I will talk about the heights and error functions. So I choose the fault in the heights. And then during my lecture, we see that, I mean, almost all heights will be appeared. Even if you want to study fault in the heights, you have to study never tell the heights, because there's no way to study fault in the heights by itself. And because everything is a package. So the story of study heights and error function are more generally studied periods. And the special value of the error function is a long story. So it really starts from beginning, started from Euler's calculation Bernoulli number, then directly across the formula. In modern terminology, in a modern, in a resimated geometry, the story starts with an algebraic variety of rationales. And then you can do many things. You can study rational points, algebraic cycles. This is the algebraic thing you really want to do. But after a while, you will go to study their congruence, module P. Then you end up, you find that the study module P is much easier to study the variety of Qs itself. When you study module P, then you have a cohomology theory, left-shift fixed point theory. Then you end up with an object called error function. This error function, it's usually built up by Euler product. It's convergent when the real part of the S is sufficiently large by very conjecture. So these objects are purely combinatoric, beautiful combinatoric objects built up from congruence of algebraic equation. Then from other side, you have algebraic equations over original rationales. Then there's a nature of a cohomology theory to let you attach algebraic cycles to the cohomology class. So this is the level. But if you just do this level, that's the finish. Because not much of the thing you can do. This side purely algebraic, you have a cohomology class. You have to go to the next one. Next level, of course, you have to study these analytical objects in depth. So that's called Lagrange's program. You have to show these error functions. Actually, an analytic continued to whole plane. That's a miracle stuff that cannot be done purely by a congruence. Then I'll assume you're done of a Lagrange program. The next thing you want to do is that, well, I have a beautiful error function. What can I do? The next step is trying to relate your global objects to this thing.  This is a version of the Cernandine conjecture. And this is a Bloch-Bellinson conjecture. Bloch-Cuttle conjecture. There are many, many things. So these conjectures usually are very hard. Because you don't have many things to attach to that. So my lecture is just trying to give you a survey of very first kind of results. So I started with the fault in the height. Because recently the fault in the height has a relation with the error function. This is not a new story, but certainly a fun application to unreorder conjecture. But from my lecture, we see that I can start with any height. I mean, all these things looks like they're completely connected to each other. So my first lecture we'll survey what I'm going to do in the four lecture series. So start with the definition of fault in the height. So I will fix that G on a natural number. A number for the k, okay, the ring of integers. Then we'll start with the a of k, a billion-variety of dimension G. And an a of k, okay, a narrow model. So we assume that after a phase change, we know this sin is semi-stable. So that's what we assume. So assume it's semi-stable or semi-a billion. So that's, okay, then so there's the e-unique section. Then we define a bundle omega a equals two. There's a higher bundle and a base. So this is a bundle in the base. So in an elliptic curve case, that's a rational. That's usually the narrow differential. And we put a norm there. So I put a norm for each argument in place. The norm is reported as usual. Then there is a sum plus or minus. So I just write alpha, alpha bar, take up some value. You put a norm there. So in this way, this omega bar equals this omega with all these norms. We'll give you so-called matrix line bundle, Hermitian line bundle in G-less theory. So then you can define a degree. So the degree, so this is a sin. If it's normalized by k over q, so that is something called a fault in the height. And this degree is defined by, you can use a more elementary way to define that. So if alpha is a section, alpha not zero, you actually calculate the degree by a simple formula minus summation of log alpha v. So in particular, if you make a best change, so one thing I want to say that if you happen that your number field is class number one, then this will be generated by one element. Then you can forget about this thing. So basically this stuff. So then the most important property, I mean one property, I give you some remark is that the first thing, so this height is the variant and the best change. So that's why we need this assumption of the semibillion. So if the variant semibillion is the best change, of course, then that gives you that this height is basically the geometric height. So what does that mean? Mean that, okay, mean that is h. So this h is a modular, is a height in a modular space. Let me write S of G, the Ziegler modular of principally polarized, principally polarized variety. So what I mean that if you have this L of G to S of G universal family. Oh no, no, not principally polarized. So, okay, so because I don't really need it, just a stack. Forget about principally polarized business. So you have many copies of this modular stack. So you have this omega is the same thing. You have this unit section. So you can define omega to be E pullback G S of G and you can put a metric. I mean that is the same recipe. Then you should have 14th height of A P equals h omega above P for P is a point S of G of Q bar. So it's really a modular height. Then of course, then there's really a higher function. Higher function means that satisfy a so-called north card property. Right, so there the algebraic, I mean I believe the point and the space with a bounded height, bounded degree should be finite. So otherwise, there's no reason. And the most important property of this thing is not north card property. It's something called, it satisfies so-called the isogenic property. So it has a 14th height has a nice behavior, behave nicely, and then isogenic. So this is actually the most important property of 14th height. Then 14th uses the property to prove the Taylor's conjecture, Chavarouche conjecture and the Maudet conjecture. Otherwise you can't find many heights. You can always do that. There are many conjectures about the heights. I mean the first of all this sense, I just list some conjecture which has no way to prove. For example, I call it generalized Shapiro conjecture. You can say that, okay, so for any like 6 alpha G beta G a real number such as that, for any a billion variety, same a billion of dimension G as above, we have that the 14th height should be bounded alpha of G of degree there log n of a plus log discriminant of K plus beta of G. So this is a, I will not call it a conductor of A. So maybe there's a number of components or whatever.  Well, this is a very strong, so you can make it even stronger. So the stronger form, so you can, you can make alpha G equal G or not half plus epsilon. That's very strong for any of them bigger than zero. So I'll give you a remark. So first thing is that I made a Shapiro conjecture. This conjecture implies everything. So it's a really bizarre conjecture. So first of all, I'm giving you some ideas of the effective model of conjecture. So in particular ABC conjecture. Second thing, it implies no, no zero, no exceptional zero conjecture of Lando, I'm a Lando zero. And then I have a many thing. For example, it applies their effective bond on the imaginary quadratic number, imaginary quadratic field with the genius number one. What exactly does it mean? I mean, I could set epsilon equal to alpha G minus Q over two. I'd say bigger than zero, of course. Yeah, for any, okay. So I mean, when I make this conjecture, lots of things are important that of a function field of characteristic zero, so this actually is true. Otherwise, there's no reason to process conjecture. So this conjecture is called host. And it usually is called, I write a theorem. So this is a code, usually we call RK of photons inequality. So there, maybe the last part I should write the names, host, view week, and zoo. They find a theorem like that. So if let A over B be a family of semi, a billion variety over a smooth projective curve of a complex number, then we have the following. The degree of omega A over B normalized by G, then less than one and a half degree over B omega B1 of S. So this S is a, okay, so S is a, it's a padlock flux. So that is one and a half twice G over B minus two plus number of S. So that is the most general conjecture. It's true, and this bond is a shell. So this is a very general conjecture we can imagine by this general story. So this is approved by Hartz theory. Okay, so this is something we are not, I mean, we're not talking about this conjecture, this series of lectures. There, the reason we don't talk about that, so there's a fault in the height in the, in the, for the family of being a variety of complex numbers is more or less, is the cohomology variant. You can read this thing from cohomology, from Hartz theory as a thing. But our number of fields is not, you cannot read them from, from the Hartz theory. In particular, the acumen part of fault in the height, we have no idea how to fit in the cohomology. Right, so