All right, so let's start. So we are in the SICK API machinery talk today. And we have two speakers. It's Abu, who's here, and Mike Spreitzer, who prepared a video which Abu will play. And it's about protein fairness. And for those of you who have no idea what this means, a few years ago, when we didn't have that, one controller could basically kill the API server by sending too many requests. And basically, we depended on client-side throttling to be configured correctly. And we are in a different world today, 2024. And the work for that is basically in protein fairness. And this feature is equipped with the API server. And Abu and Mike are the ones who have basically pushed that and implemented that. So let's welcome Abu. Thank you, Stefan. Hello, everyone. Welcome to the IP machinery SICK dip dive. So Mike couldn't be here in person. We have a prerecorded video from him. So I'll start by playing his video. Spreitzer here to give you a brief overview of the API priority and fairness feature in Kubernetes. This is a feature in the API server and in the generic API server library that we use to build similar API servers. This feature regulates the load of the API server in terms of the number of requests that is active as serving at a given moment. The purpose of this feature is to protect the API server from the clients and to protect the clients from each other. This feature is based on attributes of the requests that participate in authentication and access control, so that it cannot be easily fooled. This feature, thus, is taking into account both the request rate and the time it takes to serve each request, because the product of these two is, on average, the number of concurrent requests. This is one-dimensional regulation. This is an approximate technique. It's a good approximation, and there are a few tweaks to make it better, which we'll see later. This feature replaces the maximum flight filter, which is an earlier filter, that is simpler. It reclassifies each request into one of just two categories, mutating or read-only, and treats all requests of a given category at the same. APF is more granular. It's also configurable, and it introduces queuing, and APF introduces some fairness between clients. Like the maximum flight filter, APF rejects requests using, in the standard HTTP way, which is the status code 429. Let's look at where the APF feature fits into the API server. Steph Eschermanski gave a good talk a few years ago at KubeCon about the overall structure of the Kube API server. Here, we're just gonna think about the chain of handlers, so-called filters, that do some general purpose processing of each request on its way into the server. The APF filter starts by doing classification. For each request, this determines the priority level that the request belongs to, and puts the request into one of the queues at that priority level. Each priority level has a certain number of queues that it is configured with, and has a dispatcher whose job is to take requests from the right queue at the right time, and send them on for further processing. In a way, it keeps the server as busy as requested, and allowed, but no more so, and do so in some fairness. Let's look at request classification. This starts with configured objects called flow schemas, that say how requests are to be classified. Each flow schema has a name, having numeric matching precedence, which is used to put the flow schemas in an ordered list. Classifying request consists of, starts with comparing each request to the flow schemas in order, to find the first one that matches. Each flow schema is configured with some matching rules that say which request matches. The result of this is two things. One is it says which priority level the flow that request belongs to, and the other is it classifies the request into a flow. In other words, for each priority level, the requests are classified into flows. A flow is identified by a pair of strings. The first string is the name of the flow schema that the request matched. The second string is extracted from the request, according to a rule, which is a choice that the flow schema is configured to make. A flow schema can make one or three choices. One is that the second string in the flow that a fire can be the name space of the object that the request will act on. Another choice is that the second string will be the name of the user in the issue request. The third choice is that the second string will be the empty string. The flow that a fire is input to shuffle string, which he used to put the request into one of the queues in the priority level. A priority level is configured with a fixed number of queues and a so-called hand size, which is the size of the subset of the queues that will be considered for a given request. Shuffle sharding will use the flow identifier as a source of random event tree to make a pseudo random choice to pick that subset of queues. The request then gets put in that subset that has the shortest length. So you see there is a distinction here between the number of queues and the number of flows. The number of flows is not so well controlled. It is dynamic and it can be quite large, impractically large to service the number of queues. Shuffle sharding is a technique for mapping a large number of flows onto a small number of queues in such a way that any one or few big flows do not crowd out the other flows. Now let's look at dispatching. Each priority level has a current concurrency limit. That is roughly the maximum number of requests that the server can actually be working on at a given time of that priority level. These are based on nominal concurrency limits. The nominal concurrency limits are derived from server capacity and configured concurrency shares. Each priority level is configured with a number of nominal concurrency shares. The server's capacity is divided amongst the priority levels in proportion to their nominal concurrency shares. These nominal concurrency limits are a baseline that is then tweaked periodically by borrowing to produce the current concurrency limit. The purpose of borrowing is to allow a relatively lightly loaded priority level, a level that is lightly loaded at the moment, to be able to lend some of its concurrency to other priority levels that are heavily loaded at the moment. Each priority level is configured with a number of queues and there is a dispatching algorithm that is inspired by the fair queuing technique from networking. We had to adapt that a bit to our use here. The details are in the cap. And this algorithm then is the thing that takes requests from the queues and chooses which queues to take requests from and send it on to further processing. A priority level can be configured to not queue and instead just reject excess requests like the Max Inflight filter did. Also, there are limits on queuing. Each priority level is configured with a limit on the length of its queues and there's also a limit on the time that a request can spend waiting in a queue. So a request can be rejected due to either of those limits as well. Finally, there is one priority level that is exempt from regulation. As mentioned earlier, there are some additional considerations. One is that APF will consider some requests to occupy more than one seat. That is to say, be relatively expensive or heavyweight. The leading example of this is a list request that returns a large number of objects. Such a request compared to others that take the same amount of time to execute is exceptionally expensive to handle. And so APF will consider such a request to be worth more than one request. The next consideration is watch requests. Whereas the Max Inflight filter simply did not regulate them, APF does regulate them. A watch request is a request to do one or two things. The main focus of the watch request is to keep the client appraised of changes to a collection of objects on an ongoing basis over some period of time. Some watch requests additionally will start by informing the client of all the pre-existing objects. This first phase, which is or is not there depending on details of the request, is much like the ordinary short-lived transaction requests and APF will manage the first phase as such. And once that phase is over, APF considers the request to be done, even though in fact it continues on to notify the client of ongoing changes. The costs for those notifications then, APF associates with the other requests that are actually making the changes. So for requests that writes or mutates an object, even though the reply was back to the requester in promptly without waiting, APF will consider the request to execute for a while longer to account for the cost of sending those watch notifications out to the watching clients. Another additional consideration is for the exempt priority level that has a nominal concurrency limit and participates in borrowing. This can be used to somewhat even out its effects on the other priority levels. Finally, the last one I wanna mention is rejections. The 429 status code, one of its standard features in HTTP is a recommended time for the client to wait before trying again. For a long time, Kubernetes always set that to one second. Recently, we've made that adaptive so the clients can do a better job of backing off. So that completes the brief overview and now Abu will take over and give you some more interesting details. All right, let me just quickly skip through the slides. Mike just covered, okay. All right, so let's do a quick recap on how APF handles a request. So a new request arrives, we find a matching flow schema and we compute the flow of the request. The request is enqueued using shuffle sharding and then we ask the scheduler to dispatch. So the scheduler dispatches the request that should be executed next using the fair queuing technique. At this moment, the scheduler will also dispatch as many requests as possible and then the request basically waits in the queue for a decision, right? If the decision is accept, the request will get executed. If the queue wait time threshold exceeds and the scheduler cannot accommodate the request, right? This will be the request will be removed from the queue and the rejected, right? So that's kind of like how APF handles a request. Next slide. So APF is highly configurable via API objects It ships with a set of flow schema and priority level configuration objects. We refer to them as bootstrap configuration. The left column shows the flow schema objects available in order of their matching precedence. On the right, we have the available priority level configuration objects. A flow schema object is assigned to exactly one priority level. On the other hand, a priority level can be shared by multiple flow schemas. Okay, that's the next slide. So let's go through some of the bootstrap flow schema objects and why they're there. So exempt, this flow schema matches all requests belonging to the system master's group. That means if you're a class red mean you fall into that category and these requests are always exempt from APF regulations. Next we have system leader election. It matches the leader election requests from Coup Controller Manager and Coup Scheduler. This traffic is critical for cluster availability. Then we have endpoint controller. It matches the requests coming from the endpoint controller that manages the endpoint objects. I think this is critical to keep the service network functional. Then we have system node high. These flow schema matches the heartbeats from the nodes, I mean, Kubelet. We need this for system self maintenance. And then we have Coup Controller Manager, Coup Scheduler. These matches the leftover traffic from their respective components. We have service accounts. It matches any leftover in cluster traffic. So if you have a workload that's running as a pod, most likely the requests coming from your workload will match this flow schema. Global default matches any leftover traffic, including any unauthenticated traffic or any traffic that is external to the cluster. Right, catch all. It serves as a catch all for any unmatched traffic. Under normal conditions, no requests which match this flow schema because the flow schemas that are above like acts as a net to match like all requests. Okay, so we talked a bit about, oh, sorry. So during startup, the Kubei BI server ensures that all bootstrap configuration objects exist on the cluster, right? It also periodically scans these objects and applies any update necessary, right? That means