You've been with the team a couple of weeks now. So what is the biggest difference you've noticed just between the vibe here and what it was like with the Nationals? Yeah. I had some great years with the Nationals, great years in DC. And I love all those guys over there. Staff and Mike Rizzo, the GM, our training staff, everything. And it was great. I had an absolute blast for those seven years that I was there. And I wish them nothing but the best. But now I'm turning the page to Philly. Very excited. I think walking into the clubhouse day one, you never know what it's going to be like. And it was a fear. There's definitely a fear of knowing a place for seven years. And that's the only thing you know. And then you come to a new team and a new city and things like that. And it's like a family. I mean, the first day I walked in, it was open arms, whatever I needed, and anything to make me comfortable and happy. They were definitely all ears for that. So everybody's very genuine. We have a lot of fun. And I think we're going to keep having fun as a team and enjoying it. Outside of your well-known favorite, JT Mio Mudo, what player has impressed you the most? I really like Gene Seguro. I think he's one of the most underrated short stops in the game. He's a guy that hits for average every seven years, hits for power. He's an all-star player. And he's just a very good guy. He plays 155 to 162 games a year. And he's a grinder. You know what you're going to get out of him. And you know what he's going to do. So he's been great. I mean, Jake Ariadette has been awesome, but you don't have a veteran guy like that. He's a winner. He's a proven winner. Very good on the postseason as well. Aaron Noble, of course. I'm glad I don't have to face him anymore. Hoskins, he's mature beyond his years. So I'm very excited about the team that we have. Got a lot of really good ball players and great staff as well. And I'm just looking forward to it. You mentioned Nola. What will it be like for you not having to face him anymore? Oh, man, it's going to be great. He's got the heater that's different. He's got the curveball that just hits a wall and just strikes through usually. And he has this change-up that's electrifying as well. So all of his pitches are plus-plus. He's just getting better each year. He had a breakout year last year. Had a great 2018 campaign. And signed that extension here for a couple more years. And very excited about that to be able to play alongside him for a couple more years as well. Very young. So looking forward to that. Looking forward to seeing him be Aaron Nola and being Aaron Nola that we know. The lineup. It's deep. How good do you think it can be? I think it can be really good. I said at the press conference a couple of weeks back, as a team we have to grow. We have to understand what kind of team we want to be. And it starts with ownership all the way down to us. With John and the way he runs his team and his franchise, he wants to win. And you can see that. You can see that when you talk to him. He understands what it takes to win and understands how to win and go about it.  So he knows how to understand that. And then he went through the 08 run with them, the 09 run with them. And he understands what it's like to bring that back to a city. And I think he's craving that a little bit more now as well. So because it has been a little bit long. So I'm very excited for that to know that he's going to go out and press the buttons to be able to win and goes down to our GM and all the way down to our manager and all the way down to us. So our lineup, I think, is very strong. 1 through 9, I think we're really good. We're very deep, just like you said. Pitching and defense wins championships. So if our pitching can do what they can, and our bullpen as well, can do what they can, and we can score a few runs, I think we'll be OK. You mentioned John. You had a few meetings with him during your free agency. What stood out to you? Just, you know, he was on a personal level every time he talked to me. It didn't matter if he was John Milton, the owner, or just John. And, you know, that's what I loved about him. You know, something we're going to be able to sit down with him and find common ground and understand what he wanted to do as an organization, what he wanted to do as a franchise, for him to put his trust into me, and be able to put my trust into him, was huge. And from day one, I felt that, you know. So, you know, for me, I wanted that 13-year deal. You know, I wanted a long-term commitment. I wanted to be able to dig my roots somewhere, build a family somewhere. Beyond all the money and things like that, that was what I wanted. And, you know, Scott knew that from day one.  And they offered me the 13, and I said, absolutely. Like, let's get this thing worked out.  So I'm very happy to be in Philly, very excited to be in Philly, and just can't wait. How tough was it to be patient during free agency? This went on for four months. Yeah.  Yeah, I think Scott, at the beginning, said, hey, we're going to go into March, probably. So, I mean, at the beginning of the time, it was like, OK. So I just went about it like it was regular off-season. Like, I was playing for a team, and it didn't really matter. So I remember my wife, we went on vacation, did all the things we wanted to do, came back and started to work out, and just acted like I was going to go to spring training when I was going to go to spring training. So not at any time was I really frustrated or anything like that. It was more the opposite of, OK, well, the baseball side is going to take care of itself. When can we ship our cars? Where are we going to live?  You know, if I wouldn't have signed into March or anything like that, then it would have been OK with me. It wasn't like I'm not going to ever play baseball again. So for me, it was like, OK, it's going to take care of itself, and I'll be where I need to be. Now, the Giants were one of the other teams that was in. Their park, as you know, is not nearly as hitter-friendly as Citizens Bank. So if they had hit the number, let's talk hypothetically, I know, how difficult a decision would that have been, knowing what you can do in Philadelphia from an offensive standpoint. Yeah, I think when I was going through that day, I think it was Thursday when they called. So I just met with Larry and Farhan about two days before. And then the Dodgers came in right after them, talked to them, and they were saying, you know, we can go four years kind of thing like that.  I was very appreciative of that, you know, the money and things like that, but I just, I won a long term. And so the next day was Thursday. Scott called me, it was like 9 a.m. and I was still sleeping and still laying in bed and he calls me and he's like, hey, you know, we have an offer from the Phillies. You know, this is what they're willing to do, things like that. So I said, hey, have you heard back from Sam Fran? And he goes, we haven't heard back from them yet. I said, okay, I said, well, once you hear back from Sam Fran, let me know. And so he said, all right, well, talk about this, make a decision like with Kayla and figure out, okay, do we want to hear from Sam Fran or, you know, whatever. So me and Kayla already had like, okay, we're going to go to Philly or we're going to go to Sam Fran, you know, one of those. And what works best for us? What works best for our family? Where did we feel like we could build a family and be around a city that really cared about us as individuals and not just price the baseball player? So we sat there and we talked for a little bit and I remember standing there and me hugging her and saying, hey, we're going to Philly. And that was before we even heard from Sam Fran. And so Sam Fran called back, offered, you know, whatever it was. And by that point, it was kind of like, you know, I'm already a Philadelphia Philly. In my heart, I was already Philadelphia Philly. And I had nothing to do. It was nothing against San Francisco. They're a great organization, great city, things like that. But it just came down to, you know, my feeling and what I felt like. And at that point, it was Philly. Okay. Now the park does factor in at some level. How about just Bryce thinking Hall of Fame down the line, does it become more of an enhancement in Philadelphia? You know, for me, it wasn't, they gave me my overlays on each park. And you know, I saw my overlays in each park if that was National Spark, if that was LA as I was Sam Fran or Philly. And the overlays weren't as crazy as people would think.   So I mean, of course you factor in wind and things like that or cold weather and stuff. But I mean, that was never really a factor. I'm not scared of ballparks. So it was kind of like, okay, well, if I go in the San Fran, then it's gonna make me a better hitter because I have to stay on the ball. You have triple hours to right. But if I stay on the ball, hit the ball to the left. You know, and then pull my homers to right. I hit tower homers to right. So my line drives to the left would have played.  Okay, as you said at the press conference, Scott Boris your agent, he invented the opt out. And yet you said that you did not want one. Why? Yeah, so at the beginning of the whole thing, Scott was sitting there and we were talking about it. And he, you know, he said, so what do you want?   I don't want to have to go through this again. I don't want to, you know, uproot my family after four or five years and say, hey, we're going here. Or, hey, Kayla, we got to go here. And this is what we're going to do. And I didn't think that was fair. You know, I didn't think that was fair to a city. I didn't think that was fair to an ownership. For me to just say, okay, four years, I'm done, I'm out of here and I'm going to go for somewhere else. You know, I really wanted to be instilled into a city. I really wanted to be, you know, part of the city for a long period of time.  