The EDUCAUS awards program recognizes the remarkable achievement of some exceptional members of our community, and we're so grateful to Moran Technology Consulting for sponsoring our awards program. The Community Leadership Award recognizes leaders and active volunteers in service to our community of IT professionals and honors those who epitomize the spirit of community and connection through their leadership, commitment, and service to the EDUCAUS community and to the broader profession as well. This year's Leadership Award recognizes Hillary J. Baker, Vice President for Information Technology and CIO Emeritus at California State University, Northridge. Throughout her career, Hillary has demonstrated exceptional personal commitment to our community and to the profession, always modeling the values of inclusiveness and integrity. She's given much to EDUCAUS through her board and committee service, and her international perspective has enhanced her work, for example, spearheading the International Task Force, which focused on outreach with our partner associations from all over the world. Hillary's made it a focus of her career to mentor women in IT and to encourage them to step into IT leadership roles. Congratulations, Hillary, for making our community better. I'd like to express my sincere thanks to those who nominated me, the awards sponsor Moran Technology Consulting, the EDUCAUS Recognition Committee, and the EDUCAUS Board, as well as all the wonderful colleagues throughout my career, especially those who mentored and guided me along the way. My grandmother used to encourage me to make every moment count, which seems particularly relevant during this challenging and unprecedented year. As a young girl, I loved science and followed my dreams to pursue a mathematics degree which opened the pathway for my IT career. One of my passions has been to help support and encourage other women in information technology. By receiving this award today, I truly hope it inspires other women to follow STEM careers and pursue IT leadership roles in higher education. EDUCAUS has always been my go-to place for information, conferences, and networking opportunities. I have thoroughly enjoyed giving back by serving on numerous committees, teaching alongside expert CIO colleagues as faculty for the Leadership Institute, and as John mentioned, working with him and leaders of similar associations worldwide to become more responsive to the EDUCAUS international community. My career journey would not have been possible without incredible support from my family. So thank you to my wonderful children who inspire me to be my very best, to my adventurous siblings who often push me to go way outside my comfort zone, and of course, my heartfelt thanks to my husband, Michael, who has been my true strength and provided me with his unwavering support behind the scenes. As I thank you all, I encourage you to make every moment count.


This summer we started a journey with humanitarian toolbox to build an application for disaster preparedness What we do with humanitarian toolbox is we focus on how can we get volunteers involved and and not just have them do manual labor Test, but as somebody who has technical skills, there's more you can do. There's more impact You can have what we're trying to do from a preparedness aspect is we're trying to get smoke detectors into people's homes You know who don't have them or and that's where this kind of app can come in to make Getting this program working much more more effectively The reality is you're gonna spend three days dedicating your time working on an application Something that's gonna be carried forward by others. So this is your choice to be here and spend that time. So thank you We're really proud of the work we've been able to do with 15 developers over the last three days But this is only the beginning This is already this is a project for the Red Cross now We had a few codathons since July and gotten quite a bit of code written that led to a whole new rack of work items That's a little details And so the work items went from a few Prototype features to this larger block of what's the things we must have to actually run a field trial There was an opportunity to get a really amazing group of people together and push through to the final detail So that we can put this project in the field. It's really exciting to see All of these volunteers come together with just this very unique skill set and this sort of a codathon is really incredible And it's really neat to see all this expertise in one room The only way for me to volunteer and help in any kind of humanitarian effort has been okay Well put down Visual Studio put down get put down anything that you know about working In your craft and go pick up power tools and I'm like no you don't have enough band-aids for me to build a house For someone this is just a fantastic opportunity a to work with some great people and be to use our skills of software developers to actually build some software that can help people this is the reality of right software is a superpower and Getting all those superheroes to fly in the same direction is a trick Coordinating a project can be quite difficult. Let's see how they managed everything in GitHub So Bill hey Seth, how we doing great? Tell us what you're doing on the project, but well I've been incredibly busy today. I saw you know, you've been talking to everybody here I was going to keep so the way we're managing the project and managing reviews is we're using the github flow model So basically anybody who's working on a task They fork our repo so they take our github repo fork it into their own account Okay, once it's in their own account, they bring it down to their desktop They do all the work in Visual Studio all the things that happen there submit it into their copy of the already repo Okay, and then when they say they're done they submit a pull request I see and then one of the key committers Tony or I or we've now added James as a member of the commit team Can go through and look through each one of these awesome. So I just want to show you just today's activity Okay, so here's one page. That's all today. Wow. Okay. We got more This is page two. We're still on today November 7th. We're rolling down here. We've got all these merges and when we get down here into We see the first ones that we did this morning the third page down in our commit log, you know for just today You know and yesterday we were working quite a bit. There's another Several pages there for yesterday. Okay, so we've got a lot of work Now the way we do this here's basically the process that goes through so I've got three open pull requests right now Okay, and here's where they're sitting here. You know, this is gonna be fun I get to review rocky look as code. Okay, so we get to say dude. Did you do great? Okay, and there's a comment here So I'll look at this one and you can see this one screen and I'll explain where we're going there So when I look at his pull request You know, I can see what he's changed. So he's added a couple tests here You can see Dave Fakett one of the people already is Reviewing this and there's the emoji here. This is the ship it emoji. So in this case, I don't have to review Rocky's code, right Dave already did. He said this is great. This is wonderful This next block here says we have some checks that we do to make sure a pull request is ready and doesn't break the build Okay, so the first one here the check that we have and this is an app fare One so we're doing a continuous integration of every pull request using app fare So what happens is when somebody submits a pull request This software in the cloud Builds it runs all the tests and then says, okay, it's good Okay, and then it also checks to make sure that it's up to date with the base branch So I don't have to do any manual merge. I said, which would be the other reason we pull it back So we got new tests. We've got this happening and I'm gonna do the merge great and improve some tests Okay, confirm the merge great. And now it's in place. Okay, so that's one more thing that just got done Now the other thing that I should probably show The way we're tracking this and especially if anybody even after this goes live and you're watching We're looking at we basically track everything as issues. So you go under the issues and we take milestones here that We're trying to track. This is what we're trying to finish today and tomorrow And you can see these are the tasks that we're assigned to this milestone and when we finish we're gonna take Set a new milestone basically a new scrum and say let's try to get as many as we can done By building this an ASP.net 5 it gives a chance for developers to learn some new skills You know, you may not get to use the latest of bits in your day job. Come join us and see what they do And so there's there's a little bit of a learning curve, but it's interesting and how Now we have the ability to do certain things that sort of speed up the development process Even though, you know, there are some struggles when you're working with a beta version But overall that it's interesting how you can Pull in all your assets that you need and new ways, you know That's more integrated using growing Gulf things like that where you had to really work toward that in previous versions Now it's all part of it, you know, it makes it a lot easier Some of these developers were using some really cool techniques Let's look at a pattern that one of them was using in this project. All right So why don't you tell us now because we've talked about all this great stuff. Who are you dude? And what do you do?  