I didn't intend to make any slides at all because I intended to have some small brain storming session. With a few interesting people, I want to talk about how secure is our Damian desktop. This means for users who are using day-to-day applications on their, for example, the desktop issue. I want to outline my security budget for what I'm intending to solve, or what's the problem that we're being conflicted. I see that we're conflicted. First of all, from time to time, we all have to, or in the past, have incomes to occasion where you have to run 100% software like, do you really just activate this Adobe reader? You are perhaps aware that it is, by default, able to run JavaScript and connect other websites to the internet, but there are use cases where you really have to use that, for example, like filling out formulas, and you can imagine various other applications where you really need to run proprietary applications where you don't know the source code, you don't know exactly what it is, and you run it anyway in one environment or the other one. Or even if you restrict us to use just free software, I think we all have used ICWISL or Firefox at some point, and if you look at the security history, it's not really a secure software, but we still use it. We know that there are malicious websites doing all kinds of weird things with JavaScript, so many people prefer to just turn off JavaScript, but seriously, does it work for day-to-day use? I think not. Or think about buffer overflows in, for example, media players. You still want to watch video from somewhere, and you still run unsecured media players. Of course they are unsecured, but you live with that. What are the problems with running unsecured?  If you run Firefox on your laptop, you essentially grant Firefox the right to access, transmit, delete, whatever the GPG key. Think about that. I think that's a serious problem. Generally, nothing happens because Firefox generally won't open your GPG key, but potentially it has the right to do this. And I think this is potentials dangerous. Now I want to move your view to other operating systems which are more popular, which are quite popular. There we have softwares used of all various kinds. They call it personal firewalls, where you can restrict the software to, where you can intercept the software when it calls to the Internet, then you get some sort of pop-up or other notification. In application called Microsoft Internet Explorer is trying to access the Internet to this or that website. Do you want to disallow this? There are other kinds of sandboxes softwares used available on Windows. There are various kinds of virus and trojan scanners and other auditing tools for Windows. Now let's shift back to Debian. What do we have here? There are some commercial products like this Panda Antivirus on firewall. Have you seen that before? Well, that works. That's quite similar to the personal firewall which I explained to you. So if you get notifications like I do, you'll be really trying to call home to this appearance, but it's commercial. There are really various all kinds of other virus scanners available for Windows and Debian. Therefore, I think I don't need to count them. There is some free software in this area of interest which I'm talking about, like a ClamAV. I think there are other virus scanners besides the most popular ones. I'm not sure if there's any software for sandboxing or free software for this personal firewall. Does anyone know here some software which can be used for sandboxes? Well, I think that the most common way to sandbox application is to virtualize.  You can be quite confident that nothing bad will happen to you for some new GBGQ or something. You can also run V-Service. Sorry? You can run V-Service. V-Service? That's another kind. That's not virtualization, that's isolation, but it comes to the same point, right? It depends on the home. You also just basically run your potentially malicious software in a user account. Yes, you can separate with different user accounts.  You can't really say that to users. It could be, it could be difficult to have a separate user account and it's kind of so... You just find it easy to do, but I don't think it will work. It's nice to stay home. I think that's an approach Microsoft is doing with this, running Internet Explorer in an alpha less privileged security context. Are you trying to remove all the... Everyone having to be administrators and do everything? Yes. For example, yes. Right, so virtualization could be one approach, but I think we all agree that's not really what we want here. What... And you mentioned Sea Linux before. Yes, there are a couple of security frameworks in the... You already mentioned Sea Linux. It's a very intensive and broad approach. It requires you to label your complete file system to have this time rule enforcement depending on the role you are and depending on which label, the binary you have to execute. The policy itself in Sea Linux is implemented by the reference policy and... Well, it's too much to explain Sea Linux in detail in this talk. I just want to mention Sea Linux exists there. We have heard a talk with Manoj at the beginning of this week. I hope you will hear that. And alternative or another way approach to do this is Armour. Armour wants to compete with Sea Linux without having to relabel your complete file system because they rely on file system locations. So they say, okay, you want to run the binary user bin Firefox, so it has this set of rules applied to them. I just looked up before the comparison of Sea Linux and Armour on novel.com. Obviously, by us. And I just copied all these signs with usability in mind. Well, sure, they make different constraints and assumptions more easy so they can have easier rules. What you cannot do with Armour, for example, is to have the same binary running in different security contexts so you can't have a Firefox which is able to access your more secure cookies than another one. It's not possible with Armour. There are also some other less known security frameworks. Who of you knows SysTrace? And everyone on that? It's very common in open BST because it has been properly integrated in the system. You can think about it like a fireball for system calls. You start an application in a SysTrace environment where you apply a set of rules which system calls are allowed with which parameters. For example, you can apply a policy to the open system call and then match a regular expression to see what kinds of files the application is able to open with which mode and whatever. This is SysTrace. It's VAR but I think it matches a bit with SysTrace, right? Yeah. It seems like a Kluge system to me. So it always seems like kind of a Kluge system to me when we're trying to do a secure case of filing, matching and bargaining, matching. Well, it's not only a file name. It's just that you can also apply security policies towards them to the connect system call which allows you to implement... Right. Or if you apply it to everything, you can have something like a personal fireball. If applied correctly. And has anyone heard before of RSVAC? Anyone? Interesting because from what I've seen from the virtual, it seems to be an impressive project but it's rather just a framework and not a relative solution. They provide you to install your system, modules they call ADF, get the proper decision for the team and access control enforcement facilities. You can install several of these decision fallacies in various places of the Linux panel which end things, all kinds of things like ACC, file access, network access, whatever. And with this you can also implement different security policies. And I wanted this to be a brainstorming both. These are four security frameworks which we would be able to use. I explained to you the problems, what we currently have and I think we all agree that they are real problems which we really should find some way to deal with them. And I'm open for suggestions on how one of these four or maybe someone gets up with another idea I think a public can see perhaps a road mesh to approach how to solve this problem. That was my last slide for you. I think what we were thinking about, Stefan, you and me, we are currently developing some top-down approach by thinking what we understand with a security policy and the next steps to map our understanding of a security policy to one or more of these frameworks. Currently it looks like it was down to sisterage people for a reason that are not so interesting here. But we wanted to hear your opinions. Do you think these security facilities are, or which of these security facilities are usable to solve the problems that we currently have on the desktop at all? I can't think that in five years' time, or maybe two, we could leave without something like, I have ACNUs in mind or anybody which enforce security based in the context of what the application is doing. I guess everybody is more or less aware of ACNUs and also have to learn some stuff that also can detect some kind of malware or call it virus or whatever, because it really works. No, not to the same, it's as an extra, I don't like the engineer's work, it's not meaningful, but some stuff that can detect that you have done it in something which is not, it's probably going to have a strange behavior. ACNUs, to me, are probably one of the best in the world. This trace is, ACNUs, cheaper way to implement ACNUs stuff, it may be easier to improve our system and we can modify it. I'll say ACNUs, don't really use them much. We're the ones here. We need to use it and so we can improve the policies. Probably ACNUs is, of course, it is very complex to get an ACNU that works for the new one. So, would you think that it's feasible to just leave most things running and not just the web browser and some serious special