Success. Okay, we'll just pretend like it goes for two minutes, four minutes or less than that. Okay, so it's at the stage to remind everybody where we were. Right, we're back in, oh man, I forget. 1988, on November 2nd, when the first internet worm was released. Right, and so we eventually learned that it was released by a Cornell grad student that had a mistake in the replication procedure that led to unexpected deliberation. And they had to turn the entire internet off to get the fix out for this because as soon as you turn the computer on there's so many instances of the worm out there and it used several different vulnerabilities that your machine would get infected immediately and then it would continue to happen. So the worm itself is very interesting because it's really the first instance of a worm out there in the wild. So what do we mean by worm?  Yeah, a worm is a piece of software that doesn't require any trigger or something to spread like so it's just a piece of code that might be a bootstrap in the OS like it can spread and it keeps on multiplying in the number so if it affects one of the areas we don't know how much it has spread in the whole network. Yeah, so the big key here is that a worm is self-replicating so that kind of distinguishes it from a lot of other things. You think of it like, warming its way through the computer systems and we won't get into all the different terminology of all the different things and the important thing is here is once it gets into one system it then tries to look for other vulnerable machines around it and if it finds any it replicates itself to those machines and on those machines it scans looking for vulnerable machines and it infects those machines and it spreads in this exponential way throughout the network. So the worm specifically worked on some three systems and back machine computers running VSD Unix and so the worm consisted of two parts. There was a main program, so the actual kind of main functionality and a bootstrap program, that's what was loaded on a new system so on the new system this bootstrap code was sent, executed and that code basically went fetch the main code, compiled it for the system and actually performed all of the propagation techniques. So the first thing that a worm needs to do is to get privileged access remotely and here remember the key thing is that it's spreading throughout the network essentially uncontrolled or without any user interaction. And so it first had to get remote privileged access so it actually used I believe three different ways to get access on the machine. So one was it used a buffer overflow in the finger data so anybody actually use the finger plan though but it did Eric you want to tell us a little bit about it? Because I remember it, if you didn't know who a user was you could use finger and identify them and it would give you any, it was kind of like a profile basically. Yeah so you could, it was a remote service right so on any machine on the network you could connect to a specific port you'd query for a user and it would return back information about that user so it would say you know and they got to think this is way way way back before Facebook or anything like that right so you knew my user account you could finger my server and then it would tell you oh yeah this is how I'm going to pay this is this office, this is phone number or whatever whatever and current logins oh interesting so yeah it's not really used anymore but it used to be pretty important and there was a simple buffer overflow vulnerability in the finger server code and it basically looked exactly like this which we haven't gotten into buffer oversource yet but here we have a buffer allocated that line so line is a character buffer of 256 bytes and it's nullifying the very first entry of this array but the next grade is get so what does gets do? it takes an input and does what? modifies it? places it in the buffer what was that? places the input strings in the buffer yeah so gets will get a string from standard in and for every character just add it to this buffer append it to this buffer until I believe a control D is sent or a zero a null byte I believe is how gets work I can't remember the exact ending but if we could look up the man's page we'll give the exact semantics of gets which we will do at some point so there's no bounding on the amount of input that is going to be received here right it doesn't say hey only get me 512 bytes because that's all the states I've allocated in my buffer so essentially what happens is the attacker could send a bunch of code more code than the 512 bytes that the finger server was expecting and then it would overwrite the return address and be able to execute arbitrary code now this is just kind of like a teaser for the rest of the class because this is the kind of stuff that we're going to get into and this is the kind of stuff that you're going to be able to exploit on your own okay send mail what's the send mail server kind of in the name yeah send to me that's that's meant right it's a SMTV server so you know also a very critical part of the internet infrastructure right if you want to be able to use I mean I guess I can't 100% save for certain but I would believe that email is probably one of the original killer features of the internet right so you could communicate electronically with people at different institutions and it would be quick it would be cheap you know it didn't cost a phone call so this had so you know you're building one of these servers you're building this remote email client and it had an option that you could send when you're sending mail called debug seems legitimate right you're a developer you want some way to help administrators debug your server so you allow them to when they connect to the system to send mail they can issue this debug command to execute commands on the system which helps you as an administrator because now you don't have to go into the box and you know have an account there to administer everything you can just do it right from this nice little plan from anywhere and with this commands to execute it literally means any command to execute so whatever you sent it would basically just execute that command so this is bad why? you can step into the stack of the program you can step into the stack of the program I mean execution code yeah yeah so you're basically so it's just like getting a shell a remote shell where you can type in commands like a terminal on this machine remotely do any authorization access control checks no just let anybody do this right so the intended functionality of the server because they were trying to be nice and friendly to admins so anybody could just go to the server and send commands to execute so after one of these two succeeded it then would transmit a bootstrap program which was about 100 lines of C code then they actually compiled and ran that bootstrap version and then with the bootstrap would cause a transfer of the main program from the victim machine to the infected to the host machine to the new victim and then the main program so now you're on the machine right so what do you want to do you're the warm writer you're RTN back in 1988 a little bit before this happened use the send mail to send to run for the compiled C code that's already done yeah so that's what just happened so then the main program gets executed what do you want to do? bootstrap it on to all the next bootstrap those programs to all the machines in the network so you can infect all the machines so you want to infect new hosts but how do you know how to find the hosts? try all the possibilities of the IP address yeah one thing you can enumerate all of the IP address space and you can find the one you want to use what's the problem with that? there's a lot of IP addresses there's 4 billion IP address you can always use the instead and find the ones the ones that are connected so use the netstat and locate the IP addresses that your machine is communicating with and only use the netstat and route right so netstat would tell you what connections your machine currently has to other hosts so netstat tells you the current connection so that's how you can get to the valid host what's in the routing table? the subnets they are connected to yeah so the routing table says hey if you want to send a packet out to any of these other addresses you have to talk to this machine so they can do another machine right there what else? how do I find out about more machines? ETC host will contain like mapscanner or something to get the valid host yeah so you can do like a ping scan to ping maybe so maybe you can use the routing table to understand what's the local network and maybe if you could send out some ping from the local network or you can, from the ipad so netmask you can know how many was there in the network well it could be there right but we don't know the actions so what were you saying about ETC host? it has information of the system that has logged in to that particular device maybe so what's in the ETC host file? yeah so that's manual DNS entry mapping so manual entries between host names and IP addresses but hey that's another place and you know that if you put that entry in there it probably exists legitimately right that's a real host I don't know if I did it but you could query the what range they were