So this is good stuff My name is James Chambers, I'm an ASP net IIS MVP I'm I've been a four-time awardee and I'm just really loving the new stuff in Azure and on ASP net v-next ASP net 5. I guess we're called now and so yeah a blog in this space I'm working in the space and this opportunity to work with the already crews just awesome like to take our Craft and to apply it to something that's like for the greater good is just really cool What we wanted to do was to basically You know take the workload that was happening in the website itself, okay, and move it off into the cloud We let's let the website keep moving as quickly as possible But the long-running tasks the IO the email sending the calling the rest apis out to send SMS messages We want to make sure that that's not tying up the tasks on the website property We knew up this command we put in all of the details that we need to we post it onto a queue And then we've got a job that's running in the back and a web job Okay, that's just part of our Azure website got it and it runs in the back end and when it's triggered automatically when a new Entry goes into the queue once you explain a little bit what a queue is sure this so the storage queue is one of the Features of Azure and it allows us just to post a message and in my case all I'm doing is taking that command that I've got I Use jason.net to serialize it as a jason document. We pitch it up just as a string So it's super easy and then on the on the other side of it when that queue is actually when we want to start processing the queue You know and back to what a queue actually is it's it's just a it's just that it's just you know The way that we think about you stand in line for something and then eventually you get to the front of the line So the queue works that way as well and the storage queue there's some cool things about it Like it's gonna keep retrying for us if there's failures and everything rather than writing all of that logic inside of our app We just install the Azure SDK throw our message on to the bus and then we wait for it to be triggered in our web job And that's not a completely different process. Awesome. Well, let's let's take a look at it Yeah, absolutely one of the scenarios for notifications that we want to use is when we have an Activity that set up and there's all these tasks that need to be completed.  We'd like you to try this out. Well, that's awesome Well, let's look at the code of how you do that. Absolutely. So I'm in the code itself here We basically we get a list of all the updates that are coming in we have you know We just knew up a couple of lists We add anything that had been changed from the view model that's posted back into our controller action here And then very easily we just set up a view model for this command and we send it off to the bus And that's that's all that's needed to make that happen. Maybe you can help educate me Are you guys using the CQRS type pattern command inquiry, but we're not doing full-blown events. Yeah, okay So now that's I've got my bus that gets passed in by a DI. I've got my controller here that does the Interesting bits of building up my model. I send it off to the bus and then without waiting for any Crazy processing to actually happen. I get to just resume rendering the website. Awesome Well, let's take a look at the one for sending messages. It looks like it's right there Yeah, this is it right here. This is the command and you can see it's it's pretty straightforward What we're doing is we've got a single command that lets any caller Choose to send out The sms messages the email messages are both So you build up that body of sms recipients You build up the body of email recipients and when you pass that in if there's anything in that collection It's going to loop over them and then cue the messages the sms's have a recipient and a message The email recipients have an email And a subject as well and we're actually because we're using send grid We're actually going to be able to use templates as well. So all the emails that go out are going to look like super like Awesome.  That's cool. Yeah Can we see where the event happens when you actually get the cue the message in the queue and then It notifies somebody that it gets a message right and this is the super simple part So down here we've got a web job called notification processor And you configure it to deploy side by side with your web app When you actually the tooling and visual studio 2015 now supports you can like right click and add a web job to this Oh, that's so much nicer than it used to be. Let's look at the job getting this stuff off the Right. So to start off the job what we do in my case. I'm using user secrets So the azure storage connection string is stored in my user secrets And this is or in this case an environment variable. I apologize But that's the pattern that you know that pattern that we're doing got it And it looks like the job host is the actual thing that's going to be running That's right So we do we do run and block and then the way the stk works is it scans for anything that looks like Something that is part of the azure stk. So I've got this functions.cs And I've got a process sms cue message It's got a cue trigger property attribute on it And when when this compiles when this builds when this runs it Dives in and basically pulls these functions out and says this is something that we're going to use to Participate in that job host. Okay. So let's look at the cue trigger attribute that's happening on this function anytime something Goes into that cue execute this function. Exactly. Yeah, and then so, you know, we know that it's that jason object that we had serialized previously So we do serialize it back out. We've got a shared type with a common core library or whatever So we do serialize that back out We read from our environment variables to pull out things like our twilio id and our token the phone number that we're sending from And then the rest of it is send the to we got the message that we've got we create an instance of the twilio Rest client. This is all like code that you can just pull right off of there Yeah, absolutely. Yeah, and then we just send it out if there's an exception If there's something goes wrong with sending it via twilio, they populate this rest exception object So if that's not null and there's a message in there then we know something went wrong and we just log it out Man, you're going full Elvis operator and string interpolation. I know I love it. Hey, it's great c sharp six Yeah, okay. Well, thanks so much for spending time on this bud. Yeah, absolutely All right back to work. Sounds good. All right, thanks We've got this process of of wanting to make the website as responsive as possible But we don't want to have to We want to make sure that there's guaranteed delivery on things rather than writing a whole complex set of code that that we need to in order to ensure delivery We've got automatic retries in a storage queue out in azure We can ship a command up there and wait for a queue processor to pick it up and then deliver emails and deliver sms via other cloud services that are connected to our to our azure project and It things like that just weren't even possible five years ago So it's very interesting how they sort of structured this into these lots of little decoupled pieces that We probably should have more tests for but you always want more tests in a project like this I'm here with rocky. Why don't you introduce yourself and tell us what you've been working on, but sure I'm rocky lotka. I'm the cto at meganic and here Adding some tests to the toolbox project. So that sounds like super easy But when you're looking at adding tests to a project that's already existing Sometimes that requires a little retooling. Did you did you have any of that happen? Oh, yeah Testings never actually. No, I know I'm just saying it sounds easy But if you go to your manager and you're like, hey, we're gonna add some tests We're like, oh that's super easy, but that's not what it is, right? No. In fact, there's uh, you know a lot of Existing code. So we've got to figure out what the code is doing and then in some cases figure out ways to Be able to generate sample data or known data sets and and run through the code. And so we've had to Change a few things here and there. Luckily. I've only found one real bug so far today. So that's good All right. Well, let's take a look at what you've done and see if we can find any of that Sure. So Really the project had very limited testing to start with but then I've added some new ones here. So for example, we've got a test that is running through the idea of can we get activity detail and On the surface you'd say, well, that's that's easy, right? If we look down here, the actual tests are not that hard We basically create a query Uh, and then call the handler and then in this case, I expect not to get anything back. So I'm saying, well, is it, you know, An all So that was the easy part But then when you start saying, well, what about the test for something that does exist Say, well, we do expect to get something back. Okay fair enough Then there's all this code here because we have to actually have something to get back, right and And day has gone by and I'm sure a lot of people maybe still do this We'd set up a test database and have some sort of script every time you run your tests It would re-initialize the data the actual database and you know Why I remember those days So in this case what we've got is we're using entity framework with an in-memory database model. I see and uh So in fact, if I go up one level higher And here's one of the areas where we started refactoring some of this is we've got a base class For the tests that at least sets up some of the base configuration Information and in this case in particular is setting up our entity framework Creates essentially an empty in-memory database And all of this is using dependency injection to pull the appropriate resources Just like the app itself