applications that we can strengthen by ACNUs? This is a valid approach for the beginning part. This is just a slightly harder process. In fact, this is the approach the reference policy is doing and the reference policy is basically the only really usable, in fact, usable policy for CELINOS, which, that's why the reference policy is targeted, that's the full name. Yeah, but it's only for the system services and not for the process. But different users put different violence for web browser and ACNU, which have different policies for the different users. So, I think that's a quite complex task to consider. There's no easy way currently to switch between things. I don't think there's no other problems, but it's also, obviously, a security issue. If it's easy to switch between them, then they're not secure. Switch between what you say? What you're allowing it to do. Applying new policies. Applying new policies to and running or to a new process. Yeah, basically, currently, you have to be big. With CELINOS, you can install new policy modules, the reference policies module, and you can load and unload security modules, which are part of the policy you're implementing at runtime, just like you can do with parameter modules. The problem with this is that with CELINOS, this is a privileged operation, so you have to be moved to install a new security and policy in the current. What could be really slick was if the user would be able to constrain himself from saying, I'm starting actuary now, and I want this particular instance of actuary to be not able to contact any network, because for UNO PDF installation, you're able to contact some network. Yeah, so when you're about to start programming, you can expect that you want to make it, say, more enforced than normal. It's probably an interesting way to do it, rather than you go, I want this to be in the open, because then that would be whatever project virus, et cetera, would do, if it managed to get onto the machine to be able to talk back or install things. This is an interesting thing I've made around, just get it restricted in some way. Right. You can also have it checked. And this is in fact doable with CIS3s. Surprisingly, yes, it is, because a user can... No, you cannot run CIS3s with an CIS3s. That was a limitation, right? So if you have to compute this, don't run it with an CIS3s, you cannot run... You have to compare them. You need to have a worker. Yes, you. Which then would apply some constraints. Right. You can perhaps track the CIS3 system, compare the new rules with the older rules, define some metric which is more... Which defines, is this rule more or less strict? And if it is less strict, then I know it. Otherwise, deny it. Yeah, I will. And I did some research on CIS3s on them, and they used to be a package called Carbon Patch CIS3s along with the CIS3 tools. It has been removed since some time from there, because the old maintain a lost interest in it, and just often it had it removed from the labian archive. There is one upstream guy who still parts it to Linux, so it's waiting to be packaged by someone who actually uses it, so it could be really an auction, but we need to package it. There are packages ready to use, packages for sale drawings, but made by Linux. I think there are more packages for Debian, and I know that a lot of guys are working one-up armor, so that should be easy to get this into Debian, if it isn't already. CIS3 needs to be packaged. There is a C in the upstream guys of providing some Debian packages, but it seems nobody has used it so far. And I really hope that we had someone who could tell me about that, but it seems to be no one here. I think it is the desktop, and I think it's possible. I think we're going to be really reckless and stuff like this. I think we can play the game, it's like the same thing, but worse, I think it's interesting, it's like web browser, like E-mail and streaming, it's just good defaults to not let the web browser go to GPG and stuff like that. Yes, we're doing the same things, and yes, this is basically what we are trying to solve for the power. It should be default, it should be a choice, or we should have to opt out of it. It's quite a problem we should do. Because it's a problem that people would want to turn it off. I think, to answer your question, I think we can't expect to have a serious strict policy in the next few years. So we must get through what we call targeted, as we do today, this statement can do this, and this section, and maybe extend this to user... Which is the same section, but you would want... What would the user want to do? And so, firefox, just don't go to password file and do this one, it would be better to say it can go into this, rather than you having to divide it into... Yeah, you're right. But the idea of targeted is to have a transition and say, we can't do strict today, so we'll just firefox. It's better, and just gradually out.  So it's better to be patient. But some of that compromises that you just get used to. As long as you can see that there's this benefit and so, you move the file afterwards, but you're much more secure. So the basic idea is to start with a small set of rules, which are supposed to not break too much, and then gradually improve the rules. I get it. Is that works? You had in mind before? Yeah. There's only one question, and it's only working to get somebody to restrict a police enforcement. I think the best thing is if people run it and then they can see what actions they're not going to want to do and allow it, hopefully all normal things people want to do will be allowed. Then one of the problems with things like SELX is everyone's half thinking, well this is really complicated and there are major problems at the moment, I can live with evidence. So there's partly a PR science to think of this. And going look, it's easy to install, it doesn't cause you any problems, just do this. In fact security frameworks are designed to cause problems because you want to restrict. So this is... That's part of the problem. It's not necessary people do what they don't want to do anyway. It's not a problem. Many applications have access to SELX and they don't really need or it will always be positive points or real problems. I'm just an adult and I'm studying migration to Linux or my company. And then security has actually been one of the issues we've looked at obviously. And then we were a little, I won't say surprised, but most people will know the windows style group of stuff. We've built an active directory environment. Does anybody know some sort of equivalent for Linux or Linux systems? For Linux or Linux systems? I mean some central management because I completely agree that something you want to have on a desktop should be as easy as possible for the end user. However you may come across some situations in which management should be done centrally. And basically that was one of the things you didn't really find stuff like that. I think you have a very good point here. Can you please elaborate on the requirements you have. Are you centralized now? What other requirements are there? What do you want to restrict? What do you understand here on security policy? I think between those you've got very fine-grained control of things on your desktop. Absolutely. It's slightly different. It's not entirely there's two things about those group policy things. One part is more configuration based than switch of items and stuff. Some other parts is also security related and it's actually for the security related bits. Okay. Like running programs or you need to do that. What we're doing now is giving through such policies access to particular all of the workstations. Which has changed from historical what they were doing, you can run it. It's basically you have to get away from the single machine where you can administrate the social. So these policy you said we're not going to restrict programs from doing certain actions but they restrict the user from doing any applications. So we could do something with groups. That's a difference. Basically we would like to go in much more detail. Like some central simply managed AC Linux which we can really go more fainter say like this program can access this file in this situation. So basically you would like to see Linux but have it managed centrally. Did you have to write it yourself? Did you have to write it yourself? You could do it without that. Have you heard about CFMG? Yes. Some people use FAI or Puppet, I don't know this one.  