allocated sometimes back then they had to I was going to say DHCP yeah I don't know I don't know I would assume it's done a little more ready some people will use SSH so you have a bunch of keys for different hosts or you have maybe the hosts that are listed or even your your known hosts file it has every single machine that you have SSH to and it's private keys so you have valid ID addresses there so they didn't have SSH at this time but they had the equivalent so yeah it's trying to find out it would look at network interfaces it would look it actually did use net stack to look at the open connections then when they got there trying to use RSH so RSH is remote shell so this is the precursor to SSH what's the first SSH stand for? Secure yeah so what's that mean about RSH where it came before not secure yeah so it had no encryption and often times what people would say is hey if I'm a user on this machine and I SSH into that machine just allow it because I trust this thing who wants to type in their password over and over again that's crazy so it would try to leverage the trust between two hosts so it would try to bring in one host and say ah if this is in your you know our hosts equivalent or known hosts they'll try to SSH into it because maybe you've already set up that connection and so it would gather information on the trusted hosts it would look for ETC hosts or ETC hosts equivalents our host file which allows the administrator to specify trusted RSH hosts and also the dot forward file is the dot forward file close yes it's forwarding I believe mail so it's for so when the mail server gets an email you can say hey actually all email for this user forward it to this other system which means there's probably another trust relationship there and so the system the warm would try to spread throughout there so first we try to RSH to the reference host right so it's just trying to say hey can I get there right because they're already set up a connection there then it would try a password cracking attack so it would look at the ETC password file where all the Unix the Unix stores the users and the hashes of their passwords and then we try to crack it with the dictionary and all this stuff so it would try to perform a dictionary cracking attack to be able to then go to that user to try to find out more information about the hosts and transfer to machines and so then when it broke into the other machine right this process was repeated so then the bootstrap of transfer that's being probably on execute so it tries to go and get down to more information in fact to more hosts and so just by doing this it brought down the entire machine like a day so let's say you write this right and you let's say you don't want to release it you want to release it whatever we'll assume you're a bad guy you want to release it where would you release it at or be your infection site in the public workstation a public workstation where here it is you open networks yeah I don't know what I'm going to do in Tepe I drive down to U of A and you would release it there or you'd ask your friend to do it maybe at some other university across the country same thing happened here so the initial infection started from a server at MIT so they think it was a little bit of trying to throw them off the trail and get them to be looking at MIT students when they was really at a different place so now we get to watch this awesome so this is the CNN coverage of the attack on your head it's too big okay we're going to have to deal with a very tiny, tiny view screen so let's refresh this I've seen this video it works and this is hilarious this is a broadcast on the day this happened life in the modern world has a new anxiety these days just as we've become totally dependent on our computers they're being stopped by satuers satuers who create computer viruses the defense department, universities and research centers are still recovering tonight from a computer virus that brought a nationwide network to a standstill one of the institution's hardest hit was MIT David Boyer reports it was first spotted at NASA Ames at Grand it came from California maybe traveled by a electronic mail it spread across America how insidious was this virus it spread very quickly there are reports in newspapers today that it has made its way to Europe and to Australia it arrived at MIT in the middle of the night the students were safe their computers weren't it just ran it would do its thing it would go to other machines at MIT 200 computers were infected a country that told might be 6,000 we believe it was intended to spread more slowly than it did so that it wouldn't be noticed as quickly which would actually have been more insidious if it's spread out to a large number of machines and say held a surprise and did something Mark Eikin students in a part-time virus once we had it stopped we were able to take it apart sort of like dissect it and tear it apart piece by piece at least three processes right here these three programs the SH with the primes are in fact copies of the virus that are running there it's not really a virus it's a code a set of instructions an act of sabotage that started on a floppy disk this virus spreads by disk and by telephone it's just a call away and like a virus it replicates like crazy look at this and look at this and look at this and as it replicates the code the so-called virus it wipes out stored data or cripples the hardware but this virus clogged the system many thousands of computers but it did no damage but it's benign it's not malicious and it has to do no damage besides propagating itself and that's why I think it's a warning the suspect somewhere a dark genius I suspect it's an A student a good A student so lost computer time but it's real for the virus and a warning my personal speculation is that this is somebody who is trying to to warn people to say it can happen to you we know you've been able to isolate the cause someone called it is everywhere and there's no one that's a good enough news I'm David Boyer what do you think seems like a millennium that seems crazy 6,000 computers were affected oh my gosh that sounds crazy think about it something like that happened now and was able to spread to all the machine the numbers would be in the millions maybe billions depending on how much you get to spread if you get to spread on all of your mobile devices your tablets the computer that's inside this thing on the front of the screen here that's crazy to think about that's crazy to think about to think about how terrible a broadcast that was they just took clips from a movie that's not relevant to add some dramatic effect or something and just noticing it's self-contradictory they say in the middle that crashing hard drives or something and then towards the end it's like no damage happened to any of you I think they just got confused because nobody could access their files in some sense they were gone but they were still there when they fixed everything any other comments on the video things you liked for hair at the beginning so then we turned our attention a little bit more forward in time to Kevin Mitnick who's one of the most well-known hackers I would say who would you guys say best known hacker I mean you take a hacker and a real person who you take a electron the guy who goes with the name electron I don't know what does he do he was an Australian hacker he had a bunch of like news networks and stuff interesting anonymous anonymous it's hard to give a nice story about them so much about them too much Jeremy Hammond who's he, what's he done use the hack this side a lot of deep and you go to NSA and send it for 13 or 14 years so Kevin Mitnick he's in my mind one of the most well known hackers maybe it's from in the 90s but he's still around today in his history is a very checkered past so in 1981 he had a one year probation for breaking into a lot of Pacific Bell's offices and what he was trying to do was he and his little crew they broke it into the office and they weren't even messing with the computer system what they wanted was a free access a free way into the networks so what they did is they put their card in the VoloDex of like allowed people in their office but that way what they called them and like this is Kevin Mitnick I want access to your systems like I'm a technician I have to you know do it now and they say I've never heard of you well look in here boss put the thing in the file and they look in the file and they're cool like I'll give them whatever he wants so that's why they broke in there but eventually they found it then he he then enrolled at USC and uses some campus machines and he leaves the activities where he was sentenced to six months in juby and you'll notice like a trend here he keeps getting caught and like not not doing bad stuff so he breaks then breaks into the San Diego this I don't know SCO which was a company I think he was trying to get software I believe and so he was they found him they caught him he was sentenced to three years probation he gets expelled from another institution after he gets caught he breaks into the DEC so he was caught by an FBI he got sentenced to one year's sentence what was three years probation for? stealing software I think that's no but he hacks again in 1980 oh yeah full probation just means you have a probation officer that