does So let's talk a little bit about the tooling and how the tooling is helping you with unit tests Is the tooling doing anything for you when it comes to unit tests? Well, the tooling is fairly nice You know built into visual studio is this idea of the test explorer and test runner So I'm able to just run up here and say I'd like to you know run all of my tests Um, we'll do a quick build and if we go back to the test explorer now, we'll see Um right across here the bar. I've got one failing test, which I know I'm working on that now Oh, awesome. So I expect that to be failing. I'm not done with it. Cool. So in your experience and you've been doing this for a long time Coat coverage. What do you feel sort of like a good sort of smell for how much should I be testing? I really think It's it's difficult to narrow down on a specific percentage Certainly, I've worked or interacted with places that are oh, we want a hundred percent and I don't think that's Use effective, right? I mean, yeah, if if you can even achieve it you're spending way more money than you should be right Um, yeah, 20 percent is typically bad pretty pretty bad Yeah, so you probably want somewhere, you know, well north of 50 percent But I also think that you have to look at what you're testing because there's um Code that's a lot more complex or a lot more on the critical path And then there's code that's that's arguably less important. So what do you have? What kind of work do you have ahead of you? Uh, well boy, we're just really getting started on this testing. Um, so we're You know, I've got to flesh out some of the tests that are here and now that we've got a model I think it'll be easier Maybe to get more people involved in writing some more tests on more handlers. Well, awesome. Well, I'll let you get to work But great. Thanks. All right. Thanks bud. So one of the biggest challenges we had today is we literally couldn't have people test We had the code it seemed to be working on my machine It always works on my machine on their machine someone's machine And we finally figured out how to get that thing deployed So the testers weren't testing code that was a week or two old And getting that was a huge moment because it basically doubled the amount of manpower that we had working today We're trying to pull in a bunch of different technologies And so we had lots of different ways. It just wasn't working We tried looking at splitting up the build. We tried deploying instead of automatically doing it manually Tried a lot of different options. What we finally found is that we had to kind of break it down into separate pieces So for deployment, we focused on how do we deploy it manually versus get automated stuff from continuous deployment And then we were able to figure out what the actual issue was there and solve that What we did is we took the code and manually deployed it So I was kind of playing the role of the continuous deployment mechanism And we figured out that what was happening is was getting there. We're running into an error But we weren't seeing an error screen. So we went in we made some changes to the azure configuration We're actually able to see some of the logs behind the scenes of stuff We weren't seeing through the web page. All right, bill So it looks like you got some cool stuff to show us right so once again, we talked earlier We were having trouble with our deployment scripts and with some Help from david fowler actually who wrote some of the build engine. He's coming in and helping us get this through So here's the how the process works when it's supposed to work. Okay, so now now Let me see if we got this right. So now you were having some build problems before we saw that So now you were able to resolve that with some help right and now we're going to see how this whole process works I've got pull requests. You can see the one here with the yellow that says it's it's building All right when I click into it and that page was a little bit A little bit old you can see we come down here and you can see now it says again all checks have passed Up to date with the base branch before we got on camera. I reviewed all the code normally I do that at this stage So I go ahead and just merge this And I confirm the merge. Okay And now if I switch over to this other window, I'm showing our deployments and what we should see here really shortly Is now you can see it's grabbing it expecting the changes It's going to run the build in the cloud It's going to deploy those bits and we'll have new bits on the site That's awesome. So what was the challenge? What was going on in the background that was causing this issue? So what was going on is we're running In order to get our web jobs running we're trying to build both xproj and csproj Which are which are not necessarily compatible. We don't even know if they are so what we needed was One of the guys from the build team David Fowler just was looking at our deployment script and pointing out where oh, yeah You got to do this when you're in this situation got to do this on this deploy and and there you go Well, that's super handy It is it was great to get the the support we've gotten as we're trying to use Some of the latest and greatest and even not yet release stuff has been really super So can you get into sort of the details while this is still baking of what sort of things you had to change? There were a couple different ones and I'm going to end up writing a blog post about this by the time you watch right now, so When you go to say, please generate the deployment script for me and there's a way in kudu and it can use the azure The azure tools that get installed by a new get and it'll say, okay Please generate the script that the default script that actually runs on the site So then we get that and I was starting to modify Well that default script assumes that your solution file is in the root of your repo Okay, well at our repository. It's one directory down. I see so I had to modify that whole default script Okay, okay, you can configure that so it knows and runs correctly, but we just had to change that That bit in the configuration And then it was trying to get everything to build in the right order And once we started building then it was primarily we had to make some change to point for the cs project Is to point to the v2 new get feed and Once we got that going then the same command we were running that I showed you earlier So reviewing the pull request that's now running exactly the same order exact same commands up in kudu up in azure To deploy from our main repo awesome So let's watch this how long does this usually take to build probably more time than we really want to sit and watch this All right Well, it can't take as much as about eight or nine minutes Okay, because it has to do all that and install the runtime and everything And then what would happen is this deploying one then would suddenly become that active deployment Just as you see the next one down And what we'll see when it's done is once it's active I can go and I can look at everything and see about how long it takes And you can see it takes that one took about four minutes. Oh, that's not bad. There we go And see and now we have new bits. So if I flip back over this other browser here If I go to this page right here and I refresh I'll be refreshed and running the new bits This is awesome. So you're able to now sort of as things get checked into whatever release or development branch you have It'll just pull it right in run the bill get it going This push this last few weeks from culminating this weekend is just getting to the minimal buy of a product All the bits that we can actually go take it into the field And I'm very cogs in the fact that that's the point where we find out if we actually have a clue Like have we built the right things can people who are not computer people Use this app and actually get some results from it All right, so i'm here with tony and sarah and we're going to sort of get a demo of what you guys have been able to Accomplish in the last couple of days. Yeah, why don't we get started last couple of days in the last couple of months We pulled together a whole bunch of code So we're going to look at it from two point of views The first one is from the technology we have for individual volunteers or users who come And so you'll be able to search with this giant search magnet there Or otherwise what you can do is you can see the campaigns all of the organizations who are on the on the application Can just list whatever preparedness campaigns they've got going on anywhere in the country That's pretty cool. I mean you get in there. It seems like it's pretty easy to just get in there and do it Yep, and so I can look in a campaign I can find out what are some of the activities available So I can go from I want to do something to actually want to start to volunteer for a particular task So do you have to be logged in to do this part? Nope, all of this is visible from the public site We want it to be as easy to get to and then it's not until you volunteer that you have to start giving information and logging in So that would be the site where you would be able to see exactly what types of events and activities are going on in your own neighborhood Basically, yeah So for example here, I can find out that maybe in a particular neighborhood There's a fire prevention day and I can go ahead and click volunteer It'll ask me some for information some skills I might have and then connect me up to somebody like Sarah who might actually assign me to a task So what's going to happen after they volunteer? You'd get this feedback and what would you do from there? Yeah, so I would see a list of all of the people who want to volunteer for a certain task or a certain activity And then I would look at all of the tasks that we need to accomplish