Like, I would love to went back to DC. I would have loved to have been there my whole career. But it just didn't work out. You know, both sides have to, you know, find common ground and we just weren't able to do that. So, you know, I turned that page and I was like, okay, so where can I go and really understand that I can be there for a long period of time beyond the money and things like that. But being successful as a team, being happy as an individual off the field. And for me, that was huge. And so when Scott said, okay, well, you know, opt out would be huge after three years or whatever at 29, you know, get back into the market, things like that. I told him, no, I don't want to. I don't want to do it. And he said, okay. He said, then we'll explore the options that we have and we'll figure it out. So he knew from the beginning, I didn't want to be traded and I didn't, you know, want the opt out at all. I wanted to be able to go through the ups and downs with the city. I wanted to be able to, you know, build my family in a city. I wanted to be able to be instilled into a city, the community and really let that city know that I'm part of them. And, you know, for Philly, it means something to put the Phillies across your chest. They understand it, they grind with you.  If that's the Eagles, the Sixers, the Flyers and the Phillies. And I think people know that. And for me, you know, the vibe that I got with Philly, it's a big old neighborhood. And these, you know, the people of Philly really understand and instill themselves into their fan bases and really understand the players. And they try to on a personal level. And I love that. And this organization does that as well. And that really fires me up and makes me want to play hard for this city and, you know, do something special for it as well. Now, not to play the role of Scott, but I imagine he might have said to you, or at least I'll ask you, why sacrifice the control? Why not get the opt-out and the long-term deal? You could have done that. Yeah, but I mean, after three years, why would I do that with a team when I'm going and I'm saying, okay, well, I could go for three years, but how much trust can they have in me for that? As much as I put my trust in them and I'm asking them to trust me, and they're asking me to trust them. So for me, it was about finding that common ground and going, okay, you put your trust into me, I put my trust into you, and this is what we're gonna do. I don't want the opt-out, there's no reason to. I have all the money in the world to do whatever I want with it, and I have more money than I'll ever know what to do with it, you know what I'm saying? So it wasn't about that. It was about me going to a city and instilling myself in that city and being able to build relationships with the people in that city for that period of time.  So for me, it would have been a, you know, kind of for my clubhouse and this clubhouse right now, if I had an opt-out after three years, that's all everybody would be talking about.  He's gonna go here in three years. He's gonna go here in three years. He's gonna go back to D.C. in three years. So that had no, you know, that had nothing for me. It would have done more damage than good for me, and I just didn't want to be part of that. 330 million, it's a crazy number, obviously. And yet the deal, the AAV is just over 25 million. Trout's gonna be well beyond, that is well beyond that. Manny's beyond that.   Mookie, Betz, Lindor, whatever. Does that bother you? No, I mean, why should it? You know what I'm saying? Like, I'm happy with where I am. I'm in a great city, I'm with a great team. You know, I'm with a great fan base, and I mean, that's all you can ask for.  Trout was able to stay with the Angels. Mookie's gonna stay with the Red Sox if they're gonna have them, of course.  Like, that's what you want. You want guys to be able to be there for a long term and a long period of time. You know, that's what baseball is. It's fun. It's being able to go out there, do whatever you can for your team and your club. Also, be able to get paid what you're worth. And for me, I mean, maybe in 26th of the year, Phillies are able to go out and get wherever they want as well. So I mean, I'm able to go out. We're able to hopefully possibly extend Reese, Real Muto, wherever we get. And we're able to build this core, you know, the core four or the core five that we're gonna have for a long period of time and be able to do that and hopefully bring multiple titles back to this city. And, you know, for me, that's, from day one, that's all I've said. I wanna win. I wanna be only part of the city for a long period of time. And, you know, I'm able to make the money that I am and be able to be successful and happy with what I've done. And, you know, the best advice that I got from Jason was, make a decision and never look back. And that's what I'm gonna do. You know, if Mookie does it, if, you know, if Trout does it, I mean, I'm so happy for him. I'm excited for Trout. I told him that. I texted him, said, hey man, I'm so excited for you and Jess. I'm happy for you. You deserve it. There's no other player in the league that's more deserving than Mike Trout. And everybody knows that. And so if that's Mookie, if that's Judge or whoever it is, you know, that's what it's all about. So I'm very happy for them. AAV or anything like that, whatever, I got my years. And at the beginning, that's all I wanted. That first day, they sold more jerseys than anyone's ever sold the first day. What did that mean to you? It's what you get when you play for a great fan base.  And, you know, it just goes to show how great of a city Philadelphia is.  And, you know, I'm excited to get it going. You know, excited to see all the Harper Threes out there and be able to be part of something bigger than myself with the Philadelphia Phillies. And, you know, it just goes to show, like I said, how great of a fan base this is, how great of a city it is, and I'm more than happy to be part of it. Now, you mentioned Jason. And Jason said in an interview shortly after he signed, he was asked, all right, when do you think Bryce might get booed the first time? And he said, opening day. So I guess I have to ask you, how thick is your skin?  I get booed all the time. And, you know, of course it's different when you're at home and things like that.  They understand how this game works.  They look forward to the Eagles games on Sundays. They look forward to, you know, the Sixers games and the Flyers games. And they look forward to the Phillies games each week. So I mean, if you're looking forward to that, if you're buying a ticket for that, then you expect your superstars to perform well. And for me, I've always had high expectations my whole life. You know, every single day I come into this game, I've had high expectations to play what, play it again the right way, play well. And, you know, we live in the era of social media and, you know, media people and media coverage on everything. And I mean, it's bound to happen.  Gabe said something to me just now that I thought was really interesting. He said, you mentioned to him that because you experienced as a young person a lot of diversity, a lot of different experiences because you were so good, so fast, that it kind of made you blend into a major league clubhouse that much easier. So what was it about your background that kind of made this journey a little bit different than it would have been for others? I mean, coming up at 19, you know, it's always tough.   It's a different ball game. You know, then I came up and, you know, having to deal with the social media, having to deal with the new era of media and just the craziness and, you know, everybody's watching you do this, everybody watching you do that. It was different.  You know, it was definitely, I was very lucky to have a guy like Jason Worth. I was very lucky to have a guy like Ian Desmond kind of, you know, helped me along in that sense and do some things that, you know, helped me out along the way. So, you know, for me, it was just being able to understand and learn the game a little bit more, you know, those first three years and try to get my feet under me and, you know, try to understand it.  You know, it was really cool to be able to see Juan Soto come up last year and really, you know, try to instill in him like, be Juan Soto.  If you can help us win, that's all I care.  Whatever makes you happy and makes you have fun, you know, that's what it's all about.  Until you change my mind, you know, it's gonna be different. But for me, it's, on a personal level, it doesn't matter who walks into our clubhouse, you're part of this family. And, you know, it's, from day one, I want that to be instilled in this clubhouse because they know when they, if they're 17, 18, if that's, you know, 19 or whatever, like Mickey Moneak or anybody who it is, I want them to be able to walk in and go, man, this team has my back, it doesn't matter if I'm over four or four for four or if I have to answer the hard questions or I don't have to answer the hard questions, I'm part of this team, I'm part of this culture.  So, you know, if we can instill that early and instill that in our minor leagues as well, where we, you know, we're a family, we go through this, we go through the ups and downs, the highs and the lows all together. And, you know, we fight together and we grind together. That's what it's all about.


