever works for you So this let me get a survey of the room. How many of you are designers? Okay, how many of you are small business owners? Okay, great and any developers Okay, and any other categories I might have missed just learning perfect Great It's good to know so this is an so I'll start with introducing myself. My name is Carolyn Thayer I'm a UI UX designer, and I'm a Teacher's assistant at skill crush calm. I'm based out of Portland, Maine Feel free if you think of any questions to Hit me up on email or send me a tweet. Whatever. I'll take questions after too And so the goals of this presentation, so this is going to be an entry-level presentation Before you create a website you need a plan You don't want to just open up Photoshop and start throwing around colors and fonts you need to know what you're doing It's going to save you time and money Well, you could just open up Photoshop, but it's going to cost you a lot more money and a lot more time And you're going to have a lot more expensive mistakes So the goal of this talk is to give you the tools to create a roadmap for your website Whether you're building your own site or you're working on a client site or you're working with a designer agency You're a small business. You're working with someone just knowing the process knowing the steps You can take before you talk to a designer This is going to give you a launch point to build a successful website You might not need to use all of the methods every time that I'm going to talk about But you'll have like a toolbox that you can reach into and grab something that will fit your project All right, so the first thing I'm going to talk about is user personas So I'd like to say that a user persona is a snapshot of a fictional person who represents Research done on a major group of people visiting your website So user personas give you a useful metric to design and critique your site with So rather than having to remember the details of many users You're looking at your site through the lens of three to five fictional characters This tool is really useful then when you have to make sure that a user accomplishes a certain goal such as buy a product Call a number find directions And what makes a good user persona? So a good user persona Focuses on your intended audience while it's possible to have multiple audiences However, if you're asked a question, who is your business targeting and the answer is everyone you're not actually targeting anyone So you want to kind of narrow it down between one and three categories of people who are using your product or service Really knowing your users and their needs is going to help you make effective design decisions As much as possible your persona should be based on actual research So this makes your job easier if it's an existing business or company You're able to do research It's a little harder if it's brand new you have to make some assumptions look at your competitors But as much as you can not make assumptions or make assumptions and validate them with research like analytics Or if it's a physical location surveying people who walk in the door any of that sort that's going to help you out and A good user persona should be realistic This one's really important. So while it's okay to be aspirational You want to keep your decisions based in reality For example, if you're creating a persona for a nonprofit that typically receives many twenty five to a hundred dollar donations You don't want to make a persona. That's a millionaire looking to give away their life savings That's not going to happen and that persona is not going to help you And personas are also great for creating empathy. So if you say When you're citing making a design decision and you're citing research Sometimes that's really hard with your stakeholders to create empathy. So you're saying well 45% of people using cell phones But if you have mark uses a cell phone and you can tell a story about mark Look, he's on the go in his car and he's pulling out his phone That's going to build empathy and be easier for all your stakeholders to understand So this is a Free user persona template I just grabbed off a website, but there's lots of user persona templates out there They can be super complicated in detail. They can be very simple I'll send out a link to this at the end of the presentation But a good persona is going to help you pinpoint your users goals That's what it's going to focus on. What are their goals a little bit about their demographics? Some important things to consider for your persona include what their pain points are and what frustrates and delight your users And also some general demographic information Also, because again, we're using these personas to build empathy Naming them something like John Doe and making it really generic is not going to build that same level of empathy as Just building a more well-rounded persona so that more you can make them feel like a real person based on a Large amount of data the more you're going to build that empathy and have really want to build a goods product for your user All right. So how do we use these fancy personas you ask? Having made up these fictional characters. We have a snapshot of our key audience We've built empathy with them and they're now more than just facts and figures So here are two case studies two samples here This is for an online grocery shopping store. They want to build an app or a website and What they did is they surveyed a whole bunch of their customers. They talked to people We talked to cashiers coming in and they want to add an online delivery to their website So this grocery store looked at their online analytics. They surveyed in person customers They talked to their cashiers and they decided that they have two key personas. We have Joyce here on the left She's 75. She mostly uses a desktop computer. She's retired. She lives by herself in apartment downtown. She doesn't drive She struggles with lugging groceries home and her goal is to get basic supplies easily without relying on outside help Something she might say is it's not worth the hassle and then we also have Laura Smith shopping at the same grocery store She has an intermediate tech level. She