any changes to the spec of a configuration object will be stormed by the API server. For the changes to stick, the cluster operators must set the auto update spec annotations, annotation to false. The goal is to enable the Kubei pay server to update these bootstrap objects installed by the previous releases. Also the same time, not overriding the changes made by the cluster operators. So cluster operators can add their own configurations if needed. For example, if you have a buggy workload that is known to run amok and flood the API server, you can actually define a dedicated flow schema that matches the requests coming from your workload and then assign it to a prior level with like your small concurrency sugar, right? All right, so we talked a bit about the flow schemas. Now let's switch to prior levels. So we'll start with server concurrency limit. It is the maximum number of seats the in-flight requests can occupy at any moment on the server, right? So APF uses it as a fence for protection. So it'll try to prevent the load on the API server going beyond that fence. And Mike just mentioned it's the kind of approximation, right? So server concurrency limit is calculated by summing these two server run options. If not modified by the cluster operator, the default server concurrency limit is 600 on any Kubei pay server instance. It's also worth mentioning that a request on the server can occupy one or more seats. It gives us a granular mechanism to deal with requests that have variable costs. For example, Mike mentioned getting one object versus getting a list of hundreds of objects, right? So each priority level has a property called nominal concurrency limit that is basically the number of execution seats available to it, right? So let's see how we actually distribute the server concurrency limit among these different priority levels. So each priority level API object has a field called nominal concurrency shares. It's basically prescribes a fraction of the server concurrency limit that is available to that level. We use it to compute these nominal concurrency limit of that level. And more and higher value of nominal concurrency shares basically means more nominal concurrency limit to that level and at the expense of every other priority level. The pie chart here shows the default distribution of the server concurrency limit on a vanilla cluster. Okay, so next slide. Okay, so each priority level enforces its concurrency limit independently of the other levels, which introduces this utilization challenge, right? So if we look at the figure, priority level B is underutilized. It is running well below its concurrency limit, right? On the other hand, priority level A is saturated, right? If you look at the YOLO line, it shows a moment where the number of execution requests for priority level A has reached the concurrency limit. And there are an access number of requests waiting in the queue. So what happens to those access requests for A, right? They will either wait longer in the queue before served and this will introduce additional latency in the response time, right? Or in the worst case, they will be rejected by APF, right? So how do we solve this problem? If we allow A to borrow from B, some sits, right? Then we can help resolve the situation. So APF basically allows borrowing among priority levels. There are two fields that basically prescribe how many sits a priority level can lend to or borrow from other levels. So lendable percent is the fraction of the nominal concurrency limit of a priority level that other levels can borrow from it. Boring limit percent is basically the limit on how many sits a priority level can borrow from other levels, right? This table here shows the borrowing configuration for some of the bootstrap priority levels. For example, literal action, this priority level, it doesn't lend to any other level, but it can borrow without limit. So another interesting topic of what mentioning is priority inversion, right? It is a case where in the course of serving a request, some other request gets spawned to the Kubei PAs. For example, in the figure below, we have a cluster extended by aggregation, right? So user sends a request A, Kubei PAs server proxies the request to the aggregated API server. The aggregated API server spawns a new request B in order to serve request A, right? So B is subject to APF regulations independent of A. So if B is rejected by APF as a consequence, A will fail, right? Some examples are delegated authorization where the aggregated API server is in response to serving a request. It actually issues a subject access review to the Kubei PAs server. There are other examples. Kubei PAs server issuing requests to itself over a local loopback client. I think there's also examples of external admission web book server issuing requests to the Kubei PAs server, right? Which itself is basically serving call outs from the Kubei PAs server. So how do we solve priority inversion? APF doesn't have any mechanism to detect these spawned requests. The way we're solving priority inversion is basically exempting the spawned requests. So basically you have a flow schema that matches the spawned requests and assign the flow schema to an exempt priority level. For example, for the delegated authorization, here we are matching the traffic, right? So subject access reviews are matched from the delegated API server, and we are assigning them to the exempt priority level. So let's talk about client and retry. So when APF rejects a request, it sends four to nine status code, which means too many requests. It also adds the retry after header in the response. The value of the header basically tells the client how long it should wait before the next retry, right? So if your workload is built with Clanggo, you don't have to worry about retries. Clanggo automatically retries the requests. Okay, I'll just talk about that. I'll talk about a couple of situations where APF can't help. So in most production environments, Kubei PAs server runs as a pod and Kubelet probes it periodically so that it knows when to restart it, right? If the API server is overloaded, it may reject the health probes from Kubelet further degrading the cluster, right? And we can prevent this situation by exempting the liveness probes to the Kubei PAs server. There is another situation. This is a watch storm incident. It shows, basically from a AHA cluster with three Kubei PAs server instances. The graph shows the number of watches over time. Each line represents a unique Kubei PAs server instance, and it shows the number of watch requests active on that particular server instance. And the gap on the line shows a time window where that API server instance was unavailable for the duration. If you look at the highlighted area, it shows that the blue instance died, and all the watch requests from the blue instance almost immediately reestablished on the green instance. So this sort of watch storm can overload the API server or in some instance can crash it, right? So this is one of the many cases of cluster degradation where APF can come to the protection of the API server. All right, I think. APF has a set of metrics for observability. I'll just quickly go through some of them. So this one is a rate of requests dispatched for each priority level. So we can see how many requests are serving per second. The next one is, this one shows the number of requests currently executing for each priority level. This one shows number of requests currently waiting in the queue before they're served. And this histogram shows how much time a request waits in its queue before being executed, and it shows it for each priority level. I think that's it. With this, I'll stop for questions. Oh, the default, so it's the client setting. The default value is 10, but I think an author can actually modify that settings. Are you referring to the... Oh, I see, yes. No, yes, you can actually change the... These are actually... Oh, sorry, your question was, can... Yeah, I'll go back to the slide, yeah. Oh, this one? No, this one, sorry, this one, I think. Yes, yeah. So the question was all the different configuration. You said there's default value from API missionary that's set in the core right now. You said operators can reset them or set them to different values if they want to. Is there any specific type of use case you see people having for this type of cluster you want to build, you want to set different values, or...? So these are designed in a way that is enough for, or approximately enough to prevent, to have the API server functioning even during the degradation, right? You can, a cluster admin can actually change those objects. These are API objects, basically. And a cluster operator can change its objects, but it's not recommended. I think only use cases you are experiencing and degradation in the cluster and you find out that some private level here is doesn't have enough room. Maybe you can tweak it to make room temporarily. This is maybe once in a row I can think of, but usually we recommend that the operators first identify the requests that are valuable to them, right? And then try to see if there is a flow schema that matches it. Otherwise, you can create your own flow scheme object and then you can assign them to the desired priority level. Yeah, that'll come with the follow-up. I think in the graphs you showed, one of the example was like the special type, like OpenShift1, that was a custom booster configuration probably made as well. Like in the graphs that you had shown, I think one of the custom type was like, that was gonna be the follow-up by the, I think you already answered that. I see, okay. That you can create custom configuration. Okay, cool. Thank you. Is there any kind of guidance on how much to tweak the amount of seats available? There was 600 as the default from the maximum flight, but as a function of course, RAM, you allocate? Yeah, that's a very good question. I think we're still trying to find that answer because this is all like a very rough approximation, right? So when we say that APF uses this as a fence for protection, but it's definitely not an accurate fence, right? So 600 means you can use the number of cores to map to this value, and you can run experiments and see like how well it performs. It also depends on the workload you have, right? Some like not all workloads will act like similar on the APS over in the side, right? So because requests have different costs. Yeah, thanks. So request traditionally had a timeout of 30 seconds. What can I expect, Jela? How long does my request stay in those queues? Okay, so we made a recent change. The queue await time is depends on the request timeout. So how do you specify time on a request? A user can specify in the request parameter like timeout equal to 10 second, right? I think we limit the request timeout on the server side to be at most 60 seconds for the regular requests. And the queue await timeout, like APF queue await timeout, is basically one fourth of the request timeout. Previously it was like hardcoded 15 seconds. Now it's like based on the actual request timeout. If the user doesn't specify a timeout, on the server side we default it to 60 seconds. So it'll be 15 seconds for those requests. Hey, thanks for the talk. I just have a quick series of questions. So the bootstrap config, I assume you can't delete because you were saying if you make edits it reconciles once you override. Yes, if you delete the controller will recreate it. Okay, great. Second question, did you drop then in client go the request per second client side throttling? We have not yet, but we did an experiment in Kubernetes CI, in upstream CI, by disabling the client throttling for everything in KK. And we have some results to like share for that. But the result looked good, but it's not in production. I think in production client go still enforces the client rate limiter. Do you know when you'll drop? We will want to see how it performs in production. Usually the production environments are not up to date with the latest releases. So I think there'll be some soak time and then we'll probably have to figure out from there. So you're saying there's no upstream tests for that production environment. We had a test, I think it ran on the 5000 node test. Okay, awesome. For you said client go does retries when does the 429 conflict or the rate limiting does that stall? Like, does client go wait and retry their quest? So essentially if you're a controller author does that