that's the one difficulty to put there. And that's a, this, this fault in the height and the fitting cohomology probably is the first notice by Manin, it is a proof of a model conjecture. So that's why we call the Gauss-Mannin connection. So it's actually the first time it's appeared because he's attempted to prove this conjecture. They could be figured out disease variants actually can fit in cohomology very well. But in number 50 case, we don't know. We have no idea about fault in the height in the cohomology, because all cohomology is a periodic cohomology and these are real numbers. So we have no idea how to make a connection between real numbers and a periodic cohomology. And of course, the reason that there is a, a non-stop proof of Moczuzuki and the one thing I, for example, I could not understand how do you get a real numbers from cohomology, my P. And in his case, he actually proved, studied the P torsion points of the elliptic curve. So it's a pretty difficult thing for us. Well, there's no cohomology theory. So this lecture I want to do is using the modularity of error function, trying to compute the fault in the height for very special class Abelian variety called CM Abelian Varities. For CM Abelian Varities, the calculation is slightly easier. And from spiritual conjecture point of view, it's kind of funny because there's no battery reduction anymore. But the conjecture I, I stated here, still very difficult conjecture. It implies very strong consequence on error functions. So even in that special case, there are, there are many interesting things we meant to do that. So I'll talk about CM Abelian Varities. So maybe if you take a note, that's a, that is a 1.1 to 1.2. So CM Abelian Varities is slightly easy. So E is the same field, okay, the same field. So this means that there is a, there is E plus totally real. So I usually write F and the E over E plus the imaginary, totally imaginary quadratic. So what I'm trying to say is, okay, totally real, you know what that means. So E will be equal to E plus square root of alpha. Alpha is negative at every place. So typically, in this case, we can talk about the CM type. The simplest way to see the same type is your E, terms of Q or real number. We know this is the copies of complex numbers. So you just fix a copy. So the phi is isomorphism to C to the G, okay. So their degree of E equal to G. So then we say Abelian Varities L over C is of CM type of phi. If their A has action by E, such that the induced action of E on a lee algebra is given by type like that. So very concretely, really mean A is isomorphic to C to the G phi, well, is a lattice or one there. So the lambda of E is a Z lattice, right. So we say that CM of type say not only phi, but OE over phi. In this case, if lambda is actually the idea of OE, then A is of type OE and phi. So that's basically we require A has action by O of E. So that's the simple thing. You can do that. So when I start this kind of variety, the variety is simple enough, because you can write down complex uniformization so explicitly. And by the other hand, it has a very nice algebraic property. So by Shimura Tanayama, Tanayama. So this A has a model A of K of a subfield, a number field, K inside C. And such that A of O of K has a good reduction everywhere, has no better reduction. So in other words, the narrow model is a completely abelian scheme. So we can define, so we can define the fault in the height equals H A of K. And so I mean, so this thing is well defined. So we can define, so we can H of K. So we just define a number. And there are some miracle things. It's not very hard. So by Komei's, there's some calculation. So H of K depends only on phi. See, the same time that I write a beginning, that's the only thing you get. So we can write H of phi. Well, for each same time, we get a complex number, real number. Not bad thing. So Komei's conjecture, we're not talking just precisely, trying to understand this number. So at the end, he figured out that they're collection all these numbers, all these same types. Actually, and a collection of the logarithm of our function of the same type. There are two sets, actually, that mutually express to each other. So for, so this is one, this is called a Komei's conjecture. I will come to the later, this is a point later. But right now, I want to continue this conjecture already before. So in this case, for example, they generalized the conjecture for L over phi. So implies the following very bizarre property. H of photons phi is less equal than epsilon g over 2 plus epsilon log discriminant of K K over Q. And this conjecture is widely open, even for elliptic curve. We don't know how to prove it. So I just give you an example. So let's try to try to start it. So now I assume, so let's the g equals 1, so A is the elliptic curve. Then in this case, the photons high actually can be computed. So there is a theorem by Lurch and Chola-Selberg. So Lurch proved the whole theorem already in 1897, but it's just covered by other two people in 1940, I guess, 41. So 1941. So they re-proved the theorem. The long time we don't know, this is already proved by Chola-Selberg. They call it the Chola-Selberg formula, but actually really proved by Lurch. So they actually found the formula to calculate this thing. So what they prove is the following. The H photons of A, in this case, is one-and-a-half of L prime of eta of d. I use eta of d0 minus one-quarter log of d. So this eta of d, in my lecture, is just around the symbol. So eta of n, this is just the, just the, so eta of ds is just a delta function of q squared of d, or I have not yet read anything. So, yes, so A equals c, yeah, of qz plus one-and-a-half of d squared of negative d. So d is the fundamental discriminant, and all of the delta function, just the simple error function you get. So d is less than zero fundamental discriminant. What? Is this just A over q? A over q, I should tell you. No, A may not be defined over q. No, no, no, it's cm. cm, elliptic curve. Okay, so any sense of, okay, so the, the, the, the genres in, or the projectiles? Yeah, this is over q, the quadratic symbol. Yeah. So in this case, the Spir-Kanjen implies, so I have to say generalize Spir-Kanjen. Spir never made this conjecture. He only, he doesn't care about Akemen place. If you don't know Akemen place, that's a discriminant. It doesn't make sense. That's actually called homology variance. But the funny thing is, as I said that, if you talk about a conjecture, you have to make the Akemen place to be inside, right? Because otherwise, you will not understand the whole picture. So this Kanjen implies that, so L prime of chi over d of one equals O log over d. So this implies no, or random, z equals zero. So even this Kanjen implies that. Okay, so, so this is the only thing we know how to calculate the fault in the height for elliptic curve. That's something to do. So, so what the main purpose of lecture is trying to generalize this alert, charlotte-sebel formula, there are, so we will give two, two generalizations. So the first, the replace, I mean, first to, first for, to the height dimension. So first is the average, the compute average of H of phi sigma phi for fixed CM type, fixed E. And then, well, for elliptic curve, there's only two of them, but there's a conjugate to each other, actually the same thing. The second thing is, calculate, I mean, presumably the height on Schmura curve. So because Schmura, as I said that if you, for a elliptic curve case, you know, the compute fault is a height, the same thing to compute the height of CM point, a modular curve. Then you're trying to generalize it and a Schmura curve. Then you say, well, I mean, what is the point? If you're done for modular curve, you can done for Schmura curve. Actually, it's not that easy. Next lecture, I will tell you that how do they prove Lercher and Charles Sabre formula. This formula is proved. The crucial factor used is that these existences of data can add a function that explicit section of modular forms. They use this modular form to compute the height. And on Schmura curve and a Ziegler modular space, the reason we don't know how to calculate, we don't have any explicit modular form there. So how do you calculate the same if you don't know the section of line bundle? Because you'll compute zero in the poles of the boundary. You don't have this thing. So then I will show you how to do that. In Schmura curve, you want compute height without using a section. But you have to use something else. This thing, use the Hecker operators. And using the first of all, there's a fault in the height and a modular curve in particular. It's a section. And if you replace this omega, the heart boundary by twice of that, it will be the boundary of differentials. So you'll calculate the height of a point with respect to differentials, canonical boundary, basically, and a reasonable variety. So by adjunct formula, there will be a safety section with a section. The safety section, we don't know. I mean, you use the modular form to move the way. But in the modular world, besides using modular form, we can use a Hecker operator. We can replace section by its Hecker operator. We can move it away. Of course, then the difficulty is how do you get it back? You can move a section, move away. So that's the whole business. Once you start using Hecker operators, then you find, well, I can compute many things. I can compute a section between one Cm point and Hecker, all bit of other things. After this is done, not only prove Charles