uses an iPhone 8. She's 39. She lives in a residential neighborhood. She has three children She spends a lot of time driving around. She wants to pay the shop local and She wants she'd pay more for organic brands and she wants to save time without sacrificing quality So can anyone think looking at these if you had to make design decisions? What are some things you might think of that based on these that you'd make for an online marketing store or? an online grocery delivery service exactly Any other things that you can think of based on these personas that you'd want to make sure your online delivery Includes any features for your product. That's a good one, too. Yeah Yes Yeah Those are all great things and so through these we've had empathy versus just saying a statistic of X amount of our users are this age We now can say Joyce wants this and Laura wants this other examples might be Joyce might want to have the phone number easily accessible so she can call. Maybe she doesn't want to deal with an online form So we need to make sure that phone number is easy to find She also might want a larger font to read We also based on Laura. It needs to be mobile friendly We probably want to look that says more high quality versus discount And she might want to click the call button. She might not want to type the phone number in her phone She might want to just hit a button and place her order because she's in a hurry so knowing this if we hadn't had these we could design a beautiful form like a beautiful online ordering form with all these complicated things and checkboxes and good out there and find that Joyce doesn't use it at all and Laura is in too much of a hurry to click a bunch of buttons and scroll through pages and pages of this complicated online Ordering thing so this is where the these user personas and knowing who is using and building empathy can really help All right next item before you dive into your site is site maps So site maps are a way to organize the information and the navigation of your website After creating a site map you should have a complete map of all the pages and sub pages on your site So how do you make a sub site site map my favorite way? Super simple bring it back to the basics post-it notes One way to tackle your site map is to start by writing down all the names of all the pages You'll need on post-it notes and stacking them in rows under the home page of how you feel They should be organized and then the next step. This is the important step go through write down everything that you think go back And then edit them. What can you combine? What can you eliminate? What's redundant and? So you'll end up eventually with something like this so this is for a landscape business and We have our post-it notes and you can tell that they start on the home page We have our main navigation so in the top. We're going to have an about us and our services a gallery and a contact us Then they're probably gonna have in the format of a drop-down menu a mowing page and a snow removal And the post-it notes and the pen and pencil are great because you can really just move things around You can shuffle them you can even add links if you have a navigation in your footer You can put some down at the bottom Mm-hmm So those are a great way to know before you start building your site know what pages you have how many pages? So site maps are sometimes confused with user flows or task flows. That's something I want to talk about the difference of user flows also known as task flows both take the form of Flow charts the differences in what they represent so a site map is about your pages Specifically and the structure of your navigation and your content a user flow is how a user gets from point a to point B So I think the great analogy is from UX movement calm what they say is That they state that a site map is like looking at a map of a territory from a bird's eye view with all major landmarks Visible on the map and a user flow is like putting in coordinates for directions on Google Maps You can see which route to take where to turn and the miles it takes to get there So I know I mentioned user flows Let's talk about that briefly So where user flows are really it useful they're useful for applications and larger e-commerce sites and That's really how we start thinking about going from page to page What is a process like for our customer for our user using our site? How many steps does it take someone to put an item in their cart or on board to create an account? For example, has anyone ever played or watched zoom the TV show the kids show? Yeah, have you ever seen the clip of the peanut butter and jelly game or heard of the peanut butter and jelly game? Okay, this is I wish I put a video in here So the peanut butter and jelly game is where you instruct someone who you can't see so you stand like this And you have someone behind you making a peanut butter and jelly sandwich and they have to kind of play dumb and Follow exactly to the letter at the steps you take to make a peanut butter and jelly sandwich And maybe you didn't tell them to open the bread bag or maybe you didn't tell them to unscrew the jar of peanut butter And they do literally what you say and you end up with like a jar of peanut butter between two slices of bread or something like that Because they didn't open the jar so that's kind of with a user flow. You're trying to think of all of the decisions you're making and Trying to kind of like play that peanut butter and jelly game where you want to be very specific and Next thing you know, you forgot that that user to put an item in their cart has to click through four pages Or something you find or put something in or something that's a lot more steps than you thought of and we're like, we'll just have them check out It'll be so great. So thinking of exactly what your user is doing Let's get that so when do we need to use a user flow? So user flows are really handy on sites that require its users to complete a task in order to be successful Examples can be creating an account like onboarding adding an event to a calendar Putting a product in a cart and checking out Filling out a form to download an e-book Your user flow should help