involved with all the security releases for Drupal 6 and through the years I got to see all the common problems in the That we deal with in the Drupal security team So I hope I can help you in avoiding those and to be able to tailor this session for your needs I hope to see how many managers there are in the community are in the audience. How many of you think you are managers? Quite a few. Okay.  Very good. That's that's the track we are on. How many of you think you're a themeers building themes for Drupal? That's not much. That's kind of interesting. How many of you are hardcore developers or not so hardcore about developers? Okay, that's very good. So I hope to have content for all of you And if the only thing that you gather from this session is to go and buy this book Then my mission is accomplished It's not written by myself. So it's not a shameless blog on my own It's written by Greg Nattison. It's called cracking Drupal drop in a bucket and it's a very good book for learning about Drupal Security it's for Drupal 6. It's not for Drupal 7 yet as far as I've heard it's being updated for Drupal 7 It's very good to learn the different problems and especially if nothing else you read I think chapter 8 Where it talks about finding Drupal sites to hack into how you hack into Drupal sites Different techniques and then how you prevent those. It's very insightful and you learn a lot about how How how you can look as a third third party on your websites and see it see it from a distance and Find these problems Of course you think you're probably affected and you need to know about this But a lot of people ask this am I really affected? I'm like I'm running a small block here or a small e-commerce shop and nobody's interested really in the data that I have here and The answer to this one actually is that people look for all kinds of data on the internet If they can hack into your site and you are a mini skew small site somewhere on the internet They might still be able to get get your use get your user account database and be able to use the same user accounts on Facebook or on Twitter or somewhere else where it's more valuable or hacking to someone's Apple ID or Amazon.com account because many people use their use same credentials on all kinds of websites So even if your site is just a small a bit in the ocean somewhere You can easily have valuable data for people to get Even if it's just data on other people and The other reason that you might be concerned is that with very simple holes Your administrator user can be taken over and that means anything can be done with your website And it's pretty serious and I will show a few ways to do that on a Drupal site if it's not If it's not operated properly Now I chose to use a framework for this session that's based on the open web application security project top 10 security top 10 Risk list right so they looked at all the risks that websites are Facing on the internet and put up a top 10 list of what are the most important ones and what we should take into account first and foremost and I'm trying to put the Drupal security practices into this framework. So you have a I have a common framework to compare the Drupal solutions to and Kind of relate to what the industry thinks about these problems I Did not put all the things in order because I think the the most important for us here to start off is number six Which is security mis-configuration because it's very easy to go wrong in that area Anybody heard of the word press comm attack that happened in mid-April anybody No It's kind of interesting. That was a big issue. I'm not picking on word press calm because it's our competitor No, this could just as easily happen to any Drupal site. It's not work press Pacific the the problem the the reason that I Come with this is because it was a huge scale problem with I think 20 million websites that are hosted there. So What they've experienced is that they've had a perfectly nicely set up word press instance and the attackers Went in below word press on lower levels and gain root access on the servers And they've and they got access to the source code of all the custom source code That's not open from word press calm and some of the customer data that was there and took that and did something with it We don't know we don't know what it we didn't get a lot of information on what actually happened there What we got is that it wasn't attack of the system under word press it was attack outside of word presses control and When you're thinking about Drupal security, it's very important that whatever you do with Drupal Drupal lives in a huge system So there's a lot of things running around Drupal that you have on your server and you need to take care about that first It matters it matters a lot what kind of tools you use to maintain and deploy your website I would say you should avoid FTP at all costs anything that sends unencrypted information over the wire You should avoid Well get it get to the fact later that all of you who have your open laptops might be sharing some valuable information about Your account, but we'll see that Check your client to whatever client who you use where it stores the data if you search on Google for for Total commander or Windows commander FTP Password tool Then you'll find tools that you can just upload a total commander password file and it will Decrypt it for you and you will have access to all the passwords that are stored in that file You can just upload your password file online So anybody who who has access to your machine like a virus cracking in can get all your Credentials to all the sites that you're using with with total commander Think about who do you share your server with if you're running on a shared shared hosting service who else is Putting software on that service who else is putting all kinds of other tools on that service and think about what they Have on there. Are you confident in who else you're sharing servers with at one time? I've had my my personal website at that at a At a shared hosting provider and turned out I was running with some hard line leftist parties Like political parties I was running on the same server and I was kind of concerned that if somebody would like to attack them What happens to my data? So think about that if you're running other apps that could be pretty Pretty problematic There's a forum software out there like PHP BB to that's historically very vulnerable to security issues So even if you perfectly secure a Drupal website everything is perfect on your Drupal website There can be other tools that can can be used to hack into your web presense of course If you can go even lower the OS layer PHP your SQL server your keys to the server room, whatever But when it comes to securing Drupal There's some very basic configuration things that you should think about Drupal tries to help you pick a good admin password Drupal 6 doesn't do a very good job in that it like throws big red And yellow error messages every time you don't type the ideal password in the world So admin is not a best password Keep in mind the suggestions provided by Drupal, but there's maybe better better Suggestions around the internet of picking strong passwords Look at all the admin permissions on the site if you give any of those out to anybody Your site can be easily taken over if you have administer users or administer permissions Permission given out to somebody they can edit other users And grant them new permissions and then those users can take over your website. So a lot of these permissions are Opening up your system very wide to anybody who Who wants to crack your that are your service? So think very wisely about who you trust those administer filters is permission that looks very very Safe it's like yeah, it's filters getting in data and then putting out HTML And we'll see an example soon that if you Pick this permission for some user They can also take over your whole site because it's content coming in your service and administer filters about what kind of security Process is put on that content to be printed to the user and that That control can let people take over your website as well There is so the security team is hard at work in putting out fixes for all the modules that are on Drupal There's thousands of modules and there's a lot of work in and putting that out so if you want to Maintain or not if you want to but you shouldn't maintain your Drupal website to be up to date with all the security updates and Drupal has the built-in update module for that which you can enable and it can alert you by email about latest updates to your modules So it's very easy to do. I would suggest you do that And the other thing to note here is that for those for those new versions that are coming out We have a standard to do those on Wednesdays the reason for that is So we have a predictable schedule for all the important security Updates that you need to make to your website. We've put those out on Wednesdays So if there's no security releases for your models on Wednesdays You can go on holiday on the Thursday and come back on a Tuesday We let you go to the beach and sip mojitos But on Wednesdays at any module can have a security release also It lets you have some Q8 time with your website until you need to leave for the weekend, of course So we have a process in place for informing you and we have a process in place for making the releases predictable Further on securing the Drupal configuration itself, I would say you should avoid any kind of PHP input Drupal has this PHP model. You should forget about it. It's not there never enable it if you want to Hide it without hacking Drupal core. You can use the paranoia module That hide hides the PHP module among other very good things and never allows you to enable it It also hides itself so people cannot disable paranoia module And also there's all kinds of other things to improve security on your website So I think it's a very worthy module to to look into using as I've said you should watch your input formats One of the great things or one of the interesting things about input formats is that they come with standard help text So when you enable some input formats, they come with standard text like this This field allows you to enter any kind of HTML input or these tags are allowed and it lists all the tags Now this these very standard text can be Google then we can search for sites that are vulnerable to certain Injections of data so we can look for the standard tags and Find websites that we can enter malicious data into and and hack into so if you if you enable Fully HTML input for example for anonymous users, then you can easily run into Problems where people Google your site and then enter data and they already had your property There's the security review module which runs Runs through these things that I've said most of these things that I've said and many more that help you Have a good check of whether your sites configured securely or not These are some of the Rules that you should follow now to go back to the first first point in the OWASP list It's about injection. There's many kinds of injections and in the web security I'll talk primarily about SQL injection here and hopefully get you a comfortable feel of how Drupal tries to protect you from that SQL injection is very simple. You have you have your web address and there's some data coming in there and if somebody puts in a Number there it means that it updates your value to that number but if somebody puts in malicious data there like They end the quote and then they do something to update the user password in that table or They do a select another table or do an update on another table. That could be pretty dangerous So what we do in Drupal is we protect that or we force that kind of data to be of certain type and That type in case of Drupal 7 is introspective from the database schema So we look at the database key, man We realize that that value should be a number and be converted that value to a number at