Everford me, also prove Gould's idea for me. So this work somehow is already done, like a few years, I mean, 2008, when we finished this Gorazaga formula at Shimura Curve. So that's the letter story. So right now, I'm trying to study the two theorems. Okay, so let me try to study the two theorems. So the theorem, I will state this one. So the fix. So this theorem is approved by so-called average, Koume's conjecture. So it's approved by two group of people. One is Yuan, myself. So Yuan actually is done 2008 by the second formula. Then last year, I relied the second formula in plus the first one. So this is 2008 to 2015. So something's done a long time. We put it in there. We put it somewhere never, because we have no idea what is formula is useful. Then there's another group. Another group is called Andrietta, Howard, Goran, and Mother Pussy, Pera. And this group actually has two subgroups. So they, two subgroups that work together, then they met together, they found that they work complement to each other, put it together, they get everything. So it's a funny sense. So I mean, it's two big groups, each group has two subgroups. So they're all, that makes the life very difficult. So I'm not really sure anybody really understands whole proof. Right? Okay, the theorem is very simple. So two to the g, h of phi for all phi will be one-half L prime of eight, e of f, zero, L prime, L e of f, zero, minus one-half log, discriminant of e, discriminant of f. Okay, this theorem is very interesting at this point. I'm not only from this, this high point of view, even for error function, it's very interesting because this thing is what? This is the class number, basically. This is actually equal to the two to the a of class number, e of f divided by, so maybe w, something like that. The rule number is a very simple number. It's a rational number. So this formula somehow give you the second term of the error function. So this is the first term, it's actually proved by HEC, using evaluation of Austin-Stan theory, at the same point, the Hilbert module of variety. Right? You evaluate, you get a zeta function. Then you let, you copy the residue, you get the formula. So then, of course, I mean, in the number field case, the f is the q, that's the derivative formula, derivative formula computed by hand. So this formula somehow give you the first derivative.  That's something miracle, but we don't have no idea how to do that of a number field. So before I continue to talk about a Shimura curve case, then I will give you a rough idea why this thing is interesting, because this is under order conjecture. So I will talk about consequences and the consequences. So the first set of this thing is, so this after, first thing is under order. It's after Taylor Zimmerman built on the ideas of many people. I think I did the whole thing the first time, and the Klingler, Yaffev, Emmanuel, and many other people. So somehow there is a very surprising consequences. As I said, after the Shimura conjecture there, Shimura conjecture cannot be approved. You actually can't do backward thing. You're trying to see how energy number theory give us the result. The first thing is that this A, so for energy number theory, you actually can show that this is bounded by just Klingler's epsilon, for any epsilon bigger than theorem. So you compare with the conjecture by Shapiro, there's a far away, because that's a log of data. This is just a power. The second thing is that the degree of K, well, so if A of K has a good reduction everywhere, then this actually is bigger than data of E, some precise number, rho over g, rho over g is bigger than zero. And I think Emmanuel, you wrote some paper like that, right? Did you write some paper with some? Somehow I remember you wrote something about the Ziegler-Brouw type theorem. So there's a Ziegler, so this is, you can compare with a conjecture by Ziegler-Brouw, Brouw-Ziegler type conjecture by, and he wrote something, actually you can find out that supposedly what's the best bound should be, but at least I give you a bound. And there are, the first inequality is purely by using an energy number theory, the other side is error function. From first one to second one is kind of surprising. You have to use, you have to use, called the Wussel theorem, with the muscle Wussel theorem. So muscle Wussel simply says that the degree K on a height of five cannot be boldly too small. One of them must be big, but the first one says the height is small, the degree must be big. Right, so that's a, that's a nice thing. From these two, then you apply on this, the strategy of Pilar Zanier, when they approve their, when they approve their new proven many-man for conjecture, use all minimality, basically the same strategy. Now they become bigger in industry right now. So this one, if we give you the energy order conjecture. So it's nice, I mean of course, when I said this, each one of them, I'm from A, from B to C, you have a, you need a, it's a very long thing, you have to. So, but I write the theorem, say, if X of S of G, the irreducible sub-variety of a complex number, such as that X has a characteristic dense subset of same points, then X is basically, is a special sub-variety, maybe writing more presents is a Schumerer sub-variety. Yeah, we don't have such a terminology, but that's different because we've got special sub-variety. There's a first kind of application. The second kind of application is even more something, you're getting back to arithmetic. So the recently I just, quote some result I heard from a conference. So then it's a, it's a back to elliptic curves, application to elliptic curves to BSD type problem. I mean, it's not really to BSD. So this is some theorem proved by, so this theorem proved by, by Burr, Rogen Dell, and Chen, the Boudin's idea of HIDA, they use, and we already conducted to show that for any elliptic curve E over Q and any positive number, there are only finitely many CM points, CM imagine a quadratic extension, K over Q, such that the following two things are true. The first thing is that the error function EK of S has odd sign. Okay, they have odd sign. Second thing is that E, the rank, E over HK, the Hilbert-Costfield is less than M. So basically the elliptic curve over the imaginary quadratic field, the rank should go to infinity. I mean, nothing surprise, but this is really proved by a clever use of Android auto conjecture. So the Android auto conjecture is about, is about the density of points, but somehow they can use this thing to show some PIDA function in non-vanish, the proved error function, they can point the non-trivial. So that's a very nice way, but that's just the initial application. I guess, I mean, the next few years, they probably can prove much more theorem, so they already have a few more theorems. This should be ready in a few weeks. Okay, so this is the one thing. Okay, so now I talk about the second, oh, that's something that you put here, third part and about a UN theorem, the same points Schumerer curves. So this is the second generalization of Chola-Celber formula. So I just make a comparison between modular curve and Schumerer curve. So the result is pretty straightforward.  So let Sigma be a finite set of places of F with outer cardinality. From these two data, you will get, so from these two data, you will get a pro Schumerer curve. Okay, so it really means that it's X, X of U, I mean, this is a real Schumerer curve of F.  So idea is the following. Idea is that for each V divided by infinity, this X of V has its own explicit uniformization by alpha plane. I'll give you the following. So the process is the following. The first thing I want to define in the V to be the Potemnian, algebra of F, with the wrong implication set, Sigma, take V out. So that's why I mean that it's Sigma to be out. Take V out, then become even. Then for U, well, so then this is the sense of the B, the real numbers, will you look like M2 or real numbers? So if you fix such isomorphism, so of course, then the B cross will X on alpha plane plus or minus, right? You know, you can. So plus or minus is C, take the real thing out. Then you have, so I write this Q H, you call the Q tends to Z H, right? Z H will be limit of Z of N Z. So the final address, so for, so this is, so you have these, these, okay, the B H, whatever the B tends to Z H. Anyway, so this is, so this, so this is just a locally compact group, right? The topologically compact. So for U inside B H, suppose open compact, then you can get a variety.  