mean you'd be stalling reconciliation when that happens? Yes, so client go if it sees a 429 or any five xx and it also sees a retry after header and the header has a value like today's integer. So it'll sleep for that number of seconds before the next retry. Is it possible to configure client go to pass that through to the controller author so they could essentially re-queue? The, yes, I think an author can like set the retry, the retry count, but the actual weight is basically instructed by the server, right? So server sends a header. It says you should wait like three seconds and the client will wait three seconds before retrying. Yeah, the reason I'm asking is because like for some controllers you have like two concurrent reconciliation at a time as an example. So if you have two of those hitting a potential retry because you're hitting some resource endpoint, there could be other work to be done while it's waiting for those retries. That's why I was wondering if your thoughts are on that. If I remember correctly, I think the request that the client object that sends a request, it's I think the same thread, it's same go routine as the, as the application. So I guess there will be this, I don't think there is any way for you to avoid that latency. That block, you're saying, okay. I think that's all I had, thanks. But if you have an application that is built to be concurrent like independently, that's something I think the author has to consider, I guess. Yeah, that was a good point. I guess adding to that just would maybe make sense to have an error type with timeout for those. If you set retry to one, then it would give you an error instead, saying that while you should, the controller should wait or requeue after a minute or something. If that's the thing, so that is something we probably could add to the client go. I think in client go. Just inform the controller that. I see, okay. But in client go, I think if you specify the timeout, right? The server enforces the timeout on the server side, but the client also will wait at most that many seconds. So let's see if you say timeout equal to 30 second. If the server takes longer, the client will timeout after that 30 second. Even if you have retry count available to you for retries, I think it'll be like context timing out basically after 30 seconds. I don't have a question. I just wanted to say thanks for working on something really, really hard and subtle. Thank you so much. Hey, it's me again. I have one more. If I do something similar to the endpoint controller and do endpoint management, should I be reusing that priority level? That priority level? Or do you recommend I create my own? That's a very good question. If you have your own flow schema and you want it, you want to assign it to any of like this very critical priority level, you run a risk because those priority levels will be shared to some extent, right? And if you work on this, 10 RAM and Mac and flood API server, it could impact those more important requests, right? I would say like, if you're not sure, I think the best bet is to create a new priority level and assign your flow schema to that level and start with that configuration. All right, we're done. Thank you so much for coming.


Natus level 20 introduces the page in a different way than the previous levels like Natus 18 and Natus 19 did. Immediately we are already logged in as supposedly as a regular user, but we have to modify the credentials and log in as admin to retrieve credentials for Natus 21, the next level. So we have a form here that allows us to post another HTTP method to index.php, this homepage here, and the functionality looks like it's asking for a name, like we can change our name of whatever user we're logged into. To verify this, let's take a look at the index source. We can go ahead and browse to that page here with our Python script. And let's go ahead and take this, remove all of the break lines that are in the way and let's de-entitize this thing. I did that out of order, so de-entitize. Does that work? Hello. Okay, cool. I don't know why I said hello. Talking on the phone here. All right, so the source code that we have gives us a debug message that looks like it's enabled once we actually run get requests with the variable debug, and if that's present. Normally I've ignored this, but we are gonna need it in this level, so that'll get a better idea of what's really happening here. The function print credentials looks like it is being run because it tells us originally you're logged in as a regular user, logged in as the admin to retrieve credentials. So we're trying to determine whether or not the session little dictionary in PHP has this admin index, this admin value, and make sure that that is set to one. I guess it's an associative array in PHP, whatever, but we wanna make sure that session admin is set to one. Okay, that's the goal here, and then we get the password for the next level. So it looks like that this program defines a lot of boilerplate functions that are trying to handle how a session or a PHP session is stored and saved. We can scroll down a little bit earlier and we see other functions like MyDestroy, MyGarbage, et cetera, and these are set as the handlers for the default PHP session, handler, or how that's really operated and done in PHP. So since we're using these custom-made functions, we have the code here that's visible and we might be able to do something villainous if we really wanted to. So things like MyOpen, MyClose, MyDestroy, MyGarbage are noted as we don't need these things, they just kind of return true and they aren't really anything interesting. But what we have here is this functionality that lets us change the name variable, just like we saw in that form. If we actually post the page, make a request and set the name, it will go ahead and create a session variable for that. It displays the credentials and if the right key exists, it gets it, et cetera, et cetera, and we just have our form. So the interesting things here are these custom functions, MyRead and MyRight, because they're the only valuable ones really being used for handling our session. So MyRead is interesting because it says, okay, I'm gonna read out of a session ID and it tests is the string matching these characters here or they not equal to the length or whatever and it looks like that just determines whether or not it's a valid session ID. So some kind of handling determines in a right form. And then it stores these in a file, a file name that it determines a path for and whether or not it exists, it will handle it appropriately. If it does exist, it will read from it. It looks like it gets the contents of it, it creates an array for the session variable and it will process it bit by bit. That explode function in PHP will take a string and explode or split it up into an array or a list given a specific delimiter. So our new line here just breaks it up line by line and you can see this debug statement here, it's reading each line by line and then it explodes by spaces and it determines each specific part or segment of the line that it's reading. So if it's not nothing, if it's not an empty line, it sets a session variable to the other part of that line, like key value, we have a key pair here. Okay, that looks peculiar because that can probably be taken advantage of. So it's reading out of that session file. Now let's determine how is it getting written to? How does the my right function work? We get our debug message, we test if it's in the correct form again, we get the same file name, saving and we sort by keys the session variable for each session variable that we have, we denote the debug here and we add it to a string that we're originally appending to as from nothing and we build out a new file based off of that because we're using file put contents. Okay, so let's actually play with this now in code, now in experimenting with the level. Because we're in Python because we're using this response.text session that we're able to work with, we can handle multiple calls all in code because we're doing this code like this. So let's actually have a divider here because I wanna show you the development in this. By default, we are still going to the source code. So let's first fix that. Let's go to the original page. It tells us you're logged in as an individual as a regular user, nothing special. Let's turn those debug methods on by changing this link here to include HTTP get variables. So following with the question mark, debug can equal really anything but I'll just say true for your ability and we'll check out what this content is. It says, okay, debug my read, blah, blah, blah. This must be the random thing that's created. It says, okay, this session file doesn't exist. So it must have been created and that's why at the very end of the page we see the my write function being ran and the saving it in var lib PHP. So whatever file on the server that this session is being stored into. So we're operating in a session, right? Every time I run this program, run this Python script we're gonna get a different string as our session string. So what I'm going to do is just make multiple calls but I'm not going to, I'm gonna keep adding to the current script we're working with. Let's go ahead and see if we can change our name or let's, before we get into that let's see are we keeping the same session following this or after we, if we get another request here. We say, okay, let's get a random one. The session file doesn't exist. We write to it and then in the second call using our dividers to tell us a second call we see, okay, now that file does exist because we created it. There's nothing really in there so it was able to read nothing but we should have some other variables we can put into it because of that change name functionality. Now let's try and include a name that we can post to it. Let's make a call to post with data being name can be plus sub. Now that we've posted to it. Again, session file doesn't exist. It will create it. Now that we've made a post we have set debug statements out here. Name is set to please sub and we write in here the, in the session file we're setting name, a string, a six character length to contents please sub. Final call, once we run get we are reading here, reading from varlib. Red name is please sub. Okay, so we were able to do that and in my write function it still keeps the name here. Now let's see if we can inject something or get in the way of this read and write function because it doesn't look like they're sanitizing anything at all in that source code if they're just splitting up variables line by line and with a space in between each thing we could just as easily add a new line and change whatever session variables we really wanted to.  So let's go ahead and try that. In our code, when we're making our post request we can say name please sub or whatever we really wanted to but if we had a new line character backslash n now we can set any other session variable to whatever we want because we're getting in the way of that session handler admin and set it to one, right? Cool. Let's go ahead and take a look. If I run this code at the very, very end after we've established the session and then after we've modified it now we can check back. It says, awesome.  The credentials for the next level are NAT is 21 and the password right here. So I hope that makes sense because we were able to just read the source code see how it's determining these variables getting saved and loaded essentially from the PHP session with those custom handlers and we're able to take advantage of them. So sweet. Let's go ahead and save this now. Create a new script, NATS 21 and we don't need all this junk but we do want to move to the next level here and we've got the next level. Okay. So thank you guys for watching. I hope you enjoy this. If you do like these videos please press that like button and I'm getting my words stumbled. Maybe leave me a comment, let me know what you think, what you'd like to see next, what I can do better, how else you solve this. If you're willing to subscribe and if you really, really want to support me please check me out on Patreon. On that note I want to give a special shout out to Spencer Clark who is currently supporting me on Patreon. If you do support me I'll give you a shout out in literally every single video. Five dollars or more I'll give you early access to just about everything I release on YouTube. So thanks for watching. See you soon.


