Actually, wait. I'm standing in for Randy Vaughn. My name is Paul Vixie. Randy can't be here for family reasons and he knew I was here and that I have kicked Gotti while he was at the microphone before and that I would be okay for substituting for him on this talk. Many of you know Gotti Everon. He's working on downloading presentations because my laptop decided that this projector was evil in some way. So, we've already got a hand up. I wish I'd thought of disabling your microphone, but I didn't. Okay, just for clarification, this guy knows absolutely nothing about DNS, which is why we asked him to come here and fill in for us because if we know nothing and he knows nothing, it's pretty much the same level, okay? I'm not going to go over my whole bio, but what it says in the book is the... I will go over his bio. Paul Vixie.  You don't work today. Paul Vixie, to make a long story short, either... So, what it says in the book is that I hold the record for most cert advisories due to a single author.  Which actually is true if you can't send mail and cron and Wu FTP and all the others. I did stop writing code, started writing paychecks instead, so I now sort of don't wear a suit anymore, but I do just management rather than programming, and you should all be thankful for that. In any case, during the years I wrote a lot of code. I also got to know a lot of DNS operators, so they still call me when they have trouble. I like to track attacks. Sometimes I will ask someone or invite someone to be hosted inside of ISC so that when they are attacked, I'll be in a better position to help track that attack. That's not what happened here, but... On with the actual topic, which Gotti will eventually get slides for, DNS amplification is a little bit like the old Ping Flood, where you spoof the source address of your victim and you send it toward some middle box, some reflector who just sees that as a normal ICMP query or DNS query, whatever it happens to be, and responds to it. Of course, the attractive part of this, there are two attractions to doing a reflector attack when you want to ping bomb somebody. One is that the traffic that is hitting the victim is not coming from the attacker, and so it's a little bit harder to track down. They can't come immediately back to you and say, I see that you're sending me the gigabits' worth of traffic and I see your IP address in the trace route and so I'm going to come after you with guns or lawyers or whatever it is. Instead, the victim has to go through a large number of these middle boxes and see if they can get trace routes done from there, but the trace route won't help because the source address was spoofed at the time it reached there. I do have a USB dock. Yes, you copy, I'll talk. That will work. Hi. So basically what happened is that we have the presentations, but Paul's laptop was supposed to be connected. And, well, that's a story, basically. So right now, Paul is skillfully moving over his mousepad and trying to mount the USB drive, the dongle, okay? And now that he's done that, he's moving the window around very skillfully. What? He's kind of shy, which shows that he probably knows what he's doing. Okay, a little bit about Paul. I don't really have any fewer things to do except for bad jokes and more bad jokes. Okay, the enosmplification attacks. There has been a lot of confusion about the enosmplification attacks and when it comes down to it, nothing is new about the amount of service attacks on the internet, brute force and the amount of service attacks. What does change over time are the techniques used, whether they are indeed brute force or in fact exploiting some sort of vulnerability in whatever space that may be, and how effective they are for how much you spend, which means if you send one packet and you get back 11 to a potential 255, say smurf, that's pretty impressive. And with DNS, DNS attacks basically have been around for a long time. Paul, how's it going? Going well. Going well, okay. And the point is that instead of sending one packet that is very, very difficult to filter and the DNS server would have to receive, whether it is legitimate or not, again, this is UDP based, you can send more. That's the basic of it and when you can send gigabytes of traffic amounting up to even 10 gigabytes at a time, that can be kind of significant. Anybody ever heard of blue security? No? Yeah. Okay, people heard of blue security. That's great. The what? The brute force. The brute force what? The brute force. What? Okay, great. You can go now to Mike. All right, as Gotti was trying to say before his... Very skillfully. Humor got in his way again. The important part about these attacks is not just that they come from someone who is not the attacker and are thus very hard to track, but that the response that are sent by these middle boxes are much bigger than the attack that is launched by the attacker. So, you know, yes, we know that you can assemble a botnet of 10,000 or a million or whatever nodes and send somebody one packet each from each of those places, but that's not artful. So, it's much more artful if you can get a couple of hundred of these things and generate gigabits' worth of traffic toward the victim. And that's what happened in this case. I have two sets of slides. One was generated by Randy and Gotti from the paper that they published on this topic. Another was released by Verisign. The other set was given by Verisign at a Nanog meeting and I know the people at Verisign. So, even though Verisign as a corporation has sued me, or at least they named me as a co-conspirator during the Sitefinder Wars, and I have no love for the corporation as a whole, I have to admit that they have some very smart people working there and some of them are my friends. So, I have his slides that were given at Nanog and there's some pretty juicy graphics on that one. So, what we'll do with the time we'll have left if we ever get the AV situation straightened out is run through both sets of slides quickly. And in the last 20 minutes or so, I'm hoping we'll get to kind of a question and answer about, well, what does it all mean? What can I do about it? What can I do to avoid being affected by it? Probably we will get around to why are we using a laboratory-grade internet for, you know, production traffic because that usually comes up in this type of top talk. Gotti. Yes. What are you doing? Um, wasting time. I think he's reading his email. Um, all right. Something not covered in the slides, so I won't be boring you when I go over it again later, which I won't. DNS had originally come of age in a time when you could only have 512 bytes in a response. Uh, that was irrespective of the headers, the IP headers, UDP headers and whatnot. You could include 512 bytes, and that seemed like a gargantuan lot. Uh, sort of the way that 640K must have seemed like a gargantuan lot to the people who invented the computer that had that as its limitation. Um, eventually all sorts of new things went into DNS and 512 bytes started looking pretty small, especially the crypto stuff that goes with DNS security. So, um, the IETF stood around and rung its hands and, uh, stared off into space for a long time, and I eventually came and made myself less popular. It's sort of an incremental process, uh, making myself less popular by coming in with a working solution that's already implemented and bind and has a, you know, RFC that documents it and so forth, and so they were left with nothing to do, but say, well, okay, well, let's do it that way. And the result was, uh, RFC 2671, so-called EDNS, extended DNS, and it adds a number of interesting protocol features to DNS, but the important one for the purpose of this talk is that it relaxed that 512 byte limit so that when you are sending a response, uh, if the person who sent you the request indicated with the EDNS signaling extensions, if they indicated in their request that they can take a bigger response than the standard 512, then you'll send them a bigger response. Um, and the fallback, if you can't fit your response into the available space, is that the requester gets told that it wouldn't fit, and the requester has to start over with TCP. Now, if you are sort of watching as I do a root name server take, uh, 10, 20,000 queries a second around the clock, uh, you know that, uh, UDP, which is two packets, one request, one response, is a lot cheaper than TCP, which is a minimum of about seven packets. So, we try to avoid overflowing that 512 bytes as often as possible because if we didn't, then the internet would stop working, although I'm not sure how we would tell. Boy, they're having more fun than us. Um, so, um, so what you do- Any experts on NVIDIA drivers here? Oh, God. Alright, we're winging it. It was supposed to be your laptop. No, it was supposed to be your laptop. We were going to use mine because you couldn't get yours working. I agree. Let's hook up a Mac. I've got it right here on a USB dongle. Somebody bring a Mac up here. That's not a Mac. That is a Mac. Okay, so, um, naturally, when you want to attack, if you want your, the, the middle box response, the actual attacked flow to be bigger than the triggering flow that you're sending from your little botnet, you need amplification. And is Mike Schiffman in the room? Mike, stand up? No? Okay. Um, Dan Kaminski in the room. Oh, man, they're, they're, they're, they're with the fun people. Um, okay, so those guys have done some studies on a form of amplification that is just continues to mystify all of us, which is where you send one packet to something that you think is a DNS server and you get anywhere between 20 and 50 responses to it. Uh, so it's some kind of, uh, broadcast amplifier. We don't know exactly what it is. Um, but there are a lot of them. Uh, it's a common enough thing. So if you do what Dan Kaminski does, which is to sort of sweep the IPv4 address base with DNS queries, sometimes you get nothing. Sometimes you get a response from an address you didn't send the query to. Sometimes you get a lot of responses. Um, these guys, the, the ones who launched the attacks that we're going to describe if we ever get this working. Hey, I see a Mac. That's going to work. Okay. Hey, they think they've got it. Um, so the guys that launched this attack...  Woo! Woo! Apparently there is an NVIDIA toolbar.  Okay. Paul, which one do you want first? And thank you, whoever you are. I don't know you. Whoever you are. I'm dissing you after you try to help me. I got my hands full. Yeah, kind of. Can we have a Randy's slides please? Um, which ones are those? The PowerPoint file. Oh, figures. Yeah, pretty much. I need my Linux. Had I made these, they would have been ODP format, just so you know. It's supposed to be, yep, here it is, F5. Here we go! Woo! Can you hear me now? Okay. Um, so the fellows who launched this attack, I assume they're guys, because women are usually more polite about this kind of stuff or sneakier. Um, the, the folks who, who launched this attack did a little bit of research to find out where the, uh, open recursive name servers were. In other words, name servers that were willing to respond to queries that did not come from their lands. So, they either got a hold of Dan Kaminski's dataset, or they just did what everybody else does, which is to add to the cosmic background radiation on the internet and send a packet to every possible address and see what answers. Anyway, they had a, uh, an idea of where they could send this stuff. Um, but they didn't use it. At least in the, the attack that we heard about through Verisign, it did not get used that way. Uh, what they did instead was they let their bots send their DNS traffic to whatever was the, the victim PC's normal name server. And we just, what we discovered by analyzing the attack is that those name servers are willing to bel, believe spoofed traffic that comes from within their own ISPs. Um, it is a mystery to me how the internet works at all. But I guess I've said that before. So, on with Randy Vaughn and Gadi Ivran's slides quickly, and then we'll get on to Verisign's slides, and then we'll get on to what I hope will be the real meat of this, which is Q&A. Okay, you're wondering, what is all that crap? Okay, the thing at the far right, although you can't read it, is TXT. These are queries for text records. Actually, these are responses about text records. And what the rest of it is trying to tell you is that these are frags. That the real message that you're seeing the pieces of is about 8K in length, and that you're seeing 1,500-byte