during that activity And I would start to assign people tasks based on all of their various skill sets awesome And we're not quite fully there, but I can actually show you what she's talking about So from an admin point of view, I can go and look at a campaign So Sarah would go in look at a campaign and find out okay for this particular activity I've got obviously this is sample data, but I've got some users here who have signed up to volunteer I've got a set of tasks and then she can actually go in here and start to match up Different volunteers to different tasks now. We don't have it done today But what we're going to do is be able to show past history So it'll help her pick the best volunteer for a task as well as matching up skills Maybe I need people who are carpenters or electrical for this task And I can find out are there people who are volunteers who have that skill set Can you give us a sense for how long this would have taken before something like this? Not really It it it takes weeks to and we're basically doing call downs So we've got all of our list of volunteers and we're doing call downs We're putting word out there for what we call event-based volunteers who are just spontaneous volunteers who want to get involved Then you've got to call them You've got to see what their comfort level is how long they're able to participate in the event And it just it takes a long time. So having having volunteers proactively kind of step up and then to already know what they're Comfortable doing is going to make that that process a lot smoother. You literally don't have to call anybody Well, you're still going to make some calls, but this is going to sort of alleviate a lot of that pressure Oh, absolutely. And I something we were talking about earlier, which I'm really excited about at the At the task level I'm just exporting that out as work assignments being able to get just a nice report of Look, these are all the people who are going to do that task for that day And here's all their contact information and have that for the people who are managing the event That's fantastic. And our motivation in building this is the less she can spend time having to do this work Then the more time she's actually spending doing good and helping out in the community So we talked about skills. So one of the other capabilities we have here is they can create their own sort of taxonomy of skills We've obviously got some sample data here, but you can go in and you can specify Carpenter skills, electrical skills, um, maybe the ability to do heavy lifting or particular certifications All those things that you'd have to gather from somebody so you can have a list that they can supply to you You can also request and you can do that matching as you assign somebody to a task So traditionally there'd probably be like some huge excel spreadsheet when you're doing call downs That someone's just literally filling out or something like that Yeah, if we're lucky if we even have that formalized information Mostly it's a project manager just kind of keeping it on their head And they sort of have the lay of the land and person x is going to do this and person y is going to do that And just hope for the best on the day of So one of the things here that's less about an individual organization But we also have the ability to have multiple organizations Ultimately, this is multi 10 if you will from a technical point of view because the goal is for a community say Chicago to be able to see Everybody who's active doing something in a preparedness campaign so that I as an individual can go to a campaign And I can not only volunteer But eventually there'll be the ability for me to go in here and say, you know what I actually would like To receive the benefit of that I'd like a smoke detector So you can kind of sign up to be part of that which helps direct them as to who to help first Awesome And we're hoping over time we'll be able to pull data out of this so that we can also show sort of overall indexes of Resilience and reliability and what people are able to do in their own communities And also help you give the data to know when you're going out and doing something in a large community Where do you go first? What's going to have the sort of bang for the buck if you will awesome You know the thing that's interesting about a project like this is it becomes people's hobby You know this is What people want to work on like you could go bowling on wednesdays But instead you pick up a work item for already and help move it along So I love working on this project because I feel like I'm making a difference And that's what it that's the core of what matters to me So the things I do on a day-to-day basis. I want to improve someone's life So after several weeks of work leading up to the codathon and a mainly amazing three days We're now ready with what we call a minimal viable product all of the basic pieces to now take this into the field We want to just build the least necessary to truly try because we know As soon as it hits the field, it's going to be different. They're going to learn things about the way it works They're going to be making some changes. So we got there. We've got those pieces together We're just getting waiting now to get it out in the field and we're hoping by the end of november We'll be rather than you set a requirements to go further It's been three days and we're really proud of the work. We've been able to accomplish There's still a lot more to be done go to humanitarian toolbox to see how you can help make it even better


Welcome to church of the chair where we love showing off our beavers. I'm your host E and today I'm responding to community comments. Our first comment is from Eric Cartman 7361 He says I'm hoping for an update on that Stephen King movie Ben Stiller is doing So here's your update Ben Stiller purchased the rights to rat from Stephen King's novella collection if it bleeds But due to the writer strike, I'm pretty sure that project is on hold Indefinitely not to mention Ben Stiller will be playing Jack Torrance in a stage play adaptation of The Shining That's sure to be wild as hell. Next comment is from its chow For us I'm hope I hope I'm getting that right for us says hey dude Love your channel, and I'm loving the redo of your series I'm a fairly new arrival to the King's universe having read only Carrie Salem's lot cell the Shining Doctor Sleep and misery in that order my question to you would be what's the best way to read King? Should I keep going in chronological order? Meaning my next one would be book for the stand many things yes for us I suggest you and anyone else who is looking to do a deep dive into Stephen King's work to read those books in Chronological order it is the best way to catch all of the connections And then you can come back and watch the theory videos our next comment comes from the rev nation Who's been a long time sir sir? I almost said survivor a long time subscriber. Let's see what rev has to say sir Good sir leaving comments in the comment section is fine, but leaving comments in the is Much more fun where art thou I had to reply tis been retired Welcome to the new era. I'm well aware some of you had absolutely no problem with the way I used to do things please believe me when I tell you that I am much happier now Thank you now on to some comments I received on my the Stephen King theorist videos on my video for Kerry Jake Brennan had this to say give me damn Redux reviews. I Don't know why I read it like that man, but that's how I read it in my head Jake goes on to say I'm curious if the black man is also the dark man from King's poem Originally published in 1969 which served as the basis for Randall flag DX maniac 01 Also left a comment with regards to my theory about the black man in Kerry And when I say the black man, I'm not talking about an African-American man What I'm talking about is King describes a man with skin that is solid black DX says my assumption is that the black man Is a reference to HP Lovecraft's? Nara la dough tap I'm not pronouncing that word again Specifically in this case from dreams in the witch house. I could be wrong But I know Stephen King was a huge HP Lovecraft fan seeing as both Randall flag is The dark man from the original poem and the man in black from the dark tower all of this Jake and BX's comments Fit nicely. Thanks guys now moving on to comments from my theory video for the dead zone I'll add a lot to say about my theory About how everyone gets their powers my buddy Pat Costin had this to say Johnny Smith hit his head by falling on ice as a kid So he was showing mine powers before the car accident the coma after the car accident somehow Enhanced his mine powers and Brad Perkins had this to say I may be wrong But I'm pretty sure Kerry had powers since birth didn't Margaret try to kill her when she was a baby and Kerry Started crying and used her powers to make her stop Next Harry Stephen King reviews. I'm sorry. I can't say that name. I know it's spelled h a r r Why but every time I read it aloud. I think of Harry You're a Harry person talking about Let's move on Harry Stephen King reviews 6385 says I like the idea that Kerry had her powers full force after the traumatic event But her powers came on full force before that with the reign of stones So it wasn't just a shower scene while I understand what you guys are getting at and maybe I was not clear enough when I said They brought it on full force. It was not to say that we hadn't seen those powers before It was to say that after a traumatic incident It seems like either powers get stronger or they come on for the very first time Needless to say I agree with all of you You're all correct both of these characters both Johnny Smith and Kerry white had powers before the big event but at the same time Let's look at what it's like