Welcome back to Tiny Mike Interviews at DEF CON 31. Today we have Rachel here, and we're at the Hackasat Contest area. So tell me about this project because you were telling me before that this has been happening. I've been in the workshop for 40 years. Exactly, yep. So a little bit of history. We have been at DEF CON with the Aerospace Village. We're kind of in conjunction this year and happy to be here with them. So in years past, we have run a CTF, a qualification event and a finals event. However, what's exciting this year is not only are we live in person for our CTF finals, we have our teams in front of us. We also have an orbiting satellite for Hackasat 4. And so that has been the biggest change from year one to four. We've been in a four year iteration of design build break and we're finally breaking because we have a satellite to hack out there on orbit. And that's really, really exciting for us. So this is the actual satellite that's in orbit. This is the model of the actual satellite. Yes, yep. So Moonlighter as we call it is a 3U CubeSat. It is out in Leo orbiting in space. Our teams are communicating that through our game opposite satellite ops behind me. And this is quite literally how it looks, how it designed, the camera on top, the wings on the side for the solar panels. This is quite literally as real as it gets. So why are they actually hacking? What's the end goal of this CTF of this competition? Yeah, so these teams, the five teams that are here with us today, they competed in quals. They placed in the top five. They came here today to quite literally have the ability to contact the satellite, send commands up, receive commands back down, and that's ultimately how they're being scored. We do have some ground station challenges, but for the most part, this is a space CTF, the first of its kind. And so they are sending things up to the satellite, waiting for the information to come back down and see how it goes. Things like taking pictures with a satellite. You know, anything orbital mechanics, you name it, we tried to involve it, include it, and the team's so far so good. I mean, that sounds so cool. So they are actually hacking on a live satellite right now that's in space in low Earth orbit? Low Earth orbit. So we were launched in June out of Florida on the SpaceX 28 mission, where it was an ISS resupply. In July, we have a nice video we shot out of the ISS as it was out in space to get into our own orbit. So the bird went off. We were able to get live footage of that. And so we've been up in space now about a month on our own. Things are going really well, not on what. And so, yeah, so the teams, the communicating with that satellite, a lot of the visuals in here and what the teams are really focused on are contact windows. So we have times that we're on contact and then, you know, some downtime where they're getting all their calculations and doing all of the smart things that it takes to complete a CTF. And then those contact windows are very crucial for our game. Someone was saying, how often is the contact window? So there is a schedule that the teams have and that is what we're projecting up here. It changes each day. So it's never the same each day. But we have pretty good contact windows today. We did decide to extend the game time to utilize the contact windows today, surrounding our game hours. And tomorrow, 10 to 6, we're our best contact windows again, and so we'll utilize those. Now behind the scenes in the dark tonight, our teams, all of our off teams will still be utilizing contact windows, making sure our scoring, all the data coming, you know, up and down from that is still in progress and going well. What's your favorite task that they have to execute in the scene? Oh, man. My favorite task is definitely the picture taking. I think for us, it's the most tangible. You get something down that anybody can digest and understand that these guys and what they're doing, that's literally cause and effect. And so that's really exciting for us. They're so in the zone. And for the people who are watching at home, is there anything you'd love to let them know about? Yeah, so honestly at home, just because you're home doesn't mean you're missing out. Yeah. We have quite literally all the information that we are sharing is there. Our scoreboard is live. It's ever changing. A lot of our tracking is on there as well.  And what's really fun is after this is over, give us a little bit of time, but all of the challenge, all of the solvers, and it's all posted on GitHub through our website. So folks can digest it. You can pretend like you were here and try it yourself and see it. You know, if you weren't super good at it, look at the solvers. Look at what we put out there and learn. And we would love for people to do that. That's awesome. Yeah. Thank you so much for taking this time out of your busy schedule. Thank you for having us here. This is awesome. Definitely check out the website. What's the website again? Hackasat.com. That's awesome. Thank you so much for this. It's great to see you. It's awesome.


