Akulana, hindi na neneza b cuteja, narega ni sekohera sekuretisha wiki gudwa nnezako wiki kuu. Ya, hindi na heneza, narega ni sekohera sekuretisha wiki kuu. Hata ni bida nezako wiki kiyama kuwa kuhu ni mezi. Yes, I think we have heard several sentiments by state council John Sangwa, who has been misleading the public about issues of the presidential eligibility and matters of the constitution. We are fully aware ourselves as PF and as a legal profession that Mr. John Sangwa state council is one of those lawyers that was representing Hakka in the HLMA in the 2016 petition and we are also aware that is one of the lawyers that misled the church on the number of the 14 days and is the lawyer that lost the election petition when it was thrown out by the court because it was presented to court. But they failed to finish it on time. So state council John Sangwa was also the lawyer in the Dhanipole case. He was representing the law association of Zambia and the court has clearly defined its decisions on both matters. So we are wondering why state council John Sangwa would today come and say in matters that are water under the bridge. Who in this country or in this world can say Dr. Edgar Chagwarungu is not president of Zambia? Who can listen to John Sangwa when he says that? First of all, on the issue of the petition that was dismissed, when a petition is dismissed, do you expect the court to make a decision or a judgment on a matter that they have thrown out? So for him to say the court did not decide that they did not declare president Lungu eligible, there is no law that authorizes the court to pass a decision on a matter that they have thrown out. So John Sangwa is misleading the public and is actually being treacherous. Having lost the corncote case in 2016, September, when the court threw it out, he should have actually found another way of coming back to this issue. Today as we speak, state council John Sangwa is ranting on almost each and every case. He is actually picking up on a topic and going to the public and saying this is what the constitution says. John Sangwa lost almost 7 cases from the time the 2016 constitution came in place and me I know him as my former lecture and as my former boss. I know that he has never won a case. So this is the man who will go around telling people he is a constitution expert but why doesn't he win constitution law cases? Just recently we had the Bizwa-Ukwunika case where the court was deciding on the 12th certificate. I handled that matter myself and the case presented arguments before the court went in our favor. And now it's clear as to what constitutes a 12th certificate. So can we again go back to the same court and say the court has not ruled on the 12th certificate? I've heard him telling people that as far as he's concerned the court should have nullified the seat for the Rundazi Central. But look, the law is very clear. If John Sangwa has a couple of the constitution he will be able to see that the constitution has a 90 day period within which a election petition can be presented. The Bizwa-Ukwunika case was presented to court after two years. The elections were in August 2016. The matter went to court in 2018, almost 2019, early 2019. So how can the court nullify a seat when the constitution says the court has no power to hear an election petition outside the 90 day period? I've also heard him saying no the president has violated the constitution several times. First of all he was not sworn in by the chief justice. All those arguments John Sangwa is presenting below the standard of the Bizwa argument. Because if you look at the manner in which John Sangwa has been trying to mislead the public, it's very clear that he has always wanted to come up with an argument that people would actually persuade with. For instance, when John Sangwa woke up and started saying he's going to petition the president's nomination, we want to find out from him. When the court has ruled, because the court has ruled on the presidential eligibility and there's a judgment which is binding. It's that judgment is perpetual, it's binding, it's futuristic and no one will change it unless the court itself. Now, when John Sangwa says that when the president presents his petition, his nomination, our petition saying that it's not eligible, the question is simple. What was the decision in the Dandipoli case? Where John Sangwa presented all those arguments including the fact that the president was not eligible. John Sangwa presented those arguments and lost before the court. So when he goes to court and says the president is not eligible, the question that would be put to him is did the president save three years between 2015 and 2016? The answer is no. What constitutes a presidential term? They've already defined all those things. So we are waiting for him. The moment he presents a petition to court, we will also present a judgment and say this case was closed. This matter of saying whether the president is eligible or not was already closed by the court. His other argument, which is also a very shallow argument and the basic argument, the premature argument is that the judgment did not mention President Lume. How was he expecting the judgment to mention President Lume when the judgment, when the constitution does not mention President Lume? When the 2016 constitution was signed, you can read it either way back to front, to front, to back. The constitution does not contain Ed Galun or President Ed Galun. Why? Because the constitution was not made for the president. It was made for the people of Zambia. And that is why it uses words like the person elected. It could be tomorrow President Lungu not being set house. Do we need to change the constitution? Where does John Sangwa see a constitution carrying people's names? So we want to rabbi show his claims and just help the people to ignore him because we feel time has come for us to put him where he belongs. For instance, he's been telling people that the president would have committed treason if he presented denomination to the ECZ. Does John Sangwa understand the offence of treason? If you read section 43 of the Pino Code, treason is known. It's an offence where somebody wants to take over power using unconstitutional means. Now, what is the role of the Electoral Commission of Zambia? The role of the Electoral Commission of Zambia is conduct elections. So the nomination process is the beginning of elections because then only those validly nominated will be allowed to stand. So when John Sangwa says if the president presents a nomination, I will say he has committed treason. All those arguments are not supported by any legal provisions. They are not supported by any law and I also know that 90% of the time John Sangwa fails to point to the supporting law. He just makes blanket statements. He will never point at the law that is actually supporting his argument. So we want to aid the people of Zambia, forget about John Sangwa. He is nobody. John Sangwa is nobody. He is not the only Zambian lawyer. He is not the only person who knows the law. All the arguments John Sangwa has presented before the courts were thrown out. You remember that when John Sangwa, when he misread the church on the 14 day period and they said that the matter had actually come to an end because they could not finish it on time. John Sangwa went to the High Court. Usaka High Court presented the petition and said that he wanted the High Court to instruct the corn court to hear the petition. The High Court threw out that case because electro matters. We all know the power to handle electoral cases lies in the constitutional court. So they told him the High Court has no power to hear you John Sangwa and will not waste our time. So all the cases he lost in court he has now started coming back to the public presenting totally different views. So we want to advise the public to seriously ignore him because as far as we are concerned, John Sangwa is a nobody. This country does not belong to him. He is just one of us. He cannot stand up and say this one must be president, this one must not be president. It's the people that decide who goes to the state house and the hatred and the levels of hatred that John Sangwa is exhibiting towards the head of state actually shows that everything he is trying to say is saying it out of vengeance, having failed to win Hakainde's case and he is also conflicted because he has been representing the UPND and the church. So why don't we get a neutral person to tell us about the presidential eligibility because John Sangwa is not neutral. He is not neutral and he will never tell the truth on this matter. And for all we care, once the courts have decided the matter and closed it, it's dead and buried. No one can reopen it and no one can overturn the judgments of the court. And that's why John Sangwa is busy committing kuntim to court day in, day out. Of the five cases he presented to court against the president, he has never won any of those cases. So how does he come up today and say that some cases he lost in court, he is busy telling people wrong things, he must learn to respect court decisions. And this is the same John Sangwa that was telling the judges of the court that they don't know the law. We are incompetent and unqualified. He presented these cases with different courts but he has simply lost. So the problem is not to the courts, it's with John Sangwa. So we want to advise John Sangwa, please take your seat and do not mistit the public because the people of Zambia are aware. Come 2021, August, we are going for elections, the president will win again. John Sangwa again will petition and he will lose again because he is the only one who lives in a world that nobody understands. So we are grateful for this opportunity to just respond to some of the arguments that he presented and also we are grateful to the people that are following this argument. And maybe as we wind up, let me also address the issue of the Great Warf Certificate. I have heard him mentioning the issue of the Great Warf Certificate, a case which I handled personally. And he was telling people the court was wrong, they should have notified the seat, they should have done this and that, they should have gone this and this that way. I think it's very clear if you look at the judgment itself and the arguments that were before the court, the examination counts of Zambia regulations on this Great Warf Certificate came into effect in 2018. By that time, by 2018, there was no such regulation to control the type of Great Warf Certificates. The Zambia Qualifications Authority, level descriptors, which are used now in Zambia to see what is your level of qualification if you come from outside the country. Those regulations only came into effect in July 2017, after the candidates had already done their nomination. So by law, John Sangwa cannot talk about the court going below or before the law, because the law was there but there were no regulations. So the issue of the Great Warf Certificate has been debated by the members of the public, must be understood that the issue of the Great Warf Certificate has always been there, it's not a new law. People have always been getting Great Warf Certificates and Sku Certificates. What is there now is just complying with what the 2016 constitution said. And the 2016 constitution requires that a person should have a Great Warf Certificate. So what the Konkot did in the Bisoyongonika case, we presented our arguments in that case and the court said, for purposes of elections, a Great Warf Certificate should be a Sku Certificate or a GCE that is equivalent to a Sku Certificate. And the court threw out all the other arguments put up by the other lawyers where they were saying, look, all this tertiary education and so on do not qualify. So the court has helped us in that matter by defining what an equivalent is. So according to the Bisoyongonika case, the Lundazi Central seat, the court is saying for it to be equivalent it should not be more than a Great Swolf. Meaning diplomas, degrees are not equivalents of a Great Warf Certificate. All these certificates and other other qualifications which don't meet the Great Warf Certificate do not also qualify. Meaning, even if you have a PhD master, when you are going to stand in an election, what they will be looking for are your qualifications at Gr. 12. If you are going to invest of Zambia, they may look at other qualifications, but if you are going to stand as an MP, they must first look at what qualifications you have at Gr. 12. And that is why we are saying, John Sangwa was not in court in this matter. He doesn't know the arguments that were presented, but he's busy misleading the public. How was the court going to qualify the seat when there was no such petition? The petition before the court was that the Muhonalbo Member of Parliament reached the constitution because it did not have the requisite Gr. 12 certificate. But in John Sangwa's own thinking, he says the court should have notified the seat. How can the court notify a seat when the argument is different? When you ask for an apple and you are given a different fruit, how can you say I am making an apple when you are being given something else? So I just thought I could add one line on the issue of the Gr. 12 certificate and say that this is not a new law. The examination counts of Zambia has been in existence for a very long time. The 2016 constitution has been in existence for five years now, more than five years. I have been coming to effect on the fifth day of January 2016. So as we speak, all we are expecting, all people who want to stand as members of parliament is to present their Gr. 12 certificate as in school certificate or to present before the examination counts of Zambia or electrocommission of Zambia qualifications that will meet the five all-level subjects and not as John Sangwa has understood it. So I just thought I could add one line to that issue and also wish to thank the people of Zambia for supporting the law because I think we all know that parliament must have people capable of debating national issues. And that was the basis. The recommendation on the Gr. 12 certificate came from the people who were doing the constitutional view commission and they said they wanted to raise the level to jump from ordinary citizens to at this school reverse. In other countries, to become a member of parliament, we must have a master's or a PhD. In Zambia we are okay, we are talking about basic Gr. 12 certificate because we got secondary schools in every constituents of this country so we cannot fail to have Gr. 12 school reverse. The only issue we want to add the ECZ is to ensure that the way they apply this law must be uniform. They must apply it in uniform manner without dealing or allowing their people to accept wrong qualifications. Once they come up with a uniform standard, the people of Zambia will be very good.