you see how long and straightforward the process is to completing the task You want your users to take if the task is too long complicated or confusing you can lose your users on the journey Leaving the goal of your website unfulfilled If you've ever visited a website that is so complicated to use that it has an entire page Dedicated to setting up your account or checking out then you can empathize with how frustrating that is and see how mapping out the process You don't want to have instructions for how people have to check out you want them just to be able to do it So here's an example of a user flow here for a checkout process and So as you can see when drawing out all the steps of this is a simple checkout process There's a lot of steps that someone has to go through for a simple basic checkout process Looking at this user flow. We can tell that the longest path to checkout is creating a new user account before checking out That's why having a guest checkout option for users in a hurry is a great option other options we could consider to offer a shorter checkout process could be having social media sign-in This can make that process shorter Having a one-page checkout with billing info billing address shipping address and shipping info all on the same pages I've also seen Checkouts with the step numbers on top so you know you're on step one of three so they know it's coming up how long it takes So creating these user flows super important because it shows you barriers to your users completing the goal on your site After you create your user flow you would want to go back to those user personas So then we're gonna reel it back and go back to Joyce and I believe Sarah and we're gonna see would they be able to do this? Where are they gonna stumble or have trouble? And what can we change to make it better for those two personas so they can complete this easily and quickly and painlessly as possible All right, and the last but not the least step. I'm gonna talk about is content guide documents All right, there are many forms of content guide documents. This is another one of those you can find lots of samples online to pull off You can make your own If you're working with an agency if you own a small business and you're working with an agency Typically agencies will have their own content guide document. They want you to fill out And their own preferred format If you're building sites for clients, you really should create your own custom questionnaire for them to get like The information that's most important for you in your process A content guide document contains all of the copy. That's gonna be on your website This document can be as simple as a word document with a new page that corresponds to an item on your site map And a super simple content guide document will only contain your headlines and your text So why use a content guide document? So if you have a content guide your designer will have an idea and Designers love content guide documents. We very much appreciate this But they'll have an idea of the size and type of your content and then they can design your site to meet your content needs and show It off rather than an empty container that you have to fill So I think like if you think of it like a clear vase if we have your content We can build this perfect box or container for all of the content But if you don't have the content and you build and design the whole website first You then have to kind of smush your content in there and maybe it doesn't look so great and that container We built doesn't show it off the way it should Or say you have too little content and we built this Beautiful website for four or five paragraphs. You then have this little sad content rattling around lonely there, so And this exercise should also give you an idea of all the images and assets you'll need to provide your designer and developer And most importantly this step is the step I've seen Most hold up the launch of a website Getting content can really delay the launch of your site and you want to be able to launch that as soon as possible A site can't launch without content. So Getting that together is a great first step The earlier you figure out what content you have and what you're gonna put on there the sooner your site can launch Also now it's okay to tweak it a little bit. It's okay to write something It's not permanent and adjust it, but just knowing like well It's gonna be about one paragraph. Maybe a sentence here or two will change. Maybe the wording will change It's okay. It doesn't have to be set in stone. It is the internet That's a great part as we can iterate but getting an idea for what's gonna be on each page is so important All right, so this is a sample content guide I made up here Very very basic. We have a page title What's gonna be on that page? This is an about us page. We have the content. So this is for a business So they and they're about us page.  I now know that we have one two three four four images a small paragraph and A few names and a call to action. I'm not gonna design a huge page for 10th paragraphs. I'm gonna make sure that this is shown off as we needed to and You know, it can still be flexible enough. We can add another person. We can take away a person We have a basic idea of what's going on here Okay So important question. What if I'm working with an agency?  You may be sitting here and saying I'm not a designer. I'm not a developer I'm having my site built and redesigned What good is this for me? Do I really need to know this isn't this their job? And I think the answer is yes or no and no It's kind of a combination a good web designer and developer. They're gonna do all of this process with you They're gonna walk you through at least several of these steps And you can hire someone to do all of this for you, but there's benefits huge benefits for giving it a first go around yourself first of all when you're trying to get quotes you're calling up agencies and You're trying to get an idea of how long your site will take how much it will cost You're gonna have a much better idea of the scope of your project when You know you can say I have seven pages and This is what's going on You're gonna be able to get a much more accurate quote and maybe it'll change maybe it'll be six Maybe it'll be eight with their recommendation.  