frags because there's some sort of path M2U limitation between the middle box and the victim. One of the ways that this is sometimes mitigated is by turning off the reception of fragments, UDP fragments, but there isn't enough information in the headers of a fragment, the UDP header is only in the first frag, so there are certain things you can't do. You end up eating the bandwidth for everything after, I don't know, it's hard to mitigate this. I guess I'm getting ahead of myself. Since you can't read this, we'll move on. Here's what they look like up close. You can see that Randy is a gentleman. He didn't want the slash 24 that this had come through to be visible, so you can see that the last octets were dot 37 and dot 46. But really, you're just seeing something that came from port 53, which is a name server, in the destination port, in this case 31,000 and some, which was a random address chosen for a client context, and it's saying, okay, it's a DNS truncation event. What a shock because somebody tried to send an 8K UDP mobigram down a channel that didn't have it, and this is only a small part of it, the packet capture utility could get to. More of the same. More of the same. I guess Randy likes Hex more than I do. So, that RFC number is wrong. We revved it. It's 2845 now, not 2671. What's going on here is sort of, oh, God. All right, here we go. There's a mixture of NX domains. There are TXTs. There's a certain number of any queries. Most of the queries were for type any, and what type any means in DNS is somewhat opportunistic. If you send a query for all record types, which is Q type any, to an authority server, it will tell you the truth. It will tell you, it will give you the entire list of all the resource record sets of all types that are present at the name you asked. But if you ask it of some intermediate caching resolving name server, like the ones you list in your resolve.cont file, or get told when you do a DHCP transaction, it does not tell you the truth. It tells you only what it knows. So, if it has no data for that type in its cache, it will tell you that there's no data. So, type any is kind of useless, but these guys found a great use for it. So, they started out by seeding all of the name servers that they wanted to use as their middle boxes by making a query for type TXT so that there would be something in the cache. And they did this with, you know, TCP as their transport, and they did this, you know, with something that they knew would be about 8K worth of text. And then, man, oh man, they're having it more fun than us. I want to be over there. Can we stop? No, I'm sorry. We're not going to stop. And then they launched the real attack, which was a fairly small trickle of stuff that turned into an avalanche at the victim's site. Enough of an avalanche that, chances are that no matter what they did in their firewall, their upstream link would have been saturated, which is the traditional DDoS effect, is yes, I built a name server that was a mile high and took 10 terawatts of power to operate, but then you sort of blew the fuse inside all of my ISPs, and so I didn't receive the traffic I was paying to receive. This was discussed to death on Nanog, and there were all kinds of people who were theorizing about things, and very few of them. I guess it's the usual sort of deal. I'm sure it's true in your user communities also. The people who actually knew the answer did not speak up. So what the amplification looked like is a whole bunch of, maybe 20-byte packets got sent in, and a whole bunch of 8K Mobygrams came out, and when all was said and done, it was a 63-to-1 amplification factor, which, if you think about the battle days of Smurf amplifiers, 63-to-1 is damn good. Estimates are, and we'll get to this in the verisign slides, estimates are that it only takes about a couple hundred bots to generate a couple gig of traffic if you do it this way. Here's where we're starting to talk about the duplicates. Definitely get your hands on Mike Schiffman and Dan Kaminski and make them tell you about their 580,000 estimate. My estimate is different. Actually I spoke with Dan and he promised to get me better results and it means much higher, because this was written before he finalized his research and we never got done with that. Well, then, like I said, get your hands on Dan Kaminski, make him tell you about this 580,000 number, because it's either far too high or far too low, depending on how you look at it. There are some documents that explain what needs to be done, and here's where we get to the tricky part. What needs to be done is not going to be done by the victims, it's not going to be done by the middle boxes, and it's not going to be done by the attackers, and so what needs to be done isn't going to be done, but I'll tell you what it is anyway. The first thing is that these recursive name servers have got to get some ACLs. There's no reason for me if I am on a land somewhere and I'm listed in the resolve.conf of hosts on that land for me to be willing to accept source IP addresses that did not originate on that land. If they did, then chances are they are either never really were there, they're spoofed, or they got there by mistake, and in any case answering those queries would be a mistake. But that's the default, that's what we all do. And the reason that we do it is that those jackasses at ISC made that the default in the bind, so... Who is that at ISC again? I recommend that we all sort of let those ISC weasels know that they should set up the default ACL. What is the name of the guy in charge of the ISC? Is it Randy Vaughn? Yeah, Randy Vaughn. Send mail to Randy Vaughn and tell him that you want the bind default changed. More seriously, we did change it, and in bind 9.4 the default will be that if you get a query from something that isn't on your local land it will be dropped. And we expect that to make the phone ring off the hook with people who say they liked it better the other way because now everything else that comes to a name server from that campus will not work by default. And we expect that the usual thing people will do when it doesn't work is they'll put in an ACL that says allow anything because they don't want to be bothered with having to add their lands one by one. But I am hoping that that's the minority and that eventually we'll see enough upgrades that things will get better. Now bind, of course, is not the only name server under the sun. There are plenty of others. We have gotten in touch with Microsoft, tried to get them to change their default. But ultimately the people who need to make this change have no incentive to do it, right? They were receiving a very small trickle of packets and they were sending a very small trickle of packets, you know, on the order of tens or hundreds of kilobits. They never noticed that they were helping to fire bomb some poor victim somewhere with traffic that they could not mitigate. And so we're essentially going back to the sort of the spammers paradox of trying to get the people who are not being hurt by it, by the fact that there are open relays in that case, to make a configuration change that was going to increase their costs across the board. But that's what you have to do. So I'm hoping that as you go through life and you find name servers, you'll start asking the operators of those name servers, what's the ackle on that? Because perhaps if they learn that they will be annoyed to death and pecked to death by ducks, they'll decide that that's a higher pain threshold than making the config change. The other thing that needs to be done by people who will not do it is the so-called BCP-38. Paul Ferguson wrote this. Paul Ferguson and another guy, Dan Sene. Yeah. It says that if you're an ISP and your customer tries to spoof their source, you should drop that traffic as early as possible, and you should not fling it out into the global internet. Now, I can tell you as it... Oh, okay. Thank you for your applause, but you might hold that for a moment. I think that Sene and Fergie wrote a great document, but there was no incentive for the ISPs to do that. Because, again, the traffic that was being spoofed was only leaving their network. It was not going to be hitting anybody inside their network. So what you're doing, you're going to these people with an economics proposition that is exactly backward. Would you please spend money to keep your competitor from having to spend money? We want you to invest so your competitor can become more profitable. So they hate that, and they laughed us out of the room. So it's a great document, but it has not been widely deployed. I know there are some examples. Somebody told me that Internet was starting to really lock this down, and if so, God love them. But most people don't do this, even though it's a one-line config change on all of the routers made since 2000. And for reference, I'll just tell you, that means that a mom-and-pop ISP who is buying junk off of eBay that they cannot afford support contracts for, and they're buying extra copies of that junk so they can maintain their own spares, is getting hardware that is capable of doing this. That's how long it has been, the current hardware in the state of the art. But you will still find that inside of MCI, which I think is the new name for WorldCom, which is the new name for UUNet, which I don't know exactly how many other networks are in there, this is not the default. They're a telco. They have a lot of knuckle-dragging union technicians that they would have to upgrade in order to get this done. That's the expensive part. Actually, I just learned something last year. I'm actually pretty offended by this, but hey, do you know what's the name of knock engineers? Reboot monkeys. Reboot monkeys, okay. That's not funny, that's kind of offensive. Monkeys? What? Most of the problems are solved by a reboot and somebody calls them, hey, can you reboot machine AXBC? Sure, thanks. And you're lucky if they reboot the right one. So anyway, what we need is for ISPs to stop allowing these spoofed sources to come from inside their networks and then we need name server operators to put in some ACLs. Neither one is going to benefit from their increased costs, but we as victims would benefit from being attacked less often and that's the way the internet is. I'm going to switch to verisign slides, which are glitzier by... Goddy wants to say a few words. Wow, when you say it that way. The interesting thing here, yes, it's a denial of service attack, a distributed denial of service attack, yes, it is very impressive, yes. It has taken down networks, significant networks, but you should really concentrate on what Paul just said. On the one end, to make this attack work, we need to maliciously put some sort of DXT record, a SOAR record in this case, over at some sort of server you hacked into or put in place ahead of schedule. Okay, thanks. And... You Zoom? Control L, thank you very much. I do not use Windows as my usual thing and Hebrew is not my usual keyboard either. Isn't it, everybody? I should have a problem with that. I can type blind in English when I type in Hebrew, I have a ton of typos. Never happens, but I still have the stickers on the thingies. Anyway, that's the one end of it, so basically the attack on you is happening maliciously and not just by some bots pulling out data. And the other part of it is, imagine you live in New York, okay? And the crime that hurts you is on some other block in the city, across the city, okay? Now, the other citizens over there would kind of... How is the mayor supposed to explain to these citizens that they see a lot more cops in their neighborhood and they get imposed with a lot of regulations and rules about their movements when their neighborhood is kind of free and shiny and happy, ooh, shiny and all that, when the actual problem is across the city, somewhere else that you don't even see. So that's basically the point is the internet has become a huge... What do people like saying? Global Village? Yes? What? Who? Oh, that, right. I'm a DEF CON. If somebody is going to break in, I at least want to see it.  