What's up, YouTube? What's up, Switch? Welcome to the Univ. Welcome to Tailgate Tours. Episode number two, we're in Minnesota. Guys, welcome to S-Fans Tailgate Tours. It is episode two, 2022, the 2022 season. We are at the University of Minnesota. The Golden Gophers have been incredibly, incredibly generous. They invited us out here to come and get a tour of the whole stadium. We're actually gonna get some special access. The environment is already nuts. The game starts in about three hours and there's people that have been out there since about 8 a.m. We're gonna get to see the team. We're gonna get to see the locker room. This is Bonnie's first ever college football experience at all. So what do you think? I'm really excited because we get a lot of super exclusive access that nobody else gets. And it's my first one, so... Yeah, you're gonna get to see things today, Bonnie, that not even most football fans, or not even that you've never seen, but also most football fans never get to see. So let's go ahead and turn around and take a look at the biggest locker room in college football. Isn't this incredible? It doesn't it? So they have the retired jerseys up here. Those who have come before them, that's how they do it. It's showtime. It's very serious. Tanner Morgan's locker, the quarterback. But I do want to take a look around. I mean, just go ahead and take a look at the equipment staff here. Incredible. They go, they have every single person's jersey ready, tucked in, they have the helmets nice, they're buffered out, they got the decals ready. Minnesota has some of the best facilities in college. It's absolutely incredible here. So go ahead and just give them a good look, give them a nice look. You have a wide look at this. And a special little pass, event production for S-Fan. For S-Fan and people. Yeah, we're very important, OK? It's very exciting. We're here, the team is actually going to get lined up here. You have the band, you have the suit. Fans are already lining up. The tailgate is nuts. And people have been out here since 8 AM. Look at the band. Look at how regal they look. Hey, you guys look cute in regal. They're in suits. They're ready to go.  They're very sick. Take a look at the weight room and stuff. And then we'll get out on the tailgate lots. Let's go. Let's go boom. Thanks, guys. Thanks, guys. All right, thank you guys. Yeah. Have a great day, and they love you, too. We just got to get across. Let's do this, you guys, in a bit. We're into the weight room. We're just going to stay here for the Twitch thumbnail. OK, this is sick, dude. This is sick. Take a look. Thank you. They got all their trophies, the national championships. They'll bring recruits through here, and they'll show them kind of like the history of the school. Minnesota, top notch facilities. This place is phenomenal. Any kid who gets to come play here, they're going to have a good time. You've got the All-Americans, the academic All-Americans, because, while I chat, academic All-Americans, yes, they do care about the students as well. They'll usually take recruits, and they'll have them wear their full pads, look at them at Jersey, and we'll take pictures and stuff. A lot of times if you fall like football recruiting, you'll see these guys, these high school kids, are always like posting pictures and stuff. This is where they do it. You get the whole game day experience. Next, what we're going to do is we're going to take a look at the weight room, because we do want to get out there on the tailgate lots. So. Welcome to the gym. This gym is exclusively reserved for the academics of the campus. Yeah, as you guys can see chat, this is the football weight room. Hey guys, best is the standard. So, what Minnesota has done, Minnesota has actually modeled their entire gym after mine. That is exactly what they've done. They have the power lift racks. You know, they were like, man, S-Fan is just the epitome of knowing what the best weight training equipment is. All the logos are facing up. Yeah, see that? So you respect the logo. You respect the logo. You respect the name. And they got the Vertamax. Hell yeah, they got the Vertamax. I swear by this thing. All the top strength coaches, dude, all the top strengthening and dishing coaches, most of them love this thing. So, they got the Vertamax. They use power lift equipment. They use the best. They've got pit sharks. And the belt squats over there. All the truck mills are actually up on the second floor. And you can see it on the balcony. That's what he goes to. So, nobody goes to the treadmills because your cardio is getting up there. I'm jealous of him. There's actually multiple gyms here. And there's five libraries. I don't know, libraries are for nerds. There's two practice fields. Hell yeah. Two practice fields. And then one main field where they actually do the games, the actual games. So, this is the pit shark. You guys know the pit shark from my gym. This is the main reason why we came to check out Minnesota's weight room. It's to validate myself. So, hearts in the chat for me for having an amazing weight room that is basically one one-hundredth of a college football weight room. This is the best tailgate here on the lot. Right over there. What makes this the best tailgate? Out of any other tailgate, here in Minnesota, what makes this the best one? Probably the biggest reason why this is like the best tailgate in this whole lot. Anyone else has everyone that went to the U, did this, did that. This is all family right here today. That's awesome. A golden gopher family. You can't beat it. That's for sure. Yeah, for sure. Yeah, thank you guys. Thank you for being here. That's crazy. Adopted... put your kid up for adoption fifty years ago. Fifty-four years ago. I'm telling you, this is my first time in Minnesota. The atmosphere is incredible. I don't remember. Nothing beats it. Football memory here in Minnesota. Govers being Penn State. Here's why, because the Govers are the best in the world. You heard of me today. You heard it here first. Fifty-four. I don't know. Dude, it was seventy-three. Seventy-three. Seventy-three to four. Book it. Book it. You heard it on the TV. Too safety. St. Thomas. Oh, St. Thomas in Minnesota stands. Kind of. My mother here. We do a tailgate show. It's called S-Fans Tailgate Tour. If we go all over the country, check out the best tailgates.  I would love to. It's yours. It's yours. And this one. That is my question. Is there enough? I got more underneath. That's a good one. As long as you have the liquor, you're good. We're going to get two safeties, and then the Govers are going to run it up. That's my son.  She really just hopped out of the cart. It's been a nice non-stop. Let's get the taste test. Thank you guys so much. Thank you. We're going to be buying this. But this will be on YouTube in a few days. It's live right now, actually. Oh my God. Yeah. S-F-A-N-D. Did you get that? S-F-N. S-F-N tailgate tours. That's awesome. Thank you. Cheers. Political science. I'm so sorry. Yeah. Not good. You guys are excited for the game, obviously. You guys come out to every game, tailgate every game. Be a little banged up. What's your guys' favorite memory from tailgating? This is for me. Yeah. I'm excited. I'm excited. I'm excited. I'm excited. I'm excited. I'm excited. I'm excited. I'm excited. I'm excited. I'm excited. I'm excited. I'm excited. One, two, three goifers. Hell yeah. So, pretty much that's where the memory stopped. I'm excited. So he's also, he's my best friend in college. He looks a little bit older. I'm a 6 year senior. Yeah. Hell yeah. I was a 7th-year senior. Oh yeah. My favorite game is Penn State two or three years ago. I thought I had been hearing. Crash of the Feet oh my God. It was beautiful. And then getting the axe last year. Ah. Do you remember any of that? There was time the shots. I'd say my favorite memory is just being with everybody And get the opportunity to meet new friends and experience the culture together. You guys want to take a Tatsuki? Yeah. That'd be awesome. Hell, I'll take one. Yeah! Hey! What is this for? It's for YouTube. Oh, really? Yeah, we're live on Twitch and we're doing YouTube.  What up? All right.   Yeah, a little bit. I'm sorry. A little bit. Shots on it. Hey, I love it. Can we watch this back later? I'm so... What's a channel? Hey, just take a picture. How many subscribers you got? Like a million. Hi, I don't like getting hammered. See, this is what you really call rowing the boat right here.  Let's go! No, sorry. My actual favorite memory is like now that I thought you were like part of school. Oh, yeah, yeah. After that Penn State game, we all went streaking up and down university. See, you know what the funny part is? These are the adults. Dude, these aren't even the students. Yeah, we're going to get the students. I'm probably going to call you on Twitter. What's your Twitter handle? SfanTV? Yeah. Sfan? Yeah, Sfan. Yeah, I started following you this morning. There you go. I didn't look down immediately as he paid after. I didn't actually think it was you. Great to meet you. Big fan. How are you in Minnesota? Why not? Why not? Thank you so much. Hey man, good to see you. Good to meet you. Yeah, for sure. Good luck with classic. Thanks, dude. I really love the fact that people come up all the time, like viewers, and they're just like normal adults all the time. It's fantastic. It is great. It's like nobody's usually ever weird or anything. They come and play the piece and you move on. How much do you pay these people? Like 15 bucks. Subway gift card? These aren't even on. Hey, what's up, man? How's it going? It's been good. It's good to see you out here. What are you doing out here? Are you a Gover's fan? I am now. I've been here about... an hour and a half, but I'm a Gover's fan now. That's crazy.  