this is preposterous. Good heavens John, you sound even more disagreeable than usual. Cale, you try being the president after George Washington and see how agreeable you become. Oh dear, what is it this time? What is it every time? Politicians blindly following their factions, ambition and intrigue are all I say around me. How did we ever come to this place from the birth of our independence? I would never renounce our independence but all your troubles do make me long for the simpler times before we began the fight for our liberties. Oh my dearest friend, you are sounding like an old man. Oh I beg your pardon. I'm simply reminded of a part of a John Wesley sermon. Is it not the common practice of old men to praise the past and condemn the present time? And old women. I often think about the days when I Diana was courted by her dashing Lysander before the cares of parenthood and statesmanship. It felt like we were living in our own utopian dream. Massachusetts was certainly no utopia, particularly once George III ascended on his dark cloud to the throne. Suddenly all the old men of Parliament wished to return to the past themselves. At least they did so with the acts and taxes upon the colonies. There was that war that needed to be paid for. Oh yes, the cleverly titled Seven Years War that lasted for nine years. Yes but it did benefit those of us in the colonies. There was no small amount of fighting on our soil and Americans profited greatly by supplying the army. And that is precisely why the Parliament thought that we colonists should repay the debt they incurred in the war. I have a providential that you should bring this up now John. I've been going through some of your old papers and came upon your radical writings from the 60s. I believe you were every bit as masterful as Barrister Otis. From a dissertation on Canon and feudal law to Humphrey Plough Jogger.  You flatter me Mrs. Adams. Oh good old Mr. Plough Jogger. I liked him. Even with the poor spelling he was easy to understand. Poor simple Mr. Plough Jogger. He was every American farmer after the Seven Year War. He'd prospered during the war because there was a market for his goods. But then afterwards when it came to having to pay more taxes in support of the thing he wondered how he might do that. Even he could see that the crown was determining where money should be spent. Taking New England tax money and spending it on things like hemp from the southern colonies. When our New England farmers could grow that cash crop just as well as any other colonial property. Yes they just needed the parent country to be the responsible steward. Educate the farmers on the crop then work them into the empire's market. Instead the crown would create debtors out of honest working men and throw them in prison where they would have no chance of repaying the debt. It was a ridiculous cycle. And for what? To pay for a standing army? Humphrey wrote they say there's going to be a standing army to be kept in pay all peacetime. And I'm glad of it for I'm sure for then money will be plenty and we could sell off our source and meet. But some other people says we shall be forced to pay him and that will be bad on other hand because if we have paid taxes enough already amongst us and they say we are desperately in debt now. You have a fine Mr. Plow Jogger impression. I do wish the Prime Minister had read Mr. Plow Jogger. He might have realized that after the war we were still grateful to be English subjects. We were still willing to pay our share. Heart of oak are our ships. Heart of oak are our men. Our purses are ready. Steady friends steady. Not as slaves but as free men our money we will give. After all we were still at heart British colonists. Although I am fifth generation New England Bond Adams so there is not one drop of blood in my veins but that which is American. Yes you've made that abundantly clear John. But you were also quite vocal at the time that we as the children of Great Britain deserved the same rights as our brethren and fellow subjects. Well it was not abundantly clear that we were British citizens. In England they seemed to forget that the charters our charters gave us authority to govern and tax ourselves yet they continued to treat us as children. Children who must presume that the parent is right even when that parent seems to us to shake the foundations of government. Were we the children of Great Britain any more than the cities of London, Exeter, Bath. But admitting we were children have not the children the right to complain when their parents are attempting to break their limbs or administer poison or to sell them to their enemies for slaves. That is rather dramatic but we were still subject to the acts of parliament. Were we truly though? Our colonies had no representation in parliament and that went against our rights set forth in the Magna Carta. Centuries later the Prince of Orange was created King William by the people on purpose that their rights might be eternal and inviolable. Thank you for mentioning Magna Carta dearest. You know how I feel about my worthy ancestor Sire de Quincy's contributions to the venerable compact between the King and the people. Clause 38 to 42 are of particular importance. The right to face one's accusers, the right to a speedy trial by a jury of equals and the rights of our country's merchants to free trade. Yes dear but as it was written to the Boston representatives in 1764 for if our trade may be taxed why not our lands? Why not the produce of our lands and everything we possess or make use of? This we apprehend annihilates our charter to govern and tax ourselves. It strikes at our British privileges which as we have never forfeited them we hold in common with our fellow subjects who are natives of Britain. If taxes are laid upon us in any shape without our having a legal representation where they are made are we not reduced from the character of free subjects to the miserable state of tributary slaves? Were those the instructions written in response to the sugar act? Ah yes yes which the old men of Parliament took from the Malazas Act of 1733. Those were about to expire and they renewed those import taxes with vigor even though they reduced the tax from six pence per gallon to three. When you put it that way it seems as if they were almost trying to do us a favor. But it was the principle of the matter. I know not why we should blush to confess that Malazas was an essential ingredient in American independence. Many great events have proceeded from much smaller causes and besides the taxes were for Malazas and sugar and wine and iron and it made trading all the more difficult with other countries. I believe it spurred the earliest non-importation agreements among American consumers. Yes and while we were suffering financially they reintroduced the Currency Act. Wasn't that already an existing law? Oh yes but it was scarce they enforced. The Parliament gave some strength to it and suddenly the colonies were not supposed to print their own currency. Use foreign coin pieces of eight Indian shell or anything else but British money which was already scarce here. Why did they think we were trying to use other currency to begin with? Our paper money was so ephemeral. I do believe that government securities are the most sound investment. I prefer to invest in land. Well I would run you into debt for as much land as you want provided you would stay at home long enough to farm it. Mrs. Adams you are an excellent farmeress. Well yes but I never want any more land than I can handle on my own. But land is what our forefathers came here for. Land and liberty recollect the civil and religious principles and hopes and expectations which constantly supported and carried our ancestors through all hardships and patience and resignation. Let us recollect it was liberty. The hope of liberty for themselves and us and ours which conquered all discouragements, dangers and trials. The liberty that our forefathers had come to enjoy was being encroached upon every time the crown sought to renew and bolster some old and previously unenforced acts of government. I fear that most people in British government were looking for the slightest provocation to force their grasping hands into our purses. Pelham and Fat George gave them all the motivation they needed. There was no one to represent us, no one to speak for us. I believe you are forgetting there was someone who stood for our rights, our liberties, our very standing as citizens. Oh that is very sweet of you to say Abigail but I merely wrote a few articles and instructions. I would ghastly say I was some grand hero at that time. Of course you are my hero John. However I was referring to James Otis. Oh Otis? Yes of course. Mr Otis demonstrated how these articles of molasses and sugar especially the former entered into all and every branch of our commerce. Fisheries, even manufacturers and agriculture. He asserted this act to be a taxation law made by those who had no feeling for us and whose interest prompted them to tax us to the quick. He was masterful in advocating for our rights. Even when doing so put him at a great risk. Remember his sacrifices for defending against the rits of assistance? The rits of assistance?  To be able to claim someone was harboring contraband and force a search, even without the slightest thing resembling proof. It was scarcely less malicious than claiming someone to be a witch. Thankfully Mr Otis eloquently defended against those terrible rits and without payment. And without winning his arguments. Do not forget that. He added injury to injury after he resigned his post as advocate general. The British wanted him to enforce those dreadful rits and instead he renounced his advocacy and fought for the opposite side. Our side? He proclaimed what we all believed that a person's house is his castle, his fortress. Indeed. Yet despite his loss Otis was so masterful that I believe that the child independence was then and there born. I thought you said independence was born from the molasses act. But it was a lengthy birth Mrs Adams. The molasses act, the sugar act, the currency act, the rits of assistance. The quartering act. Although in fairness the quartering act was not fully enforced. I do not believe fairness and the quartering act should be in the same sentence. The simple fact of parliament even considering that colonists should be forced to give housing to their own occupying soldiers. My blood boils. My blood isn't. Articles seem to do no good. James Otis' arguments and pamphlets seem to do no good. There was no room for debate. We understood the need for some taxes to borrow from Otis a quiescentis commotum centiure depot et onus. He who receives the benefit must also bear the burden. But a person who bears the burden for others as well as for himself without receiving the benefit cannot survive long. It is a common understanding of equity. If you order and then are served a deal of cider, you are under responsibility to pay for it. But if you are made to pay for your cider and the cider of the patrons on the other side of the room and you receive no cider at all, well then it is doubtful that you will continue to patronize such an establishment. Suddenly I'm rather thirsty. Oh, thank you. Welcome dear. Of course, if you desire to return to the older times my dear, you will have to return to the great George Grendel and his introduction of the Stamp Act. Oh, good times. It was dreadful. As a lawyer I was inundated with taxes on all my necessary papers. Pleased to court, bails, court orders, rits of entry, and attorney's licenses were the highest taxed of them all. Mr. Gridley admonished me to serve the law rather than the gain of it. But it was difficult with these stamps. They made it difficult for anyone to gain anything at all. It was as if by design they were keeping us from our success. I have a charming Mr. Plow jogger on that one. Here we go. I do say I won't buy one shilling worth of anything that comes from Old England till the Stamp Act is appealed. No, I won't let any of my sons and daughters. I'd rather the Spitlefield waivers should pull down all the houses of Old England and knock the brains out of all wicked great men there than this country should lose their liberty. Our forefathers come over here for liberty of conscience and we've been nothing better than servants to them all along this andred years. I know not if it was their intent but it certainly felt as though they were trying to subjugate the colonies as much as tax them. Taxing newspapers and pamphlets it made reading a wealthier man's pursuit and we were desperate enough for education on this continent. Fortunately you were not