watches you like you're not in jail you're out of jail you have to like but it's not like a fun process you have to like check in with an officer and all this stuff and if you violate your probation then you go back in the jail at least that's my understanding of it if somebody knows better he got like a personal experience you want to share that that's fun too so then oh yeah so in 1992 he violates his probation and he goes into hiding so Kevin Mitnick's his skills so he's a very sophisticated hacker as we'll see in a second one of his really big skills is social engineering so he was able to break into systems without even really breaking into them just by tricking the human on the end of the phone to let him in so 1994 the California DMV issues a one million dollar warrant for his arrest which is pretty crazy right that's kind of you know one of your other hackers stuff and he's in hiding he's accused of invading the San Diego supercomputer center it's actually a really cool attack that we're going to look at so this attack so he is trying to break into the supercomputer center he wants I don't know if he's doing it for the fame or the talking about money really at this point he's on the run and so this is actually a very sophisticated TCP spoofing attack so what's one of the what's one of the basic differences between TCP and UDP it's connected let me go on UDP UDP is unreliable and connected right so UDP you can just send a packet it has no concept of a connection TCP you have to do a three-way handshake right so we have to I send you a packet you send me an act and then an act and then we're good to go when we start talking right so there's a three-way there's a three-step handshake for us to be able to communicate with each other what he was able to do is exploit the trust between two hosts in the San Diego Supercomputer Network so there was an external machine that was a spark station it was running so large one it didn't have any disks whatever the details aren't super important there was a server so there's a host that provided boot images to this X terminal and the X terminal allowed unauthenticated logins and commands coming from the server right so if you were coming from the IP address of the server into the X terminal right you could execute any commands that you want it makes sense it makes sense as a security measure because you have to establish this three-way handshake if you don't complete that third step of that handshake then you're not going to establish a connection so yes you can spoon one TCP packet but in order to communicate you have to do that whole handshake okay what he found out was that it was actually not easy but pretty easy to do this so he first took down the server so he did a denial of service and a bunch of packets to the server so that the server wouldn't respond to any packets then he impersonated the server well if that happens again we're going to have to leave maybe they heard me okay so you take down the server this goal is to impersonate that server and to get it to execute arbitrary commands on this X terminal so he denial of service attacks the terminal and then is able to guess because there was bad TCP sequence numbers here he was able to guess the TCP sequence number and able to inject a packet into that connection in order to do the handshake and execute the arbitrary commands so he ran basically this command to allow any unauthenticated access from any host in our host file and there's actually a great read down here that describes exactly the steps that was taken and shows some cool TCP dumps some like the actual traces that happened here so I encourage you to read that and I'm going over this just like the buffer overflows at a very high level because probably beginning of next week we'll start looking more at how these types of attacks actually happen okay so in 94 he's still on the run from the law in 1975 they arrest him in North Carolina he's sentenced to 46 months in prison yeah this is kind of cool so his wanted poster that one I'm probably going to keep it in 2000 he was released from prison after 5 years and as part of his probation with his history he just said no internet no computers, no email for you and so it wasn't until 2003 that he could actually surf the internet and use the web do you think that's fair? is that right? what would you do if you couldn't use a computer for 3 years? so do you think that's a legitimate thing that we should do to notorious hackers? no it's a basic right to use a computer what have you demonstrated in history like this of using criminal activity? you need to improve the security you need to do research on that I could if I have a house and I don't lock my door when I get into my house that's still that right? just because it wasn't locked you know you can't come into my house I'm not saying it's not wrong but putting the onus on him is ridiculous let's say there are thousands of Kevin Mitnick are you going to arrest all of them and how are you going to monitor all of them you have to secure your systems is it the same problem or different problems though? are they different issues? what do you think? walking away hired as a security expert help mitigate hold that thought we're going to talk about that in a bit let's be thinking about that later on Albert Gonzalez he's one of not my favorite I would say but he's a high profile person in cyber crime this is him he ran a crew he ran a crew of hackers that used sequel injection vulnerabilities to steal credit cards I remember hearing about TJ Maxx, Barnes & Noble some of the other ones heartland payment systems I think they decided to like not go for the small fry why would I bring into one company I'm going to bring into a credit card payment processor and then steal credit cards from there so that was the pay land heartland payment systems in total they're responsible for 170 million credit cards that were stolen it's a crazy number so they're responsible for David Buster's and and TJ Maxx and what they would do they would do what's called board driving so they drive by these businesses see if they had open wifi access more of a wifi that they could break they break into the wifi and get into the network on the store they would have the ability in that system to get on the point of sale terminal or to get in the back end system so to use that one store to go to multiple stores and then they would steal all the credit cards they could from these stores so he was he was sentenced to 20 years in federal prison now this is when hacking becomes less about the fame and the the moles and much more about the money and so you can see the result I think maybe the the sentencing changes that and reflects that 20 years and I also really like his story so there's a great Rolling Stone article about him and his hacking crew it's all the fast times and hard fall of green hack gang so apparently they just did a bunch of drugs and parties and stuff and it's crazy like rock and roll lifestyle even though they were like huge nerds clearly so like the guy in the bottom of the super long hair kind of looks like my advisor from Santa Barbara he he was like the genius hacker and there's a story about him being super high like them bringing code to him and Grant wrote the sequel injection vulnerability that exploited while he was like out of his mind so yeah very interesting story also interesting that they got caught which is good really interesting story so this is what I really like so in Australia an admin from their systems attacked their sewage system and what he did was so he worked for this the I don't know how to pronounce that word I'm not his name but Australian no 130 people so what he did was he attacked or broke in or you know we'll see how into their sewage control system and caused raw sewage overflows to leak out all onto the Australians coast and he had the hundreds cost hundreds of thousands of litres of raw sewage went onto like you know hotels and all this stuff where tourists were were staying marine life died like it was a huge ecological problem so he was sentenced to two years and he was convicted he was sentenced actually only two years in prison maybe they have different laws so you don't know how he did this so this wasn't a sophisticated TCP spoofing guessing attack this wasn't a crazy complex it was a complicated sequel injection spread throughout time and getting into payment processing centers this guy was an admin at this place and he was fired he was pissed he was pissed he got fired he said well it's pretty easy I'm going to mess with all the sewage systems what does this tell us malicious insider malicious insider so I don't even think this person was technically sophisticated but they just didn't remote his access he got home after he got fired found out he still got access went to town I also like this because it shows that not only do these security problems in the worst case take down systems so you can't use them like those poor 600 machines or 6000 machines and all those poor students will be their home market because this dang virus or it's not just credit card theft which is definitely a problem and a lot of people's credit cards though they're protected so it's really the payment companies that it's like impacting the environment this has like physical consequences on the world as a result of a hack or