Hi everybody, thank you for coming today. I know that it's getting somewhat late, but what I want to talk about is the other targets that surround the election system. Now I know that a lot of us are concentrating on the voting machine and certainly I have been, but there's other ways, as we've probably heard some of the other speakers mention, that elections can be swayed. So what I really want from everybody to get out of this is to understand that the voting machine is very important and we have done a lot of research into it and things like that, but there's other things that we need to consider. So this is me and I've put this slide deck together just because a lot of times with security we think that this is done by these people in a dark room in a closet and things like that. No, I mean we are normal people. I'm a private pilot, fixed wing drone pilot and love life and freedom and everything else. So this is normal people doing normal things that are finding just how easy it is to get vulnerabilities and to compromise our election systems. So I'm from the purple state of Florida and I promise I did not plan this out and if you guys have seen Harry going around the voting village he's wearing a purple shirt. So somehow we must get the memo. So Florida is always in the news about something, whether it's alligators or if it's the recount of 2000, the gubernatorial race of 2018 and of course it was the scene for hacking democracy where Harry and Bev and Dr. Hugh Thompson did a lot of filming in Florida and just so happens that I'm from Florida also. So the voting machine, I knew I couldn't get out of here without at least talking a little bit about the voting machine. This is one that we've simulated the whole election system and you'll see as I talked about the various components of this is that the first one that I looked at was in 2016 in preparation for DEF CON and it was so riddled with vulnerabilities and things like that that we decided that hey, let's just make our own with all the other components of it and that way we can talk about the security aspect because it wouldn't be that much fun if I brought the real voting machine to Black Hat back in 2016. But something that I find as I looked into this voting machine and along with the other components of the modern day election system is that a lot of the basics aren't even being done and I know we've heard that quite a bit. Some of these and I use the air quotes hard drives are just regular compact flash cards and if you guys go over to the voting village you'll see some of those compact flash cards. Some of these air quote hard drives, maybe they wanted to make them a little more secure by embedding the hard drive onto the board itself and they used a type of chip called a BGA or ball graph array. This is nothing more than a memory chip that's soldered to the board so a little manipulation and we're back to square one. This is something that's really important as you see these machines, regardless of the operating system, I've looked at two separate ones and both of them were different operating systems but it wasn't even the basics weren't utilized. So there's no encryption, full disk encryption and those kind of things and even our phones have those on them now and most laptops, I mean if you have an Apple product you click file vault and it's done and so there's you know tons of things that aren't even being met by basic security. So just a slight disclaimer because I know I always find one person in the crowd that says you know debunks you know things that we try to say but these are just the machines I looked at, two of them from two separate manufacturers and the last one was used in the last election and the other one was used in the 2016 election. So anything I talk about throughout this presentation is just the hardware that I've had the utmost privilege of exploiting. So the memory cartridge is whether it's made by Sequoia or any of the other vendors there's some kind of medium that flows back and forth and so one thing that I hear a lot of is these machines are not connected to the internet and most the ones I've seen they did not have a direct internet connection but if you take and put a memory card or anything inside of a machine that doesn't have internet connectivity then you put it in a machine that does have internet connectivity and then you put it back into the other machine when you have internet connectivity you just have really really long ping times and latency and stuff like that a lot of us in the business call it the sneaker net right so you don't have an ethernet you have a sneaker net between them and so these voting cartridges are perfect for reading and writing stuff too moreover since they're not encrypted at rest whenever I received the voting cartridges it was pretty simple this form factor here while it you know some of us that have been around for a little while understand that that's a PCMCIA or laptop card and so for a couple bucks on the internet you could buy one of these things and and they're very outdated and you plug it in and the ones that I bought actually had the election system ballots still on there now I couldn't see who voted for who but I could see who had points in different areas in the tally and stuff like that but what this gave me was a glimpse into how these machines work and because that was available on one of the major online auction sites I was able to grab this no full disk encryption so this is a very high value target that I acquired as a good guy but it allowed me to make my own ballot which was pretty cool and the machine accepted it and did its integrity checking and all that fancy stuff and seemed to load it up so that was pretty cool so you know as we move forward with these and I know that a lot of people talk about these not being connected to the internet just rest assured that unless you're using things like write blockers and all kinds of stuff really this is to me is one of the highest value targets because this is used to not only load the the ballots but it's also used to write the information then to the cartridges that are transferred so you can do things like stuffing the ballot box virtually and things like that this is something I've been focusing on quite a bit lately is this piece of the election infrastructure is what myself and my friends and everybody else hopefully stays up late at night on election night to see that real-time dissemination of voting right it's almost like the Superbowl's like yes this state's reporting and this much stuff well this dissemination system is something to me that's greatest concern because there's not a standard protocol and procedures for how does this information get disseminated and so as one of the other speakers we're talking about some people use Twitter and stuff but in general what I found is that there's not so much a nationwide central repository most of this stuff is stored out on cloud servers whether it's you know name your your major provider but whenever I was looking into this into these buckets and shared drives currently as of three days ago because I wanted to make sure that my talk was current that this is still a factor in one of the states that is storing the same data from the election results the unofficial results in the same bucket of data or shared drive whatever you guys want to call it as the division of corporations records and so now we know a security professional right I mean let's get least privileged access and now something I wonder is is that if they didn't take the a little bit of forethought to say you know what why don't we at least get our own bucket or own shared drive and have just this in there now someone can be compromised from the division of corporations at this specific state and could could change this file or manipulate it now the news media or whoever's pulling that information so they could be the first one to call a state that file I mean there's no hashes and keys and md5s and all the stuff that us look at when we download stuff so you know that this information could hit the news media very quick and me being from the purple state of Florida they could call the election for one candidate or the other and that may have people staying home because they're like oh well they already had it moreover you know this free flow of information I really do love it but when you think about it they're using things like exit polling data I know that my wife was involved with one of these exit poll things and they instructed her to download an app and she was supposed to pull these people I'm like wait a second let me take a look at this application you just downloaded to your phone so you know where's the security and the integrity and we just heard not a couple days ago that one major online dating app was leaking not only pictures and stuff like that but you know so this information is flowing pretty quickly and we need to make sure that this is you know there's at least some kind of standards and stuff in place that control how this data is stored where it's stored at and things like that and then simply with the app that I looked at on her phone it said that if there was not any data for the exit poll like maybe you know someone didn't want to do that you could you could click that and then they would use historical analysis for that precinct area so I just think that really as we talk about this part of the election system which it is a part of this real-time dissemination of data I mean this needs to be looked at to make sure that someone doesn't manipulate this to you know sway the outcome of an election or call some kind of unrest and distrust are these smart cards these are awesome I think I still have one on me that we actually made ourselves these smart cards is what they tell a lot of people well you know we we use a security encryption and you got to have a card and from the best that I could tell is is that you go up and you get one of these smart cards and then that just allows you to vote but your information isn't stored on there but digging in a little bit more we've seen tons of exploits in the smart cards and I don't want to have a show of hands because I don't want to incriminate anybody but you know back in the day there was a certain digital satellite broadcast company that had a lot of had a lot of issues with their smart cards right rumor is it was hacked before it even went up and so smart cards are notorious for vulnerabilities and stuff but what's more interesting is is that on the output of these cards it's simply serial commands right so it does some processing inside with the cpu does all the stuff so if in the demonstration I gave back in 2016 we were able to simulate a compromise of one of these smart cards and we were able to you know vote multiple times and stuff like that now that would probably get detected because you know too many people voted for that precinct that's registered and stuff like that but you know when you look at this as one of the targets of the modern election system there's there's more work that needs to be done I mean there's all kinds of things into this from cloning to manipulating to glitching and all kinds of stuff so we've talked about the communications path a little bit on this here really this is how this information is loaded to the machines and how it goes from the machine back and into the dissemination but moreover the communications paths I'm talking about with this is in the peripherals of the machines these are the the printers that print out that all official tally that says this is the the stuff that how people voted and you sign it as the poll worker and turn it in I have one demonstration that I gave into one of the voting machines where my boss because I kind of like him because he you know pays my bills I made it where he won the election and when the tally came out it was completely legit and stuff to the eye of the poll worker and they needed to sign it well there was a compromise in the path that were no matter how the machine voted then I could make it print out whatever I wanted by looking at the candidate so it was pretty technical as far as to try to evade detection but the end result is is that whoever was the winner the name that I inserted would automatically be the winner of that particular