Welcome folks, we have the Dow Industrial trading down 59, Nasdaq up 29, S&Ps are down 10, Gold contract trading down $11.90 cents at 2,033 an ounce. We have Silver down 26 cents, $24.12 an ounce, Light, Sweet, Crude, Flat, $71.41 a barrel, notes and bonds. A 10-year note down 3 ticks, $1.1213, the 30-year up 11 ticks, at $1.2325, and $Kingdala. $592 ticks trading out at $102.547, Euro at $108, the ounce trading at $142, British pound is at $126 to $1 US dollar. Option expiration, we're coming in folks, and you get an attotional value that's going to expire at the close of $5.4 trillion, how's that? It's even hard to comprehend, man. So you can expect some action coming into the close out here, that's for sure. We go look at the spy, folks, bottom line, you're down a little, you're downward light of all, and the spy still wants a higher price, you're at $469 right now, the high out there that it's shooting for is the $469, we're looking for, NDX100, so we take a look at the NDX, that's still crawling up there, man. The bottom line is that the all-time high on the Q's is $408.72, and we've hit $406.54, and you get volume behind the move again. Now, what's really going to be wild this week is that we have volumes on the dailies, but we're going to have monster volumes on the weeklies out here, too. And on the weeklies, you can see quite clearly, man, we've got ABC structures on the way up. 2024 is going to be a trip, folks, okay?  Dollar, dollar's doing a counter trend bounce out here, it makes sense, you know, the bottom line is that we're stretched out here, you know. So we'll see how this baby shakes out here, $589, notes and bonds, though they won't move. The bottom line, you get the 10-year down three ticks, big deal, right? They just continue to want higher price, lower yield, and we take a look at the gold contract and that also is pulling back, you know, light volume, nothing heavy out here, man. Stay right there, folks, come right back.


So, this is the third in a series of videos that I put together to show the enhanced display that I have developed. And this one is going to talk more about shapes and specifically shapes where one of the indices is a single one because that can be difficult to see in the standard display. And as an example, we'll take a look at this variable which gives us a 2 by 3 shape, at least that's what it looks like. But even though these look identical, if I take the first item of A, I get a list of three, at least that's what it looks like. And if I do the first item of B, I get a 2 by 3 shape, at least that's what it looks like. And the problem I have with that is what I'm seeing is not really telling me the full story. So, in my enhanced display I came up with a way that I could actually get a list of more information about how I was looking at things. So let's look at A. A is expected is the shape 2 by 3 and its integers, just in case you want that extra information. If I go to B, I have a gray background, its shape is 1, 2, 3 and what the gray background means is there's some number of leading ones and why am I already only worrying about the leading ones in the shape? Well, because a 1 inside the shape, so if I say put that together, I have no problem. That looks different, 2, 1, 3, than 2, 3, 2, 3 looks more like that, 2, 1, 3 looks like that. That's the spacing anyway. Of course we can see with the gray shade that that's not 2, 3 here, it's 1, 2, 3. So as I sort of dart around here, you can see that the different shapes look different if the 1 is inside not the leading one. If I put a number of leading ones in front, I can put any number of leading ones in front and as soon as I do it I'm back to this and I can't tell the difference how many leading ones until I do a hover, but that's a lot quicker than what the standard display is because what the standard display shows me is that same, I have no idea what shape that is unless I ask it, well of course I could put a shape in front, it would give me the shape back, so something like this, so that gives me the shape right back again in the standard display. So I can get it back, but it's much easier if I just do that, it tells me there's something to watch out for, I can go back and check it. So that's the way I've dealt with the singletons and the leading and as I said before, having ones inside were bounded by non-single indices, you can see the difference immediately. That kind of shows how effective the standard display is in showing shapes in J, but I found with the leading ones I really wanted to know that at least there was a difference because there are some things, how often I've been caught by something like that where I thought I was dealing with an atom, say that, and I want that to look like an atom and I want this to look differently, it's a list. And of course if I do something as simple as add another number to it, it's pretty obvious what it is, it's a list. But as soon as I take that away in the standard display, it becomes a lot less obvious and obvious is what I want, so that's why I've developed it that way.


Actually, Wingsuit, like, Mount Everest. What? That's crazy. OK, so Skylar and I were actually just talking. And she said she'd be down to help me through the interviews. So we're going to go and tackle some interviews right now. Do you think these guys? We're going to ask. OK, OK, OK. Excuse me. Hey. If you had $100,000 to do any sort of creative project, what would it be? One of my biggest, like, projects I would love to do one day is, like, actually, Wingsuit, like, Mount Everest. What? That's crazy. Little documentary about it, like, the training process and getting and achieved the goal. Did you know Artlist has their $100K fund where they're giving one creator $100,000 to make their dream project come to life? Which means you could probably Wingsuit. That's, like, pretty perfect, because that's exactly what you need for your dream. So I'll, like, I guess I will have to, like, apply? Apply? Yeah, sounds like you should apply. Thank you. Good to meet you, bro.


