My name is Vinky Shankar and I work on the cluster first into that and I am the team leader of the replication team and with me I have few of my cluster folks here ready for answering your questions. Okay, so let's begin. So before we start how many of people have used cluster? Please raise your hands. Okay, a few. Okay, Hadoop. Quite many. Okay, so let's see. So let me start by talking a bit about cluster Fs itself and then we'll move with the Hadoop big data interface part. So obviously cluster Fs is, we are obviously storage. We can scale to petabytes. We have distributed scale out mass. And essentially what we do is we are posix compliant and also we are metadata less. So if you have used any other distributed storage, there's a concept called as metadata server. That is a single point of failure. If that goes down, essentially you can't access any files in your distributed system. That's because the metadata server has all the engines. So what cluster Fs has, a big advantage is we are metadata less and because of that we are in a very good shape. Okay, let me focus a bit about scale out and distribute feature here. So with scale out, so any of you who have used cluster Fs, we have different topologies in which you can set up your cluster. One is a distribute, distribute replicate, and distribute replicate and strike. So with distribute, actually what you do is you have a bunch of servers. You configure your cluster in a distribute mode and your files are actually hatched to different nodes. So if you want to access files in parallel, you are actually spreading out your load on different servers.  Okay, so at the very top level, that's what I talked about, cluster Fs coming a level down. cluster Fs is also Hadoop ready. What do you mean by that? So Hadoop is actually a map-reduced framework plus HDFS. HDFS is Hadoop Distributed File System, which is basically has a centralized metadata server also called as name node and a bunch of storage nodes also called as data nodes. So where do we come into picture? So as you saw in the earlier slide, we are metadata less. So if you are using cluster Fs as a backend store for Hadoop, you are actually eliminating the name node, which means you are left with the client machine in which the macro is your branch and the storage nodes. So for Hadoop to use the cluster Fs plugin, Hadoop to actually talk to cluster Fs, we have something called as a cluster Fs plugin, which we will come in the next slide. So the good thing about that is, if you plan to use Hadoop with cluster Fs, one first point is you save data ingestion time. So how does that come into picture? Suppose you are running a patch of a server and you have lots of access logs, your site is getting hit pretty badly and you have lots and lots of access logs and you now want to analyze data. So what do you do? You pick up the access logs and dump it to HDFS. So as you see, you are actually copying data from one file system to another. Where cluster Fs can help you in that is just because we are a process compliant file system and the interface to cluster Fs is via what we call as a native protocol or the fuse client, you can actually mount a cluster volume as a normal UNIX mount product. So if you see what you can do in your Apache web server, just point your log directory to the mount point and there you are done. Every request that is logged by Apache web server is actually going into cluster Fs. And now when you want to analyze data, you use the cluster Fs Hadoop plugin and do your analytics. So where we save time is in the share. Also another great feature is you can access data via multiple protocols. That is, as I just told about it, fuse client is something which is one of the widely used way of accessing data on cluster Fs. Other bits include NFS, HTTP interface, which is OpenStack Swift. We also have a plugin for that. So you can use the rest APIs to put, delete and get files from cluster Fs mount point and obviously Hadoop itself. Now you have your data on cluster Fs. Now what do you do with it? You run MapReduce jobs on it. And how do you do that is what we cover in the next slide. So what does it take to run MapReduce jobs on cluster Fs? Two things. One, a cluster Fs Hadoop plugin, that is a jar file and a configuration file. That's it. So a plugin. What does a plugin mean? It has to be pluggable. Your application need not do any rewrite of jobs. It need not be rewritten. You just take the Hadoop, cluster Fs Hadoop RPM or build it from source, govish and just install it on a machine. Do one configuration file, which I'll be showing you as a demo. And then that's it. No rewrite of application. Let me cover this a bit about the plugin itself. As of now, it's tech preview. That means you could have bugs in place. So if you find it, please report it. So how does it work internally? So Hadoop actually provides an interface called as file system interface. So what we do is just extend that interface. So that interface covers basic operations like open, close, which is very, very basically to access a file anywhere. And some advanced API like get me, given a file, get me all the blocks. Where is it in distributed in a setup? And what is the chunk size? So there are very, very low level APIs and very, very difficult APIs in which you need to put that API in a way in which you understand the underlying file system. So the cluster Fs plugin does all that for you. And the communication to the plugin communicates to cluster Fs via, as I told the fuse mode or the network. The other thing that is very close to Hadoop is given a file, where are the blocks? With HDFS, you actually have a centralized metadata server. So the MapReduce framework actually contacts the name note of the centralized metadata server and gets the list of blocks. With cluster FS, since we don't have the name note, what we do is there is something called as an extended attribute in a file. It's a file system concept where you can store key value pair associated with a particular file. So actually the plugin itself talks to cluster FS, queries the extended attribute, gets the required amount of intelligence to give it back to Hadoop. And that's it. Then Hadoop takes care of scheduling jobs. So what we have tested it so far? We have tested it with MapReduce, existing MapReduce applications. That is these include applications that ship with Apache Hadoop, the example applications. And there's something called as Apache PIC in which you do a scripting kind of thing. It's not a shell script. It's a normal scripting language. You give it to a PIC binary and it converts it into a MapReduce application. So we have tested it with Apache PIC as well as HBase.  