alone in your dissatisfaction with the Stamp Act. They were protests all along Massachusetts. Well, if there is anything we New Englanders know it is how to make our voices heard. Your cousin Samuel can make people shout rather loudly. He does have a power to him. He took mobs that were fighting each other and turned them into a force for liberty. The sons of liberty were sometimes as dangerous as they were loud. Do you remember the protesting in Boston when they hung an effigy of the Stamp Collector under that entry? The sheriff was told to take it down but the crowd wouldn't let him. They only took it down to give the effigy a funeral march and a funeral fire. Well, didn't that collector ask to resign? Oh, indeed he did after they beheaded and burned his effigy in front of his house. I was none too surprised though. We colonists were not exactly innocents in our protest. Well, it wasn't only Massachusetts. We read about protests and boycotts in New York, Rhode Island, Virginia. Oh no, it took many voices to be heard across the sea. Boston was simply louder than the others. Oh, thankfully they heard us and repealed that hateful Stamp Act. Oh yes, but we were cheering so loudly that when we heard the news we did not hear that Parliament had passed the Declaratory Act at the same time. There, you see John, they did read our laws and ancient compacts between the crown and colonies and not liking what they read they simply used their unchallenged prerogative to change the law to something that suited them better. Thus declaring that Parliament would determine colonial policy in all cases whatsoever. Yes, thus clearing the way for the Townsend Acts, more duties on lead, paper, glass, tea. Oh, why did they have to be so mean about the tea? It was the hardest thing for me to give up. My dearest, would you be a patriot or a tea drinker? Liberty tea just never had the same effect. Well, one good thing to come out of those acts was that John Hancock was accused of smuggling and brought before the Admiralty courts on several occasions, acting as his attorney in those years did secure our finances during the early years of our marriage.  Judges also not of our own local assemblies choosing were being given princely salaries by the Crown in whose favor they might pass judgment. And along with sending judges that we neither wanted nor needed nor elected the Crown and Parliament continued to manipulate the American Newton Act. A fancy name for quartering a standing army among peaceable subjects. That had also been around in some form or other since 1689, but it was intended to have limitations of one year after the declarations of peace. And yet the buildup of troops here after the 1763 Treaty of Paris continued for years unabated. Well, after all of this do you still wish to live in the old times? Well, I simply wish for people to learn from them so they may stop blindly fighting each other. I fear that as long as there are politics and politicians that may never happen.


I guess there's no goon introducing us, so we'll have to do everything ourselves. All right, so I'm Dennis. A lot of you guys know me. Yay for Houston. And all of you know me from my previous talk. I talked about access control systems. So this is going to be my second time speaking. I work for Lars Consulting. I'm an adversarial engineer, my best, my most favorite title yet. I'm also, since I'm from Houston, I'm a founder of Houston Locksport or Lockpicking Club.  So, ooh, what have we got here? Libations for your talk. Oh, thank you so much. Round of applause for Kyle. Yay. Ooh, that's good. All right, and so I'm Tim. I'm a Red Team Manager for Lars, which means I don't know what to call Dennis employee, but more of a team lead consultant, that sort of thing. This is my 10th year as a DEFCON Goon, so I'm eligible for retirement now, which is always fun. Yeah, woo. I'm also a former CCDC team coach for a group of college students through CCDC. I don't know if y'all are familiar with that program. I'll see you guys in the back. And also, and I'm also a former CTF participant for DEFCON. I did that two years in a row. I also ran the wireless contest for a couple of years. So I've kind of been around. I've done a little bit of everything. This is also my second DEFCON talk. So what we're going to talk about is sticky keys. If I say sticky keys, does everybody in here know what we're talking about? That's how you get into your computer. Exactly right. So if you Google for how to reset Windows passwords, like eight of the top 10 links on Google are pages that tell you, reboot off of your rescue CD, go in, copy, cmd.exe, overset, hc.exe, reboot at the login prompt, press shift five times, use net user, change your password, close the window, log in, and you're done. There's only one or two of those sites that actually says clean up after yourself when you're done. So there's a lot of boxes out there that still have cmd replacing set hc, and these boxes are just kind of ripe for the picking. So it was used as a persistence mechanism, like there's a kernel-ownage blog on it. There's several different places that tell you how to do this. And with this though, so there's no event logs that are generated whenever you actually execute this backdoor.  So there's two ways that you can go about backdooring a Windows box with this method. One of them is the binary replacement, actually replacing any of the pre-authentication accessibility tools with cmd, or you can set the image file execution option, registry debugger key to be cmd.dx. And so whenever you access any of the accessibility tools for Windows, you get a command prompt running as system pre-authentication. So here's a list of the accessibility tools that are available pre-authentication. You've got the binary on the left, the description of what the tool actually does in the middle, and on the right, you've got how you actually access that. And so that's gonna come in important later whenever we actually start talking about the tool. But Microsoft does have some limitations on what binaries you can replace any of the accessibility tools with. So the first limitation is you have to have elevated access on the box. You're gonna have to have administrator system to begin with. So we're not actually exploiting the box and we're not actually placing a backdoor. We're just taking advantage of a backdoor that somebody else has already put on the box. The binary must be digitally signed. This is Microsoft restriction for that. The binary must exist in system 32 and it must be on the Windows protected file list. And so if you've ever ran system file checker and it goes back and says, hey look, these binaries have been replaced or there's something wrong with them and it fixes them, that's the Windows protected file list. And you can get a list of those from Microsoft's website. But so you can't just use any old binary. You have to use something that meets those criteria and CM2DXE meets all three of those criteria. And so we were working with an incident response team in an organization and they had uncovered via the file system side of things several boxes that had this persistence mechanism put in place. And so it was more than likely a systems administrator could have been a rogue admin, could have been some APT group that was in the environment. Don't know how they actually got there, but we wanted something to where we could scan for this from the network side. So we started, well let me back up a little bit. The problem with looking for binaries that have been replaced on the disk is you don't actually catch the image file execution option unless you're sweeping the registry as well.  So boxes that the group doesn't have administrative access on. You're gonna miss any boxes that they don't have administrative privileges. And so we had a need for a network based scanner. We started looking into writing our own using Java RDP or looking at Python and had a bunch of problems and just a hate for Java that we couldn't get over. So we ran across Zach Grace's proof of concept script, Sticky Key Hunter. Sticky Key Hunter was a great starting point for us. It gave us a decent framework for how we wanted to kind of implement our script, but his script was similar to the peeping Tom program. If any of you are pen testers and you've seen peeping Tom, it scrapes a bunch of websites and we'll take screenshots of them and then give you a page that you can just scroll through looking at them. And so if you're talking about a large organization with anywhere from 20 to 100,000 endpoints, that's a lot of screenshots just to scroll through looking for a command prompt. So we wanted a way to automate some of that for us. And so Zach's script also in the to-dos had automatic command prompt detection and then multi-threading to make a script faster. It took about 25 to 30 seconds per host and we did some optimizations on that. All right, so we started with the Sticky Key Hunter script that Tim talked about and we went into it, we wanted to help improve it and help kind of complete its to-do items and what ended up happening is I spent way too much time on it just seeing things that I wanted to do differently and so we ended up more than double the lines of code of what originally was and we implemented a lot of performance improvements, some error handling to help with if hosts go down or whatever, lots of detailed logging to help with reporting and as well as it's now parallelized so it'll scan more than one host at a time and that dramatically improves the time it takes to scan a list, a range of hosts or IPs and it also automatically alerts on command prompts on hosts that thinks it actually found a command prompt on and so you don't have to scroll through thousands and thousands of screenshots and of course it's in Bash so it's tailored toward Linux, we programmed this on Kali Linux, all the tools you'll need is available for Kali so that's our script, so let me demo this for you. I'm gonna start by demoing what Tim talked about, what the sticky key's vulnerability is so I'm gonna remote desktop into a computer and just show you what happens is you're gonna see a Windows login prompt and we're not gonna put in any credentials, we're just gonna be presented with that login prompt and this computer is vulnerable to the sticky key backdoor so all we do is press shift five times, I'm gonna do this, there you go and then now you see we have a command prompt and because this is spawning from winlogon.exe you can see who am I, we are system, the highest level access you can get on that computer and so that's just a method of persistence, a backdoor that lots of people do and so our script, let's go back to the PowerPoint here, our script automates searching for that, automates actually scanning for that vulnerability, you'll see here, let's press play carefully, does that work? Okay, so it's going, so you'll see it's named banana.sh when we recorded this, I had no idea what to name it so Tim and I settled on banana but now it's sticky key slayer, so. But you can see, I told it to do eight threads at a time, it's doing a list of 20-something hosts and it's going through each one, it's establishing a connection to it, it's taking screenshot, hitting shift five times as well as other keyboard shortcuts, taking another screenshot and then comparing the amount of black pixels that are on the screen and it'll alert, okay, I found a lot of black pixels, it's within this range of this percentage and this percentage, I think you have a command prompt and once it's done, you can see the logging there, I hope the text is not too small, you can look through the screenshots and you see the screenshots of all the hosts that don't have a command prompt and in that discovered folder that I'm going to click on in a second, you'll see all the hosts that actually have a command prompt and you can see them in there, there's one of them. So to reiterate, there's a sticky key slayer, that's the real name, specified dash jh for the number of jobs, demo host is just a list of targets line by line and then you get the screenshots for all the computers and in a discover folder, there's the ones that actually have command prompt and there it is and those are computers we have full system level remote code execution on without any work using someone else's back door. So free money. So tool usage, so I mean that's the tool, that's the gist of it, it's like 360 lines of code but that's all it does, sticky key, excuse me, tool usage, sticky key slayer.sh So there's a few parameters that you can choose, you can do dash v for verbose, it does output some information to you but you can make it more verbose if you want to