Can I hop over? Check out the line? You can hop over if you want. There's barely a lot. There's like a part of the video. Okay. Wait, so what is this? The camera will spin around you in order for a slow motion video. Really? Yeah, you can use some of the props. Oh, nice. We're going to go ahead and go. We're going to go ahead and go because I don't want... because kids keep coming up and I don't want... Chad, do you guys want me to do it? Should I get in line and do it? We all want you to. Let's do it. Let's see how it turned out. It's all good. Picture chatting with you? Yes, absolutely. Hi. Absolutely. It's great to meet you. Yeah, for sure. Julie. Yeah, good to meet you. Thank you very much. Yeah, of course. Have a good day. You too. Yeah, that's awesome. Yeah, we're live right now. Let's check this out. Shout out Minnesota. They're hooking it up, dude. I'm giving it some gear. It's all Gord's colors. Gryffindor. That's kind of weird. That's kind of great. Hey, yeah. Hi. You're in Minnesota. Why are you in Minnesota? Why not? Look at this. This is amazing. So why are you two over here? I mean, this is one of the best atmospheres in college. So I was like, I'm doing the tailgate show and I was like, I got to go to Minnesota. Yeah. That's really cool. Yeah. Yeah, thank you. Yeah, it's been a blast. So here's what we're going to do now. We're actually going to get to go down onto the field. We're going to see some of the Spirit Squad stuff. We're going to get to see the warm-ups as well. It's going to be badass. It's going to be sick. We're actually going to get to watch the team coming out of the tunnel. Big thing in Minnesota, row the boat. This is rowing with us. These are all fan-made or decorated. These have all been sent in by fans and they decorate the inside of their tunnel with it. So before the game, the players come down through here. They get to see the fans, like, shows the fan support for the guys. You're playing. They're playing in front of a ton of people, but not only that, these people are sending in these handmade and decorated oars to just, like, show their support. It's pretty sick. All right. All right, guys. So here it is. The University of Minnesota has hooked us up with some special access. We're going to get some early acts on the field. They're in warm-ups right now. They're hanging out. We've got Minnesotans out here, Colorado's out here. Let's check it out. Let's go see the guys. Student section, the fans. Look at them start to fill in. Minnesotans defensive assistant at SMU Everything, former president of the Texas High School Football Coaches Association, and now he's linebackers coach at Colorado. So, man, I'm so happy. How's it going, man? You look good. Obviously you're busy. We've got something to do today. I'm not joking. I'm warm-up, man. Listen, I saw that hair put a mile away. I said, wait, that's got to be here. Great to see you. Great to see you. I've got to come to Colorado. Please do. Give me up, man. I'll take care of you. Dude, I love Coach Smith. I love him. Fantastic. I'm so glad we ran into him. I do miss this. I really do miss college football, man. I love streaming. I love everything about it. But it's something about college football. I love being able to take my two passions and put them together. I really do. Best tailgate ever. Thank you, guys, man. I really appreciate it. We're working really hard, man. I'm hoping, like I said, if you're watching this, if you work for a certain program, I mean, this thing is incredible. Not only for recruiting, it's good for fans. It's good for everybody. Exposure to the school, right? To a new audience. Hit me up. Message me on Twitter. Ask FanTV on Twitter. Follow me on Twitter. And we'll work something out. Some schools I've already talked to, so we got some more good things like this planned for the future. But I want to fill out a whole season schedule. Oh, look at the guys. What's up, man? That's a fan. Love you so much. I love you too, man. I can't. He's playing. They're slow. Just pay attention to the footwork. Okay? Look at it. Just look at it. That's football IQ. That's what that is. We'll be here in a second, and we'll actually be right behind them when they run out of things. Look at the lighting, dude. This is so hard. About next week, I don't know what's happening. Two weeks from now is TwitchCon. But three weeks from now, for sure there will be another tailgate. Follow me on Twitter, Ask FanTV on Twitter, YouTube, Instagram, everything is Ask FanTV. You'll get updates on when the next tailgate tour is going to be. It's always going to be on Saturdays. The game has started. We lost her, I guess. So, guys, thank you so much for joining me for episode two of the 2012 season. I will see you guys later this week. Tailgate tour should be almost every Saturday. Follow my Twitter for updates. Make sure to follow Bonnie Rabbit. She joined us today. She helped us out a ton. Bonnie was a phenomenal guest. We're going to keep having a great time doing tailgate tours. So, again, thank you guys so much for watching. I'll see you guys next time.


Regarding GTEC, this is like, you know, really, I mean, I, I got it handed to them. They did, you know, like the Argos did an amazing job on Friday, which should trap like both sides. And this is one of the stock, like, when you have FOMO and when you didn't have a plan, it's going to kill you, right? But for those that who are patient enough to wait for the key levels, you know, like long or short, you're going to profit from it, right? But it's not easy. Okay. Easy to say it then done, but it's not that easy. Myself, I took some of the long tray. I made some money, short sign, made some money as well. I took a loss near like 3.30pm was right here on this kind of dip.  But, you know, there's really absolutely nothing I regret about that trade. I would have, you know, taken that tray any day. If, you know, it happens again, I'm going to take it. Okay.  I should have waited a little bit lower to have a better average or like, you know, Thursday I have better stop, right? Basically. But, you know, it is what it is.  So I took a, here along like 9.6. My start was like at nine and you just look at what the stock did and, you know, kind of draw right away and stop me out right here. And then it went down to like this key level, 8.5 as you can see here. Resistance becomes support, right? Support, you know, like make this line 8.7. Supporting that whole day, 8.5 dip, dip, dip here. Like, this is really key level as 8.5. If I was patient a little bit, you know, taking that tray into here, 8.50 or 8.60, stopping, I mean, exactly the same thesis, but not like 9.6 and stop at 9, but instead of 8.6, you know, 8, but easier on a, you know, in hindsight, right? But the thesis was right after that stock, you know, popped back into this 10 line and, you know, went high after hours, but, you know, it's really hard to kind of capture after hours of move. But my goal on this one was like, you know, 9.5 and sold into this push 10.5, but we didn't get there. So regarding this ticker, I would like to kind of go over the topic I want to get, you know, go over today is how to kind of recognize or like to know, you know, if the stock is trapping. And so you can take advantage of it, right? And usually, if the stock is going to trap for, you know, for the rest of the day, it usually showing signs really early in the morning, right? And also the volumes should tell the story, easy to borrow. But, you know, in this case, it has, it had like all the red flags that we need. And also if you just gonna do it like this, like in the morning, right?  Everyone is thinking that, okay, this is pretty much like, you know, done, right? Or it's over pretty much. I was watching this one and I thought to myself, okay, so this could be it. Okay, put out 9 or 1.5 little mark perfect, right? Push into 8.5, couldn't break this line and went below view app. That's probably that's it, right?  And then on this eight line, pop straight through that pre-market high. To me, after this point, like I said to myself, okay, so stock should have died, but it didn't, right? It should have not done that. This is the type of the move where I recognize and I said to myself, okay, so this is the trap. Okay. And the moment like GTAC or like stock did that, I know it was a trouble. Okay. I know this stock is something you don't want to mess with, right? And this is typically the sign that you need to look for, uh, you know, maybe earlier in the morning, maybe in the pre-market, but this is like the stock is telling you the story, right? Or how it's going to behave for the rest of the day. And to me, this is like the clear sign. I mean, you know, went below view app 8 to 7.5 and then just rips through the pre-market high, right? I mean, this is not normal guys. Okay. Usually, it should test back a little bit view app and then lower, lower here and then, you know, that's it. So after that, when I noticed something like this, I know this was the trappy stock and there is really, I mean, I would say the easiest way has to trade this is not to trade it, right? The easiest way is to avoid, but for some reason you want to trade this one, you want to take advantage of that, totally fine. But just keep in mind on this type of stock, they try to, you know, mess with longs and short, both sides. Okay. It doesn't have any, any clear indication or like clear confirmations that it's going to one directions, but instead it's playing with the range. Okay. What I mean by that is let's say, you know, pop into this one and went to 10 line, right? And as you can see here, you know, big stuff, view app nine and then eight, right?  How often you see that?  You didn't listen to it. You went back to the well, you're going to get, you know, squeeze. All right.  Okay. So on this type of stock, the only way for you to be able to take advantage of that, either long or short is scalping the range. Okay. You could, I don't know, I forgot to put a drawing here. I would say the range was between 10 and eight. Okay. If you narrow it down a little bit, maybe 10 and 8.5. This is the range that the stock is, you know, basically giving you the guidance or like the guy for the rest of the day, right? Like in the premarket, it should have died in at the open. It should have died in. So after 10, 30, that's your range. Okay. So if you want to scout the channel, that I think that would be the only way how to profit from it, but it requires a lot of patience.