So this, this one acts on both. So maybe write this way is better. So this one acts on this one acts on this one. So this actually is a final union of H by gamma I. So the final union, some, some final union. So I mean the way I write this thing, the, the reason is I want to make sure that X U is actually defined as F. And X U defined as F actually is connected. So that's only, it's not geometric connected, but it's connected, right? So that's the way you do that. If you write this way, the price you pay is the initial component will not be defined over F anymore, right? Define some i billion extension of F. So I'll give you some example about this thing. So, so let F equals Q sigma is infinity, just one secrete. Then this X is nothing, X just X of 1 is just a usual modular curve. Okay, so that's the one thing you get. So write example. So and then if F equals Q for arbitrary sigma, sigma is not, then X is a, is a modular, it's called usually a modular or abelian surface with action by O over B. So there's a B in definite quaternion, definite quaternion, or bromefician state, sigma taking infinity out. So that's why, and I, when usually you talk about the quaternion algebra over rationales, you never think about the sigma as outer set because you have only one infinity place, right? But when you talk to a real number field, it's because there's so many acumenian place. You have to be really careful which uniformization you talk about it. Then miraculously, the, the so-called conjugation, the conjugation all of this similar curve defined by different places actually, they conjugate to each other. So this is why we use the outer set of sigma. It's, it's a much more convenient way to do that. And this one second thing is that over total real number field, your sigma curve does not have a modular interpretation. So simple, right? So here it's just a miracle. Over Q, you can uniformize your sigma curve by this thing, it's called a PR type. And not only that, this is a, this is actually compact. The fact is that, so X is a, is a proper if sigma is a cardinality, if F not equal Q, or sigma is not equal to infinity. So only one case, this is a non-compact curve, or other case compact. So that's actually makes the proof of Chola-Sever formula difficult because that's the only one case you can prove by explicit calculation. All other cases, you have to find some clever tricks to do that. Okay, so, so what did you do is that, so in this case, we have, we can, we can, we can take the omega bar square equals this omega X of the one, we define a metric there, and we can normalize the metric DZ, this norm at a place V, right? I mean, equal to twice of Y, so that's explicit. So I mean, the first, I came in place, you have uniformization like that, so you can give a metric there. So there's one thing, second thing that we can define, so if E is embedded to B, then, then we can define, then you have, you can define a point, you can define a so-called CM point P inside X. So this, because we have a pro curve, there's a pro curve has a beautiful thing, and usually for number theory, they don't use a pro curve, they use one modular curve there, is a Hecker operators. But once you have a lot of group involved, it's better to use a pro curve, because the group action is more convenient than Hecker action. So here you have action by Hecker operators as a correspondence, right? Here you have action by, actually can have action by this B-head cross, you have action by group, right? So, so that's a, since action by group, then we can talk about this thing, the fixed point of a U cross. So this is a pro set, pro scheme of F of dimension zero, and this one has a diagonal action by E by Galois group of EAB over Q, actually the single orbit inside, there's a CM, this actually is a one orbit, they pick up P inside, then you can compute, so this is called a CM point, you can compute this height. So the theorem I'm going to describe our UN theorem is as follows, the theorem proposed by UN 2008, and so it's a, assume, assume there that at least two place of F are ramified, B, so in other words, yeah, B, so, so I mean, so what is two finite place, right? That makes sense, is that correct? I don't know finite or maybe, okay, that's funny thing, that just means the sigma is not infinity, that's pretty stupid, right? Second thing is the no places, no places of F is ramified in both, no finite places, is ramified in both B and E, then here's the explicit formula, the height of the CM point is equal to negative one-half L prime at zero, L eta zero minus one-quarter log of E of F, that plus one-quarter log discriminant of B, okay? So you have this theorem, if we compare the theorem we have before, the only one thing is something extra here, everything else is the most same. Is it a particular case of general climate conjecture or general climate conjecture, what derivatives of that functions? No, yeah, I mean, my, you will see my next lecture, next one is the most interesting part, so far as purely, so next one, top of function field, you will see the basic sin, imaginal conjecture about the first derivative? No, about logarithm derivative is zero for alternate functions. Oh, that's the comb as conjecture. Is it a particular case? Is it a particular case? Not approved yet. Okay, so this is sin, so what's left? Oh, my lecture is very fast, so what's left? I will talk about a function field arithmetic, so because function field case we can prove much more, function field case. So this is the work by Drewey Wynne and Wei Zhang, and the name is very confusing, so this is Yuan, this is Wynne, this is Zhang, and this is Zhang. Okay, so the relation is that these three guys are classmates to each other, so that Wynne and this Zhang is my student, so it's very confusing, so if I forget, if I write Zhang here, that means not myself, it means Wei Zhang. Anything I write there, if I could mistakenly write Yuan, Yuan actually means Wynne, so that's it, so by Chinese name only use three letters, X, Y, Z, no more than that. But this guy is in Yale, he was in Stanford before, this guy in Columbia, I was in Columbia before, so it's pretty much confused, but that guy is in Berkeley. So I will talk about function field case, in function field case we can prove much more, so let FQ, let X of FQ be smooth, geometrically connected, curve, a proper curve, okay, FQ means the field of finite field of with Q elements. So I even write something smaller, maybe it's probably not important, I usually write K of FQ of X, and I will fix R at the even, the even an integer, I write a bigger K to be FQ of XR the power, so that's already very interesting, so I'm talking about doing arithmetic of a field which is not, this is a typical function field we're working on, and in this lecture was a remain, I will talk about arithmetic of this function field. So there, okay, so maybe the question I want to ask is the following, so before doing that, well, so the question, so we may ask that does there exist a formula for R's derivative of at a zero in number field case, right, R equals zero is the class number formula, R equals one, I should write down the blackboard and try to say about formula, right, and what about any R, the answer is yes, so yes over function field, okay, I should answer this question before I write this stuff, so I only will work on, or R is even, and I will some assumption in the text, first of all R is even, and so far, I mean right now, R even E of F, sorry, maybe you, sorry, I needed to get him back, this is, because I needed to use same notation there, write this F there, write this FR, sorry, so E of F is eta, I think that right now they're working on the case, non-eta, they still can do that, but the paper on the car is still an eta case, right, quadratic, yeah, yeah, still quadratic, I know that they're working on, on arting error function as well, arting error function in number field is very hard to work, because we don't know the module or not, in function of the case, they're modular by, by, like, like the conjecture of the LaFox, like, like the conjecture, so the idea is that they, idea that this R, eta zero is simply the height of, so the, the, the, the main result is the so-called the Trimfield-Heaton cycle on the moduli of Stuka, with R-legs, in a French code of powers, right, so I will, this is why I'm going to describe in the, in the, in the rest of my lecture, so this is the main result, so I give you some definition, so let S of XR be a scheme, oh yeah, let's be a XR scheme, so this really means that, okay, this is what it really means, that S is a scheme of f of q with some points, Xi, S goes to X, right, so some, some, some points, are from 1 to R, so RGLN Stuka, let me write a name called on S, is a diagram of morphisms, so I'm right down there, I need more space to write on the Stuka, so it's a 0, 1 of R over 2, then change the direction R over 2 plus 1 of R, okay, oh yeah, so last one is interesting, you need to be, this one is isomorphic to the original one of Toder, so where epsilon i is a vector bundle over X cross S, okay, the vector bundle, and the second thing, this EI over EI minus 1, when I less than R over 2, and EI of EI plus 1, when I the bigger than R over 2, this R of the form gamma i push forward of line bundles, so the gamma i is S goes to, I already have X there, X cross S, so there's a graph of Xi, Li of S is a line bundle, so it's basically, if you think about it, it's a, if you forget about all the middle stage, it's just that this E0 and E0 conjugate, okay, I need to write down the last part, so E0 tau is the one, the Frobenius S pullback of E0, so this is a morphism basically, so the Stuka roughly speaking is a vector bundle plus a conjugation isomorphism, so why I do that, so there's a lot of modification in the middle with some modifications, okay, so so let SHMR denote the the modular stack of GRN stickers, I will give you some example. E1 over E0, what E minus 1 is? Oh, I from 1, yeah, okay, and E0 is a drunk one, I don't get it, E0 is E0, so E1 of this N? E0 of drunk, yeah, yeah, what is the rank of E0? Oh, rank N, yeah, sorry, otherwise that's called GRN, for absolute G you can be read by G bundles, all the same ranks, yeah, I'll give you some example, otherwise you will not get anything more than that, I'll give you two extreme example, one is say suppose I don't have any legs, right, say example, so suppose my R equals 0, no leg at all, right, no leg at all, what do I mean, so this is basically a vector bundle E0 isomorphic to E0 