maybe something's wrong or you just want more information. You can specify the number of jobs, it defaults one job at a time but you can give it as much as you want, as much as your CPU can handle. Don't try 1000 because it will crash but I've had success on a Cali VM running on a MacBook Pro about 24 and that'll scan about 22,000 hosts in about three hours. So that's pretty good. Timeout, you guys are familiar with the concept of timeout, it'll try a certain job for a certain amount of time before it just errors out. You can specify that timeout, it defaults to 30 seconds and then target list. You can either give it a single target, an IP or a host or a FQDN or you can give it a list of hosts and that's the money right there. You can give it a list of 20,000 hosts, let it run, go home, come back and get all these, get hundreds of, sorry, 20,000 screenshots when you come back. So some limitations to the tool. It does tie up the computer you're using. As you can see, it was popping up a bunch of remote desktop windows so it's kind of hard to use it. When you're, it's hard to use a computer when you're using the script. So have a VM dedicated just to that for that time. And as well as we, when Tim and I were doing some scans and some other IP addresses with their permission, Wink, we found that the majority of them, majority of the backdoors were cmd.exe, however, there were a few that were something else like Task Manager or MMC or something custom and our script, of course, doesn't detect those because it's looking for a certain amount of black pixels. So maybe in the future, Tim and I are kind of working on how we're gonna engineer that, like detecting any anomalous behavior, not just cmd, statistics. All right, so based on Dennis and I's assessments and then based on some assessments from some other friends and other things, we've probably scanned about half a million boxes. We've turned these over to some large organizations for internal scanning and there's a pretty decent success rate internally for some of the environments that we were in, but we decided to turn around and look at a large business class ISP. I went to show Dan, did a search for business ISP and then port 3389 got a list of boxes that were exposed, that were exposing RDP to the internet and there were about 100,000 or so roughly in that list. We had 570 system shells by the time the scan was done. It took about six or eight hours to scan that large of an IP space. So that was one out of, the real statistic was like one out of 173 boxes, one out of 175 makes a great round number for it, but that was far more boxes than we thought we're actually going to be vulnerable to a backdoor that's been around for years. I mean, our first step into this was this is going to be stupid, nobody's ever going to do this and it turns out this is happening all over the place. So by looking at the domain names on the login screen, there's educational institutions, there's law offices, manufacturing facilities, hospitals, pretty much any vertical that you can think of have free system shells on their boxes. So if you step into an assessment or an environment if you're doing an external test and they have RDP enabled, hey, take a shot, it may work. If you're internal, that's even better because you may find one or two servers, but those one or two servers you've got a system shell on that you can now run MimiCats or go from there with absolutely no logging. By the way, that's 570 plus shells we got like with no work required. How was that not worth a round of applause? Woo! So now we got to talk about what matters most, right? The recommendations, the remediation, the prevention detection. So we've worked a lot on the remediation side of this. So we came up with a few techniques, a few just ways to help mitigate this. So if you do find one of these, one of your boxes in your environment are vulnerable to this back door, there are a few things you can do. You can delete the executable. If there's, if CMD was replaced, assethc.exe or any one of those other accessibility tools, you can just simply delete them. They're not totally necessary to make a computer function and your computer will eventually in an update or when it does an integrity check, it'll replace those files back to where it would be. If you don't want to delete them, you can force an integrity check. You can use sfc.exe, which is system file checker that's built into Windows. And what that'll do is that'll scan all the Windows protected files in which all of these are Windows protected files and it'll check, are these the files that they're supposed to be? If not, it'll replace them back to what they're supposed to be. So you can run fsc scan now, you can specify to do your entire drive or specific files. If this was done through the registry method using the debugger to make it run, you can simply delete that registry key. That key does not need to be there. Delete the whole key for sethc.exe or utilman or whatever. And one thing I like to inform people is that I really feel that they should treat this as an indicator of compromise. If they find, if you guys find this back to where in your environment, it's going to be one of two things. It's going to be someone subverted processes and put this back to where in for whatever reason. Maybe it's just a simple reason they want it to get in in case something goes wrong or maybe it's they want it to get in when they get fired. So there's that. And then there's also, if it's not that reason, it's an indicator of compromise. Maybe there is an intrusion in your network previously, some malware or APT as they call it or some threat actor. Oh great, someone laughed at APT. I laugh too every time. Someone did this. This is a known method of persistence. I mean, this is my top method. When I go to CCDC, I played against that guy over there. We wrecked them with just cmd.exe backdoor because they took a snapshot of their VMs before, after we already implemented this backdoor. So we were able to get in every time. So treat this as an indicator of compromise because it's serious, it doesn't just happen. Now going into the prevention and detection phase, okay the simple protection, simple way to protect against this is restrict local admin of course. You need to be local admin to replace these files. So restricting that is important. It helps resolve a lot of issues including this. Full disk encryption, that'll help prevent if someone were to steal a laptop and get access to content to the hard drive and replace the files that way. Full disk encryption will help protect against that. My favorite method of, it doesn't really protect against it. It protects against the exploitation of it is network level authentication for remote desktop. Network level authentication, when that's enabled, it requires valid credentials before a console is ever presented to the user. So our scripts wouldn't work unless we had valid credentials. So enabling NLA across the entire environment is a valid protection against exploitation of this. Against remote exploitation. End point monitoring, we've seen a lot of success with end point monitoring. You can monitor a few things, one of them being monitor when the file is replaced. If the file is something what it's not supposed to be, alert on that. You can also alert on if CMD ever spawns from the WinLogOn process, as a child of the WinLogOn process, that's not normal. I mean in my experience, it's usually not normal. So you can flag on that as well. And then NetFlow analysis. Simply look at, are there hosts, is there one host or a few hosts in the environment that are just spraying RDP, port 3389 everywhere? If so, maybe you should look into that. So, oh by the way, Tim made this for me, it's great. This is, what do you call it? What do you call it? Conquest, the ears of your enemies. The ears of my enemy. The rumor has it, these are all the shift keys that we've broken over time from exploiting them. So we just took them off and Tim made them into a necklace. So I'm gonna wear it. Um, what's this guy? So, a little treat for you guys. The code is, has been released as of an hour ago. So it's on my GitHub, sticky key, excuse me, sticky key slayer, what are you laughing at? Sticky key slayer. It's up there, I put a lot of documentation, hopefully it's easy to read and easy to use. I recommend if you guys work for a big company or a small company, download it, look at the code so you know I'm not doing anything malicious.  Run this in your environment and just see, you'll be surprised how many you'll see out there. There hasn't been any environment yet that we've scanned and haven't at least found one. So try it, look into it and see what you can get. So yeah, my codes on GitHub, I encourage you guys to contribute to it or at least report any issues you see because I always like to make my stuff work for everyone, so report issues, send us feedback, whatever you want. Slides are also online, demo video is online if you care about it. That's pretty much it, questions. So we've also got a weaponized version of the works that you can just say execute this code as soon as you find a command prompt. So you just set it and forget it and watch the shells rain in. So that's a. I call it raining shells.sh. Question, question over there. Oh. We'll repeat the question. Yeah, yeah. Okay. All right, yeah, that's a good idea. Okay, we'll do that. Okay, questions go up here. So we have three minutes for questions. And then. You need a loud mouth in the back? Yeah, I'm sure you have questions. Okay, go ahead. Is it on? Okay, just tell me, I'll repeat it. All right, so if you use black pixels to determine if you got a command prompt, what did you do to account for the different operating systems? For example, Windows XP has a pure black background and other operating systems might use dark backgrounds. It's the difference between the H-R-DP connection. We take a screenshot and we make a, actually send all the accessibility options. We take a difference, take a second screenshot and it's the difference between the two. It's not just looking for black pixels, it's looking for the different, the difference between them. So if you look at like Dell has their default Windows install has the front end of the Dell bezel on it that's got a lot of black in it. Whenever you actually pop a sticky key shell on it, there's more black on the screen than there was before. And so we're just looking for the difference. It's very simple. It's rudimentary. There's been some work out there in like OpenCV trying to do screenshot detections and other stuff for it. We looked into using OCR in the screen, but we found a lot of boxes in non-native English and I don't know how to do OCR recognition in English and non-English character sets. So about half a million IP addresses that we've scanned with it from us and then other people's engagements. It's great. It's like 99.96% effective in detecting the screenshot every time. There were a couple of false positives, but those false positives were due to broken consoles to where like the top two thirds of the screen was the actual console, the bottom third of the screen would just be black. Thank you. Woo! Yeah, I mean, so to paralyze this, we do use GNU parallel. That's it right, GNU parallel. We use the tool GNU parallel and that just allows the script to spawn itself in multiple processes and just run really, really fast. So it's really cool looking at that tool. Question? Thank you, sirs. Question. Do you have a list of all of the other ones that work? Yeah, we go back to that. Because you said there are other ones, but you only talked about ZHC. There you go.  Thank you. Okay, so yeah.   So just to reiterate, this is not, so shift five times is only one of the one, two, three, four, five, six, seven. Seven executables that'll work with this. Window key, you will open Utilman on-screen keyboard. There's no keyboard shortcut for that, but there's an option for that. And so they're saying we're done. We have one more minute. Question, one more minute. Yeah, sure. So if you can programmatically scan and detect these things and you can programmatically send keys, you could also in theory programmatically add an option to remove the back door.  So my goal as a troll was if you just downloaded our code and ran it and said, hey, go ahead and just do this to run SFC slash scan now as the actual weaponized code. And then drop us something in the log file to say, hey, this box had this back door enabled on it, but sorry, you just cleaned it, thanks. Read the code next time. Thank you guys so much. Questions will be out there and we'll slowly move to the bar. Thank you guys so much for coming.