In this video, I'll be revealing my personal ratings on every natropic I've ever tried, but that's not all, I'm going to categorize them into three groups. The ones you should avoid at all costs, the ones you can consider for occasional use, and the ones that are so effective and safe that you should consider buying them right away. Of course, before you start adding any of these brain boosting supplements to your routine, it is important to consult with your doctor first. But once you do, you'll be well on your way to unlocking your full cognitive potential. So while you're waiting for it, let's dive into the world of natropics together. Hi friends, and welcome to your Inception's YouTube channel. My name is Greg Gostinkar and on this channel we are on the hunt for the best products, natropics, and supplements to boost brain performance. If that interests you, then be sure to subscribe and hit the bell for notifications. So let's start with 5-HTP. Now 5-HTP is an amino acid that regulates serotonin and other brain chemicals for relaxation, sleep, and appetite satisfaction. It easily crosses the blood-brain barrier where it converts to serotonin. It is also known to decrease appetite and reduce sleep terrors. The recommended dosage is 300-500 mg, and I think you should consider 5-HTP. Then we have acetylalkarnitin, a derivative from a amino acid that can boost your cognitive and physical performance. It is naturally produced in your body, so it doesn't make much sense to supplement it. It can enhance mitochondria energy, and it may improve memory and mental awareness. Now the recommended dosage is 500-2000 mg per day. I don't think you need it, so I think you should avoid it. Alpha lipoic acid.  It is a synthetic form of lipoic acid which can eliminate free radicals in your brain. It may improve memory and enhance energy levels. And the recommended dosage is 300-600 mg. I think you should consider it. Alpha GPC. Now Alpha GPC is a cooling compound needed for a healthy brain and body functioning. It supports memory and fights against cognitive decline. Supplementing shows positive effects on our memory, focus, learning, and oral cognition. And the recommended daily dosage is 300-600 mg. Now Alpha GPC is one of the best entropics for brain function, so I think you should buy it. And the rest of them. And the rest of them is two to five times stronger than the normal rest of them. And it is primarily used for creativity, holistic thinking, memory, and reducing anxiety. This synthetic neutropic may improve learning, memory, and cognition. Also, it can reduce stress. Now since this is a synthetic neutropic without lots of studies, questionable safety, and illegal status in many countries, including in the EU, I think you should avoid it. Artichoke Extract. Now artichoke is a plant that is known for several benefits, including lowering cholesterol, liver health, and antioxidant properties. It is also a PDE-4 inhibitor. This entropic is often supplemented for improving memory, cognition, and protecting the brain. The optimal daily dosage has not been established, and I think you should consider supplementing this entropic. By the way, what are your favorite entropics? Let me know in the comment section below. Okay, let's continue with Ashfagandha. Ashfagandha is an adaption root herb with benefits for mental energy, stress, resistance, and mood. It has been used in Ayurveda medicine for centuries, and it is one of the most popular adaptions on the market. The recombined daily dosage is 300-500 mg, taking with a meal. Now Ashfagandha is one of the best entropics on the market, so I think you should buy it. Astaxanthin. Astaxanthin is a potent antioxidant found in algae that may offer some brain-protecting activity. Now, it is less research compared to lutein, but it seems to be very potent. The recombined daily dosage is 6-8 mg, and I think you should consider it. Astrogalus. Astrogalus is a herb used in traditional Chinese medicine that is known for its anti-aging and anti-inflammatory effects. It is one of the traditional entropics that hasn't been well researched, but it seems to be highly effective and very, very potent. Now, we don't know the optimal daily intake, but most supplements generally contain from 200 mg to 1000 mg of a quality extract. Now, this is a great entropic for longevity and overall immunity, so I think you should buy it. Bacopa muniarin. Bacopa is a herb used in traditional medicine for improving memory, focus and also reducing stress. It is one of the most popular entropics available on the market right now. The recombined daily dosage is about 300 mg. Bacopa is one of my favorite entropics, so I think you should definitely buy it. Bramantan. Bramantan is a synthetic metropic or also a smart drug that was developed in Russia and that may boost physical and mental performance. Due to the lack of research, its complicated legal status, I think you should avoid this drug until we know more about it. Then we have caffeine. I don't want to spend too much time talking about caffeine. As you know, it's a strong booster that comes with many side effects. If you take it now and then, that's fine, but daily use is probably not recommended, so overall, yes, you can consider it. CBD. CBD is a very popular cannabis-derived compound used to treat anxiety. It can help people with chronic pain, reduce inflammation, and decrease symptoms of schizophrenia, and I think you should consider buying CBD. Celestros planiculitis is a woody shrub seed used in our VD herbalism that may help with overall brain health. It may also promote intestinal health. Now, studies on red show that this plant can reduce cholesterol and even improve cognition. Now, this is a tropic with a lot of potential, so I think you should consider it. Then we have chaga mushroom. Chaga is becoming more and more popular due to its potential health benefits. Recent studies show that supplementing chaga can boost your immune system, lower blood sugar and cholesterol, and provide anti-inflammatory effects. Now, the optimal daily dosage is 500 to 1500 milligrams. Now, I love natural and effective tropics, and hence I highly recommend taking chaga. City Collin. City Collin is a naturally produced substance used for enhancing memory, improving mood, and cognitive function. Now, this bioavailable source of Collin can easily cross the blood-brain barrier on itself, and once it gets to the body, it cooperates in the synthesis of acetylcholine, the learning neurotransmitter. It is as good as AlphaGPC, or even better, so go ahead and buy it. Consign Q10. Now, consign Q10 is a molecule produced in the body that has a critical role in producing energy for the body. Studies show that supplementing consign Q10 can help with fertility, skin aging, it could reduce headaches, boost exercise performance, and help with immunity. The standard daily dosage is 100 to 400 milligrams. Now, consign Q10 is a vitamin-like substance, which I think you should consider supplementing. Cordyceps. Cordyceps is another popular medicinal mushroom that may boost exercise performance, has anti-aging properties, and can help you fight inflammation. Now, the general regimen daily intake is 500 to 3000 milligrams. I think cordyceps is a very potent mushroom, so I think you should buy it. DMAE is a Collin molecule and its active compound of centrophenoxine, a popular natropic drug. It is used for optimizing brain cell structure, but it might as well help with mood, cognitive decline, and attention. Now, due to the lack of research, I think you should avoid it for now. Forced Collin. Forced Collin is made of a root plant in the mind family that might help with weight loss. This entropic, which is native to South Asia, is often combined with the artichoke extract to boost CA and P levels. It may enhance memory in healthy individuals. Now, it doesn't seem to be very effective in tropics, so you can avoid it. GABA. GABA is a neurotransmitter and an amino acid that can help people relax. It may also improve sleep. Now, GABA cannot cross the blood-brain barrier, so it is often combined with other natropics. Its efficacy is questionable, but I think it's a natropic with a lot of potential, so you can consider it. Green Tea Extract. Green Tea Extract is a potent natropic that contains EGCG and caffeine, two very potent phytochemicals. Supplementing green tea may boost brain health, help with promoting weight loss, blood sugar regulation, and speed up exercise recovery. The Recomydele Intake is between 50 and 500 mg. Green Tea is a great natropic, and I think you should just go and buy it. Ginko Biloba. Ginko Biloba is one of the most popular natropics on the market. It seems very effective for decreasing cognitive decline and enhancing memory in the elderly. However, it doesn't seem so effective for healthy individuals. The Recomydele dosage is 120 to 240 mg. Now, if you're older, you should consider it, otherwise there are better natropics on the market. Jinseng is another traditional Chinese plant used for several benefits, including increasing your energy, decreasing stress, and boosting your immune system. There are many types of Jinseng on the market, with Panic Jinseng being the true Jinseng. The Recomydele dosage is 200 to 400 mg. Now, Jinseng is great, so I think you should buy it. Varana. Varana is another source of caffeine, so the same is true for it as for caffeine. You can consider using it now and then. Hooperzine A. Hooperzine A is a plant extract with cholinergic properties. It works by slowing down the acetylcholine degradation. It seems especially useful for older adults, but it may enhance cognition in healthy individuals as well. The Recomydele dosage is 50 to 200 mg. Yeah, this is a potent tropic that you need to cycle it to avoid overdose, so I think you should consider it. Kratom. Kratom is a very risky traditional Asian herb that is believed to promote feelings of calmness. Drug addicts often supplement it for withdrawals from other drugs. It may help depressed people, but it is considered unsafe, and therefore I think you should avoid it. Alphenolalanine. Alphenolalanine is an amino acid needed for a clear mental function. It is a building block of protein and is used for depression, ADHD, weight loss, and several other reasons. Alphenolalanine converts to L-tyrosine, which boosts dopamine levels. Now, you should be careful about such a tropics, but