And the certain ones as well. You don't have to apply it. Yeah, you've got to have some questions. So that would be a way to go. One, CFMG is a tool to distribute a configuration policy whatever that means. You still have to decide on the policy and ways of actually implementing the policy. And it's basically system configuration. It again doesn't allow you to restrict programs from doing certain things. You could have, if you used ACLs, you could do it for user's or likes to running the programs. But that's maybe a bit complicated. This goes to this window's approach that you have one centralized service which sets basic unix file permissions to restrict users or groups to things. To see a engine allow you to use ACLs or just basic file permissions. So, you could presumably use it to deploy an ACL with policy as well. That would continue. Yes. Since you are allowed to execute check commands and your parse files and edit files, you're basically allowed to do anything including it. So you need a special policy for the engine to only have some rules. I know there is a security framework or being in place or being hacked on can you give me a small overview what this is useful for today? Of course, it's not usable for anything because it's just a framework. The basic architecture is structured based on the ACLs where you have high policy and you respect access to resources within the X-server. The default access control in the X-server is what you need to get at everything in order to know inter-process restrictions whatsoever. The X-ACE security framework allows you to implement ACLs by policies inside the X-server to restrict access to various properties so you can restrict the ability to cut between applications and restrict the visibility of other applications from what you know. Essentially, the partition works in your work environment so you can see the logical sets. A set of applications that have created additional privileges like the window manager has really immediately all of the windows on the screen. This grows out of the ST Linux work and the historical X-security framework which I have fairly sophisticated policy and fairly sophisticated access control of other policies. And how does it relate to the ST Linux? Does it use the same syntax and the same mechanisms or is it completely different? It uses the same semantics. I'm not exactly because the objects are different it can't really show the different types of the same files or anything but the basic concepts are very similar. I'm not exactly sure how the where the policy is stored but it's only visible to me in terms of access restrictions that are actually quite easy to use. And it's being done by Amy Wall she said at NSA. What stage is this? I don't know. He worked on it before he got his security clearance at NSA quite heavily for a year and a half or so and he went off and disappeared for a couple of years right back doing more work on it. I don't know what the stage is. I don't know if it's a usable work that's very, very useful for intellectual work. I don't think that's the way to see where it is stored. So it's mainly developed by the industry? Yeah. There is a public see-away framework but no policy like the reference policy? Yeah, I don't think he has a policy. Yeah, it provides some level of security. Very interesting to try to try to answer that. But I'm not sure at this point because a lot of inter-process communication happened outside of the X environment. I'm not sure what the added security to the X issue at this point. A lot of the communication has to do with security. And so that certainly knows. Unfortunately, because these frameworks don't talk about D-Bus security, how do we integrate these? D-Bus has its own security framework. We have particular processes that users are allowed to access different resources in the system. So how does all these different services which now have this wide variety of different security frameworks in place, how do we manage them and provide unified information about what your current security policy is?  None of this stuff talks about what we do with X or D-Bus or how information will access to devices. All this kind of stuff. It's a few months ago now, but I remember reading a scientific paper from the NSA talking about how to lie sediments to something as weird as the GCon database. I think you've read the paper as well? No, I've read it. He is explaining and describing how to design and implement user space object manager, I think he calls it. Great. And he's applying the concepts with the type and role and subject to object to GCon. And he's labeling the GCon keys by duplicating the complete GCon tree to sub-tree prefix by Cliners and then the he stores the security labels. Yep. And then each time an application in order to access the GCon you have to use a well-defined interface. But there's not a database ending behind the enforcement policy. Right. And the paper therefore proposes because currently GCon is commonly used with orbit with a corba interface. And in the paper he proposes to drop that and just switch to D-Bus because from the D-Bus side he can implement this user space object manager more easily to enforce Cliners' rules on access to the database. And that's what the paper is basically about. So it seems to be at least in theory solved somehow. Well, I mean the database seems to be focusing on getting to being able to use SClinics file access control for all these different databases. It seems like good. It sounds like you will be able to give us this information. But it seems like it's pushing the way for these other alternative frameworks. Because it seems more the concepts in SClinics seem more generally applicable across a wide domain of different databases. But we had an old access control mechanism in X that was just to do that here. So it was actually compartmented both workstations. We had basically two domains. We had the secure trusted application and the trusted applications. The trusted applications could do anything. The untrusted applications wouldn't really be there. If you remember the invention at this age could they turn that on? What? Put it yourself? Yeah. This sounds quite similar to what we're using currently in Unix which is operating a root account which can do anything and use our account which can do a certain set of actions.  And so all of a sudden half of your extensions no longer worked for the sysh access applications because it made anything coming in over as sysh was later untrusted. So the render extensions stopped working. Pre-booking. Does the audience or how do you feel now what can we do from the Damian side or which approach should be most feasible to have a secure desktop as I defined it in my talk before. Which framework or which way would you suggest to be the most popular? I think the other distributions are already showing that sysh access is the direction we're pushing things in because it does provide enough semantics and flexibility to encode a really wide range of systems. It doesn't seem like there just isn't any community support about these other mechanisms they have shown themselves to be significantly more confident in what we see in the configuring. Other opinions? Okay. I wanted to hear. Because Jaxon seems to object quite strongly to as you know for being a framework which introduces a very complex set of rules on something which should be simple. But if it's too simple then I don't think it's perfect. I don't agree with them, I just say I don't think his argument is wrong though. SC limits is for all intents and purposes today possible for the user every year. And to say that we should policy frameworks SC limits and that just seems crazy. But we haven't come up with a better mechanism yet. The United States is simpler. Either simpler or just perlating it so it works. Well, if the user can't understand how it's configured then they're going to know that it's secure. And they'll act like accident configuration changes will be gain and secure again. And how the SC limits community is addressing a particular issue. It makes some sense in the server environment where you can expect there to be a confident in knowledge versus in the desktop. It seems like we have a long way to go for SC limits to be understood and configured by a younger user. Well, there's the two parts there. There's the desktop and then there's all these sorts of things. There are very good desktops. They're very difficult to separate. There's a corporate desktop at this point that's mutated randomly by the corporate user. As much as corporations would like to watch out for desktops, users can manage to work around these restrictions on a regular basis. It obviously depends as they've got the rest of the machine which can install effects off. But if you can physically touch the machine that's the key. Yeah, pitch. What? Essentially. But then if someone's actually putting off a removable media and stuff and pulling the bias battery out you can then take policy but workplace policy depends rather than future policy against them at that point. They're obviously violating things that could mean that. Right. In the computer pool it's needed the users have physically access to the machines but they are told to not switch it off, to not remove it because it has a password and what effect users could just take it offline into various things about it but we have cameras and we stick with people doing that. Yeah, or if you have security cables through the machines meaning that you have to actually use enough deterrent, I would say, for most things. Yeah, well I've been in a cop in a student department that works quite well in any case if the user doesn't understand the policy independently whether they're intentionally they don't know what they are secure against them so they don't know what the system is violating. In the worst case you just frustrate them. But even in that case they're just frustrated with the system to survive and we want to encourage them to deal. What problems I see with SD-Linux is at this point I don't see how SD-Linux is able to help me with implementing some sort of person firewall. This means to supervise implications of what they are actually doing and asking me what they are also doing. What does SD-Linux not provide a mechanism for redirecting requests to get a connect request to it? If you have an application trying to make a network access SD-Linux doesn't really seem to provide any ways to say either you can either say yes or no it doesn't seem to provide a mechanism for saying wait let me check. I haven't seen that before but that would be very helpful in this case. Yeah I think that's although then again we have the endless pop-ups of windows. Yeah I think I heard that we got into an effort of such kind of some guy who actually made which works with IP tables and with GUI we just asked what pandas pandas providing this? Nooo Ah there's also I think phytosol is equal to GPL yes I think there's another GPL implementation not what you say but How does that allow you to pause the connection? Maybe to answer I think there's an IP tables user space project where you can redirect