one yeah so all together you know all these devices another thing is is that the for americans with disability act type requirements you know these audio files that are loaded onto the machine you know when someone plugs into that headphone jack one I can replace you know the file on the machine but moreover I could have also audio inside of there that maybe it's just white noise and then they have an issue with the machine or something like that but more over I can put in the audio file and tell it you know left is this candidate right is that candidate so when you look at these paths you know it's not just the machine it's everything that's connected to it network wise and peripherals and stuff like that we've had demonstrations where those paths can become compromised to then put out different results of course social media this is something that's really starting to to play out and also like we saw with Cambridge Analytica and things you know a lot of people just like the front page of the paper no one really would read I don't I don't get the paper anymore but I've heard that no one reads past the fold right whatever's at the top same thing with Twitter and Facebook and stuff like that not too many people go and do in-depth stuff Google you know that's why they charge so much to be one of the top search results so with social media anybody can say anything they want and also too they can profile groups of people and by seeing who your friends are and stuff like that to then feed this information websites is a real real big one also because anybody can register any domain for anything right so we see this a lot like someone doesn't like a major company is like this company sucks calm well candidates names through domain squatting and stuff like that can can also be used by adversaries to be a target where if you want to do more research maybe type type in the candidates name but moreover you know through domain squatting stuff like that you put some thing out there that's a very highly controversial subject and say they're for or against it you're seeing a lot of these Facebook and Twitter are doing the shadow banding and those kind of stuff and so I've gotten a couple personal invites to join our slack channel or join our discord channel because we can post whatever we want and these I think are just highly susceptible because one if you're sending out all these invites to slack and discord for these private channels but also that is just a megaphone where people can get in there and say whatever and so you know I think with a lot of the social media and things like that with some of the censoring and banning regardless you know what your views are of that you know you're seeing these private channels that are being created and to me those are you know just ripe for the pickings so the question is we get all the time what's going to happen you know in my professional opinion what's likely to play out is there it only takes one machine and one precinct and one county to be compromised that's it then the other problem is is that we don't really have the mechanism to understand whether that happened or not and one particular machine that I had the luxury of playing with I was able to put devices and components in and out of that machine and us as security folks we're like oh why don't we just go to the logging data why I found out that that particular machine was only logging data that the vendor actually cared about which is the ballot load did you know so they don't care if you or in this particular one they didn't care if I put a network card in and out of the machine they didn't care about that you know that was never locked so the problem is is that with hacktivists and things like that or other folks all they got to do is say it and then how do we prove it I don't think that you know I think we're more able to see things you know injected with bogus data like I said with the media and and things like that where you know those systems become compromised and then you know of course defacing insider threat and the reason why I put insider threat is because this is one of the areas that I hear all the time and we've heard a couple other speakers talk about it is that they say that well you would have to have physical access to this machine and so I roll back to my first slide you mean you mean the guy that's like happy go lucky and loves life and stuff yeah I'm not going to go break into a precinct and do this but when you read the SOPs on official government letterhead that says you should plug the machine in at night at your house and I'm kind of you know ad-libbing here so the batteries are completely charged I mean it only takes a few seconds in any of these attacks so the fact that you know the insider threat just go you know volunteer to be a poll worker or something like that so saying that you know someone that's highly sophisticated would have to have access to it it's not that just like I mentioned with the satellite card days right I mean you could buy the equipment where someone could just press a button and do it so the insider threat to me would be the biggest to the physical machine but the rest of it is you know through disinformation so with that I'm trying to speed it up a little bit because I know the other one ran a little long so anybody has any questions I guess I could take one or two or see you at the back oh right here the first thing I zeroed in on really quickly is you said they're going to get an email uh yeah I mean there's uh to me that would be one of the first I'm not saying the email is not secure but you know when you look at that now you know what is what email address is getting uh registered or how they send in this email and all the other things around that and then you said a telephone uh what's going to happen is that cell phone perhaps right yeah um because sim jacking is not a real thing in modern times right so yeah I mean you know any of these systems they can be secure and that's what I tell everybody like we have the technology to solve this right I mean we have things with open ledger technology and we have but right now you know I try to stay out of the political part as a professional but we can't even decide if we're going to show our ID or not or when we go to to the polls so I mean now we're going to collect phone numbers and stuff like that so yeah I see a lot of concerns and issues with that oh yes ma'am yeah so I think there's definitely a future for blockchain and I'm really that's why I'm very excited that DARPA is uh at the voting village and they're working towards that open source voting system because I think the more eyes that we have on this the better we are uh I mean case in point with the voting village now I mean we have thousands of uh and you know experts look at that and they're finding vulnerabilities left and right and so when you think about it when you open source and I know there's two camps and I'm in both camps with open source technology but I think for what's at stake I think that we need as many eyes looking at the source code and things like that so blockchain is definitely one of them and you know like I said I've been on the on conference calls with some congressmen and women and a few senators and very quickly the conversation deteriorates not from the election security but it states rights and sovereignty and stuff like that so I think anything that's out there that could probably solve the problem we need to get over some of the uh social uh sociological issues first before we even attempt to do that so yes sir in the back sure yes um definitely so this would be the last question because I'm getting getting the cue from the back uh I think what we're doing right now is what our best hope is in the short term is the education piece of it because before folks like harry and and and team started looking at this these were essentially just devices that no one really you know looked at and now I think education even my mom if she goes to vote and she sees anything wrong without voting machine she is going to be hyper aware so the more we can educate and and and it's a very complex ecosystem that has you know with a modern day election system so maybe there's a senator or person or IT professional at a county or something like that so I think we got to do a course correction for this big ship that's uh that we're sailing on so I think in the short term there is hope uh like I said I don't think that there's going to be widespread exploits into the voting machines that's going to change the outcome of the election just I don't I don't see that but now that people are educated I guarantee you there's any glitches whatsoever it's going to hit uh the the the social media outlets and tv's and stuff like that so well I appreciate everybody coming and um like I said I'll be floating around in the back if anyone has any other questions and stuff and with that enjoy your defcon


Item Number, SCP-459, Object Class, Safe Special Containment Procedures SCP-459 is to be kept unpowered in a standard security locker. The access code is to be changed bi-weekly and known to level 3 and higher personnel. As of 04-15-2000, testing has been indefinitely suspended. Proposals for use should be directed to 05 level personnel. Description, SCP-459 appears to be a standard home thermostat. The item is equipped with a small display, four buttons, and two dials on either side of the screen. The two buttons on the right side raise and lower temperature, and the other two appear to affect relative humidity in the area. However, these buttons will only work when both dials are set to the off position. The left dial, Dial 1, is marked with several standard weather conditions, including rain, snow, and data expunged. The fourth and fifth positions have been respectively designated T-Storm and Hurricane. The right dial, Dial 2, has different settings, all of which are unmarked. The rightmost positions on each dial are the off positions. SCP-459 can, when wired to a heating and cooling system, modify weather patterns in addition to temperature and humidity. The area of effect appears to be about 1500 square feet, or about 139 meters squared. The same amount is a modest home. How these effects are produced is currently unknown, as site-wide heating and cooling systems show no abnormalities in the area, even if the temperature is significantly different. The testing may suggest SCP-459 can access resources from other planets, and possibly other dimensions. Addendum 459-1. SCP-459 was discovered in a suburban home after reports from neighbors of loud noises and bright flashes at night. Authority's first attempts to investigate resulted in attracting the Foundation's attention. A group of agents with standard protection gear cut power to the house, and proceeded to retrieve SCP-459 without incident. Wherein, all agents returned to site-wide with the device. The bodies of the occupants of the home were recovered as well. Cause of death is officially listed as a gas leak. Test log 459-2. Pre-testing note. The default settings are 20 degrees Celsius and 50% relative humidity. Dr. W. Name. Dr. W. Date. 316-2000 W. Temperature, humidity, weather setting. 20 degrees Celsius. 50%. Dial 1. Snow. Results. After 127 seconds, rain began to fall in the testing area. Temperature indicated by SCP-459 is confirmed. Weather cleared after 20 minutes. Notes. I thought it would decrease the temperature. Well, I was half right. This is, functionally, ordinary weather and follows the same rules. Dr. W. Date. 316-2000 W. Temperature, humidity, weather setting. 23 degrees Celsius. 75%. Dial 1. 4. Results. After 47 seconds, dark clouds began to coalesce followed by moderate rain and occasional thunder. Wind speed inside the testing chamber peaked at 67 kilometers an hour. Weather cleared after 34 minutes. Notes. Nothing particularly unusual, though maybe we should have some weather gear close by next time we test this thing. Dr. W. Date. 316-2000 W. Temperature, humidity, weather setting. 26 degrees Celsius. 80%. Dial 1. 5. Results. At first, outcome appeared identical to second test, but seven minutes after activation, weather conditions began to sharply deteriorate, with heavy rain and winds reaching up to 162 kilometers an hour, followed by W. Weather took over two hours to clear up. Site-wide brownouts reported. Notes. Let's not try that again. While watching a handful of sopping wet researchers being blown around a test chamber is, in retrospect, hilarious. My assistant getting electrocuted and the risk of site-wide containment failure put a bit of a damper on the whole thing. Dr. W. Date. 324-2000 W. Temperature, humidity, weather setting. 20 degrees Celsius. 50%. Dial 2. Leftmost position. Results. After five minutes of inactivity, Dr. W. Exited the test chamber due to a spontaneous nosebleed. At seven minutes and 32 seconds after activation, a breeze began to blow throughout the room, increasing in speed very rapidly, after which, the view was obscured by large amounts of unidentified red material data expunged. Sensors clocked the wind speed at 428 kilometers an hour before they were destroyed. Data expunged. Entire east wing locked down. Weather did not subside for a week after the incident, and further testing was suspended until the test chamber could be fully inspected and repaired. Inspection of the chamber showed large quantities of ammonia, hydrogen sulfide, and other chemical compounds known to make up Jupiter's atmosphere. Notes. Was that the red spot? Dr. W. Date. 415-2000 W. Temperature, humidity, weather setting. 20 degrees Celsius. 50%. Dial 2. One turn from leftmost position. Results. D-Class personnel adjusted the device accordingly. After 742 seconds, data expunged. All further testing suspended indefinitely. Notes. It took three weeks to get the thing back, but it's completely undamaged. It's possible we could use this thing to help recreate natural environments for certain Earth-native animal SCPs. Dr. W. Lesson complete. If you missed the previous orientation, go watch SCP-458, the never-ending pizza box, right now. Or for the complete course, watch this playlist.