So welcome everybody we are here today at executive directors chat we call that ED chat here and this is a chat as a conversation between all of us here. So feel free to either chat with each other in the chat room or you can use the raise your hand option to chat with each other. So today we're going to exploring the use of artificial intelligence in grant writing and I know if you're a nonprofit in here, you need a grant writer or you may be the grant writer so what I want to do is do a little poll as people are coming in and find out. If you're the person who writes the grants for your organization let's see who with the grant writers here. Are you the person who writes a grant for your organization. Ah, wow. Who is most of you. Okay. This is, I knew this was going to be most of you. Okay. Yep. I'm going to share the results and that really is most of you so you may be grant wearing multiple hats being the grant writer being the executive director, been the volunteer coordinator you may be multiple things well. I'm talking about technology here at TechSoup and I know you guys are probably hearing about AI you may be afraid of it. I don't know. I know when I heard about it, I just kind of. Not sure, but then a friend told me that she wrote her whole book using AI like really so I started asking questions that I need answers to and I'm pretty fascinating so I do some grant writing courses and we use AI to write some grants so I just wanted to kind of share this with you and share your experience so today is going to be interactive. I want to show you how you can engage while you're here. Everybody is on mute as you come in your on mute I would love if you would remain on mute. If you have a question. Use the raise your hand option down at the bottom of your screen you see the reactions buttons or you can type it in the Q&A. I would love to hear you come live to share your experience so make sure you share your experience with us. My name is Aretha Simons I'm the webinar producer here and I want to get right into it. It's going to be kind of like, you know, I'm going to share my screen and show you some things that I have learned from using artificial intelligence. I cannot assume that everyone knows what I'm talking about or that everyone has to use AI. So I want to know who currently uses chat GPT. So let me just ask this question I'm going to put it in the poll right here. One second. People is not wanting so do me a favor just type in yes or no. Yes, I currently use chat GPT. No, I currently do not. I'm very curious to see how many people we have here that uses chat GPT already. So wow, almost even, almost even lots, lots of nodes here and some people say a little. Yeah, yes for other reasons. Oh, I'm a pro I love it TJ so TJ I definitely want you to share with us as we get started. So hi Jean how are you I see a lot of faces that I recognize awesome great great to see you all. So what I want to do is share my main screen for for quick second because this is for and I'm sharing this because for people who do not use chat GPT or who have never used chat GPT. And there are other types of. Oh good I'm reading this in the chat. No with a letter published last week from 350 to the world's cop AI scientists says stop using it until there's a place for more rules and regulations. We're going to talk about that, because what they're doing and I hear I'm going to share my screen real quick. I have multiple screens here. One second. My screen is is a yellow screen right somebody wave at me. Awesome. Okay, so this is where you would log in and it's going to say that is open AI comms backslash chat GPT. And so you would click here to log in for anyone who has not done that this is what it looks like, but they've changed the site since I've started using they've changed it several times. So it may look different tomorrow I don't know, but just just know that the website is open AI.com backslash chat GPT so when you log in and what it's going to look like it's going to ask you for email is going to verify it's you. And when you get to this page this is what I want to talk about because we are using a platform that's new to us, but AI artificial intelligence has been around for a long long time. More than 30 years, maybe not in this form because we we just start using computers in our home, not too long ago, but here you can have chat GPT. You can create realistic images and art forms. Incredible. You can integrate open AI models into your application for this so you can even build apps for this, or we're going to do chat GPT, which is interact with our flagship language model in a conversation interface. And I see somebody's on mute it so if you will make sure that you are muted that would be helpful, because I'm trying to multitask here. So here, when you get to this page. This is what we do, you ever get something, a new phone or something you just open the box and just start playing with. We forget to read the instruction so this are these are the instructions right here I don't know if you can see it don't need to make my screen bigger. Okay, make it bigger. Okay, so let me let me multiply this screen. Okay, here it says, this is a free research preview so I'm using the free version here. They are paid versions. It says our goal is to get external feedback in order to improve our systems and make them safer. So they're getting feedback from you as well. Here is a little red light. There's a little warning sign. While we have safeguards in place. The system may occasionally generate incorrect or misleading information and produce offensive and bias content. It is not intended to give advice.  We may give you wrong information I've seen where a lawyer is now being sued because he used chat GPT to do his legal brief. So there's people who are using it for different things and that you've seen, you've been on our other webinars and seen other webinars about artificial intelligence. It tells you there is a warning that says, hey, we're going to give you good information but don't rely on this don't use it for medical reasons don't use it for legal reasons. So here's the next warning, how we collect data yes they are collecting your data conversation may be reviewed by our AI trainers to improve our systems. So every question that's typed on here. You're probably keeping the questions right it makes sense. Here's a little lock and key. This is very good. Please do not share any sense in your conversations. Very important. This is not not on me. Okay, I'm Darren I'm going to mute you. There we go. This is could be about your volunteers. If you want to write a letter about somebody. You all deal with all types of different nonprofits, sensitive data some domestic violence, all kinds of health organization so just make sure that you're not putting sense of information into your chat GPT sounds like common sense but I promise you, you know, you could do it only. So, here it once again they want your feedback. The system is optimized for a dialogue. So you're talking to, you know, artificial intelligence so let us know in particular what was a response good or helpful. They want to know or unhelpful so they really want to know. So now I'm in here. And again, I've asked questions I'm going to build a house I asked about framing my house what's cost going to be. But if I want to ask questions. Let's let's, first of all, remember to talk about the directions. Let's look at these here is going to give you examples here, explain quantum computing and simple term this is just an example what you're going to what you can ask chat chat GPT, you can say, explain to me, what a grant writer would put in a grant proposal, and it's going to do that for you. You can tell it to remember what you just said in an early conversation. Hey, remember what I asked you in an early conversation. Can you give me more details about funding for Orlando, Florida. So, and here's another kicker may occasionally generate incorrect information so if you are asking chat GPT to give you demographics for your area say you're helping children in the third grade in Orlando, Florida. Make sure you verify that with the school board, you know, on their website that's open information, or, you know, the county that you're in just make sure you verify a lot of the data so I want to get right into it I see there's a question in the chat. Okay, somebody was just saying that they have not used chat GPT. I'm going to go to the chat section. Very good. So, before I get into asking a question. Does anybody want to share, because this is this conversation that anybody want to share, you're going to use the, the raise your hand option, how you use chat GPT. So, Emily says could you share a grant application to chat GPT with the original call for applications to do a comparison and see if you missed elements. Oh, that is a good one. And that's a good question anybody got any. Any comments on that because you know every grant application funder is asking for specific information right. And so if you got a call for applications. If you put that information on there.  That would be a good one I wish you had the information so we could put it in here to compare, because that's the biggest thing in grant writing missing those little things, you know, missing that list having that checklist checked off and missing those things so that's a good anybody got any answers to that. Anybody done that. I can speak to my experience with that. Perfect. Thank you. Sorry a bit nervous speaking in front of so many people so pardon me but like I found that I've done that where I gave it the RFP and I gave it the copy. And it was interesting because like it was able to pick up some things that maybe I hadn't thought about. And so you know it was nice to sort of have that extra perspective I guess. At the same time I think that there is this sort of caution, just because the AI is suggesting that you add something it may not necessarily be appropriate for the RFP or appropriate for your strategy. You know, it seems like there's some, you know, your team might have thinking that goes behind the proposal and the AI is kind of blind to that. So that's something to think about. And I've also experienced just to that end kind of like having, having done like having asked for rewrites or things that incorporated feedback to see maybe how it implement those things. And I find that the answers that it give me that it's given me or kind of hollow, you know, kind of missing a human element. So just just some experiences that I've had with that but it does work I just think that it takes thinking it's not automatic. Okay, okay. That's very interesting. Because I wrote an email to a professional I'm not going to say what type of professional it was. And I told chat GPT to make it, you know, better than what I did and what it wrote was like outstanding so I imagine if you may have, if you may thought it was hollow just say chat GPT rewrite this, again and see what it does I don't know so that was that was great feedback. So Gavin and a couple other people asking about putting PDFs. I know in this free version you have to copy the verbiage, and then put it in here, maybe in the paid version which I do not use. You can probably add PDFs anybody got an experience hi Gail welcome and experience with PDFs and making graphics. So Susan asked a great question. And you guys just use the raise your hand option. I'm going to stop share my screen for a moment because I cannot see your hands being raised. Susan asked, where's her question. How much time. Do you lose by two fact checked it versus how much time you save, saving it. Very good question. Um, I imagine the fact checking. It just depends like I mentioned about the demographics. I mean, it may not take you that long to check that. Crystal Jones I see your hand raise. Go ahead and meet yourself. Hi. Hi, hi. So I've been using it for a lot of things. But something that Cameron touched on, and I think several of us in the chat have touched on. Be careful of the facts, especially when starts naming people because I've had this thing. In fact, just yesterday, make up a whole person that did not exist at all. But I've used it in a variety of ways and it's not perfect technology, but like you are. I've used it to write letters. I've used it to write emails. I've used it. I saw someone else say about social media. I spent the whole weekend using it to write my whole month worth of social media posts.  Double check those really quick what I find the fastest way to do that.  