to be a baby a baby crying Not that any of us can remember that time but think about a baby crying Wanting food being upset for whatever reason maybe Kerry white was just colicky And that's what brought the reign of storms down that can still be considered a traumatic event Especially in the mind of a child who has experienced nothing else in the world. Thanks for those comments though It really got me thinking about how I was going to reply and I love Things that make me think Patrick Costin also brought up another interesting example of How people get their powers in fire starter Charlie McGee and her father and her mother were ex well the mother and father were experimented on in MK ultra type Scientific experiments and those experiments were done by the shop a shop which has roots in Maine both the mist and the Tommy knockers happen in Maine and The shops one of the shops headquarters is What spawns the creatures from the mist and last but certainly not least Brad Perkins comes back with another comment This one was on my theory video for Kujo and Brad says my two senses the thing in Tad's closet could possibly be another Or the same boogeyman from the night shift story. I really really love this idea The reason why is because we don't know where the boogeyman came from could the boogeyman be an outsider Pennywise any kind of creature in the same vein I love that you caught that and I love that you brought it up Brad. I appreciate you But that's all the time I have for you today Make sure to comment down there on all of the videos and maybe you'll show up in this series But until next time


All right, let's watch this. This is a longer sequence with no sound That was my cartoon sounds cute There's some really good stuff there. I've seen this before Academy there's definitely update on the on the bird Seared I wonder the only thing that strikes me here. I'm going there for my friend But I think what I would do This might be weird, but just as a thought like when I was watching this and obviously I know What is going on like this is all? Still good. You got a bit of tail-acting Only thing maybe that I would do here is maybe you can take this and have it go down this way That's a bigger change. We're not having seen this for a while. What strikes me here is that this Kind of even though there's a bit of a drag in the tip there It just has a feeling of This is the head body tail and everything pivots off of here and moves as one piece As the tell comes down the body comes down Maybe this could be something where this goes down straight where it will go down and then the tip would drag Go down more tip will be here. It's kind of like a wave down and then this would be Less of this over one frame What is massive shape pops in but it could be either body and in the head down here and it's kind of the back that leads So then this is here and the head might be, you know, it's a bit lower Then the body stops then the head snaps over or might have still One in between like here and then into that. It's the only thing that strikes me here Is that it feels a bit too much of a solid piece that kind of goes up? I Think there's some good moments in terms of All the reactions or even here when you have home the little reaction in there as that goes forward I Think the thing that we talked about before this kind of hurts You just kind of the the modeling of it where it's just very pointy has a lot of Shapes that we're enveloping is not as clean as it could be but I don't know how much control you have Or with this because you do have all the All the drag and everything the only thing I would say this feels a bit much when you go from here to here And then the next frame go forward, but in the small spacing here, especially this to this it gives it Like it hits that wall there So to me I would go here and then the next frame This headline is here Somewhere here and you can still do that with the arm But it does a little bit of continuing motion going back Then you can maybe pop to here and then into this that might be a bit more fluid but It's just tricky. I don't know if you can rotate the hand so that there's a bit more of a fluid Line there even this I don't know if you have pen bows You know like stuff like that where we just kind of soften those lines a bit like this feels very messy Where I would just bring that wrist down. I mean, I know you want to put in the drag But maybe something where Might just for the moment be okay, but I'm just registering this It's just of such a weird shape Maybe the drag would just be more it'd be flatter or doesn't have no drag at all. I'll give it a nicer more appealing silhouette Like it's something like this again I would just bring in those fingers like this and simplify That shapes it doesn't have that in there That's kind of my comment For most of those elements here I give them through here and I might just be raking just to To all of this I think that's probably The biggest thing if you can go in there and I know if you have to go even like something like this still Simplified the shapes to have this come down into just the plant and not have all of these out there Even that Just feels broken So I think because everything is there and it's cute and I like it. It just feels it just feels messy in terms of Those shapes and I know this that's not your fault. It's just how to model is But even like a stop like that Maybe give this a bit more room Maybe here would actually be a good thing to bring out those fingers because now it's a plant I think I would reduce the amount of craziness was to me at this point. This just becomes strobe And it could just be who I could just be going up into a hold a couple frames like take one of the You know leg arm forward moves. It's a bit more hold and then It's almost like he wants to get up All right. He does all this Gets up and then feels like he's stuck in the air and that's when he starts treading here in the air To get into this to go forward Just right now it feels like it's Just so strobe. You might want to run this with motion blur and then We'll have a different opinion on that. Maybe then that will be better Actually, what's going on here in the camera? I feel like your camera is doing a translate right there It might just be me, but this feels like a translate and also kind of messes up the entrance of The birth there. I would just go translate backwards for all of this, but any type of reframing is done with rotations This just seems odd at this point and I would probably still bring in that bird from top down Little eagle attacks. It's it of low. This feels less threatening. I would go straight down into this But it's cool. I really like the the flutter and Adjustments in the wings. I would have a little bit of an adjustment in the head here that kind of not in sync with the legs might go earlier maybe right of it at the end but Given that it's cartoony how we can push this and have it more of a head Move outward eyes, maybe end up up here and open the beak just more this kind of Falls into the same line and maybe rotate the head a bit So that the head here has a beak here and then a beak here So we see the separation between that top part and the lower part and you might cheat and open those eyes a bit more Because it's going past us so fast so quickly You can cheat that maybe a little bit So the initial comment here before I was started at the beginning I wonder if at this point we can take this hill away Keep those clouds up there. So this is basically just blue ground here this green my end here so that here Because he gets into this hole. I would have Jump give it contrast, but also make it a moment. So we understand Bam goes in there and hides right now It just feels like she's kind of disappears because I'm also looking at the eagle coming in And I feel like we want to have just a bigger moment And if that means maybe you have to extend the shot a little bit since he's just kind of coming in There's not much going on there. I would have a little bit of a Flutter in the in the wings here. Just like you have here, which is cool But you might have to open up the shot make it a bit longer. Just give it is a Jump hang time. So it's almost like it's almost there grabbing it And I know that means that maybe the eagle will be higher because Maybe not. I think it might just be Do this jump up down and just kind of re-time the eagle so that this still happens that it's an almost grab But this this he should be grabbing it. So I would still back time that guy so that when the Squirrel is here. I feel like this is the pose of the eagle when this girl is here This feels like it would still grab the guy so it's make change a little bit for another for bit more of a near miss And then it feels like It slows down. So me personally I will go Here and then on this you could have a flap but I will probably do less of a flap with his left wing and Have the bird look Maybe back with a little bit big eyes and as well cartoonified this whole thing and Look back bit side with slight of slight flap and speed ups really This feels a bit more like he's easing in But do like this though here and then that's cute comes out and that's that alright. Thanks All right, there's an email you can sign up you can start whenever you want You can submit whatever you want you get 16 submissions either way like and subscribe would be awesome. All right. Thank you