e retired and you can say that probably because of that I'm simply saying that the council's always right when you're in the council meeting when you're getting home and you talk to your wife and have a martini I'm not sure about that Kevin we'll talk about that you don't have to answer that to stay on for another three years in the park district thank you very much that was unsolicited right yes no if he said he wanted to come and I said okay so two of the so natural resources is saying you'll get also that's great I don't know we got to consider the source there we have a really good time with Betty and I we've learned to really understand the others' viewpoints and really appreciate them and that makes for a great committee that's great well thank you for your service so far and for your interest and willingness to continue so we just I know it's after nine but we have one more item so well actually two but do you want to take a since we've interviewed everyone would you like a five minute break yeah why don't we do a five minute break because I forgot we have two items under oh yeah right yeah good enough good to get up too sitting a lot in oh it's this Friday yeah to call this guy he lives in New York state I got two in college one's going to New Pulse, the other one's going to University of Vermont you know where that is and I go my dog is going there too mine's a freshman I go by his too yeah well she said dad I can't sleep on a mattress and somebody else has left on me so I've got to go to the new door the new door it's the wellness environment door you've got to do yoga and meditation yoga new mattress there you go old mattress so they were told they had to be here at 8 a.m. on Friday because there's like a tiny little loop there wasn't a new one right they've got those people gated it by the hour the new door was open the new door was open for the freshman in the WE environment I don't know about others but at least now and then I think that that professor that's charging it they were going to take Trinity's and turn that into an upper class yeah so where is the new door it's like it's going to be behind the library oh okay it's between the shoeboxes yeah the shoeboxes well it's behind old mill I know exactly it's got a material yeah and a connection you want to go to a daughter it should be pretty good that's where Allie's going no she's going to she did she did make the first cut that's because they took a 9% 5% this year so they were yielding yeah good good so she's getting a double with a bathroom right oh okay that's nice so two people do a bathroom that's sweet so meeting of Monday August 21st 2017 and our next item almost the last item is consider convening as the South Burlington liquor control board to approve the following application so moved second okay all in favor then we have to move to get into the liquor control did you do that okay one item I don't know how to pronounce I'm Saigon I moved that we issued the permit for the first cost license second it's been moved and seconded any discussion yes delicious food at I'm Saigon oh really yes go there very often it's next to Union Jax next to the post office right there at the bottom of yeah does a name for that what is it called Shelburne Road Plaza or something like that alrighty and Vietnamese alright so along with having a drink you can get some good meals so all in favor signify by saying aye aye I move that we accept the South Burlington liquor control board and go back into the city council okay all in favor okay we are out of liquor control board and the final item of business is other business and we have two items and the one of them was an issue that Pat brought up about kind of what's our city policy for panhandling David Vieux had contacted all of us and then the next day contacted us again we didn't hear and I guess a couple of us did get back to him and his issue was two as you recall one is the issue on panhandling and is this what we want to have as an image of our city and the second piece was also on the safety because the picture he showed was it was a little scary to have somebody on an old road panhandling or soliciting whatever and we see that with some regularity coming off the interstate yesterday into Williston there was someone there as well and outside of McDonald's and Winooski and so forth and all over and I'm wondering if this is something that we see brought up and I do have one question for the city when I was driving out from Lowe's on Sheldon Road I believe it was the Lowe's exit there is a very small sign attached to the stop sign and it basically is something to do with solicitation it's not encouraged to be there because it was on and I didn't know whether we the city posted that or whether it's when you're coming out of where Berger King is and so on right there I believe it's a little sign that is attached to the stop sign yeah there are several around the city exiting the price no exiting the Shaw's lot I think there's also a little sign that says it discourages donating money to people standing there I'll look into it I'm not sure is it against the law? Do we have an ordinance against this? no it's allowed I think there was recently a court case that said that it's freedom of your first amendment Cranston Road Island or Warwick recently had to rewrite their rule about that it's only if it gets aggressive that it's an issue but I mean it's like what we saw in Charlottesville but if it's not aggressive it's the safety piece perhaps in the middle of a four lane road standing on a two foot wide strip I think we have a responsibility not only to that person if there was a problem but also for traffic that I don't know if we've had any accidents people were ending somebody else and I certainly understand that people have the right to under our amendments to do this but that's something that we don't want to bring up I just thought it would be appropriate to answer Mr. Vio's question but if there's been a supreme court case it seems like it's been designed for a supreme court I don't think it was a supreme court I think it was a couple levels down it was a state issue if you'd like Andrew to look into if there's anything applicable in our ordinances and check with Trevor about the safety issue because we don't have our I mean the thing that I find actually less the middle of the road on the yellow line with a boot or whatever asking for money and I'm surprised some haven't been killed you used to that Winooski a long time ago yeah I don't know if we've ever done that in South Burlington well we gotta for your fire service now it's probably unlikely that we're gonna be seeing it do oh that's right oh that's right that's right if they're doing that we gotta know about it yeah exactly on whose time alright well why don't we at least get an update from Andrew and I think that would be important because maybe other people are wondering about that as well yep I think he was concerned I think Mr. Vio was concerned also about market street is this going to become a problem on market street and I think the point that had been made if there is an aggressive approach to people like they have in some major cities I mean that would be different than maybe just stopping at a traffic light soliciting funds right did church street pass an ordinance forbidding panhandling on church street but it's okay on the side streets around is that what they did it sounds familiar but I think they did something like that they changed their ordinance around panhandling we could look at that on market street and years from now true and I appreciate the safety issue but I and I always personally don't know whether to give money or not I mean it sort of plucks at my heart strings and I usually don't but it always makes me feel like so fortunate and whether it's a scam or not I don't know but I suspect that some of them it isn't a scam that they really are there's a grandmother that collects on Sunday morning or the grandmother collecting on Sunday morning in Winooski when we leave Mass and she is up near a stoplight and you know it's during the winter time and things I always feel or in bad weather and things like that and the weather is good I sometimes skip but it's interesting that there are a couple of couples that we meet up with for breakfast and they've become almost like friends to her and she knows she's there but that's her job she goes there every day and kicks people out that shouldn't be there and she has her little spot and sits on it and collects money she's raising grandchildren apparently and I feel for her so most of the time we can I think we all feel for them so we'll find out what the legal issues are the other item that I brought up and again I I don't know if well I'd like to have at some point just a sense of would we like to have some kind of resolution that really articulates this council's position that the the neo-nazi values and racism and you know those kinds of comments and actions that were being touted I guess at Charlottesville part of our make up and DNA for this community so yes I would definitely support something to that I would just be cautious to develop ourselves and use Andrew's time I'd be more interested if there's a set of language that's being adopted by other municipalities that we can show support for only to be cautious over our time and also to have a stronger message with the community standing up for the same statement well there certainly have been a lot of criticism by famous people as the state come out with anything that the governor has very strongly worded military I mean I think I don't want to make it political this is not a in my mind you know just let's embarrass the president or whatever but rather I don't think our resolution should be a yes they have so I just thought that we should be proactive we can articulate I mean I don't know if it needs to be a resolution or do you want to just a statement