that place and we ensure that there is no unintended data to go in there if You need to have your dynamic table names either in your modules or in your themes to be Protected in this way look at DB escape table function. So the injection Problem that I I just explained is basically about data coming in right from the web request and Right into in this case an SQL query and running through there But the same can happen to any kind of data that comes from another database table or an XML file or an RSS feed So just don't assume that the data is coming always from the URL Important part is to always treat the data. That's coming from somewhere that you don't trust as potentially an attack and To add the place where you use the data ensure that you use the right format now as I've said I have a few code examples in my session and one of the points that the that the Drupal security book makes is that most of the vulnerabilities on Drupal sites are in themes Okay, so people download modules and those modules are pretty well Controlled and we put out security releases for those modules But themes are custom made for your Drupal websites and most of the problems come come from themes So even if you even if you think you you are just building themes It might be the most dangerous thing to do for a site security A much more interesting is number two is cross-site scripting a abbreviated XSS because CSS was already taken Is a very similar problem, but this time we are not injecting data to an SQL query We are injecting data to the HTML output That data can come from the query can come from the request the URL either a form or a query string or somewhere else And we are just bringing it out or it can come from data we stored previously Like the node title Drupal store Drupal usually usually stores data without any filtering on it So we store the data and when you use the data in your theme in your module in your view in your whatever You're responsible for sanitizing that data and making it secure Okay, so the node title can contain any kind of data that breaks your site or makes your site vulnerable If you just put the node title in the output print out the node title as is in here in the theme Then it's going to be vulnerable so we made a lot of things accessible in themes and in pre-processed functions that are already secured like the dollar title Variable which is already made secure, but if you're going deep in structures like the node title property that is insecure giving full HTML access or trusting people to enter unsafe tags is a similar problem and cross-site scripting might not look like a Big problem at first is just injecting stuff to your web page. How can that be serious? Why it had security put out a research paper. I think that was this March, yes, and they estimated the the likelihood of cross-site scripting on any website as 64% so that your website has a cross-site scripting issue you have 64% chance Okay, so your your website likely has a cross-site scripting problem now if your website has a cross-site scripting problem like printing out the node title or You're granting full HTML access to people who cannot be trusted or those people can enter unsafe HTML tags or you grant Administered users permission or administer filters permission to people who done who shouldn't have that then those people can do this to your site So this is a code sample that that was posted by Heine Dostra the Drupal security team lead way back and This exact code sample runs on Drupal 5, but the same code same principles can be brought forward to Drupal 6 It's it's more code But the same principles run on Drupal 6 and a bit more work is required for Drupal 7 But but a cross-site scripting issue on any Drupal 7 site is enough to achieve the same effect So what happens here is that we put in a little just a little bit of JavaScript This is not much right. This is a tiny code snippet what we do is We get the user slash one slash edit page, which has the edit page for user number one And when that actually happens we run this function If it's a successful request Then we look at the form token that ensures for Drupal that we loaded the form We remember that form token in the token variable and we in the payload we put in that We are the user edit form We put in the token and we put in a password of our choosing and Then we submit the form with a post request. That's it. Okay So if you if you allow people to enter full html or if at any place in your theme You output a node buddy field without filtering or a note title filled without filtering or other kind of data That comes in from the request or is stored in the Drupal database People can enter this or equivalent source code and can hack your user one password And from there they can do anything. It's they own the Drupal website If they can enable the PHP model from there, then they can run code on your web server However, they want. Okay So how to protect from that there's a lot of Functions in Drupal that help with that and this is the main family of functions That you can use in your theme in your module in your custom PHP snippet in your views header PHP snippet, whatever so we assume HTML output here and If you encounter a URL that's to be output then we have the check URL function if it's not a URL but a but plain text like a note title or I don't know an email address Then it should be run through check plain if it has a format attached like a node buddy Or in the other place in Drupal where a format is attached to the text Then it's check markup and you should provide the format that should be used and if there is no format attached Which I which is at some places in Drupal like the site mission statement or site mission statement in Drupal 6 or the I Don't know so quite a few places in Drupal core like like aggregator category descriptions stuff like that Then you should use filter accesses, which still does some cross-site scripting filtering If it's none of these and you trust it Then you then you can output to HTML So we do these preparations to a theme variables in the theming flow in Pre-process functions, so when you look at a tpl.php file in your Drupal instance That that will have a huge list of variables that are already Pre-sanitized for you to be used in your theme So I would suggest you to use those first and foremost And if you really need to have custom data in your themes in your modules then look at look at these functions We also support this With our localization infrastructure, so we have the tn format plural functions which automate calling off check plane and And the placeholder theming functions So you can use the translation function to compose a text snippet That has these kind of this kind of filtering in there And it still reads like name has a blog at URL and the URL is filled in proper and the name is filled in proper Same is available in HTML in the JavaScript for triple dot tn triple dot format plural But not all output is HTML. So this as I have explained was all the ways to filter text for HTML presentation, but you will also do stuff like sending emails or Building data for other Output formats you should always consider the escaping for those places like for sending html depends on whether you send html email Or plain text if you send plain text the module has a function to strip all the text from the html and format it Sensibly for sending it an email So think about the kind of input you have whether it's already sanitized if it's not sanitized Think about the type of Format that it has and then apply the sanitization Appropriate for the output format that we assumed to be html before but can be any other format as well Number three is authentication and sessions It's basically about weak password storage and account management or session hijacking Or lack of session timeout and Drupal already has pretty well Pretty well crooked solution for this. So you don't need to care a lot about this problem We do store passwords hashed and we are increasing our security with every release. So Drupal 7 increased on this from Drupal 6 We do change session IDs when people are Locked in or locked out when permissions change actually in fact when permissions are heightened So whenever you have you whenever you get new permission we change your session ID So we can avoid you being trapped in a session hijacking problem We do work on top of SSL and we do have some support for SSL that we'll see later And we do have some nice modules for that which we'll also say later Number four was insecure direct object references and that's again very simple for Drupal actually It's looks like a similar code example I've had for injection but in this case what happens is that I'm putting in the number and I'm just getting data for That kind of value and I'm not checking whether the user has permission to have access to that value And there's a lot of thinking to go in there When you're building a Drupal site so our menu system That's our main system for dispatching requests in the Drupal system is built for is built with checking for permissions It's kind of nice if you do want to check for permissions yourself I would suggest the user access function if you do want to check a note permission There's specific functions for that and if you're writing queries directly against tables, which I suggest against But if you still want to do it then you can add the Node access tag to it now one of the one of the very interesting things here and one that many people miss Is that when you create a view? It does not filter for published notes Automatically out of the box so one of the things that many people miss is then they create a view They put out their content and it will list unpublished notes at first and then you need to go in and check to not list the unpublished notes that's kind of a Insecure object reference we we list all those contents and some of them is not available for you although you can see it One of the more interesting problems is cross-site request forgery That's called cross-site, but it can actually happen on your site So one of the things that you can do with the Drupal user Is lock them out So if you can post an image or something that can make a request on behalf of the user on a website You can lock that user out So if you post this code on on a Drupal site that allows for images and anybody was this visit this page They will be locked out Okay, this is not very interesting because you know you're not gonna gain anything by logging them out But this is the type of problem that That cross-site request forgery is about is that we are forging a request on behalf of the visiting user With for example an image there's other ways other tags in html that allows this like the script style tag other tags So the real problem here is that this can be an action that's destructive for the site like deleting something So if delete if we if we refer to deleting something and it actually runs without questioning you Are you sure then it's going to be a problem for cross-site request forgery So if you are fed up with Drupal always asking you about are you sure you want to delete this? Then it's because of this problem if Drupal wouldn't ask you then anybody would be able to delete stuff on your behalf Okay There was a big problem with this when Google released their I think browser speed Plugin for firefax back in the day way before they released Chrome How many any of you remember that the firefax speed plugin? Yeah So the problem there was that the Google preloaded pages for you like you visited a page and all the links it preloaded for you So when you click it, it's going to be available right away Now if you're on a note page like the note admin page delete delete delete delete, oops, that would be a problem so So this is a this is a problem for anything that does not check or does not ask Whether it whether you actually wanted to do it and just does right away some models do this So there's some quick voting modules in Drupal where you just click