If somebody is going to break in, you're not going to see. That's why this is an expendable laptop. Looks to me like you've been broken into by somebody in Redmond, Washington. Woo! Okay, you saw it. So what I'm basically trying to say is that why should they spend money on you? Why should somebody in China spend money on somebody in the United States? Why should anybody be nice network citizens to one another when their attack does not affect them? So basically what happens is one day their attack does affect them, they go down, and then in a nice Dorinian way, everybody gets patched, but it takes a long, long time. So that's pretty much it. Everybody knows your password now. It's blah, blah, blah, blah, blah, blah, blah. How did you know that? Actually no, it's one, two, three, four, five. That's amazing! That's the exact same combination of my luggage. Never mind. Okay, so I told you that the Verisign people spent a little more time on the graphics, and this kind of shows a little bit more of what's going on except that even the Verisign, they don't know how to spell attacker. That's interesting. I hadn't noticed that until just now. Yeah, this is a PDF file. I did not alter their slides to make them look like they don't know how to spell. Okay, so there's this big TXT record. They've got an army of 300 to 500,000, or 30 to 500,000, I don't know. That seems like that was written for the suits. I know there weren't 500,000, but I think that's what it took and you get this... In this case, the DNS server that had the TXT record, the authority server, had itself been captured, right? So this was somebody's zone somewhere that got broken into, and the attacker put an 8K text record in there for the purpose of then seeding all of the middle box name servers so that they could then amplify the attack. And this is sort of part of the tried-and-true philosophy of don't put this... Don't buy that with your own credit card. You don't want the police coming to your door. You want them to go into somebody else's door. And the Verisign folks were very personable, and they went and located the name server in question and got a copy of the zone, and I'll get to that later. So here's a 20 megabyte... megabit per second spike. But this is only a 1% sample, so they were estimating that it was 100 times bigger. But they know that they're... They know how much... how much trans that they buy and how much their ISPs were throwing away at the time, and so they were able to estimate that the total size of the attack was 5 gig. This is pretty much the same attack, or at least the same attackers that Gotti and Randy were tracking. But they were attacking different TLD name servers at different times. And we, as far as I know, there's no publicity around any kind of arrests in these cases. So the folks that are out there doing this... We know who they are. Yes, but we know that they have not been arrested. No, should they? Come on, are we really going to go and arrest them? If I were in the business, yes. If I were in the business? Well, we'll be in a lot of trouble then. Okay, so there's the name... the zone that got broken into is in South Africa. And this one was a 4K answer and unlike the 8K Mobygram that Randy and Gotti were tracking, but it was a 60-byte query, so you see the amplification factor, you see how many reflecting middle boxes there were.  And depending on what games they play, you can tell whether they were attempting to randomize it, whether they succeeded at randomizing it, or whether they were not able to set it. Some APIs don't allow unprivileged applications to set the IP TTL. And so if you get enough of this data, and we've got Dave Dagan here, I see who has studied TTL in detail. So if there's Q&A on this, then we've got the expert. Anyway, by looking at this sample, they were able to tell that the traffic, the actual flow that hit the Verisign name server was itself not spoofed. That actually came from real places that were setting the TTL in normal ways. And proving that it isn't spoofed is one of those expert things you can ask Dagan. Sequential IP addresses? Yes, so in other words, they found these name servers with a sequential scan, similar to what Mr. Kaminsky does. And Verisign and a lot of other people went and looked at the sources of these and said, well, gee, they were sending me these big Mobygrams. Does that mean they're open recursive name servers? Can I do a dig against them for data that is not local to them? And sure enough, yes. And then we started to notice the true scope of the problem. Okay. Yeah, yeah, yeah. We don't care about this. Right. There's this estimate that the attackers only had to spend 80 megabit to get the 5 gigabit response. And that 80 megabit was spread across a bot army of somewhere between 30,000 and these people estimated 500,000. But 80 megabit, you know, host can generate 80 megabit these days. And it would be very difficult to find out which host had suddenly shown an 80 megabit spike because two or three hops away from that colo it would be a bunch of very small flows headed to, you know, 100,000 open recursive name servers or 580,000 if you ask Dan. And I do hope you ask Dan. So the domain in South Africa had two authoritative servers but only one had been compromised. In other words, they broke in and changed something that should be a slave name server to be a master name server and then edited the zone in place. So there was a chance that when the middle boxes went to go get this data so they could seed the cache that they would talk to the wrong name server and potentially not be able to cache it. But even that didn't really stop this from being a very successful attack. Well, okay, it's a verisign slides on the board here and even though they named me as a co-conspirator during the Sitefinder Wars I don't want them to be unfairly characterized here. I don't know if this was successful in costing them any money but it certainly got their attention. Okay, so this talks about the fragments. You can get copies of these slides at the URL that I'll tell you at the end. So if you want to study this in more detail just basically if you are trying to send a UDP datagram bigger than your Ethernet M2U you'll have to break it up into chunks and those chunks look very odd at the receiving end because DNS is normally not large enough to need to be chunked. They were measuring 25 minutes. Again, this is only one of a number of attacks that happened across about a two month period so Randy and Gotti had different spans of time. In some cases these things go on for days because there's really no incentive to stop it. I mean it's not costing you anything. There's no chance you're going to get caught. Hey, he spelled attack right on this slide. Yeah, see the near vertical start is part of what you can sort of tell. This did not ramp up over a period of five minutes. There was a lot of synchronization and getting all the different attack flows to get started at the same time. Okay. Yeah, this was mitigation is always what people want to talk about which I worry about sometimes. How can we live with this instead of how can we avoid having to live with this are the two different ways of approaching that question. So there was this thing. Okay Dan, you've got 580,000 name servers on this list. What if all the authority name servers on the Internet were to subscribe to a black hole list that was seeded from your list and they just stopped answering any queries from somebody who was known to be open and recursive. Well, I think the collateral damage would be too high. I don't see Amazon.com deciding that they don't want to get any queries from known to be open servers. It costs them a lot of credit card transactions among other things. So dropping fragments toward the victim turns out to be pretty effective but as most of you know... Dan Kaminsky on the line here, so hold on a minute. Dan, can you come here to the lecture about DNS? We kind of want to ask you a question. Yeah, that's a good idea. Let's get Dan in here. Oh, damn. Oh, you're at Caesar's for a second.  Okay. So when are you getting there? Too late for our purposes. In other words, get here. Anyway, these are all ineffective because if you decide you're going to drop fragments then they will retune their attack to use the maximum size packet they can send that doesn't require fragments. So all of the things that you could do to mitigate this will be as costly or more costly than just living with it. So at the moment, we all sort of live with it but it's not that different from Smurf amplifiers or other ping of death type scenarios. Anybody can DDoS anybody on any given day on the internet and you just hope you haven't pissed anybody off who's in a bad mood. Well, about that issue of... basically some people said that limiting... I said it originally too and some people including me said originally that... sorry for repeating myself. If you limit the packet size to 512 bytes, you limit the amplification. Now theoretically and practically that's true but before the but if you get to limit one bot sending out packets for one basically set of fragments to have 7 times 7 amplification instead of say 2 times 70 that's pretty impressive, right? It would work but you would at the same time be limiting your DNS server abilities be limiting the ability to use IP version 6 and a lot of other such expansions to DNS and it wouldn't matter and I'll tell you why. This attack is built in a way much like in any security system in any system in any way at any stage of the links of how this attack works from how many bots are sending the packets to how many open recursive servers you are using or connecting to and so on. You can use more bots, you can send more packets you can connect to more open name servers and cause the amplification to be just as large if not larger. You basically control how big this is going to be until the point where you reach saturation. For example...  Put the mic down. Here's another long list of things that could be done but would hurt a lot and give very little benefit. None of these will make the attack unattractive so these are just speaking points to the suits. You've got to really study these slides and hear the guy who made them tell you what they all mean. Let's move on to the Q&A because we have about 10 minutes. I think we're going to do that. This is the slide I wanted to stop on here. We have microphones, please use them. Someone? The URL where these slides can be had is public.orci.net and it's a Drupal site and I apologize for that and you'll have to click around a little bit. It's part of a DNS operations forum or workshop that was done so it's your two or three clicks from it. It's public.orci.net The study by Randy and me can be found online. Just do DNS amplification attacks in Google and you'll find it. First question. Are you guys aware of any utilities that have been posted at places like PacketStorm for instance? No. This isn't like nobody's put something together and published it yet? Work for 30 minutes in Python and you'll have it. Nothing public. I've seen the kit but I don't think it's online anywhere. Gatti mentioned earlier that you'd need to for the text record attack go and put maliciously something into text records. I've actually done a little bit of research on data mining text records that are already out there and there's quite a few that are pretty large. I've found ASCII armored encryption keys I've found large shell scripts and even one had a very large chunk of the book of Revelation which would be great for a DITOS attack for Horsemen of the Apocalypse clogging up your series of tubes and that it'd be great. You might not necessarily need to maliciously put something out there just find something and use it. Yes. That is absolutely true. You don't need to capture anybody's name server. You can use normal traffic. The response that you'll get from www.microsoft.com is a lot. As soon as we get DNS security really underway and we have these big crypto blobs attached to every RR set on the internet then once again the ease with which you can generate a gigantic response coming out of somebody else's name server will just keep on coming. Absolutely. One more thing about this is that when you use something that's already out there public servers with huge records really limited because you can use quite a bit of servers in another link in the chain instead of just adding bots or just adding name servers but in this particular case the guy put a malicious record of his own in one name server and it took quite a bit of time to get it down but he had enough bots and enough name servers that were open to generate the attack sites he needed so he didn't really need more records elsewhere. Yes, needless to say had I crafted this attack it would have been a lot smoother. You sound like a virus writer. Actually, I sound like an anti-virus guy. I'm sorry. My mistake. Question to Paul. What is the normal behavior for the properly configured public name server when it receives the query, the request for the an object in the zone it's not a 3084 and from the land that it's not supposed to answer recursive queries for. Is it still responding something or is it just dropping this request and keeping silence? I don't think you meant to but you asked three different questions. So, if someone asks you a question and they're not in your ACL then you could I suppose answer with refused there's an opcode out there called refused but given the purpose of an ACL and that ACLs were not defined by the DNS protocol and this behavior is therefore not not defined I think that the spirit of an ACL is that if you get a question from somebody who shouldn't have sent it to you shouldn't answer it.  