tau, I mean this data actually descent, right, so this actually implies E0 is defined over FQ, you don't have anything else, so there's a stuka of N, 0 of FQ is actually the vector bundles over X of rank because N, right, it's just a set of vector bundles and we can, this is a curve, we can write a vector bundle clearly, how do you write it? We fix isomorphism at the generic fiber becomes, become vector space of F, that vector bundle becomes, sorry, promenius S means the arithmetic promenius, yes, yeah, so this S is X, good XQ on S, on S part, the second part, what? It doesn't really matter, right, so here, I didn't check that, I resumed a geometric, I don't know, I think a probably geometric, you know, yeah, so if your rod is done, then this is equal to gRN of F of gRN of AF gRN of O, right, so O, yeah, it's just the OAF, right, so this is usually as an automorphic set that we work in a modular form, so this gives you an idea that RLX is the generalization of their usual thing, what kind, so this is the one example, so this is not so interesting, it's interesting in automorphic forms, but not interesting in geometry, it's just zero dimension space, well, this is the course, and maybe I give a simple proof, right, and that's pretty simple, so if you give you g inside gRN of AF, then you define what you're going to do, you will define a vector bundle of the shift on F, this is the shift, right, this is the shift on X, so inside of the shift you have two sub-shifts, you have FN inside, right, you have this shift, you also have O, ON, right, it's a sub-shift there, then you use g to X on this thing, I don't know, it's the left or right, maybe g of O of N inside of there, right, you get this sub-shift there, the intersection, so you do intersection g of ON, ON there, this is the vector bundle you want to construct, okay, right, you get this is the vector bundle, I probably, this O will be, how can I do, maybe I put something here, this O is not structure shift, so this is nothing, it's just a product OOP, OX, X inside of X, okay, maybe write OA, okay, so this is OAN, OAN, right, it doesn't make sense, it's just some shift, you know, right, okay, this is the one example, the second example gives you a flavor of why this construction is interesting, so I will write on R equals one, no, N equals one, just to see what we get, when N equals one, then all these things are line bundles, right, all things are line bundles, then, so this difference is given by devices, right, so we can write R i equals E i are line bundles, so then in particular, we have that R i equals R i minus one of D i, right, if i is less than r over two, big, greater than one, R i equals R i minus one, negative D i, if i is bigger than r over two, then less than r, we have such a thing, right, so, so there, the last there, last there isomorphism, so this E r of E zero of tau, it becomes the following, becomes L zero summation of D i, i less than r over two minus D i, i bigger than r over two, isomorphic to L zero of tau, right, I didn't say same D i, for each i, i change here, yes, I write this thing, all I can write on in a different form, we will get, so that's the only equation we have, of a bunch of devices plus the equation, so if we write on the better way, it's L zero of tau L zero inverse isomorphic to O x of D i, i less than r over two, D i, i bigger than r over two, okay, so we have this equation, so the stuka, you can say stuka of zero of one R is basically like that, all L zeros in a pick of x with this equation, so let me write this equation in a in a diagram, maybe better way, so you have a pick of x map to pick zero of x, so this is L called tau minus one, so L goes to L tau, L inverse, right, and we have an equation from x of R go there, so this basically is a device they get, x i goes to sigma x i, i less than r minus sigma x i, i bigger than r, r over two, right, you can get this equation, so this is the Cartesian product, this actually is the stuka of one bundles with R modification, right, of this thing, so this is basically the Cartesian product, but the kernel from here to here is well known, here to here is the line bundles with a fixed bifurve varnish, it's nothing else, so this is just a pick of x of fq, so this actually is a group, is a group of rank one, right, the finite group plus the group of degree one, right, so this gives you an idea that of one rt, I mean, okay, one r is a pick x of fq tau sir over xr, so it's very interesting, so this is the attack cover of this morphism, this scheme which is a precise group, so they give you a very precise risk-prosy law, you're trying to construct it, right, so that's why this whole thing is very interesting, so even when rank one case already gave you a very nice construction risk-prosy law, so we, there are a couple of theorems, I'm going to describe this, this thing, this modular stuka, so I write on the basic theorem like that, the theorem, so it's given by Grunfeld, one r equals two, Walshowski in general, is that the first thing is let me say, the morphism sht or the nr is a delimene for stack with stratification, with stratification, stratification, okay, the bi-stability, right, because that of stacks of finite type, so you are talking about vector of bounders, the vector of bounders, usually the modular vector of bounders cannot be finite type, but you can put a stability, then they make the union of this in there, the second thing is the morphism of stuka to xr is smooth, separated, I mean the separated smooth, whatever, of relative dimension equals, I mean flat, flat smooth, relative dimension is, I guess, is r times n minus one, and let me try to see the correct, or n times r minus one, and yeah, n equals one is that, it's correct, right, just check, I mean one of the, one is minus one, I don't know which one it is, yes, I mean the total, so in other words, the total dimension of this stuka is r times n, base is r dimensional, this one's pretty reasonable, right, the relative dimension, so the dimension of stuka n of r is rn, so that's basically what does it mean, the dimension of fq, okay, so when, so now I write g equals pjrn, right, I mean then you can define the stuka of the gr to be stuka of nr, your module is a group, we are action there, so I have to define action, pick of xfq, so what I really mean there, okay, so the action, when we define stuka, we have these vector bundles, we can tense all the vector bundles by a line bundle, so we have the pick, so if you, if the pick xx on by the, by the very simple way, if you have e, this stuka, you have a line bundle, then I just give you, I mean the ei turns l, right, of i's, so that's just the simple action, but my line bundle is defined as fq, so in the last step, I have a Frobenius action as a trivial, so that's the way you can do that, and then quoted by this group that I called the stuka for g, but I think as I said that actually, by Weiszowski, you can define the module stuka for any relative gruji, right, as a g bundle, finally, I will respect it at the n equals, n equals two, so now we'll respect it n equals two, and then we have a morphism like that, we have a morphism from stuka of one r, but here I over, over e, remember I have of f equals fq of x, e of f, the quadratic extension is eta, right, is eta, so e equals fq of some y, so the y has a morphism to x, this is eta cover, actually I don't really add top here, so I have, so this will be, I just put e there really means that I consider stuka over e, the rank one line bundles, this has a morphism to stuka two, well f there of r, but if you have a line bundles goes to, suppose I have a morphism, I write a new there, new push forward of l, right, so this equal to, this is, so we have this r0, r1, rr, I sum up the r0 of tau there, so I just go there, I push forward on my line bundle, this one get the line bundle, r0, v0, r0 of tau, so I get from rank one stuka, just some misprint second stuka over 2f, 2f, yes, so I get a one stuka rank one, get a stuka rank two, right, so I quote it by pick xfq, right, so as I said this actually is a really trivial stuka, right, this actually stuka rank zero, I mean rank one with zero lack, if you remember that, that's actually like that, right, and we get a morphism stuka of t of r, I will write down there, go to stuka of g of r, so this g is pjr2, this t is, well, is zero one of e quarter by zero one of f, right, this is tolerance, so this can be in many inside there, so I write a theta this thing, right, but if you want to record it there, where's the base there, so I write the base there clearly, let me rewrite this thing there, so this sht of r sht of g of r, so this has a base x of r, this is y of r, so this is eta, right, is a torsor, right, is a torsor is pick of y of fq over pick of xfq, so this actually is a finite eta cover, right, and this is, this is something like that, and because this is the reason I take the fiber product, so I get a morphism as gr goes to, of gr x of r y of r, so I get an embedding there, this is actually the embedding, so let's, let's for simplicity, this is the scheme I'm going to work on, I write as m, this scheme I work on as n, right, so I get a modular stack, so I just give you some idea, so the m dimension of m equals 2r, dimension n equals r, and this m is now by no way compact, as I said that because the vector bundle you need this different stability, but as n is a compact, because there's just line bundles, right, so this n defined across a char group of r with compact support of m, okay, is a