Now that's it for the talk. I'll just demo. So yeah, one more thing I want to mention the plugin itself only works with Hadoop, this version of Hadoop, 0.20.2. It's tied to this version. We are working on extending the plugin to support other versions. Also the current 1.0, but that's in progress. That's in the timeline. Now I'll show you what configurations you need to do. Once you have untied Hadoop and done all those relevant changes to Hadoop and PNV, there's something called as... This is the Java. You can actually build it from source or have an RPM in stock. Anyway, it should be present in this specific location. Untied Hadoop and there's a lib directory. Put it in there. This is the Java file and we ship a sample configuration file which you need to edit. That is core site. Please don't touch this one. This tells Hadoop to load the cluster FSjar. The rest of all is what you need to touch. Currently I'm running a one node cluster on my laptop only. FS.default.name should be in this format. Cluster FS. This file will present in all the nodes in the cluster. This should be the name of that particular machine. This is the volume name. Anybody who has used cluster you can create a volume. As I said, it can be distributed, replicated, striped. You create a volume that is through cluster CLI. I created a distributed replicate volume with four bricks. These are my export directories. This is my volume name. I use the same volume name here. This tells Hadoop to actually mount this volume via the native protocol. You can run map reduce jobs on the data present inside this volume. Next is the mount point. Because we use to do a fuse mount, you need to give a mount point. This directory should be existing. That is put it here. The final thing is this. Because it needs to do a mount, you need to give the host name or the IP address or any storage node. This is a performance tunable. I will explain this. Currently, just leave it to off. This gives a good performance boost. That is because of the way in which the plugin works. We have seen some bugs in that. For now, just leave it for off.  Before that, there is a map red site. This you need to do for your HDFS thing. This has to be pre-done with any system. Once you have done these, what you do is you do start map red.sh. I have already done that beforehand. What you will see is some demands running. These are two demands. One is a job tracker, one is a fast tracker. Because there is a single node cluster, you see it in the same host. Once that is done, now you need to copy some files. Here is the mount point. What I will do is add some files in this directory. In data. I have copied some files. As an example, you are a patchy web server. Your log file directory would be actually pointing to this. Whenever there is a hit on your site, it will be locked here. What you can do next is run some jobs. Before I run a job, there is this thing called for loop shell. It provides some basic. From this shell, you can run a map red job. You can run a normal file system operation. Let me run a normal ls. If you see, because now I have configured it in core site, in the configuration file, it is initializing the cluster of s. Then it dumps all those. As you see it here, in this, you see the same thing there. This is Hadoop's way of reading. This is the way to test out whether your configuration is fine or not. You do well as you do cat or something. This works. Now, coming to the actual MapReduce, I have this. This is the example file that ships with Hadoop. It is called Hadoop.examples.char.  These are all MapReduce apps. Pre-written for your thing to test it out. What I will run is, I will run a grab job, a distributed grab job, and maybe a distributed wordcom. Let's see. How do you run grab? Just to grab, it will show you how to run it. You do in, underscore, there. You don't get the actual mount point, mnt, Hadoop. Don't do that. That's internally there. The plug-in conversion file. Just get in there, and out there for grab, and then get the keyword you want to grab for, out there. Now it's running MapReduce. It's 0% map, 0% reduce. It's using the surface behind. Slowly, ready for catchment. Once this is done, currently you can see that if you do a normal list, you'll see the directory is getting created. This is what I talk about multi-protocol access. You can run it from Hadoop, see the output from a different mount point, from HTTP, whatever. Once this is done, let's do a cat of how data of grab. The preference is eight times of the list. Another job is called word.com. Once this is done, it's done. There you go. Word.com, the original file. So I'm done with that demo and the talk. Any questions? Yep. And you're saying you specify the name node in the course name configuration? Yes. Which node do you specify here? Any storage node. So to mount, you need to give the IP or host name of the storage node. Just give it that. And you keep it uniform, so that you can copy the same file. You need not do an edit. Keep it same so that you don't have to change the configuration. What is the performance with respect to HDFS? What's the performance with respect to HDFS and MAPA? So with MAPA, we are unable to test it with HDFS for read-only workloads. We are on par and for some of the jobs, even better for read-only workloads. But for write workloads or a mix of read and write, in which say it's 70% write and 30% read, we are a bit slow. But we are working on having buffering at the plugin level to improve that. But if your job is purely read-only, like there's grep and work on, in which mostly it reads, reads, reads. So we are on par and even better. If you choose distribute, distributed, replicated, striped volume, you are actually scaling out pretty well. Typically, people who use data processing can do that sometimes. But there's data mostly inside and outside. So there is a way to get the data in. So that's what it is. So why do you kind of protocol activity protocol or something like that? We have a STTP access to files on the surface. That's for OpenStack Swift. We have modified it to talk to the surface. You can do that in place. And then directly via STTP rest calls, you can do put, get, and even delete files. Or you can do the classic Unix way of mounting it. I don't think a native mount or a NFS mount. Or anyway, you can use the Stadoop schedule. So I told you to a FS. I can show you. FS, like this hyphen ls. There's a hyphen port I think. And a hyphen get, hyphen cats. We can use even this. But what we recommend is either you use the Unix, classic Unix way of mounting it or through a STTP. It uses fuse mount. It doesn't do JNI and load. We have a live cluster FS client coming up, but it doesn't use that. It doesn't use JNI to load that and use that. So if you see here, right, a lower mount, it actually does a fuse mount, native mount, and uses that. So what you are seeing here, it was, the plugin will see in its namespace like this. You mount it and then configure FS to store lockfiles in that.