an exploit or an insecure system and there's plenty of other stories if you look you can find it there's plenty of examples throughout the years of web defasement this used to be the way you prove you were leaked as you would break into somebody's web server change their home page to be something worms, there's been plenty of worms but recently they've been dying down which is a good thing mainly because people want money it's hard to make money off of a worm that spreads actually throughout a network plus finding these remotely exploitable vulnerabilities you could, if you find one let's say Windows 10 you'd probably sell it for at least $50,000 ethically, probably more 10 times that on ethically probably not that much but probably about 100,000 if you want, we're not scrupulous about who you want to sell it to why write a worm and burn all that money if you can sell it to somebody and if you remember some of these worms go red, slammer, blaster they like really rippled the int today this was in the 2000s when they had actually exploded and computers were everywhere they took down business it turns out Blaster's author was 18 years old when he wrote that work it's a long history, yeah I'm actually curious what's your thoughts on Stuxnet where they actually don't know who created the worm yeah, so that moves up into the nation state level Stuxnet for those that don't know was a I should say it was kind of a worm it did spread throughout the system but it was a controlled worm its goal was to disrupt the nuclear enrichment facilities of an Iranian facility so what it would do is it would spread onto USB drives and then it would spread onto computers that it was plugged into and then it would get loaded there let's see the way it so it was very sophisticated I think it used three or four different zero-day or previously unknown vulnerabilities in its code and then when it got onto the machines that it wanted to it looked for a very specific configuration of this uranium enrichment and then when it found that it would lie to the user interface and say, yeah, everything's totally cool uranium is being enriched when really it would be shaking it at a frequency that would disrupt or actually break the machine over time and these machines were air gapped so they were not connected to any networks the internet or anything but all it takes is the USB drive and these actually went in through the planning files for that machine there's a program that controls these machines and they have files so that's what they use to eventually get in there so yeah, it's crazy so we don't actually know who's responsible we believe it's probably pretty clear the Israeli government but yeah, I don't know I don't think we'll ever know for certain maybe until like 50 years later but yeah, it's you know, it's interesting it definitely raises the level of sophistication from an 18 year old kid when they could be back in 2000 versus what a giant nation state can do at that level but yeah, it definitely changes the cyber it changes the landscape a little bit it makes it interesting from what I know about that it wasn't that it was particularly sophisticated it wasn't like stuff like this oh my gosh, you could understand this it used kind of pretty well known techniques it was just much more like the engineering on it was a lot better so it actually was like a better all-wear basically and it had some unknown vulnerabilities which you have to pay a lot of money for or find them yourself so it was sophisticated in that sense before we go any further to actual stuff we got to talk about ethics the common theme from all of the examples we looked at was I'm asking you if it's not adorable it was they're not making the right choices don't act systems, you don't don't act systems, you don't know keep quiet now they got caught, right? and for example, they got caught most of them went to jail, some of them did not so, ethics A, doing the right thing and B, not going to jail so those are very related concepts but I want you to do the right thing and you will not end up in jail so it's actually very easy so it's actually pretty easy don't do anything illegal okay that's in general I guess but don't get caught but I don't want to talk about that so what does this mean what does this mean in a hacking contest to not do anything illegal I guess I should premise this with I'm not a lawyer so, you know, don't take this as legal advice but take this as an ethical consideration of what things you should or should not do with knowledge you've learned from this class what does this mean to not do anything illegal in a hacking contest I think malicious I think malicious, what do you mean by malicious it could harm the computer or steal something which harms a computer or steals something that's part of it I mean, if we do discover something that is a vulnerability in the system we should report it to the authorities who can fix it finding vulnerabilities you should report it yeah, we'll talk about that in a second it's a great component I mean, not use it for our benefits or retrieving some information yes, definitely not you're not going to use it for benefit you're not going to use it for benefit why not do it figuratively yeah, definitely don't harm the environment that's really, really bad all those poor parts like birds and fish but I don't know about that so I mean, so part of the reason what you're learning in this class is I mean, showing how knowledge of a system can give you control over that so that way I would say doing these things or writing a nice way definitely can be educational if you're learning about the system there's a big disconnect here between the theory behind something and how to actually do it on a real system right, so those things are important and we're going to do that specifically because I don't want there to be this gap in your mind of oh yeah, definitely, I know how I know how a buffer road works but it's like, yeah, we'll here do it it's like, it's more difficult when you're doing it can you design your machine? could you break it and hack into it? I mean, ethically maybe by guessing the password yeah, guessing the password or let's say you found a vulnerability window could you explain that on your own copy, on your own machine maybe, but I would like to if I find something that may I don't look into it what about he finds more than your windows but he explains that on to your machine it's possible, I mean it's something that you can do in the class system it's possible, but it should be what should you do no, because it's not his unless you explicitly give permission to touch or access to your machine yeah, but you on your own machine you're totally free to do whatever you want in your own environment on the system that you control and you have the authority to decide what happens or doesn't happen so this is the big thing to keep in mind in my mind don't hide in the system that you don't own or have permission this is kind of the golden rule so if you follow this rule everything will be fine and you know we're here to learn, we're here for educational purposes so I want you to explore things so you're showing me explore things that you don't want to listen to but trying to hack into the let's say you find out that the second floor lab has a known vulnerability in their version of red athletics and you want to go in there and play around not a good idea because you don't have permission to that system they find you, they say you've broken the acceptable use policy for ASU systems and in addition people have grades on there, another homework so now we have to you could have compromised all of that data and all that stuff so we have to verify all those things so now you're in big trouble, you can get expelled suspended, whatever but really, you know exactly which version of red athletics it is you know their environment you can set that up in a virtual machine on your own computer you can go to town, you can do whatever you want to do so okay, hacking breaking into, it'd be like kind of like a house, right? you don't walk into other people's houses or but what about so this is let's say hacking in or breaking in or getting access to some of these systems when you're reasonably certain that it's going to succeed what about finding vulnerabilities could you, is that applicable can you attempt to find vulnerabilities or should you attempt to find vulnerabilities on the lab computers or the library computers or your friend's laptops yes, though, why? we are exporting those vulnerabilities and we are able to find some vulnerability and we are like, can make it through the all the... but it's not your system now so what if you're trying to do it on somebody else's system what if you, let's say you're trying a SQL injection on a website let's say you crash that website it's down, it's no longer available to anyone, right? you didn't actually even successfully exploit it are you responsible for that? I think so, right? you have to act responsibly you have to think through what are the possible consequences of my actions, right? if I try to find this vulnerability on a system I don't own hey, I don't have permission to do that so I definitely shouldn't do it and B, if I was successful maybe I get access to that I shouldn't be seeing I could really only do it on systems that I control I can't think of it like a house thing, right? can you go up to people's houses and fill with their doorknobs to see if they lock their house or not? if somebody did that to your house would you be happy? right but then you come outside and you're like what are you doing? and they're like oh, I'm just checking to make sure you lock yourself I'm providing a service I'm securing the neighborhood I'm going to come up here and mess with your doorknob and try to get in so, the corollary to this do not attempt to find vulnerabilities in a system that you don't own or have permission I think this is the other key it's very tempting you're going to have the skills and the knowledge to be able to think like oh, yeah I'll just try this one thing out on this one website when we're on the system we don't have permission to do that so, we come back with that in mind we're going to talk about how to practice without going to jail