something and it happens And those might be vulnerable to hacking this way And then you need to decide whether you want to have a quick voting system or less gameable voting system So the Drupal approach to solve this is that we we work with a post submissions by default Which makes it harder to do this kind of work We include tokens in the form so people need to download the form first That includes a token and when when you submit the form you need to submit the token with it as well We check validity for that and we do provide APIs for those who want to have one click links that have tokens So it is somewhat harder to break, but if you have a cross-site Scripting problem then none of these will help you none Number seven is insecure cryptographic storage, which can happen with your custom data But Drupal does do a good job of handling this for all the data that it handles itself So as I've said before we use a one-way hashes to store passwords so they cannot be Correct as easily backwards We do provide a randomly generated private key on every website That is secret in your variables table to use for custom encryption and we do have a quite a few modules for you to encrypt data and I Don't have a concrete suggestion on their what modules to use there's multiples depending on your needs But a lot of people are making backups at places. I've seen people sending backups by email to themselves and yeah, and And if you don't ensure that those backups are safe those backups cannot be copied then whatever we do on on your database It's not going to help so So be sure to look at your backups and who can access those backups because that can easily be a problem as well This is the environment around Drupal that we don't often think about but is very important Number eight is failure to restrict your access. We sort of touched on this before Our menu system handles that It's your responsibility to configure the permissions on your Drupal website to be proper and The security team has a guide on this that I will link to later And it's your responsibility to configure your views proper to Not least unpublished data number nine is insufficient transport protection and At this point I would like to ask Who heard of fire sheep? Some of you okay, so fire sheep is a very nice tool So any of you who have your laptop open can go and download fire sheep It's a free Firefox sidebar plugin that you can download to your machine And what it does is that you turn it on and It collects or it looks at data happening in this open network So anything that's happening on an open network or now actually we do don't have an open network here, right? So if you walk into a bar that has an open network and you just flip up your laptop with fire sheep on it You can look at the data that's flowing on the open network And what fire sheep does is it makes very simple for you to? Capture meaningful parts of that data so it looks at that data and it searches for website login information for example so if can't find the Facebook credentials for for the person that's sitting next to you or At the other end of the bar and it will actually I will even show the Facebook profile picture of the guy So you click on that and it opens a browser for you that is logged into that guys Facebook profile Okay, and you can do whatever in the name of that guy and The reason for that is and and the reason for that is two-fold one is that the network is open That is a very good sign is that they are not asking for a password and The second reason is if that Facebook profile was access on the HTTP connection. That's not encrypted So if the network is open and the and the data itself is not encrypted Then you can actually break into that connection and then grab the user session ID and from there You can do whatever in the name of that user That's pretty powerful so When you go to a bar, you should ensure that it either has good Protection for the wireless that you're running with or you have like a VPN to connect to before you do anything And on your Drupal site what you can do is that you can try and run your Drupal site on full SSL Which is expensive But it's it's being introduced in most of these high-profile websites for this reason because Breaking into these accounts is as simpler by the day Or what you can do is to try and secure some of your web pages Like what we do on on Drupal guidance comm is that we're running with a set of these models To secure the login process itself and then secure whatever action you want to do on your account So that those actions are protected from the outside so secure pages is for Setting some of your web pages to be forced to run only on SSL So like your user login or user edit pages would only run on SSL and secure pages prevent hijack is about Trying to hide trying to prevent hijacking that session cookie that you get when you log in Which becomes unsecure when you visit the other pages on the site? And this sets a secure cookie additionally to the insecure cookie and ensures that you can only browse the site if you have both There's a very good example of setting up these models in a good Constellation on the Drupal Scout comm website and I would suggest you it's very easily findable with the When you navigate to the knowledge base So you don't need to write all that down and and these videos will be available and my session slides will be available So it should be good. It's also important to not just secure your website But also use a valid certificate if people are used to your website downloading and spitting out an error message that the certificate is invalid then if somebody Performs a middle a man in the middle attack and replaces your certificate and presents a different website But in your in your website's place Then they will not notice if your site is always popping up an error message of an invalid or expired or a Self-signed or whatever certificate. Okay, so make sure that you have a valid certificate on any website that you value And finally number ten is kind of interesting the last time I've had this session Drupal still had vulnerabilities in Syria And I was kind of trying to go it low The invalidated redirects problem is that you have a link that looks like it goes to example calm But it actually redirects to evil calm and I can put anything at the end of the URL and it would be direct there So Drupal used to have this problem. I think a year ago or so and the approach that it now has is Is that it tries to use local paths? So none of the external you none of the redirections build external URLs to redirect to and it also has validation in Drupal go-to that that looks at your looks at your Redirection and whether that's an interview or not, but All your custom code or your themes that do like work flow simplification on your site can be vulnerable to this problem So look at what kind of input you allow there and filter for For relative URLs if at all possible. So this was the OWASP top 10 list as it applies to Drupal I hope it was helpful and I'd like to touch on one more subject here Which is a very common question Whether he's open source secure, of course, I'm saying it's secure. I'm from the security team I'm working with the security team for four years. So of course, I wouldn't say Drupal isn't secure Because open source makes people look at it open source makes people We use the same code all over again and they find mistakes and they send it in and even if they post blockposts about it And they come and it goes out to the wild. Well, we'll be able to figure it out and fix it and release it So a lot of a lot of ice we have on that And also there is always more smart people to look at stuff I'm not at all good at all the ten areas. I've listed. No, I Have expertise in a few and I know what to look for but when I have a problem I have guides to look at I have people to talk to I have I have the security team to report errors and They help with fixing them. Of course open source is insecure because people can find holes in there and people did Did go into publishing blockposts about the holes before we could fix them that happens That's kind of the the The trade-off that we have here And also to fix becomes public and it becomes available and then people can look at how how sites that are outdated can be attacked And the Drupal security books chapter 8 talks about some of those problems that oh We've had these previous security problems and how you can find those sites and how you can break into them So so this is somewhat of a problem. It's not It's not really your issue if you follow the security releases and you patch your sites And if you keep yourself well educated on these security problems So in concrete Is Drupal secure or is it not secure? Of course, we try to design Drupal to be secure I've had a lot of examples here on how we have apis to filter text how we have apis to Validate form submissions how we have apis to validate tokens for encrypting data for doing a lot of cool stuff So so we build these tools to be secure But it's always on you to use it in a proper way So if you give out full html or if you give out administer users Or if you leave a sticky note on your monitor with your password then we can't help you out There is a guide to writing secure code that I suggest everybody read who ever touches code even Even if you think it's just a theme template file It's the same php environment that the theme template files run in then the rest of Drupal. So please look at that And be mindful of all the all the ways that you can make your Drupal site secure What we do for you to be to feel secure and to be secure is that we built a security team That is entirely built out of volunteers That we ensure to To put out security releases and who try to educate people around here to be better at security So our three goals as to this is to help design Drupal to be secure by default To help educate people like you so that's part of what I'm here and the third goal is to fix problems That's the third one. That's the last one. So we try to design Drupal to be secure To help design Drupal to be secure we try to educate you to use it that way and if there's a problem we help fix it our duty is that we look at Drupal core and all contributed modules on Drupal.org which Means that we look at stable releases of modules So if you're using a development release or an alpha release, you might be out of luck So be sure to look at the the stability level of modules. We consider Stable releases to be supported We do not actively look for vulnerabilities in contributing models We we are a middleman between the reports coming in and helping the maintainers put out releases So we we look at we assess the vulnerability that's coming in we contact the maintainer and we work with the reporter and the maintainer to put out the release for For the module or the theme in question. We only support the current and the one earlier version So currently that's 7.x and 6.x. We do not support 5.x and when 8.x is released We're going to stop supporting 6.x We do have a few points of contact We do really we do announce releases at Drupal.org security We have a separate feed for core releases. We have a separate feed for contributed releases We do have a guide on how you can report issues On security.drupal.org. We do have a guide on how can you report correct sites? But it's very helpful if you can provide data to us on how we can reproduce the problem so we can actually fix it and There's a There's a discussion group on groups at Drupal.org called best practices in Drupal security That should be helpful if you have more detailed questions And finally let me once again suggest the cracking Drupal book. It's very good, especially chapter 8 So if you haven't yet gotten around to reading this book you should Any questions unless I'm out of time Yes So the question was if I know any issues with Drupal configuration like outputting errors on the screen Yes, outputting errors on the screen might help attackers to get information