First off, I have a couple slides in this talk that have a bit of small font for code samples and stuff. So if you go to this URL, thanks to the great website that this event has, you can just like look at the slides on your own laptop. All right. I'm Jan Horn from Google Project Zero. I'm here today to talk about some tricks that can be used to exploit race conditions in Linux environment. All of the bugs that I'm talking about have been fixed for a long time, like one of the bugs is from like 2016 to other stuff from last year, and all of the exports are against kernel 4.4, which an Android land still is relevant for some devices, but of course on desktop Linux land is very ancient. But the focus here is on like exploitation techniques, not on the individual bugs, so I think that's fine. So I'm going to be talking, I'm going to be using three different bugs as examples today to talk about exploitation techniques. The first bug is something that gives you a use of the free of a physical page through a state LTLB entry, and exploiting that requires hitting a narrow taming window, and I'll talk a bit about how the behavior of the body allocator influences how you can exploit this and how you can play with preemption and with the scheduler to make your race window bigger. And then there's a second bug that was a kernel bug that let you decrement the reference counter in a struct file, and I'll talk a bit about how you can exploit that in a way that would normally be a race condition, but then use user fault FDN fuse to make it deterministic again, and how the KCMP's call helps with exploiting use of the free bugs. And then there's a third bug, which was an Android user space bug, where exploitation required a primitive that was somewhat similar to what you'd get with use of user fault FD, but those are unavailable on Android, so I'll talk a bit about how you can sort of build a poor man's alternative to that. Okay, so the first bug I'm talking about is a race between the Emory map and F locates as calls, has a quick bit of background, but you need to understand how the bug works. In the CPU, you have the translation look-aside buffer, which caches page table entries basically so that you can do address translations faster than always walking the page tables, and while the page table entries are essentially like ref counted pointers to pages, the TLB just borrows references from your page tables, because the CPU isn't going to be incrementing and decrementing references on your page structures. So this means that when you're removing entries from your page tables, you need to also clear out the corresponding cache entries in the TLB, otherwise you get a use of the freeze. The first syscall that participates in this bug and the one that actually had the buggy code is the Emory map syscall. Emory map can be used to move a memory mapping from one virtual address to another virtual address. This of course requires creating a new virtual memory area structure and so on, but it also requires moving the actual page table entries and allocating new page tables for the destination address range. So Emory map has to go and allocate new page tables for the new mapping, then move the page table entries over from the old mapping into the new mapping, and then clear the translation look-aside buffer for the old address range. The second syscall that participates in the race is FAllocate. FAllocate allows you to allocate a deallocate space for a file, and if you use FAllocate to deallocate space on a file, it not only deallocates pages on disk, but it also tries to free up page cache files, sorry, page cache pages that are currently cached in the kernel. So when you use FAllocate, it has to go and iterate through all of the virtual memory areas across different processes on the system that include this file range and then tries to yank out the pages from them. So it looks for page table entries that are non-zero, deletes the page table entries, flashes the TLB range, and then drops the references on the pages. And the race here was that Emory map didn't hold any locks between the time it moved the page table entries from the old address to the new address, and when it did the TLB flush out the old address. So this means that you could have a race where first Emory map moves the page table entries from the old address to the new address, but you can still have still TLB entries for the old virtual address. Then FAllocate comes along, deletes the page table entries to the new address, does the TLB flush that removes entries for the new address range, but not the old address range, and then FAllocate would drop references on the pages. And at this point, you'd have still TLB entries pointing to pages that have already potentially been put back on the page free list. So this gives you a use after free of a physical page. And on Linux before 4.9, this was actually exploitable to get write access to pages. Starting with 4.9, getting write access was a very narrow timing window. And only read access to pages was easier. So I decided to write an exploit for the Pixel 2 phone, because that still runs a 4.4 kernel. So the first exploit idea that I had here was, okay, we have a physical page in the free list, and we have like full read and write access to this page. Let's try to reallocate this page so that it contains kernel data. The thing is that the kernel page locator, the body allocator has the vaguely this behavior I have up here. This isn't entirely accurate, and if someone here knows the allocator, please don't think to badly of me for simplifying it this way. But basically, the idea is that we have this free page that gets put onto this red per CPU free list up there, which is a free list that is specific to the migration type, migrate movable, for pages that can arbitrarily be moved around by the kernel. And kernel allocations for the kernel and all data structures normally come from the migrate unmovable lists. And the page allocator kind of tries to keep those memory types separate. And if you want a page to move from like movable type to an unmovable type, you need to create memory pressure and stuff. And it gets messy, and I didn't want to deal with that. So instead, I decided to go for reallocating the page as, again, a page belonging to user space. So you could either reallocate the page as an anonymous page in some other process, but that would require you to interact with another user space process, and that user space process might do other things that disturb the kernel heap and so on. So that didn't seem like such a good idea. So I decided to go for reallocating the page as a page cache file. So what this means is you trigger this bug to get the page freed, then you trigger a read on a specific page in some shared library that is used by a privileged process, and then this read will allocate the page that you just freed and put it in the page cache for the file, read data from disk into this page, and then hopefully you can modify this page of code before some privileged process continues to use this code, and then you can escalate privileges into the context of that process. There are two things that make this kind of hard. The first thing is that you need to detect when and at the right point where you want to interrupt it and do your allocate operation. Luckily, as an attacker, we can use procfs for this because procfs contains statistics about the memory