I think you can consider it. By the way guys, if you like this video, please press the like button below. L-tianine. L-tianine is an amino acid found in green tea that promotes relaxation and creativity. It is one of the most popular amino acids and tropics on the market. People often combine it with caffeine to enhance caffeine effects. The recombined daily dosage is 100 to 200 milligrams. Now, L-tianine is a great atropic and I think you should buy it. Then we have L-triptophan. L-triptophan is an essential amino acid that helps our bodies make proteins. It is also a tropic used for relaxation and improving sleep quality. Now, this amino acid is a special beneficial for people who suffer from depression. And I think you should consider it. Lemon balm, also named Melisa office in Alice, is a traditional herb that promotes calmness and induces sleep. Despite the lack of studies, it may be beneficial for improving cognition as well. It also decreases alertness. And the recombined daily dosage is about 300 milligrams. Yeah, I think you should consider it. Then we have L-tianine mushroom. L-tianine mushroom is a medicinal mushroom that induces nerve growth factor. It's a promising cognitive enhancer. It can decrease anxiety, help people with depression and slow down cognitive decline. The recombined daily dosage is 500 to 1000 milligrams. Now, L-tianine is quite ineffective for short-term use, but great for long-term use. So I think you should buy it. MCT oil. MCT oil is a highly saturated type of coconut oil. It supports the use of ketones for brain energy and is helpful for mental clarity. Among other benefits, MCT oil may improve processing speed in people. You need to be careful to avoid consuming too much of saturated fat, but a small dosage now and then can be beneficial. So you can consider melatonin. Melatonin is a hormone that promotes sleep and help people restore circadian rhythm. The recombined daily intake is 500 micrograms to 5 milligrams. Now, it's not recommended to take melatonin daily, only when needed. So you should consider using it now and then. Modefinal. Modefinal is not an atropic, but a drug that helps people with narcolepsy, sleep apnea, or shift work sleep disorder. Since this is a drug, I only recommend taking it if it is prescribed to you by a doctor. Unlike other naturopics on our list, Modefinal comes with many serious side effects and it's not recommended to take it daily, so be careful with it. Mucuna prurines. Mucuna prurines is a precursor to the formation of dopamine. This naturopics can increase adrenaline, decrease cortisol, help to reduce the symptoms of Parkinson's disease and it may improve your subjective well-being. The recombined daily dosage is 5 grams of dried powder. And I think you should be careful about it, but you can consider using it. Omega-3 fatty acids are one of the best atropics that I take daily because of its many benefits. We know the supplementing omega-3 may prevent anxiety and depression, it may improve eye health, it may boost brain health, it may reduce ADHD and lead to a dozen other health benefits. And the recombined daily intake is between 1 to 2 grams. So I think you should go to the store and buy it. And by the way, I always use a plant-based omega-3 because they are of the highest quality possible. Then we have nicotine. Nicotine is a tropic with relatively powerful brain-boosting benefits. Nicotine can activate acetylcholine receptors, it works as a fat burner and it may increase cognition. Now I don't like nicotine too much, so I would just avoid it. Nupept. Nupept is a very popular tropic that shows a positive impact on brain function. It is structurally similar to pyrazidine, so it may provide similar effects. It's a great tropic for its symmetry properties. But due to the lack of studies, its problematic legal status and potential risks, I would avoid it. And the same is true for our next tropic, oxyresitin. Then we have thinkbot. Thinkbot is a very controversial tropic that might help with mood issues. Now structurally, it is similar to GABA, but it's primarily used as a recreational drug. People use it to treat fear, anxiety, stress, fatigue, etc. Now I think it's too risky to take it, so I would just avoid it. Pyrazidine, phenylpyrazidine and primaryrazidine. Now all those synthetic tropics show some potential, but I would avoid them until we know more about safety, actual effects and long-term use. Phosphatidylglycerin is a very popular tropic for memory boosting. By definition, it is an amino acid that is naturally found in our brains. Now studies show that supplementing PS may enhance memory in the elderly, slow down cognitive decline and decrease stress. And the recombined daily dosage is 100 milligrams per day, which you can take up to three times. Now this is a great natropic, so yeah, you can definitely go and buy it. Pterostilbine. Pterostilbine is a powerful antioxidant found in berries. It is a derivative of resveratrol and much better absorbed. The optimal daily dosage has not been established yet, but I think you can still consider using it. PQQ. PQQ is another powerful antioxidant that was once thought to be a vitamin. It has neuroprotective function in the elderly and it may boost mitochondria, so you should consider this one as well. Then we have resveratrol. Resveratrol is a red, wine, antioxidant that supports healthy brain aging. It may increase lifespan, modulate pressure in the blood, and it has many other antioxidant benefits. Now resveratrol seems one of the natropics with great potential for anti-aging. But the optimal daily dosage has not been established yet, so you can consider it, but do your research before using it. Reishi Mushroom. Reishi is yet another mushroom that can boost your immune system. It could fight fatigue and help with depression and also provide strong antioxidant effects. It's a great natropic that has been used for centuries. Now the standard dosage is somewhere between 1.5 to 5.2 grams, even though many supplements contain a much lower dosage that is probably even better for long-term use. I think Reishi is one of the best natropics and hence you should just go to the store and buy it. Rodiola Roséa. Rodiola Roséa is an adaption herb that optimizes mental energy and physical endurance. It can reduce fatigue and depression, it can also enhance cognition. Now this is one of my favorite natropics on the market. The recombined daily dosage is between 50 to 680 milligrams and yes, I think you should definitely buy it. Shishantra Berry. Shishantra Berry is an Asian berry that may help to protect your brain. It has been traditionally used for reducing anxiety and cortisol levels. Now the recombined daily dosage has not been established yet, so I think you can consider it or just avoid it for now. And the same is true for Sant John's word, but if you decide to buy it, consult your doctor before that. Shilajit. Shilajit is a natural compound found mostly in the Himalayas. Studies show that Shilajit can help with Alzheimer's disease, it can help with memory, boost testosterone levels, slow down aging, and even provide a few other health benefits. The recombined daily intake is 300 to 500 milligrams. Due to the early stage of research, I think you should consider this potential tropic. Turin. Turin is a very popular amino acid that regulates cell-to-cell communication. It may be beneficial for diabetics, it increases blood flow, and it has been studied for several other potential benefits. The recombined daily dosage has not been established yet, and while I don't think it is dangerous, you can avoid it for now. Tubermine. Tubermine is a popular caffeine-like compound that might have stimulating effects and boost blood flow. It is found in cocoa products, including chocolate, and I think you can definitely consider buying it. By the way, are you on the lookout for the best on tropics to boost your brain performance, but don't know where to start? Take a look at our free on tropics quiz, a link below, to get personalized recommendations that will be the perfect choice for you. Let's continue with Tomgat Ali. Tomgat Ali is known as a male enhancement herb.  Studies show that it may improve subjective well-being, decrease stress, and even weight. The recombined daily dosage is 200 to 300 milligrams. Now, if you need Tomgat Ali, you should definitely consider using it. Tarazin.  It is used to produce two essential neurotransmitters, dopamine and noregenitalin. It is especially useful for people in stressful situations. Now, the recombined daily dosage is 500 milligrams to 2000 milligrams. And yeah, I think it's a great natropic to consider. Uridine monophosphate. Uridine is an atrophy that has the potential to protect the brain from degeneration. We currently like human studies to confirm any urethane benefits, but based on the available studies, it seems to be quite promising. So I think you should consider using it. Valerian is an ancient root herb that may work by sustaining GABA levels. It is often used in herbalties for its anti-anxiety properties. It may enhance sleep quality, but is even better relaxed in agent. The recombined daily dosage is up to 450 milligrams. And if you struggle with sleep, I think you should definitely go and buy it. Vimpositin. Now, vimpositin is a compound found in a periwinkle plant and one of the best brain circulation boosters. It may enhance memory, decrease pulse rating and reaction time, as it may even slow down cognitive decline. The recombined daily dosage is 15 to 60 milligrams. Now, due to the recent research, I think you should currently avoid it. Gerbomate. Gerbomate is made out of South American tea leaves and it's one of my favorite energy and focus boosters. It provides the positive effects of caffeine without its side effects and it delivers a very long lasting focus that leads to increased productivity. The recombined daily intake is 300 to 1000 milligrams. Personally, I love gerbomate and I think you should just go to the store and buy it right away. B-vitamins. Now, they're essential for multiple functions in the brain, but I think the most important you should use is vitamin B12. Now, instead of buying all of these entropics individually, you can just grab the most effective entropic stack on the market. But, which is that? Well, watch up my next video up here. Thank you guys for watching and I hope to see you soon again. Stay well.