on what kind of environment your site is running at Like the the operating system the place your code is running or the SQL error message Provides information on the query that that data is going into so Outputting error messages publicly on the web page is not only scary for visitors to look at big red messages, but also Information disclosure you provide the information for the attacker to guide them on how they how can they crack your website? So I would consider that a dangerous Thing uses a very good regular development site, but I wouldn't suggest to do it on the life site Do I know anything else than that? I don't know it sounds like a too general question for me Yes DDoS attacks So the question was can I speak anything to denial of service or distributed denial of service attacks on any protection to that? It's pretty hard to it's pretty hard to To protect for that I must say of course your best protection is if you have a very well distributed system to run your website on and you can scale automatically up to any kind of Traffic, but it can be very expensive Drupal does have a very simple flood system that tries to Protect people from flooding like contact forms and that kind of stuff I would say that's not a deck that that quit for any sizable attack So I would suggest you look at the web hosting layer and look for denial of service attacks there I can connect you with the outrageous pen. My colleague who's working on solutions for data. Acrea I think he would have much more concrete information for you Yes yes, so the the suggestion was to Have your own inner security team in you To to look at the modules and the available code With a critical eye So we do say we support all contributed models on Drupal.org, but we do not make any guarantees that any of the modules would have a Backdoor or a security problem or a cross-scripting issue or whatever any of the models could have We cannot guarantee that so you should look at the activity of the module if it's being worked on by a lot of people If it's being used by a lot of sites if it has an active Comment history if it did have security releases before that's a good indication that it's a good Module if it had a lot of security releases before that's probably an indication It's a bed module But if it had a few it had eyes on it to to look at it and fix problems And the security team often looks at modules and finds other problems and then tries to fix multiples together not always but tries to Tries to do a a batch practice around that So there's a lot of these things that can inform you on Drupal.org and help you in your module selection when you Try to look for secure tools Yes, the question was if if the blowfish bug affected Drupal in any way security wise and I don't know the answer Unfortunately, sorry So the question was is it a problem that all of Drupal is in the document route Under your web server and is it isn't something that Drupal warns you about when you like upload something with FTP or like or FTP whatever you upload a new module to your site and you change permissions on that or something I Don't I don't think Drupal will warn you on changing the permission on the doc route or in the modules folder it will look at things like the settings file the files directory and those things and It is a it is something you should consider that Drupal runs in the doc route all together People can upload stuff there and Drupal tries its best to protect uploads and rename uploads to have different Extensions so the web server will not run them and there is and there is a Big issue for Drupal 8 to move most of the core stuff into its own directory So all the stuff that is modified by Drupal like the files and profiles and those things and custom modules are in a Separate place from the rest of Drupal core so you can keep the rest of Drupal core untouched And you know where to look for things that are modified And of course there's the Drupal 7 feature to separate the private files from the public files So that you can keep your public files in the document route and keep your private files outside the document route if you want to and There's not going to be accessible from from the web server Even if your server is not reading your hdxs file that is there. So there is a lot of considerations around that I Would say it's ongoing to secure that and we probably kind of improve on on that in Drupal 8 I've seen the issue that separating the user modifiable and the core distribution parts of Drupal to different directories It's set to be going to be committed somewhere later this year But it's breaking so many patches because it moves around everything that it's delayed for the fix ups in Drupal 7 To get in and then we can like make even more bigger changes in Drupal 8 Any other questions? No, then thank you. Thanks for being here


All right. Hi, everybody. I want to talk to you about YouTube podcasts. So I'm going to first share my screen and show you what I mean. If you have been going into your YouTube studio, you may have noticed that there's now a podcast tab, like I'm showing you here. And when you click on the podcast tab, you probably don't have anything yet, unless you have already changed one of your YouTube playlists into a podcast. So that's really the easiest way to start what's called a YouTube podcast is to either take one of your existing playlists. So I'm just going to take a random one here. Let's say this one. Okay. Edit and one second here. Okay. And then when you're editing the playlist, you can click on the three dots and click on set as podcast. Now I'm not going to do that right now because I've already done that with a couple of them that I'll show you. But what is the point of setting a YouTube playlist as a podcast? Well, let's take a look. So first of all, what about analytics, for example? Podcast analytics, I'm showing you one of the playlists I've changed into a podcast. Podcast analytics looks to me exactly the same as playlist analytics, except for this little line here. You can get rid of that one. You ignore that. But besides that, look, views, total views, da, da, da, you know, watch time. That's all the same. This is a regular YouTube playlist versus a so-called YouTube podcast. So it doesn't have playlist watch time and watch time total views. It just has views watch time. So it's actually less interesting, maybe. Let's see content. Yeah, it has views. Let's see podcast. Yeah, it has all these same tabs here, right? Except probably less, looks like it's less analytics than the YouTube playlist. The main drawback, okay? The main drawback is that a YouTube podcast does not... Let me click on advanced mode. Okay, advanced mode, same thing with playlist. Let me go and go back to the playlist analytics has advanced mode too. So both the podcast analytics, playlist analytics both have advanced mode. So thus far, YouTube playlist, YouTube podcast seems exactly the same thing. The deceptive part about YouTube podcast is that it does not give you an RSS feed. What does that mean?  I don't know if Stitcher is still a thing, but it's... You can't distribute your YouTube podcast as an audio podcast onto most of the podcasting platforms. So what's the point? What's the point of having a YouTube podcast? Well, the point is that YouTube podcasting at this time is when I'm recording this December of 2023. It's more of a podcasting distribution platform itself, not a podcasting host, okay? Whereas, for example, Substack is now a podcast, it's a free podcast host as of this recording. You put your podcast on the Substack, you can distribute that podcast onto Apple, Spotify, etc. And you can even distribute your audio podcast onto YouTube through the RSS mode. So you look, you can look for this help document. Distribute podcast on YouTube. You can basically submit your RSS feed, learn how to connect your RSS feed to YouTube to submit that. So what's the point? Again, YouTube podcast is not a hosting platform at this time. It's a distribution platform. So why would you want to distribute your podcast on YouTube podcast distribution network? Why? Because YouTube music is becoming a bigger and bigger thing. Google podcast, which is a podcasting distribution, you know, podcatcher, podcasting software and Google podcast is going to be subsumed into YouTube music or YouTube podcasts. YouTube music is now a very big thing now. People go there to listen to music, but not only music, podcasts as well. So people go to YouTube music. They can click on podcasts and they can, you know, add shows that they want to listen to via YouTube music, etc. And YouTube also has, whoops, let me go ahead and show you. YouTube also has a podcast, youtube.com slash podcasts is a thing now. They haven't promoted that much, but I think they will promote it more and more, given that Google podcast is going away and becoming YouTube podcasts. Now, YouTube podcast right now only has the biggest podcasts, right? They have NBC and Lex Friedman and Diary.  And even the recommended episodes are like tens of thousands, hundreds of thousands. Okay, this one is so-called small, but it's Aubrey Marcus, so it sees a really big influencer. So YouTube podcast is going to become a bigger and bigger thing. So it's a good idea to basically turn your YouTube playlists into podcasts, just like I showed you earlier in this video. And also to take your existing podcast that you uploaded to Substack or, you know, wherever you put your audio podcast, take that RSS and bring it into YouTube as well. You might as well. So this is basically what I wanted to share with you. The reason I made this video is because I was really confused. YouTube podcast, how come I can't distribute it to Apple or Spotify? You can't. YouTube has it's trying to be its own distribution platform. You know, in the future, I'm hoping they get wise and allow us to take RSS from the YouTube podcast and distribute that out to Apple and Spotify as well. But maybe they won't. Maybe they just really want to make it a walled garden for themselves and just have everybody else come over to YouTube to distribute their podcasts and essentially host their podcasts as YouTube videos. But from going from YouTube podcast out to Apple, Spotify, it's not possible at this time. So if you have any other thoughts about YouTube podcasts as a hosting place or as a distribution platform, go ahead and comment below. I'd love to.


IOM has a long history of support to the United States Refugee Admissions Program. This program includes case processing, migration health assessment, travel assistance and pre-departure orientation. We also offer counseling sessions that include preparing them psychologically for travel and before they receive any treatment. Our work also includes a lot of administration work, which includes facilitating and regulating a smooth transition for our refugees from their point of departure to their destination. One of IOM's strengths is being proactive and forward-looking. This has helped me as a nurse to develop the need for preparedness for moments of crisis. Establishing strong relationships with colleagues through teamwork has provided me an opportunity for me to grow personally both at home and at work. It has made me more confident and more self-disciplined due to the vast responsibilities within the workplace. Being committed to humanitarian principles has made it easier to access vulnerable communities and to navigate various humanitarian dilemmas. It has been a fulfilling and rewarding journey as I get the opportunity to interact with people from different backgrounds and cultures. This has given me an appreciation for different traditions as I interact with people from all walks of life.