Hi everyone, Joe for Jaspy's casebreaks.com, coming at you with a box of 2019-2020 Panini Obsidian Soccer, random number block break, number 36, the second to last box that we have in the shop. Works just like our number block breaks. The next one's already in the store too. Big thanks to these folks for getting into it. There are the numbers right there. Let's roll it, let's randomize it. Four and a three, lucky seven times. One, two, three, four, five, four, five, six, and seventh and final time. After seven, we got Roy down to Cody. And then four and a three, seven times for the numbers. One, two, three, four, five, six, and seventh and final time. Got zero down to three. All right, so Roy with zero, you'll get any and all redemptions in this one box that we're about to do, including one-of-one redemptions. Robert Runkle, you'll still get live one-of-ones. Last spot, Mojo too. James with nine, Jim with eight, David with four, Robert with six and five, Roy with seven, and Robert with two, Cody with three. Let's order these numerically. I doubt there's gonna be any trades, right? While you're considering trades, let's see which box we're gonna do. So we'll go one, two, three for the top box, four, five, six for the bottom box. I'll choose that Liverpool red die right there. One, two, three, four, five, six, that's my club. And it's gonna be one, so one for the top box, and we'll save this for break 37, which is the last box. There you go, 30, there's three and seven right there. Last box that we have in the shop. All right, no trades, right? No trades, so let's print, let's rip, let's rock, let's roll. And if you're watching live and not the replay, if you're watching the replay, it might be sold out by now, but the last box of obsidian soccer, jaspyscasebreaks.com. Check it out. All right, there we go, break 36. Yep, it's a Joe Jason night tonight, Corey. Jason on Instagram, live at jaspysbreaks. And me right here on the main channel. Bryce, I will answer that top's question after this Panini break. Usually just the base card on the bottom and then the hits, okay, perfect. Use that blank card to hide the hits a little bit. There's Billy Sharp from Sheffield United leading things off 43 out of 65. If there's any non-numbered cards, we'll randomize it to one person as a lot in this break. Sheffield United stayed up, had a pretty nice season in top flight, Premier League, Cody with number three. We got quarantine, Tolizo for France, 86 out of 165, Robert Runkel with number six. Nice, Mike. Yeah, hopefully we can do that final box tonight, the final box of obsidian tonight. We got Raheem Sterling, supernova. 27 out of 135. Roy with number seven. Former Liverpool player, pretty good player for the great player actually for Man City and England. We got Alessio Romagnoli, four out of 75. Atomic material rally. Number four, David Mundt. Then we've got Vasjan Shfaenstager, two out of 75. Robert Runkel with number two, getting the cutting edge. Piece of his shirt. Two more to go. We've got Jersey and Otto, the Argentinian Gonzalo Martinez, Jersey and autograph. And that is 93 out of 99. Nice, Cody with number three. And the final one here is John Stones, Manchester City defender. Two color, dual relic and autograph. Nice, let's see who that's gonna go to. That's gonna go to number one, 41 out of 99. Robert Runkel with number one.  Thanks for watching, thanks for joining. Last box in the store right now, jaspyscasebreaks.com. I'm Joe and I'll break that with you next time. Bye-bye.


There's a few very important points that if you grasp those, you're gonna be on fire. What's up Car Sales Nation? My name's Jeff Bachelor. I'm down here in Fountain Hills, Arizona. Just wrapped up a master closer seminar with Andy Elliott. And man, if you have the opportunity to come down to one of these seminars, it will change your life. The opportunity in the automotive industry right now is the best that it will ever be. And if you aren't sharpening your skills and trying to be the best that you can, you are literally letting the best opportunity of your life just pass you by. I've actually only been selling vehicles for only four years and over the last three years, I've helped over 300 families in consecutive years. Forget the economy, forget COVID, forget everything that's going on in the world. If you have a service, if you offer your customer something that's different than everybody else, they will come back to you time and time again. You see, I didn't actually choose the automotive industry. My general manager met me when I was waiting on tables and offered me a job as a dealership. And very, very quickly I realized the opportunity was out there. You know, salespeople were not servicing their customers like maybe a server wouldn't a restaurant. They weren't offering, you know, this immense care and appreciation for each and every customer that came in the way. I mean, the money's great, but being able to help somebody solve a problem and have them really genuinely appreciate it is the most gratifying part of this job. Now you can train with Andy, you can go to one of the seminars, but you can recreate yourself as long as you put the effort yourself into it. This is the best opportunity in the entire world to change lives and I'm very grateful for all the coaches, all the mentors, and everyone who's helped me get where I am. So guys, when people come in to see you it's not just about selling them a vehicle, it's providing an entire experience. See, I love it, because when my customers come into my dealership, I try to make it like an airport lounge. I got phone chargers, I got water bottles, I got heaters in the winter, and I got fans in the summer. I got a big sign next to my desk that says if I don't give you the best service, find you a vehicle you love, and you aren't happy with the numbers, don't buy. I mean, what kind of salesperson puts a sign on his desk that says don't buy? Well, one that wants to give the best service, give the best deals, and find the perfect vehicle so they do buy. Guys, social media is the easiest way to get your name out there right now. If you aren't trying to brand yourself, if you're not trying to advertise what you do different than the next guy, you are clearly missing out. You know, you will succeed drastically in this business by being different. So make sure that that edge that you have is being put out there to the world.  So as I mentioned, I haven't always been in the car business. In fact, I've probably made every single wrong decision before I started making some right decisions. So, you know, it's never too late to start. You know, every expert was a beginner once. So maybe this is your opportunity to start new. Start your new life. You know, make those changes that you've been waiting for.  Because working in the car business right now is not only an opportunity to change your customer's life, but also be the best version of yourself. You know, I found myself making all the wrong choices. I actually wrote a book to try to inspire and change the lives of others as well. And the interactions that you provide for your customers, the advice, the recommendations, and the service that you can provide can certainly make a difference in people's lives as well too. We're down here with the Elliott Group recreating salespeople, changing salespeople's lives who are eager to change their customers' lives by providing them epic service and awesome products as well. Man, if you have an opportunity to get down to one of these conferences, come see Andy in person. He'll make sure that you're running through the roof, busting through doors, and absolutely hitting your peak potential. There is so much opportunity out there right now. I'm only scratching the surface. I help over 300 people find vehicles every year, and I'm eager to double that, maybe even triple that in 2022. This is the era of the worst salesperson on the planet. Be different, be better, and watch the benefits, watch the rewards, you know, come rolling in. Make sure that your customers remember you, okay? If your experience isn't enough to make sure that they know that they should always come back to you for trusted automotive service and advice, do the fun things, do the extra things, go that extra mile. Your customers are gonna love it when you go that extra mile, so make sure that you deliver not only during the sale, but after the sale as well. I have a whole lot of fun with my customers. You know, I'll put gas cap stickers, door jam stickers, key chains with my names on them. You know, thank you cards with jokes in them, gift cards, all kinds of other stuff. These are the few little things you can do to stand out from the crowd. You know, surprise your customers and under promise, but over deliver every single time.  You wanna make sure that they never forget you. You wanna make sure that even if they're at another dealership, trying to buy another car, they think about the unbelievable experience you were able to provide, and maybe that way you'll get that phone call and you'll be able to come in and save the day. So guys, in a very crowded field of automotive sales professionals, you are the secret sauce. What are you gonna do different? I make this comparison all the time. Imagine a restaurant. Every single server in that restaurant has the same food, the same menu, the same opportunity to help tables, the same prices, you know, yet one server leaves every night with three times as much money as all the other servers. Well, that's you and the dealership. What can you do above and beyond all the other sales people at your dealership, in your town, in your brand, in your country? That's the secret sauce in the automotive industry right now. If you want people to treat you like your competition, act like them, but if you wanna be the best, be the best and stand out from a crowd. So I just finished a private one-on-one day with Andy Elliott, you know, a guy who cares nothing more about everybody in the car sales nations. He's somebody who really wants to change lives and I wanna let you guys know that you have the opportunity to change lives as well.  I've been able to give more money back to my community, donate and contribute back to the place I live and the people that I love more than I could ever imagine. I'm so grateful that I got good at this industry and got good at this job really quick because I've been able to afford anything that I've ever wanted and need by being successful in this business.