Wow, the second talk this day here, the second talk with the topic of gender and how to feel and how to be and what am I and not male, not female, something in between. I assume you basically all know intersexuality intersects people and that it is even more difficult for intersex to fit into something like society than, for example, trans people. So Maya is, fortunately, I'm so happy. Maya is a member of Entropia. She lives in Karlsruhe. So I can see her every day and it's great to talk to her and we talk a lot of intersex and her way of going through her life, managing her life and so. She talks about how the internet affected her, being her search in getting around in terms of intersex. So, a warm welcome to Maya. Okay, yeah, I have to stay here because microphone, so I'm down to this so I can't look around, so remember. Yeah, so I have to go back to how I want to start. Well, the other card says basically everything already, the introduction, pretty much everything, because, well, okay, I'm intersex, I'll tell more about it later. And the internet has been really, really important to me in, well, basically I'm here, this location and still alive because of the internet, so that's pretty big, I think. Okay, so let's get started at the beginning, because everything has started at the beginning, because before I can tell about how important the internet is, how important, how everything has happened, at first I must start at the beginning, like, well, I was born and raised in the 80s, so my parents were, well, those were my parents. Of course, we didn't have the floppy drive, it was too expensive, but of the really official monitor, we just had a, well, the TV works, the winter games, everything, I've played it so much, and of course, the little tape drive, seeing those numbers spinning and having to stop at the right location, and, ah, yes. That's my childhood, so that's how I started, then of course, a bit later, well, you get older, you get a better system, a little bit faster, so I actually had a PS2, an IBM PS2 with a Model M keyboard, it was great, so, yes, not that monitor, I think now we have a cheaper one, of course, always. It was cool, well, that was my teacher, I really liked the teacher, I could play Kings Valley on there, so that's great. Of course, friends, of course they were friends. Yes, it was actually my younger brothers, we bought that one, used, so, and he mostly played on it, but I played sometimes on it as well, and it was really fun, and then I bought that one, so, yeah, it was a childhood, not sure. Other friends, of course. That's my current small part of my current library, so as a child, I would read lots and lots and lots, and in the school, I remember sitting there in the classroom, and we were talking about how many books have you read, and someone said, well, Maya has read more than 300 books. I still remember everybody looking at me, so, and it was like, yeah, okay, I've read a lot of books, is that okay? So, my childhood was basically like being raised by computers, video games, of course, having fun with lots of people and playing with the soccer as well, and reading more books, and then the internet happened. It was quite amazing when suddenly all the computers, if you had to, they can do internet, so you must have something, of course, Windows 95 with 65K modem, of course, really fancy. I remember I could be on the internet for like one hour a day, because she had to, of course, just dial up, so it would cost so much per minute, as it would get too expensive. That was, internet was great, like suddenly this, it's grown up in little filets, like 100, 200 people, so you know everybody, everybody knows you. That's basically the entire world, and suddenly, like, you've got the internet, and I kind of got stuck on the, it's basically also in the time that I was learning English, because I was raised in the Netherlands, so you start learning English pretty soon, because you have to survive, and the internet back then was basically everything was English, so that's how you get started. Basically, great, just downloading Super Nintendo Rooms and emulators and everything, everything illegal, because hey, it's possible, and cheap, but also forums, talking with people, learning to use IRC, Instant Relay Chat, suddenly talking with people around the world. I remember the first time talking to someone from the US, in English, that was so exciting, because that person understood me, I could talk with a person on the other side of the world's life. Yeah, that was pretty amazing back then. So, but yeah, Goodbye Innocence, 2005. After my parents had a force, moved around the Netherlands a bit, I began to realize that something was not quite right. Just more of a feeling, like, I was at this do-it-yoursel-store, just walking around there with my mother, just getting some stuff there, and I suddenly noticed that I was trying to walk in a feminine manner. It was weird, because I was supposed to be a guy. I mean, I was supposed to be born as a boy, had all the requisite parts for it, but somehow I wanted to be seen as a woman. It was weird, that night. As I think about it more, like, it doesn't really make sense. Why would I want that people look at me as if I am a woman, as if I am a guy, so it doesn't make sense. For about one week I thought I must be transsexual, because that's the only thing I know that's not strictly binary. So, okay, then I must be transsexual. But thanks to the internet, I started doing a bit more research, and I stumbled over an article about intersex, and it changed my life, because I had not known that something like intersex existed. So, because of the internet, I suddenly had a clue about what I actually was. I could examine, investigate more and more research, look at my body, because that's really the thing. Like, I have stared so long, so many times at mirrors.  But then looking back, puberty, but on puberty almost nothing happened in terms of secondary changes. Okay, I had a bit of breasts growing, that was weird, so okay, I'll ignore that. I didn't bear it's growth or something like that, not really anything else, masculine, not really. My clothing fits a bit weird, so I had to go for the really tiny male size, that's weird, but you're still a guy, so, or not. Look, doing more investigations on Wikipedia and around the internet and stumbling over this. There are so many forms of intersex, not just like your intersex period, done. No, you've got hundreds of different types, more common ones, more rare ones, and in a sense it's kind of fun to play your own doctor, doing your own physical examinations, and doing the differential diagnostics and everything, but it's also kind of annoying. But in the end it came all down to intersex. That's the logo I created a few years ago, and I think it symbolizes pretty much the whole thing. You've got extremes, and basically you're a song there in between there, but not really a specific point. So what do you do with that? There's also support, just the internet, IRC, Jet, MSN, it still exists, but then just talking with people, video chats, regularly just communicating with people. Of course I wasn't going to tell people about how I was different because I'd never been really clear about my gender identity or anything like that, I was just a person on the internet. Then it was basically when I found out it's in 2007 that I first got concrete evidence that I was like, okay, I still kept on keeping it a secret. Maybe I should start telling people. So I started over just, okay, I will just write it down in a text file and type it and send it to some people who I trust to be able to talk about it. That's how it started.  