a packet to user space and then let a user space privilege even contact the user session debuffs and make it pop-ups and things I think there is a GPL application for that but in there it's really restricted to network connections which is a good thing but I was rather looking for more I think there are the two distinct things there's network and there's phytos I'm not sure if there's anything, there's an easy way of actually tying those two together apart from just having a program that does two different things What I would like to do is if really in long term if we want to secure the desktop I don't think we can rely on any user interaction to enforce security because we know how users are the first time they're being asked what's the problem as soon as they understand they might give a sensible answer the fifth time they just don't give up and say what's the key point yes and the problem is really that they don't probably it's very difficult to get them to really understand what's about someone going to this application wants to get to the network and why should I why shouldn't it and if you can answer whether this application if you can document why this application should go on the network you probably actually can build a policy to enforce you shouldn't be tasked with that point well I think there are two distinct use cases the one is yes, a half time one thing is to secure a general to work workflow day-to-day applications that you probably don't need these interactive pop-ups to ask you what to do but I think there is also another use case where you are running a potentially untrusted application you want to supervise it and therefore these pop-ups can be very useful if you actively want to supervise them sort of training programs you are running for studies maybe and you are seeing what it's doing but whether you have any user really wants to be doing that end user might end user might they get into the conference maybe not at conf but sometimes they have a very interesting conference and they are being given some stuff on it and of course it's something they have to learn because that's how it's done in windows world and so they plug in the software and if they have been sensed how is it going to be done they might want to say I want to okay I have to run the software but I want to run it as being unsecure and then having those kind of pop-ups you can do that and this would be interesting and that would probably more apply to software that you are downloading yourself rather than the system in software but generally that should be tested yes maybe but not always not always but it's a more likely situation and you have to admit that's a common use case more idea, more inputs time is up but thanks you for attending the session I think we have written down some interesting points are we allowed to say what we are doing making choices to get past all the stuff no, the website is supposed to be go online so we are working we work on such a project to get some environment to design place we are currently evaluating different security frameworks and we want to hear from just requirements common use cases which I think we have written down some interesting points here to make a centralized approach like you are demanding I think we can call the name it would be the Nubius project website is going to be on as soon as possible well, we actually want to work in that direction was this kind of interesting application thank you thanks for coming thank you thank you thank you for operating the camera you are welcome


In a time before time, oh so long long ago, humankind had known things which we no longer know. Designs so advanced from their minds and their hands that a primitive man just could not understand. But something had happened a long time ago, the earth it did shake and the wind it did blow. A disaster occurred that they just couldn't mend and the time before time had come to an end.  And the skies they did fall and the ground it did crack. And with everything lost there was no looking back. They found shelter and caves as they arose from the mud and a new time began at the end of the flood. And with all that was lost for the few left alive, only one thing was left, just their will to survive. And the need to replant and to regrow the land with the seeds in the handbags they held in their hands and they hunted and gathered and tried to rebuild but the shoes of the past were too big to be filled. Over thousands of years they forgot there was more. Time itself had erased the time once long before. And so here we are now with advancements so grand but we're wondering how and we can't understand how people from caves could have been so advanced ancient ruins were not made by primitive man, how they carved shaped and moved megastones in such ways with mathematic precision that we can't do today. And we look to our history books and can't bear that there's something not right, that there's something not there. Where is this lost time that we can't find in history? How old is mankind and can we solve the mystery?


Okay, so going up from the previous mode of like explaining people's projects and stuff like that, I go back to something a bit more theoretical from a very simple explanation on JavaScript inheritance. So basically to me it's like the journey to classes. I figured what's the best way to learn something than to like share it with 50 people and then get all the 50 you are wrong with your rights. So here I am. So it's a simple journey today. So basically if I just take two very broad categories of inheritance, we have the classical inheritance such as in Java and then we have the prototypical inheritance such as in JavaScript. So in classical for instance this would be like you making a cut maker like a plastic, like a metal cutter for little paper men. You make the cutter so that metal cutter thing would be like a class and then each time you want to make like a little paper man cut. And then for me what I understand from prototypical inheritance, this would be more like cutting paper man and then you take this paper man, put it on paper and cut it again and then you can alter it and cut it again. And so basically instances where you can inherit from other instances, so objects from objects. And so here's the found part that I found. I think it was like in my second or third week of living JavaScript, it was the prototype chain. So essentially almost everything in JavaScript is an object and all of them contain properties which you consider like that or like that. Each object has an internal property called prototype which is like this and it's linked to a previous object. So this is the prototype chain and visually it looks something like this. So don't worry it doesn't go on forever. Essentially there will be the end of the chain. And so going back to the previous slide, in the two types of inheritance we have classical and prototypical. I always say prototype. I can't remember. There's like two different terms for it. And then essentially what my takeaway is like JavaScript does not have classes but we try to program as though it does. And so I say hello ES6 classes which is what I'm using. So if I take a very simple diagram we have inheritance. Like I mentioned we have classical like in Java. We don't want that. And then we have prototyped like in JavaScript. And then two examples the prototyped pattern and the constructor pattern. So this will be the constructor pattern and this is the prototyped pattern. So this is essentially how it looks like. I'm sure you're familiar with constructors and then like the old school one. And then essentially this example shows that like both of them are pretty much identical in terms of memory usage, things like that. The ability to create like the kids is also pretty similar. So no much difference. And this is the fun part which is the before and the after. So there is like the constructor. And then how many of you have switched to ES5 2015 already? And how many of you are using classes in ES 2015? Okay so I still have something to talk about because some people haven't. So essentially this is like the constructor. I'm sorry I'm a bit short. This top bit. This is the properties. And then you would do like a, for example, like book.prototype.flip page. And then this is how you do the method. And then you instantiate it like that. You put it in and then like you can flip page now. Whereas in 2015, in 2015 we can put it all together and we can actually call it class. But in ES 2015 essentially this is like synthetic sugar. So you're still doing the same thing. You're still essentially like creating objects and dealing with inheritance. But it's just like a nicer class thinking kind of manner of doing it. And so over here you create the class book. I will put like constructor. So it's still constructor but in nicer syntax. You pass in your arguments. I put in default sometimes. My example is just making books and then your properties. The method would be like flipping pages. And then I create another example class called ebook which extends from book. And over here the fun thing is besides making like defaults you can do things like super. So super all this stuff. Title, year, total pages, medium. Basically you just take it from here and ignore this line. And then I wanted to include another method for example, compatible devices. And then for the method you could super the flip page. I could super the previous method and then just edit like an alert. So this shows that you can very easily extend from this one. Let's do in a JavaScript manner. And then you instantiate them in the same manner. Like book, book, ebook. And then I can pass in more arguments that come from here. So that's essentially the end of it. Hope you enjoyed it. Any questions? Any questions you can ask Sab. Thank you.