That's what I was referring to. Still a lot of data. It's still a lot of data. It's a big chunk of muck that you can't get any value from and should never have been sent but the document was unclear and so the code was unclear and that's just what it sort of does. One way you can turn that off is to follow my personal recommended practice which is don't run recursion and authority in the same name server instance and on your authoritative name server don't give it any root hints if it doesn't have that data it won't send it. Okay, so the right for the DNS administrators out there the right behavior is to send a refuse. Just drop it I would say drop it because I'm aware of virtually all DNS requester source code bases out there even the Microsoft one I've talked to the developers and so forth no one process is refused so you may as well not send it because it's not going to do them any good even if it was sent legitimately. Thank you. We have three minutes but we have three questions. Okay. Is there or couldn't there be some sort of legal liability associated with running an open DNS server open mail relay allowing originating spoof packets etc. Could there be a legal something whatever about running an open relay mail server? What I'm saying is you know if you're running if you've got a DNS server and it's connected to the internet and it's allowing recursive queries from anywhere that's a legitimate use for DNS we don't have time for this so he is not a lawyer I am not a lawyer there are lawyers in the room they're not going to answer this because they don't want to be your lawyer without getting paid but what I believe is that if you can show that they have been hurting you here's the pcap here's your cease and desist letter then if they don't cease and desist then there might be some civil liability in no case criminal liability that I can foresee I didn't even mean criminal I just meant like tort law is there any reason other than legacy for the text field and if not can't we just get rid of it i.e. block it with a firewall or just remove it from the code? TXT is not the problem as I said you can use DNS security records you can use just normal A record sets that you would get back from any server but to the extent that it is a problem it's one we will have to live with because TXT is a catch-all it is for example being used by the SPF people to contain all of the mail server sort of ACLs that they want to do about what mail servers are able to send mail from a given domain name so we're stuck with it but it's not the problem so it's not bad that we're stuck with it so from everything I've heard so far the possible solution here is ACLs but that's not going to scale when you're using valid SPF, DNS, etc when you're not pre-posting or you're not doing a recursive DNS if we actually implement ACLs as you're suggesting then that's not going to scale because as you said they're going to change the attack as such don't you think the problem is actually the fact that you can spoof the packet in the first place so wouldn't you say that the problem is in UDP and not DNS? Certainly in this laboratory grade toy for production use that's an excellent question and with that I'll turn it over to 10 minute break and then Gotti will be back here by himself talking about other DNS related stuff thank you


This is Wayland Chow. Welcome to Negligence Torts and Professional Liability, Module 3B, Part C. In this part, we will look at the special rules that apply to determine the duty of care with regard to professional statements. Now I want to talk about the special way that the courts have dealt with imposing a duty of care on statements made by professionals. So quite often professionals such as financial advisors, bankers, stockbrokers, lawyers, accountants, engineers, we all make mistakes every now and then. And sometimes we make inaccurate statements and those statements are relied on the people who hear or read those statements. And those people can be most obviously clients but they can also be non-clients. Now the concern the courts have with imposing liability for statements made by professionals is that negligent statements can cause, quote, liability in an indeterminate amount for an indeterminate time to an indeterminate class. So it could be an indeterminate amount because if I say something, let's say as a lawyer and then someone out there who has read what I've said, they might rely on it in entering into a multi-million dollar transaction. And then the information I gave turns out to be bad and they sue me for tens or hundreds of millions of dollars. So the amount can be indeterminate. And also it's an indeterminate time because when you make a statement and it's recorded in some way or another if it's written, it's out there floating, especially with the internet. The information could be floating out there for an indefinite period of time. And also it could be an indeterminate class meaning that you don't know exactly who or how many people will hear or read your statement. Another consideration is that negligent statements are more likely to cause pure economic loss instead of property damage or personal injury. So with property damage or personal injury, it's much more easier to ascertain or it's much more defined while economic loss is inherently more difficult to ascertain. So what the courts have done with the duty of care for professional statements is that they have created some special rules for determining duty of care where a negligent statement has caused pure economic loss. One of the leading cases here is a Supreme Court of Canada decision in Hercules Management and Ernst & Young. So Ernst & Young was an accounting firm which prepared the audit financial statements for a public company. The purpose of the statements were to allow shareholders to supervise the management of the company. The plaintiff as a shareholder of the company relied on these financial statements in deciding to continue his investment in the company. The company however later collapsed and it turned out that these financial statements contained some inaccurate information. The plaintiff sued E&Y, the accounting firm. Some of the questions considered by the court where the first was was it reasonably foreseeable that the plaintiff would suffer a loss by relying on the financial statements? And the second question was was there proximity between E&Y and the plaintiff in determining reasonable foreseeability? The Supreme Court gave some very specific guidance on what to look for to determine whether or not there was reasonable foreseeability. So it said that it's more likely to be reasonably foreseeable if the defendant claims some kind of special knowledge. The statement was communicated on a serious occasion. The statement was made in response to a specific inquiry. The defendant received some kind of financial benefit for making the statement. The statement was a statement of fact or an opinion or prediction based on fact rather than a pure opinion. And it's less likely to be reasonably foreseeable if the statement was accompanied by some kind of legal disclaimer. The Supreme Court here held that it was reasonably foreseeable that the plaintiff would rely on the defendant's statements. The second question in determining duty of care that the court dealt with was determining whether or not there was sufficient proximity between the plaintiff being Hercules management and the accounting firm Ernst & Young. The court pointed out two particular requirements needed for proximity in these situations. The first was the defendant knew that the plaintiff either individually or as a member of a defined group might rely upon the statement. And second requirement, the plaintiff relied on the statement for its intended purpose. So what the court found in this case was that the plaintiff used the statements as investment advice instead of for the intended purpose of management of the company. So it failed to meet the second requirement that it set out for proximity. So therefore the conclusion was there was no proximity in this case and thus no duty of care owed by the accounting firm to the plaintiff. Since the court in this case denied a duty of care on the basis of a lack of proximity, it did not have to get into considering the policy considerations of imposing a duty of care. But however, let's consider it ourselves. Can you think of some policy considerations in deciding whether or not to impose a duty of care on the auditors in this Hercules case? So please pause this video at this point in time to consider this question. Some examples that I can think of and you might think of others of policy considerations that a court might look at is that if we impose a duty of care on the accounting firm here, fewer accounting firms in the future may be willing to perform audits of public companies. Also another consequence could be that audit fees charged by accounting firms to public companies will increase significantly because these accounting firms will have to take into account the fact that they might be sued by investors or anyone who reads the financial statements. Another consequence, another policy consideration is that generally it will be more expensive and difficult to prepare financial statements of public companies. Also accounting firms may be motivated to be more careful and thorough in performing audits if accounting firms that know that they might be sued for any mistake that they make, they will be much more motivated to be very careful in performing audits. So that would be an argument in favor of imposing a duty of care.


Manuel, the governor of Lagos State Babajidesa, will learn Saturday we opened the Aqqogwa Bridge in the state over 15 months after a fire outbreak at the market and its environs. Red users and motorists around the area were thrown into panic on the 23rd of March when an early morning fire broke out at the Aqqogwa market, destroying several wooden shops. Vehicles parked under the bridge were also raised by the inferno which enveloped a large section of the bridge. Following the fire outbreak, the Lagos State government shot the Aqqogwa Bridge with alternative routes announced for diverting traffic and for the safety of motorists. A lot of people have wanted this to happen earlier and now, because of the extent of work that has to be done in the bridge and also the extent of the destruction that happened on the bridge, we cannot take the risk to open it earlier before now. Actually, it is a great delight that we have done a comprehensive test when the contractor from Federal Ministry of Works believed that this end, this portion of the Aqqogwa of the bridge will have a fix for motorists. So, you get notified about fresh news updates.


The sun sets and is silent, there is no one that's patient, as hearts break for this moment, the one who sees Ali aches. Named Haidar, by his mother killed 35 at Badr and raised the gate of Khaybar when finding her rib, he shakes. He sits curled up and crying. A lion of God wailing and every cry is asking, how can Fatima's rib break? A tragedy he has found. He sheds tears that shake the ground. Every time they hear a sound, the sound of her rib breaking. Her rib reaches his finger, the thought of it is torture. He cannot bear to touch her the door he's remembering, between the door and the wall, the one from heaven would fall and when for help she would call, for Ali she'd be screaming. At Khaybar Ali would stand, the moon upon earth would land, he raised the gate with his hand but he couldn't touch her rib. The one who never felt fear is tortured by every tear he wishes he wasn't here and was still fighting Marhad, give Ali any battle, any pain, any trial, just no rib and no nail and no Muhsin's empty crib.