That's in having to keep it a secret or feeling that you have to keep it a secret, even on the internet. People are like, boy, on the internet, you can be anyone, anything, but you still have contacts with people. For example, you're in a chat group on the internet, and you talk to the same people over and over, and of course you learn a bit about the other person and you don't want to get too personal because on the internet you're more interested in just staying on topic sometimes. But then you have something really personal you really want to talk about and you're like, okay, well, it shouldn't matter. Just like, I also know people who have met, usually, of IRC who are, for example, blind and they just communicate, just make a screen reader and everything, you have no idea until they tell you, doesn't matter, doesn't really matter. But I was still stuck in this mindset of, well, I cannot tell here in real life about it. People around me in my environment, I cannot do that, because this is how coming out thing, but in the sex style, I guess, because you don't want to change, you just want to, currently I am this person, currently I am, this is where I am. Not that I want to change, but everybody was wrong about who I am as a person and physically and everything. And it basically took me until an American friend, but when I did a lot of video chatting back then, she told me in a chat, well, I was crying just completely emotionally, just drained, broken, done, and she told me, you cannot do this alone, you cannot do this by yourself. For now, I'm going to tell everybody and see it and then I had no choice but to do it as well and the response was basically just amazing. Because I was often said that while people you meet on the internet aren't real, that's not true. People on the internet, between what you've been talking for years, they're often more real than people you know in real life. You've often known them longer, you've talked more intensively about personal things and everything and the support I got from that really helped me to just say, I'm going on, I can do this. Suddenly things are easier. That was the point when I became more open about it, just publicly even talking about on forums and everything and that was the reason why I got the first medical help. It's the first point. Someone told me, hey, in the Netherlands it's not allowed to just pay for an MRI scan because I had this idea, well, I think, I'm intersex, I think I am a hermaphrodite. Both male and female organs. Assumption. What do you need to check that? Well, MRI scan. But in the Netherlands it's not legal. You cannot just pay for an MRI scan.  As long as you can pay for it, that's fine. So I had an MRI scan made of my abdomen. I will never forget the look on the face of the radiologist when she told me a first question to me was, were you operated on before? No.  Everything is there. That was the first confirmation that I am indeed a hermaphrodite. Both male and female alternatives. Thanks to the internet, because I would never figure it out on my own without having all those resources and contacts with people. Who would just tell me, hey, you can go there and there's the website of a service which is offer, to say that's a company which just organizes everything for that. So it's an MRI scan. That is just amazing. So I did that. Great. Finally confirmation. Second point. You can just order anything hormones. Because I did hormone therapy for a while until my body decided that it wasn't necessary anymore. And I just ordered it online without prescription for a couple of years. Because, well, I wasn't getting a doctor crazy enough to just prescribe me those hormones or medicines and anything. Because they didn't believe that I was in just sex. I had the MRI scans there. And could you please help me? No, it is a normal boy. Or he's transsexual. And I become really intimate with the transgender protocol with those years of talking and the real life test. And that was not fun. That was really not fun. But because of the internet, I found a way around it. Because people helped me. And I got hormones. I could start on that. I had to also figure out the right dose for those hormones because nobody wanted to help me. So I had to go online to figure out, OK, I need some in my blood. I need those values. I calculated, converted from milligrams. I think they were often used to nanomall. And that was really fun, geophysics. But that all worked. And so I finally got something going with hormone therapy. Just done it all myself. And things just seemed to get a little bit better. Then starting 2009, well, the media, they can really find you really well if you have an online presence, as I've noticed. So I would just still get these people during this contact me. Email, Facebook, everything. Like, hey, do you want to do an interview? So since 2009, I've basically done the whole thing, including talk shows and everything, radio, television shows, newspapers, magazines. It's pretty crazy to think about. And of course, starting my own website, Weblog. Weblog is also great because people have told me, well, you can just write it down.  But you can just write it down on paper or type it somewhere and store it on the hard drive of your computer and leave it there. But does that help? Because what I've noticed is that when you really open about it, when you really open about, OK, this is who I am. This is what's happening to me. These are my plans for the future. This is what you want to accomplish. This is what stands in my way.  And then you get contacted by people. I've met so many other intersex people because of my Weblog, mostly, because I write about it. And of course, this gets indexed by Google and someone searches, and they're like, hey, blog posts about all the symptoms. I know that. That sounds familiar. And then they contact you, or they start following you on Twitter. And then they contact you later. And you're like, huh, I'm not alone. Because intersex isn't really rare. It's like 4% of the population who has some type of intersex. Just about. There's no real proper statistics because nobody wants to research it. But something like that, there are quite a few. But meeting them, just finding out because most intersex people are still like, just like how I was years ago. Don't want to talk about it. Don't want to be open about it. People know. So what I have done is pretty useful. That's what I've noticed also with the media because they're like in the Netherlands. I was always the one intersex person in the whole entirety of the Netherlands where they could actually find and was willing to appear publicly. So... Yeah, maybe I'm just weird like that. But I think being open about it is the better way to go about it. So... Yeah. Also, that's interesting enough. When I did the talk show, in Netherlands, then next day actually the publisher contacted me, hey, I would like to publish your autobiography. Okay. Let's pick. I'm still working on that one. It takes a while. It happened since then, so it's becoming better and better. But, yes, 13 plus years went well. It's been pretty crazy just contacting doctors everywhere and just trying to get something going, trying to get some answers and to have received some answers. But the biggest answers I've got are really the second point. Because in 2015, I suddenly began to notice, hey, I've got a really funny little brown line there. Linnea nigra. That's something you're supposed to only get when you're pregnant. Okay. Or, as someone told me over the internet, as a nurse in the United States, it can also happen if you have too much female hormones in your system. That's how I found out that I didn't need a hormone therapy anymore. Because I had to complete over those and I was getting not just a bit PMS, but like extreme PMS. I have a normal psychone, as I've learned. And basically, my body decided to say, let's try this female thing and properly this time. So, yay. It's also resulted in not so pleasant symptoms every month because, well, no doctor has deemed it necessary yet to really look at this closed off vagina. And I have a monthly cycle, so that's not a good idea. So, I'm just looking for medical help there. And I'm not really sure what's going on there. That's going to be really exciting in the coming time. But we'll always have the internet. So, there is still hope. If you compare that to, well, the world without the internet. That's you just walking there with a condition with nobody else had. And you have no clue about what's going on there. And you just feel different. And you feel alone. And there is nobody you can talk to and nobody will understand you. And there is no help. You can go to a local doctor, and I'm crazy before I got medical evidence that I was not crazy. But, yes, that's the kind of world which you really, really, really don't want to have. And that's basically the point of this entire talk, I guess. Imagining what my life would have been like right now if I did not have access to the internet.  We can just talk about it, or I found something here, and I will contact this person for you. And suddenly, like, I've actually had one real surgery so far. Because I needed to have my official gender identity changed, because, well, I looked like this, and I still had a male official identity. That's really confusing, because you're sitting there in the waiting room, and they're asking for a sur-pause.  