Camels, the cigarette that's first in the service present the Abbott and Costello program. With the music of Leeds Stevens at his orchestra, the songs of Connie Haynes and the Camel Quinn Tep, tonight's guest Miss Marlena Dietrich and starring Bud Abbott and Lou Costello. Oh, Costello. Oh, Abbott. Will you stop that noise? What are you doing here in the studio dressing your bathing suit? Well, I spent all day trying to get my car out of the swimming pool. What was it doing there? Don't you read the papers, Abbott? The government says you have to pool your car.  They mean share the ride. You have to pick up people. Oh, I did that yesterday. I picked up Helen, Mary, Rosie, and Josie. But your car holds more than that? Yeah. But now they only allow you four gulls a week. Fine that, Costello. Where have you been all week? What have you been doing? Oh, boy, have I been having a phone with Connie Haynes. No kidding. Last Saturday, I took her to a football game. What a game! What excitement! Any passes? No. Her mother was with us. And another thing, Abbott. And another thing, Abbott. There was a man sitting next to us with a six-month-old baby. All afternoon, the kid was crying. He was so hungry. Well, didn't the father bring a bottle? Yeah, but the kid wanted milk.  I give him a penny. Well, did I keep him quiet? Yeah.  He ruined the game. How did it ruin the game? All afternoon, Lincoln was playing in the backfield. Don't forget the football game. Much better this afternoon, huh? Yes, yes, yes. A lot better. We've got other things to worry about.  Isn't that right, Ken? Yes, it is. After all, I could give the program a lift. I'm a shot in the arm. You said it.   Niles is very popular. Why, sure. Right after the broadcast last week, a lot of women chased me a polywood boulevard and one of them caught me and threw her arms around my neck. I saw that. You did? Yeah. You snatched her pocketbook. Now, cut it out, Castella. Now, I talked to Ken's wife and she says, uh, he should have more lines. She says he's got talent. She says he's terrific. She says he's colossal. She says this. She says that. I don't care what his wife says. Well, I do. My wife is a wonderful person. She's as necessary to me as is an umbrella and a rainstorm. I'll take the umbrella.  Now, why don't you be reasonable, Castella? Mrs. Niles is a very sweet girl. Yeah, she is. She's a great deal like Sonya, honey. You mean you have to keep her on ice? Please. Are you folks hearing us? Now, wait a minute. Just a minute. Now, that isn't fair, Castella. Now, let's get together here. Give Ken a chance to show what he can do. Okay. Thanks, bud. I'd like to read a little tidbit that I could just happen to bring along. Oh, this is going to murder you. One night as I sat rocking, rocking on my chamber floor, came a knocking, gentle knocking, knocking on my chamber door. Closer raven, nevermore. Closer raven, nevermore. There, how'd you like that? Don't look now, but the raven just laid a name.  Oh, this voice of this kid is temperane. Quiet, quiet. Hello, Connie. Mr. Castella, honey, I'd like you and Mr. Abbott to meet someone. This is my Aunt Ruby. Hello. Nice to meet you. Hi, Aunt Ruby. How do you like California? Well, I have enough to do. Wait a minute. After all that. I listened to the program last week, and there should be more music. Connie ought to sing 45 songs. There's nothing but talk on the program, and who wants to hear a lot of talk, talk, talk, talk. Talk, talk, talk, talk. Oh, yeah. Why, even I sang in New York, Philadelphia, Cincinnati, Cleveland, Chicago. What about St. Louis? They beat the Yanks. Well, that time.  Mm-hmm. And you're just the old bat that can do it. Oh, yeah. Now, just a second, Castella. You can't talk like that to Connie's Aunt Ruby. She's right. Maybe this program needs more singing. Exactly. Everyone loves singing. Something like this. Oh, you know, I just had my tonsils taken out. Have them put back in. Castella, what right have you got to criticize? What do you know about singing? Now, look, Abbott, if I hadn't come from such a large family, I'd have been a great singer. What does the large family have to do with it? I could never get in the bathroom. Oh, no. Come on, Castella, make up your mind. Are you going to give Niles and Connie more to do or not? Why should I?  And why shouldn't I? What did I have on last week's program? Nothing. Not even a door slam. I understand doors. I know doors inside and out. I talk to doors and they talk to me. What do you hear from the knob? How well may you laugh? Little do you know how important every little sound is to me. Even the sound of a morph chewing on an overcoat. Like this. What's that funny sound? That's the morph spitting out the buttons. I... Don't you think sounds are fascinating? Here is a sample of my day. When work is through, I walk home at night in the rain. I open the door.  Then I walk upstairs in the rain. It's raining in the house. Yes, we're waiting for a government ceiling. He must have a better rider than us, huh? I imagine so. I jump into bed and sleep. It's morning. What a night! I've got to catch the train.  My wife kisses me. I kiss her and she kisses me. Wait a minute. What about the office? With a wife like that, why should he go to the office? Luke Costello. Yes, sir. For me? Yeah. How's your spelling this week? I can spell anything. Okay, spell crumpets. Crumpets. Yeah, crumpets. Crumpets. K. No. Crumpets. C-R-U-M-P-E-S. Oh, wait a minute. You're left out to tea. Today, I got to have crumpets without tea. Why? I lost my sugar ration card. Oh, wait a minute. Ration card. Yeah. Anyway. Ration or ration. Look, around here, you can't forget any teas. Why not? Well, because with us, it's important. In fact, with any cigarette smoker, tea ought to be one of the most important letters in the alphabet. Is that right? Why, sure, tea stands for taste and throat. That's anybody's own personal proving ground cigarettes, the tea zone.  Give camels the tea zone test now. Ask your taste about camels' flavor. You'll find it wears well, doesn't go flat. Ask your throat about camels' mildness. It's the best judge you can find. Thousands of smokers who are making their own tea zone test advise camels suit them. Through a tea. Just remember that you're the one who's doing your smoking. For steady pleasure, try camels. You'll find their slow burning, cooler smoking, richer tasting, milder, better. Because camels are expertly and matchlessly blended of costlier tobaccos. So take a tip from your tea zone.   You'll want to buy a carton tomorrow. On a February morning, the time it came before it was born. Abraham, Abraham. Folks all call him honest, Abraham, president. Quintet, doing Abraham from the holiday in. And now ladies and gentlemen, all quiet. What's the matter? Hey look, look what I got. Look at all the money. Wait a minute, Costella. Where did you get that roll of bills? I went outside for a minute. Just when I reached the corner, a guy ran out of the bank with a bank full of money. And he gave me some. He gave it to you. What did he look like? I couldn't tell. He had such a bad cold, he had a handkerchief tied across his nose.  The man was a bank robber. Oh, I don't think so, Abbott. He was the president. He offered to sell me the bank for a squawk. Sell you the bank for a squawk? Yeah, he said, one squawk out of you, and I'll give you the business. Dumb bills. Why didn't you go into the bank and investigate? I did go in. I went away to run a business. I walked in and a couple of clerks were playing hide-and-seek.  Honest.  The other guy was under the counter. There was nobody around to play with him. Then there was another guy. What other guy? He was trying to do tricks. Trying to do tricks? Yeah, he was laying on the floor trying to escape from a lot of ropes. And you thought he was playing a game? Trying time to play games. Huh? Yeah. Especially when he had a toothache. He didn't have a toothache. No, then why did he have a plaster across his mouth? The man had a gag in his mouth. If he did, he never got a chance to tell it.  I did. And right away, a guy started worrying about his rationing card. Worrying about his rationing card. Yeah, he started yelling, they took the sugar. They took the sugar. Oh, no, no, no. Castell, the man was yelling because he was stuck up. Stuck up? Sure. A fine time to get a swelled head. No. Somebody might have robbed the place. He did rob the place. Look, was there anybody with him? Just a woman. A woman. Why didn't you mention her before? She didn't appeal to me. Oh. Did you pinch her? No. Then you should have held her. If I'd have held her, I'd have pinched her.  A little bit. Do you realize that by keeping the money and letting the crooks get away, you've made yourself an accomplice? Ken Niles. Turn on the radio. Maybe we'll get a police report. Hurry up. Okay, bud. Okay. Hey. Can you get an habit? What's that? There's a message. Well, what does it say? Hold up by Black Pete and his gang of desperate bandits. When last seen, the gang was headed for their hideout at Dead Pan Gulch. Also at large, is there a accomplice? Describe this five feet tall... That's me. Mr. Five by Five.  Now you've got to capture that gang to clear yourself. Uh, now you can't do it alone. So call a posse. That's the thing. Okay. Hip-pushy-pushy-pushy. No, no, no, no, no. Hip-pushy. No, no, please. Dead Pan Gulch is the... In the heart of the cattle country, it's the home of the Western bandits and cattle rustlers. Then I'm just a guy, Abbott. I became a three-letter man chasing cattle rustlers. Oh, how could you become a three-letter man chasing cattle rustlers? I sat on a branding iron. But does that cause you to catch the rustlers? Catch them? I passed them. But this is going to be a long trip. You'll have to get an outfit. What are you going to wear? Oh, we're a 10-gallon hat, a tan shirt, a leather belt, and a bloodhound. What pants? The bloodhound. No, all right. Never mind the outfit. One other thing you lead is a horse. Have you got a horse? Have I got a horse? Yes. I got a horse. And he's my pal. Well, that's swell. I eat with my horse. That's wonderful. I drink with my horse. I even sleep with my horse.  I got it. It's just blanket. Now tell me, can you ride a horse? Sure, I can ride a horse. One time, Abbott, I rode two horses at once, standing up. I had my right foot on one horse, my left foot on the other horse. All of a sudden, we came to a fork in the road. Each horse went in a different direction. That was all I had. Yeah? You thought I'd split? I... Well, never mind. The first thing... The first thing you have to do is find the bandit's trail. When you do, you leap into the saddle and away you go.  Your grip is sure. Your clutch is firm. How's my transmission? All right. I'll ask him. Please keep quiet. Then you ride. You ride out across the prairie. You ride for hours and hours on end. That sounds logical. Don't interrupt me.  Finally, there you are. I knew I'd come through. Yeah. Well, Castello, what are you going to do? Are you going out after the bandits? Are you going to clear your name? I'm going to clear my name, Abbott. Had a boy. I'll do it. I know it was in you. I'm going to get it out of me right now. Come on. I'll get them bandits. But just tell me one thing. If I get killed, what's going to happen to that little fellow that depends on me?   If anything happens, Abbott, it'll kill him. The poor little fellow... Who is the poor little fellow? Me? Connie Haynes with the Campbell Climber to sing a new tune of the Old West, cow-cow boogie. Out on the plain, down near Santa Fe, I met a cowboy, riding the range one day. And as it jogged along, I heard him singing a most peculiar cowboy song. It was a ditty, come a-tay-ay-ay. Come a-tay-yip-tay-ay. Get along. Come a-tay-yip-tay-ay. He's singing his cowboy song. And I clad with a hawk. And Costello as we find them hot on the trail of the bank bandit Black Pete. Leading a posse of men, they tracked the villain to the lawless town of Deadpan Gulch. Here they are, riding up the main street of the town. Like a spurs that jingle, jingle, jingle, jingle, jingle, jingle. What's wrong? What's wrong? One of my spurs got stuck. Costello, what do you think you're doing? Why are you riding underneath your horse? Well, my horse isn't feeling well, Abbott. And the doctor told me to watch his stomach. Here we are, men. We'll probably find Black Pete in the Red Dog Cafe across the street. Stop your horse. Okay. Whoa!  