usage of each process, including specifically how much memory is used for page tables. So we can see exactly when mremap is allocating memory for new page tables and then use that as a signal. The other thing is that the way I chose to exploit this requires that we have this TLB entry long enough. It requires that the mremap operation takes so long that in the middle of the mremap operation we can not just reallocate the page but also do disk.io because we want to be doing our use after free write after data has been fetched from the disk into the page. Otherwise the disk is just going to overwrite the data we put in there. So the plan for exploiting this requires knowing a bit about how preemption works. So Linux has, on Linux, user space programs can always basically be preempted by sending inter-processor interrupts or something like that. But it gets more complicated when you're running in kernel context. Linux supports three different preemption models. One of them is the voluntary preemption model where kernel code explicitly calls a con resched to say, hey, I can be preempted at this point. And this is used by many Linux distros by default but Android uses full preemption model in which you can send inter-processor interrupts to a interrupt but to preempt kernel code that is executing in almost any context as long as it's not holding a spin lock or something like that. And importantly, new taxes do not be able to spin locks, new taxes do not prevent preemption. And Linux also gives us a lot of control over the scheduler's behavior. So basically the idea is that you can tell the scheduler to make your task run faster, give it higher priority, but you can tell the scheduler that your own tasks should run at a reduced priority or should only be running on certain CPU cores or things like that. And if you, for example, say this task should have idle priority, it should run at very low priority, and there's some other task that's running on the same CPU at normal priority, then you only get working up something like once a second. Also a task with idle priority never preempts other tasks. So this means that if you have an idle task that is waiting for some input to arrive, and then that input arrives, but some other task is currently running on the same CPU, then you will not be switching over to the idle task until like the next scheduler takes arrives or something like that. And importantly, these scheduler controls do not just affect your tasks when they're executing user space mode, but they also affect the execution of kernel code and in syscore context on behalf of your tasks. So this means that you can, for example, create two tasks yourself, put them on the same CPU core. By telling the scheduler these tasks may only run on the CPU core, set one of them to idle scheduling priority and the other one to normal priority, and then let the idle priority task start executing some syscore that, for example, takes a lock at some point. You can have your idle task execute some syscore and then in the middle of that syscore, wake up your normal priority task and then you can use this to stall the execution of this syscore, potentially in the middle of some race condition or something like that for quite some time. So here's a timing diagram of how I ended up exploiting this bug. I go through this step by step. So we have five tasks here across four CPU cores. Each task is pinned to a specific CPU core. At the start, we have tasks B and C sharing one CPU core, each other task has its own CPU core, and only task B is running at idle priority. Everything else has normal priority. Task E is the task that is a task that is just in a busy loop trying to read and write the page, the virtual address in the old mapping where we are about to get the LTLB entry. The idea here is that by in a busy loop, we are constantly accessing the address as long as the page table entries still exist. When the LTLB entry goes away, we are immediately refreshing the LTLB entry. And then later, when the page table entry has gone away and we slough out the LTLB entry, we can detect when the page contains the code we expect. So we actually know that the page was reallocated in place we wanted. And then we have the LTLB entry overrided. Task C starts off by readings from some empty pi which causes it to block, which means that at that point, task B can execute since it's the only thing that's runnable on the CPU. Task B starts executing memory map and starts allocating memory for page tables and moving page table entries. At this point, task D, which is in a busy loop pulling the statistics on procFS, can notice the progress of the memory map operation and wake up task C by writing to the pipe that task C is blocking on. At this point, task C preempts task B because task B is our priority on task C is not. So now, task B is in the middle of this memory map operation where we wanted. And the first thing task C now does is to move the task B over to CPU zero where task A is running and task A is just spinning a loop so task B is probably not going to get woken up for quite some time. And at this point, task C can use F allocate to perform the other side of the race, putting the page on the per CPU free list and then use the PreadSys call to read a page from the library we're targeting and reallocate the page as and at that point, hopefully, task E will then see the page cache contents and override them with arbitrary code. Okay. That was the first bug. As a second example, this one's a bit easier. This was a bug from 2016, a bug that let you arbitrarily decrement the ref count on a struct file. The bug itself doesn't actually have a race condition in it, but the way I chose to exploit it would normally be a race without special tricks. It's a bit of background for this. On Linux, you have two mechanisms, user fault, FD, and fuse that allow user space to synchronously handle page faults. In the case of user fault FD, that's precisely the intent. User fault FD is specifically a mechanism with the intent to allow user space to synchronously handle page faults. Whereas with fuse, you can basically construct the same primitive by mounting a fuse file system and then mapping a file from it. And when you have a page fault in a file that is backed by a fuse file system, the fuse file system gets to resolve the page fault at any time at once. And you can use these two tricks on like normal desktop Linux systems to arbitrarily block kernel code execution at any point where the kernel does things like copy from user, copy to user, get user, put user, and so on. But on Android, user fault FD and fuse are not exposed to unreligious code, so it's not really usable there. So here's the bug I want to use as an example here. Basically, you can see the code on the right-hand side. We have this FD get, which takes reference to a struct file. And then we call it this dip-dip-bpf-map-get function, which has an error case where it calls FD put, then returns an error code, and then we go into this if-al branch in the upper part of the code, and this branch again calls FD put, so it's like a straightforward bug that just over decrements the reference count. A syscall that's very useful for exploiting user-to-freeze on certain data structures, including struct file, is the KCMP syscall, which is available on kernels that activate a checkpoint restore. KCMP, you can basically see what it does on the right-hand