So the world is facing major issues to ensure future human well-being and ecosystem integrity. And the Sustainable Development Goals are one attempt to address the most pressing ones. However, past experience has shown that proposed solutions often don't deliver, while solving one issue, they make another one worse. So why do economic or technological solutions often fail? For many years I've worked at or studied what some call the world's largest environmental catastrophe, the desiccation of the air or sea, and the economic, ecological, and health consequences of decades of water overuse for cotton production. I was puzzled by the persistence of unsustainable practices, despite massive international assistance. So the region still has enough water, so why is there no solution? So I once said we cannot solve our problems with the same thinking we used when we created them. Historically development is based on a thinking and on a quest to analyze, understand, and predict nature. It was believed that we could predict nature and control and manipulate it like a machine, thus reducing uncertainty. The human environmental systems we live in are not simple machines. They're systems of humans embedded in ecosystems that are characterized by high levels of interconnectedness, uncertainty, and abrupt change. We saw fisheries collapse or the resistance of management, like in the air or sea basin. So solutions that don't address those interconnectedness lead to unexpected outcomes. In my project, Muses, we developed computational models that actually capture human nature interdependencies to serve as a laboratory for virtual experiments and to identify key mechanisms that actually might underlie and propose leverage points for solutions. So one of those mechanisms is reinforcing feedbacks, as we've seen in backgrounds, for example, where the expectations of bank failure leads to the withdrawal of money that leads to collapse. Balancing feedbacks, on the other hand, stabilize systems like the fox and the hare. One example of the importance of feedbacks or actually the lack of feedbacks is the collapse of the cod fishery in the Baltic. A fate that actually happened to many cod fisheries around the world. So there was a boom of cod in the early 1980s and it suddenly disappeared and basically not recovered until today. So what were the ecological and social processes that led to that collapse? So in an ideal world, like with the fox and the hare, a reduction in fish would actually lead to a reduction in fishing. However, in reality, those feedbacks are often delayed or even absent because of market dynamics, because of incorrect beliefs of fishermen. So we use the model to kind of understand how the lack of adaptation of fishermen interacted with ecological dynamics to actually produce that collapse. Feedbacks often underlie also persistent poverty, so-called poverty traps. Here it is reinforcing feedbacks of low levels of production leading to low savings, which even decrease production even more, leading to kind of a downward spiral into poverty. So solutions to move out of poverty or to prevent collapses need to take these feedbacks and tipping points into account. That could mean managing feedbacks by turning them around, turning a downward spiral into an upward one, or introducing, creating feedbacks where they're missing, like information about the cod stock. So smoking, for example, is an example where feedbacks helped change a very persistent norm of smoking indoors. So while most people were smoking indoors, non-smokers didn't disapprove much of smoke exposure. However, once a law made more people smoke outside, disapproval of smoke exposure by non-smoker actually increased and reinforced that new behavior. Lacking feedbacks and that downward spiral of poverty is also what underlies many interventions to alleviate poverty. For example, through providing asset inputs such as fertilizers. However, with our models we could show if these interventions neglect feedbacks with the environment, like the effect on soil quality, they can make poverty even worse. So in summary, environmental problems are created by complex interactions between humans and the environment, and we need to take these complexities into account. However, we don't need to be overwhelmed by them. Identifying key interactions can really help us to find leverage points to move towards more sustainable management. So the new thinking or new mindset that might help us address global problems need to acknowledge that people are a part of ecosystems and that there's limit to prediction and control. Tackling those issues really needs collective action by everybody involved. So from the fisher, the trader, to the consumer and the government, because management becomes a process of identifying and manipulating or changing those interdependencies to watch more sustainable pathways. So I've tried to briefly explain how feedbacks can actually prevent change or they can accelerate change and help us to move forward. Another way might be to think about the social norms underlying our eating habits. How could we change those to move towards more vegetarian diets and address climate change?


what are you doing all the time yes oh my goodness I go here and she's like what am I and now it's the same with her in DC what is my name again this man


The uprogressive Congress APC in Benoist state has accused Governor Samuel Otam administration of setting a trap for the coming administration to slow down its takeoff. The Benoist state APC chairman Austin Agada at the press conference in Makodi, the state's capital, alleged that the outgoing administration had concluded plans to appoint his cronies as new permanent secretaries and give undue promotion to selected individuals of interest in the state civil service as well as falsification of financial transaction which constitutes an impediment for the incoming administration of the governor-elect Reverend Father Hyacinth earlier. The APC also called those whose names have been penciled down for such ill appointments, promotions and placement to reject such great gifts from the autumn-led administration.