Hey everybody, this is Brett, and today I'm excited to do a quick walk-around on our very first 2022 Jeep Grand Cherokee WL package, or body style I should say it, is an Overland package, and I'm just going to do a quick walk-around. This particular one has the 5.7 Hemi, it's going to get you 22 miles per gallon on the highway, 14 city for an average of 17, 357 horsepower, 390 foot-pounds of torque, and this one's going to be able to pull 7,200 pounds with this particular engine, and it's got the 8-speed automatic, Diamond Black is the color, and if you want to see the full walk-around video that we've done, it's in the upper right hand part of the screen, a link to that video, and we are shooting this video in 4K, and you can see all the chrome trim on there, but the big thing is that we've had a bunch of Grand Cherokee Ls, so the third row, so this is the first only two-row Grand Cherokee that we've had on our lot. This one has the tow package of course, and I just wanted to show the back storage area, since I'm sure there's not a lot of videos out there yet of this. Here's your receiver hitch cover, but plenty of room back here, and those seats do fold down, pretty nice and flat, which I'll show you in a little bit, this one has the Macintosh Premium Audio System, it has a subwoofer back here, and it's going to come with a spare tire to get this gate down, you just press this button, and then the other thing I wanted to show you are those back seats, because they look really comfortable, and they also recline, so you can see that those seats recline like so, and then they also go down, and that's how nice and flat they go down, and if you look at it from the back here, and see that once those are down, you have a pretty good amount of room up to those front seats to store stuff, so you can put longer items in here. Now these back seats are heated, you get the rear air controls there, you get two USBs, two USB C's, 115 volt, 150 watt plug-in, factory floor mats, which button down into the floor so they don't move around, you do get the latch child safety system, there's two latch points back here for child car seats, this one also has the shades, which are a nice feature, and you can lock the doors back here, which I thought was pretty cool, and you get that wood grain trim, and I'll just quickly show you the interior in the front, now this is going to be just like a Grand Cherokee L, this particular one is the Overland, and it does have the panel roof, so that's the quick walk around, and hope you enjoyed the video, remember if you want to check out the full walk around, it's like 16 minutes long, you can check that out in the upper right hand part of the screen, thanks again for checking out the video, and hope you liked it, and go to our YouTube channel, which is youtube.com slash summit auto, and check out all the videos that we have there, in fact in a second you will see a link to subscribe to our YouTube channel in the upper left, a link to more Grand Cherokee videos like this one in the upper right, a link to a bunch of auto show videos that we did in the lower left, and a link to one of our latest YouTube videos in the lower right, click those, check us out, and remember to like, subscribe, and share, thanks again for checking out this quick walk around on this 2022 Jeep Grand Cherokee WL body style Overland in Diamond Black Metallic, thanks again for checking out the video, remember to like, subscribe, and share.


Hey everyone, my name is Martin. Thank you for having me today. I will be talking about the seven phases of a smart contract hacking In this talk my my idea is not not to jump and dive into technical parts of what it means to hack a smart contracts but actually I want to give a little bit of perspective and Try to talk about the bigger picture of what does it actually mean to hack a smart contracts? so if you're up and tested if you are not a back hunter a Perhaps working in application security or or other realms of information security. You can jump into the Ethidium ecosystem and start helping us secure the entire platform. So a little bit of background about myself. I'm Martin I'm a security researcher open sapling one of the leading companies in a smart contract audits in ethidium I'm a systems engineer. I'm doing a master's degree in cybersecurity and cyber defense at the University of Buenos Aires And I used to work as a pentester mainly on application security infrastructure mobile applications web applications at a big four and Then I jumped into being a security researcher here open sapling Well, let's say again that you are a pentester. You might be a back hunter a white hat hacker and Perhaps working other realms of information security But you're interested in blockchains in smart contracts You have heard about them because to be honest, we have hit the headlines a couple of times There has been many hacks in the latest months Around smart contracts in ethidium so as you see many hacks and In my opinion, we need more and more security experts to jump into the field and to help us secure the entire ecosystem So this talk is mainly aimed at you And the question is if you can hack a smart contract, right? If what knowledge do you have already that can help you out here? In the smart contract world and that you can start applying today to start hacking smart contracts And well the answer is yes that you do have some knowledge Because you do know which are the seven faces, let's say of a typical security engagement I'm gonna say seven. I don't mean to be strict with these faces that we'll be talking about It's just a way of organizing the talk But perhaps when you do back hunting some faces you might skip them or you might do others But the idea is to outline our work as security auditors or back hunters or what hackers in these seven faces So we can have a common language So to talk about this well These are the seven faces that I have That we will be talking about first is scoping the reconnaissance identification of vulnerabilities Exploiting these vulnerabilities that we have found What does it actually mean to do post Exploitation is in the smart contract world and we will be asking ourselves if whether that's an actual thing or not And then we'll be briefly covering reporting fixes and retest So you might be already familiar with these faces The idea of today is to see how these faces apply in the smart contract world And where we can start drawing some parallels between these faces and the ones that you are used to to apply So let's get started Let's talk about scoping If you come from the let's say application security world or maybe doing pen testing for infrastructure Exposed on the internet. You might be familiar with the fact that you have IP addresses, right? You When you are scoping your work, you will be given an IP addresses that will help you understand the systems that you that you are about to audit or assess In the Ethereum case, we also have addresses in this case. We have Ethereum addresses. I know they are not the same I know there are many differences between them by the idea is to start drawing as I said before some parallels between the worlds So we can think about these addresses as ways of allocating like not allocating but Locating resources, let's say in the first case on a network and in the other case on the blockchain When you are working in smart contracts, you will not only have a one Ethereum address But you can have many Ethereum addresses that are related to each other And you may not even have Ethereum addresses, but actually you can have domain names, right? As in the classic world, you have the DNS that will help you resolve from read human readable Names to actual IP addresses in Ethereum We have the Ethereum nice service which will help you translate Human readable domain names like John Doe.ith to Ethereum addresses such as Wonder But sometimes most times actually you won't have perhaps you won't have an Ethereum address or many addresses You may be you might only have Solidity source code and Solidity is the smart contract language that we use Nowadays there might be others but today is the smart contract language that is high-level and that can help you code smart contracts in an easy way, let's say so You might be given a Repository with these files or you can actually find that source code in Ethereum scan Which is the main explorer for the Ethereum blockchain and at this point the Engagement will become something like a white box engagement, right? You will have access to the source code, but there are ways as we will see later So actually deploy these contracts and to start poking around with them last living program So there are two ways perhaps of of approaching the the assessment So if you want to go to ether scan you can find the verify source source code there This is for instance the source code for die one of the main stable coins in the Ethereum ecosystem And you can go to its address and retrieve the source code there But if you don't have the code you can actually decompile the evm bytecode and try to Read it in a more in a more like a nicer way using evm, right? So this is a decompiler for Solidity code and will help you Understand what's what's behind this is sometimes difficult to parse evm bytecode and will give you a more readable way to understand it and So again, you might have the source codes But if you don't and you only have an Ethereum address you can use this the compiler that can help you out Well, once we are done with this scoping phase we move on to the second one which is reconnaissance in reconnaissance We basically once want to understand what's in there, right? so we might be given as I said before a list of files and We are not only talking about one two three But many many and several files that you might be given and sometimes the names of these files don't even Make much sense at the beginning, right? So you we see here like files names flap flip flop and there is not so self-explanatory to be honest so We need to start looking deeper into the files and to actually understand what they are doing But when we look when we look deeper into the files, we will see Solidity code, right? This is what actually actual Solidity looks like And just a brief example for those that are not