side, is a syscall for making arithmetic comparisons between obfuscated kernel pointers. So the intent here is that if you have, for example, a process with a big file descriptor table and you want to figure out which ones of those file descriptors map to the same struct file, so in other words, which file descriptors share the same file descriptor object, instead of doing like pairwise comparisons between the file descriptors somehow, you can do like a normal N log N sorting algorithm, where as the comparison function, you use the KCMP syscall. So this works on a bunch of different data structures in the kernel that are quite important, including like struct file, mmstruct, file struct, and so on. But this is also useful for exploiting user-to-freeze, because for example, if in your file descriptor table, you have one pointer to a file, you have a dangling pointer to a file that has actually been freed, and then you reallocate that memory for another struct file and get a pointer to that in your file descriptor table, then you can ask KCMP, hey, did I reallocate the new struct file in exactly the same place as the old struct file or did I hit some other memory location? So this can be used to make exploits very reliable, and I think this also might have some interesting implications in the future unless it's handled especially for memory tagging, because you can ignore this if you don't know what memory tagging is, but basically with memory tagging, you have these tag widths as part of your pointers, and these tag widths are secret, and if you can leak them, you can defeat the mitigation. And this thing compares the complete pointers, including the tag widths, so you could use this to repeat leak query whether the tag widths are the same, and then if they're not the same, you can retry until they match up. Yeah, so here's what back in the four to four days, the VFS write function looked like. So at the very start of the VFS write V function, we have a check that checks if we have read access, if we have write access on this file descriptor, and if we do not, it bails out. So the way you can exploit the bug is you create a fuse file system, you map a file from this file system, you open a slash dev slash null as writable, and then you start a write V operation on dev null, which has its IO vector stored inside the fuse mapping. So the write V syscall comes in, does the check, sees the file is writable, we can continue, and then further down you can see this import IO vector call where we import the IO vector from user space. So at this point, import IO has to do a copy from user on this memory region that is backed by a fuse file system. This blocks until user space resolves the page fault by supplying some data. So at this point, we have as much time as we want to trigger our use of the free, free this dev null file struct that we are operating on, and reallocate it as something else. Now, normally when people exploit use of the free, they do stuff like replace the struct with a struct of a completely different type, so we turn our use of the free into a type confusion where we are interpreting numbers as pointers or interpreting a point of one type as another type or something like that, but what you can also do is you can just allocate another struct file. So we open slash dev slash crontab as read only, and then we can use the kcmp trick to check whether we indeed place the crontab file at the same location where we previously had our dev null file, and then if we see that it worked, we can resolve the page fault and do read v write v continues, and it performs the actual write operation on the etc crontab file. So now we can write arbitrary content in the crontab and elevate privileges to root, and this whole thing works without any type confusions or like rob or any of these things. Okay, and the third bug example that I have is use of the getpid con function in Android. So as background, when you have some system where you're integrating with SLinux, user space demons sometimes need to figure out what is the SLinux context of the peer that I'm talking to, like if you have some demon and it's receiving requests from some client and has to check, is the client allowed to do this? So for Unix domain sockets, the situation is pretty nice. You can use things like SO peer seg to ask the con, hey, what's the security context of my peer? But until recently, Android's binder IPC system didn't tell you that. Binder just gave you the UID and the process ID of the sender. So luckily there's a helper function that you can use in this case which is called getpidcon. You give it a PID and it gives you the SLinux context of the process with that PID. So obviously this has problems because, for example, there's the classic PID reuse problem that if the sender of the message goes away and then another process spawns and reuses that PID before you get around to doing this check, then you see some completely different SLinux context that has nothing to do with the actual sender of the message. And the way that getpidcon is implemented is basically that it opens in Proc FS under the process directory, the address slash current file, and reads from that. So in Android, there's this hardware service manager thing. You don't really need to know what it is, but it's basically like some demon that manages names. And this is readable from like the normal application context and from other places in the system. And this thing receives some IPC calls and it has to figure out what the context of the sender is. And it used getpidcon for this. So to exploit this, we have to exit our sending process and then we need to make some privileged threads spawn somewhere in the system that reuses the PID. And like for making a privileged threads spawn somewhere in the system that requires user space interaction and isn't very fast. And so it would be nice if we could stretch this race window out between the time the binder IPC is received and the time getpidcon actually reads the as Linux context. And luckily, we can make on like 4.4 kernels, we can make this getpidcon call that just opens the file in Proc FS and reads from it, takes something like 15, 20 seconds. So as background for this on up until like kernel 4.7, there's a mutex in the inode struct, which protects a bunch of operations, including a getdance, which is used for like the read the ellipsy function. So this function takes this mutex on an inode, then iterates over the directory entries for this inode, copies the directory entries to user space while holding the lock, and then drops the lock in the end. So if you have a big directory and you're doing this operation, you're holding this mutex while accessing a lot of users based memory, which can take a lot of time. Another path that also takes the inode mutex is the lookup slow function, which is used if you don't have like a cache directory entry for the name that you're trying to look up. So for example, in Proc FS, if you haven't accessed a process through Proc FS before, there won't be a cache directory entry for it. So this means that if we can make, if we can getdance and make that take a long time, then we can also block the open call that getpidcondice for the same amount of time. Most of you probably already know this stuff, but in operating systems, you can have the problem priority inversion where you have three tasks, task A with high priority, task B with