Hey guys, it's cleaning day today. We're gonna clean the black, the surface, we're gonna clean the pistons and we're gonna clean the valves. So mainly we're preparing the black and the valves for the heads, even though I still don't have them. Anyways, what I got is this, this, this, a bunch of these, this, and this.  That's a big no-no. This is aluminum, it's easily scratchable. This is only, notice the black is slightly tilted. So whatever dirt comes off of it, it's gonna fall down right on the floor. Okay, just to get this dirt off, this buildup here, it's pretty good for me. Anywhere else? No, we're good. Okay, nevermind, a little bit here. Just the big stuff. Now I'm gonna use PB Blaster. Wet the surface. Now notice how this piston is out, just make sure, you know, it's out all the way. So it's easily accessible. It should be fine.  This may scratch the surface. I won't be pushing too hard. So just a light, very lightly work the surface. Now, so you saw me using the big brush on the drill, only on the piston, you know, slowly, barely pushing it, clean off the piston, actually came out. Well, so-so, you know, I'm not gonna get into it too much, just wanted to get rid of these big chunks. It's never gonna be perfect. I don't want to spend too much time on it. Anyways, and use the very super soft brush on the Dremel. This actually worked perfectly for the actual surface. Again, barely pressing on it, using PB blaster, whatever lubricant you've got. I'm actually gonna have to clean the other side with just plain oil because I run out. Anyways, this is fine. It's still gonna get some cleaning right before the head is, or the gasket is applied. Right now, we're gonna check for straightness or level, whatever you want to call it. So straight edge, this is 1500. Perfect. Trying to stick it underneath the straight edge in several areas. As you can see, it is not going in. It wants to go underneath here, but it's dragging, probably because there's maybe some dirt over here. Like, I may have to work on it a little bit in this area. Yeah, I can actually feel a bump over here. Same story over here on this area. So yeah, I mean, but it's barely like in this. Okay, see it is going underneath here. Let's check 2000. Also going in, but dragging. So there could be just a bump. Oh yeah, oh yeah, never mind. I was actually, okay, I bet you if I move it over a little bit.  Let's go back to the 1500. Yeah, yeah, there is a, this is actually, this small area here is actually higher than the surface, mating surface. So yeah, so just putting it in the wrong area. But I'm pretty sure this block is good. I did check it when it was still dirty, because if it was, if it would be bad, then this would be all due to overheating most of the time. But if the engine doesn't overheat, never overheats, then your block will most likely be fine. All right, that's how you check it for straightness. I'm gonna quickly, well not quickly, it is kind of time-consuming. Do the other side. Then we're gonna turn our attention to the valves. Next day, guys, I think my battery went dead. Now we're gonna work on the valves. Oddly enough, the intake valves, some of these, this one looked just like this one. You can see a lot of carbon buildup on this guy. These are usually clean on the faces, the intake valves. Their faces are clean. This one already cleaned. And this one looked exactly like that one that I just showed you. These two I did not touch. And you can see they are much better. These are the exhaust. I did clean one of them. This one, no, not this one. This one I cleaned. Usually these look terrible, but in this case it's the other way around.  I'm gonna take each there, finish it, come back, put in the same spot and continue. So what I'm gonna do, I'm just gonna take the worst one, which is this one, the intake one. Otherwise, I'm not wearing any gloves. You need to hold on to this guy like to your nuts. Now, the area that you need to worry about is from here all the way to the top. Usually, you know, guys tape this up so in case they don't nick it or whatnot, I don't. I just, you know, I'm just really careful about this whole process. And I don't use gloves. I want to have maximum grip possible. And that's that's pretty much it. If you drop this, that's it. If this comes flying off the wire wheel, you're gonna most likely need a new one. All right, let's get to it. Now, I did not go all the way this from here to, I don't know, somewhere here, whatever. The valve drives on it on its seat, right? And it's whatever you call it, the valve seal. So like I said before, this area here, see, you see, I almost went up there. You can still see the dirt line here. This is smooth. I'm gonna leave this alone.  Now, this is a clean valve. This, I don't know if I'm gonna even bother to do the intake valves, maybe a little bit. I'm talking about lapping, but for sure I'm doing the exhaust valves. All right, I'm gonna do all these. I'm not gonna record it because I got a limited area to set the camera there. So I'll see you in a few. Guys, valves are done. Do I forget one? Man, I forgot one. Okay. Almost all are done. Anyways, so remember how one of these was all black or two on the passenger side head? The driver's side actually had two pretty black buildup over here and one was pretty wet, which pretty much means your valve seals are leaking. That usually happens from old age sitting, usually sitting. If you're not using the car, it sits a lot. You know, the valve seals, they get dry and tend to leak later on. And you can always tell after sitting for a few days, you start your car up and it smokes for the very first minute or two until the engine warms up. You get, you know, oil from your tailpipe. That's usually your valve seals. All right, since I'm pretty much done getting ready for lapping, I'm gonna designate an area, this area for the valve lapping and I'm gonna run you through the process. Guys, check this out. Heating up the headers. This is, well, it's clean, good enough. But I thought I'd mention this. Look at this. This is, we had a leak right over here, from here to here. So what I do in this case, take a file like this, break off the big chunks, and then take a black, sanding block, whatever, 400, 600, whatever you got and just go to town. And voila, you're really looking to clean this area here. That's it. This is done.  You want to ensure the gasket sits nicely on the whole surface and you see how this was a high spot. So let's say, you know, let's say I would leave this alone and leave this a high spot. It would not seal properly in this area. You know, it is a potential future failure. So you want to block the whole, the whole surface. All right. I also cleaned up the radiator. All right, one more thing. Remember that code, what was it? P0028? I think it was 28 for the driver's side variable intake thingy. So I did order one from Subaruparts.com for a hundred bucks, this guy here. Now, so I just did remove it from the body over here, 110 bolt right here. And once you get this going, and of course, obviously a new gasket, this was leaking, by the way, can really tell, okay, from here. Anyways, you're going to find this little mesh filter, which sits right in here. Okay. Clean this out, guys. Grab it, remove it, be careful. I used a small, tiny, small screwdriver. Took this out. If it doesn't want to come out, spin this, pushing these little tabs. Don't be sticking your screwdriver in where the mesh filter is. Okay, you don't want to mess this up. Anyways, take it out. Spray a brake cleaner on the outside of it, and you're done. Make sure it's, you can see through it. Okay, you should be able to see through it. Anyways, and then I'm going to obviously clean this up. Now this is just empty passages at this point. Make sure this guy is clean and ready for the new solenoid. Guys, update. So I've been cleaning stuff. Found out I'm going to wait a while for the gasket set. So I went and cleaned up this front of the engine here, and started to tighten up the belt, timing belt tensioner, and this bolt here, this thread, that's where it goes. This just gave up. Look at this. See the thread in there? I just did a video on helicoils, and I had trouble, well, you know, how the intake attaches to the heads, you know, the intake manifold. Two of those were stripped, I believe it was on the left side, and I had to use helicoils. Luckily for me, I already have this size that I need. So I'm going to have to fix that, drill this out. This is a through and through hole. Then make new thread, install the helicoil, and tighten it up. Perfect. Last time, it didn't even get to 18.