Hey there Chameleons, it's Chamele and today we are bleaching my hair. I hope you guys saw yesterday's video which with how to fade out red semi-permanent hair dye or any semi-permanent or demi-permanent hair dye, but the next step in changing the color is bleaching. So unfortunately I have these crazy long roots and we've got to take care of those. So I'm going to show you guys how I bleach my hair in the most healthy way possible. So I'm going to get my bleach which is the Prism Lights in blue and I just got this at Sally's because it was on sale and because it's blue which is the opposite of orange on the color wheel so it will help kind of balance out the orange tones in your hair and get you closer to blonde. Now I'm mixing that with a 30 volume developer and I always use the cream developer over the liquid because it's easier to use. I'm doing one scoop of powdered bleach using the scooper that came with it, shaking up that developer, shaking like a polaroid picture. You're actually not supposed to shake polaroid pictures apparently. People just do it wrong. It kind of breaks the color capsules. But anyways I'm doing two scoops so I'm doing a one bleach to two developer ratio mixing that together and then I'm adding some Olaplex and I'm putting in a fourth of an ounce like it says to on the packaging but you just want to read that, pouring that in there and then mixing it up. Once you mix it all together you'll see the consistency and that it needs more liquid so I'm doing one more scoop of the developer. So pretty much one scoop bleach, three scoops developer and then Olaplex. Now I've been wanting to use this hack for a long time but I always hear about people using sweet and low which is fake sugar mixing it in their bleach and then using it so that the bleach doesn't sting or burn their scalp as much and I have a sensitive scalp so this is definitely something that was worth trying out and I just took this from like a random coffee shop or something that I bought coffee at because trust me I would not be putting this fake sugar in my body I would rather just put it on my hair. Now I'm going to part my hair and the way I'm sectioning it is just to keep my hair as healthy as possible because some parts of your hair will bleach faster and other parts are more delicate just based on where on your head it's located so I'm pretty much just sectioning off the outer inch around my whole head so I already had a center part down the middle of my head and now I'm doing an inch from the front on the left and on the right and I'm pulling that into two sections looks super hot like that oh yeah and now I'm doing the same thing in the back just about an inch thick from the base of my neck and then I'm going to put that in a section of its own now for the middle part I'm dividing this into sections too so I'm going to do a front and a back section this hair is the thickest hair on my head so that's why I want it to start bleaching first and processing first and as you can see my roots are pretty long you have to use gloves when you're bleaching your hair because the chemicals are really strong and you don't want to ruin your skin so make sure you put your gloves on and now working from the bottom section I'm using the bleach on my fingers because I want to be able to feel the back of my head since I'm not using mirrors and no one's helping me so I always just use my fingers because that way I can feel how like I can just feel what I'm touching pretty much and I'm pulling that all throughout the roots until the very end where the black ends and then I'm kind of just very lightly fading that into the bleached part with the least amount of overlap as possible because I don't want to bleach something that's already bleached I just kind of want to keep it on the new growth now I'm taking up the scrunchie for the top middle section and I'm doing the same thing here I'm just pulling the hair out into sections of their own so out of the sections I make other sections so it's like section-ception and then that's what it looks like when it's all done and now I'm going to put that up get it out of the way and then start working on the outside sections now I did the back first because it doesn't process as fast as the front of my hair does and I saved the front for last because this part bleaches the fastest and gets damaged more easily now once all the bleach is on you're gonna let it sit for a while and I use a very low volume since I used Olaplex on the 30 it brings it down to a 20 volume so I just let it sit for probably an hour and a half because it was so low and this is what it came out looking like so you can see that my roots are still golden as expected with such a low volume but it didn't ruin my hair now I'm gonna use Olaplex number two which you use after you rinse out the bleach don't actually use shampoo you just rinse it out then you put this on all the sections that you bleached and it's going to help bond your hair back together and kind of fix some of the bonds that were broken when you bleached so I'm doing that all throughout the roots that I bleached and then just pulling it throughout a little more now I just did the whole process all over again the next day and this is what it looks like after I did all the sections and then I applied bleach and I use Olaplex again and sweet and low again and actually did help a little bit with the burning sensation so that was great but for my second round I used 40 volume developer which Olaplex brought down to a 30 volume just because the 20 volume really isn't that strong on hair that's so dark so I just let this sit for probably about 40 minutes I used bag to keep the heat and speed up the chemical reactions and after I did that I decided to tone my hair I use this blonde brilliant stuff because it has a sigh extract coconut oil papaya extract mango oil wheat proteins it has all this stuff in there to keep your hair healthy even the developer has coconut oil papaya extract and mango oil so it is better for your hair and I only use five volume developer because I just want to deposit the color without adding any extra lift or any extra damage to my hair so I squeeze the tube of the toner into my little mixing bowl it's like white stuff but then at the end it turns kind of like a PG pink color for some reason but that's what it looks like and then I add the same amount of developer so it's a one-to-one ratio and pretty much just need half the bottle so you just mix it all together making a nice even paste and then this is what my hair looked like the next day after the tube leachings had happened and dried and I definitely did some hot oil and some keratin treatments before doing this now I'm just sectioning my hair again I'm sectioning it into quarters this time just so it's easier to apply the toner and the toner is not as big of a deal as the bleach so you don't have to be like too crazy with the sectioning you definitely have to wear gloves because it is chemicals again and I'm using my fingers once again to spread this out just because it's easier to feel so I start with the center part apply it there and I move to the front of my face and just all around the outsides of the part make sure it's nice and saturated and then you want to start sectioning off the other parts of the section with your fingers and making sure that every single thing gets covered and then with all the extras you just want to use that on the rest of your hair and just kind of pull it through all the rest of your blonde it will just kind of tone everything out a little bit and just make your hair a little bit more even I'm putting my hair up in a ponytail and then up in a bun just to keep it out my face girl and then I'm putting on a plastic bag speed up the chemicals and because it makes me look like Tupac in a twisted way so that's the healthy way that I used to bleach my hair and tone my hair and get it ready for hair dye so tune in tomorrow and you will see the new hair color thank you guys so much for watching I hope you enjoyed this video don't forget to subscribe to this channel my cooking channel and my vlog channel which are linked down below and I will see you chameleons in the next video kisses


Okay, we're back live inside theCUBE. This is our flagship telecast theCUBE from SiliconANGLE.tv, where we go out to the events, extract the signal from the noise, talk to all the thought leaders, smartest people in the room we can find, CEOs, entrepreneurs, developers, bloggers, you name it. We'll cover it and bring all that to you, extracting the signal from the noise. I'm John Furrier, the founder of SiliconANGLE.com. I'm joined by my co-host. I'm Dave Vellante of Wikibon.org, and we're here with Mike Claco, who's the CEO of Brocade, CUBE alum. Mike, welcome back. Thank you very much, Dave. We've had you on here last year, and... How we call it? EMC Worlds, big event, keeps getting bigger, cloud, big data transformation, all great messaging. How you doing? Where you guys fit into all this? Well, how are we doing? Well, we're doing great, thank you for asking. Where do we fit is the fact that everything that's being talked around, whether it's big data or a virtualized enterprise, or all the different things around analytics, you got to move data from point A to point B. And the only way you can really do that is through a network. And so that's what we build, we're a pure network player from that standpoint. And the other thing is you have to understand how the data's moved. So our heritage is all around storage networking. So we can apply that storage networking to the big analytics as well as the big data, the big analytics, as well as cloud computing. So we're in a pretty good inflection point and a great spot right now. Yeah, we've dubbed, others have too, I guess, the 2012 is the year of the cloud, but it's real. We just did a survey on Wikibon and it's very clear that people don't see cloud as a buzzword anymore. You know, the whole Larry Ellison rant. I mean, it's real, it's happening. You see that in your customer base? We are. We actually are seeing it in a variety of different deployments. There