Or it's going to come back and confirm it. So it's not, it's not perfect, but I've used it for a lot of things in terms of grant writing. I just started trying to play with this for grant writing because it works so well for letters and social media and all kinds of things.  You know, and just kind of had a conversation with AI first, and then I started feeding it some of the questions from the grant application, but not feeding them cold.  And I've had good results. Some of it has been less than human. And when it does, I'll just tell it, hey, this is great. Can you rewrite that? So basically I treat it like I'm having a conversation with a robot I'm trying to train a really smart robot, but it doesn't know everything.  So it's, it's got the mind of a genius, but you know, sometimes the capabilities of a four year old in some area. So if you approach it that way, it really is a pretty powerful tool, but it's not the end all be all, but it sure has made so far this grant application so much easier for me. Yeah, thank you for that feedback. Hi, you know, you need to treat it like any employee who would be reporting to you. Right. Would you would you quote any employee working for you and assume that they've got every everything correct. I've been using it. First, more context you give it the better it reacts. And I've been using it to generate multiple choice quizzes. I put a link again at 114pm to our website. We've got chat GP T for in the chat bot. But we've also used it to generate multiple choice quizzes and answers now I'm a paraplegic so it's still very tedious for me to copy and paste each thing. I haven't finished yet but I've started playing around with having chat GP T for write the PHP or the JavaScript code for me to do a plug in for WordPress that takes the output of it's like one long paragraph of the questions and answers. And then we'll parse that into the XML file that then I can import into WordPress so I won't have to, won't have to do all the tedious copy and and paste, but it's, you know, it doesn't a couple of seconds what would take me a couple of days. Yeah, nice, nice. Give me one second MCGS I'm going to answer Billy's question. How do you give chat GP T rules other stuff. I see a lot of questions in the chat area so if you can put them now in the Q amp a because we get, we have a lot of people on the section so Billy, you, you give it rules just like you, your question you would give was, you can tell chat GP T. You are a doctor, write me a, you know, a medical letter saying that my child cannot go to school or something like, I don't know, but you have you can tell chat GP T that was a bad example. You can tell chat GP T. Oh, you know what you are you're you're an architect, you know, tell me how much it's going to cost to build a duplex, you can tell it you can give it the rules. So, thank you for that question. Okay. MCGS. I couldn't change my name I'm Linda Morgan Clark. That's an acronym for the genealogy society I was just on a zoom call. But, but I'm with the two nonprofits the genealogy society as well as the community food pantry. And the thing that as far as the food pantries concerns which I do write grants for fundraising letters, thank you letters. I am working in my mind what to do with some reporting that I've got coming up on a couple of grants. The thing that I have learned, however, from the genealogy community and using artificial intelligence and particularly chat GP T is to remember that it's about words and not facts. So it is helping you write good script. And I always ask it for two or three versions of everything that I ask it to do. And then sometimes I can tweak a couple of or merge a couple of them or whatever and make them more human sounding. But it is, it's about words and not facts. Now. I use being a I for facts, because it does do a better job of getting you some good links to check out and verify. So it has to do you need to learn what chat GP T does what being does where it gets its information and that kind of thing so that's what I have done is I've really delved into where it gets where each one of these gets its information. That helps me understand what it's trying to do. That was great. That was great information. And what I want you guys to do you know this is ED chat we chat with each other go on and in the chat room and answer some of these questions for some of your colleagues because we got a lot of questions here. Go ahead user Kelly go ahead and unmute yourself and then I'll get to the Q&A for a second. What I have done in a lot of cases is, I will put in something that I have written and then ask it you know hey identify my main points or find gaps in my right. What are, what are points that I need to develop more and that way I make sure that it retains my voice. Because I do want to make sure that you know I'm still being authentic to myself and to our brand. It's strengthening my writing and not just replacing it necessarily. That was good. If you guys don't want to wait anything. Those two comments were very good. Thank you Kelly I appreciate that. Hi coral. Go ahead and unmute yourself. One of the things I have found to make it easier on us is to not delete all come all conversations. Because as you write more into it it will pull out from the information that you have already provided. And in terms of facts and data and statistics for grant writing. We're supposed to already have that before we sit down to write it. So, for instance I would say, please describe how the funds will help us in XYC utilizing the data that I will help this many people, and this amount of time because of whatever statistics I have, and it will pull it in. If I don't have it, I can then insert the sources myself. Another way that I'm using it as well is for the domestic violence advocates they do social media posts and sometimes they say well I want to say this with this post. I'm going to write a social media post and engaging social media posts include emojis that includes this information like for instance we had one where it was related to swim safety tips for kids and I had all of the list that I had received from the advocate. And then I made my points and expanded of them it had the emojis in there and then it also linked back to our site. Very nice. So it's just a way of, if you delete the information it stops knowing about what you are doing. And the more, the more that you are using the specific terms if you're writing donations, asking for donations for a specific event. It will pull everything that you already told them about the event and then sometimes they add something that you like, oh, I didn't think about that idea I like that idea but let me not add it just now until I can develop it better. And that's how we've been using it and it's is helping us increase our social media press and it helps us with the communication with donate donor supporters and our newsletter as well. So thanks for sharing that. And I want to mention something. She said something really, really key about erasing. I've gone back to check GPT a couple times and what was gone so what I want to recommend you all is when you get an answer that you like or even if you don't like maybe had a power sentence and they're a power word that you never heard of copy and paste the answer that chat GPT gave you in another Word document so you can have it because it could change I mean they could shut down tomorrow so you just never know so I would get in habit of saving everything so what I'm going to do is go to the Q&A for one second Daniel I see your hand Claudia man and ask I see your hand raised give me one man and go to the Q&A and I'll come back to you guys. So Randall said it's impossible to people both using chat GPT for the same grant application could come up with a dental grant proposals. Oh, that's a good one. And I would I would love to find out so if we could test this before the end of the webinar. So somebody put a question in the in the in the Q&A for me that a grant funder would ask and then Randall if you do you have chat GPT open you can unmute yourself. If you have the question and I have questions I'll put it in and let's see if it gives both of us the same answer. So if you put the question in Q&A say this is for Randall and Aretha and just ask us a question. Randall and I both put it in Q&A and see if we come with a chat GPT come up with the same answer so Henry I'm not sure what your question you said how about ethically I'm not sure what you mean by that if you want to rage do your raise your hand options. And I appreciate Jean going in here and ask some questions in here and you guys go free this is our conversation this is just you guys can go in the chat room and answer questions. Have you compared chat GPT versus being versus bar for grant application. Has that been anybody in here have you compared those just put it in the chat area. So I'm going to go to Daniel real quick then you can unmute yourself please. Okay, hello. I just want to reiterate what in CGS I forgot what you're what it stands for but we break out into but if you want to find information do not use chat GPT I will recommend using part being you know anything that will give you a reference. First of all and or use the or use the plugin if you have the plus version and second, going back to somebody asking chat GPT to fact check or the things that you wrote written you have written whether if you have missed anything. I would always always ask tragedy, say if you say okay, did I mention some. Did you mention, say the stats specific stat always asked chat chat to fact check the cell. It's a learning chat box so it's really good at learning for its own mistakes. So always ask it and ask it to reference the direct the exact paragraphs that perhaps that you're looking for so that you can. So that's so you know for sure. Yeah, that's that's all I have to add. Awesome. Thank you. And for those of you who are just joining us this is being recorded we're going to send the video replay probably later today, or early in the morning. Because I know there were questions that were asked that were already answered so you'll be able to hear those as well. Claudia, you can go ahead and unmute yourself. Hi, thank you. I'm Claudia from Latin advocacy network so we provide immigration legal services and for us was like kind of very difficult to start because we were very sensitive with information and it's very, very important that we learn to try to try charge it as a tool and just keep in mind that is just a tool just like Google just like whatever you have to just check information for us was very, very useful for as people said to write better emails better letters, but also I started for example to look for very specific grants like which is the best grant in California in this area for pain offices space like something like that and I got like really good results and like all the information was very useful. I also use it for the agenda for meetings. And also if I have a plan like a project, I also use it to have like a map of how to how to develop my project and gives me a lot of ideas about it. And let me check what else something that I found is like when I asked statistics one like numbers. I got information which sound very interesting but then when I asked like, which is your source, and it just, it just referred me to this big nonprofits and this report that has like 300 pages so I, I was thinking, yeah there is no way I will use that because it's time to read all of these 300 pages and I'm not sure so you have the feeling when it's something that it's not really something that you will use. And yeah, I would just say keep in mind is just a tool do not share sensitive information I never ever put names of people or I don't know like something like more specific about the organization I try not, you know, just not share that. And I think that's it. Awesome thank you so much. Aretha I think you muted yourself. Yeah, man go ahead man. Okay, so I'm not real I don't really use the chat box but just now and then it wasn't for a grant but it was for just a social media post. And I'm suicide prevention and drug overdose, and I have this event that I'm taking out military and their families over the weekend and so what we are doing is giving away free Narcan and free gun locks. So, we're paddle for suicide prevention so that's the other thing we take out group therapy on the water with paddle board that holds seven people but get going to what my post was here we're I'm