testing all right everyone welcome to black ops DNS now usually we start our talks with a nice slide that says absolutely nothing instead I seem to be showing you some kind of screen saver let me tell you guys a little story I don't know how much you guys know about me I wrote a really fast network scanner called scan random a while ago and in the process of doing DNS research well I kind of adapted it to do DNS scanning and I scan the entire 64 dot range and every single dot there is a DNS server that is plotted XYZ space according to last three bytes in 64 dot long story short there's about a hundred and forty thousand DNS servers on one single chunk of the internet alone maybe we should look into the security aspects of this so that's what we're talking about today by the way I want to thank all of you you all waited in an incredibly long line I can't believe how long that thing got thank you everyone and as it goes every year you have first of all I want questions I really want good questions so if you got a good question you can give me a beer give me one second I have to plug my laptop in and we'll begin this little shandy I'll be careful all right I can't he's right you're under 21 I can't give you beer here all right and anyway guys don't give priests too much hell he actually had a really good reason to be giving a speech and he's right they're really just at the end of the day I agree with the sentiment so let's begin the tech stuff though first of all who am I I'm a geek why why are we going to be looking into this today well DNS is globally deployed the stuff is everywhere you run you use DNS every time you access the internet if you run a server of any sort you probably have some kind of server level involvement in the protocol it solves a deceptively simple problem the internet like the telephone system does not work on names when you call your friend you don't say go to your phone and say you know Bob dogs please no you put in a number and it's the same way on the Internet you'll put in www.defcon.org well you may do that but the computer has no idea what to do with that it has to look up a number and by DNS it goes from Defcon.org to <IP_ADDRESS> whatever the internet address happens to be it is a very old protocol we're talking early mid 80s it is the second oldest what I call uncontested hell yeah you know when you've been handed a random drink by Humperdink all logic says do not drink it screw logic all right so you look at that we don't do that again wait till after so we don't do tell that anymore we do SSH we don't do that much FTP anymore a lot of people do HTTP but really you know DNS solved this problem 20 years ago and there's not anything else that comes close on the SMTP is still being used and we're really suffering for it hello spammers but DNS is really just it one it's good it's there I got interested in DNS really especially when blaster happened blasters one of the three worms of the summer of worms last year blaster not changed so big and blaster went ahead and looked up windows update dot com the wrong name guys it's windows update dot Microsoft dot com how did you forget Microsoft they're kind of a big company but a query to windows update dot com before going ahead to launch a flood against this site funny little thing everyone was running scanners to try to find their infected blaster hosts meanwhile the blaster host every last one of them was making a quiz for windows update dot com I go ahead put out a single one liner pearl command over SSH that would parse out all the infected hosts people are looking at me like what you can find worms with DNS that's when I got the idea maybe we should really start experimenting with this so we have now a new toolkit for DNS experimentation it's called Ozzy man DNS it was released at the black briefings a few days ago and it's pretty cool we've got a couple tools non D as a name as a non the gear is our experimental DNS test platform it is a dynamic DNS server very accessible very easy to code for if you can write maybe 10 lines of code a pearl you can actually return arbitrary results on a DNS query it's beautiful and the joy goes to pearl for having an amazing DNS library there's a library good enough I learned the freaking language that doesn't happen what some of you may have heard about do you out yes we have SSH over DNS if you can DNS out of a network you can get arbitrary network connectivity we have file and set file and stream receivers and senders ask on get a ask a stupid question get a stupid answer and we have glance which is a freshness check over DNS I'll tell you more about that in a bit so what are the useful traits of DNS that are interesting from a security perspective well first of all DNS is hierarchical the example you should explain this is to say let's say you could dial 411 and instead of just saying give me the number of this company you could say give me the extension of this person at the company and they would go forward one go out and find this person's extension and tell you oh yeah Bob's extension four three nine one would you like us to connect to you the phone system is very centralized we're really only a few bell system bells out there and they store all their data internally DNS is a very distributed architecture we go to calm it tells you how to get to docks para dot com you go to docks para dot com it tells you how to find food docks para dot com and so on it is a hierarchical process that gets you closer and closer it routes you through hops much like the internet routes you through hops that's kind of interesting there are two kinds of look ups recursive versus inner of look up and recursive look up you know you basically go to some sort of a ham so it's actually a complicated process to go through this entire hierarchy to follow the coms expert com to food expert com and so on this process has been offloaded to specialize servers so called name servers you go to them you say here's the answer I'm looking for it does a whole bunch of work in the background and it comes back to you with an answer that means it's a proxy server is you ask it something it goes out on the internet and does a bunch of work for you interesting so now we can tell other machines to do look ups for us and also these other machines they cash so in other words I go to you know like the 411 let's say 411 did the whole extension finding out at Bob was at extension 4931 the next time someone called 411 for 4931 say oh I don't remember that I don't need to call the company again he's at 4931 same with the DNS where there's a caching of results it's much like HTTP proxy servers like squid will prox will store results so if you ask for it instead of going out on the internet it already knows the answer it provides it these are some interesting traits for our globally deployed DNS system maybe we can use them now the primary research areas for water no so check this out the primary research areas for DNS 99 in 2000 was basically not a good year for bind no Paul Vixie has kind of removed that from his memories filled with exploits against the world's most common DNS server it was a very bad time luckily most of the bugs have been fixed I'm sure some of you know bugs that are have been have not been resolved but for the most part the DNS is okay the other second class of attack involves DNS spoofing that's where false addresses are returned for addresses a lot of work has gone into preventing the ability to spoof a DNS address that's not so much of a problem anymore used to be a lot more there are still some definite threats but that's not what I'm looking in I'm looking into DNS tunneling now there's been some interesting work lately in terms of DNS as well as well lately we have bit torrent seats how many people in this room have used bit torrent very cool good friend Bram wrote bit torrent guys awesome so bit torrent depends on a little bit of data to seed you on your goal towards getting your files people have been talking about putting those seeds in DNS as a retarded little example people have done math service you'd look up 2 plus 2 for address calm receive an IP of 4 but this violates the RFC because you're not allowed to have a plus in DNS so I'm not the first person to put odd things in DNS I do not claim to be but I'm doing some interesting stuff anyway how is the arbitrary data put in DNS now most people think well you know all things returns is a couple IP addresses ring how much storage capacity can there be an IP addresses of 4 bytes long well first of all you don't just need to host DNS addresses you can host what are called text records text records are unstructured fields of data you can get actually decent amount of content into them and shove them into a packet they're most commonly used in what are called SPF records which are they're used to validate the source addresses for spam instead of that I'm kind of putting arbitrary data in what's called base 64 format and it looks like what you see up there where it's just a large string of English character you know English standard characters you can get about 220 bytes of arbitrary data for text record now sometimes you may not want to move text records sometimes you just you don't have those available what you can actually do is in a query in a lookup in the name in the address that you look up you can throw data so when you look food calm bar calm or so on you can append a huge batch of arbitrary data in the lookup itself up to 63 characters between each dot and up to 256 characters total through this method and by the way we can't use base 64 because there are 63 not 64 63 legal characters in a DNS name so there's actually something called base 32 which takes all arbitrary data and shoves it into five bit text so you get a foodie in a couple of the numbers and through they get about 110 bytes per packet now DNS tunneling who's doing it well now nstx is the most popular system for tunneling arbitrary data over DNS it takes IP packets standard things that you move over the internet and it encapsulates them in DNS queries now the problem with nstx is that it really only works under Linux and hey that's true but you know sometimes you run another operating system every once in a while OS X say perhaps see see how I got that to be cool again so beyond that there are serious rumors it's true that various botnets and malware are using DNS as a covert channel in order to get the control channel for their worms so this is happening and at the same time it's happening nobody's monitoring their DNS traffic nobody had no idea that even worms were going on over DNS so I mean rooms were doing lookups over DNS so this here is an attempt to try to raise the lights on a real problem let's start simple nstx requires kernel cooperation and we don't want to have that so let's make something that doesn't require the kernel but still allows remote networking now what is remote networking like VPNs I'm on this network but I wanted to be over there I'm at the Starbucks network I want to be on the internet you know stuff like that so a little project I was involved in it's called SSH you might have heard of it and SSH has a function that I wrote called dynamic forwarding dynamic forwarding is basically a poor man's VPN and where's my ethernet jack could it come up and give me an ethernet cable yeah just set it up okay SSH dynamic forwarding is interesting because you can basically route arbitrary TC arbitrary TCP applications over any host you can SSH into so you want to look up websites you go over SSH you want to use your messenger you go over SSH your firewall against websites and instant messenger no problem because you're going out over SSH and with the latest hack you're now going out over SSH over DNS problem DNS is not TCP and SSH depends on TCP TCP moves by streams you know there's some arbitrary data go send it DNS means records and individual records are in the blocks of data TCP let's either side speak first DNS is client server the client has to look up and the server and then you know the server can respond if the client doesn't look up there's no response and TCP is apicly you can move any byte you want where's DNS you know you can only send this character if you don't send that character you know it's almost like I've heard this story before I shall call me HTTP all over again XML RPC and soap and all these other protocols are taking really complex