So you're gonna be able to influence What as a designer I would be making up and say like I really know that this person comes in every day And I want to make sure this works for them Also having all this info allows your agency or designer to spend time making Recommendations to refine your site and use their expertise to make the site as best as possible with refinements Rather than spending lots of time on legwork There's a lot of time at an agency that can be spent getting down content and hunting it down and making edits and you know, maybe they make three or four design comps and It's they didn't even need that page So that's wasted money that you can save time and money by having more information about the product before they make something That we need to completely redo So they can focus exactly on what you need All right So I have I have not put my slides up anywhere yet But I'm going to add them my updated slides so you can download and I will tweet that out if you're on Twitter Here's the link to resources Also, oh, do you want me to go back to do you want a picture of that page? Yeah, and I just realized I talked really really fast this same presentation took 40 minutes last time So feel free to ask a lot of questions Does anyone have any questions I honestly just use like Google draw I Pen and paper is my favorite. I'm a big fan of pen and paper. I think with all the tools out there both with wire framing Drawing flows site maps the more you can keep it simple in the beginning the better it is it costs You know, there's lots of fancy apps which are great, but make sure you keep in mind I see this with my students and lot The tools are supposed to speed up your workflow not slow them down And if it takes too much time to learn and slow down your workflow, it's not worth it So that's why I say whiteboard pen and paper stick to the basics first and then If you find that maybe you're not a good writer or you have to give something to a client Then move into a program that will make it a little faster But if it's just for you go for the simple fast and cheap way Any other question Perfect has anyone done any of these sites steps before How have they as there been a time when you haven't done one and it's like Not gone well for your project or Has gone really well and saved your project. Yeah Yeah, go for it. Yeah, I would say so my favorite way to do it So this is hard if the business already exists it makes it a lot easier it is a lot harder for me when the business doesn't exist, but If you're working with a brick-and-mortar shop go in and interview the cuss their customers like, you know If it's a give away some free product to see if you can just ask them some questions and talk to who they're doing Talk to their cashiers. So the people that have regulars if they know your regulars names That's a great person to talk to you who are their regular like I worked at a cafe for years And we had one regular who we even had a button for because he ordered the same thing the every day Like you want to know those people who are coming in you want to talk to the people who are interfacing with the customers as much as possible Talk to the people if it's an online store who are getting the complaints every day on the phone Who's calling in what is their biggest complaint? You know what get that idea about them for online you have analytics, which is great and you can look at that And that should give you a good snapshot, but yeah, and then from there I use like unsplash.com is just a free photography site, and there's some others just grab a free photo and Then if like say you don't have the opportunity you're just using analytics See if you can find someone who fits that demographic So you have an analytics and you get someone in that demographic see if you can find someone who fits that demographic and talk to them What's their name like what do they do? Where do they like to look for other websites? What kind of things do they do there in their free time? Well, I will be here if anyone has any questions You can also Hit me up on Twitter or email And or find me after and I'll be happy to answer anything. Yeah


This one Bible verse changed my mind about God's presence, and I almost missed the liberating reality that it reveals. Once you understand this truth, your prayer life and walk with God will be completely transformed. I'll read the verse and then explain to you why it's so transformative. Don't you realize that your body is the temple of the Holy Spirit? Here's one of the reasons why this matters. Many believers think of God as though he is a million miles away. They imagine that the relationship with God is like climbing a ladder. Every mistake pushes you further and every good deed gets you closer. It's true that sin has consequences and can make it difficult for you to realize your connection with God. But the presence of God dwells in the believer. He can't get any closer than that. When you make a mistake, his presence faithfully abides and empowers you to live clean. He's not far, he's within you. Subscribe for more content like this.


The verse in the Qur'an in Surah Baqarah ayah number 187, which Allah Subhanahu Wa Ta-A'la says, So eat and drink until it becomes clear to you the difference between the white thread and the black thread. So there was a companion named Aideed Nuhattin, who kept a white thread and a black thread under his pillow, and he kept looking at them while all the lights were out in his house. And the minute he's able to distinguish between the two, he would stop eating and begin fasting. So that's how he interpreted the verse, because that's what it says. Khaytu al-Abyat, khaytu al-Aswadah, literally what it says. White thread, black thread, right? So he consulted the Prophet sallallahu alayhi sallam, and the Prophet sallallahu alayhi sallam said, no, that's not what the verse means. You don't have to look at two pieces of thread. He says that the thread is the darkness of the night or the whiteness of the day. So it's important to go to the sunnah in order to understand what the Qur'an is saying.