normal priority, task C with low priority, and then if task C, which has the lowest priority, takes some log and then gets driven by task B, which is running for an extended amount of time, and then at a later point, task A wakes up and tries to take the log, task A blocks on the log, task A can't acquire the log because task C is holding the log and task C can't make progress because task B is blocking the CPU. So effectively, task B is running even though it has lower priority than task A. And this doesn't just apply if you have a task A and task B with different priorities. It also applies if you have tasks A and B with not the same priority because then you're still violating fairness between the true process that should be scheduled like 50-50, but actually one of them gets all of the CPU time. And this also works with column U taxes because they don't protect against priority inversion unless you're on like a PMDRT system. So this means that we can potentially block execution by creating, by artificially creating priority inversion problems. Okay, so here's the basic idea. Instead of using user fold FD to block a user space access for as long as we want, we create two tasks, task A and task B and pin them to the same CPU. Task A gets idle priority, task B gets normal priority, and task B is executing a spin loop. So now we let task A execute a reader operation. This reader operation takes the mutex, and then it starts doing a user space memory access. The user space memory access triggers a page fold, which triggers IO. Now the IO operation itself is relatively short. But when we trigger IO, our task stops running and yields the CPU to another task until the IO operation is completed. But because idle tasks never preempt the execution of non-idle tasks, even after the IO operation is completed, our task A doesn't get scheduled again for like something like a second, actually. So this allows us to make this user copy operation that is happening while holding the mutex stall for an extended amount of time. And we can repeat this if we have a large user copy operation. So we can map a bunch of pages so that the reader head logic doesn't fire, for example by explicitly opting out of reader head.  And then we get something like one second of delay for every single page fold, waiting for the scheduler to move us back on the CPU. And then this gives us something like 21 seconds of total delay. And for this duration, we can install the get-pit-con call. Well, I went through my slides way faster than I expected. Yeah, that's it. So questions. I think I have a lot of interesting details. And the part for the KSMP and the memory tagging is fully new for me, so I'm going to check what sounds very scary. Thanks for the great talk. First question about the first bug. Why it is easier to exploit on kernel before 4.9? Was it the scheduler changes? I know. It was a specific change in the vulnerable code part. So basically the code behaved differently depending on whether the PTEs that was flushing were writable or not. And in the case where the PTEs are writable, it would actually do a TLB flush earlier. On your kernels? Yeah. Thank you. And second, about second bug, I like user fault of D as well, very much. But there are cases when you have several K3 calls before you have your code running, your spray running. What happens then? So it is the free element is somewhere behind in the free list. And your next allocation doesn't reach it. Yes. So I actually kind of oversimplified this here a bit. And what I actually did was I think I did a, I opened up a bunch of times. And then I used KCMP on each of the open instances to see whether one of them managed to reuse the same allocation. So like, yeah. And what was the size of slab element? Which slab cache did it happen in? Files structs have their own slab cache, like modules, like slab merging stuff. So they're not on a K-malong slab. Okay. And how many files with grunt up you had to open to just reach it? Was it a lot? I don't know where I put this. Sorry. I don't remember. This was like 2016. Thank you very much. Thank you. Great talk. Questions? Everything was very clear. Normal questions? Might be quite ignorant. On normal desktop Linux, all these scheduler calls, anybody can make them, right? Can normal user code do that on Android as well? Yes. Normal user code on Android can use like set scheduler and the pinning stuff to like make themselves, to move to other priority or to pin to specific CPUs. Next speaker.


Egas Fiontek vs. Serana Castel with the fourth quarter final for the ladies at Indian Wells for 2023. Both players have been very impressive to get to this stage. Castel started the tournament off unseated and will take on the qualifier bureau in the first round. This pose no problem getting through in straight sets 6-3, 6-2. In the second round she take on the 19th seed Keys who had been battling injury of late and after winning the first set 6-1 Keys was forced to retire in the second allowing Castel to get through. In the third round she take on Perra who had just taken out Sampson over in an epic match. This was no problem for Castel winning through in straights 6-3, 6-1. In the fourth round she take on Caroline Garcia the number 5 seed who was coming off a final only a week ago. And this match was brutal with Castel eventually getting through in a tight third set 6-4, 4-6, 7-5 to advance to the quarter finals. Fiontek started the tournament off as the number 1 seed and will get a buy in the first round. In the second round she take on Lou the American but this was no problem for Fiontek getting through in straights 6-1. In the third round she take on the 30 second seed on Drescu who she had played last year on the clay. And after a close second set Fiontek would have to fight to get through 6-3, 7-6 to get to the fourth round. In the fourth round she take on Emirado Canu who had been very impressive this week beating Hadajmaia in the third round. But this didn't phase Fiontek getting through in straights sets easily 6-3, 6-1 to get to another quarter final. These two have only played the one time before that was actually at the Australian Open last year which Fiontek getting the win but Castel did win the first set in that match 7-5 so maybe Castel can use those memories. If Castel is going to win this one she needs to keep her cool and she needs to make Fiontek run around. Also get off to a really good start because what happens which Fiontek in the first few games she either comes out nervous or a little bit slow so Castel has got to take advantage of that slow start for Fiontek. If Fiontek is going to win she has to limit the errors. The forehand has been a little bit off this week. She got away with it against Rado Canu but the forehand doesn't seem to be working as well as maybe she would like going into these later stages so she needs to get that forehand working and really just play the way she's been playing. If the forehand starts working she could open the bakery again. This is an interesting matchup because I think no one expected Castel to be here and of course Fiontek is going to always be in the quarter finals. I'm going to go to Fiontek in straights sets. I think it might be close though. I think Castel might surprise a few but I think Fiontek is going to win this match and keep going on. Let me know down in the comments below. Who do you think is going to win this quarter final?