Hello and welcome to the session in which we would look at the concept of purchase commitment. What is purchase commitment? Well companies what they do is they plan ahead and as a result they might sign contract to purchase material before production start because they want to secure the material. Therefore they will enter into a contract to purchase material and that could happen a month in advance or could be a year in advance or sometime two years in advance. At this point the company don't recognize any asset or liability because no title has been transferred. However if the contract is we have to determine whether the contract is cancelable or non-cancelable. If the contract is cancelable it's water under the bridge because you can cancel it you don't have to worry about anything. If the contract to purchase is non-cancelable the minimum you have to do if the contract is material you have to disclose this to let the users of the financial statements the investors the creditors know that you have an upcoming contract a large upcoming contract. What happened if the contract to purchase which is that your purchase commitment is non-cancelable and the price of that contract is greater than the market price. What does that mean it means you sign you sign a contract to purchase something for a million dollar and that same thing now is worth 800,000 your contract price is greater than the market price well you are expecting a loss if you are expecting a loss what should you do you should record the loss you should recognize the loss in the period when such loss taking place and this is based on the matching principle you want to recognize the loss in the period that it occurs and you want to be conservative because you are expecting losses you want to anticipate the losses there as you are anticipating the losses you record the losses this topic is covered in intermediate accounting as well as the CPA exam whether you are an accounting student or a CPA candidate I strongly suggest you take a look at my website farhatlectures.com I don't replace your CPA review course I am a useful edition I explain the material differently than your CPA review course I go slower I give you more examples this is the benefit this is the difference between me and your CPA review course once you use me with your CPA review course you're going to do much much better on the exam I would say you will add 10 to 15 points because you understand the material better and here's your risk try me for one month one month of subscription to find out whether I can help you or not if not that's fine you cancel that's your maximum loss your potential gain is actually passing the exam if not for anything take a look at my website to find out how well or not well your university doing on the CPA exam I do have resources for other college courses other than intermediate accounting advanced accounting cost accounting governmental accounting all other accounting courses my CPA supplemental resources are aligned with your becker roger gleam and wiley so you can go back and forth between your CPA review course and my supplemental material I also give you the access to 1500 previously AI CPA released questions with detailed solution and some of these questions I have video recording about them video explanation there if you have not connected with me on LinkedIn please do so take a look at my take a look at my LinkedIn recommendation like this recording share it with other connect with me on Instagram Facebook Twitter and Reddit the best way to illustrate this concept is to actually work an example let's assume on January 1st X5 Adam enter into a noun cancelable contract to lease a land to extract oil for a price of 6 million so Adam's expecting there is 100,000 in the land it can can extract 100,000 barrels and the cost is $60 by the end of 20 X5 you know Adam did not have the chance to extract them because Adam was busy the price of oil the price of oil dropped and as a result the same contract is worth now 5 million simply put most likely the cost is now the price of the oil is is lower so the contract for the same piece of land is now $5 million what would Adam have to do Adam will have to debit an unrealized holding gain loss which is a loss goes to income debit that a million credit estimated liability to purchase a commitment a million so this is basically a liability and this is a loss and the loss goes on the income statement this is a loss on the income statement in 2006 in 20 X6 Adam paid for the contract now Adam would still have to pay 6 million so what would be the entry Adam will credit cash for 6 million debit purchases or inventory for 5 million and now since since Adam recognized a liability they would reduce that liability for a million because now let's assume it's a liability that's what he's well that's what he's paying for now let's assume for the sake of illustration that the lessor decided to give Adam a break and charge Adam 5.5 million for the lease rather than 6 million because oil prices drop then Adam can reverse half of that they can reverse half a million debit estimated liability debit estimated liability 500 000 in credit unrealized holding basically reducing the loss because we still have a loss it's not really again we still have a loss of 500 000 now the best way to to learn this is to work mcq's work exercises and this is what you should do go to my website farhatlectures.com again at the end of this recording I'm going to remind you if you are studying for your CPA exam or if you are an accounting student farhatlectures.com can help you tremendously I am a supplemental tool I don't replace your CPA review course I don't replace your accounting course I'm just going to give you additional resources that's going to help you understand the material better do better study hard good luck accounting is worth it the CPA exam is worth it and stay safe


At Ellis Brigham, we take product testing really seriously. It forms a crucial part of our range selection. And today, we're out here at the ski industries of Great Britain ski tests in Kutai, Austria. We're going to ski them at different speeds, different turn shapes with different skiers. The ultimate aim, at the end of this, is to select only the very best skis to put into our shops. It's not the last part of our testing though, because we will take our staff away for a week to ski skis and boots so they can gain first-hand knowledge. So we're out in team in France. This is when we invite colleagues from all the shops to come out and join us. Try the skis that we've arranged for next year, validating our choices. But also, make sure that they've skied them, they know exactly what those skis do, and they can give you the right information when you come into store.


Hello, and welcome to this quick introduction to the new release of the Unicode Graphical User Interface. This GUI can be used to evaluate all ST sensors, ranging from MEMS motion sensors such as accelerometers, gyroscopes, compasses, and iNemo modules to environmental sensors. The Unicode GUI runs on multiple platforms, from Linux to Mac OS X and Windows operating systems. For this demonstration, we are using the version for Windows. Unico is part of a complete evaluation ecosystem, which includes the ST EVAL MKI 109-V2 motherboard based on an STM32F103 high-performance ARM Cortex-M3 microcontroller and one of the many available sensor adapters. Now let's start the Unico GUI by plugging in the adapter on the motherboard, which is then connected to the PC via USB. After having connected the motherboard to the PC, launch Unico. You must then select the type of sensor you are using and the name of the device you need to evaluate. On the left side of the launcher, select the type of sensor you are using and on the right, the device name. As you can see, there are several tabs on top of the GUI used to configure the sensor. The options tab can be used for an easy setup of the device. By clicking the easy configuration button, you can turn on the device and quickly set a default configuration. The register tab is used to read and write the contents of registers embedded in the MEMS sensor. The load save tab allows you to save a stream of sensor output data in a text file. It is also possible to save the register configuration in use and reload it at any time. The buttons on the left allow the visualization of sensor output data in both graphical and numeric format. They are also used to evaluate advanced features embedded in our devices. After clicking the start button, we can test our sensor, in this case an iNemo module, by simply moving the board. Acceleration and angular rate variations along X, Y and Z axes are shown in real time as numerical data. You can also see the evolution over time using the plot tool. Each curve represents a different axis. By pressing the interrupt button, you can display a list of programmable interrupts. For example, click on wake up on interrupt 1 and you'll simulate a function commonly used in mobile phones. When you move the board, you wake it up. Now let's test the 6D function. The teapot you see on the top of the screen is real time oriented by the software based on the movement of the sensor along 6 axes. The embedded 6D position detection feature we're demonstrating right now is commonly used to determine the screen orientation of portable devices. Unico has a FIFO tool that can configure the first in, first out data buffer embedded in the device, indicating both numerical data and the corresponding graph. All the available FIFO modes can be configured. The FFT tool displays the fast Fourier transform of the output data. The tool shows both time domain plot and the frequency domain plot for each axis. If Unico is used in combination with a magnetometer, you can evaluate additional functionalities. By clicking on the scatter plot button, you will now visualize the scatter plot of magnetometer data and evaluate the quality of sensor calibration. Now we can see an example of a compass application that combines accelerometer and magnetometer output data. Rotating the board, the GUI shows the heading of the compass. The embedded algorithm measures the magnetic field using the magnetometer data and compensates for the board inclination using the accelerometer data. Thank you for watching this demonstration of the Unico GUI. To download the software, go to the page www.st.com slash s-t-e-v-a-l dash m-k-i-1-0-9-v-2, open the Design Resources tab, and click on the Unico software package for your operating system to download the package. In the root directory, you'll find the setup file to install the GUI. The software package includes the following directory structure. Firmware contains the source code of the firmware of the eMotion board together with the corresponding binary file that can be flashed to the board using the DFU software. Driver contains the installation package for the USB drivers needed to connect the eMotion board to the PC. No driver is needed on Linux and macOS platforms, so this directory is included in the Windows installation package only. DFU contains the .DFU files and the installation package for the software needed to upgrade the firmware of the eMotion board. With Unico, you can speed up the evaluation of your application. For more information, please visit our website www.st.com slash s-t-e-v-a-l dash m-k-i-1-0-9-v-2.