compact support, with a compact support of n itself with a compact, so we defined this class there, okay, so you can define a self-injection, so there's a self-injection that we defined, so we can define, so this, so we can definition where I define a fault in the height, if you like it in the fault in the height, I mean how many ways to define it, it basically defines the r-the-tron class, you remember when we defined the fault in the height, we defined the first-tron class relative bundle, there's r-the-tron class omega of m over yr of n, and this, this omega right down is because at times, okay, so it's a basic self-injection, I don't know the plus or minus the self-injection of m, right, you could define this number, so you get it, you get something in the integer, oh maybe Russian number, since I will talk about stack, so it's a Russian number, you get a way to define a number there, so the theorem is a divided by yin and a jian, so this w-jian is a 2015 is that the target is number, the fault in the height equals to a very precise number, 2 to the r plus 2 log of q to the r of the power of r's derivative of eta e of f at zero, and log of q here is pretty normal because I give you one, something that's the error eta e of f, s is a polynomial of q to the s, q to the negative s, I forgot what degree of degree, four times g minus one, maybe something like that, so when you take a derivative, you will have log of q, r's derivative get log of q there, so it's pretty normal you get this in there, so in fact the like, let's try to say the remark is like the yin theorem, so this formula is approved as a by-product of the proof of a Grusage formula of Haier, something maybe Christophe will like it, then Christophe Soleil, you will like it that some students they are trying to work on this thing using Riemann-Rach, so this Chao Li that he told me, he tried to re-prove it using Grusage-Riemann-Rach because that's something you want, you're trying to push for many years, so now they're working on this kind of thing for Attinger function, so I don't know what the story exactly is, okay, so this gives you a hope that there, maybe there's a geometry interpretation of the Haier derivative of Attinger function, other error function with something we don't know, right, because you need to have some field of one element, f1 there, once you have f1 we have this thing, right, so but the same, I probably can do it for the same group, some co homo, because this thing after all is the same stuff, okay, so I want to conclude this first lecture by asking some questions, we're not, I'm not going to talk about it, because I think Zhiyun and Zhang will raise some questions about arithmetic, we always work on arithmetic of a number field over function field, but there are, there are projects over arithmetic of a Haier base, so I just want to raise some questions about a function field arithmetic, right, so it's a arithmetic over x of r, or r equals 1 is a typical situation, so the question I'm going to ask is, what is the, what is the right, what is the right formulation of spherical structure in this situation, right, suppose my base is not x, x is r's power, so this is interesting because we are talking about arithmetic of a Haier base, I know in the physics and mirror symmetry we already talk about the curves inside, we can add one more dimension inside, so that's here already, so what is the, well, spherical structure, what about model structure, and what about android order at the same point, so this kind of question, so we usually never trying to push it before, but now it looks like it's within the, within the same, for example, I try to understand what the naryntal Haier parent here, then I would force you to talk about valuations with Haier rank group, because each closer point of x r doesn't define a valuation, it define a multi-valuation, because for example, if you fix a point, it's inside x of r of r, well, the closer point, then, I mean, x is not the closer point, it will still with define some valuation, but it's a multi-valuation, right, you know, you have to say x equals x0, x1, xr minus 1, well, so each of them define a valuation, you get a multi-valuation, they define a multi-valuations or function field of q of xr to r to the r's power, right, or maybe r minus 1, right, you have a, you have multi-valuations you can study, because define this thing, and I don't know, I just, this is like a new question, rest out, so we are, we are in age trying to study the arithmetic of the base whose dimension is Haier, right, and, and physics has more experiences than r's, so that's what, that's a rest of different question, but here I already have related to the Haier derivative error function, so this looks like it's a very, the first indication like Haier derivative actually can be studied over the Haier base, but that do have other question, sorry, that's the only thing I prepared today, so maybe I should stop, yeah, yeah, so this is my fourth lecture, yeah. You said they wear a parity, you could do a spirit for every power for, yeah, this should be for every power, yeah, I think for every power for, I mean right now they, Ying and Zhang wrote another manuscript, so all the, I mean the assumptions can be dropped, so r could be old, e and f should be separable instead of eta, yeah, and they also have the Gorozaga for square, square free conduct, so I didn't talk about Gorozaga, but Gorozaga needed much more preparation, but in my third lecture, fourth lecture, I will talk about Gorozaga formula, because this proof, the proof is the same proof, it's a, it's in one package of proof, my next lecture about decomposition, fault in the Haier's small piece, and yeah, so how you jump from Ziggler module space to Schumacher, right, and in the other project by Andriota, how would a government mother push it, they're doing opposite thing, they jump to the Haier dimension, they, they start with orthogonal group jump to two to the G's power, we jump to the, they're two complete opposite approach, they're raising the dimension, we lower the dimension, yeah.


Let me tell you about what goes into curing a critical security bug So at the start of the start of the year wordpress 4.1.2 was released With a fix for what was one of wordpress's most severe security bugs ever What we affectionately call the Trojan emoji bug The name actually works on two levels First that we used emoji as a cover for a committee that fixed wordpress But also that emoji can be used to trigger it now Andrew Nason gave a talk earlier this year about About how this bug works If you haven't seen it, I strongly encourage you to check it out It's called anatomy of a critical security bug and it's up on wordpress TV For everyone who hasn't seen it or doesn't recall the salient details allow me to give you a brief refresher So my SQL supports a feature called character sets Character sets in my SQL are simply a standard way of storing text on disk whether that be letters numbers or emoji That's all there is to it So by the far by far the most common Character set in my SQL is utf8. It's certainly the most common in wordpress prior to wordpress 4.2 About 95 percent of all wordpress sites used utf8 Now utf8 is kind of interestingly named because it's not actually utf8 The second utf8 is the actual standard and was only implemented in my SQL 5.5 as the utf8 mb4 character set As of wordpress 4.2 we default to using utf8 mb4 when we can But the utf8 character set on the other hand was only a partial implantation of the utf8 standard The utf8 character set was actually an implementation of what's called the basic multilingual plane or BMP The BMP covers most European languages and most of the And the most common East Asian characters But it's really only about 6% of the entire utf8 standard any character outside of that for example again emoji Is not supported by the utf8 character set But you can easily type an emoji character. So how does wordpress handle it when you try to save an emoji character? See what happens when you type in a mode If you type an emoji character into a comment box on a wordpress 4.1 site before this security fix and submit it Take this slightly contrived, but not particularly unusual comment. It's a link to a site It has a title. It has some slightly unsavory unsavory styling, but apart from that it all looks fine The entire comment goes through several levels of sanity checks before making its way to WP cases cases is a function that Is a function for checking that the HTML is valid and removing any invalid tags or attributes In this case style attributes aren't allowed on on link tags So cases will remove that and we end up with a validated comment This comment goes through several more levels of sanity checking before it finally arrives at WPDB Now WPDB is the interface between all of wordpress and MySQL The job is its job is to insert modify and retrieve data from the database It also makes two assumptions about data with regards to sanity checking Number one it assumes that all that any section of wordpress sending it data has appropriately sanity check that data Within the scope of that section. So the comment code ensures that it's a valid comment. That assumption is a hundred percent correct It also assumes that the data it sends to MySQL will be written exactly Will be written to the table exactly as it sent this turns out to be not correct Now remember what I said earlier about MySQL not being able to store emoji in the UTF-8 character set Here's to where the