Okay, good morning everyone My name is Alok Madhukar, and I'm joined by my colleagues Subramaniam Ramurthy and Rishabh Maheshwari, and we are from Goldman Sachs, Bangalore So today we are going to present How we are using foundation DB in financial services. So There's a mandatory disclaimer Okay, so We have been using a system called sec DB. It stands for securities database and it was built in 1991 so it's been 28 years and There are some numbers here's which kind of signify the scale of the operations that we have So the system has been running stable for over 28 years now and at this point we wanted to You know evaluate how we modernize the plant So to give some background Like why we built a system like sec DB and what were there some of the design decisions made? So what we wanted from a data platform was that our trading is happening in All the countries roughly 160 different locations. So you want to capture the risk artifacts across all these locations So the throughput needs to be very high. So these Businesses can be equities or foreign exchange So these are very kind of high throughput environment. So we need to kind of roughly Let's say capture 3 billion trades happening in a given location and Then we want to have real-time risk, which means that if a trader books some trades in Tokyo And a trader in New York is working on the same account. He should be able to have real-time risk on the system And then we are kind of regulated a highly regulated environment. So we need quick reproducible tree of results Which means that we may be asked to go back in 10 years and explain why a certain price was arrived and then We are in a scenario where we actively need to kind of do what if analysis what if some governments go down? What if market conditions change? So we run through Billions of these different shocks to see what will be the risk through this what will be the pricing in this different scenarios Finally, we want identical pricing across all our offices like front office middle office back office and Irrespective of location and minimum time to market. So there are two pieces To the magic that is happening here. One is the client side So the client side enables us to have good what if analysis Where let's say we developed our own development environment Which enables to have a graph like environment? So if I have formula C equals a plus B, it will automatically make a day-to-day cycle graph and The calculations can happen it enables memorization So many of the results can be reused and the time to market is enabled by our SDLC where Feek few click buttons and your system or your code is in production so the for the rest of the topic will be Focusing on the other piece which is the persistence layer and what we have done there and what is the evolution there so this is We came up with a very simple back-end design, which is a in-memory blob store essentially, right? So there is a shared memory it has parallel readers and serialized writes So there are components to rights, which is checker logger and applyer. These can be pipelined To kind of increase some of the throughput But essentially the the blob store under science two kinds of objects one which is a Blob which is has a metadata which has some essential information about the object, which is what class it is and What are the Essentially what are the what is the type and what is the name so so the all the objects are stored have indexes on name and type and There is a variable size binary Apart from that there is a special object that the server understand which is called a position So that's a specific name for enabling our trade model, but A position is essentially a conflict-free data type Right, so it is implemented as an incremental and in the next slide. I'll kind of focus more on What is a trade model? so Now one of the key features of our persistence is that like because of the simplicity like there are Like five people in the SRE team who manage a deployment of more than 10,000 physical kind of instances of this system now We need to enable real-time risk at all locations We need real-time synchronization of data and it's a multi master right environment where Traders in any of the locations can be updating the objects now we try to kind of design a system which Reduces conflict so it's an eventually consistent system However, our trade model is designed in such a way that there are minimal conflicts to enable that we have For each of the physical instances the trade ID range is unique. So the trade ID is don't overlap in different locations The traders are trading in objects that are called tradibles. So these tradibles are either singletons or Fungibles so when I say singletons for example a house in San Diego will be a singleton So there is only kind of a specific type of house in San Diego Something like oil will be fungible which adds up like our oil from Saudi Arabia or from Canada They kind of add up right so You can trade these either countries of one or these things add up so trades or transactions which are happening Create positions on an account which are unique and these positions as I said are incremental on the back end so even though The traders might be acting on the same account which are kind of The conflicts don't happen in general If conflicts do happen we have a conflict resolution tool that kind of solves the conflicts So to give some again, there are few impressive numbers on the first slide But now this is supporting like so so so the In memory database or and kind of no sequel was kind of ahead of its time But the key completely advantage for us was that this was uniformly adopted across the entire firm What that means is Across hundred different business units. This is a single entry point for all the trades and all the risk so through kind of Why this is a competitive edge because For example when financial crisis happened And I like I was on the trading floor It was a single query for me to figure out what is our exposure to different counterparties and this was very kind of Very very powerful Secondly, we use the same persistence to distribute our code as well right, so Everyone has the same view of the world at all points of time So what is usd versus euro is the same price that anyone is seeing like nobody's checking out code checking out code and Kind of doing pricing separately So these are kind of very powerful features here Now what is in the future So basically as I mentioned financial crisis post that that was an important year because post that the nature of the industry itself changed and So for example a lot of derivative or proprietary trading Became obsolete and there were more algorithmic trading So over time there were more kind of engineers than traders and bankers So we are at a point where we have more engineers and Secondly the the the technology itself matured also so where we were using our own language which had both functional features and imperative features now we have Model languages with support both as well as on the persistent side We have mature no sequel offering so apart from The businesses themselves are becoming more and more data-driven right so Many of the models that we rely on can be derived from data So we want to build this platform for future. Although this is still kind of very very profitable for us We want to Desiree design the system for future and there are few important considerations that we have and These decisions are more directional than technical which is we can again rewrite a proprietary system We have good C plus developers who can do that but As we are as we look at the modern generation they are more enthused by open source platforms and Like having those skills which which can be reused So that's a very important decision for us that a boutique solution that we have built which is highly optimized for us a single kind of system supports all kinds of use cases be it high throughput trading be it archives be it ticking data it solves everything To go to a open-source solution Which is more generic in nature. It's a very big engine challenge for us to kind of match the requirements So a we want to use open source and be we don't want to Make the observed performance of