I'm Anders, and I'm very happy to be here. Good to see you all made it here. Today, the topic of today's talk is going to be an open policy agent. Anyone used OPA in the past? Yeah, quite a few. So it might be a lot of things that you might know already. It's going to be like an introduction, but we might touch on some more advanced topics as well. First off, I'm Anders. I work as a developer advocate at Styra, which is the inventors of the OPA project and still the maintainers of it as well. I have a pretty long background in software development, where I used to work primarily in identity systems. So the kind of systems where you authenticate primarily, multi-factor authentication, single sign-on, solutions like that. And what kind of got me into or interested in OPA was when you're in identity and authentication, you can tend to shy away from authorization. That's the concern of somebody else. And eventually, I got interested, like what if that was my concern? How would I tackle that? I used to work for a large corporation where we integrated OPA in a big microservice environment, a highly distributed environment, about 700 microservices or so. So that's how I got involved in the OPA project. And yeah, I guess I had so much fun. So eventually, I landed at Styra. When I'm not coding or working with OPA, my interests are cooking, food, football. And if you want to reach out later, just my first name and my last name at most of these social channels. So to start off, what's the challenge or what problem is it that we're trying to solve with OPA? It's basically this. We're trying to manage policy in increasingly distributed, complex, and heterogeneous systems. And when we say policy, what we basically mean is a set of rules. And our application stacks are quite complex. If you go to any larger organization, chances are pretty good. You'll find a few of these logos. It's a really large organization and you might even find all of them. And of course, your applications will have to live somewhere.   And of course, it's not like OPA invented a concept of rules that's been there all along. So, but the challenge here is basically that all of these systems have their own way of managing policy or managing rules. And what we found is that this doesn't really scale when you start to add more and more of these logos and when you start to have like these 700 micro services. How do you know which rules are deployed to any particular system at any particular point in time? So the goal of OPA is to unify policy enforcement across the whole stack. And it's basically what OPA does. So if that's what OPA does, what is OPA? It's a general purpose policy engine. And we'll go into detail on the general purpose bit later, but it kind of has to be a general purpose in order to encompass all these diverse different technologies. So it provides a unified toolset and a framework for working with policy across the stack. It decouples policy from application logic. That's kind of a key concern for us. So the way you can think of it is like how you decouple storage from your application and move that into a database. You can kind of think of OPA doing the same, but for policy and your rule. So the rules don't no longer live inside of your application, but there are properly decoupled.  Policies, they're written in a declarative language called Rego, which I'll give you a little demo on later. One thing to note is OPA deals with the decision-making of policies. So based on the policies you have, the rules you have, OPA will provide you a decision. OPA does not enforce decisions, though. That's still up to your applications, and that's obviously highly context-specific based on what layer you are in the stack and so on. So it could be anything from sending back a forbidden response or it could be adding a log entry to the audit log, or I don't know, contacting the authorities depending on the severity. So a general-purpose policy end-in. So we have some use cases. Pretty much everywhere, but some of the most popular ones include admission control in Kubernetes, microservice or app authorization, infrastructure offers it or infrastructure policies, data source filtering, CI CD pipeline, so on. So basically anywhere where you have rules, OPA is a good fit. It's, again, it's an open-source project and a pretty vibrant community. We have over 300 contributors, 80 or more major integrations with different products like Kafka or Kubernetes, data sources and whatnot. We're used by over 1,000 other GitHub products, so dependents. 7,000 GitHub stars, 6,300 Slack users, 130 million downloads, et cetera. So it's a fairly established project by now. So OPA itself is kind of the core product or project. Well, the ecosystem also includes things like contests for running policies on files. OPA gatekeeper for Kubernetes admission control, there are editor integrations for VS Code, IntelliJ and so on. But of course, OPA is not just like a hobbyist open-source project, but it's actually used by some of the largest organizations in the world. And I said a little summary of this up until now, like from Kelsey Hightower said, the open-source project is super dope. I finally have a framework that helps me translate written security policies into executable code for every layer of the stack. That's basically what OPA provides. So if that's what OPA is, how does it work? So the first thing to keep in mind is this, it's a policy decision model. It's kind of how can OPA integrate with all these services and all these different technologies. And most of these technologies, they didn't have OPA in mind when they created those. So we kind of had to shoehorn in OPA somehow. So how does that work? So the decision model works like this. We have a service and that service, we have a pretty broad definition of service. It can basically be anything. Anything that services a request from a user or another service. It could be a Kafka broker, it could be a microservice, it could be a Linux PAM module or whatnot. So anything that services a request, when that request kind of comes in or is dispatched, rather than making a decision on our own, we'd rather kind of forward that or further on to OPA. So we ask OPA for a decision instead. And we do that via policy query. Policy query is basically just any kind of JSON value. So some common things that you'd normally include would probably be the name of the user, what endpoint, maybe the request method, things like that. Things that have meaning in this context. And based on the policy that we've written and optionally external data, we OPA makes a decision and sends back a policy decision to the service. And that response is also just JSON. So basically any technology that can read and write JSON can talk to OPA given that there's some way of kind of plugging that in. So that's the decision model. As for deployment, OPA is a self-contained lightweight binary, I think it's like 50 megabytes or so. And the common deployment model, again, we're working with distributed systems. So the common deployment model is not that you'd run like one gigantic OPA server, but rather that you deploy OPA inside of your services or as close as possible to your services. And one of the benefits of that is of course that you can distribute whatever policy and data is needed only for that particular service, but also that you keep the latency down to as low as minimum. So yeah, in a Kubernetes context, that would normally be a sidecar deployment. You have OPA running inside of the same pod as your application. There are many ways of doing it, but ideally as close to your service as possible. OPA normally is deployed as a server. So it's queried over its REST API. And yeah, inside of the same pod, that would just be a call to local host basically. So it's normally below or sub millisecond and latency overhead. So it's very fast. But there's also a few other deployment options. There's a Go library for Go applications. You can integrate it with Envoy and Istio-based applications and under service meshes. You can compile your policy to WebAssembly and more. So there's really a lot of ways to deploy OPA, which is also kind of key when you need to integrate with all these technologies. So the policies themselves, they're again, they're written in a declarative language called Rego. And by declarative, we mean that rather than saying like exactly how you want something evaluated or how you want something done, you just say what you want done. And then it's up to OPA to kind of translate that into instructions. So just like a real world policy, an OPA policy is just a number of rules. So one of the goals is kind of to try and translate what is a real world rule and trying to make that, trying to make something as close to that as possible. Rules, commonly returned true or false, is the user allowed or not. That's a Boolean decision. But again, any value that's valid JSON is also a valid response or a valid decision. OPA provides a unit test framework. So you can work with testing of your policies and rules, kind of detach from that of your business logic or application state. It's a well-documented project and there's a regular playground to try out policy offering without like even having to download OPA. So at this point, let's see if we can get a demo going here. I'm just gonna see. So just to kind of show the basics of policy offering. So the first thing I'm gonna do here, I'm gonna create a policy file, let's go policy.rego. Is it big enough or should I, it's bigger. So the first thing we're gonna do is we're gonna add a package. And this is similar to a module or a namespace and from other languages, just a name really. So we're just gonna call this policy. And now for the anatomy of a policy, a policy again, we said a policy is a set of rules. So that's what we're gonna add. In this case, we're gonna add a rule, which is a called allow, which makes sense for a Boolean rule. Are we allowed or not? But allow doesn't have a meaning to OPA. OPA doesn't have like any keywords like that. So allow or deny is just names that make sense to us. So we're just gonna say allow is equal to true. And here's the kind of the thing with rules is that they're basically conditional assignments. So if you'd, in a normal language, you'd say like if something, something, something, then assign true to the allow rule. But since the conditions are at the actual rules, OPA kind of inverts that. So we'd rather than saying allow, or if this and this and that is true, then do that. We can say then or do this if all of these conditions are met. So we're gonna add a rule body here. And if all of the conditions or assertions inside of the rule body are true, this is gonna evaluate. Or so the allow is gonna be assigned to true. So if we do something like one is equal to one, we know that to be true. And then we say OPA eval, we're gonna say the policy file there, data policy allow, we can make it pretty as well. We can see that that was indeed true. Is it big enough or? Nope. It's better. Okay, let's try it again. So OPA eval, data policy allow, that's the rule we wanna allow here. Yeah, sorry. Yeah, it looks better.  Okay, so the allow rule is true because one is obviously equal to one. And if we do something which is not true and we evaluate that, it's just empty. There's nothing there. We're meaning the rule is undefined. So if we do want to ensure that there's always some value return, we might say that by default, the allow rule is equal to false. That's a pretty good default for any authorization system, isn't it? So of course, and if we were to say like one is equal to one, two is equal to two and so on, OPA is gonna eval from line. If the first line is true, it's gonna continue on to the next. That one is true, it's gonna continue on to the next. So if each of the conditions in the body are met, the whole rule evaluates. And if one of them is not true, that's evaluation stops and we fall back to the default value. So it's kind of an inverted if condition. Now of course, these examples are just silly. So in a real example, we might, we're gonna provide a policy query, right? So we're gonna simulate something like that here. I'm just gonna create a file called input.json and it's gonna look something like that. We might have a user that seems reasonable. We have a name, we're gonna see Anders and the user might have some roles. We could just say this is a developer and we might have a request, like if this was a microservice or something, we might say that request might have a method. We get here and a path over like path components. So it's gonna say users. This could be a string as well where we just have like slash separated, but if you find it easier to work with an array of values. Okay, so now we have a request coming into our service. We have a user here in the request, a name of the user and we have some roles. We also have a request method. So once we have an input, we can reference any value from that input by just saying input, input dot user roles. For example, if you wanna reference the roles and here we might try some iteration. We could do something like that. We're not interested in the actual key here or the ordinal. So we're just gonna say if, so if we iterate over all the rules and one of them is equal to admin, then allow is gonna be true. That seems like a sensible rule. So what if we wanna, we said like inside of the rules, remember how we checked all the conditions. So they can add it together. They all need to be true. What if we wanted to add more conditions here? We might, for example, have some public end points where we don't want to require any rules at least not for reading. So the way we do that would be an or condition, right? And the way we do that in rego is just to add another rule. We could say that allow is equal to true, either if you're an admin or the other. So all of these allow rules are gonna be evaluated. And if one of them is true, the final evaluation is also true. So we might wanna say input, if input request, request method is equal to get, and the input request path. We could just say like the first path component, if that's equal to users, I think it was, right? So everyone should be able to read from the user's end point or to read users. So that makes sense as well. You don't need any particular role for doing that. You can, and we can allow that for anyone. So if we tried it out, okay, we're false because we did not provide the input data here. So let's try that. We see that, yeah, indeed, that's true because we were sending a get request to the user's end point. If we tried something else here, I don't know, sending one to the admin endpoint. We are no longer allowed. So that's basically how policy evaluation works. Some simple assertions based on the input you provide to OPA. And we can, I think we have time for one more example. We might, for example, say that we now said that anyone can read users. It's fine, but if you wanna modify a user, it must be your own user. So it must correspond to the user name in the request. So we could say that allow is equal to true if input request method is equal to put and input request path. And in this