problem comes in what MySQL does is it truncates the string immediately before the character It doesn't recognize So that gives us this which is very clearly wrong. It's totally invalid HTML Cases would have removed it earlier, but when cases was looking at the string It was valid HTML and so we've written unverified HTML to that to the database And it can be used as a script as a vector for a cross-site scripting vulnerability This vulnerability didn't just apply to comments, of course it applied to anything that could write to the database comments posts Options just to name the vectors in core Any plugins that wrote to the database were vulnerable your feedback form your e-commerce site Your booking form and anything could be used to carry out this attack. And so that was the problem And we needed to figure out how to fix it. We knew from the beginning that we had two options The first was called strict mode MySQL has a handful of settings which change how it behaves as an SQL database called modes One of those modes is called strict mode Strict mode fixes this problem by rejecting invalid strings instead of truncating the comment It would just refuse to insert it and return an error the this behavior by itself is perfect Unfortunately, that's not all that strict mode does it also adds a bunch of extra restrictions to Which changes how some queries work with MySQL and this would have ended up breaking the vast majority of WordPress sites Our second option is what we call pre-flight checks This takes the string being inserted and determines if my SQL will be able to insert it correctly This is the trickier option, but in order to not break many many sites. It's really the only one we had There are a few requirements for we have for how this patch had to work It needed to be a hundred percent accurate We couldn't afford to leave additional holes open as announcing this bug wind would inevitably cause extra security To this area of code it needed to be fast Ideally, it shouldn't add any extra queries or if it did they should be as few as possible And it needed to be invisible It should do it should just do its job and silently protect the database the average WordPress site should never see the difference With that in mind, I present to you the our first pass at fixing this bug This little block of code would have been added to WPDB's prepare method. You don't need to worry about reading it It's notable for two reasons one that it's the only version of the fat of the patch that fits on one slide It's it's about 1% of the size of the final of the final patch we committed and To it's completely wrong. It's fast. It's invisible and it doesn't work The the regular expression we used is totally wrong for UTF-8 it matches valid valid characters in the big five character set And there are probably other bugs in it that we that we didn't find before it was abandoned And so from those inauspicious beginnings, we began experimenting Our next experiment went through several iterations and several different names But the idea of strip invalid text remains Remained the same given a string and a character set it would try and remove invalid characters locally if it could or By asking my SQL to handle the string if it couldn't now this experiment Unfortunately introduced two of the bugs that ended up making it one of the two bugs that ended up making it into the final patch It used PHP's MB converting coding function to try and remove invalid characters So MB PHP's multi byte functions are a great under very specific circumstances Specifically you need to be a hundred percent certain of the character set of the string you're converting You can't rely on the character set of that PHP is configured to for example because it might not match the input string If you don't know the character set of the string of the input string it means you have to guess And so while we got pretty good at guessing it just isn't a hundred percent accurate which can introduce bugs We iterated on this concept for a while We even ran into the into some bugs with the UTF-8 character set in PHP So we moved to using this regular expression that you can see here and which did make it into the final patch The good news is that this regular expression does work Because it's based on the UTF-8 spec In hindsight it should have been a hint that there were probably bugs with other with other character sets as well The next problem we ran into is that you can do write queries directly to Directly to the database using WPDB's query method instead of using the helper insert or update functions So we had two options here. We could write an SQL parser in PHP to extract the data fields and figure out if we could insert them or not or Just to check if it's probably a write query and run our tests over the entire query string Obviously we went with the latter The use write query function was comfortably running in hyperDB for years So we borrowed that and use it as a test for whether an entire query string needs checking I mentioned earlier that earlier that there were two bugs that ended up making it into the final patch It was around this time that we introduced the second bug We'd been starting to test this patch on WordPress.org which was great for finding edge cases There's a lot of legacy code running on WordPress.org During that testing we discovered an interesting case that we hadn't considered How do we do pre-flight checks on tables that have different character sets on different columns? So we went back and added some more architecture The pre-flight checks were already happily running at this stage They'd connect to my SQL determine if the data could be inserted and then they they returned So for this to work We had to switch to doing pre-flight checks for every different character set in the set of columns referenced in the query The issue here is that we overthought the problem It seems fairly logical different character sets need to be checked differently But it was an incorrect conclusion. You can't actually change the connection character set mid-query. So this extra flexibility We added was at best useless. The worst case is it could have been a new vector for attacks The good news is that we ended up removing it but not before it managed to be the source of quite a few headaches We also tried enabling strict mode in my SQLs in WordPress's nightly builds Suffice to say the reaction was swift and overwhelming There were many different plugins and use cases that were broken by strict mode. So we quickly rolled it back Strict mode is certainly something that I'd like to revisit in the future though I do have some theories about how it could work and with recent versions of my SQL moving away from non strict behavior We'll will need to adapt in much the same way that we needed to adapt to some of the changes in PHP 7 So if you happen to have thoughts or opinions on strict mode, I'd certainly be happy to chat about them Come and find me today or tomorrow here or on Sunday at the hack day As part of this bug fix we added functions to automatically remove invalid text what when we were comfortable doing so For example, we'd prefer to remove invalid characters from a post title rather than blocking a post from saving and risk losing that post One of those cases we tried handling were serialized objects or arrays It's not possible to remove invalid characters from the serialized string So as that causes it to no longer be a valid serialized string instead We needed to un-serialize it Recurs through all of the data to check to check each member individually then serialize it again This was inspired by the WP JSON encode function, which does a similar thing before JSON encoding data Luckily, we came to the conclusion that this was way more complex than we actually needed and it was cut from the final patch So far we'd only focused on right queries as that's where the danger lay We didn't want invalid data being inserted in the database We did begin to wonder if this bug could be modified to exploit read queries as well As it turns out it was possible It didn't directly affect WordPress core that we could discover but it could very easily affect plugins or themes in weird and subtle ways For example, let's take a fictional user table and we'll insert an admin user Sometime later an attacker registers a new user with a slightly different name as you can see it has an emoji character at the end of it It's obviously different to the admin user we inserted, but what does this query actually return? So that's a problem returning incorrect results can lead to Information exposure or even privilege escalation attacks. So we needed to close off this hole as well The good news is that thanks to the way the entire fix had been architected It was only an extra few few lines of code to check or read queries whenever they needed to be checked Naturally, we reported this bug to Oracle, MariaDB and several other MySQL fork maintainers who've taken action to fix it And so this brings us to April 21st of this year WordPress 4.2 4.1.2 was released with this bug fix the release itself went fine Millions of updates rolled rolled out thanks to the auto update system Unfortunately, there were some bugs that made it into the into the final release a day or two after release Someone noted that individual characters weren't the only thing that would cause MySQL to trunk to truncate a string it would also truncate a string that was too long for the field It was being stored in in the case of comments. It's