offering to give away the free gun locks and the chat end up really like coming up with an analogy of what I wanted to say but it also like one of them to surrender their guns. And I was like, well, I was really kind of taken back by that because it literally went down that path and I'm like well I'm giving them free gun locks I'm not asking them to surrender their their guns. I kind of worried about that because I have heard that behind it when people are looking at you whoever's running all the chat box they can be, you got to be careful if they're politically driven. And so that was kind of like a red flag and I was just and I rewarded it because I'm like well that's certainly not what I'm asking here. And then once I reworded the question like you said, you know it gave me something that I would post and that we were actually doing, but it did kind of scare me why that went in that direction. And then someone else that I know she trains animals she's part of the family she's the daughter of the Barnum and Bailey's circus, the ringley circus here in Florida and they she wrote something in the chat box and it was something with animal training that all of a sudden these animal rights activists like type of answer came through. And she was kind of like a heads up for her a little bit too. So, I think we do have to worry about who is actually monitoring and who's on the other side because if it is politically driven that's the last thing that we want to see. Yeah, this is so, so good. Thank you so much for that. And that's why I wanted to do this executive director's chat so we can see each other space here each other boys here are experiences share your, your wins your those points that you just made man about paying attention to those kind of things that's very interesting. Yeah, yeah. Yeah. Ash, Ash arts. Go ahead and unmute yourself. That's actually crystal again I had to log in from my personal computer I was on my work computer before. I just wanted to say that one of the other things that I have done is, you know, because I'm seeing in the chat, you know, barred versus chat GPT versus other tools and to be honest, I think a lot of these are using some of the same engines and ai underneath. So don't assume that because it's got a different window dressing. It's a different tool. What I have been doing is using both chat GPT side by side to barred. And I truly believe that barred is using chat GPT engine or some of it, because some of the information is coming back is the same but don't be afraid to correct the AI. I've had it make up whole people and I just went right back into the chat and said there's no such person as this person, and it's come back right away and said, oh yeah you're right sorry I'm just a chat box and I'm just learning, and literally it's done that. I got the fact check pretty much everything that it comes out with numbers in regards to people. But as you start doing these correcting and slapping it on its hand. It gets better and never delete any of your history because it uses that history someone else just pointed this out to remember and refine the data that it gives you so it gets better as the more you use it but try feeding it facts first before you start asking it questions. Yeah, that was so so good. Thank you guys so much. I was on mute. I'm glad I was because I just laughed because I too have seen a chat GPT said I don't know how people feel I'm just a chat I'm just artificial intelligence so it does say funny things to me it's not funny but it was funny at the time you know so that was good thank you for sharing that It is funny. It is funny I giggled. Yeah, I'm really real so don't believe nothing I'd say, but so I want to get back to using it for grant writing. For you all who all of you need grants that's you know how you sustain yourself through and a grant doesn't always mean mean writing it could just mean you know conversation assets right for a donation is a contribution but for you who are using it to ask for contributions. Again, just keep in mind. Put some put some facts in there if don't say tell me how to do a fundraiser. It's going to give you anything you need to be specific you need to say, I want to do a fundraiser I want to do it at the, you know, Rosen hotel, and is going to see the thousand people you You have to give it data and feed it information so I really appreciate everybody's point. I'm going to go back to the Q&A section because there are some I know I did not answer. Jim you I hope I'm saying your name right it's jai you can we use chat to be teach override the AI generated content. So chat to be T is artificial intelligence so I don't know when you say to override the AI generated content and you may want to come online and ask that. And, and this is your somebody is requesting to record this locally so. Sorry, we're going to send the recording out go ahead I see you go ahead and unmute yourself to me as I say your name I help I'm sorry if I'm missing it wrong. Go ahead and unmute yourself. You still mute it. If you're speaking. Yes. Okay. I can barely hear you, but we know you're there. Clearly. Yes, yes. Yeah, my name is Jeremy you get this correct my name is Jeremy. Okay. So the question I'm asking is like just a question about it is like, you know, a lot of organization, maybe let's say as a freelancer. Maybe. And a lot of people do not support your application. So the question is like. It can. Like, so that the, any other he had to kind of be the, cannot take the content. Okay, I got part of the question to anybody your phone was breaking up your sound breaking up so I'm not sure if anybody got most of his question. Maybe try to type it in the chat again. Sorry about that. No problem. No problem. So someone asked about images to chat GPT do images. Yes. At the beginning of it, I showed you where you could either have a conversation or you can click on the link that says, you know, create images so it does create images for you all so hopefully that helps anybody else have any questions or comments I would love to do an example for you all so I'm going to ask a question but no one put it in the chat what question you wanted both of us to look at. Go ahead and ask arts go ahead and unmute yourself. It's just gonna say one thing. And so I put it in the chat but I'll say it here too. So for organizations that deal with persons of color like ash arts and stem. Some of the information this has been talked about on social media and other places as well. The chat a eyes are still learning how to deal with people of color terminology surrounding people of color so yesterday I asked it to give me the names of BIPOC persons in arts and stem who had overcome adversity in their career and gave me back a bunch of names. And it started giving me pictures and it started giving me pictures because I started asking it to give me images. So it started giving me images every time it gave me names. And three of the names were indeed people who'd overcome adversity and arts and stem but they weren't BIPOC people. One of them was a made up name Kim when with a picture to go with it that wasn't it was a Kim when but she's not what they said she was. She real names I'd never heard of and so they were good people that I could use for my social media posts. What I did though is I went right back and I said you know and I named the three people. This is a Caucasian person they are not BIPOC this is a Caucasian person they are not BIPOC and it immediately apologized and you know I know that it takes that information in so it won't spit that information back out again. So you kind of have to correct it when it does it but do be aware that not only does it make up people it doesn't seem to understand terminology like persons of color black Caucasian BIPOC it just you know you have to kind of teach it those term and terminology so it understands how to get back the information you need. Very good thank you so much. And so an anonymous show I'll come back to you in a moment and I'm so tight so what does this mean for us who make a living writing. I understand the excitement for all those who aren't writers but we've spent years perfecting our skill set and I'm going to tell you from experience because I was a grant writer for HUD United Way. City of Orlando, and I was also a grant reviewer I think that this tool can help you save time because if you're a grant writer, you know, doing the research is it takes hours doing research, and you might have copies of your grants in different places or on your computer, but I'm telling you this will speed up your process, because I've already used it and it's definitely made a difference so I think use it to your advantage I don't think it's going to. You're not going to lose your job. I think it can only enhance if you use it to enhance your skill you don't have to use at all, and don't think that you know. People who have nonprofits are going to use chat tbt to to write their grants for them is still a grant writing is still a skill set that you have to have you have to know, you know, just a lot. I can go on and on about, I'm going to let Cheryl answer her, ask her question go ahead Cheryl you can unmute yourself. Thanks for taking my question. I just had because I couldn't access the q amp a. My question was just about how at universities now in Canada I'm not sure about in the states but in Canada that we have a lot of AI detection. So, my question is, when it comes to using any type of chat AI or anything like that any AI. What type of. Well, I, I guess my concern is, are there any grant organizations now that have the type of AI that universities use to detect that you're not writing at 100% from your organization if that makes sense. Well, what I want to say is, I don't think that chat tbt can can write for your organization 100% because there's hundreds of you on here and if you if you all served the homeless, your grants will still be different because it's for your demographic is for your your zip code. So there are things that are specific just to your organization. So don't think that it's going to be like, Oh, this is a copy of theirs because it can't be identical. You know, you may have a power word or power sentence in there, but I don't think it's going to be identical. That's just my opinion anybody else got any thoughts on that. Because it's happening also with an HR right where people are using AI to write their, their cover letters, and also their resumes and they're getting, of course, getting picked up by these by smart technology with companies so my concern is really that if you use it yes you can tweak it to your own, but how smart is on the other side or is their AI going to be to be able to say okay well they didn't write most of this, and just kind of weed out applications that way. That's a question that we may ask some funders to come on and answer that because that's a great question. I want to see if are there any funders on here I know a lot of others who are on our webinars who give out grants. Usually Lisa's here. Is this my Lisa. I don't know if it's the same Lisa go ahead and unmute yourself. I don't think I don't think I'm the year Lisa. I'm, I'm, I can just have a couple of broad I guess philosophical questions that can follow on with Cheryl was just saying, I, my question in the Q amp a was yeah, or is there a place we can go to actually read about how funders are moving to the AI generated proposals and you know what I'm sure there's conversations about it you know going on behind closed doors I just wondered what, you know what they were thinking, and I work for a nonprofit news organization and we specialize in investigative news for North Carolina, and I guess I'm concerned as Cheryl may be alluded to that that our readers may be skeptical if you know if we're using a I to help even our journalists, you know gather data. So not necessarily writing stories but you know gathering the data and things that we've talked about so far in this webinar, but I'm worried about the perception I guess I'm concerned about the perception coming from readers and funders and donors and, but I'll stop there it's more more more philosophical questions if anybody has run into that. That question though, and that's something when you close or when you leave this webinar you're going to get a survey and it take you a minute to fill it out I would love you guys to put on there that you want to hear from from some funders that may be reviewing this or so I would love to hear more about that. Jen, is