And that for years, and years, and I was really not happy with that. So actually, I was able to research how you get that changed. I found a lawyer, Netherlands, to actually help me with that. I needed to prove that I was no longer a male as a male, because this whole used to work in Netherlands not anymore, I don't think. So then the conundrum found, okay, I need to, easiest way is to just have those testicles removed, but that's not allowed in the Netherlands, because you can only get, voluntarily, get your testicles removed in Netherlands. If you, well, A, you have cancer, or B, you're undergoing the gender reconstructive surgery. So I was a transgender person, and you've gone through those 15, 20 years of everything. So, but I found help in Germany, again, to talk with a transgender friend. In Germany, it was like, hey, well, you need to have your testicles removed, or my surgeon here in Hamburg can probably help me, or can help you. And he could, and he did more, did also exploratory surgery and everything, and like, for two weeks I had, our testicles were not fully developed, or I was never fertile as a male, also common, that explained why I had almost no testosterone, yay. Again, that is our, the reality we live in with the internet, that you're able to contact people, that you talk with people, they can give you advice, help, links, references, everything. Or you could be stuck in a reality like that, where you're like, okay, well, everything is weird, I don't understand anything. Where do I go from here? And if I'm, that's, I don't really want to think about that, to be honest, because if you start to think about that, that reality, then it's also easy to just realize that, well, likely I wouldn't be here on this planet anymore. So, no, I don't like this reality, I really don't like it. So, there's still a future ahead of me, fortunately. First point is really important, because well, I'm quite visible on the, on the internet, but being intersex is something that, for example, you want to get anything done pertaining medically to your intersex condition. For the insurance, it's always marked as a transgender thing, always, because the insurance here in Germany or in Netherlands, they don't know this intersex thing. So, any procedure, any surgery that gets performed, even if I had to undergo the reconstructive surgery from a female side to reconstruct that, to open it, that would be marked and covered by insurance as a transgender surgery. So, that doesn't help politics. That's this intersex thing. I've done a bit of lobbying in the Netherlands. That was fun. Doesn't help, they don't care. I've talked with one politician after emailing so many. One was like, oh, we can talk about it. Just provide some time. We talked about it and yeah, that was it, basically. Others were like, well, yeah, we're already doing something with that. Something. The medical help, yes, because I've got, because of the physical change to my body, I've kind of got chronic pains. That's kind of annoying. Also some point, third point, while the autobiography, I started writing on it in, well, late 2013, but then lots of stuff happens. I mean, writing about the second yeah, so many things I could add to it. So, actually, that I didn't get it in 2014 was a good thing, because now I can write about losmar things or I could have written a second autobiography, of course, hey, more money. But this works, so that's something I still have to finish. And, well, I also have to work. I have to make money. I have to eat. I have to live somewhere, so that's also important. But other than that, I think I've got everything covered there. So, how do I do that? That's the question. Well, the internet is, again, the answer. Because, actually, I recently lost my job, but I got completely overwhelmed with messages from recruiters who are like, hey, we want you. So, thanks to the internet, that's really not a problem. And I will probably be moving to the UK, because that's where they want me. When this works, so, and then I have to look there for more medical help and make more contacts just use the internet to my advantage. So, that's quite a bit of uncertainty you've got there, but compared to just being there without any easy contacts, without people around you whom you can talk to, where you can ask for help, there's nothing better than having the internet that you can just, even on Twitter, just cry for help, just like, hey, I feel terrible, that's a problem, can someone help me? And somebody respond, it's like, I can help you. That contact is so easy. And I think, that gives a lot of hope for the future as well. Because you know that, even if things aren't great right now, because there's the internet, because you've got those millions of people out there, someone of those millions of people, they may have the solution, they may have the life that's better, they may have the answer, sometimes an easy answer, sometimes part of the answer, like people have met over the past, well, there's one person who can tell me, oh, you have to go there, then you can have the MRI scan made, and that person, like, well, I've got here, searching, those are the big pizzas. And sometimes there's someone who just says something, like, you're right. Small things. And that really, really, really helps. Yeah, my autobiography. What do I expect from writing my autobiography? Because I've got my weblog, that's of course interesting, but the problem with my weblog is I've been writing on it since 2007. I've written more than a thousand posts. Nobody in his right mind is going to read through all of them. I mean, he would be mad. I mean, I wouldn't do it. Just 1,000, 1,200 posts I don't ever count years ago. I just write, publish on there, and I can forget it. Autobiography is more that I can cover the entire team of my story, also the earlier period, and everything. And more, I'm still autobiographic, of course, but more concise and easy to read and just put it all together in one work, that someone can just start it, start reading, finish it with, well, depends on how fast you read, I guess. But to make it a real experience and fun, and for myself it's helpful as well, because there's a difference still between writing a weblog. A weblog is just a diary. So you just write on it every day or once a week or once a month, once a year, because you have something that you need to get off your chest. You have to write about it right now. So when I just look back on what I write about, like most of the time when you're writing a blog post it's because you have something that you really need to say or you're just upset, something terrible happened. But to write about the whole picture, and it's something which I don't think I really covered in my blog, certainly. Of course, my career is also an interesting point, because as you could see at the beginning of my presentation I was kind of raised by computers. That also means that I learned to program like when I was seven or so because well, that's how you talk with computers. So yeah, I've always done that in school, never really done that. It's boring. But I'm currently in my career. I'm a senior C++ developer and I've never really done any kind of education thing there. I've used the internet to learn. And that's another area where if I did not have that, if I had to rely purely on the school system in a way. So everything together, I guess that despite how things are not made easy for me, it's still because of the internet I was able to find ways to get around obstacles, to create and hold on to a future for myself and hopefully with my autobiography and with my web blog and everything to also change the lives of so many other people because it's not just about me. It's also something that you really learn when you're on the internet for most people. There are so many people out there. So many people like yourself. So many people who need the same help as you. So many people you can help by writing something like the impact of a blog article. Sometimes you're like, okay, well nobody reads that. You look in the statistics of 500 people for that. Oh, somewhere in Italy an article has been published about it. It has impact. Everything you do, especially when you're writing about topics like this, have impact on the lives of so many other people. I've influenced directly the lives of people other intersex people by just talking with them and allowing to sharing my experience with them and they could make a decision about their own life which made them happier in the end. So that's pretty big deal. That's also I want to do more of that in the future because it's kind of fun to make people happy. I guess we're free to that point. Does anyone have any questions? Maya, thank you so much. You do a great job for everyone else. So are there any questions?     So just ask right away. She's so open and she knows so much. So... Wow, it seems you have an early off. Freedom. Okay, yes, great. Hello. Thank you very much for your presentation. It was a really great insight. What is the current legal situation in your country? Since you weren't allowed to do this legally a few years ago, has it changed in the Netherlands? The gendered change, you mean? Yes. I've heard that they've actually made it so that you don't need to prove any more as the old gender. So it's become a bit easier there. I would still have opted to just remove those use testicles because they weren't functioning and they didn't need them. So they're just annoying. So for me, it wouldn't make a difference but I think that for a lot of non-binary people are like I just want to change it. Difficult more options and that's always a good thing. So recently there were changes to the German laws regarding the third gender. Do you know anything about it? Like you would probably apply for those or you're, I don't know how to put this, like you're not a German citizen, right? You're from the Netherlands, but if you were would those apply to you? That's actually one of those really big questions like because I've of course changed my official gender from male to female, simply to fit my appearance and just I feel more like a woman. I need not that song, not that song again. That's a third gender. It's like what I really want is just talking about gender because it's not that important. It's like everything is gender, gender, gender, even when you don't need it. Like why do we need to have gender in a passport? Why does it matter? Why is it being registered? Why is it not something which is just when you're born they may not make a note there like 100% male or 90% male or CIS or hermaphrodite or something else and sleep with it. That's registered. That's interesting also for your personal doctor but the government students care about that and other people shouldn't care about that. Should this be so I'm still registered as female. Would I want to be registered as an ex? No. That's just missing the point. That's just segregation. I don't want to be an ex. I don't want to be male. I'm perfectly fine just being called an ex. I'm much better as a sur. You said that you would like to be a more female.  