And listen, Costello, when we go through this door, have your gun ready. If anybody moves, shoot. If anybody shoots, I'll move. Hey, Abbott, listen to that. What a pair of pipes. Wish I was a plumber. Costello, don't you recognize her? She's a toast to the dead-pained goats. Really? They're playing the detrick. That face has made a fortune. Yeah, it runs into a nice figure. Hello, boys. Hello, boys. How big are men where you come from? Welcome to the Red Dog Cafe. Did you like my song? What do you think of my range? Your range is lovely. In fact, I like your whole kitchen. Oh, you flatter me. You'll probably be tired after your long trip. How about a drink? Okay. I'll have a Crosby cocktail. What's that? One drink and then bing. With your personality, I would suggest straight corn. What a fresh kid. Just a minute, Marlene. You see, neither one of us is a drinking man. Do you have anything a little milder? Try a drink of this very mild wine. That sounds better. I'll try it. What's the matter? I don't understand. That wine is made here by the Hopi Indians. Hopi Indians? The word of the Indians is still hopping in it. Can't still do that silly. Come on. Let's go over and watch the boys play roulette. Yes. Or perhaps you both would rather play a game with me. Poker, Farrell, blackjack. I'd rather play post office. But that's a kid's game. Not the way I play it.   You could? Yes. Do you know someone? Sure. What a fresh kid, I bet. Now look, keep quiet, Castella. Don't talk like that to Marlene. She may know where Black Pete is. Try to win her confidence. Turn on the charm, you know. I'll turn on the charm. Okay, watch me. Marlene. My love. I adore you. You do, right? Yeah. Marlene, will you let me be your slave? Will you let me do something for you that I have never done for any other woman? What that?  Castella, will you stop that? You just don't know how to handle these Western girls. Oh, yes, I do, Abbott. Marlene, one time I was in love with a bully at Cowgirl. She was too bullied to run at the kettle. What do you mean? Well, she had a terrible time getting her calves together. What are you talking about, Castella? You've never even been in love with a girl. Yes, I was. I can see her now. She always wore cotton stockings. Cotton stockings? What happened to her? Nothing. But of all the girls, I got tattooed on my chest. On your chest? Marlene, I love you the best. The best? Better than the rest. The rest? In the West. The West? On my chest. On your chest? On my joint. Well, there's no question about it, Castella.  Marlene, is that true? Oh, Lou, if you only had the eyes of Clark Gable. Yes. The nose of Tyrone Power. Yes, yes. The chin of Gary Cooper. Yes. The face. The face of who? That's all, if you only had a face. You know, if the kids get nursed. Well, look here, Castella. We're wasting time. Did you forget why we came to Dead Pan Girls? We've got to find Black Pete's hideout. Black Pete. He's the most dangerous character in this park. Oh, he don't bother me. But he's very tough.  That's me. The breakfast of champions. But Lou, why don't you give up this mad search? It can only lead to your death. I think you've got something there, kid. Hey, Abbott. I am scared. Aren't you scared? No, I am not scared. Then why are you biting my nails? But no matter what happens, I'm going after Black Pete, Marlene. And if I die, I want you to take this shirt of mine as a keepsake.  Then wash it and have it back by Monday. And no starch in the collar, either. Listen, Castella, cut out the foolishness. Now we line up everybody in the room until we find our man. That's right, Abbott. Everybody line up and empty out your pockets. Why are you making them empty their pockets? I lost my yoyo. Now wait a minute, boys. It's not necessary to look any further. I am Black Pete. You are? What a fresh kid! What a stale plot. I think you've got something there. Marlene, I still don't believe all this is true. It is true. I took the money from the bank, but I did not steal it. It was my own money. It was my pin money. A hundred thousand dollars pin money? I have very expensive pins. If you don't believe me, I'd show you. I have all the money right here in my stocking. Look, Abbott, what a cute bank!  Oh, Marlene, if I give you all my money from the bank, will you put it in your other stocking? Certainly.  Your money is safer in the bank. Why do you want to put it in her stocking? Because that's where it's going to draw the most interest. Before we hear from Abbott and Castella again, do you want to find out how hitting ground feels to a paratrooper? Well, just hop off the top of a truck going 15 miles an hour. But don't try that until you're as husky as an all-American halfback and as nimble as a circus tumbler. Even then, you'd have to learn plenty to qualify for the chute troops. Fighters as tough as any in the world. And whether your job is to dangle in mid-air from silk cords, or whether you're making the chutes, you want to get the most out of your off-duty moments. Take Helen Lynch, for instance. She works at the Pioneer Parachute Company, making some of the chutes used by our paratroopers. Like so many of us, Miss Lynch is smoking more these days, and she sticks to camels. She said, quote, package after package, camels never tire my taste or wear out their welcome. They have such a rich, full flavor, and they're so easy on my throat. Unquote. Camel is first in the service. Actual sales records in post-exchanges and canteen show that with men in the Army, the Navy, the Marine Corps, and the Coast Guard, camel is the favorite. Why is that? But just ask your own throat and taste.  Camels are milder, too, and cooler smoking because they're slow-burning. The big reason behind this camel goodness is costlier tobaccos, blended in the years-old camel tradition of quality tobacco blending. If you're smoking more these days, try camels.  Camels.  Send a carton to that fellow in the service. And now we'll worry about next week's program. You'll hear more music from Leith Stevens in the orchestra, more songs like Connie Haynes and the Camel Quintet, and a gripping dramatic story of life in the squared circle with our guest star, John Garfield. Now, here is a short preview of next week's program. Thousands of people are assembled in Madison Square Garden. All eyes are focused on the two fighters in the center of the ring. Killer Garfield and Cupid Costello. There is a terrific exchange of blows. The crowd is on its feet. Costello is on his face. Costello, get up.   What marbles? I'm picking up my keys. Be sure to tune in next Thursday night at the same time for another big comedy show starring Bud Abbott and Lou Costello with John Garfield as our guest. Brought to you with the compliments of camel cigarettes. Camel presents three great radio shows each week. Abbott and Costello on Thursday nights. On Friday night, it's the camel caravan with Lanny Ross, Herb Schroiner, Xavier Cougat and Our Town. And Monday nights, Blondie. Balena Dietrich, who appeared with us tonight has just completed a new universal picture, Pittsburgh, with John Wayne and Randolph Scott. And here's the latest news about the camel caravans, those swell traveling shows that entertain our boys in the army camps. Fifteen army and navy training stations will be visited this week, including Camp Gordon, Georgia, Camp Pendleton, California and Camp Croft, South Carolina. This is Ken Niles speaking for the makers of camel cigarettes and wishing you all a very pleasant good night. Ever see a pipe wearing a muzzle? No, sir, and you never will, because that won't keep it from biting. Thing to do is get Prince Albert, the brand that's no bite treated for real smoke and comfort. Another thing, P.A.'s crimp cut, and that means it packs firm and easy and gives you a cool one-match burning. You'll find around 50 mild, rich tasting pipe holes in every handy pocket package of Prince Albert. Try P.A. for pipe appeal. You'll agree it's the National Joy Smoke. This program has come to you from Hollywood. This is the National Broadcasting Company.


rover-playing with guzzarat-mond-shaft, al-adani group and copper-unit joined the Br rapport group al-Goowera company, KOSH, although the company is called Copper Ltd., the interest is to produce again gi miz, for Terra stage in the development of green-field's copper refinery, means theization of the first Michel's ninety gauge steel line al-Goo-lead steel is promised to be the first steel industry that has produced Gemini binding to the subject of도 gender development. forest party 3-NG ڈ accommodation is principle unfitUU ڈ Shan beng HUGE ڈhem to two can be to complete ڈhem really ڈhem business ڈhem totally ڈhem government ڈne, చాయ్డాగిగై నిుటాగై చాసిలాన గాచిపరంత్ నిమియదినో తిసంతిమష్ని అంఠిమరేన సందరాస్నిసంపరారానాని నీందిబో మనూనదని నికివరేనని � jirezchai chi parivas 오� lockerd discharge model vyabhar huichi evang operation pay families apre 9VPN niscrie-y Allāhbhār bhheba ha料 Jab parity with this work? punoh bu fabbahr payin recycle cro효ch kājiao chhohhhh Hautu-наute Jati apanāku amā vad orviatti bhahal lagile Teva amā chanelku Like, Share au Subscribe qari raid qawcih a zkaribra ku jama bi falik volanthoh nahi original English folks


The man that started with a hundred pound and a van it's the ultimate rag to riches story the dream child of Margaret Thatcher and according to Lord Alan sugar the guy that brought computers to the masses So the Amstrad story a let me tell you it's a belter of a tale picture this It's the 1980s Margaret Thatcher's in power the world is buzzing with excitement about computers and Alan sugar is a young ambitious entrepreneur with a vision Now sugar is not your average businessman He's a no-nonsense east-end lad with a sharp wit and a knack for spotting a gap in the market And boy did he see a gap when it came to computers you see in those days Computers were expensive complicated beasts that only the super wealthy Tech savvy could afford but sugar had a hunch that there was a market for a simpler more affordable machine The ordinary people could use so he set to work assembling a team of engineers designers who shared his vision and after months of blood sweat and tears they came up with the Amstrad CPC a Sleek and user-friendly computer that was a game changer for Amstrad But here's the thing sugar didn't just want to sell computers. He wanted to revolutionize the way people thought about technology He wanted to make it accessible fun and above all practical and So he created a range of innovative peripherals to go with the Amstrad CPC Including a printer that could print on both sides of the page Remember this was the 80s people and a word processing software that was so intuitive Even a lorry driver and his family could use it and you know what it worked The Amstrad CPC became a huge success with thousands of people buying it for their homes and offices Sugar hit the jackpot, but he wasn't done yet over the years He continued to innovate and adapt to changing technology Launching a range of products that included everything from satellite dishes to mobile phones and then there's the apprentice All right, who's responsible for the creation of the Amstrad CPC? Well, let me tell you it wasn't just one person. It was a team effort led by One and only Alan sugar the man behind Amstrad himself. Yep That's right. The man who loves to say you're fired He assembled a group of talented engineers to design and develop the CPC And they all put their blood sweat and tears into making it a success The Amstrad CPC was built by a team of brilliant minds. I'll tell you what the Amstrad Computer was a bit like a polar bear wearing roller skates. It looked good on the surface But you weren't quite sure if it could actually perform Don't get me wrong It had its strengths like its sleek design and easy to use interface But it also had its fair share of weaknesses The graphics were a bit dodgy and the sound