it Jean or Jen. Okay, and, and I used to work for a funder and at the time what we really leaned into and was a small community foundation, we really leaned into understanding who that organization was so if it sounds fake to the writer, it might sound fake to the funder. So as a grant writer make sure you're not you know just sounding really authentic about your organization. And that's kind of where we largely geared our granting towards we weren't really super picky about punctuation and all that stuff because we knew a lot of the smaller nonprofits didn't necessarily have the ability to hire a professional grant writer. I can just see this as something being very beneficial because we did have a number of English a second language organizations applying and they had trouble finding the words. And we always constantly had to keep reminding our reviewers that we're not checking grammar. So we are going after what the causes, are they able to do the project they say they do, and to meet the missions that we want to meet. And that's what it boiled down to in the foundation world for us anyway smaller foundation so very good. Thank you. I appreciate that. So, um, Joe, Joe Han I hope I'm pronouncing name right you put a question in the chat you wanted me to put this in chat GPT. The question was, I'm not going to read the question because it's a math question but I put it in chat GPT and chat GPT gave me an answer I'm going to show it in a moment, but Gavin said can you please do an example of how chat GPT will help with it. In the aspect of writing a grant. So, um, your question is a little vague I wish it was vague to me may not be vague to you. I wish you would come on and like ask me a question or put it come yeah come live and ask me a specific question to ask chat GPT but I can put that in the chat and see what it says. How can you help me with an aspect of grant writing I can ask chat GPT that but while I'm while I'm waiting for you to come on and I see your hand. I'm going to ask just one second. I'm going to share. You see the answer about the math question you ask. So the question was I have a circle with a diameter of three millimeter. How do you calculate the length of the court so this is what it gave me, this is the answer that it gave me. I don't know if it was right or not, but that's the answer to gave me for the time for the sake of time I'm not going to try to look it up. And plus, I did very bad and mad. So, I don't think we're seeing your screen. Oh you're not. Are you seeing any screen at all. It was black. It's just dark. I wonder if that's chat to be doing that one second. Hold on one second. I'm trying to do that. Go ahead and ask and ask your question. Oh, I was going to say I see a lot of people worried about or expressing concerns about AI, you know, being inauthentic people using it, you know, to write their entire grant and you know, using it for filling a job applications and all kinds of things the truth of the matter is, I've used a number of AI services. And at the end of the day, it has to has to work with the inputs you provide. So the data that it puts out is based on the data you put in. And if you're not giving it any information you just take what it says, you know, on face value without, you know, vetting it without refining it, then yes you're going to get all those things that you're worried about are going to come out of AI. It's a tool it is not meant to be taken verbatim. If it comes out like I just typed in to Bard, you know, what is ash arts and stem because I want to see what it came back with and surprisingly except for one small fact. It came back with the information I have been teaching it for the last two weeks about what's the response when people ask what is ash arts and stem and it's exactly the answer I would want to give. And the long form answer. So it's only as good as the input you provided and you're not obligated to take what it pulls out and use it verbatim and anyone who's doing that you're going to find you're going to get less than desirable results anyway. You're just going to take and accept what it says and just copy and paste it wholesale without vetting it without, you know, refining it. Then yeah you're going to get some of these fake results that you know are meaningless and even in the job search because I am looking for a job right now. If it writes a cover letter. It's only writing a cover letter based on the information I've provided it about me. And I have to vet that letter and say does this ring true is this sounding like my voice is this something I would write, and I don't have to accept it wholesale. I can, I can refine it so it feels like my voice. Very good. Thanks for sharing that. And I want to say, I see a lot of comments in the chat somebody's like, we should stop right now before this all gets out of hand. I totally get it. I was not with with chat GBT until a friend, you know show me that she accomplished a lot. And so I was like okay let me just try it and then I could not stop using it. It's just like the phone when we when we first got our phones and our homes. I don't know if you remember but we only had we had an upstairs downstairs, and we would have to run upstairs downstairs to answer our phone now we carry our phones with us everywhere we can't live without it and so I think artificial intelligence is not going anywhere.  It's not going to they've been using it, but I think they're allowing us to use it. And for whatever reason, I don't I don't want to get into it. This is a conversation that we're having this is not TechSoup trying to convince you we don't have it on our platform to offer it to you. This is just a conversation for executive directors to talk about how you use it for your advantage and I appreciate all the comments that you've shared and all the feedback that you've shared with each other. So I want to answer your question that I'm going to do one demo for the gentleman that asked for demo, go ahead unmute yourself coral. I just wanted to point out, Dr. Ron posted an example of how our funders reacting to grant proposals or use AI on the chat. The same question on my chat GPT and they completely gave me a different answer to what he received. And he broke it down in the way that I write in the way that I feed at the information and it goes back to what you were saying we cannot take it at hand we have to go back through it. We had to tell it this, we had to take the information and edit it as well is the same as reading a news article you read it and then you said I want to learn more so you go to a different source to see what they're telling you about. So, same questions to completely different answers, because it's based on what I had fed it what I wanted to see and what I wanted to sound like I do a lot of give me a tone of engagement and give me a tone of friendliness give me a tone of positive attitude to try to get my, my information across and that's what it feeds to me and is similar to how I write in in real life without it's it's assistance so just wanted to say that for everyone. Thank you so much I was trying to answer questions in the chat in the Q amp a. So what I'm going to do I'm going to try to share my screen for the last five minutes and see if we can get some questions answered and make sure that you guys can see my screen one second, the right screen that is. share. Can you see the screen this is chat GPT. Yes. Thank you awesome. So, um, the other question I'm not sure what answer you got this was the math question I may not have asked it right. I asked it says here's how you do it Oh so it didn't give me the answer it tells me how to do it so we're going to go ahead and pass that since we're talking about grant writing. I just wanted to entertain your question, but someone asked how can chat GPT help me write a grant so I said, how can you help me write a grant I'm going to say this, you guys can type something in the chat you want me to put it in here. This says, I'm happy to assist you. I always imagine what the voice would sound like. But as you can see, it just kind of gives you that but then if you want to be specific, and I'm going to ask it something else it's still talking it's still going on and on and on as you see this little dots right here going. This is still writing is telling you the project plan budget. This is something that somebody was asking about being a grant writer or how do they help with the grants. Something you can give to your, your people who want you to write a grant so that's the look in grant writing. So I want to say, I have a. I'm just going to put this here. And I probably spelled it wrong because I can't see my screen one second. Yeah, oh yeah I did definitely spell that wrong. And I'm going to put a city I'm going to say, um, I'll put a dollar sign in here rehabbing. I'm not just that spell that right. I'm making stuff up. So let's just see what it says, while you're doing that I'm going to check the chat. Oh, somebody. Okay. So basically wrote a letter for me. You guys see it. I like this. And you don't have to use it word for word so you know the grant writer saying I wouldn't copy this and put it I would make it my own I would add some more things in here. The primary objective I like this. I love that I love just that sentence right there I love that but if you want to add some more why you're doing it. So here it is a project impact. And back to the question how's how is it going to affect us. It did that in a minute. I could not think this fast. So you see, it has is advantages and I want you guys to use it for your event oh it even talked about the project plan. I didn't think about that, because people want to know when you're writing grant what are you going to use their money for what are you going to use that investment for, and here's a breakdown doesn't have any, any breakdown of the numbers yet, because I haven't scroll down. Here's a but boom there it is sorry. It beat me to it. But there you go. The prompt again. Huh. What was your prompt. I'm going to go back to it I'm just want to just see I think. Yeah. Okay, so my prompt was I'm scrolling up. I have a homeless shelter in Arcadia Florida can you help me write a grant ask for $100,000 for rehabbing a home that was donated. So that was my prompt. So that was that was the example. Thank you guys. Lots more questions in a Q&A. And we're almost out of time if would you like to do this again put a, put a yes or no in the chat. And we can be more specific in what this chat would be about. We could do it next month, or the end of this month, if you want, but put that on the survey that you thought so all yeses all yeses awesome we can definitely do that. So you know what you guys can do on your survey. If you want to have me ask a question on the on the chat be GBT put that on the survey as well. So, can we do one coming up with good prompts for chat. Yeah, I like that Kelly can you please put that on your survey, or I'm going to put my email in here guys, even better yet because I may get 200 surveys. So there's my email. And also, if you guys, I don't look like I like to talk but I don't.  Please let me know so there's my email. I want to thank you all for your comments. Thank you so much for your thoughtful, impactful, enlightening. Conceal you can see your email please. You can't see my email I put in the chat but it's a text. Okay, a Simon's at TechSoup. Guys, thank you so much ladies and gentlemen thank you so much for being here today I want to give you back your two minutes of time. It's a zoom thing. I cannot save it. If I were we use this on an open platform. What I'm going to do I don't even know how to send this to you we use slide share for our open platform for sharing because I can't send this to everybody because not everybody wants that information sent out to everybody on the chat. So, if you want the chat, email me, and I will email you the chat, please. On the bottom of the chat screen where the three dots are if you right click on that it'll tell you. It does not it does not work unless you're the admin. Yeah, okay. It does not always work so even I'll put my email in there a Simon's at TechSoup please email me if you want the chat because there was a lot of good questions and comments in the chat. Again, thank you all for your time. Miss Jean I hope you stayed on for the whole time. Thank you guys have a great day. Bye everybody. Saving the chat for me. Oh good. Thanks for letting me know. So that worked for you. That's good. Awesome. Bye guys.