that we all you know I read and we all sign and this is sort of the sentiment of this city council and that we're joining the the governor and the head of the guard and so on all right well then I'll work on it for this time and we'll present that I know we don't have a mayor so we can't you know could ask the charter committee if we should yeah okay good well if there's no other items I would entertain a motion to adjourn can I just ask a question okay this is a piece for I hadn't seen this and this is a piece for consideration at the next meeting okay as additional information it was and I think you know it was rewritten to make it as factual and has all of these been looked at to see that they are yeah because this looks like the and just where as just intended to be attached to it's additional information and as it says in documentation establishing why we thought to have a resolution about governance and and I know you had concerns about some of the accuracy so several council members worked on this but I leave well we won't be taking this up till the 5th right gone a good part of the time so but well we can get it to you electronically if you want to do some edits or whatever entertain that but I'm not opposed to I'm happy with where we are but I'm not opposed to also considering the Winooski language if Winooski doesn't want to endorse ours but I mean that's a whole other conversation I'm just trying to move this notion forward alrighty so we'll consider that and have it on the agenda at a future meeting hopefully the 5th we'll have to look at the what we have to do on the 5th pack that is at this point the 5 or 6 interviews it'll be at the police department do we know I mean I just know from attending the meeting where we had some of the committee members present what each committee is looking for because I know for instance the parks and recs looking for a good writing communications person I'm assuming you got the rights looking for someone who's gung-ho about fundraising they wanted someone to be a note taker too and a note taker I heard tonight is there a way to get that back to us I think we empowered the committees during the leadership meetings to do exactly that and I don't know that anything came back I will ask Coralie about that tomorrow I think they have done some of that but I don't know if it's ever been compiled and obviously it hasn't been shared with us it's ready for prime time but yes that would be helpful you see I'm going to get a more specific question I know it's kind of hard when you're I mean it's an interested resident so it's hard to say no I know if I can work on connectivity just by attending their thing that's all just from my all righty motion to adjourn thank you thank you very much another unanimous vote it sure does 2010 yeah it's like you're still on vacation actually it is oh thank you oh oh


les Even though they made no sense granted dude is annoying, but sometimes he makes good videos Oh in relation to nostalgia videos are good. Oh nostalgia critic. Yeah, I'm sure some of his videos are good. Yeah Yeah Just the ones we but if we wouldn't cover a really good video that we agree with It would just be us for hours nodding our heads and saying yep, that's right Yeah, and even still we try to do that every once in a while Uh, what are other ways to send super chats youtube is dumb uh stream labs though admittedly, uh The so oh how am I gonna do this? So I guess tuesday I will put out part two of rags and I playing Resident evil Five because that's still those waiting behind little hope. So that's out next that has the first selection of Stream labs being respond to in it and a portion of efap 103 Um, and then the meme fab has the second portion of 103. You see how this is getting complicated now Thanks to how continuity goes um catalog system I still remember it all It's it's just that I you know, we just got to get them out in order and properly labeled so you guys can catch them all But yeah stream labs is the other way to send money if you want to Uh not involve youtube It's in the description. You'll be able to find it and and what is sent through there Uh A big chunk of them are being read on tuesday And uh rags and I are gonna figure out how exactly we're doing what catch up and where and what's labeled It's it's all coming. It's all in my head and I've got them all saved.  Maybe I should follow Doug's advice and make someone suffer for them Geez, yeah, is that a thing? I'm not funny enough. I have to start to bust out the torture implements This when you know, you're running out of options. I guess it's like right it's time Uh high rags. How is your human? Oh, he's doing a okay looking looking good all as well Rags, who's your main apex legend? I have the most kills with lifeline though I haven't played her in a while since I started playing with another friend who really likes her So I've been kind of cycling through bangalore bloodhound and mirage playing those three Enjoying them quite a bit particularly mirage And uh any videos on apex coming? Probably not though you will almost certainly see footage that I save Played in the background of like dog bites videos or maybe some other ones because I I do save clips of You know things here and there and I've been playing it enough So you'll probably see clips of it. Probably no videos dedicated to it though Depends on how rambly I want to be on dog bites sometimes if I just want to make a video where I just talk about some thoughts I have And uh also haimola. Hello Guys, I say this often I watch anime. It is terrible. The good ones are the exception to the rule And ruby is the epitome of bad anime. It's so bad. It's hilarious huh There you go Obviously most anime is bad 95% of everything is I mean yes, but like I guess it's the people often are giving a special mention at that point I assume What is your opinion on flying games because project wingman equals chef's kiss also high rags? Hello there Flying games. I don't really have not played many flying games. It's not really much of a Genre that I've explored You play flying games rags No, I don't Yeah, project wingman as I'm not even sure what it is to be honest with you Lawn is a treasure protect him at all costs Don't know what that's referring to The character an angel called lawn then yes, I agree l o r n yes there's like a music person who makes like electronic music named lawn, but that's I could be familiar with Maybe the lawn angel has got an e on the end. So probably not that one. Oh Uh, I want wind to blow All right There you go. Hi rags Hello Any recommendations from bad dragon? Yeah, I mean it depends on how Used to things you are back there Um, surely it's there's so many different preferential sort of changes you can make depending on your interest, right? I enjoy a Chance I have a two Of him two unflared ones One's a medium one's a large you had to work your way up to that one though You don't you don't want to start, you know, that's not a starting point Uh, but there's other ones that have been just fine. Um Let me try to get the name straight Look at the thing here Everyone's arguing in chat, but what what anime is What anime is It's so music to me. It's like it's okay guys, but what is anime It's a genre. It's not a genre. It's a style. It's a medium not a genre like oh god Archer is a good one that I would recommend I think they've actually renamed this since from when I bought it, but it's very humanoid Uh, but it's a really good starter Um, especially if they're soft Um That and Yeah, that that'd probably the one I'd suggest you start with Uh Watch the searchers by john ford That's a right. It's good an oldie, right? They haven't remade that yet. They were Sounds like something they would have remade by now. Um And yeah, and that's uh, that's it well at least for this e-fap, which uh Brings us to the end of this e-fap because I I'm afraid I am desperately in need of some food, you know Ah, I see the tank is ill suited to continue on such low amounts of fuel Uh, but it's been wonderfully fun. I want to make sure I save the game so we can carry on. It seems to be running better Now, uh, I got the different options going so That's good. That's good Mando Four episodes have been edited episode two is coming out tomorrow Around the time e-fap would normally stream. We'll just premiere it and then Resident Evil will be on tuesday and mandos next episode will be I guess friday No thursday and friday. I don't know how I'm gonna spread these out. I guess maybe if it's saturday monday resident evil wednesday mando friday mando saturday e-fap We got another gaming to release on the next monday. Basically, there's loads of things coming out guys. All right. It's gonna be great It's gonna be fun We are gonna watch episode six day after tomorrow or maybe I don't I don't really know and we're also Watching the last resident evil. There's lots of things getting recorded and edited and made up And all in the meantime, we are both still working on our videos lots of things along the way Oh, yeah, the the the meme stream or meme video. Sorry Meme fap that'll be out like Like in january 1st or something because it just it's uh got the wrong visuals for now all on the way No worry arinos and um Yeah, I guess that's about it. Um Or anything you wanted to mention rags before we toddle off to offline world No, I I think I've I think I've spoken enough. I think I've said what needs to be said It's like your opinion, bro Um, yeah, I was 10 hours. I think they consider that a long. I can't remember. Um I they better We're in trouble. So yeah more plenty of things on the way Lots lots lots of fun to them. Thank you all for hanging out with us. Hope you had fun And enjoyed the first of the christmas themed e-faps more along the way Good looking stuff Yeah, thank you for the memes the art the company and the the donations all very kind I guess we'll uh, we'll catch you all next time Good. Yeah, we'll see everybody later. Thanks for thanks for sticking around Good night everybody