stuff and shoving it into the HTTP channel because well no one's firewalling that same junk just like the HTTP tunnel we're going to go ahead and we're going to move data over something that really it wasn't intended to now that I have to point out there's a significant difference between DNS and HTTP in HTTP you can have an arbitrarily sized response to a request in DNS you can't there's really a 576 byte limit unless you use the UDP size option but I'm not sporting that yet so with that restriction we can still do interesting things with a tool I've written called DRoute which is a DNS stream router now let me give you a little bit of an example of how it works and then I'll see if I have enough net to show it to you because live demos are always fun upstream first of all upstream and downstream have completely different semantics upstream as limited bandwidth you'll notice on your ADSL links at home it's very slow up but very fast down because most protocols in common use you're downloading a lot more than you're uploading conveniently DNS gives us a much slower upstream than downstream we basically have the name that is available to look up we put 110 bytes in as I showed you earlier with the in between every 63 dots downstream level bandwidth we can use that 220 byte method I talked about but we have to pull for new content there are text lookups and they return base 64 data we have a byte offset that describes how far into the download stream we want to be if a poll now I don't want to continually be flooding a remote non-deserver to grab my data so this is how I do it I'm always pulling if I don't get any data back I wait three times longer before I try again up to some maximum sleep time so if I send it you know as soon as I have data I speed up because it was probably going to be more but if there's no data for me to download I back off it's a simple protocol but it actually works pretty well for for not making too much noise when there's no data to download now my present implementation is single threaded and only one packet can be outstanding at a given time but this is temporary and once it's fixed this will be a lot faster now let's do something really stupid and try to actually give you guys a demo that's mildly readable but not greatly sorry we have no net wrong one no I mean it's not live on my side nice no I don't have link on my side all right I'm gonna continue my talk and as soon as this thing maybe works I'll give you guys a lot demo so yes you know we can do SSH over DNS it does the same thing ultimately that STX does so yay all right we can do lookups wonderful this is a little bit more interesting something new something that's never been done before yes yes we can check this out so you go to a DNS server and you ask it to none of them like I said it's as if every web server was also a web proxy every DNS server or most DNS servers out there will do recursive lookups on your behalf I don't care now the basic trick is to obviously you're at a hotel network that wants you to charge you're at a Starbucks that wants you to charge you just go out through the DNS requests because they'll actually feed you DNS data before they actually hijack your outgoing HTTP instead you just donate to me now but check this out wait maybe I might be able to give you this demo one two three four Bing cake oh so DNS on this you don't say okay this one fails do I have no DHCP on this thing yes we have we may have net no I don't look at my top interface I'm not getting any DNS out so I actually need to I have link but no DNS what's this plugged into the same thing well hang on I'm gonna try this one last thing just come up here look at what you need I'm gonna continue my talk all right let's check this out guys DNS trust the hierarchy to tell it where to route next now like I told you calm takes you to Docs para.com Docs para.com says no no I don't got the answer go here it'll tell you where all the answers are for all Docs para.com and so on you can do something very interesting with this and it's called source routing because I go ahead and I communicate with a recursive server a server that's doing lookups for me and I tell it to look up an address that I control and when it comes to me trying to resolve this address I tell it no no no no no no I don't have the address but you know who does 10 or 111 it's an address in your network and it goes out the other interface on the DNS server so this is very new DNS comes from an era where firewalls didn't exist where you could globally route to any IP address possible that's its design when you have a DNS server that can go out of multiple interfaces one to the public internet one to the internal network and you go to that public internet interface and you say hey give me this answer and then you tell it by the way the answer you're looking for is on your internal interface it goes into the internal interface this look like because I'm not just going to tell you this theoretically no no no no no I'm actually going to go ahead and implement it part of Nambi Nambi has an echo service if you look up 10-0-1.55 at echoaltdocs para.com you get the name server for that is an S whatever when you look up the address for that it dynamically returns a packet that says oh that address you're looking for that's a 10-0-1.55 so guess what happens you go ahead and you try to communicate you go to recursive server it goes ahead says was my next hop the next hop is a 10-0-1.55 it goes backwards now you say fine I'll just disable recursion on my external interfaces I won't let you come back into my network and the story could end there but I'm an evil bastard the interesting things happen when you scan 16 million IP addresses about 20 or 30 thousand hosts are like who the hell is this guy and what they do is they actually look up your IP address to determine the name you're coming from lots of firewalls you know IDS is a couple individual auditors guys when you're investigating someone realize your investigations might send a big flare back that says hi I'm looking into you of course I would need to have control over my own reverse DNS I do have control over my own reverse DNS thank you very much and there's something very interesting that you can do they come to you and say hey what's the name associated with your IP address now you could tell them or you could tell them no no no no I don't have the answer either no who does know it's this IP address inside your network but it gets a little bit more complicated because we don't just want this original reverse request to come back to us I mean to get to go to the inside network no no we want arbitrary data so what we do is we say no no I don't know the answer but this other name you know big batch of data dot other domain dot com has the answer now this big batch of data will actually be the address that is eventually pointed back in the network but the very interesting thing is it is put into a separate domain then the one they looked under for the reverse lookup why I told you earlier about DNS spoofing DNS spoofing used to work like this they would reverse you know they would look up through one house look up to another look up to another you say no no no I don't have the answer but yahoo has the answer and yahoo that my address and then it would store it now every time that server tried to go yahoo it would come to this address so this is bad so it was deemed the solution was to not trust the server if it told you the IP address of a given address was in the of a given domain if that domain was some completely different place it would say oh you know what you aren't qualified to answer requests about yahoo or you're not qualified to answer requests about this other domain so it would start a completely new recursion process and this new recursion process will be for this new arbitrary name and would follow that path to its inevitable IP address and it's that arbitrary name and arbitrary IP address lookup that gets leaked all the way back into the target network that is our pipe in now what's our pipe out we just do the same thing the guy on the inside our Trojan horse on the inside picks up this request says oh I've got a big request here I've got data I've got an incoming message I don't know the answer but this guy on the outside does and thus you have a path that goes both directions you communicate with the IDS it sent a message to the DNS causing the DNS to proxy traffic back and forth between an outside host and an inside host and there's no recursion involved from in a public thing it's kind of nasty and did I mention that actually a human auditor looking into your IP address can actually cause this social engineering as an aside by the way I'm kind of embarrassed to have to talk about this but I'm going to do it anyway please don't log when you're writing software just the name return from a point of value your point of value IP address say 6 you know <IP_ADDRESS> equals this name lots and lots of places will just say hey if I got a name back I'm not going to log the IP well you know what I can return for my name 12701 is my name hey guess you know how much that messes up your logs yeah guys by the way who does this I don't know Apache SSHD bunch of IDS's don't do this thank you okay this is cute some people came to me they said Dan I would like to be able to communicate with my friend and I'm behind and at and he's behind and we can't talk to each other and we don't have any open bullets and boards that we can communicate through we would like to communicate with one another how can you do so can we do with the DNS servers I'm like well the DNS servers aren't going to like store you know list out all the results of their cash they're like please Dan there's got to be away so I'm like okay you go to a recursive server say hey you over there for 221 what is a data docs com and it goes ahead and it finds out and it stores that value for a while now a second guy comes along and he says what is data docs better calm well it's already cash so the answer is there when he does that second request the second guy comes along he can actually say no don't investigate don't recurse if you have the answer already that's great go ahead and give it to me but if not no I don't want to know that's just a recursion desired bit now data docs bear coms already cashed so it still returns that's information I now know that this guy had already gone ahead and seen data docs bear com and this is related to the whole class of information leakage where you can find out of a server has been looking up yahoo looking up hotmail been looking up arbitrary name that you want you can query his cash and not do it destructively by destroying your recursion desired bit but you can also send information based on whether an individual record has already been looked up or not here is the method for single bit data transfer over DNS and yes this is even slower than it sounds step one split your message and it better be short into individual bits for each bite that's going to be available for reading to a recursive lookup against a value that says you know I'm starting another bite for each bit that is one to a recursive lookup against a wild card hosted name meaning it'll return a response no matter what the query is that identifies that bit as active so say if you had a letter with you know three of the bits the first bit the sixth bit in the eighth bit active you'd send a request that correspond to one six and eight how do you retrieve that data you scan from zero you know one six to eight an auction scan all seven all eight but all eight bits in the bite first do look up for the first bite start bit if you get a reply do a non recursive lookup against all the names that map to the eight bits the names that do return an answer though that's a one the bits that don't return an answer are zero you integrate the bytes into a bit the bits into a bike and you save increment the bike counter return step one long story short you get about eight bits a second but two hosts can communicate over a tremendous amount of traffic implications well first of all we do bidirectional communication really really slowly secondly this method can be extended to pretty much anything web counters can be used for communication IP ID counters and IP stacks there's a story about Paul Revere's lamps in the tower the British are coming you know all sorts of there's a court