familiar with it It looks like another object oriented language at the beginning the six the syntax is similar as you go deeper and deeper into Solidity You might start seeing Several differences with our languages, but again the first look of Solidity looks like another object oriented language But if you go to actual files to actual Solidity files today being used in Ethereum You will see that sometimes developers Are not that clear with their intentions of the code and you will see that functions Have weird names and variable names are not that clear and you cannot make much sense out of The things that you already in the code, right? So it might be a bit disorganized or repetitive or the function nice might not be the best as we see in these cases But luckily there are tools and there are things that we can start doing in this reconnaissance phase that we can help us Get more familiar with the code understand what it's trying to do So in this case what we want is a we want to understand the architecture the interactions between the contracts We want to see where the contracts expose functions because we need to use the mass entry point for attacks We need to see the inheritance chains of this contract and many other things, right? But I want to make a special point on the intention we as Let's say auditors or backhunters looking at the Ethereum smart contracts We need to understand the intention of the code right intention is not usually the same as Implementation so we need to find the differences between intention and implementation and actually start digging bugs in that in that sense So a special attention to the intention of the code and not only what it's actually doing, but what is what it intends to do? For these three last points for the roles of the system the integration points and intention the work in reconnaissance becomes a bit of a Manual work and reading documentation ring the code we input requests Perhaps talking to developers From those things we can start understanding these points, right? But for the others there are tools that can actually help us In a really nice way as we are about to see so if you want to see Some things about inheritance chains. For example, you can use ether scan. We can use Surya Slither, which are tools That can help us print This kind of theorems of inheritance and can help us understand how do contracts relate to each other in a codebase It's a slither that is ecstatic analyzer can also help us See which are the exposed functions of a contract so we can see where it has many public functions Which are these public functions how they To which contracts do I belong and if there are private functions so in those contracts related to the spread to these public functions So it's easier can help us explore this There are also ID plugins such as in visual studio code You have the soliti auditor plug-in which is super useful and as you see here in the give it can help you track for instance Function calls and starting from a public function call You can go all the way down to the private calls and see Whether in this way you can track different bugs in the code And another thing that is super useful that I at least myself and useful Are diagrams so these diagrams are things that you can actually draw yourself put you better yourself and Can help you out really to find Several bugs in the code. So give it a shot try it out Please don't go so crazy on it. But again can help you Understand the relationships between different contracts and functions and dynamics of the system So that's about it with reconnaissance. We have seen tools. We have seen Manual things that you can use And now let's get on to One of the most interesting parts I guess which is vulnerability identification So this is one of the main objectives of our assessment is to actually find vulnerabilities in the code And if you're a beginner with it, uh, I wouldn't recommend you to start trying to hack Smart contracts in crazy new ways. I would suggest that you start with the basics So you might read the master team ethereum book. You can read online databases of known attacks We have the swc registry which classifies vulnerabilities and With different test cases, uh, of course, not all vulnerabilities nor all witnesses in smart contracts But the most common ones, uh, are there and you can go ahead and read them And start learning which are the basics of smart contact security But if you like learning with as playing, uh, like learning by doing you can Play the ethanol by open sampling, which is a kind of a capture the flag challenge A set of challenges actually And it's super fun and can help you understand how to hack smart contracts and learn about security in that way One thing that also, uh, always, uh, surfaces when we talk about vulnerability identification in smart contracts Is this difference between automated and manual work, right? I think this also happens in, for instance, application security where where you may have like scanners that can help you out Identify vulnerabilities in an application But all Also people or pentesters hackers tend to also do some manual work So I guess it's always, uh, about Complimenting the automated manual work. You shouldn't lean fully lean towards one on another But doing both automated and manual Work to to find out these vulnerabilities And so in the automated, uh realm We find many tools that can help us out in Ethereum For smart contracts in Solidity or perhaps you don't even need for some of these tools the the source code You can only have the even ebm bytecode. We have a sleet there mantic or a key Nami three various olpacala and many more Uh, I won't dive deeper into this the the program analysis world is Extremely interesting and it's a whole world on its own. The idea of this talk is just to briefly Uh, present them Uh, and to also mention that of course the automated tools we while they are good They might have bugs, right? They might not always work as expected They might produce false positive and they may not even find The most critical bugs. Uh, so last year we Ended up publishing a post when we found a critical vulnerability in the maker. Now contracts Uh, and we realized that many of the tools weren't capable of finding that that type of bag And the forum post became really interesting with when the The authors of these tools Jumped in and started explaining the improvements that they were applying in the tools to actually find the bag And I think that right now many of these tools are already capable of finding the This bag that we found at maker So the automated tool world is is always moving forward and coming up with new ways of finding vulnerabilities. That's super cool But also we do manual work, right in this case we focus on the business logic and the intention of the code And this actually means that uh, at least in it at least in my experience Most of the most critical bugs that I have found in smart contracts come actually from business logic Uh, and not from let's say solely common patterns So by understanding the business logic of the contracts, you can actually start Uh, highlighting these differences between implementation and intention and start coming up with different attack vectors to break the contract Uh, special care should be paid to sensitive functions. And when I mean when I say sensitive I mean Functions that may have convoluted and mixed logic functions that uh, let's say handle decimals Arrive signatures, which are usually not so straightforward to do in Insolidity so usually developers need to come and come with different hacks to to implement. Let's say handling decimals So, uh, there might be bugs there dangerous math and Functions making external calls to untrusted contracts is also something that we should be paying attention to and uh users of assembly or low level calls in Solidity is usually Uh, a good source of vulnerabilities that I have seen In my years doing doing smart contracts So again, some of these Are really important things that we should be paying attention to when we are assessing Smart contracts in a manual way But there are more right so we can also pay attention to the interactions with external dependencies And in this case, let's say other protocols price order calls decentralized exchanges are points of interaction that Sometimes can trigger different dynamics different functionalities or unexpected things in the in the system that we are trying to break Uh, another thing to to pay attention to is the impact of these dynamics of novel dynamics extreme I'm expected ones that Perhaps the developers didn't take into account with when they were developing the system and we Should be paying attention to so for instance Flash loans have been the big new thing recently in defying ethereum and with with the introduction of flash loans. We have found that Many projects ended up having problems in their dynamics and their incentives just because flash loans were available to everyone in the ecosystem Having a clocked network is also something to take into account when we are analyzing smart contracts. What happened if The network is highly congested and transactions cannot go through What happens if the price of heat goes down? by half And how would this project that i'm analyzing would react to that And another cool thing going on right now in ethereum is front running back running and transaction ordering So there are lots of bots right now in my net Playing with front running and back running and these are things really interesting things that we should also take into account If we are trying to find vulnerabilities, right? How would the project the contract we are seeing reacts to these kind of things? well once we have a Found vulnerabilities is time for us to exploit them right another fun part of being of doing security research