are, the service provider marketplace right now is actually bifurcating into two. One is it's looking at the bit pipes. How do you get lots of bits down the pipe very rapidly? And the other one is the value added services. That value added services is hosting applications. And you see some of the companies here, they're all hosting. So that area is growing rapidly. So that's one. And then the second is inside the private companies, everybody's trying to figure out how do I create all these virtualized machines and then move them throughout my organization? And so that's another huge opportunity. That's a private cloud, if you will. I think what's going to be the big, you know, holy grail in the future is how do I take this private cloud and this public cloud and then be able to seamlessly move between the two? And those technologies are just around the corner. Yeah, and I think, Mike, I wonder what your take on this. I think two years ago people were like, that's not our primary strategy. We don't believe it. I think now when you talk to customers, they actually believe they can get there. Do you agree with that? Is that what you're seeing? Oh, I absolutely agree with it. In fact, you know, I look at the, I look at my company as just an example. And right now 45% of all my applications are hosted in the cloud. Now, my employees wouldn't know that. My customers wouldn't know that, nor should they worry about that. In fact, it's the ability to access this information anywhere is what's got people very excited. So you guys are transformed internally or you're starting to transform internally? We have, we've done about 80% of our applications are virtualized and 45% of what's remaining or the other applications are actually hosted in cloud. Eating your own dog food? We were at Sapphire last week. You know, it's a European company in a very state. They said, well, we prefer to say drinking your own champagne. I'm not sure about drinking your own champagne, but we just look at it just pragmatic business applications for us. Mike, Mike, so Joe Tucci gave his keynote. He said, you know, the debate between private and public cloud is silly. That's a direct quote from Joe Tucci, mainly emphasizing the point that there's many clouds depending upon, you know, public and private. So there's no one winner. And we pretty much believe in that. But with cloud, there's the IT implications which you can see saying, oh, cloud is IT. Big data is for the business transformation, you know, analytics, et cetera. What's the role of the networking fabric play in this evolution? Because it's evolving so fast, certainly in the big data side, it's real nascent still, but on cloud it's rapidly evolving where you have hybrid, you have private, variety of different clouds, and data is the gravity, as Pat Gelsinger said. So how do you guys talk about that fabric in the network, in the cloud? Well, in fact, one of the things that our customers have told us, which is usually a pretty good indication, instead of us telling them, is that a fabric architecture will be the foundation of any other cloud. It provides infinite elasticity.  You have a fabric, you actually have a network for storage, and now what we're saying is you're having a fabric or a network on the whole idea of how you do all your server connectivity. 80 to 90% of all the traffic in a data center in the next few years is going to move east-west. Between servers, not through up and down, which used to be the traditional north-south. And because of that, you have to actually have this fabric in place, if you're going to go ahead and take advantage of the promise that cloud architecture can bring. And so, you need a fabric. Tell them about the customer, event customers are telling you about this fabric. What are some of the successes you're having with the customers in that regard? Well, we actually, and we had our earnings call last week, and what we've said is, we have about 550 production customers right now that have put in ethernet fabrics. And we have more than 50,000 customers just with EMC alone that have put in storage area networks, fabrics there. And when you look at all the other, so we have hundreds of thousands there. So now what we're starting to see is we're doubling every quarter, just doubling and doubling and doubling, and because they see the value of this. And first application that we're seeing that folks are simple virtualization. The ability to seamlessly move and drag and drop an application anywhere within the data center, they need a large sphere of mobility, and that's when ethernet fabric gives them. Yeah, now you guys have had a long relationship with EMC. I remember when you guys sort of essentially made the market for sand switches, EMC at the time was selling big monolithic boxes, but EMC to its credit embraced the storage network. Could have been a great equalizer, but they didn't fight it, they embraced it when your partnership started. And then we just saw a month or so ago, you guys are part of that despex announcement. You must have been happy about that. We were, we're very happy. In fact, we recognize that actually EMC and us together and a variety of other partners have recognized that best of greed, when you put it together, is actually best for the customer. And so you take the best servers, the best storage, and the best networking technology. EMC with its variety of offerings that they have is best storage. And you can see the whole, the lineup card that they have. From our standpoint, we have a large variety of networking products. More importantly, we have a very robust Ethernet fabric technology. It's our seventh generation of silicon that we're building this upon, so we're not new to it. And then there's a lot of technology going around the Intel server space on who's best. And there's a lot of leapfrogging going on. The nice part of what the customer can do is they can actually bifurcate these all together. And by the time they're ready to implement, they can get the best breed, put it together and it'll work. So talking more about Ethernet, right?  Seventh generation silicon. So talk a little bit more about the Ethernet uptake and that part of your strategy. Well, it's an enormous market. So you have to understand when we went into the marketplace, one of the things we looked at is we really believe that virtualization was going to be mainstay across all sizes of enterprises, as well as when we took a look at the marketplace from the growth opportunities force, we needed to have an answer for what we call the virtualized enterprise, virtualization, cloud-based computing. And that said, by definition, you need to be able to participate in the Ethernet world. And 10 gig, 100 gig, not just the basic connectivity, but the next generation. So when we look our fastest growth area, it's all around 10 gig. We're now the second largest 100 gig producer in the world in terms of shipment of product. And as soon as I shipped 100 gig, I had a customer come to me and said, when can I expect a terabit? So there's an infinite demand out there at this point in time, but if you're going to participate in cloud architecture, you have to participate in Ethernet side. So you were talking about earlier about the flattening of the network. What's driving that? And then I got to follow up. Well, I think the biggest thing that's driving it right now is just the large sphere of mobility on virtual machines. You just be able to come up to a rack, count the number of machines in a rack and say, oh, there's 20 machines in that rack. I got 20 instances. You walk up to the rack now, you may have 400 machines in there. And the ability to move these seamlessly throughout a data center, great tools by VMware, tremendous tools. But we're scaling to the point where customers want to move between hundreds of thousands of VMs. So you need a large, flat network to go ahead and do that seamlessly because going across networks, it still is a challenge. Going within a network is relatively straightforward. And your vision is that interconnect between that server to server communication is Ethernet, right? It is going to be a combination of Ethernet and fiber channel. The reason it has to be a little bit of both is it's actually relatively straightforward and VMware has done a tremendous job around the server, moving the server apps. Moving that storage behind it, you got to be able to keep the storage and the servers in sync in the data center. And then when you start stretching them outside the data center, and how do you keep FCIP and MPLS in sync? Technology's required there. So I think it's a combination of both. So server to server, driving that, that's the private piece. Ethernet and then fiber channel at the back end for the storage. But Ethernet versus InfiniBand, you guys are betting on Ethernet, right? We're betting on Ethernet, we have. We've made that position known. I mean, we're already in 100 gig technology and the price points that are on the... Ride that curve. Yeah, we're just going to ride the curve there. Mike, so one of the big themes here at EMC World and throughout all the different cube events we've covered is acceleration. Acceleration of operating cycles, acceleration of acquiring customers, acceleration of product development. So this acceleration theme, startups accelerating, all this stuff's happening. So one of the key concerns around developers and enterprises is they want to build an application environment that can accelerate fast. So the go-to market for these kinds of plans are shortening. What are you guys doing at the network fabric level to enable that acceleration? Is it the virtualization component and what specifically do you guys look at that as if you're enabling this robust top of the stack, if you will? John, that's a great question. In fact, it's all about speed at the end of the day. We can come up with technologies but you got to be able to absorb that technology in an organization or a partner has to develop. We actually, in our Ethernet fabrics, have developed and opened, there's an API that you can actually redirect frames out to