in the intelligence community you can always send a bit and there's a question of did it increment or not with a start at spikes between six and one and six or two so I mean there's always a way to send a bit could possibly send more data last modified just last week I'm writing this all this code about DNS and there's a slash that story says RSS is overloading the internet well lots and lots of news readers will do big heavy HTTP queries every hour on the hour and according to the admins this looks a lot like HTTP I mean this looks a lot like a DDoS you know all these those coming at once is really inconvenient now the only information they want to know is if there's any new data for them to download so like fine we'll take this one tiny piece of information we'll shove it in a DNS text record and they can just do a lookup but you know it's a pain in the ass and a lot of languages to do text record lookups and I'm like huh last modified the date that this RSS news file was updated well that's a date dates are times and times are represented as 32-bit integers in Unix what does DNS move a lot of that's 32 bits wide oh yeah IP addresses so is what I went ahead and wrote I won't last modified over DNS it encodes a date as the IP address for an arbitrary name so you go ahead and you run a simple command called glance the critical source code is right above it doesn't get host by name and then it casts it as a time you can glance that WWC and then com glance alt.experio.com did we kill someone again damn and then look at what it returns number of seconds since that time Thursday July 29 1611 21 GMT one packet instead of 10 very very efficient and it caches everyone in AOL can find out that CNN hasn't updated yet hallelujah but let's say we wanted a little bit more storage you know what could we do that might possibly be interesting to move over DNS well let's say we want to do really big files I call this domaincast normally normally in DNS you talk to your own server and it retrieves the canonical official data on demand for a particular request from just the official server and the data is consistent for everyone that's normally let's have a little bit more fun I showed you that screensaver at the beginning and there were a lot of dots there right what if in each of those dots we stored 20 kilobytes of data a different 20 kilobytes of data for each of those dots well if you do the math it would take if we had 20 kilobytes of server and a 700 megabyte not big CD but only take about 35,000 servers to host all 700 megs of data and guess what they're all storing data in their cache for up to a week so for up to a week we could store this big huge file would it be fast well out of the DNS server you can only get about a kilobyte a second more or less well time one kilobyte a second times 35 met thousand is 35 megabytes a second I think that's faster than my net connection now yes you know there's going to be some overhead say 50% overhead that's still 17 meg a second that's still a heck of a lot faster than my net connection so by using a divide and conquer strategy we can actually store a tremendous out of data in effectively the internet itself kind of a deep toy now how do we distribute the list of sites to go to I used to have this big complex algorithm for encoding the next hop to go to in each packet then like you know what 35,000 times four bytes is 140 kilobytes I'll just send that as my list of where to go for each individual byte and if that's even too much to host we'll just host that in domaincast as well across seven key servers BFD so yeah that's how you distribute a large file very fast over DNX but that's for a file what if we wanted to do a stream an audio stream say voice over DNS anyone so it turns out awesome so it turns out voice compresses really freaking well like two kilobits a second like 276 bytes in a second okay you know what DNS is slow any that slow I can move to 176 bytes even through a pretty slow server so it turns out interesting I didn't expect this to actually be useful but DNS caches so you can have like you know one of the things you notice when you're serving audio data is as soon as you get a whole bunch of listeners your bandwidth bill goes through the roof when to be nice if everyone will cashed your data and it distributed it shared well I look into this for a second and with HTTP it's a stream so it doesn't know how exactly to cash it but if you divide your data into say 880 millisecond chunks these chunks get cashed just fine so um yeah that's what we do we basically take data put in 800 milliseconds chunks we upload them using standard dynamic update to a buying server and we pull them down what does it sound like I'm gonna see if I have net maybe I'm hoping we have net that's a big fat maybe modify this real quick and then we're gonna win now do we all understand no promises radio San Francisco California this isn't saved this isn't a lame demo that was live and now and now that we have actually met hang on we gotta do that SSH over DNS come on how long have we wanted this at our disposal I shall even put this down since what could you afford a hooker maybe I have to modify one thing again I can document this so I said I don't know how many of you can read this SSH actually has support for something called a proxy command a proxy command says you know what a straight up TCP connection isn't gonna work instead run this command and it will go ahead and give you connectivity to where you want now normally it will just you know work normally use this for socks or for a she to be a she to be or whatever this isn't normal I'm using it for DNS now what I'm doing is I'm adding an option to my D route command to tell it to go through the resolver at 4 2 2 1 I can actually tell it to go through multiple resolvers that my data is actually bouncing off an arbitrary large list of name servers so if you say wanted to spread your communications across 30 or 50 hosts no problem boss let's see if this works maybe oh yeah this is going not straight up but over SSH receive disconnect that sucks show one more time entering interactive session and you know what just cuz I feel like doing it I feel like talking to my friends cookie scent and maybe maybe how you doing now that's a stunt we can actually actually port this hat that audio hack back to HTTP return 1 to 5 second chunks of audio over HTTP and now it'll be compatible with proxy servers so people have come to me and they've said Dan we've talked about a whole bunch of stuff I don't really understand what I'm supposed to take out of this talk fine I'll give you a nice little summary first DNS is globally deployed you use it you probably serve it as well second as the rest of IP networking has become more and more filtered DNS has been left pretty much just the same for important reasons but has been left the same and its services actually outstrip what a normal IP network provides normal IP networks don't cash data DNS does third this connectivity can be used to offer an entire range of services from an encrypted VPN style link to a completely silent but remotely accessible Trojan horse to an unexpectedly useful distributed audio caching system fourth don't shut off your DNS servers don't try to firewall it off to just knock out your network connectivity but please watch your DNS traffic see what's going on pay attention cuz people like me are out there all right any questions we got three minutes for questions and seven beers to give out so who's got something good go hang on get the heck out here you got questions come up now we got three minutes how do you deal with a blind any cast system like the dot org system that's been implemented over the past six months why would it be a problem if I register name in the dot org domain it still comes to me it still comes to you but over multiple hops you're still you're not dealing with the same cash on every system anymore no no no I'm not hosting stuff in the root servers it's being hosted in my particular endpoint unless the unless dot org hosts all the names under dot org itself which it may vary in other words we're talking about third level domains are these hosted in dot org no I was looking more at the attack vector not at the not at the hosting part of this tell me more tell me more about this attack later go ahead is it customizable the size of packets because I know it specifically picks at least by default will limit the return size of DNS queries I am staying one of an I have been overly conservative I am a hundred percent RFC compliant my DNS packets do not exceed the 576 but 512 by limit now it turns out a lot of sites don't require such paranoia just by default I coded against the system as good as I would write what would you recommend to protect against this sort of DNS routing into your private network do not allow recursive DNS on any server that's dual hosted no you got a drink I was wondering if you're doing SSH over DNS is there caching the data no I said TTL equal to zero on all my traffic so that it's not cached hey actually for the last modified self there's an optional header for a CDB called expired if you take expired minus server date you get a number of seconds that server wants you to cash the value use that as your TTL for your last modified data what if you got say 50 or 60 servers to cash a single packet of data in their servers and then forced another host to or I'm sorry sent a spooked DNS request to all of those servers and the return address for something like Microsoft comm that is very good attack do you think you're 140,000 in the 64 range is that reasonable or is that because you chose 64 is it probably an average selection 65 does not have as much 64 does my guess is that 64 was moderately heavily populated because 64 happens to be one of those that was distributed to lots and lots of different endpoints there are so a lot of companies that have the whole class B's are even class A's these companies do not host as many public DNS servers what do you foresee is a problem with say everyone started using the system to do SSH caching or caching of their video streams this is going to create a large load on everyone's DNS servers far as bandwidth the CPU consumption what what sort of problems and solutions do you foresee well for audio the interesting thing is that it actually reduces overall bandwidth because it's caching locally and you're not using your external link as much for SSH over DNS it it could get problematic if everybody was using this just because you're well you know what it is because SSH over DNS is going to be slower your aggregate data is sent is going to possibly be less so you know what bug me later we'll think about how this could actually cause problems oh apparently I can do as many questions as I want so come on up if you got a hang on hang on if you've asked me a question grab a beer where can I get a copy of your code oh yeah did I mention I actually released this junk yeah dot d o x p a r a dot com docs para the backwards paradox with the high failure rate of name lookups what I'm trying to get at is in UDP streams because that's how DNS communicates mostly how much more overhead will this take well the thing is remember I control the endpoint and so the classic bind model of just failing randomly is greatly reduced however I have a lot of reliability code in my client to go ahead and retry potentially in other servers so I've actually done a lot of work to make sure that reliability is managed a lot of them are shifting from server to client what do you mean like code DNS and some of the others that are coming out to work with DNS better hmm well I mean the idea code DNS will go ahead and deal with DNS caches all the SSH over DNS stuff is uncached because it's part of a live stream thanks when you're storing large when you're storing large files across multiple DNS servers what kind of redundancy do you have built in in case one of them goes down ah that's a very good question you get the last beer the mechanism I'm using ends up using what's it called there's a whole secret splitting mechanism you can use you know like there's lots of algorithms for 90 you know like like par on use net there's actually a more advanced version of that that's tuned towards larger files and if you have a 90% an arbitrary 90% of the data you're able to reconstruct the entire file what sort of passive attacks do you see people