I'm Ryan Castellucci and I am here today to talk about cracking brain wallets. A quick disclaimer, just because somebody's passphrase is terrible does not give you the right to steal their money. Please don't do it. Don't blame the victim.  Pretending people don't choose shitty passphrases doesn't help. So brain wallets are not a good idea. If you want to use something that works kind of like a brain wallet but is actually secure, there's this thing called work wallet. It's a lot better and if you use it with eight diceware words, everything will be great. So don't use brain wallets. If you are using one, please move your money out of it. Somebody lost $14,000 worth of Bitcoin just last week from one. Really quick overview about what a cryptocurrency is. Electronic money using cryptography to secure it. We don't need a bank or government to run one of these. Transfers work very similarly to checks. You sign the money over to somebody else, except for instant of ink on paper. It's cryptographic signatures on a blockchain. A big problem with this for a long time was how to keep people from spending the same money twice. Bitcoin solves this with a public transaction log. Transfers are identified by accounts. So it's pseudonymous. Bitcoin, Litecoin, Dogecoin, Defcon, we have Defcoin. And control of the private key is control of the money. A brain wallet is a little thing built on top of this. You need a private key but you can't memorize a private key really. It's a long string of hex. So you can turn a pass phrase into a private key with a hash. And then control of knowledge of the pass phrase becomes control of the money. Why do people like this? Well, the first thing they think is plausible deniability. If there's no record on my computer or anything of me making this thing, then if somebody asks me about it, I can just say, no, it doesn't exist and they can't prove me wrong. Not actually quite true. If blockchain is pseudonymous, you can track the transactions. It's just tricky. The other thing that people say is, oh, well, fifth amendment protection against government seizure. Well, sure, but you don't need a brain wallet to do that. An encrypted wallet gives you the same protection and is far more manageable. And then there's the old meat is a better random number generator than silicon because you can't back door meat. But you don't need to back door meat because it just comes up with shitty passwords and pass phrases. So this doesn't really work very well. So remember that cryptocurrency transactions are public. People are working on adding privacy to that, but it's not really there yet. Brain wallet addresses show up in the transactions. And the same address. So if you look at all of the addresses, you can just check them to see if there's a matching brain wallet. So a weak pass phrase can be guessed. And that $14,000 was sent to the pass phrase of, yeah, an empty string. There's a certain brain wallet tool site where that's the default pass phrase. And somebody just used it. So here's how a brain wallet tool works. You start with a pass phrase. I'm sure you've all heard of correct horse battery staple. First thing we do is run it through SHA-256. The address is treated as a 256-bit integer. And that's your private key. The next thing we do is compute the public key. So an interesting thing is that there are actually, well, one, this step is the most CPU intensive step of the whole process. And two, there's actually two different ways you can represent a public key. Compressed and uncompressed. For a long time uncompressed was the default. Most brain wallets still default to this. There's also the compressed format, which is basically a truncated version where you spend a little bit more CPU time to restore the part that's left out. And you can usually pick which one you want to use. So then we have a public key. We put this through SHA-256 as well. But that's still kind of long. So we also put it through RIPE MD-160, which is another somewhat obscure hash algorithm. Most transactions use this as the on-network and on-disk format. And, well, 160 bits in hex is kind of unwieldy for a person. And if you made any typos, the money would be gone forever. So there's base 58 check. You get the first character identifies which cryptocurrency it goes to. The rest of it is base 58 encoding with a checksum. So if you typo it, it probably will catch your typo. So brain wallets make the blockchain into a public hash database. So what do we ask when a password hash database is made public? Well, the first thing is, are the passwords, in fact, hashed? Well, yes, they are. Are they salted? No. Is the hash slow to crack? Well, kind of not slow enough, it turns out. Cracking yields money. This is a fantastic motivation for password crackers, it turns out. So back in 2013, I came across this blog post talking about brain wallets. Somebody made a bunch of them as tests to see how long it would take people to crack them. I thought this was interesting.  So I wrote that over the course. I wrote a cracker over the course of the week, using C and open SSL. So it would take in a long list of hash 160s from a file and then on standard in I could pass it passwords and passwords. No real reason to build in my own password or password generation because there's lots of other tools that will do that and it results out to standard out. So I have a Core i7 that's about four or five years old at this point and it was able to do about 10,000 guesses per second. And like a lot of people here, I find it someone interesting to go through password leaks and crack the hashes.  I was not prepared for the results. So I got this going and went to a picnic and then I got home and I saw how much wood could a woodchuck chuck if a woodchuck could chuck wood. This is pretty funny. And then I ran the balance check script. It turns out that woodchucks can chuck about 250 bitcoins worth of wood. At the time this was $20,000. So being a good guy is hard. Running a dictionary attack is easy but the hard part is well, being good. And I put myself in a wonderful little moral dilemma here because if I did absolutely nothing, you know, I'm not that smart. Somebody else will probably figure out how to do the same thing I just did and crack it and they might not be as nice as me. So I had to come up with something to do and in my flabbergasted state the only thing I could think of to do was call my friend Dan Kaminsky a admitted white hat. So about an hour, hour and a half later I'm at Dan Kaminsky's place. All I have is Mr. Woodchuck's Bitcoin address and no direct way to contact him. So what do I do? Well, we talked a while and we came up with this idea of sending Chuck a few cents and then taking it back. For extra fun there's a tool called Vanity Gen.  But it has to be pretty short otherwise it just takes forever. So crude way to send a message. Cool. So my wife was there for moral support and she's listening to this and she pipes up with yoink. If you're not familiar with that, it was perfect. So we send some money to Chuck, take the money back. At this point I should clarify, a Bitcoin address does not hold a balance. It holds a collection of previous transaction outputs. And so there's a separate 250 Bitcoin transaction output that belongs to Chuck and a .00031337 Bitcoin output that I just put there. Hopefully Chuck will notice that this yoink address is actually able to take money back from him after sending it and freak out about that and move his Bitcoins. This was the plan anyway. So I send the money to Chuck and I try to take it back because it's kind of my money anyway and I'm not a thief. But the Bitcoin software had other plans so I get the money back to the yoink address and the rest of it, the rest of Chuck's 250 Bitcoins goes to some other address I don't recognize. You can imagine my reaction here. So Dan left for a while and told me to sort it out. So once I calm down a little bit, I remember how Bitcoin actually works. I made a little mistake. I thought it would just use the exactly right amount transaction output, which seems kind of reasonable. But it turns out that it will choose outputs automatically based on the product of size and age. Well, 250 Bitcoins that was put there several weeks ago is a lot higher priority than a few pennies that I just put there. So I got that. I got my fraction of a penny of Bitcoin sent back to the yoink address and my change went to some other address that the Bitcoin wallet generated for me. So I figured it out and I put the money back. I only borrowed Chuck's money for a few minutes. It was fine. So I do this for a few days and it doesn't seem to notice that Bitcoin is all still there. So, you know, pseudonymous, cryptocurrency, totally hard to trace, right? Well, I'm going to do it anyway. So I followed the Bitcoins and pretty quickly I find out that he was a miner from a Bitcoin mining pool called DeepBit, which it just so happened I happened to use in 2011 back when GPU mining was still a reasonable thing to do. So I got in touch with the guy who ran DeepBit and spent about an hour on IRC convincing him that I was both crazy. I'm sorry. Not crazy. And a good guy. He was actually really good. He was like, well, no, I'm not going to give you this guy's email address but I'll pass along your contact information for you. I can't complain about that.  