Good all right. Welcome everybody to the second day of Academy. We've got our buff wrap up and the buffs I hope have prepared short and Succinct Statements about what they've reached today. I'm gonna start off with the XR desktop the VR happenings Does anyone want to tell us about VR Christoph? Yo, hi So I made the XR desktop bof today So in the first part we had some new people try out XR desktop who had not tried it out on the weekend yet I got some early feedback from those users thank you very much and In the second part I started to go through some of the remaining issues that we have and I also got some good feedback about how to solve them. Thank you very much, too The second buff in that room was the j'compris bof run by Timothée so So for the j'compris bof we were only four person so it was Very quiet there were first we discussed with close about moving the new Documentation for j'compris for users to user base instead of our own wiki and same for the contributor part to move it to community wiki and then With ish we worked on or she started to work on new options for accessibility to make some activities usable for disabled people and Aman helped for that That's all Thank you j'compris Moving on to the next room you to oh a to be started the day with kitty ev fund raising please Hello this morning. We it was very productive. We were able to set some goals for our fundraising working group We are keep pushing the accident people to get PayPal fixed and then with that we will be able to do some planning for our future and Related to for the race campaigns and some promo campaigns together with the kitty promo people to keep our Contributors Happy and updated with the stuff amazing stuff that we are doing and Thanks, Lydia for trying to bring some consistency to the working groups. I like that a lot. So it's that Thank You ladies and the fundraisers Elvis is right there and Yeah, Elvis is in the house But he's also the one buff organizer who's written notes and linked them to the wiki Everyone remember Link your notes to the wiki And now you get to tell us about it Yeah, so this was the first dolphin buff in a while. So that was nice We talked about a set of things resistance We would like to adopt K user feedback, but we need to figure out how He would like to move to github and we need to figure out when And then There was Alexander that's talked about his Kio fuse project Which was highly requested by users That's almost finished. We need to We need to finish it and release it basically and Then finally Maven talk about this recent work on the places panel and How he is going to improve on that later? That's it basically Thank You Elvis Carl ran the website buff.  We spoke about the current state of the websites so we have a lot of websites in multiple technologies and teams and Yeah, and then we move it to the One of the first things I needed to do it's a movie away from the capacity from work it's all framework from the what is Maintaining as a website from the caddy here And then we spoke at some of the primatics for example the transitions Because we need to capacity for the transition of the website. We need to find the anniversaries Okay, what's it? Thanks, Carl you do amazing work for us Kai. This is a notification Respond to the notification K notifications with Kai So we brainstormed ideas on how to fix the history because I'm well aware it's not idea right now So stop sending me back reports about it We also brainstorm ideas for a new K notification class with your dependencies and platform plugins and stuff like that And also less surprises in using the APIs which leads to bugs and crashes and of course the notes are linked on the wiki page Good show the next four buffs in that room or plasma plasma plasma and plasma, so I'd like to call on Bushan Let's delegate to Dave hey Dave Everything was cleverly split into independent modules the first discussion was system settings where we discussed system settings Topics included dealing with the legacy modules, which we decided we would fix it how to integrate plasma settings and the general system settings And we decided we would fix it a inconsistency in list views and we decided we would fix it and Then we had a big heated discussion about instant apply Where we didn't decide anything where we said we would fix it Yes, phony was that simple vision We we kind of decided that it would be tried as a pilot on some modules probably How actually sheep to that to the users and communicate that to the user without having an inconsistent Inconsistent thing for a long time that is a problem that still needs to be decided and now a note on the wiki motion so We had the plasma mobile pop from the at 1130 and We discussed I mean like lots of topic and we actually eventually run out of time So there is a possibility that we might organize another buff on the Thursdays to get rid of remaining topics But mostly we discussed about how to reach out to more developers and how to improve the current state of the plasma mobile and how to How to make sure our website is up to its standard and things like that We have not added notes in the wiki page We have And After that we had this walk about plasma on your toaster devices, which was kind of lie Plasma will never run on your toaster But nevertheless, we discussed about having pity plasma or pity technology on this specific set of embedded or IOT specific like devices and we also seen a demo of a plasma nano shell by Marco Martin and There was some ideas around how this technology should be Distributed or how this technology can be better demo to the internet parties and Yeah, that's it Thanks, Bushan. Next up in that room was neon the road to 2004 Hadalds tell me I'm wrong You're not wrong except it's not pronounced 2004. It's 2004 So we looked at the possibility of the very likely an entirely feasible cause a possibility of us moving to an Ubuntu 2004 base when it comes out, which will be in 2020 hence the 20 Unfortunately Fortunately the last time around we figured out a really good process So we basically made a list of all the stuff that we need to do and it's gonna be awesome and should be much faster than last time Thank you. There was a GPG signing thing run by Hadalds. It went well We mumbled numbers at each other it was great fun. You should join next year Moving on to the next room in the morning. There was the KDE India Bob So KDE India Bob was mostly about Why we were not able to host comparing for last two years and How to make the next concrete in actual possibility and Reality so we agreed that we have one when we have two possible venues and We should try and see if we can get confirmation from one venue by October month And if it doesn't happen, we should move on to second venue and try try and make this possible for at least 2020 because for 2019 it's kind of slightly overlaid and We also discussed about web our website and our conference website and I Think we I need to consult to call about this our new websites, so Yes, I think it was mostly about the next to the conference of pain at the 2019 very end or 2020 yeah Okay, bringing your KDE applications to more interesting places the KDE windows and Mac, sorry KDE craft both with Hanna Yeah, we I demonstrated how craft can be used and How easy it is to bring your application to windows if you're done your application, right and How you can get into the store later on so that was basically everything Thank you and still connecting up all the bits is the KDE connect both We were discussing how we can make KDE connect even more amazing and First of all the first step to this is to actually make a release with all the awesome stuff We've piled up for this we resolved a blocking bug and Now we can make New release soon Next we were Discussing some issues sadly with the latest Android version clipboard access is broken because of some Android privacy policy and We were thinking about ways how to make the features to work, but unfortunately we don't have a really good solution Next we are talking about a strategy for making a first Official release of KDE connect on windows and on Mac OS so those users can enjoy our awesome as to Then we discussed Refinements to the features we have particularly with the notification plug-in and Last we discussed how to tackle a certain privacy issue that we have in KDE connect So we can fulfill our goal of achieving privacy for our users, but unfortunately We don't have a very good solution yet, but we have some ideas that might be worth considering Thank you in the last room it was hacking all day and I didn't achieve anything, but other people may have so anyone wants to talk about their hacking experience so Two different bits. I was working with the post market OS team for Running for the issues which are physically kind of blocking plasma while on the pine phone and We basically made a list of various small issues and large issues and Try to see what is the product possible solutions for it and yeah, and I think it was quite successful hacking sessions Another bit was also Daniel was working on K-accounts integration with the K-mail and contact and We have now a create upon creating a new pop tomorrow at 1130 I think about the online account integration with the Whole of the KDE applications and the pain points about it. So yeah All right spiffy that wraps up the buff wrap up and I'd like to see everyone tomorrow bright and early and Don't forget the day trip and remember to link your notes. See you tomorrow