are using against somebody uses this as a communication method can you repeat that what sort of passive attacks do you see against people using this as a can we get a communication method you mean how would you hurt people who are doing this how would you drop on somebody using this as a connection well I'm moving at ideally I'm moving a man I'm allergic to a question no I did this is actually the big reason why I chose to use SSH over DNS because the SSH layer will prevent any kind of attacks from being particularly effective I mean yeah you can corrupt the link without a problem but you're not even going to be able to spoof traffic at me and this is as opposed to what I was using as I was developing this which was just I net D into a shell now SSH has a cost it has a lot of back and forth and that increases the setup time substantially but in return you get immunity from the kind of attacks that you were thinking of I think so go ahead just wondering if you've dealt with or care about how AOL doesn't seem to pay attention to all of the DNS RFCs tell me more I know that you know a person expects a certain behavior for caching from a DNS server and you're expected to be able to tell a DNS server oh nonsense I throw a knot into every request in SSH over DNS so I know exactly what we're referring to bind can be configured to have a minimum TTL value that it'll respect it will refuse to accept that data isn't going to be cash you'll cash it anyway so what you do is in your query you throw a little random knots of random value so it can't pretend that it has a cash because it doesn't actually know that these two requests correspond to the same value that's how I handle that okay all right no but great question I give you a beer if I had one is there any way to arbitrarily float extremely large files for longer than a week at a time through DNS you can repopulate the data so if you if you don't actually want to make another connection and repost anything so so let's say you put a payload up and you wanted to have that float around arbitrarily you know what you could do is assuming in your first week you had a whole bunch of people downloading your data you could actually have some code on the clients distribute the the updating of the data so you distribute to 35,000 servers and then you get a hundred thousand clients and every week the code on the clients knows oh I better go ahead and update that data that being said this is extraordinarily evil please don't write this client two questions are you going to release your list of IP addresses not publicly can I have a copy of it I can't publicly I can neither confirm nor deny so the third question it seems pretty easy to see that someone's doing this the way that you make the request are you going to make so that it will be hidden because right now it would be really easy to write a snort signature and say this is someone titling over DNS important actually something very important how would you write a snort signature to find this because these packets are entirely RFC compliant now you could just say there's a lot of DNS traffic coming from this particular host but a better method is to notice that these requests are actually have very high levels of entropy in other words English language follows a certain distribution of consonants and vowels and lead numbers and so on and DNS names very much follow that as well if you were to write a snort signature to detect this kind of traffic you would simply need to have an algorithm that detected hey look at all this very large highly intropic data I bet this is in capsule and SSH traffic do you want me to stop or take more one more question if you done any work to try to transfer four byte chunks over multiple a records problem with that is that you end up with inefficiencies because of all the data in between each a record the record stuff came originally now what people say well why don't I just shut off text record lookups first answer because it kills SPF second answer fine I'll put them in MX records and they say well why MX records are you know individual records get desorted get randomly sorted well MX records have a precedence value and this precedence value can be used to sort your request into the original order so that's why the bottom line is you're not going to stop this by trying to limit what types of records you serve so so from your standpoint is an efficiency question yes and I know efficiency and arbitrary data over DNS are not concepts that go together but it works anyway great thanks all right I think that's all we got time for find me later oh and I am going to the dunk take if you want to dunk me come get some


Hey shipmates, leading by example, clear communications, and building our foundational strengths are key to our continued success as leaders in our Great Navy. Operational stress control skills training focuses on applying these principles to help our sailors become better equipped to navigate through the challenges we face daily. This training isn't new, it's simply a way to make you and our Navy stronger. The skills you'll learn here will help you teach sailors how to thrive, not just survive. By helping them navigate through stressful times today and throughout their Navy careers. It's vital that we recognize the levels of stress and know how to mitigate it when it appears. We all experience difficult times in our daily lives and during our careers. Having the skills and resources to navigate stressors as they arise makes a difference. The Navy is better at recognizing stressors and stress reactions. We're changing the way we talk about and treat psychological health, but we can do more. The important thing is to intervene and take action. Don't stand by and allow a problem to become worse. An Iraq veteran wrote an article entitled, Leaders Can Lesson Treatment Stigma. He calls upon us, leaders, to show the way. He suggested we begin with changing how we talk about psychological health. A stress injury is no different than a physical one. Both require appropriate attention if we are to return to duty as productive sailors. This course provides you with the tools and the confidence you'll need to make a difference. Together, we can learn how to perform our best and grow during stressful times, today and throughout our Navy careers. We want our sailors to thrive, not just survive. Stay healthy, stay fit, stay Navy, and I'll see you in the fleet.


Welcome to Toffy TV. It is the Everton News Daily. Now before I get into the news, we are sponsored by Vanorama for the summer. They are responsible for driving fan TV up and down the country this summer. And they're doing a Whale Cup giveaway. They're giving away an Xbox or a PS4 with FIFA 18 and the Whale Cup edition. All you'll have to do is get over to Aft Vanorama on Twitter. Give them a follow and a retweet. The tweet is pinned at the top of their Twitter profile. And that's it. That's all you have to do to enter. Terms and conditions do apply. So why not, you know, might bring yourself a free Xbox or a PlayStation 4 and FIFA 18 just in time for the Whale Cup competition. So get yourself over to Aft Vanorama and enter that competition and you may win. Good luck. Marco Silva has been speaking to EvertonFC.com with reference to his connection with Marcel Brands. He said that the pair of them have a strong connection on how to drive the club forward. He said they'll be working hard to make the fans proud every day. He said that it's about putting the demands on the players but trying to also keep the pressure off them as much as they can. But it's about working hard as we try to get results and move forward. I've been impressed really with everything that Silva and Brands have had to say in terms of taking the club forward. At the moment it seems like a real professional relationship. It seems as though Everton have got the key elements right. And it's a case of us all getting behind it, isn't it? I think everyone is. I think everyone's looking forward to it. Obviously signings and players going out will dictate the mood as well. But it's going to be interesting as we move forward over the next few weeks. Obviously they're working hard to put things in place, get the pre-season planned, identify targets, move players out. So it's an exciting time because it's new and fresh and let's be honest we all needed the big pick me up after last season. On the back of that Marcel Brands is keen apparently to establish Everton in South America. Establish that link for getting players from South America into the club. He's done it with a lot of success over in Holland and a lot of players from South America have gone to Holland. I mean in the past like Romario and Ronaldo played there, Louis Suarez played there. And you know Brands brought Herving Lozano to PSV as well. Obviously the Mexican winger who Everton have been heavily linked with as well went there and was excellent last year. So it's a market that is untapped by Everton. Apparently Steve Walsh was looking to do it too. But Everton have got Chief Scout Martin Gloveries apparently being out to Argentina on some fact finding trips and looking at a couple of players in that league. So you know to the case of looking there, Mexico, Brazil, Bolivia, those kind of places, Uruguay. Because there will be good players there and players that can improve. And the whole thing will be trying to pick up obviously the next Messi or Neymar of course. But you can still get good, very, very good footballers there as well. So you know we need to be looking all over the world now don't we? It is a global game. Talking of players coming in, William Carvalho, the link is obviously very strong. Marco Silva has been in Portugal this weekend to see his family might have gone and had a meal somewhere as well while he was there and bumped into people who knows. But William Carvalho, Gelsa Martins and Fernandez as well. That is what has been all Bruno Fernandez. All apparently looking to terminate their contracts with the club. That is what the Portuguese press is reporting this evening. So they could all be available for free now ever and have been linked with Martins and Carvalho. Obviously we don't know how this is going to play out. It's going to be great business to get them for nothing. Obviously give them big signing on fees. But it's going to be, you know, obviously it will be protracted in terms of can they leave their club for nothing. Obviously there's a lot in the news about that club and about the owner and disagreements with them. And obviously fans attacking them as well as contributed. But from an evident perspective it would be great to get those players in for nothing. Talking about instill, Everton have been linked with a move for James Madison. The Norwich City and England under 21 player. Looks a very, very good player. Everton reportedly had the list, had the queue for Madison. So it will be again a wait and see. I think obviously we've heard about them trying to get players out of free up the ways. So it's going to be interesting to see whether we do go for them. He fits the type of player that Marcel Brands and Marco Silva want. Looks a really, really good football. A very, very talented. So it would be great if we could maybe bring him in to the club as well. Job and Pickford has been linked with a move from Manchester United. Whatevs. And Alan Stubbs, the new State Mirror manager has spoken about using his links with Everton Football Club to get some of our youngsters in on loan up there. Give them that experience but also to help St Mirren develop as well. And that would be quite a good link up because obviously there would be a link then from the 23s up to St Mirren if you could get a couple of players up there who are not really developing as much as you would like them to do in the 23s and put them up into the league which will be competitive and give them the opportunity to play in front of the crowd and things like that. So it could be a nice little link up we need a couple more of them because obviously you're always trying to give you under 23 players the next step before seeing whether they're going to be able to make it in the Premier League or not. So who knows, we'll have to wait and see on that as well. And that's about it. So make sure you subscribe to Toffy TV if you haven't done so already. If you want more videos, join us on Patreon. See you soon on Toffy TV.