The results of this study suggest that there is no significant correlation between cardiovascular fitness and physical activity, or screen time in adolescence.


You're welcome back. I did say that today is we're going to be talking about something which is really important something that is killing some people, especially not especially killing the women and that is cervical cancer and so much is not said about it or rather so much of our population does not even know about it and how to go about it and we're very lucky that there is there seem to be a vaccine for that and Nigeria is on the verge of having that vaccine come to us. So we're glad now that we're going to be joined by Dr. Wango Bin Anthony who is a medical practitioner that will help us throw more light on what cervical cancer is and also Itoro Usoro, the change leader in Guruvoo Collective. Let me start by welcoming Governor Obinna to the program. I said Governor. Dr. Obinna, welcome to the program. Thank you so much. Okay, and Itoro, welcome to the program as well. Thank you for having me. Okay, we'll keep it short and simple because our time is fast spent. Let's begin with Dr. Give us an insight into what cervical cancer really is and the dangers that it poses to women for. Okay, so cervical cancer is the cancer of the cervix. And we will mention cervix. Cervix is part of the woman's uterus. We call it uterus or womb. So the lower segment of uterus has a lower part of it called the cervix. And this cervix is a lower part of uterus from where the baby passes through during delivery. So this part of the cervix, this part of the uterus called cervix is prone to cancer called cervical cancer. The upper part of the uterus, the womb has its own cancer, the endometrial cancer. But specifically today, we are talking about the cervical cancer, which is the cancer of this particular part of the uterus or womb called the cervical cancer.  And this human papillomavirus can be prevented. That's why we look at cervical cancer as a greater good disease, because it can be prevented. It's in Nigeria, low income countries, South Sahara, Africa, who have high records for cervical cancer. Because in the western countries, in developed countries, the vaccine is there, they are doing screening with these that call the body of cervical cancer to the nearest minimum. So cervical cancer, it's something that we must know about, just like you said in your introduction, most Nigerians don't know anything about cervical cancer. And that is why our foundation, HPV Women Campaign has been on the forefront to educate Nigerians on the need to know that there is cervical cancer. And that this cancer can be prevented. It's not like other cancers that you may not have control over. It can be prevented through vaccination, primary prevention, and it can also be prevented through screening, through secondary prevention, and then health education. So that's why we are here to talk about this cancer for people to be aware. You will be surprised that the recent survey done by our chairperson, Mr. Toro, at Abu-Jaziz, we discovered that out of 100 women, about less than 10, lose about cervical cancer. Less than 10, lose about cervical cancer. And this is a cancer that in the clinic, average cases of 2 to 3 cases, I see every day in clinic, 2 to 3 cases within a week, 2 to 3 cases. And those cases at that point, they have blue cancer, because any stages of this cancer, they are symptomatic. And because the cervix is hidden, you will not know what is going on there unless you're screening. So, but you begin to know that something is going on there when the cancer becomes symptomatic. And when it becomes symptomatic, you may present with bleeding from the vagina, or you may present with a mass from the cervix. And at this stage, it's already advanced and it's difficult to treat at this stage. The prognosis is poor at this stage. So that's why we are here talking about this, that if it's dictated early through screening, most of deaths can be prevented. And if young years are vaccinated, as early as between 9 to 15 years, it's still extended up to 6 years, most of this cancer can be prevented. Because this urban patruma virus that causes 99% of this cancer is seduary transmitted, is through seduary contact. So if we can get vaccine to prevent one from being infected by this human patruma virus, we can prevent more than 99% of the cervical cancer. Other ones from genetics, smoking, those are minima compared to the burden of human patruma virus, the burden of it as regards to the cause of cervical cancer. Thank you. I'll come back to you to tell us the nisigreti about the treatment and everything we need to know. But let me go to Itoro first of all now. Itoro, tell us your experience. We've just been told that you did advocacy, you did outreach, you did sensitization and you found out a lot of things. Give us an insight to how Nigerians react to this and how much awareness that they have on cervical cancer. Thank you sir. For two years now, I've actually been on awareness campaigns, education, mostly in low and middle income areas of the nation. And it's a surprise you to note that so many women, I can say 90% of the patients have at limit, they've not heard about it. They haven't heard about it before. And the 10% that have heard about this issue, less than 10% of that 10% have been screened. So they just know about this, but they do not go forward. Just like a project director, they'll probably not rightly say this is actually preventing through awareness because a face step is for the people to know that this issue is actually there. And secondly, they