take advantage of security applications or dedupe applications or encryption or a variety of other applications because there is going to be so many great technology. Technologies that haven't even been invented have to be accounted or planned for going forward. And so we provide that in the way that our products are designed that they can actually bridge out, go in to take advantage of an application and come back in at basically line rate. Yeah, and we talked to a lot of customers and one of the big concerns we hear, among other things is they don't want to foreclose future benefits by going with an existing platform. So to them, a table stakes now is the enablement, not to foreclose that. Are you hearing the same thing? Foreclosing new opportunities that they business can build on. You know what I'm hearing from a lot of customers right now is we as vendors, a lot of vendors, we've put so much complexity into the marketplace. And frankly, there's a lot of compliance that had to be accounted for. But if we can simplify that complexity. You know, a year ago we used to list the top five areas that the CIO was very, I mean, just say these are frontal lobe, things I worry about every day. What popped into the top five this year is access to skilled labor. Now you think about that. And we talk in America all the time about the number of unemployed people. Well the fact is we still can't find enough skilled people so we can do two things. We can train a lot more people or we can simplify the products that you don't need management. Abstract the complexities away. Exactly. So we're going to the latter. We're making it very simple to use technology, building diagnosis into the product sets and so forth. So we're just trying to take that complexity out so you don't even have to deal with it. So okay, so let's take that thread a little bit. Step four, you're here at EMC really probably doing a lot of customer meetings and you know schmoozing, doing a lot of biz dev. They're almost up that CEOs do. What's the conversation like with you, with customers? When you go to them and say, hey, about Brocade, what's the kind of high level conversation do you have with your peers, other C level executives? You know for the most part, I would probably say that if you grouped it in the categories, one is strategy, so where are you going? You know, how do you plan the cloud? Where do you think that virtualization's going to go ahead and fit? How do you fit into the analytics side of the business and so forth? What's next? And so they're always looking for what's next because sometimes the high C level execs, they're making a decision for something that may not implement for a year and a half or two years in that because they have to go ahead and look farther ahead. So what we do is we have those kind of discussions and then I can compare and contrast what we're doing around the world. So let's talk about some of the product things that Brocade's doing. So like we're seeing some examples in the marketplace where different approaches and purpose-built hardware and certain solutions are getting traction and grow rapidly. VCE is one we've been tracking for a long time. Dave called it out her first and he predicted that that would be an explosion. But that's also a multi-vendor environment. There's no one solution that fits all anymore. How do you guys as a company navigate those waters of, hey, I'm a multi-vendor, but you still have to integrate in and extract away the complexity, which might require more of the one vendor, but still playing nicely with the interoperability. I think that's a great point. I mean, this is the whole V-spec thing that we came up with the EMC is you build the blueprints, you test them out. We have an enormous lab at our disposal. EMC has an enormous lab at their disposal. Many customers don't want to be in the lab business. What they want to do is they want to be in the deployment of applications. They want to go ahead and solve a problem. And so what we'll do is build the blueprint, test the solution, and literally hand it to a partner and say, these are the combined solutions. Pre-fab solutions. I mean, the VNX, which we covered, the VNX launch. I mean, very simple channel product, but they just packaged it so it's cleaner. We're doing the same thing and we're in partnership with them. Yeah, so the V-specs was something you guys were working on? We're working with them. In fact, our VDX product line, which is our Ethernet fabric, as well as our ICX product line, which is our standard Ethernet connectivity products, they're part of that offering also. So Mike, I want to talk about, come back to Ethernet a little bit. I mean, the strategy is pretty clear. You guys want it to diversify, get into the growth market. It's huge, as you said. Now, talk about what you did initially. I presume what you did is you took your relationships with your best sand customers and then obviously you're going to sell Ethernet to those guys. How do you go, first of all, is that accurate? And how do you go beyond that? How do you broaden beyond that? Is that a channel play? And talk about that a little bit, if you will. Well, actually, that would have been the obvious thing to do. We weren't that obvious, I think. What we ended up doing is finding where our products fit best and because there are more competitors in that space. In the sand space, we're at 70% market share and so we know where the customers are. We know what the value props are. So what we tried to do is provide differentiation. So we have some very good niches in the service provider marketplace. However, it's in certain segments on the edges, in some of the content distribution networks, some of the internet exchanges and so forth. So very, very high growth areas that have unique requirements that we build very fast race cards for that marketplace. And then we take a look at some of the other marketplaces, the unique requirements that an educational institution will have. And so we're going there. Some of the things that we do for the government, very, very unique. Instead of just general purpose, cover the world with everything. Now we're branching a little bit because we've got our strategies in place there and now what we're doing is implementing a fairly robust two-tier network of distributors and then taking those products, building them specifically for the channel that they can go out to their partners. Okay. And then, Mike, my last question for you was around sort of vision and brand. You know, what do you want the brand to stand for? What's the bumper sticker vision for our audience? We are a pure networking company. I mean, we're really good at what we do. And so we can not only move applications, we can move data from point A to point B with 100% quality guaranteed all the time. So, I mean, we're a high quality networking company that is committed to help companies grow into either the cloud architecture or what I call the virtual enterprise. Yeah, so you guys are really playing on drafting on the trends of cloud. You know, we talked a little bit about big data, driving some of the other networking trends. Obviously, getting tighter with EMC, which is good to see, you know, give customers choice. We love choice. We love competition here at The Choice. The choice is great. Mike, thanks very much for coming. Always great to see you again. It's great to see you. Nice to see you, David. John, nice to see you again. Okay, see you, brocade. We'll be right back at the short break.


Hello and welcome to the session in which we will discuss cost behavior. This topic is important whether you are taking managerial accounting, the CPA exam, cost accounting or the CMA exam. We have to understand how costs behave because when we make a costing decision, it's important to know whether the cost is a variable cost, a fixed cost or a mixed cost. Before we start I would like to remind you whether you are an accounting student or a CPA candidate. I strongly suggest you take a look at my website farhatlectures.com. No, I don't replace your CPA review course. I can be a useful addition to your CPA review course. I can be supplemental material to your CPA review course. My course is designed to mirror image your CPA review course. The risk of trying me is one month of subscription. The potential gain is passing the actual CPA exam. And if not for anything, take a look at my website to find out how well or not well your university is doing on the CPA exam. I also have accounting lectures for intermediate accounting, auditing, managerial accounting, cost, taxation. Also, I have the AI CPA previously released questions and my courses are there to mirror image your CPA review course. If you're taking an audit course with Roger or a reg course with Glyme, my course are designed to help you with these courses hand in hand or if you're taking a course with Becker. If you haven't connected with me on LinkedIn, please do so. Take a look at my LinkedIn recommendation like this recording, share it with other, connect with me on Instagram, Facebook, Twitter and Reddit. So let's talk about how costs behave. So how costs behave, we have three, three types of cost behaviors and I'll have to let you know upfront that in the real world, those like for example, you may not have a 100% variable cost or 100% fixed. Mostly they are variable within a range, fixed within a range, mostly mixed. But for educational purposes, for knowledge purposes, we're going to assume that certain cost is a variable cost. What is a variable cost? From the word variables, it means it varies. And how does it varies? It varies in total and direct proportion to changes in the level of activity. The best example I can give you to illustrate this concept is the old cell phones, cell phone plans. When the cell phone was becoming a more popular, a common household item, here's what would happen. You would pay for the phone and you will pay based on the usage. So if you did not use the phone, if you use the phone, zero minutes. Okay. So this is, let's assume this is the minutes and this is the dollar. And I'm going to say, I'm going to