So a lot of people have been asking me, Robby, Robby, Robby, Robby, how do you do what you do and how did you grow the Instagram to 5,000 followers in just a month. Well, it's actually really, really, really, really easy and really simple and I'm surprised nobody actually talks about it because it's so simple. But how I did it, I simply downloaded this app, you can also use it on your computer called Crowdfire and this isn't like an affiliate chat, I don't have a link to it or anything so you know I'm speaking truth, man. And you just download it or register, it's about $5 per month and basically it allows you to remove users that you follow but are not following you back. So what this means is that you can start adding a lot of people, by the way I'm hiding the wind, funny solution, hope it helps when I look at the video later. And you basically unfollow people that are not following you. And this way what I do is I have a reminder pretty much every hour to unfollow about 90 people pretty much as much as it lets you. It actually has a mechanism in the app in Crowdfire where you can't do more than like 80 or 90 per hour.  So Instagram doesn't have any problem with manual removes, it has a problem with automatic additions and removals. So you just remove every hour, every second hour as many people as you can until it tells you that you can't do anymore.  And also after removing people you go to Instagram, you go to profiles pictures of people that have similar followers of similar interests. For example I went to Grant Cardone, Tai Lopez, Gary Vaynerchuk, people who kind of are going to relate with my content as well. And I simply add as many people again as I can until Instagram stops letting me. It doesn't mean it gives me like a message that I can't, it just means that it literally you press on it and you can't add anymore people.  And yeah that's literally how simple it was to get to 5,000. And what happened about a week ago, about a week ago, what happened about a week ago was that I added too many people. So I added people until Instagram you know stopped letting me, meaning I pressed on the button and nothing happened. And then instead of waiting for like an hour or two hours I just waited for like 15 minutes and I got greedy and I tried to do it again.  So I should have been right now instead of being at 5,200 people I should have been at like 6,500 probably. I learned my lesson so yeah as long as you don't go overboard meaning that you once Instagram kind of stopped you from adding more people as long as you actually wait an hour or two you'll be fine. And that's pretty much the only way that you can kind of do this wrong if you don't wait at least an hour. Yeah and it works I mean and potentially you can get to like 10, 15,000 easy in like two months which is what I'm planning to do.  I mean I feel like it and watch my other videos.


The National Chairman of the All Progressives Congress, A.P.C. Abdullah Higanduje says the party remained resolute in the face of a court ruling on the A.P.C. candidate for the Bialsa State Governorship Election. He made this known while speaking to statehouse correspondents after a private visit to the presidential villa Abuja. Recall that Justice Donato Zokorovo of the Federal High Court Abuja disqualified the A.P.C. candidate in the November 11 gubernatorial election chief Timipre Silva. Justice Zokorovo ruled that Silva having been sworn in twice and ruled for five years as governor of Bialsa State would bridge the 1999 constitution as amended if allowed to contest and eventually win. However, Ganduje agreed we are short party members and supporters that the setback resulting from the judgment would not deter the A.P.C. from its preparations for the upcoming election in Bialsa. It's unfortunate that a judgment but we can say that it is democracy in action but we learned that the person who took the issue to the court of law is not even qualified because he did not contest with Silva. Therefore, he is not even qualified for him to take the issue to the court. However, we are appealing, we are waiting for the judgment and then we appeal for on that issue. Well, we last two weeks I was in Bialsa for two good days and I think they were ready and they are still ready to win the election. Therefore, this is a little destruction anyway but it will overcome it. We believe the appeal court will give us positive judgment but that will not stop us from making arrangement for the forthcoming election which is coming up on 11 November 2023. The A.P.C. national chairman also called for calm among party members highlighting the individual who brought the case to court may not have been qualified to do so. As they did not contest against the A.P.C.'s candidate Silva in the original primary election.


France claimed their first Grand Slam and Championship title in the nation since 2010 as they beat England 25-13 on Saturday, March 19, after passing a test of nerfs in the contests that largely dominated at the Parc Steady de France. They were on Gatley's side, showed their brilliance in an opening half, although some port passing and handling kept England in the game until the hour. Lise Blues prevailed through his ties by Guilet Fico. France Heels Cross and Antonio Dupont, with the rest of the points coming from Maven Germin's Boats to finish the Championships on 25 points, four ahead of Irand in the year before France host the World Cup. England answered with a try by Freddie Stewart and kicks from Marcus Smith and were too limited to be a credible threat as they ended up a third on 10 points and three defeats.


Zulu women are some of the most remarkable women in Africa. They are known for their incredible strength, both physical and emotional, and their unwavering commitment to their families and communities. Zulu women are natural caretakers, taking great pride in their roles as mothers and wives. Zulu mothers are known for their nurturing nature. They provide a warm and loving environment for their children to grow up in. Zulu wives are incredibly respectful and supportive of their husbands. They understand the importance of their roles as partners and helpmates. Zulu women are also incredibly hard-working and enterprising. They are not afraid to roll up their sleeves and get their hands dirty to provide for their families. Zulu women are savvy business women, using their skills and resources to create successful enterprises and support their families. Zulu women are also known for their natural beauty and feminine features. They radiate confidence and grace, even as they carry out their daily tasks. Zulu women are also deeply connected to their culture and traditions. They honor their ancestors and celebrate their heritage through song and dance. Zulu women are the solid pillars of the family structure. They hold their families together through thick and thin, providing love, support and guidance to their children and spouses. Zulu women are the heartbeat of their communities.  Zulu women are a true inspiration, embodying the very essence of what it means to be strong, caring and resilient. They are the unsung heroes of Africa, and we are all blessed to have them in our lives.


As many Victorians prepare for summer and make plans to see our beautiful state, we can't forget the devastating effects of fire if we aren't vigilant. A quarter of the summer bushfires our brigades have responded to in the past 10 years were caused by escape private fires. These are things like burn-offs and recreational fires like campfires that weren't properly extinguished or were left unattended. Warm and windy conditions see these fires not only escape but could spark a bushfire. Before lighting any fire this summer it's your responsibility to check fire restrictions and weather conditions, not only for the day of your fire but the days thereafter. Ensure it is monitored by an adult and you have plenty of water to extinguish your fire. It's your responsibility to plan and prepare for fire this summer.