What's going on, everyone? Sam here with late in sports cards, ribbon 23, Bowman baseball, Jumbo eight box, case break number 124, pick your team style. Read off a list of our names in our teams. Got Adam B with the Nats, M-O-D Mariners, Andrew B Angels, Anton H Metz, Bradley S. Reds, Christopher O. Orioles, Dan M. Dodgers, thank you, Dan Edward E. Yankees, thank you, Edward. Hansen L with the Blue Jays, Jeffrey H. Red Sox, Astros, Royals, Giants, Cardinals and D-Backs, Jeffrey, thank you as always. John C. Rockies, Keith G. Padres, Kirk L. Cubs, thank you, Kirk, Matthew B. Pirates, Michael C. Reyes, Michael S. Rangers, Miles H with the Braves, White Sox, Guardians, Tigers, Marlins, Twins, Peter M. Phillies, U-G-L with the Brewers and Zack D. with the Athletics. Thank you all again. Do appreciate it, Adam. I meant to say thank you as well for taking the Nats. Good luck, everybody. Pull something huge, man. You wanna see a Superfractor in here, Sean? Yeah. I think that'd be pretty sweet if you ask me. Yeah. I think that'd be pretty sweet if you ask me. Again, sold out on this break. Sold out on the next one. We got a couple more baseball breaks. You gotta get moving as well. Some top scrum sapphire, full case of that. We've got a full case of nothing else today, I think, baseball. I think that's it. Everything else is Mixer. It's got a five-year baseball, five-year, five-box Mixer of Billman. And Drippie's in here. Dripp is calling us over there. I don't know. Something's wrong with that guy. There's Blake and Bace. The people want to hear him in there. Okay, not you. Yeah. All right, let's get done with it. I'll just, I can just hold it right at the top of you guys. Simon Hwan. Everybody's having a good Tuesday here. Almost to the middle of the week. Almost there. Simeon Woods Richardson to 125. He'll be in series two. First auto and manual Bonilla. Base auto for the Blue Jays. There you go. Blue Jays. Paper base. Pedro Carlos Jorge. Cam Collier first. Jay Savina, How You Lee, and Drone. There's a Zach Veen sights on September, Elijah. Paper base, Dan Sussac. Roman Anthony as well for the Red Sox. There's some base, paper base. Frias. See a big auto in this one. See a big auto in this one. Gunner Henderson Ruffin. There's an Oscar Colas. He'll have his rookie in series two as well. To 199 for the White Sox. Pretty loaded checklist in series two if you guys haven't checked it out yet. Jay's Bowen first, 250 purple base. Pirates. Very loaded checklist tomorrow. Yoshida from the Red Sox got his. Kodaisanya, Volpe, Jordan Walker. The bug on me. Yeah, George Valera. Nice one there. Kind of 30 sights on September odd. I think this is the first one I've pulled of these. There you go. Guardians. Nice one there on the insert auto. Nolan Gorman, Jackson Holiday, Jackson Shuria. Got some base there. Some base here as well. My Chendrick Martinez. Those bugs, I'm not happy about this bug. We are doing, we'll be doing NBA later in the day. Dodge. Yes it is. Hartford Whaler's shirt. Yes sir, Timmy. Yes sir. Got my Hartford yard goats hat on today too. That's going to be Brian Acunha, Lunar Glow, and Luis Garcia on the lava to 399. Got my Hartford yard goats. This is the Hartford bouncing pickles. Dodge, there's a break. Yeah, thank you. 20 to go on Sapphire? Nice, thank you. Thank you guys. 20 to go on Sapphire now everybody. Tyler Soderstrom. We have, oh yeah we have a second auto. Yeah. Yeah I grew up in Connecticut. There's Drew Jones first. Appreciate that. I grew up in Connecticut. I wasn't like, Whaler's had already been gone by the time I was born unfortunately. That's why to this day I'm not, do not like the Carolina Hurricanes. There's Brelin Taverra, base auto for the Orioles. Grats on that Baltimore. Balmo. This bug dude, this mosquito. It's like having you around. Cool young. All right, that'll do it for box numero uno of Bowman. Yeah, bunch of spots coming in. Thank you there, Joseph. Thank you Austin taking some fast break spots. David taking two in Sapphire. Jonathan taking one. Steve, what's up dude? Jonathan taking one in hour. My friend did Steve on the fourth. Oh yeah? Steve's a big fortnight guy. Yeah dude that was great. I'm so close to being done with the battle pass and the season ends on Friday.   Just try to get as many as I possibly can. I know I probably will. You're off right? Yeah. Yeah that'll work out well. Actually Forrest wants to play a three less that night because he's like two games off two. I know, let's do it. Yeah, let's do it. Nice, Roman Anthony. True Blue going to the Red Sox. Grats on that Boston. Very nice. Go Red Sox. Very nice. 85 of 150. First pack Mojo right there. Got Juan Alonzo and Myrochendrick Martinez. The 299. There you go Dodgers. One of the last teams taken. Nice. Myrochendrick. Last spot Mojo is big.  You think so? I think so. I think so too. I mean, I don't know why but. See that's Sean saying that too. Sean's believing in it in last spot Mojo. Tonight's that night. There's something in the air tonight. Think it's that fly. Leandro Arias the 299. I think we might play some later tonight. Let's go Steve. Let's go. I'm gonna be all systems go on Thursday for sure. Down, down. There's Alex Ramirez, Lunar Glow. I bought the Mickey Mouse shirt with the hair. Oh yeah? And I bought this pretty. Oh my God. Yeah, I bought the one that's like lean with it. Right. Yeah. They got a lot of dances. Dude, there was one night I was playing with Dylan and Joe. Dylan, Joe and Matt. And the entire item shop was basically just dancing. Yeah, still right now. Is it? Yeah. Yeah, the prism photo at 70th spot for a random team sells out super quickly. Yeah. That was sold out like when I woke up this morning. Basically, I was checking spots in the morning. And yeah, that one goes quick for sure. There's Drew Jones first as well. Nice one, the. Again guys, we've got down to 20 to go in Sapphire. Thank you all very much. Do appreciate that. Followed by the mixer of luminaries and Cosmic Chrome coming up after. Xavier Isaac, Simon Juan. There's Damon Keith for the Dodgers. Nice one there. Refractor to 4.99 grats on that Dodgers. Again, one of the last teams taken. Got them on pretty good pricing there as well. There's a Jacob Berry first. Burgoyah, Sony Blanco. Brady, how old are you? I don't think so. 39, 49 going on three. Yeah, that too. That's the only one that's lead to a meeting. I don't know, man. And you're grown. I was telling Donnie about that. You're your hands. I'm not in the lead on a meeting. That's just that's a whole different one. Shea Lingliers to 250 on the purple paper. There's Jorge Ruiz for the Angels base first. We're hiring him, should have been like a ton too. Should have been what? Should have been possibly rubber-manded. Now you let that get through the cracks. One man in her hands sorting baseball cards. Come on, man. Come over. I am too bad at it. You know what's the way to fall off? People are going to tighten up around here. Oh, you need to have Donnie show you his impression of you doing a random style break. Oh, my God. It's so funny. I can only imagine I can't stand him. Oh, man. Do you have one of those tonight as well? And it's a Star Wars one. No, I did not. That's actually pretty easy. My thing is, well, some of the spelling is what it is. That's how I don't care. Right. But this box pad. Oh, it's so sensitive, dude. Just accidentally touch it. Jeff. Let's go, Jeff. Taking some spots in our through the years. Make sure it's down to only eight spots to go. Let's go, Jeff. Let's go, Jeff. So again, guys, here's 20 to go on Sapphire. Full case 10 box break, random team style. Again, 105 a spot. We'll get that rocking and rolling just a bit. We've also got 10 box Tuesday tonight as well. Excited for some 10 bucks. Something's coming out of there for sure. We can see a red J-Rug coming out of 2019. Something's coming, dude. Tell me. Feel it. Oh, yeah. Some good schticks to be had today, too. I can do without that. Shorted Lawler atomic to 150. Jesus. There's Jefferson Rojas to 399. What do you think about the heat coming back? I know. I know. Let's go. I know. They look good. They look... It's going to be a good series, man. It's going to be a good series. Ooh, nice. Jackson Holiday. On the Bowman Scouts, top 100 to 99. There you go. Orioles. That's on that. Baltimore. Gabriel Moreno with Axl Sanchez. Hope everybody's having a good day here as well. Appreciate you all for hanging out and grabbing some group break spots. Going to be fun. It's always entertaining when Sean and I... Anything can happen Tuesdays. Got Drippie in the room next to us, too. Drippie. Drippie will be live tomorrow night over on Leighton 2. There's Daniel Susack. That goes live tomorrow. That goes live tomorrow. Got Matt and Forrest in the morning. Me and Kyle at night got a Quadstream. Quadstream Wednesdays. That's what we're going to start calling it. Quadstream Wednesdays. That means on the normal Wednesdays, we're going to have Me, Hugh, Donnie, and Kyle all in the same building. Oh, man. That's a little scary. Yeah, that's a little... That's a little scary. William Lugo. Nice. White Speckler 299. First auto for the Mets. That's New York. I think that was Anton each. Let's go Anton. There you go, buddy. Zack Neto. Yeah, guys. We've got Eli Delacruz up in the majors now. Long-awaited debut from Eli. I think the Reds kind of couldn't wait too much longer. Reds are looking good too, man. They're getting some big-time production out of their... Their guys are calling up with McLean and Steer. Now, Ellie coming up as well. It's going to be... They're going to be a fun, exciting young team to watch, for sure. They got some more guys, Spencer Jones first down in the system as well. So, like I said, it'll be a good time to be a Reds fan at this point, I think. Damon Keith again. This time, just a base auto. Nice one. I'm just doing well for one of the last teams taking off the board today. Thank you all again, Jefferson Rojas. We've got Kyle Harrison first as well. One of the top-pitching prospects in the entire Major League baseball. That's going to be a pink paper. Kate Cavalli rookie to 175. There you go, Nats. Congrats, Nationals. There's a Blake. Blaper. Blaper. There's Glader Figuario to 199. Fuchsia Lunar Creator. Blaper and Blom. Funny. That's good. You got to give me credit for that one. I like that one. That was pretty funny. I hate it. Purple Rayway, Vianna Hernandez to 250. I hate it. Yeah, I know. Once you know the origin and who came up with it, then that's like... Oh, that was cool. Oh, that's cool. Oh, that was cool. Oh, that was cool. Oh, that was cool. Oh, that was cool. Oh, that was cool. Gabriel Gonzalez. Okay, I'm Collier first for the Reds and a Lazaro Monsez behind it. Double check who has the twins. Oh, yeah, let me take a look really quick, Steve. I got you. Every now and then I will say the wrong name. Yeah, he was going off the top of the dome and then he got the dome in. Not too great there. Nick S. Nick S. I might have said Miles. Yeah, Nick S with the twins. That should be... If that's you, Nick, then boom. You're good to go. Sorry about that, Nick. I do apologize. Nick, let me know if you want me to beat him off. I got him. I guess so, honestly. There's your guys' link again to Sapphire coming up a little bit later. Full case of Saphir. Yeah, yeah, no problem. You got it, Nick. No problem. Sorry about that again. Like I said, if that ever happens in the future, just do exactly what you did. Be like, hey, I thought I had so-and-so team. You said the wrong name. Odds are. I did say the wrong name. Or the other... It's either I said the wrong name or you bought it or whoever the customer is bought into either a later break. Justin Crawford. Same product, different number. That does happen on occasions as well. So, yep. Should be good to go now. There's a Neurovillian Sedanio to 125. Aqua Lunacreta for the Padres. If Twins pull nothing, please charge Miles' card instead of mine. There's your Tani Taylor Santos to 150. Oh, that's good. Oh, there's Worm saying it's my fault now. Oh, Worm. Worm, was it my fault when I pulled you that Greengrass Drew Jones, though? Oh, yeah. Oh, interesting. Oh, oh, oh. Now he's talking. Ryan Clifford on the base auto for the Astros first. Grads on that. Houston. There's Yosue DePaola. No way, Yosue. No way, it's Yosue. Hip hip Yosue. Worm is right. Worm is right. Worm is right. Take everything back. Davison DeLos Santos as well. Galvrisolano Dillonore.  