quality was a bit like a cap scratching at a chalkboard But overall it was a decent computer for its time Some people might argue that the Amstrad CPC had some of the best games of its time with titles like Barbarian the ultimate warrior chase HQ and Roland on the ropes However, others might disagree and prefer the games available on other systems like the Commodore 64 or ZX spectrum But if you really want to know the best of the best I'd have to go with chase HQ as mentioned before Robocop and head over heels Those games were the bees knees the cats pajamas the absolute dogs bollocks of the Amstrad CPC gaming So if you were looking for some old-school fun, those are the games to play my friend picture the scene a Sweltering day in the muggy dog days of August 83 Step forward sir Roland Perry a hapless soul Toiling away at a small fry of a company called Ambit International He was bored out of his skull probably by the annual stocktake Ambit made a pretty penny running a mall order catalogue for electronic gizmos funding all sorts of geeky pursuits that got their pulses racing They doubled in publishing a magazine about electronics Designing nifty calculators and even giving Amstrad a hand with their CB radios Perry's job didn't exactly include counting transistors, which probably ranked somewhere between watching paint dry And cleaning out the office fridge on the excitement scale But then low and behold Instructs Bob Watkins the technical director over at Amstrad Perry's ears pricked up with interest This is more action than he's seen in months at Ambig's digs on Brentwood High Street a town Situated smack dab in the middle of London's dreary commuter belt It's a place where the suburban landscape gives way to rolling countryside But excitement is about as common as a politician telling the truth Watkins and Ambit go way back Thanks to some work the company did for Amstrad in the past You see Ambit's managing director William Pol and Stan Randall who was running Amstrad Hong Kong at the time Were boss and buddies and that's how the cookie crumbled The story continues Watkins was lugging around a cardboard box like it was the most precious thing In the universe and plonked it down on the desk right in front of Perry. I mean, it's just a box, right? But then he starts pulling out a stack of papers and the next thing you know He's unveiling a shiny new computer keyboard and get this it's got Amstrad stamped right there in the corner I don't know about you, but at the time that must have been some pretty mind-boggling stuff right there now according to a few articles that I've read along the way and From Alan sugar's autobiography Watkins turns to Perry and says you're one of those computer types, right? Well, we're working on this computer project and our designers have gone AWOL Do you reckon you might be able to help us finish it off? So Watkins goes on to explain why he's even there in Brentwood in the first place Apparently this chap Alan sugar had been keeping an eye on the whole home computer craze That was sweeping the nation Companies like Sinclair, Acorn, Commodore and Oric were raking in the dough Selling thousands upon thousands of these little machines for a couple of hundred quid each and Amstrad Well, they were still stuck in the audio business barely making a dent, but then sugar had an epiphany He realized that the home computer market was ripe for the Amstrad touch and that's where this project comes in Still probably like you. I can't help but feel like there's more to the story than meets the eye But sugar blesses heart didn't know a thing allegedly about computers So he did what any self-respecting entrepreneur would do he asked around and boy, did he get an earful Turns out this computer business was a whole different ballgame compared to the world of hi-fi and CB radio Right, so Amstrad was all set to handle the outside of their new computer You know the way it looks and all that jazz and Alan sugar blesses heart already had some bloody brilliant ideas in that department on what to do But here's the thing When it comes to the actual guts of the thing the electronic circuitry and the operating software Amstrad was a bit out of his depth So what does sugar do in his infinite wisdom? he turns to a couple of blokes who used to work for the company and Reckon they knew a thing or two about computers now I don't know about you, but that all sounds like a bit of a dodgy move to me I mean these two geezers just claim to understand computers That's like me claiming to understand quantum mechanics because I watched a couple of episodes of Doctor Who When you actually hear things like this, it's a wonder a surprise. They actually got this computer anywhere near up and running So according to what I've heard and read Watkins goes up to Perry and asks him if the company Ambit can finish off Amstrad's computer project But get this he's got two bloody conditions First they got to keep the whole thing hush hush like don't tell anyone Amstrad's involved So whenever they show the keyboard to outsiders, they've got to tape over the Amstrad's name Second they've got to finish the whole shebang like super fast before the end of January, which is only five months away Now Perry talks to his managing director William poll and they both agree to take on the project But get this their role is going to be more like project managers They'll find the best designers and oversee the whole operation at first They reckoned they'd only need to devote about half of their time to Amstrad But let me tell you that turned out to be a right load of old bollocks. They were in way over their heads So this Perry bloke the newly appointed project manager starts tapping into his network of contacts from his time as an engineering student at Cambridge University and let me tell you back then Cambridge was like Britain's version of Silicon Valley and as you know Silicon Valley is like a legendary strip of California That's given us these amazing breakthroughs in computing and electronics and so to sum up Cambridge is a bit like that for us Brits In fact back in the 80s the media dubbed the area around Cambridge as Silicon Fenn Essentially it was a hotbed of high-tech companies Sinclair Research and Acorn were the big stars of the show But there were loads of other companies that were killing it in the Cambridge scene It was like a whole new world of tech was opening up right before our very eyes And so as the story goes Perry didn't waste any time He hopped on a train and was in Cambridge within days of Watkins visit He talked to two sets of computer designers and got straight to the heart of the matter The biggest problem was finding some top-notch software designers for the Amstrad computer You see this thing needed an operating system That's like the big boss program that controls all the main activities of the computer And it also needed a basic which is the most widely used programming language in personal computers Without these things software houses wouldn't be able to write any games or any programs that could run on the Amstrad machine So Perry was really up against it He knew he had to get the best software designers on the case if they were going to make this thing work I mean this was a bit like Mission Impossible and as we all know Perry pulled it off Time was ticking which had Perry scurrying around Cambridge trying to find some software designers for Amstrad's new computer project And after a few full starts he finally landed on a gem of a contact in Howard Fisher Fisher had previously worked on a project for Acorn which involved developing a basic for the new Acorn small business package The work had been carried out by a couple of design geniuses Chris Hall and Richard Clayton They had gone on to form their own software partnership called locomotive software Fisher suggested that Perry should give Clayton a shout as he was part of the old Cambridge crowd And you know what they say it's all about who you know Now this is where things get really interesting So Clayton the software genius tells Perry that they need to find a hardware expert to get this project moving Honestly, you couldn't make this stuff up. And wouldn't you know it? Mark Eric Jones is just a stone's throw away Clayton immediately suggests giving him a call and seeing if he can come over to help out And this is where things all start coming together quite nicely So this is all getting quite interesting now, but listen to this MEJ's old man was the big cheese over at a little outfit called data recall They were a bit of a who's who in the tech world back in the day We've plenty of former Cambridge folks on board including one Richard Clayton Now data recalls real claim to fame was their fancy word processor the diamond and let me tell you This bad boy was no joke These things used to go for around 10,000 a pop the diamond was top of the line And as it turns out this background would later prove to be a real asset for Amstrad Now, I hope you're finding this a really fascinating story You see it was the cozy confines of the King's Arms Pub in Dawking where the final design for Amstrad's Computer was trashed out and let me tell you they didn't mess around They scrapped the existing software and hardware design and completely transformed the computer into a Z80 base machine They also managed to churn out an operating system and a basic by the end of January Now in my job today, I'm all about productivity and that there is some serious productivity Now here's the real kicker Even the Dawking engineers themselves had no idea who the mysterious client was Perry had spent the whole day teasing them with the talk of a big high street name leaving Clayton to scratch his head and wonder When it came time to give their prototype computer a codename Perry decided to go with Arnold and get this He even went so far as to replace the Amstrad branding on the keyboards with the new moniker Now most people assumed that this was a nod to the general electric company Which was led by none other than Lord Arnold Weinstock Who coincidentally was the biggest manufacturer in all of Britain but get this folks It turns out that Perry had another motive behind the name choice You see Arnold is actually an anagram of his own first name Roland Pretty clever, eh? If you ask me of course the computer would later acquire the more formal name of CPC 464 Which stands for color personal computer coupled with 64 as a nod to its memory size But those early days of codenames and speculation must have been really exciting These new Amstrad computer models use some pretty fancy tech called gate arrays Now originally developed by Ferranti Gate arrays are a game changer in computers because they let you pack a whole bunch of individual components onto a single silicon chip You can custom design a chip to meet a manufacturer's precise specs for a particular piece of equipment It's like having a tailor-made suit for your computer Now back in the day in 1983 gate arrays also known as uncommitted logic arrays Were a pretty new technology for consumer items in the mass market Even the mighty IBM hadn't used them in its first personal computer So why was it such a big deal for Amstrad? Well MEJ had a chat with sugar and he told him that the gate array had three major advantages First off by packing so many components onto one chip They could cut down on the component count and cost of the machine Second they could fit more features into the computer for the same price and third They could reduce the chances of the Amstrad machine being copied because once you've got a customized gate array It's circuitry is effectively hidden closed off The Amstrad CPC 464 computer was a bit of a tricky customer when it came to gaming It wasn't quite like your regular gaming console or computer So it would take some serious effort from those software houses to write games that would work smoothly for it But here's the thing sir Alan sugar being the savvy businessman that he is Knew that he couldn't wait around