should be screened for persons who have passed the vaccination stage. And I'm happy that the federal government currently have ruled out a vaccination program because with the vaccination now, young girls will be vaccinated. And of course, the positive agent, which is the HPV, will be reduced and eliminated. And at the end of the day, the burden of these menace should be reduced in our nation. But why is the vaccination a thing now? Why they're saying Nigeria to introduce HPV vaccines to protect girls against cervical cancer? Why has it not been introduced before? Or if it has been introduced, why is it taking so much time to reach everybody? Okay, we have so many other vaccines in our national immunization program. Personally, when I lost my mom, because I actually lost my mom to this particular issue, which is what prompted and gave me the passion to run with this to see how I can prevent the pain and the heartbreaks and the vacuums in families. Okay, so when I researched and I saw that this was not actually part of our immunization program. Personally, in June 1st, through the change of platform, I was able to write a petition to federal government. And the petition is actually getting traction on so many signatures, actually on it. So I want to believe this has also been what has prompted the government because they've seen that so many persons are reacting and responding in this regard. But prior to this time, it was just discussions, you know, we had persons talk about this, we had the federal minister of health, they talked about this, they debated on it. But I'm excited that at this point, we are going to be having the vaccines. And this has really been my heart desire and I'm excited that that is happening. Okay, Doctor, let me come back to you. How dangerous, maybe it's a relevant question because we should know it's dangerous. But how dangerous is this cervical cancer so that the person hearing for the first time will know that something needs to be done promptly when the symptoms present themselves. Tell us how dangerous this cervical cancer is and what to look out for so that people can go for screening fast enough. Okay, just like every other cancer, the moment you hear cancer, I'm sure your guess will be as good as mine, that anything cancerous or cancer is a dangerous illness. But what makes cervical cancer peculiar is that in early stage, it's asymptomatic. Because that part of the organ I told you the cervix is hidden. It's right there in the upper part of the upper vagina, you can see the cervix, which is part of the uterus, the lower segment of uterus. So the location where it is, it's hidden. So if something is going on there, you will know. So it's asymptomatic when this cancer begins to proliferate and grow. It's asymptomatic. So you will not know what's going on there until when it becomes a full-blown cancer. When it becomes a full-blown cancer, that is when it becomes symptomatic. And that's why that is when you can identify something is going on in me. And they can present with bleeding of vagina, meaning you can see blood bleeding from the private parts from the vagina. Then you can also present with false smelling vagina discharge.  Then the cervix can be eroded with a max exfoliating mass. Most times the mass can even cover 2-3 of the vagina in advanced cases. And just like any other cancer doesn't limit itself at the site of lesion. There is metastasis to other organs. It can metastase to the liver. It can metastase to the brain. It can metastase to other parts of the body, lungs. So it's quite dangerous. So it's important that we know about this. Another important thing to... Sorry, I was just going to ask. If it is breast cancer, for instance, there are things that you can do in front of the mirror and find out if you have it without even waiting for symptoms to show and everything else. Is it also possible for cervical cancer to do a self-examination and find out whether it is there or not? It's not possible because the cervix, even for your finger to reach the cervix, where you put your finger through your vagina to reach the cervix, you can touch it but you won't know what it's doing on there, unless you can feel a mass. And when you're feeling a mass, mind you, it's already in advanced stage. So it's not possible. And that's the importance of screening. The only tool to identify what is going on there is screening. And that is why women of reproductive age, American Cancer Society recommend that women 25 to 65 years should do cervical cancer screening. It's only through screening you can identify what is going on there. What screening does, if you're nervous, you must get screened. And what screening does is to detect the pre-cancerous lesions. Those lesions that will expose you to cancer in the next 10 years, in the next 20 years because cervical cancer is not a day cancer. It doesn't come overnight. It takes years. And it's important to note, too, that this virus, human papillomavirus, that causes cervical cancer, we have one that is high and low, there are one that is high and low-grade types. It's high-risk type that can progress to cervical cancer. When you're affected by a low-risk type, it doesn't progress to cervical cancer. It can cause benign lesions. It's also important to note that this virus that causes cervical cancer, it doesn't cause cancer in individuals. Within two years, most of the human papillomavirus, even when you contract it, can spontaneously resolve. It's only the high-risk type that persists, the persistent infection that can transform into cancer. And this persistent infection, which are the high-risk type, type 16, type 