The problem is I knew that the person I had gotten in touch with was the person who funded the brain wallet which is not necessarily the rightful owner of the brain wallet. I figured the best way to sort this out was talk to the guy on the phone. So I did. He was really nice. I asked him if he knew what a brain wallet was and he said he did and I asked him if he had a bunch of money in a brain wallet and he said he did. And I explained that I knew what his pass phrase was and that I'm a nice guy but there are not nice people who are also smart. And I could hear his jaw hit the floor over the phone. So he was very, as I said, he was very nice. I didn't tell him that I borrowed his Bitcoins without asking. I figured it was better that way. So he didn't call the cops. In fact, he sent me two Bitcoins for my trouble which I actually gave to a friend as a wedding gift because I didn't want to make money off of the whole thing. And he missed his Bitcoin and he's fine. Nothing bad happened to him which is great.  I talked to him and he realized that choosing a standard password would not protect his Bitcoins. But how many people actually have a good intuition of what a password, a pass phrase cracker can actually do? Show of hands here. How many of you have used an obscure quote or song lyrics or something like that as the encryption key for a GPG wallet or disk encryption? Anyone? I don't believe you. Well, lots of people do. I've done it, certainly. And there's a post on Reddit about a year, year and a half ago. Somebody had put a couple Bitcoins in a brain wallet and his pass phrase was a line from an obscure poem in Afrikaans. And it got stolen. So anyway, Chuck's okay. And the next thing for me to do is see if I can actually make my brain wallet cracker fast in order to just point out that, hey, this is a serious problem and if you use these things, you're going to get robbed. So brain flare. There's a new elliptic curve library that came out for Bitcoin called live SECP 256K1 which is named after the curve Bitcoin uses. It's way faster. I got 130,000 pass phrases a second out of my machine. And I benchmarked this in EC2. 560 million pass phrases checked per dollar of spot instance time on C3 large instances. You can pretty easily call Amazon up and get your instance limit bumped. Mine is currently a couple thousand. With 1,000 instances and $175 you can check a trillion pass phrases in nine hours with this thing. But so remember this? XKCD. Yeah. So XKCD is not always right. Brain flare can cover that search space with 1,000 instances in less than a week for about $2,800. And bad guys don't use EC2. Well, maybe but there will be someone else's EC2 instances. So they don't have to pay for it. And they also have botnets. And these days a small botnet would be 100,000 nodes. If we want to get a nice lower bound we can assume that these nodes are 10% as fast as those EC2 instances which aren't fast. And with that you can try 2 to the 48 pass phrases per day which is about 275 trillion. That's a lot of pass phrases. If this still isn't fast enough for you there's still plenty of room for optimization and fancy math to make it go faster. And this can definitely be GPU accelerated. It can definitely be FPA accelerated. It can even be ASIC accelerated. But I don't expect that to happen. Mining ASICs mine bitcoins. They can't do anything else. They can't even hash arbitrary data. They only hash blocks. And if you want to get ASICs made for something you're going to be dropping a few million dollars to get a fab run done. I just don't see that happening. How brain flare works. So the first thing you need to do is get a copy of the blockchain. The Bitcoin blockchain is currently about 40 gigs. Takes a few hours to download usually. Then you need to extract all the unique addresses from it. Then we got to preprocess those because checking them one by one would be slow as hell. Then we have our candidate passphrase generation. We feed those in and calculate the corresponding addresses. And we check them for matching addresses in the blockchain. If there's a match win. The Bitcoin currently has had about 80 million addresses used ever. I use a technique called a bloom filter to check all of them effectively simultaneously. Bloom filter is like maybe second or third year computer science stuff. If you don't know what it is go look it up on Wikipedia. I will give you a really brief explanation. But the important thing is that it either tells you no match or there's probably a match. So that doesn't mean it has false positives but you can clean those up later. The likelihood of a false positive depends upon how much depends on the parameters of the bloom filter and how many items have been inserted. The way brain with brain flares bloom filter parameters you get about one false positive after in every 380 million passphrases with 100 million addresses inserted. But why 100 million addresses and not 80 million? Well you can just crack multiple block chains at once. It's just going to make your false positives a little bit higher. All of the alt coins use basically the same format. So load as many of them as many of them as you want in there. So you can check Bitcoin brain wallets, dogecoin, litecoin, whatever all at the same time. And it doesn't slow you down.  This is two to three two bits. Nice round number. And each hash 160 is mapped to 20 different bits in the bit mask. When we insert a hash 160 we set the corresponding bits to check whether or not the hash 160 is present. We look through those bits one by one until we find one that is not set. If we find one that's not set we stop looking and say no match. If we get through to the end and they're all there we can say probable match. Normally with a bloom filter you would take your input and run it through a bunch of different hashes to generate the bits. You don't have to use a cryptographic hash for this. It just has to have a uniform distribution. Usually something like XX hash is used. But well it's called a hash 160. It's already hashed. So we cheat. Just bit slice the thing.  Combine them in a few different ways. This turns out to work really well and it takes a few CPU cycles per hash 160. Super fast. Candidate passphrase generation is a little tricky. Word lists for password cracking are really easy to find. Passphrase lists less so so I did some scraping. Song lyrics, Wikipedia, project Gutenberg, forums like bitcoin talk, reddit, decipher punks mailing list, whatever. And then you've got all this raw data so you've got to clean it up. Every source is going to require different cleanup so I'm not going to go into how to do that but use your favorite scripting language. It's not hard. Once you've got clean list of phrases you can put you can run rules against them. So you could try it with normal capitalization, all caps, all lower case, initial caps, with or without punctuation, with or without spaces. Some results. So the QTC one, I'm pretty sure somebody found and they just burned the coins. It got sent to an invalid address and so this coins are gone forever. It was about two bitcoins. I think that's a Texas Social Security number and the persistence of memory is the name of that melty clock painting by Dolly. That actually had bitcoin in it when I found it but I couldn't figure out how to contact the guy. He used bitcoin gambling sites but those don't make you register so I had no way to get in touch with him. I don't know if he cleaned it out himself or he got robbed, unfortunately. Even more, these ones were all very tiny amounts. So yeah, there were a lot of anorhands quotes. A lot of them looked like they were just put there for people to find. They had like a tiny fraction of a penny in bitcoin in them but good times. So I went through all of the ones that I was able to crack, added up to 733 bitcoins. I mean this is starting in 2011 and going through two. I think I scraped the blockchain last sometime in June. I didn't necessarily find any of these while they had a balance but a lot of them did have money in them at one point and it's very, very hard to tell which ones were stolen from and which ones the owner just moved the money out and to be clear I did not take any of it with the exception of borrowing a little bit of Chuck's bitcoin for a few minutes on accident. So don't be Chuck, any password or passphrase that you can come up with on your own can be found by a sufficiently clever guessing algorithm and if somebody else came up with it it's going to end up in a word list or phrase list at some point. And there's just better ways to do this. There's a lightweight bitcoin wallet called Electrum. It does a nice little thing. It will randomly generate a master key and export this for you as 12 words. So you just remember those 12 words and you can restore your wallet and it doesn't give you just one address. It gives you as many as you want. It's pretty convenient and then as I mentioned earlier warp wallet which does support assault, they recommend you use your full your email address. You could also use your full name or ID number or whatever and it uses S-crypt for hardening. So I haven't actually benchmarked it but I would be impressed if you could make a hundred guesses a second against it. And then there's my personal favorite encrypted paper wallets which is where you print out a encrypted version of your private key. The encryption is hardened with S-crypt so even if you find one of these things you still have to crack it and if you know somebody found it and you have another one somewhere else for example you keep one in a bank fault and one under your bed you can get the other copy and move the funds before they crack it. I'm a big fan of this one. So a lot of people have spent a lot of time trying to figure out how to figure how to determine how strong a password or passphrase is. Really easy when it's computer generated randomness. If you're willing to assume the random number generator is good all you have to do is count the bits. Each bit doubles the strength each 10 bits increases it by about a thousandfold. When a person chooses it it's more complicated. Randomness and unpredictableness end up being more or less the same thing and it's predictable. And I know you've all used plenty of sites that will give you a password strength meter and you've probably noticed that password strength meters don't agree with each other. The best one I've seen was made by a team at Dropbox. It's called ZXCVBN. If you are confused by that name look at the bottom of the query keyboard. And it works pretty well but it does have its limitations and failure cases most of which are caused by the inherently limited dictionary size that such a tool can have. I ran a few things through it. Quiggy bow hash rated as 42.2 bits of entropy but that's a word that Bart Simpson played in Scrabble in an episode of The Simpsons so that's definitely in someone's word list.  