The Mutual Broadcasting System in cooperation with Family Theatre Incorporated presents The Melancholy Clown starring Lionel Barrymore and Dean Stockwell. Your hostess, by transcription, Lisbeth Scott.  Here is Lisbeth Scott. Wouldn't it be wonderful if there was a simple solution to every family problem? Day after day we hear families breaking up through separation and divorce. And it seems so tragic that men and women who once pledged their love until death do us part now cannot live together in peace and harmony. That so many children are torn between two homes and end up with no real home. Yes, what we need is a magic formula to make family problems disappear. Well, we of Family Theatre can offer no magic. But we do have a solution to family difficulties that is simple and effective. It is family prayer. Pray together each day as a family for the help you need. Bring God into your home. And discover for yourselves that the family that prays together stays together. Lisbeth Scott returns following this week's Family Theatre play. A true story taken from the life of one of the greatest men of the American Theatre. Our stars Lionel Barrymore and Dean Stockwell. It was a hot July night in Manhattan. From the windows of his penthouse in the Gladstone, a regal white haired man looked down on the bright lights of Broadway glittering like a handful of spilled diamonds. Lights that in the years gone by had proclaimed him to be one of the greatest figures of the theatrical world. With a slight smile, he turned toward the drawing room, then stopped short to stare at a young man seated gingerly on the edge of an ornate guilt chair. You, get up off that chair. Mr. Belasco. That's the chair the first empire cost me a thousand dollars. It's not meant to be sat on. I'm sorry, sir. No, my secretary says that you've been waiting to see me. Yes, sir. I'm O'Brien from the Manhattan Daily, and I... Oh, yes. You want an interview. The call was interviewed. Well, you see, sir, this being your birthday... But they... So it is. I was born more than 70 years ago today in San Francisco. Haven't been to San Francisco? Yes, sir. I keep thinking someday I'll go back. It'd be like being young again. Well, sit down, Mr. O'Brien. On something else this time. Yes, sir. I thought, sir, we might work out a story along some unusual line. My dear fellow, everything about me is unusual. Don't you know that? But everybody knows your career. David Belasco, the greatest showman since Barnum. Barnum was a circus man. I'm of the theater. I could write about the plays you produced and written. Girl of the Golden West, Madam Butterfly. Or I could write about your white hair with that unruly forelock.  You're a very perceptive young man. And I could say you date the era when Keystone met a cop, not a movie camera. And I could remind my readers that you discovered an unknown young actress named Gladys Smith and rechristened her merry picture. The most famous of them all. But what I really want to write about is none of those things. Well, then, why did you come to see me? Like I said for a story. But while I was waiting, sitting here on your $1,000 chair, I started looking at your antiques and at that curio cabinet. What do you want me to tell you? I want to know why you collect toy elephants. My boy, you've hit upon a story. A story I've never told anyone in all these years. But I'm going to tell you now. It all started with this little elephant. It's made of teak. Brought from China in a clipper ship. Its story is like the first act of a play. And I... I was the actor. I was only 11 years old when it began. The time was shortly after the war between the states. Place California.  Picture the scene. It's early evening.  Circuit wagons. And dominating the scene, promising all the magic wonders of the title from lion tamers and clowns, is a huge brown tent. The big top.  What have we here? Gee, Cos, mister. Are you a real honest-to-goodness clown? Honest-to-goodness. Oh, gee. Crawl through the flap, didn't you? Yes, sir, but gee, you're not going to turn me in, are you, mister? I mean, I came all the way from... You ran away from home to join the circus, eh? Yes, sir. What's your name? David. David what? Just David. Hey, what's going on here, Walter? Oh, kid. Oh, this is David, Mr. Morgan. Mr. Morgan owns the circus. We don't give no free tickets for watering the animal, son. You beat it right back outside and buy away in just like everybody else. Oh, I don't think you understand, Mr. Morgan. David has come to be one of us. I'm going to join the circus. You're what? Look, kid, I'm a busy man. Are you beat it or I'll call the sheriff? Crawling under the tent right here, you might have stampeded the elephants. Oh, I don't think so. Elephants love small boys. Who else feeds them peanuts? What are you getting at? Only this morning I was saying to myself, looking in my mirror while I was making up. Walter, I says, wouldn't it be nice if some small boy should run away from home to join the circus today? I'd have just the job for him. To be honest, Mr.    The best clowns are the melancholy clowns. Look, David, how would you like to be a junior clown in my act? Oh, clown. Do you really mean it? Yes, I mean it. I've been looking for a little boy like you for a long time.  All right, I'll pay him out of my salary.  And that's how David Bellasco, aged 11, joined the circus. Walter Kingsley was a kind man. He knew all the magic things the little boys dream of, and he made my dream come true. After we ate, he made a costume for me, baggy pants with a patch on them and a torn shirt and a red bandana tie on the end of a stick. A miniature of his own outfit. We were a success from the first appearance. Thanks, Mr. O'Brien. It had been Walter's idea, but Walter had to watch Morgan rake in the money, and he had to watch me get top billing. But Walter just smiled that sad smile of his that never reached his eyes and went on teaching me all he knew. Oh, I'm afraid we'll get wet going from the wagon to the big top, David, and I'll be careful. Don't smear your makeup. Yes, sir. Now, remember, when we get inside, just shuffle along like I do, and look up at the crowd and pick out somebody and stare at him and look very, very sad. Yes, sir. You feel all right, son? Sure. I just guess I'm cold. Hey, what's holding you up? We're ready. Well, look here, I don't think David had better go on, Morgan. He doesn't look good. He looks all right to me.  I'm fine. Honest, Walter. All right. I just want to take care of you. That's all. Are you coming? Yes, yes, we're coming. David, you were great. You were a natural. Thanks, Walter. 16 towns, 16 one-night stands, and they call us back for encores. We're a success, David. Hey, something wrong? I feel kind of funny. You got wet. I should never have let you go on. My hair. Hurt somewhere, huh? You got it. You got a fever. I think I'm sick. David. Morgan! Somebody get a doctor quick! Same thing here we do in San Bernardino tomorrow. Poster's already up announcing your act. The kid has to go and get sick. Probably got a bellyache from too much candy. Well, the doctor says he has the fever and it's bad. Fever? Well, I'll be...  You better turn him over to the sheriff or the church or somebody and pack your stuff. We're shoving off in half an hour. We're not going to desert the kid and that's final. Then you're fired and that's final. Sometimes now, Mr. O'Brien, when I look back on those days, I know that Walter Kingsley was the best friend I ever had. He gave up his job for me, found us some rooms in a cheap hotel, used his savings to pay for doctor and medicine. And when his money ran out, he put on his clown suit and his paint and smiled his sad smile and worked the streets and the saloons for pennies and food, anything he could get. And at night he slept on the floor beside my bed. But I never knew it. In fact, I didn't know anything until four weeks later when I waked up to see a familiar face bending over my bed. Oh, Father. Hello, son. Am I home? No, but I've come to take you home. How did you find me? Well, the conductor on the Santa Fe train remembered the little boy who paid his fare with pennies and then when I came across those circus posters advertising the boy clown David, well, I picked up the trail. I was a real clown, Father. Walter made me a suit just like his and made Mr. Morgan give me a job and he said we were a success. I know. Walter's off a good, Father. Where is he? In the next room. Is something wrong with Walter, Father? I'm afraid so, David. He took the fever, too. He's sick. Oh, I got to see him. Father, he's going to be all right, isn't he? I don't know. Here, I'll carry you in to see him. David. Gee, Walter, you're going to get well, aren't you? You've got to get well. Sit here beside me, David. I've got something to tell you. Sure. I'm glad your daddy found your son. I want you to go back home with him. Go to school and learn and read. But aren't we going back to the circus? The circus is no place for you, David. You have a great talent. You're meant for bigger things. Once I thought I was meant for bigger things, but... What things, Mr. Wald? I wanted to be an actor. A great actor. All my life, I wanted to go on the stage to play the great roles. And more than anything in the world, I... I wanted to play Hamlet. But instead, I became a clown. Just a melancholic clown. You didn't like the circus? No. David, I'm going to give you something. Something to remember me by. Me and the circus. And when you look at it, I want it to remind you that you've been given a great talent. And you owe it to God and the world to develop that talent. To share it. To create great art. Here. Here, my boy. It's... it's an elephant.  It's carved out of teak wood. It came from China on a... on a clipper ship a long, long time ago. I always liked it. Now I... I want you to have it. But won't you need it? Won't you miss it? No. No, son. I won't miss it anymore. Walter Kingsley died. I lost my best friend. But I never forgot him for what he said to me. This little teak wood elephant has reminded me for 60 years that once a man gave his life for me. Well, Mr. O'Brien, I never forgot my promise to Walter Kingsley. I went back home with my father to San Francisco. For 30 years I read Shakespeare in front of the mirror and recited Kipling in the backyard. Youngsters in the neighborhood used to come over to listen. I was determined to become an actor. And finally, what with running errands and doing odd jobs, I saved enough money to take elocution lessons from one of the actresses at Maguire's Opera House. Her name was Nellie Holbrook. She used to come over to our house on Thursdays to hear me read. That's good, David. But remember, we must use our lips like this. We enunciate each word. Yes, Miss Nellie. Now, I've got a surprise for you. What kind of surprise? Read this advertisement. Let's see. Announcing the presentation shortly of the great sensational military drama of the Lion of Paternia, with banjo solos in between the ads. Maguire's Opera House. Is the surprise a ticket? Oh, more than that. It's a role in the play. Me, a real part with makeup and lines and everything. And a costume. Oh, gosh, how did you ever manage, Miss Nellie? I'm playing the female lead, and I persuaded Mr. Maguire to let you read for the role of the baron's son, young Percy. The baron's son, royalty. First rehearsal tomorrow afternoon at three. I didn't sleep at all that night, Mr. O'Brien. I lay awake and stared at the ceiling and said my one line a thousand different ways. When we opened in the Lion of Paternia three weeks later, it was the most exciting evening of my life. Maguire Opera House was the most important theatre in town. It was magnificent with candlelit chandeliers and fashionably dressed fertilizers from Nobile. And up in the gallery in the cheap seats, my mother and father and their kids from the neighborhood all dressed in their Sunday best. I didn't come on till the second act. And I was getting pretty nervous by the time Tom Maguire announced the second curtain. I'm going up, curtain going up. You ready, Nellie? Yes, Tom. And the kid? Yes, sir. All right, curtain. We're on, David. Odd. Oh, my dear, Percy. What do you think has happened to His Majesty's ships? Perhaps, dear mother, the stress of the weather... Hang up! ...from the coast. David, what's the meaning of this? It's the kids' Benny and the rest from home. Well, what then thunders the meaning of this outrage? I'm sorry, Mr. McGuire. Sorry, do you realize you've ruined the entire production? That I'll have to refund every ticket in the house? But, Mr. Maguire, I couldn't help it. I didn't know Benny would yell at me.  