18. These are, and others, these are major ones that can progress to cervical cancer. And so the tool for identifying what is going on there is screening. When you're screened, we have several methods of screening. In Nigeria, within the reach of the economy, most of the screening is done with either visual inspection with acidic acid, visual inspection with a Lugola iodine, then pap smear, and then you can proceed to do coposcoping, and then biopsy and histology. So in doing screening, if from the screening, using pap smear or visual inspection with iodine, if there is, if we dictate any precancerous religion, then treatment can be offered in what we call screen-and-treat approach. You can use, there are several methods of upgrading methods, like iotherapy, you can use to destroy the religion. Then if you screen, and you're negative to human-patruma virus, it's expected that you should screen every three years using this visual inspection acidic acid, pap smear, visual inspection with iodine. But if you're using human-patruma DNA testing, you're expected to screen every five years. The truth is that if you've been screening every three years, there is no way the cancer can come over, right? Okay. There is no way it can come over. Doctor, doctor, very simply now, all the things you're mentioning, it sounds like big grammar, and if it's big grammar, it means that it's going to be very expensive. That is the mentality of an average Nigerian. Is it affordable, the screening you're talking about? You know, I'm talking affordable, not from the point of a rich man, but affordable to the common man. The screening is affordable, but with the nature of Nigerian economy, even if we put up the screening to be 3,000, some people may not still be able to afford it. And that is why we, our NGO, Help The Woman campaign, has gone beyond taxing to do free cervical cancer screening. Three months ago, we organized free cervical cancer screening and we screened up to 100 women in collaboration with our partner hospital, Family Life Center, and VVF hospital, VVTAM, applying on stage. And we screened over 100 women, and most of them, I have the data which I may not share here, the one we discovered from them. So we have taken it as a point of duty to do free cervical cancer screening. For women, we may not afford it, because average screening, if at the current cost, average screening might cost, if you have to go through the entire issue, cost between 10,000 to 20,000, it's quite expensive for some people. But that's why we are working, we're also trying to partner with agencies, international agencies, government, so that this cervical screening we are doing, we can be able to have some funds to offer it to a large group of people, women. Our target is to screen at least one million women in Nigeria every year, at least one million every year. And by every screen, we target to screen 1,000 women, but they can be charged for them. Alright, a million women a year will amount to 200 years before, or at least 100 years before you can screen the whole of Nigerian women. So I do hope you get that partnership that will make every Nigerian to be screened, and every Nigerian woman to get the vaccination, the people who are still at that range. So let me come to Itoro quickly now, Itoro. What is the level of response like? I'm just putting two questions together. What's the level of response like from the people that you have been taking this awareness campaign to, and how close are we to getting this vaccine because we don't have a particular date that we know right now that this vaccine is going to come? Okay, for the people we actually reach out to, they are usually scared at first, but of course because of the strategies and approaches that we put in place, they start to reach out to them.  So we have several, you know, big thoughts, games, engaging them, you know, freebies, and ensuring that they are excited about what we're doing. So basically for what we've done for the past two years, I must say it's exciting. We see the excitement in the faces of the people, and we are happy about this issue.  Then for the vaccination, I want to thank the federal government for actually, you know, embracing this, though I think this is on a temporary basis, my petition actually acts the federal government to actually make it, you know, a permanent thing because when you go to primary health care facilities, mostly in remote areas, they really do not have anything to actually offer these particular services. So I'm still, you know, pleading and asking federal government and other agencies to actually make these available, affordable and accessible because this... Sorry. Okay, well, we lost the audio of Itoro there, but we were talking about the fact that this cancer vaccine is going to come up here in Nigeria. So we thank the government for that, and we thank your organization for doing what they are doing. We do hope that you get the right partnership to continue this good work and make sure the vaccines are available to all. Thank you, gentlemen, for coming on the show. Thank you. Well, that's the much we can take. I wish we had more time, but we are going to do a follow-up if we need to. But the code for the day today is health is a state of complete physical, mental and social well-being and not merely the absence of disease or infirmity. That is according to World Health Organization. So be sure that if you can say you're healthy, you will have health in mind and body. That's the much we can take this morning on the show. On behalf of the entire crew, my name is Nyam Gul at Gadji. Let's do it again tomorrow.