is Actually exploit the things that we found To do exploiting what we want is actually first to have an reproducible attack vector and that means Have some way of sharing with the clients sharing with The bug bounty report that we are how to submit that we have a reproducible attack vector And we are proving actually that there is a vulnerability and that can be exploited and there is a certain scenario right And we also need to understand the impact that this Actually exploiting this would have in the system And for the impact to be honest, we usually also need to see Or to actually to understand How would the system Work and how would the system react to our exploit and what is the actual impact in the business logic of the system, right? So we need some knowledge Business logic related knowledge to the system that we are we are assessing To do exploiting my recommendation is to also try your exploits in a local testing environment You shouldn't do that at main net, of course So you can first spin up a local node. You can do that with ganache or with geth Geth allows you to have a development mode. So Your test will run faster and with ganache. There is a cool feature that you can do is to actually fork main net and So you can Point ganache to a Let's say a full node fork main net into your local environment And actually run your exploits as if they were to be run on main net But you will be like Causing no damage to any project out there To interact with nodes, you can use if you are Hacking on javascript. You can use web 3.js or ethers But I think that web 3 is also available for python and if you are wanting to do bigger things That perhaps It would be too difficult to only to only do with web 3.js or ethers You can use bidler or travel which are kind of frameworks or Tax tax runners that can help you Do more crazy and bigger things with your exploits These are the ones that I personally use and the ones I recommend But of course there might be others out in the space that can help you out too If you want to see some exploit examples actually using some of the tools that I just mentioned We have published in the open sapling github repository An exploit for the uniswap vulnerability that was found by another auditing company by consensus deletions last year And that we ended up publishing A proof of concept Exploit on how that vulnerability would come exploited for some kind of tokens in uniswap pools And the exploit is readily available there and it's public and for you to See and run it in your local machines. Interestingly this exploit was actually I don't know if this particular exploit but the vulnerability was later exploited in the wild in some real uniswap pools I have also published myself some Exploits example in my github repository And in February this year, for example, we also at open sapling publish A way to backdoor nosy safe wallets one of the most most popular wallets in the space during deployment And we in this post that I keep leaving you the link there in this post We are actually publishing the proof of concept exploit on how to Backdoor nosy safe wallets during deployment But also we have the possibility to to reproduce real exploits in Ethereum So you can see here a transaction an execution trace of a transaction that actually Stole More than 24 k usdc last week on approaching in Ethereum on main net. This is real And we there this the attack not only was made up of a single transaction, but many transactions and cost a lot of fund losses In this project So you can actually see these transactions because transactions are public in Ethereum. You can see The interactions between the contracts and you can even go ahead and reproduce these real exploits on your local environments So that is something something pretty cool Well, moving on after exploiting we can begin talking about post exploit exploitation, right? So The big question here that I I've been asking myself myself when preparing this talk if this is if this is even a thing, right? so In the application security world, perhaps you might be thinking of like pivoting open in a shell moving to our systems Champing around the network, but perhaps in this in the smart contract world that is not possible or that is It is not that easy to draw draw a parallel between the smart contract and our walls so Again, we shouldn't think of having a shell here But perhaps we can start thinking about when thinking about posted exploitation. We can Try to extend or elevate access to the smart contracts We can cost for the consequences in our components or even even In other protocols by going beyond beyond the exploited system that we are assessing, right? So in that sense, there might be some parallels between In this post exploitation phase, sorry So, uh, let's go to an example to see to better see what I mean by post exploitation hero So let's see a compromise oracle case In this case, we have a let's imagine a platform that is selling collectibles is selling these kitties And you pay it and it will give you away some kitties depending on how much if you have paid But this platform actually uses the price in In each of these kitties But uses a price oracle to fetch the price in it, right? The price oracle is basically another set of contracts where the price in each of these kitties is registered by someone and But in this case if you Can end up finding a vulnerability in the price oracle and you can compromise the price oracle You can actually compromise The system that is relying on the right because you can set for instance the price in each of these collectibles to zero You can send a transaction to buy all kitties and you can steal away all kitties in this platform And that is not also true for a single platform that relies on this oracle, but it's also true for all A platforms that are actually relying on this price oracle This is an actual problem that I think that we have nowadays in ethereum The more pro projects that are relying on a single oracle or just a small number of oracles The greater the incentives the economic incentives to attack a price oracle to compromise it and to Basically pound every single project depending on it So this is basically what I mean with post exploitation We can compromise an oracle and by doing that we can move on to other projects and execute attacks in in in them as well moving on We have these Last phases which is about reporting doing fixes doing retests and I believe that There are many many many similarities with the With our information security realms. So I don't think I should dive deeper into this Um, of course we do reporting of course we review the fixes for our clients. Of course, we do retest to make sure they They haven't reintroduced the vulnerability and have actually fixed the things the things that we have reported So we do all of that. That is basically the same But one thing that we should be highlighting here is that in the ethereum world Most if not all but most Uh security reports are public. There is something that you don't see in other words, right? There is something that for instance me working as a pen tester for banks in my previous job I wouldn't have even imagined that I could at some point make public a report, right? But in the ethereum world that is true. You can do that. Of course agreeing that with the client But um, I think everyone is encouraged to actually public their security reports because in that way we can all Improve the ecosystem. We cannot learn about the best security practices with which things might not be the best for Sometimes of projects and also to have the perspective of other security auditors in the space and Yeah, learn from from each other and and make everything In the open and as transparent as possible So we have public security reports and you can go to for instance our blog at open sepuline And many other companies as well are publishing their reports and you can read them and learn tons about Smart contract hacking and security and research just by reading those public security reports So that is something that I wanted to highlight because I think it's super valuable in the space Um, well and to end this talk Uh, I I wanted to leave you with a little surprise, right? I don't think Today I I have covered many things Like technical on the technical side just because I wanted to as I told you at the beginning I wanted to give you like the bigger picture of what does it mean to hack smart contracts and how do we structure our engagements? um But if you actually want to look at code and run some exploits and try to break smart contracts I think you might find this super Useful and entertaining It's time for you to start hacking smart contracts So you can start applying all these learnings from these phases that I have been telling you about You can go to my github repository. It's already public and you can start hacking a set of smart contracts That is based on a governance system using flash loans and token snapshots all things and features super popular nowadays in the fee space and here you have An example on how that can be severely broken and you can be the one attacking it and breaking it. So please have fun with it and Hope hope to get some feedback on that if you if you happen to play it So, thank you very much. You can contact me on Telegram on twitter on github and all these platforms and you can find me as tinge abate And you can learn more about information security related to smart contracts in our forum in our blog at openseparim and yeah, happy to Happy to help you out with anything related to this and yeah, please Ping me if you find this interesting. So thank you


Guys this piece is gonna be so sick. Okay. It's gonna be the colors of this right here. Oh That tastes so good. Oh, baby. Let's get it All right guys Here it is ready My result is oh So beautiful