You're fired. You can fire me, but someday I'll show you, someday I'll be the most important man in the American theater. Why, David Belasco, such utter conceit! Mr. Belasco, do you mean to tell me that really happened? Yes, Mr. O'Brien. At my first appearance on the San Francisco stage, I can truthfully say I brought down the house, as well as the wrath of the producer. But what a prediction to come true, the most important man in the American theater. I wasn't as brave as I sounded. I sneaked out of the stage door like a whit puppy. I vowed I'd never set foot in a theater again. Oh, I had some wild dreams that night. But in the midst of them, I put my hand in my pocket. And I touched the little teakwood elephant, and I remembered what I had promised. I was going to be a great actor. I was going to work hard. I was going to justify a man's faith in me. I went back to McGuire's opera house. I've come back. What do you want? I want to talk to you, Mr. McGuire. I've got to talk to you. Well, so long as it don't cost me nothing, talk. I want to say I'm sorry about tonight. But honest, I didn't know they were going to yell at me. And I'm sorry about the way I spoke to you, too. I guess I wasn't very respectful. Is that all you wanted to say, David? No, sir. What else? I want you to give me another chance. Why? Because I want to be an actor. I've got to be an actor. It's all I want ever. Someday I want to play Hamlet. Never happen. Take a skinny fellow to play Hamlet. Well, I'll grow up to be skinny. I'll do anything. Would you sweep up the stage, David, and run errands and copy parts? Yes, sir. And about to play Young Percy. Well, we're only running a week. I guess you can play the part. Oh, gosh. Thanks. Thanks a lot. But just one thing. No more little boys in the balcony. Yes, sir. I promise. And that's how I got my start in the San Francisco Theater, Mr. O'Brien. I worked for several years for McGuire. Then I acted and wrote and produced plays myself. And one day I came to New York. The rest is theatrical history. Well, Mr. Belasco, I... Wait. This program here on the floor. Well, it must have fallen out of the cabinet. Thomas McGuire presents Hamlet, Prince of Denmark, at the McGuire Opera House. Yes, yes, yes. I never was quite skinny enough, but I did play Hamlet in McGuire's opera house. But the program doesn't list your name. In fact, it says the part of Hamlet is played by Walter Kingsley. Yeah. I took that name for the opening night. But why? I was remembering a little boy who ran away to join the circus. An emellantly clown who wanted to be an actor. I like to think that, after all, Walter Kingsley did get to play Hamlet. This is Elizabeth Scott again. You know, when I first heard the story of David Belasco's early days, it struck me how easily he could have become a juvenile delinquent. His whole life might have been different had he not found a home under the big top of the circus. Yes, a circus tent can be a home. And a melancholy clown can be the best kind of father. If he realizes what a boy needs, someone to talk to, someone to make a hero of, someone to imitate and love. Every child has a right to expect these things in his own home. Every child has a right to find love there and understanding and the example of parents who believe in God and pray to him daily. We at Family Theatre urge you to begin today in your home the practice of daily family prayer for the family that prays together stays together. Thank you for being with us. God bless you. Our grateful thanks to Lionel Barrymore, Dean Stockwell and Elizabeth Scott for their appearances and to Beth Barnes for writing our play. Original music was scored and conducted by Max Tehr. This production of Family Theatre Incorporated was directed by David Young. Brief portions were transcribed. The supporting cast included Alan Reed, Herb Rollinson, Virginia Greg, Ken Christie, Joe Thompson, Charles Maxwell and Alan Reed Jr. This series of the Family Theatre broadcasts is made possible by the thousands of you who felt the need for this kind of program and by the mutual broadcasting system which has responded to this need. Be with us next week at the same time when Gene Cagney, Bula Bondi and Don McNeil will star on Family Theatre. Your announcer, Meryl Ross. This is the Mutual Broadcasting System.


All right, thanks for the introduction. And this would be a blockchain-less talk. So the title of my talk is Attestation as a Service, all which neatly abbreviates to S. But before we go into technical details about security of trusted execution environments and attestation protocols, let's start with some basic philosophy. So if a tree falls in the forest and there is no one around to hear it, does it make a sound? Does it even matter? Do we care? Well, I would hope that the owner of this car actually cared that the tree fell on it. But it depends on context, right? This tree actually made a sound when it fell. I hope so, at least. OK, so now that we've graduated basic philosophy class, let's talk about security. If a machine was hacked somewhere in the darkness in someone's basement and there is no user data on it, does it matter? Should we care? Well, again, it depends on context. Because every SGX capable machine can actually access a prized asset, an SGX private key, also known as EPID key. But never fear Intel has assured us that these keys are carefully guarded and one simply cannot access an SGX key easily. And these keys show never you leave the confinements of Intel CPUs. Well, some things even Intel cannot protect against. And you might have heard last week at Usenix we presented Forshadow. Forshadow is a speculative execution attack against Intel hardware. It breaks protections and security boundaries enforced by virtual memory. It has applications to virtual machines. And one virtual machine on the cloud can read another virtual machine on the cloud. But it also has implications on SGX. It can basically dump any data located in SGX address space. And we can roughly dump 100% of the data 100% of the time up to measurement errors. And in case you're all wondering how does this seem in practice and how hard is it to do, well, let's start with the demo. I've initialized here an SGX enclave. I've hid a super secret string at this address. I can dump the entire memory space. But it's much easier to analyze demos when you know where the interesting data is. So it's in this address. And when I try to simply read it and simply access it, I get 0xff, which is SGX protection mechanism, also known as a page semantics, because one cannot simply just access SGX memory outside the context of SGX. That's how it was designed. That's what it does. But when we try speculative execution, and most specifically for shadow, this is what happened. And this is our super secret text taken from Intel Security First pledge. Well, they'll happily tell you that Intel Security has been one of the highest priorities in the four years of building security for every product they create. Well, that's a combination of a licky micro architecture and speculative execution. That's what happens. Ah, and we even have a measurement error, so you see that I did it live and I wasn't lying. OK, but now that we have the capability of dumping SGX memory, what do we do with this? Why is this useful? Well, we can go ahead and use this capability to steal EPID private keys, which are located inside every SGX-capable machine. But what are the security implications of somebody getting his hands on an EPID key? Well, to do that, I have to bore you a bit with SGX attestation. So we have a usual delegation scenario. We have the client, we have the cloud. The client would like to delegate some computation to the cloud. And the cloud would like to prove to the client that it is running genuine SGX hardware. So how do we do that? Every SGX machine has a key inside it. And the client, the cloud takes the computation, give into it by the client, hashes it, and then uses special SGX instructions to sign it, producing what's known as an attestation quote. That quote actually acts as a proof that this computation is being run on a genuine SGX machine. This quote is given by the cloud to the client, who cannot verify it by itself, but he takes it to the Intel attestation server, which gives us back a OK. And together with the client and send his session key, we establish a joint key, and then the client can communicate to the enclave running on the cloud, securely, with this command-derived secret. Now, the key taker, a message of this entire slide is that the security of this entire attestation protocol is based upon the fact that nobody can access an SGX private key, except genuine Intel hardware under some conditions using SGX instructions. OK, well, we got our SGX key, but so what can we do with it? Well, to do, to understand that, I need to dig even deeper into the SGX enhanced privacy ID group signature. It's a group signature, and it has an epic feature, privacy. It's unlinkable, which means that nobody can tell who signed what and how, and you cannot link a signature to its public key or to the identity of the signing, which basically means that if we have this red guy here that signs something, nobody can distinguish between it and its surroundings, and nobody knows who signed what. Unfortunately, with enhanced privacy comes enhanced responsibility, because even a single extracted EPID key can be used to forge signatures for millions of machines without anybody being able to distinguish between signatures made by the attacker and genuine signatures made by SGX machines, which basically means that one compromised key erodes trust in the entire SGX ecosystem.  It's a Twitter bot that would attest to anything you tweet at it. It's reduced the cost of the attack, since you don't know what you need to own an SGX machine. We'll need it for you, and we extracted the key, and we put it available online for public service. Your identity is protected by the privacy of the EPID protocol, because nobody can say who signed with what key. Currently, it returns group out of date because Intel had issued a patch against original foreshadow, which means that we need to update our machines, which we haven't done yet. So if you take out the stations to Intel's server, you get a group out of date, meaning we have to update. Unfortunately, or perhaps not surprisingly, despite weeks of advance notice, the keys are still not revoked. So these keys are still out there, but unfortunately, I just heard 10 minutes ago, we got blocked by Twitter because they're worried about the security implications of this entire business again. And if you cannot rely on Intel to revoke SGX keys, well, at least I hope you can rely on Twitter to defend the security of SGX.