Well the first place, I'm human. Second place, I'm a hermaphrodite and I want to keep it away.  What would you wish for in sex education and also at which age do you think we should educate people about this because as seen in your talk this has been something that has been with you for a very long time? That's also a very good question. The thing is that the whole problem with intersex and sex education starts before, long before child has even been born because everything is about this binary spectrum or binary system I should say, definitely system because even before a child is born it's like well is it a boy, is it a girl start with that which color do we pick for the room, which clothes do we buy for the baby which name do we pick, everything is gender, gender, gender, gender and then a child is born and they do not conform to, with their genitals to either males or females and you're like okay because confusing, we don't want to be confused we as parents or we as doctors we don't like being confused, we don't want to think we just want to fix it and those normalization surgeries as they're called their big problem is also problem with the parents because they don't know that intersex exists they get a child with funny looking genitals so is it a vagina, is it a penis and I'm sure this is both, like you see a penis and then a whole below there that's often which hemorrhoids I was lucky that it was not visible in my case or I would have a scar there and something would have been removed already that's something which when when a woman is conspicuous they should already know about intersex, should be educated about they should know that it's nothing bad, nothing serious when children grow up they should not be forced into a gender realm that's something which we as adults as parents, as educators something we can already do that's something which we has to do it's not just we just leave it to abilities, classes like then they will learn about intersection everything will be right, that's not how it works it has to be an integral part of society that people know about you've got men, you've got women and you've got everything else and that's a really big spectrum with lots of different bodies and people would not fit into those two extremes and when you start with that well, everywhere parents, teachers gender public what I am trying to do currently and of course the law that is actually there's also another law in Germany about the third gender, namely that a baby can be born in Germany and does not immediately have to be assigned a gender that's positive first step because then you take away the pressure of choosing why would you have to choose okay, your baby gets born why would you have to choose whether it must be male or female how could you, I mean we have gender people their chromosomes do not match up with their assigned designated gender how could you figure out for an intersex child what gender they would prefer why would you make them male or female why would you take away those organs and leave the other so that's a really big issue what we've got there and something that has to be something that has to be tackled at so many levels then then maybe one follow up question are you annoyed that the intersex issue is or it seems that what is talked about as first is genitals or do you think we should talk about genitals much more in general I really don't think the genitals are that important I mean sure if you've got a partner and it's nice if you're like hey you've got cool genitals, I like those but beyond that I don't think like why would your boss care about your genitals, why would a politician care about your genitals why would a guy sitting in your church care about your genitals what's the relevance of that and there's a point where I say that people just be people so everything else is of complicating things and things must stay simple much more fun thank you Maya


The Pittsburgh Penguins are your team. We're without the two best players in Hawking, two best players on the team. We win 6-2 against the reigning champs. No big deal. The Vegas Golden Knights also played against the Kraken. Yep, boom. Brand new squad. Kraken, fun fact, the only completely duff-feated NHL franchise has never, that franchise has never won a game ever. Think about that. I don't know if you want to be a fan of that team or you'd rather be a fan of the Pittsburgh Penguins. Joining me today, a man who grew up in Pittsburgh, Pennsylvania. He's the host of Hammer. Done. Which runs 15 minutes after this show ends every single Monday through Friday at YouTube.com forward slash hammer. Done. Grew up in Pittsburgh, city of champions hockey. Done. And he is somehow now a Seattle Kraken fan. You got a chance to see your team lose last night. It's great to be in the middle of hockey season. Listen, it's football season. Do not get it twisted.


In my last video, I talked about how I optimized my environment to make the best use of my peripheral vision using subtle cues to improve my attention, creativity and productivity as well. And in that video, I briefly talked about how keeping a simple note card in my proximity can act as a kind reminder of the stuff I need to take care of. And I've been always taking notes using a notepad of some sort as I do enjoy the physicality and simplicity of paper technology. But this is a simple system I used in the past three months that has helped me improve my productive output and making sure I'm first taking care of the stuff I want to do and also helping me capture ideas, thoughts, intrigue and a variety of other things. I'm using a small and cheap A7 memo pad, I believe you can pretty much buy this anywhere. And I do keep it on my desk. This makes it small enough for me to approach it and also makes it very portable, although I'm not keeping it in my back pocket, but simply I might carry it inside my back. The workflow is simple. If there's a full page inside, that means that the page needs to be processed. Once I crossed off the items on the page, I will throw the page away. I view it as a physical inbox for my thoughts. So I want to make sure that I can record the task anywhere and with ease. And this is why the pen always sits in close proximity. Also I want to be able to deplete this task tank and make them go away. I also want to be able to delegate, restructure or delete bin tasks that I can't prioritize. So what I usually do is dedicate one page for a macro level view of the things I need to do. I outline this with bullets and tackle them one by one. Then what I can also do is use a separate page if an idea comes to my mind while say doing random things around the house. And if I have more thoughts about it, I will dedicate a full page to that idea. I will then go and use my computer to process it, expand my horizon on it and then distill it and make it atomic. I would also sometimes place them on my blackboard so that I can quickly take one with me if I have to leave the house and work on my laptop somewhere else. And I found that it is much easier for me to quickly capture that piece of thought in a physical entity instead of placing it in some to-do list app or folder. And don't get me wrong, I still use to do apps as well. The problem with these apps is that they give you too much choice, feeding the paradox of choice, with you having to actually decide in which folder to put that specific to-do. To which project you need to attach it, choose a deadline. If you want to postpone it, you need to pick a date as well. Quite a lot of decisions to make this move.  This is why I like a simple system that should be easy to use that I don't have to think about. And even if you manage to create this beautiful structure, assigning icons to folders and having this neat category-based system to track your stuff, the app, the UI will treat all of your tasks the same way. Now to-do lists and systems should work together. I do not use this for big projects, but I found that having it on my peripheral vision and also keeping all of these trapped inside small squares that are, again, in my proximity, approachable and also very satisfying to throw away. And I gotta say, there's something beautiful about finishing a bunch of to-dos, discarding a note and throwing it in the bin.