case, we're gonna say the first path component should be users and the second one should be the user from the request. So input user name. So with this rule, we should be able to modify. Change this to put request. See users, there's. So we should be allowed to do this, try it out. And we are. And if we change now the path, try and modify Jane. We should no longer be allowed and we aren't. So that's basically a very brief introduction to Rego and how you can build your policies from these small rules and how they're all combined into something bigger. And of course, this is very simplified. There's a whole lot more to Rego than this in terms of iteration, built-in functions. There's over 170 built-in functions. So if you wanna ensure things like all email addresses must end with acmecorp.com or whatnot. So, but the basic principles are all contained in here. It's rules are built from simple assertions and in this case, we had a Boolean rule which returns true, but this could be one or it could be yes. Again, any value that is valid, JSON is also a valid decision. All right, so let's hop back here. Any questions on like Rego or policy offering? Yeah, so the question was, should the input also always be a JSON format? And yes, OPA supports JSON and Jamel by default. So if you have any other format, your advice to convert to that before submitting it to OPA. There are some projects around OPA like Conf test which supports a whole lot more five formats, but OPA, the core engine is JSON or Jamel. So it needs to be like structured data. Okay, so can I, yeah? Could you define the rule set in non-time if you have this running as a service? Oh yeah, for sure. So one of the ideas of having decouple your policy from your application state is that the policies can be updated independently of the life cycle of your applications. So if you have 700 microservices and you wanna add another role or you wanna add another rule here, it's kinda inconvenient having to redeploy 700 microservices. So that's one of the ideas. And I'll kinda get into that a bit later on the management features. But yeah, OPA can be configured to pull periodically to pull down configuration or policy and data from remote endpoints, for example. Okay, so with some basics, with some basic knowledge of Rego, I kinda figure we can take a look at one of the more common use cases which is Kubernetes submission control. And before we dive into OPA and how that works, we can add a little reminder of how the Kubernetes API works. So it's basically whenever you do something like KubeCity I'll apply your application or a deployment or whatever, that request kind of passes a series of modules. And so any request needs to be authenticated, needs to be authorized, and it will also pass the admission controllers which can either mutate the request on its way in or just validate that this looks all right. These modules are chainable. So you can have as many authorizers or admission controllers as you want. And of course, Kubernetes comes with a whole bunch of built-in modules for all of these, like RBAC for authorization and a whole bunch of admission controllers as well. But of course, for OPA, this is really what we're interested in because we wanna extend Kubernetes with our own rules. And again, if you paid attention, this is basically the policy decision model, right? You have something at a service that takes a request rather than making a decision of its own. It's passing that onto OPA and then has OPA make that decision. So we're gonna zoom in here on the validating one. So we don't really do often occasion with OPA, but authorization and the mutation or validation is what we do here. So I'm gonna zoom in on validating admission controller. And the reason I can choose that is it's by far the most popular module to extend. And the reason that is so is that it allows us to build these kind of policy-based guardrails around our clusters. So some common policies that are kind of popularly enforced to have rules. Let's say like you can pull down any image you want, but it must be from the company registry. Some organizational things like any resource deployed must have a tag or an annotation, a label which says which whoever, it's gonna labels whoever deployed it, the team name or the cost center and so on. So definitely not just about security, like these kind of rules and policies can be about anything really. Ingress and host path uniqueness, that's another one. And that's an interesting one because it requires some knowledge, not just hard-coded in policy, but you also actually need to know what other things are deployed previously. So there's no conflict when we deploy this. TLS for your service configurations. You might wanna deny certain attributes like host path volume mounts. You might wanna enforce some limits on resource allocation, policy security policies and yeah, basically anything you can think of. So if there's any rule you might wanna have, OPA is your friend. And just to provide a very simplified example, but if you remember from the demo here, we had an input which was just a JSON file. This is exactly what we'll get from the Kubernetes API server. In this case, it's gonna be in the form of an admission review object. So just have some JSON data here where we see, okay, these are the containers which are about to be deployed. We have a simple policy in the middle. It says, if not input request object metadata labels about cost center, then every resource must have a cost center. In this case, we return a string so that the admin actually knows. It's not very useful if we were to just say deny here because how would you know what to fix? So in this case, we just say every resource must have a cost center label and that error message is gonna be propagated back to the user who made the request so that they can remediate that. Offer station, another popular use case or common use case. And I'm not gonna go into all of the details around offer station. It's such a complicated and big topic but just to provide like a bit of an overview of what an OPA deployment might look like in that context. So in this case, kind of remember the policy deployment or different deployment models in an ideal scenario would keep OPA as close to our services as possible and not just have like one OPA server that they would all go and query. So in this case, we have deployed OPA in all these individual services. We have an identity system, which is also decoupled and those have been properly decoupled for the last 20 years or so. It's offer station has up until now kind of been still very much hard coded into our application logic. But now we've, so we have an identity system. We know who the user is. That user would popularly or commonly be represented using a token. This might be a JSON web token or something. So, which is then passed along in all these requests. So we know who the user is. We know the request method, we know things, whatever details we need to make an off rise or to make an informed decision. And when you see this, you might ask like why can't we just, why can't we not just put OPA in the first service? And that's basically how we did offer station for in the past, used to put that kind of decision in a gateway or somewhere where you'd authorize the request and then we just let it through. This kind of zero cross security motto says that that's not a good idea. Because of course, once you once, if you made it past that first step, it's basically an open highway. You can do anything because the request is just assumed to have been authorized somewhere. And once that assumption breaks, that's a pretty bad place to be. And another problem with that model is of course, one of these services might run a cron job which would then be behind the gateway and would then also not be authorized. So the zero trust security model, it kind of mandates that you do offer station in all these locations. In this case, we have a control plane as well. The arrows here does not mean that OPA is gonna reach out as a synchronous action. This is kind of what you were asking about before. So OPA does not reach out to this control plane when a policy is evaluated but it rather goes there periodically to fetch new policy and new data and whatever else it might need. And with a control plane, you get more things like decision logging. So any decision OPA ever made is sent back to that control plane or you can then later follow up. How many of our violations did we have in our cluster? Our OPAs are they all healthy? Are they all up and running and so on. And yes, diuretic, the company I work for, we provide such a control plane. But basically in order to just serve policies, you can just set up an engine X or an S3 bucket or something to get started. So you can go from very simple models to two more advanced. All right, so that was an introduction to OPA and if you think this sounds interesting, some advice for getting started. I think starting small is a good thing. So similar to what we did in the demo, just try and write a few simple policies and rules and kind of build experience from that. Again, the OPA docs are a great resource. So get a feel for all the basics of the Rago language, all the built-ins or built-in functions available. And then with some knowledge of the basics, then I think like start to consider possible applications near to you. So some, if you have a microservice or something, like start there and then try it out. And again, you don't need to rewrite your whole application to use OPA. You could just start with a single endpoint, maybe a single role, maybe have the admin check, go via OPA and have OPA decide is this user an admin or not. And from there, you can scale up. I mentioned the management possibilities or capabilities, things like logging, providing policies and data via bundle servers and so on. And that's obviously the Styra DAS, which is the commercial control thing from Styra. And I should say there's a free edition as well, which you can all try out. There's the Styra Academy, which is another good learning resource. And there's the OPA Slack community, where we were a lot of friendly faces going to, that are happy to help you on your OPA journey. All right, any questions? Yeah, that's a good question. I know there are, I have seen a few, like community projects for working with that. But I think in general, it's not gonna be at the layer of the firewall, but rather more of these kind of API gateways where you can work with HTTP or JSON and not just kind of more low level rules. But yeah, if they have some pluggable system for writing rules, I'm sure OPA could fit right in. So it seems like when you move to OPA, you move from a system where authentication is a distributed problem. And you move into a system where a whole lot of rules are coming into one system. Do you find that gets really complex and how do you manage it? Yeah, so the question was, when you move from OPA, you move from a distributed system to a unified system. Yeah. So I think, and the kind of complexity that comes with that, I think it's basically the other way around. When you do have your rules distributed in all these different systems and they are written in different programming languages and so on, it's very hard to know what rules are deployed at any time or without going out, especially if they're all managed by these different teams. And it's pretty much how I got into OPA. We were looking to solve authorization for a big company. We had, I think we had eight or nine programming languages running in our clusters. And we wanted to ensure like, and if we were to just say like, we want these are the rules we want in all our systems, we kind of knew that if we were just to go out to all these teams, they would all implement it differently. And probably not by like, because it's just like, there are so many kind of ambiguities or like things that aren't really clear and how to interpret rules and so on. So we kind of needed one way where we could say like, here are the rules. They're all in one place. And then those rules are kind of distributed to all these components, but they have a single place where they live and they're all defined using a common language. That final rule file starts to get very large and comes in a big complex system. And how would you go about managing it?  Oh yeah, yeah, sure. So the rules themselves, then they don't have to live in a single file or so. So you can have as many files and modules as you want and you can use imports and so on. You can have like common libraries. So there are many ways to work with OPA and Rego for larger and more complex systems that will help you. Your policy files, do you treat them like code for being in and get labels distributed via pipelines? Yeah, I think that's gonna be a little bit different depending on where you go. But yeah, I think that's basically one of the good things or one of the premises of treating policy as code is of course that you can treat Rego as you would with any other code. So you have version control, you have things like testing, code reviews. So any change to policy must be reviewed by two members of the security team or whatnot. So it's basically another benefit of this approach. All right, I think that's it then. So thank you.