for those software houses to catch up No, sir He had a plan and that plan was to ask not one not ten But 50 software companies to supply one game each now that might sound like a tall order But you know what they say go big or go home and Alan sugar wasn't going home anytime soon He was going to get those games even if it meant dispatching 50 prototypes by late November and let me tell you that's no mean feat Now if you've ever wondered why the Amstrad CPC when you boot it up has a blue screen background and yellow writing well listen up The Amstrad team had just returned from Japan where they had some rather interesting discussions with their counterparts from Orion Well, it turns out that the Japanese wanted Amstrad to change the screen coloring on their machine Now you might be wondering why the Japanese was so insistent on this point. It all comes down to contrast You see the previous color arrangement on the Amstrad machines was a bit indistinct And the Japanese wanted to make sure that the screen was as clear as possible And how did they plan to achieve this? Well by using yellow letters on a blue background The strongest possible contrast you can get Amstrad wasn't about to argue with the Japanese on this point They agreed to the request and locomotive blessed their souls set about adapting the color codes to make it happen The finishing touches to the design went smoothly thereafter And it just goes to show that sometimes a little tweak here and there can make all the difference You see Alan sugar Had a rather unique vision for his first computer He saw it as a games playing machine for the home for sure But he also wanted it to have one foot in the business market I think even back then sugar was thinking big even back in those early days And part of his plan to make the CPC 464 stand out was to make it big enough to look like an office computer He wanted users to realize its potential for business functions And let me tell you he succeeded the CPC screen was wide enough to take 80 characters Just like most computers found in the office. That's twice the amount normally available for a home computer So Amstrad CPC's first computer the 464 was unveiled a mere eight months after Bob Watkins had walked into Ambit's offices Can you believe it? Talk about a speedy turnaround and by then Amstrad had already hired public relations advisors Michael Joyce consultants to mastermind its increasingly slick product launches. These guys were top-notch They even went as far as hiring the Great Hall of Westminster School A stone's throw from the Houses of Parliament for the CPC 464's launch So the Amstrad CPC was available in three different configurations You had your basic green on black screen model which was going for 229 Then you had a color version for 329 And finally there was a model with an add-on disk drive for 429 When it hit the market the CPC 464 was greeted with pretty positive reviews from the press Some journals even went as far as to call it the people's computer Jack Schofield computer editor for the Guardian had this to say about it This little beauty outperforms the Commodore 64 the machine's main rival in practically every way Plus it's a heck of a bargain costing a cool 80 less than an equivalent Commodore or Atari machine Well, I hope you've enjoyed this video Please like, comment, subscribe or better still leave me a thanks Plus I'd love to get a decent microphone and a decent camera setup and go out and about You know revisit all the old software companies go back and capture most of our misspent youth So until next time Bye


One Super Nintendo accessory I never fully took advantage of as a kid was the Super Game Boy. I did have a Game Boy in a few games, but I never got all that wrapped up in that universe because, well, I had a Super Nintendo. My mentality was, why would I want to play lesser versions of these awesome Super Nintendo games? Screw that! So the Game Boy games I ended up having were just like Tetris, WWF Superstars, Bart vs the Juggernauts, Roger Clemens MVP Baseball, stuff like that.  Now what I stupidly ignored is that many of these Game Boy games served as extensions or complimentary pieces to the Nintendo and Super Nintendo classics. So here's a list of those particular Game Boy games that were spin-offs, so to speak, of their Nintendo and Super Nintendo counterparts. So yeah, no Pokemon in this list, please control your anger. Now keep in mind, only original Game Boy games work with the Super Game Boy, so no Game Boy Color. Let's get the obvious ones out of the way first. The first game that comes to mind is Link's Awakening. I already reviewed this one, but I'll say it again, I like this game better than Link to the past. I like the silly story, I love being able to jump, the piece of power is a lot of fun, and the way the map is slowly unlocked the further you progress is cleverly done. Another obvious game I'll get out of the way real quick is Super Mario Land 2 and the Six Golden Coins. This game was a quantum leap ahead of the first Super Mario Land. Seriously, it's like going from the first Super Mario Brothers to Super Mario World, and it's still obviously an outstanding game today. Plus, how can you beat Bunny Mario and Wario making his debut as the main villain? If you like Super Mario World and who doesn't, then you'll like Mario Land 2. It's available for cheap on the 3DS Virtual Console, so check it out. Sticking with the land theme, there's also Donkey Kong Land 2. It's impressive how it manages to cram in the traditional Donkey Kong Country graphics onto a tiny Game Boy cartridge. Like Donkey Kong Country 2, you play as Diddy and Dixie, but it features completely new layouts for each level.  Mega Man 5, not to be confused with the NES Mega Man 5, also features original content with new music and new bosses, all named after planets in our solar system, even you, Pluto. Sadly, this game does have some slowdown problems and has kind of a goofy jump glitch, but the gameplay and level design is as good as you'd expect from any other Mega Man game. I'm a huge fanboy of the NES Mega Man games, and I think this game is on that same wavelength. So if you love Mega Man, you gotta check this one out. The cartridge of this one is kind of rare, but thankfully it's available on the 3DS Virtual Console. Operation C is, of course, way more like the original Contra or Super Steep for the NES than it is like Contra 3, but this game did get kind of ignored a bit. It's got five original stages, but it does borrow some elements from Super C. This isn't to be confused with the Contra Alien Wars port, just FYI. It's got that classic Contra gameplay, although it does play a bit easier since the Game Boy limitations make it tough to have a lot going on the screen at once. I really like that the default gun is a machine gun, so all you have to do is hold the button down instead of tapping it to death. Anyway, this game is usually pretty cheap on eBay, and I think it's well worth it. Castlevania II, Belmont's Revenge, is another game that's closer to a complimentary piece for the NES titles, but this game also has some surprising similarities to Super Castlevania IV in terms of atmosphere. Yeah, you heard me. An original Game Boy title manages to create a real atmosphere. The sound design goes a long way toward that, and the overall presentation here is really impressive. It's really worth checking out. There's four castles you can play through in any order. There's rock, crystal, plant, and cloud, and they all have distinct music and backgrounds. The game might not be as hard as the NES games, but it's a fun play through that lives up to the Castlevania Legacy. Next, there's Metroid II Return of Samus, whose mission is to eliminate all the Metroids on their home planet before the space pirates show up. This game is kind of polarizing. Some people love it, some people hate it. It's nowhere near Super Metroid, but if you enjoy the 2D Metroid universe, you might like this one. The sound and graphics of the Game Boy don't always lend themselves well to a game like Metroid, but to be honest, I kind of like the soundtrack. The dissonance reminds me of an Atari 2600 game, or even Earthbound at times. Anyway, the usual Metroid combat style is here, with upgrades, energy tanks, and missile packs. It might not appeal to everyone, but I think it's worth a shot. Next, there's Teenage Mutant Ninja Turtles, Fall of the Foot Clan. At first glance, this game looks super limited and really easy. I mean, as a Game Boy beat-em-up, looks pretty basic, and for the most part it is, but it is capable of getting somewhat chaotic at times. You can choose to beat any of the four Turtles to crank through five original levels. Bebop and Rocksteady are here, Baxter, Shredder, Krang, the Technodrome. It's a short game, but it's not a bad way to spend a half an hour. Next, there's Gargoyle's Quest, which in my opinion is better than its Super Nintendo counterpart, Demon's Crest. I know I might be in the minority on that, but seriously, if you like Demon's Crest, you should absolutely check out Gargoyle's Quest. The level design better fits Firebrand's capabilities, and it makes you be a bit more precise. You also have a limited time in which you can fly, a feature that I think would have gone a long way in the Super Nintendo game. There's an overhead map where you can fall into random battles too, as well as the usual side-scrolling levels. It is easily one of the best original Game Boy games. Alright, let's close this out with a bang. Two more games that are on a much bigger scale. First, Final Fantasy Legend 2, also known as Saga 2, Hiho Densetsu. One of the better games in the Final Fantasy universe. The gameplay is pretty standard, four characters in your party, choosing between humans, mutants, robots, and monsters. Exploring a world map with random encounters where you fight monsters. Simple stuff for the most part, but you can control what stats level up to a certain extent. Physical attacks increase your strength, and magic attacks increase your mana. There's also minor stuff like tanking, which is a nice touch. The story is that your dad one day leaves to go find the Magi, which are 77 shards of a broken statue of a goddess. Years go by, and you decide one day to go looking for him. It surprisingly gets pretty interesting, with parallel universes, other gods fighting for power, ancient civilizations, and without spoiling anything, things don't always go as planned. The best part of the game, however, might be the music. I love the battle theme in this game. So yeah, Final Fantasy Legend 2 is deceptively simple. There's more than meets the eye with this game. Last, there's Harvest Moon, the second game in the series after the Super Nintendo version. This is basically a more affordable port of the wildly expensive Super Nintendo game. Yeah, it's pretty limited. There's not as much variety as the original, and stuff like the mountain isn't in this game, sadly. But I always really enjoyed the Harvest Moon universe.  The fundamental gameplay stuff with the farm is all here, clearing the land, plowing it, and planting crops. You can also buy and raise chickens and cows, which of course produce eggs and milk. If this sounds painfully boring, then, uh, I don't know what to tell ya. I like the Harvest Moon games, though. And while this one might be a bit limited, it's way more affordable than the Super Nintendo version, and it looks surprisingly nice as well. Alright, there you go. That's eleven original Game Boy games for the Super Game Boy accessory for the Super Nintendo that are all worth checking out. One last thing I want to point out real quick is this handy Super Game Boy guide that comes with the accessory. It gives good pointers on how to customize what colors and borders you want to set for each game. You can look up most of the stuff online nowadays, but it's still pretty cool, and it's worth grabbing if you can get it for cheap. Thanks for watching. I hope you have a great rest of your day.