Yeah, there it is. I come up. I was looking at, there's not a lot of sticks for series too, unfortunately. Yes. Purple Drew Gilbert to 250. Jesus. I'll come up with something, don't worry. Something else. I'll just come up with something off rep when we're doing it. There it is. Kumar Rocker. Nice. Blue Lunar Crater for the Rangers to 150. I think the Rangers won a last team still sticking around as well. So there you go. Nice, Kumar. Adley Hrachman. Worm, did you get that by the way, that card? Matt Mervis. I'm assuming that's come in at this point. That was a fun one. That was back on. Yeah, that's been a while, so I'm assuming. Davison, should he be looking in series too? Really, there's not a bad one. Because you're looking at, there's Jacob Berry. At least just big name rookies, Junior Caminero. NL West is really good. You've got Corbin Carroll and James Outman out there. AL East, you've got Volpe and Yoshida. NL East, you've got Kodaisanya. NL Central, you've got Jordan Walker. AL West, Logan Ohapi is going to be out there as well. AL Central, you've got Koloss. So it's pretty loaded actually overall. How you lead. Overall I would say probably NL West or AL East I think are probably going to be the two strongest divisions. Just because they're a little bit more top heavy. There's Jackson Ferris to 499. It's the names wheels. Ferris wheels. Jackson Ferris. It's only 19 minutes into the stream by the way. There's Tony Blanco to 499. Yeah, Tauna hype around Volpe of course. Plus Yoshida. Yoshida is probably leading AL Rookie of the Year right now. Between him and Josh Young. Yeah, AL West pretty solid. I forgot they have Josh Young out there as well. So yeah, pretty loaded checklist though for Series 2 tomorrow. It's going to be fun man. It's going to be a lot of fun. Some Series 2. Plus then you've got a ton of product coming out around Series 2 as well. So that'll be a good time. Again guys, 20 to go still in Sappaya. Let's get that filled on up. Oh yeah. Yeah, Yoshida stuff is going to come out like firing. Yoshida stuff is going to be... There's a chance maybe outside of like Walker that Yoshida is going to be the most desirable. Corbin, Corbin, Carol too. But yeah, there's going to be super desirable guys all over that product. It's going to be fun man. Take the Guido. Yes I am. CK. Yeah, we're doing the Bowman... It's a Bowman Jumbo through the years, Justin Crawford. We're doing the Bowman Chrome through the years. This one's going to be the Bowman Jumbo through the years. So it's a five box as opposed to seven, but more autos overall technically are about the same amount. There's Dion Jorge. Is that too much? No, that's good. On the Invicta. Yeah, so the through the years is going to be a good time too. That's coming up after the next break as well. It's got I believe eight spots to go. Last time I checked, there's Juan Burrito and it's going to be Refractor Auto to 499. Oh yeah, Salad. Lot of bass in Bowman. Lot of bass. Lot of bass. Daniel Guiarte. Dion Jorge. Perez. Dion Jorge. There we go. That's a new one. That's a new one. Man, Dion Jorge. When he has autos, he might be in Bowman Chrome for autos. There's going to be a lot of shticks for Dion Jorge. It's going to be a good one. No, it's not. Oh, it is. No. Miguel Vargas. There's a green paper, Colson Montgomery to 399. Yafri Solano and bass. Got an auto coming up. Jorge Burgos. Nice one there. Bass Auto for the Guardians. Grats Cleveland. Cleveland doing well. Add this to your Valera auto. Valera sites on September auto. K.M. Collier first. Matt Mervis. Merv the swerve. Worst was doing an impression of you at Sunday. He was like, yeah, I was by Junior Cabinero. My impression of Sean, he's like, Joshua Bias to 499.  Like anytime someone comes into chat, he's like, Josh, you are like that.  I'm going to bring a real taser in if he's doing the thing. Tell me he showed you guys his top load like that all the way to the back. Oh, yeah. Jay Savina first on the Lunar Glow. Oh, yeah. Coming up here, that is going to be Myroshendric Martinez to 250 on the purple Dodgers killing it now. Congrats on that. There you go. Goyers. Nice Myroshendric. I'm going to start calling you that. Start calling you Myroshendric.  Friendly stream. That are Dudley. Oh, man. There's Robert Perez Jr. to 125 on the Teal Shimmer. Yeah. Ellie probably, Ellie most likely slated to be an update. I'd have to imagine a few other guys. I mean, Mervis will probably make his way into update. McLean might as well. Reds are going to be really good in Top's update. Thank you, Christopher, taking that spot. Thank you. Thank you. Well, Reds are going to be really good in Top's update. Thank you, Christopher, taking that spot in the through the years, as well as Nam Q taking some spots. Thank you, Nam Q. Nam Q. Appreciate you, buddy, taking one in the Mixer, as well as in Luminaries. The Luminaries Mixer 2. Got me using in Tier 1 coming up after this, guys. See something huge coming out of there. See a big Telier booklet or something in the museum. Or Bat Nob, Bat Barrel. That would be sick. That would be sick. See a cup, maybe, coming out of Luminaries. Gold Paper, Zeck, Geloff, or Geloff to Pippi. Josue de Paula, no way, it's Josue. There's Diego Hernandez for the Royals. That's refractor, first auto, too, 499. Congrats, Royals. Corporate Carroll, rookie. Josue. Yeah, that's a good one. That's good. See, look at you coming up with sticks now. You're turning to the dark side. I'm trying to help you out. Okay, I'm Collier first. There's Gabriel Martinez on the first Lunar Glue for the old Blue Jays. There's Yoffrey Solano, Myroshendrick. He was going Saturday with Boris, and they were watching from the early championship. Oh, yeah? What is it on? What's it on? I want to say Saturday at 3am. That's not bad, honestly. There's true jokes. Yeah, we'll have to run some support on Thursday. Yeah.  But Kiwis, by my house, or by the house, is a soccer bar. Really? Yeah. That's pretty cool. So I figured I told them let's go there with my darts, pool. Yeah, there you go. Luis Ravello, base auto for the Red Sox. Nice one there. Shay Langlears. Leandro Arias. Also down to 7 to go in the through-the-years mixer. Everybody, thanks again. 20 to go still on Sapphire. Let's get that filled on up. 19. 19 to go on Sapphire. Took a spot. Must have been recent. Scott F. taking Illuminaries in mixer spot. There's Shelby. Thank you, Shelby. Logan taking a spot in random player style. Good ol' Bowman U. There's a Invicta to 99 Nelson. Going to the Angels to 99. He likes that one. That's like Blake's favorite right there. Yeah, I saw that. I saw that, Chris. Thank you, buddy. Chris. Thank you, man.  It's probably the Mariners get you a big J-Rod. J-Rod first auto out of 19. That'd be pretty sweet. I'm pumped for 22 in that one, man. 22 is going to be fun with Ellie now. I might save that for second to last. Might do start with 21. Go to 23. Go back to 20. Then go to 22 and then finish with 19. I think that might be the strat there for sure. I think that's going to be a fun break overall. Keep the momentum going, Punisher. Keep it going. Honestly, got to ride the hot hand there. Yeah, absolutely. Hey, there's Camp Collier. Nice to 125. For the Reds. Rats on that. There you go, Reds. 22125, Teal Lunar, Craitor. Craitor. This guy over here. All my shirts.  It's like a purge as they're sliding down. Oh, God, dude. Terrifying. Oh, yeah. Ellie's stuff is probably going nuts on eBay right now. Hey, there's Quinn Priestert. 150. Bowman Scouts top 100 for the Pirates. There's Miguel Blaze too. 150. Had a pretty big, not huge eBay sale, but Max Monti to 250.  He always does fire sales. And I bought for like... Hold on. Like 20 bucks. I bought a Sam Darnold RPA from Certified. It's a 25. William Lugo, another one. Bay Sotto for the Met. Stop, Jeremiah. Jeremiah. And sold it for 50 a couple of days ago. I'm like, hey, dude. Trust me, I need it. Matt Mervis, Set and Forget. You know how it goes? Khalil Watson. Say it. You haven't listened to a lot of stuff on eBay. Yeah. A lot of stuff over the past few days. I got to get back and do it on the door. Cause I've been buying a lot. I've been buying a ton on Facebook. And a lot of times it'll just be huge. Lots of stuff. Like fire sale, dollar cards. Five dollar cards. There's Lizandro Rodriguez. Lunar Glow. Samuel Munoz. Lava to 3.99. Or Samuel Zavala, excuse me. For the Padres. Cause then I get so much stuff in. And I get like 50 cards. 