a 64 kilobyte field So everything after the sixty five thousand five hundred and thirty six character was removed It's it's pretty easy to generate a string of that length and submit it as a comment to any WordPress site So we quickly released a new version to deal with this bug The good news here was that The way we architect the original fix again made it pretty easy to add in this extra check We're already getting column info to from the database for the character set So we just needed to test against the column length as well We also had some problems with some of the less common character sets CP 1251 which is used in several Eastern European countries and EUC JPMS which is used in Japan most of these are legacy character sets, but they still have Substantial enough user user bases that this fix cause significant problems The primary issue here as I mentioned earlier was that we assume that PHP's multi-byte character Multi-byte libraries had the same behavior as my as my SQL's character sets, which totally wasn't the case We removed those checks now Everything goes either through the utf-8 regular expression we saw earlier or it goes directly to my SQL for checking So looking back, I think there are a couple of important things we learned from this process Allowing us to improve the development process within WordPress core unless there's lessons that you can incorporate into your own development practices First of all, if you've assumed something is true test it The hardest part is figuring out what your assumptions are But when you create something you take the time to step back and see what it relies on Does it rely on those things correctly? Does it take different conditions into account? You can make it easier to figure out your assumptions by simplifying your code Don't be afraid to throw everything out and start again In the initial ticket alone for this bug there are over 50 patches including five complete rewrites On this on the subsequent follow-up tickets There are another 50 or so patches several of which made significant changes to the code or completely remove the parts that didn't work No matter how clever a piece of code is if it doesn't solve the problem correctly, it should be removed Don't try to build the ultimate solution I've worked on a done on a bunch of different projects across WordPress core on Jetpack on WordPress comm and it occurred to me recently that large chunks of the code I've written Large chunks of the code I've written over the years have either been removed or replaced not because it was bad or wrong Well, some of it was bad, but now it's not the time to go into that Because it was bad or wrong But because it's the nature of software development that the code you write will be replaced over time Instead of focusing on making it on making the ultimate solution Make something simple so that the person who comes after you can easily incorporate it into a bigger vision As they say we all stand on the shoulders of giants So when it comes time for someone to stand on your shoulders make it as easy as possible for them to reach higher So before I'd finish I'd like to give props to my co-conspirators on this voyage Andrew Nason WordPress lead developer Nikolai Bacchewski WordPress securities securities are and Mike Adams magical coding wizard and Of course the entire WordPress security team for acting as sounding board tester idea source and sometimes personal counselor And that is the story of how we fix the Trojan emoji bug. Thank you I'd also like to offer a warning this fairly innocuous conversation was how I was introduced to this bug So if Nason ever tells you that he has something in for interesting for you, you may be getting more than you bargained for Thank you Morning hi It's on alright It sounds like a lot of the complexity from this came from supporting many different configurations lots of different legacy stuff Are there plans to force migrations to a consistent table or call our characters that formats? No It's it's one of word presses strengths I think is its flexibility and its ability to be used for on many different configurations and for many different use cases So I think it's it's important that we continue to support as many different character sets as possible And if people if people want to use it on crazy configurations, then we let them do that Hey, Gary. Hi. I think there were concerns when this was being fixed that other open source Packages might be affected by the same bug. So since it's been released. Has that come to light any other? things being affected No, not that I'm aware of I think a lot of a lot of other open source CMS is to give an obvious example Drupal is as quite it's quite well used and Drupal takes a different tack to what we to what we do is that they Basically rewrite on a regular basis and break backwards compatibility which isn't an option for For word presses we want to maintain backwards compatibility as much as possible, which does mean that We do have to write some Some of these things together to keep things working, but it's the way we view it is it's it's important that we it takes a few of us to write a few of us a year to write this patch is better than breaking half of all WordPress sites and Take meaning that hundreds of thousands or millions of developers have to spend Days or weeks fixing their code. I was just curious what What was the reasoning for including emoji into WordPress? I mean, obviously there's a the fixing the bugs in the database of traction, but Why actually include the emoji script on every site? I know there's a lot of contention from a lot of people out there about that so what Your site already supports emoji so what we were what we really did with the with the emoji script is fill-in compatibility like what we do for example with with adding in hacks to to To fix internet Explorer bugs the same thing we do to make sure that your browser Displays emoji correctly emoji by itself is is a language So it's important that we allow people to communicate in whatever language they choose Hi Gary You mentioned the WordPress security team and what is Can you introduce people to Responsible disclosure if they happen to find a security bug and how to reach your security team to properly Handle the situation without making a mess of course So security team is made up of about 30 different people from various parts of the WordPress community If you do find something that you think might be a security bug then email security at wordpress.org Please don't submit it on the public bug tracker security tickets do need to be handled privately and Even if it's not a bug then we'll get back to you and let you know If it is a bug then it's much better that it's that it's handled privately I'm just wondering how serious of a bug this actually is if by for whatever reason you choose not to upgrade Or can't upgrade for whatever reason very serious it affected 90-something percent of sites any site that had the where comments were turned on for example and it's Excuse me it It allowed an attacker to completely take control of your site So it is very important that you upgrade Smiley face thumbs up smiling pile of poop Thanks I've found working with various character sets when doing code development sometimes a bit of a trial Do you have any tips that you learned when working through this on how to work with various character sets efficiently? I think So for modern development and if backwards compatibility isn't a concern then you use utf-8 or in my scroll utf-8 mb4 That's the based on unicode and it's the idea of unicode is that it covers It's a replacement for all character sets if you do need to handle handle legacy systems, it's I don't think I've found a particularly good way. It's mostly just a case of Knowing the differences between them and Kind of working from there. I was just curious. I don't know if this is even really Possible, but when it comes to major security issues like this and stuff like that once they get reported Is there any way for you guys as a security team to kind of track? when sites fall victim to these kind of security issues and so I mean so you can kind of keep track of You know how serious this was before it got patched and things like that or I mean again Don't know if it's possible, but it just be interesting to see that kind of data We don't have data on across all sites, but we do work with the various security companies Security and voltpress for example to kind of get an idea for what the level of attack is or If we if we see it see something that's being attacked through comments Then we work with the Accusement team to to get an idea of how it's being exploited Hi, I was wondering if you could speak to the communications that came about after you fix the bug How do you roll it out to the world and get everybody to upgrade your site their sites? We auto upgrade It's this this was always the idea of the auto upgrade system was that when wordpresses now over a quarter of the internet and When there's a security bug and when it's announced People work very attackers work very quickly to try and exploit it So if we're able to roll out a fix for it to every wordpress site to tens of millions of sites in half an hour Then it keeps it secure so The the auto updates is the main thing and then obviously the actual information about what What the exploit was is spread through the wordpress news news blog and that gets shared around Well, I think that's it. Thank you very much I'll see you around