say one minute per dollar to make it easy. So if you use it one minute, you'll pay $1. Okay. If you use it two minutes, you'll pay $2. If you use it three minutes, so this is one, two, three minutes. And this is how it used to be actually, believe it or not, maybe some of you don't remember this, three minutes you'd pay $3. This is the dollar. Now we can draw a graph and it would look something like this. So as your usage goes up, as your usage goes up, your total, this is your total, goes up in proportion to the level of activity. So this is an example of total variable cost changing in proportion to the level of activity. Okay. Hopefully this make sense. Now in the real world, you might have cost drivers such as unit produced. For example, for each unit produced, you'd spend $4. If you produce two units, you will spend $8 so on and so forth. It could be based on machine hours. What's driving your cost? Again, the cell phone is the cell phone usage. For example, if you have a vehicle that's delivering its miles and miles driven, if you're using a vehicle to produce or it could be labor hours. So those are all cost drivers. So the variable cost per unit, you have to understand now what we are discussing. The variable cost per unit is constant. And if we go back to this example to my cell phone, I said for each one minute, you pay a dollar. So the cost per unit, the variable cost per unit is variable. Why is it variable? Well, because for every unit, the cost is always a dollar. The cost is always the same. Therefore, it would look something like this per unit, per one single unit, per one single unit. So per one single unit, you'll have a flat line. But in total, in total, in total, it varies in total. It increases in total. But per unit, it's $1 per unit. So this is the variable cost. Let's talk about the fixed cost. And if we always, when we say the fixed cost, we say the fixed cost within the relevant range, and I'll explain what do I mean by the relevant range in a moment. But what is a fixed cost? Well, as the terminology implies, it's fixed. Fixed regardless of the activity, again, within a relevant range. A cost cannot be fixed forever. For example, if you are renting a building, let's assume you are operating a building and you are renting that building. And let's assume you are paying $10,000 rent per month. And that $10,000 is for 1,000 square feet. Okay, so $10,000 to rent 1,000 square feet. So simply put, as long as you are within 1,000 square feet, you only have to pay $10,000. Okay, as long as you are that. But let's assume you are expanding your operation and now you need more space, more than 1,000 feet. The next thing is you cannot rent, for example, 5 square feet you have to rent. It goes from 1,000 to 2,000. So what we say is now the the fixed cost jumped. So since you need an additional 1,000, now you have to pay, we're going to say it's proportional, you have to pay 20,000. So what's happening here, the relevant range of the activity is flat within a relevant range. So this is flat up to 1,000 square feet. Then if you're going to go up to 2,000, then it's going to jump and it's going to stay flat to a certain degree. So the fixed cost always fixed within a range. So the cost remained constant regardless of the level of activities, again, within a relevant range, within a relevant range, it cannot be fixed forever. So in total, the cost is fixed. So in total, let's assume in total, so if we look at the look at the graph for the total fixed cost, let's assume we are paying $10,000. So the $10,000 is the same regardless of the activity, assuming we're not jumping activity. As long as we are within the relevant range, the fixed cost is the same. What happened to fixed cost per unit? Well, the fixed cost per unit is inversely related. What does that mean? Let's assume we are paying $10,000 as fixed cost, fixed cost, and we are producing for the sake of simplicity, $10,000 unit of XYZ. If I ask you, what is your fixed cost per unit? You would say $10,000 divided by $1,000, your fixed cost per unit is $1. Let's assume we were very productive and we produced 20,000 units for that month, and we're still paying, remember the fixed cost is $10,000. If we produce 20,000 units, now our fixed cost per unit is only half, 50 pennies. So what happened to our fixed cost per unit? As we produce more, our fixed cost per unit goes down, our fixed cost per unit. So per unit, it's inversely related. However, in total, in total, again, we are dealing within the relevant range, in total, it stays the same $10,000. So you need to understand how variable cost behave in terms of, in total, it varies in total, it stays constant per unit, fixed cost, it stays total in fixed cost, in total, it's fixed per unit, it's inversely related. And we'll see an example to illustrate these concepts. Now, who wants to guess what a mixed cost would be? Well, a mixed cost will have both the component of a fixed, will have a both fixed component and a variable component. That's why it's called mixed. And most costs under real word, they will take the form of a mixed cost. There's nothing 100% variable, there's nothing 100% fixed. So simply put, if we want to express this algebraically, we can say that the total cost Y, the total cost, the total mixed cost Y equal to the fixed component. So A, representing the fixed cost, or we're going to see this with or the Y intercept or, you know, fixed cost, we're going to see it on the graph, A is fixed cost, plus B is the variable cost, B is the variable cost, and X is the activity. So the total cost equal to the fixed cost plus the variable cost. So your cost consists of a fixed component and a variable component. And this is what it looks like on a graph. For example, here, and this is, this is an illustration of your utility bill.   As long as you have your utility active at the house, you pay $40, regardless, even if you consume zero kilowatt. Then what happened is this, for each kilowatt you consume, we're going to charge you three pennies per kilowatt. Okay, now this is the variable component. Why? Because it's varying per the activity here is the consumption of the kilowatts. So let's assume you, for a particular month, you consumed 2,000 kilowatts, 2,000 kilowatts for a particular month. How do you find your total cost? Well, you have to pay $40. That's A, that's your fixed cost, plus, plus B, your variable cost is 0.03, three pennies. And for that particular month, we said you consumed 2,000 kilowatt. Now we can find, so this is A is the fixed cost and this part here is the variable cost. If we solve this, we find out that your total cost, which is Y, total cost is Y is $100. Now what we can do, we can start to estimate your cost for any level of activity. For example, if we say your activity goes up to 3,000, we can predict your total cost. If your activity goes down to 500 kilowatt, we can predict your total cost. So this is the cost formula, which is your total cost equal to your fixed component, plus your variable component. Your fixed component is the Y intercept, is this point here, is the Y intercept. Now let's take a look at an example to see if we can solve this problem. Ronald Company recorded sales volume of 50,000 units, its total fixed cost are 50,000. If I ask you right now, what is the fixed cost per unit? That's easy. Fixed cost is $50,000 of fixed cost and we produce 50,000 units. We would say the fixed cost per unit is a dollar. The variable cost per unit is 70,000. This is the variable cost and the relevant range is 40 to 60. So we are within the relevant range. Now if I ask you, what is the variable cost per unit? Well, you could compute variable cost per unit. You can take 70,000 divided by 50,000 unit and let's see how much would that be. And we can find, if I take 70,000 dollar divided by 50,000 unit, we know this is equal to $1.40. This is $1.40. And I can tell you, if I ask you right now, what is the total cost per unit? You would say the total cost per unit is $2.40. What would be the total expected cost per unit? If Ronald were to sell rather than 50, sell 60,000 unit. My first question to you is this. What cost per unit goes up or what cost per unit goes down? I hope you can answer this question immediately. The cost per unit should go down. Why? Because you are within the relevant range and now you are selling or you are producing or selling 60,000 unit versus 50. So as you produce more, this $1 should go down. This fixed cost per unit should go down. For example, if I know it's $2.40, I can immediately eliminate $2.40. I can eliminate $2.44 and I'm down to two options. Either it must be C or D. Now, I'm going to have to use my formula to compute my total cost per unit. Well, my fixed component is fixed. It's not going to change. So that's going to be $50,000. That's A in the formula, the fixed cost plus B of X. Well, the variable cost per unit, remember the variable cost per unit is constant. So this $1.40 is constant. So 1.4 times 60,000 unit. So that's going to give me my total cost. Let's do the computation and see how much do we get as total cost. So if we take $1.40, which is the variable cost per unit, which is we computed earlier times 60,000 unit, that's going to give us 84,000 plus the fixed cost of 50,000. That's going to give us total of 134,000. Now 134,000 and we're going to split it or allocated over 60,000 unit. And now, again, as I said, we are ready to do the computation. If we take 134 divided by 60,000, and it's $2.23, $2.22, $2.23. As I told you, it's going to be less than 240, which we predicted this. Therefore, the answer is 223. Now, if you're looking to practice additional exercises in addition to viewing these lectures, you can go to my website, farhatlectures.com. I don't replace your CPA review course. I provide alternative resources. I can help you understand the material better. I can provide you with supplemental resources. This is what I can do. Invest in your career. Invest in yourself. Don't shortchange yourself. The CPA is a lifetime investment. Good luck. Study hard. And of course, stay safe and take a look at my course catalog. Good luck.