Major League Baseball is somewhat unique among sports leagues in that its teams are divided into two groups that actually play under different rules At least with regards to one position at least for now Although this may change in the very near future at which point I'll have to remake this video and convert everything to the past tense There are a lot of arguments over this topic which go back decades But I'm certain we'll be able to settle this debate by the end of this video The MLB is divided into the American League and the National League both of which have 15 teams teams in the American League or the AL have one player each game who they designate to hit for the pitcher in that game This guy is called the designated hitter or more commonly the DH because who has time to say two whole words as You may or may not know and I'll assume you don't know because you're watching this as pitchers make their way up to the major leagues They spend all of their time focused on pitching and not so much time focused on hitting so way back even in the early 1900s some people were tired of watching their pitchers suck so much at hitting that they figured that another player should just bat in his place and So in keeping in line with the pace at which baseball usually addresses their issues 70 years later in 1973 the DH was born the AL and the NL were much more independent of what another back then than they are now so it was only adopted in the AL which has kept it all this time and Despite coming close in the past the NL has held out and continues to make their pitchers continue to hit even though They are all still garbage Of course there are times now such as in early games where an NL and an AL team play each other Which they didn't do in the 70s and of course there's the baseballs championship the World Series and In all of these games whoever the home team is determines whether or not the pitcher hits If the game is at an NL park then he hits if it's at the AL teams field then he doesn't so what exactly is all the controversy here I mean does letting one guy hit instead of another guy like four times a game actually make that big of a difference And it kind of does So first let's actually look at the numbers. How bad are pitchers at hitting? We're gonna look here at the stats from 2019 instead of 2020 because it was all kind of messed up So as baseball reference tells us the average baseball player in the entire major leagues on base percentage was 323 and we'll use OVP here rather than batting average because we're not heathens. So the average DH Was at 328 while the average pitcher was a distant last among positions with just a 159 OVP Slugging was a similar story with 455 compared to a tiny 163 So DHS hit 474 home runs while pitchers hit just 25 and while pitchers had half the number of it bats throughout the season Even if you double those at bats to make things even DHs are still hitting nine times the number of homers That isn't to say that more home runs is inherently better or that there aren't pitchers who can't hit at an okay level But it's clear that there is a major gap in hitting between Pitchers and DHS are really pitchers and everybody else for that matter So let's actually look at the arguments for both sides here. Although full disclosure I am pro DH, but hopefully I can explain the reasons on both sides well enough There's an old saying that if you don't play in the field Then you don't hit in essence saying that everyone has to play both offense and defense as is the case for most sports After all it's not like James Harden just plays offense and then he doesn't After all it's it's not like LeBron James doesn't play offense and then not defense Perhaps the biggest anti-DH argument is that not having a DH will Also force a manager from time to time to make a tough decision This situation will arise when a team has a pitcher who is pitching well But then when they're on offense his team starts a rally and gets a few guys on base The manager will need to decide here when it's the pitchers time to bat Do you pinch hit for the pitcher and send a better hitter to the plate? Increasing your chances of getting a few runs or do you send your horrible hitting pitcher to the plate? So that no matter what happens at least he can stay in the game and pitch the next inning With the DH this never happens the manager never has to make this call Now my personal counter argument to this one is that in today's game Teams have so many pitchers and there are so many pitching changes that it's rare that you'll need to be so Conservative with pitchers that it's not worth it to pull a guy now late in an extra inning game where lots of guys have been used or Even early on when it's between sending a starter back out for the sixth inning or something then sure and perhaps in the lower Levels it would be a bigger deal, but I just don't see it happening enough in the majors for it to bother me Are also a couple arguments that could kind of go either way The first is that having or not having a DH makes a difference in the way that you might choose players and construct your lineup AL teams need to have an extra player beyond their typical starters who can hit well Whereas maybe NL teams are able to have Subs off the bench who are better at defense Obviously it would be nice to have someone who can do both, but typically you're gonna have to pick one or the other It is less likely nowadays than it used to be for teams to have one guy who is their everyday DH Instead they usually just opt to give guys a break from the field every few days and rotate the DH around from player to player The other one is that the DH will inevitably Lead to more runs being scored because they are better hitters, which you may or may not like Now personally my argument in support of having the DH comes down basically to one thing when I watch baseball I want to see the best pitchers face the best hitters by removing the DH. You are making a pitcher hit While you force someone else who you know is a better hitter to sit on the bench Like could you imagine the Red Sox sending Tim Wakefield up to bat while David Ortiz just stood there in the dugout During their World Series run in 2007 or 10 years later how many fewer runs with the Astros have scored if their pitcher had had to Never mind Now I understand that there is the occasional pitcher who can hit and in this case He should be able to hit for himself as I record this this actually just happened last week For the first time in 12 years, which just shows how rare that it is So hopefully if you didn't when this video started you now understand a little bit more about the DH and the controversy that follows it If you don't like the DH however I have some bad news because I feel that a universal DH that is having it across the whole league is likely inevitable But not for anything that we've actually talked about so far as with most things it basically comes down to money For players to have an extra position will increase the value of that one guy who is the obvious DH choice or Increase the value of a few guys who are on the edge between starter and bench warmer Who will now have an everyday DH roll to fill? It is a benefit when contract negotiations roll around to be able to point out that they deserve a bigger check Because teams now have an extra position to fill on the other hand The AL has had the DH since 1973 and people have been saying that the NL will adopt it any year now ever since and they never have Done it so who knows if it'll happen I'd say it's probably just about as predictable as whether or not a pitcher will get a hit


Hi and welcome to the session. Today we will discuss the following question. The question says the area of a trapezium is 34 centimetres square. In the length of one of the parallel sides is 10 centimetres and its height is 4 centimetres. Find the length of the other parallel side. Before proceeding for the solution let's recall area of a trapezium. Now area of trapezium is equal to half into sum of parallel sides into height. The key idea for this question. Now let's see its solution. Here we have a trapezium. Now in question we are given that the area of the trapezium is 34 centimetres square. So area of trapezium is equal to 34 centimetres square. Also the length of one of the parallel sides is 10 centimetres. Length of one parallel side is equal to 10 centimetres. Let's say this side is 10 centimetres. Now height is 4 centimetres. Height equal to 4 centimetres. Here the height is 4 centimetres. Now we need to find the length of other parallel side. So let us assume it to be x. Let the length of other parallel side equal to x centimetre. Here in figure let this length is x centimetres. Now substitute all these values in the formula of area of trapezium. So we have area of trapezium that is 34 centimetres square equal to half into sum of parallel sides. Length of one parallel side is 10 centimetres. Now length of other parallel side is x centimetre into height and height is 4 centimetres. Here 2 and 4 will get cancelled by the common factor 2 and we will get 34 equal to 2 into 10 plus x which gives 34 equal to 20 plus 2x. Now subtracting 20 from both the sides we will get 34 minus 20 equal to 20 plus 2x minus 20. So here 34 minus 20 is equal to 14 equal to and on right hand side 20 and minus 20 will get cancelled and we are left with 2x. Now dividing both the sides by 2 we have 14 upon 2 equal to 2x upon 2. Now 14 and 2 gets cancelled by the common factor 2 and here 2 and 2 will get cancelled. So we get 7 equal to x therefore length of other parallel side is equal to 7 centimetres. And thus 7 centimetres is a required answer. With this we finish this session. Hope you must have enjoyed it. Goodbye and take care.