Rated is 92.9 bits of entropy which would take centuries to crack. So clearly these estimates are not credible. Microsoft did a study where they determined that the average user's password was about 40 bits in strength. Watt. You can make things a little better with key stretching which is a must have in any modern encryption or password hashing application. The idea is you just make the hash take a lot of CPU time. If it's taking 100 milliseconds for the legitimate user's password to be checked it's not a big deal but you're going to make a cracker really sad if they have to spend 100 milliseconds each time. Even if they super optimize it they're checking dozens or hundreds of passwords a second.  And brainflayer does 130,000 a second on one computer and stretching could make that be one per second easily. Common algorithms S crypt, B crypt, SHA 512 crypt which is not the same as SHA 512, PBKDF2, similar sorts of stuff. There's a password hashing competition which was just recently completed. They announced their winner as Argon 2. I really need to go read up about that. It sounds really interesting. You end up being able to increase strength in a lot of cases by about a million fold using key stretching and it's not that expensive of trade-off. But you can do more. There's extreme key stretching. I came up with this and I've seen other people talk about it as well so it's not that clever of an idea. What you want to do is have a short value, say five digits, six digits, something like that, that is written down or stored on a disk. This is a shortcut. It's run through its own key derivation function. And if you have the shortcut and the pass phrase, it takes, you know, 100 milliseconds a second to recompute the key or verify it. If you're missing the shortcut, you have to brute force it. The legitimate user having the pass phrase or password can recover their shortcut in a few hours to a day or so. But then the attacker has to spend that long on every pass phrase or password they check. And who's got time for that? Pretty easy to generate a secure password or pass phrase. You generate it randomly. Diceware is great. And you might not be able to, if you have a bunch of these, you're not going to be able to remember them all, but hey, password managers can do that. But you need a master password for your password manager and you need to back up the password manager and then the backups can be cracked and it's just kind of turtles all the way down. You still have to memorize at least one strong pass phrase or password. I'm going to go over a little bit about what I've seen actual brain wallet thieves actually doing in the wild. There seems to be about half a dozen of them active currently. They're pretty sophisticated.  If you don't know what that means, don't worry about it. And they compete with each other. So they have to be fast. And they're not going to be fast enough manually, so they've got bots.  Rainbow tables are a lot faster than actually fully cracking, but they're also kind of slow. So lookup tables are really the only option. And some of these guys seem to have some pretty big lookup tables. If I were going to build one of these things, I haven't, but if I were, I'd go with a disk backed key value store using whatever no SQL database is popular that day. Use a truncated hash 256 as the key, the pass phrase or private key as the value, whichever one's shorter. Then you just have to monitor the transactions. You can't just monitor the blockchain, you actually have to actively monitor the network because by the time it's in a block somebody else's who's monitoring transactions would have already gotten it. So you have to talk to the network and then when you see a private key or an address that you have a private key for, you just sweep it off to your own address. And you do this faster than the other guys that are also doing this. So a $120 four terabyte hard drive should be big enough for about 64 billion passwords and pass phrases. In the wild, I am pretty sure I can confidently say that somebody's got one with at least 100 billion entries because they're able to instantly crack any random five character password I put out, like including numbers, letters, special character symbols, instantly. And anything on common word lists also was stolen instantly, song lyrics, mini song lyrics, that sort of thing, it vanishes instantly. Six random characters I've tried a few of and the ones that I've made have not been stolen yet. So this is clearly a little bit too big, but Brain Flare could go through that search space on EC2 for $1,300. If you actually want to memorize something secure, crypto mnemonics are the way to go. Diceware has been around forever, the idea is you take a big list of words, you roll some casino dice to pick words from that list and your pass phrases made up of those words. Electrum, as I mentioned earlier, also exists. There's also pronounceable password generators. I don't think they work that well, but some people like them. Then there's structured generators. This is trying to not only come up with words, but to put those words together in meaningful combinations. You could do adjective, noun, verb, tuples. You can use a Markov chain to generate things that look sort of like sentences. That sort of thing. It seems easy, it seems like it's going to be easy to remember. There's a lot of research going on on this though, and I expect this to improve in the wild soon. So your meat is predictable. Don't use it to generate passwords or pass phrases. Don't be robbed. So I figured I would make this fun for everyone. So Defcoin exists. It's a cryptocurrency for Defcon. There's the coin droid's contest. They use it.  So Brain Flare will be online shortly.  So if you want some Defcoin you can download Brain Flare and hopefully be faster than everybody else here. And I will announce this on Twitter when it's actually done. Which should be within an hour or two. Any questions? You got it? Are we doing a line or am I just shouting at people? Yep. In fact somebody there's uh he asked it seems the big problem here is that brain wallets don't use just use Shot 256. He's exactly right. A popular site for making these things is brainwallet.org and they're on GitHub and somebody actually submitted a patch to upgrade it to a hardened hash. And the guy rejected the patch with some explanation of oh well elliptic curve public key derivation is slow so this is unnecessary. This guy has been accused of cracking brain wallets himself. And yeah his site will default to empty string as a passphrase and there's no complexity requirements enforced. So okay who's next? You. Length doesn't uh he asked if inserting spaces in a password or passphrase would strengthen it sufficiently? No adding spaces does not significantly increase the strength of a password. Length really doesn't matter. It's complexity that matters. I think you were first. Um he asked if deterministic wallets could have the same problem. Um there's uh bitcoin has hierarchical deterministic wallets. If you seated them with a passphrase you chose yourself then yes it would have the same problem depending upon whether or not any hardening or salting was used. But electrum is the most popular tool that does this and it will choose a passphrase for you so you don't have that problem. Uh does adding spaces or capitalization to a password actually weaken it under any circumstances? Uh oh like if someone hears you type it. If someone is hearing you type passwords and is using this to against you you have other problems. Uh but I mean the weakest version of any passphrase is going to be one that appears verbatim somewhere. So if you stripped all the spaces it would be very very very slightly stronger but if you're relying on this to save you you're going to be disappointed. Anyone else? Uh there was that one in africans. Uh I found some in Chinese and Russian. You know you said any multilingual like two languages in them. Um I didn't find one but I don't think that the lists I was using had anything like that in them. Uh so there might be I just didn't find them. I can't hear you. Uh I had a couple of slides with examples on there. Um there was definitely used the force loop in there. Anybody else? Oh yeah I'm sorry I did skip over that. Uh he's asking how I figured out what people are actually doing. Um the answer is I made bait wallets. So you know I made this mental model of how I would steal brain wallets if I were going to do it and I realized well they're going to have bots and so if I send a small amount of bitcoin to a weak brain wallet any bots capable of stealing it will steal it. So I was able to kind of use their theft bots as an oracle against their look up tables. And then by doing some blockchain forensics I was able to see get some idea rough idea of how many of them there are. Anyone else? Way in the back? Uh are you saying it's too big too small or too big by a factor of ten? Uh he's saying that my math was wrong. Um one second. Uh my assumption is that storing a single passphrase takes about a hundred bytes. Right uh if you know what the dictionaries are you still have to store the dictionaries somewhere. So your dictionary is taking space either way. So you can't optimize it that much. Um I'm sorry I'm having a little bit of trouble securing you. Uh right but the look up table has the dictionary words or private keys themselves. Uh find me later and we can talk about this.