60, 70, 80, 100 cards. And then if I don't list them, they just sit there. It's not doing anything for me. It's not making me any money. Speaking of Ali, there he is. Freiland Pernasio. Trinucaminero. Chevy Caminero. That's Forrest, by the way. I can't take credit for that one. That's Forrest. This is Chevy Caminero. All right. Let's keep it moving here. Everybody thanks again for selling this first breakout. Do appreciate it. That was awesome of y'all. I'm a picture. I have a light box. So I'm a picture guy. Yeah, me too. I'm a picture guy. Did you get the light box? Yeah. Yeah, you did. Isn't it awesome? I need to use the glare on it for that. You just got to angle it the right way. That's the thing. And you got to let your camera focus in, too. There's Freiland Tibera. That is Blue Lunar Crater to 150 for the Orioles. On the first auto nice one there, Baltimore. Kumar Rocker. Yes, sir, Mercedes. Yes, sir. I really hope in this year's Bowman Chrome, they have firsts of this kid on the Padres, making Salas. He's the top international prospect in all of baseball. He's 16. Yeah, yeah, I see. He just made his debut, or 17. He might have just turned 17. He didn't double his first like that. Yeah. He's so good. That's cool, man. He was actually in the training camp. He caught one of the games for them. Did he really? Yeah. That's pretty cool. Justin Crawford. I didn't know that. That's pretty awesome. I remember them all talking about this kid. I was like 16 years old. Yeah, dude. I know. Unbelievable, dude. There's Wilmer Flores. White Spackler 299 for the Tigers. That's incredible. I don't think he doesn't have Bowman yet either. Yeah, he's already in the top 100, dude. It's unbelievable. Unbelievable. It's crazy. I know Ellie. The rise of Ellie Dela Cruz was pretty incredible, too. That's Jacob Berry. I was reading something. Reading something today, once I found out he got called up, I went and was looking at an article about it. He started off last year at 79 and had such a good season that he shot up to 7. He was 7 going into this year top prospect, which is crazy. I'm trying to think, who else is like, because I know we've really been talking about Ellie making the jump this year. He's been one of the guys that were like, all right, it's a matter of, not really a matter of if, it's a matter of when. Who else do we think is going to get called up this year? Is there anybody, any other big names we think might make their debuts? Maybe not even necessarily saying like, Ellie like this early in the season, but like expanded rosters in September, like who's a potential debut guy? Like top, top prospect. There's 18 to go now on Sapphire. That is Clinton taking a spot. Thank you, Clinton. Appreciate you, buddy. Down to 18 to go on Sapphire, everybody. That is breaking not next, not the break after, but the following break. And then we're into luminaries as well. Oh, Henry Davis moving up to triple A. That's solid. That sounds like it could be, could be potential for sure. I mean, we're thinking maybe Lawler. Lawler maybe make the jump a little bit later in the season as well. There's definitely a possibility there. A lot of these 21 draft guys are starting to, to make their cases. I was thinking Cheerio maybe too. I mean, Cheerio is what, he's in double A right now, I believe, correct? Holiday is, is, is next freaking level, dude. His, his, his batting, his batting average is insane right now. He's batting, he's going nuts. And where is he right now? Single A? Single A, single or high, I believe. I'm not mistaken there. The only thing with Cheerio, I think he's still a little too young. He's only 18, dude. He's already in double, he's matching in double A too. Mashing. There's Jacob Berry. He might be 19 now, but as of last season, he was, he was 18. Mikey Romero, that is 2150. There's also a Spencer Jones base before that. Steamers out there. Oh boy. Steamers. Chunky steamers. Forrest goes finally, my hair's growing back a little so people will stop saying, ugh, I thought it blended in with the wall. There's two 399 rookie Francisco Alferez. So funny. Oh man. I know, I had to do like a double take when I was watching videos. I was like, I was like, is this hat just like in the right lighting? No, that's his head. I was like, wow. That is nice. How about a Cam Collier? Atomic to 100. Let's go Reds. Congrats on that. Heck yeah, dude. That's freaking awesome right there. Cam Collier to 100. He's making his way into the top like what? 40 right now, I want to say. We'll get that into him. Congrats, Reds. Last box mojo on that. Told you, it's coming. It's real. Yup. There's Samuel Zavala to 199. Sean, Sean says there's something in the air tonight. I'm just going to take that how you will, but that's what Sean's saying. And I generally will believe what Sean says for most of the time at least. Feel it. Lazar Roman says, maybe not take advice about how to keep a cell phone on you, but who forgets their phone at the golf course. Dude, I did the Ace Ventura slide into the cart return and it had to have fallen out there. I whipped that down. That's what you get right there. I thought the guy was going to yell at me. I almost had it on two wheels. It came in hot. It came in hot. All right. What do we got here? Darnichi Balthas. Nice one for the Cubs to 299 on the White Speckle. He's like a pretty hard guy to hit in this. Signs his full name and just legit writing, which is good. Better than a scribble. Yeah. Hey, it's better than just a line. Yeah. You got to say that. I'll give it to him. There's Miguel Blase. Sky blue paper to 499. Freyland Garnasi. Each rod. There's a gunner. That's Adley. Wrong one. One of the two Orioles. One of the two Orioles. Ruben Santana. Lean with it. Rock with it. Drop with it. Bounce with it. There's Jorge Ruiz. First moon and glove for the Angels. What a baby. What a baby. What's up? That's all I care about is dances. I know. Skins. I know. But I'm not doing anything. I'm not sure I have enough. The Balthas. The Balthas. The first one I did. Wow. Matt Mervis now on the base auto. There's Mervis Swerve for the Cubs. Cubs killed it in that last box. That was big time comeback for Chicago right there. Congrats Chicago. A lot of those last few teams did very well. I have to say. Cross. Munoz. And base. Do a quick recap here everybody. We had a Matt Mervis starting off the base autos. William Lugo. Luis Ravello. Jorge Burgos. Juan Burrito. Ryan Clifford. Damon Keith. Jorge Ruiz. Damon Keith to 499. Brilan Tvera. Emmanuel Bonilla. Diego Hernandez. Jackson Farris. White Speckles to 299. Derniche Valdes. Wilmer Flores. William Lugo. Purple Myroshendric Martinez to 250. Blue Lunar Creators to 150. Kumar Rocker. Brilan Tvera. Rowan Anthony. Nice one there. Invicta Nelson. Rada. For the Angels. Instead of ta-da. Rada. There's Jackson Holliday and George Valera. Yeah there we go Kirk. Thanks again man. And Kam Collier to 100. I'll do it for the break guys. Thanks again for the fill-up. Next we've got that museum. It's here one minute.


Let's not forget to let your voice be heard via the app. Here, John Peters on value-based connections. teammate. 2025. No one knows exactly what this future will hold. It's a black box. But we can start by imagining. So let's leap into the future. Imagine. It's five minutes to midnight, December 31st, 2025. Several members of our Tilburg University community meet on the rooftop of the future building, the highest building on campus. Looking out over the bustling thriving campus, they discuss how our university has changed into a central hub connected to hubs worldwide. Let me introduce to you the different views of a student, a business partner, an employee, and an alumnus. Wow. It has been such amazing months. I took online interactive guest lectures of my Harvard professor, took an offline course on the role of robotics and healthcare, and followed the Tilburg Career Weeks where study associations organized for other students. What else did I do? Oh yeah, I had a Skype meeting with fellow group mates of the Tata Steel project I'm working on. But these people are living in India and New Zealand. The education and self-study building has great facilities for Skype meetings. You should go there sometime and check out yourself. It's right across the other side of our bustling campus. Another great person I met this year is my supervisor. And my supervisor and I are creating a FaceTime hackathon for creating a co-platform on technology and sensation. I'm honored to have such kind of job instead of stocking shelves at the Albert Heim. Well, Tilburg University has a great experience for me, and I'm sure I will stay involved as soon as I am an alumnus of this wonderful university. Our organization was looking for an academic partnership. So we also approached Tilburg University. And their partnership portal is a one-stop shop, giving easy access to all the services provided here at the university. And also in a very personalized way. I could even virtually meet my partnership contact and get in to tap into the Tilburg community. We are now an ambassador partner of Tilburg University. We are actively participating in their so-called impact hubs allowing us to exchange knowledge on societal issues with the entire Tilburg community. So last year we got involved, of course, in the Digital Hub on Data Science. And got in touch with an alumnus in Singapore. And this contact has even resulted in a start-up together with entrepreneurship students of Tilburg University. So as an organization, as you can imagine, we are very proud to be engaged with the Tilburg University community through this partnership. And we can only recommend this to any other organization out there. I'm sorry. I didn't mean to yawn. It's not about your story. It's just that I'm a little bit jet-lagged. I just returned from Sydney working with our partner university on a project. And I also met some really nice alumni there. It was a great experience. And I must say, after having worked with my colleagues in Tilburg and on our virtual campus, it was really nice to meet them in person and work together. We share experiences and best practices. And that's very inspiring. And all of this to better support research, do our educational programs, improve services for students. So as a team, we all work very well together. And we create this inspiring environment in which our qualities are appreciated and recognized. And we are challenged and encouraged to go the extra mile to achieve excellence. Our successes are celebrated. And our failures, we learn from. I love my job. And I'm proud to be part of the Tilburg University Society. My thesis, I felt pretty nervous just like now. But I also felt confident because I was guided by excellent teachers throughout my studies. And during the last months of my studies, I joined the mentor program. I got in touch with an alum called Steph. And he showed me around on the job market and told me about his experiences. He even practiced job interviews with me. I am pretty sure that because of his help, I got an amazing job at Coca-Cola. The other day, I was back on campus and I gave a guest lecture on consumer behavior. It's very inspiring to share my knowledge with students. And maybe I will even meet my next intern or colleague today. I'm happy to give back to my alma mater. And I'm very proud to be part of Tilburg University Society. Hey guys, it's nearly 12 o'clock. We need to do some countdown here before it gets to 12. So, okay. Seven, six, five, four, three, two, one. Now, let's get back to today, to reality. These were some of our views on the future of our university, on the journey ahead. Will you join us on this journey? Will you join us, Emil? Will you join us, Lex? Thank you. Get your input into the tool and let your voice heard so I can put this ready.