existing system any worse. So when we kind of So in phase one, we don't want to change any of the clients, but as we change the back end We don't want clients to face any kind of performance degradation and that's where all the engineering challenge comes up so How how we are doing that for that? I'll invite Richard Maheshwari Like words are being journey so far. So essentially We are trying to solve Two problems here. So one is we want to replace our key value store That will make the system as is compliant to our existing system and secondly because a blob store is not amenable to Like server site queries the clients need to civilize the data on this site and then make queries We want to also solve the olap problem here. So we have apart from solving the OLTP solution We have a real-time sync to make the blobs into attributes and then Move the query load to this attribute store Right. So so that's how we are kind of thinking about the new system and Russia will take you through the journey How we are going there? Hi everyone, okay, so let me take you through the journey of how we started with foundation DB and What are the steps we took and where we are right now? So as I look told that we already have a proprietary system with us Which is basically we have clients we have the back end which is essentially a blob store And we have a well-defined protocol and the first thing which we wanted was that we wanted an as is Replacement of the back end without any change in clients Which means that what we started with is that as is replacement of the blob store Which means that we first defined a middle where so we first defined a unit Which is between the foundation DB blob store and the clients and we supported the same protocol as is Which is currently a sick DB. So the first step was that a middle where which has which has Which has discoverable endpoints with the same protocol as is and also the first offering which we gave was that basic credit operations which will insert the blob and Retrieve the blood for the client apart from that the second point is that In sec DB rather apart from being a simple or document store It's also has some limited indexing support So when I say limited indexing support if you are familiar with record layer or Document layer indexing. It's very similar to it. Which means that a client So schema here is managed on the client side Which means that when a client wants to store a document it will serialize a document as a blob store and store it in the foundation DB and if a client wants to fetch the document it will get the blob deserlize it from the clients client-side manage schema and get it The indexing support is something like we can register what fee of what attributes of an object or a or a security are Indexed and what happens is that client knows that these attributes are index So the client sends the blob with the indexed values and registered in a particular format and If other clients wants to query those indexes they can basically Start with an offset and iterate through the indexes It's very similar to how record layer and document layer do it And then that with the as is replacement So this is these are the as is replacement for the client for the users for our DevOps team We our current system already has tools like backup restore and other systems and other tools We tried to replace all these features as is For them as well. So these are some of the features which foundation DB supports out of the box So they were all supported as is Other than that one of the things which I look mentioned was that Apart from the simple limited support which we have that is blob store and indexing our clients also wanted the support of rich server-side queries which means that if we index something or we We provide attributes to the server that we should have ability to support rich server-side queries like aggregation or Composite indexes etc. And that's where we found it record layer very helpful and that's where we are using it So what we did was we encode the Attributes in portable format store it and based on using record layer or record layer principles we tried to have these queries and Also, the other thing is that next we looked at the the other requirements of clients for example one of the main requirements of clients is that they want to Measure risk as of a particular milestone So what was the risk if this condition was valid or what was the risk as of some particular time? And we wanted some milestone milestone based on which we can query data and The roadmap of foundation DB looks exactly To what our future roadmap is which is there's there's a roadmap for Edward engine which will provide that Milestoning layer So that is what it is So this is a journey where we try to do as is replacement of foundation DB with our system And this is where it fits fits our bill foundation to be exactly as is But there are a lot of places where it there are few places where it doesn't fit the bill and for that I will I will invite a subwoo. Hi. Hello everyone. So I'm gonna talk a little bit about the next steps, which means We are not in production yet So we have done a lot of analysis and this is more about the what we need to do before we actually go to production So being a financial firm I mean the need all of the kind of the DevOps requirement on the security requirements are pretty high for us and Also the environment what we operate is a little bit different So because we actually have a thick clients who directly interact with the native blob store Which means we don't really there isn't like a strict need for a layer in the middle for the read operations So we have these hundreds of thousands of clients running on one side And you have a server on the other side which we think will be foundation DB And they want to natively read the data and do something on that side. So that Brings in a lot of interesting propositions like what about a DDoS when we natively expose this cluster to these hundreds of thousands of Clients can all of them had the hit the cluster at one go and bring down the cluster and can they work on the Infrastructure so how do we manage something like that and then comes the sum of the regulatory and the audit kind of requirements Like for us we have to record every single meaningful thing that happens in a production system Which means if somebody is like adding a machine to a cluster or taking a machine out of the cluster We actually have to record everything. So how how do we do that and then we have things like Purely the security the authentication. So who made a transaction? How do we identify what a client is? So while foundation DB as well as this acid blob store ticked all the boxes And then we realized we can't really expose it we can't really run foundation to be natively as a service for the clients directly and That is where we are and we need to build a layer to like a DevOps layer to and a security layer to secure a lot of these operations And the next part is performance. So as I said, we have a thick clients and sometimes even a desktop-based clients running on one side that kind of means the The the concurrent connection requirement is like a hundred thousand requirement. So it Currently we kind of scale but foundation to be is not built for that So we still think the layer will actually help us Scaled for that and we have other things like the fast Restoring backup that is a very very key requirement for us because at the moment It is a complete in-memory system in 10 minutes We can actually have a clone of a database running the size is small But the the bar is pretty high because it's quite literally takes 10 minutes for us to If we have a database running in New York and we won't have a copy of that running in London It takes 10 minutes for us to copy the data over and start another instance. So that is another one and It's kind of path ahead as I said We plan to write this DevOps layer which we think is genetic will be useful for the rest of the community And we want to build it and we want to give it back to the community That is one part and also help with some of the capacity requirements and in terms of the collaboration as I said We want to Write this layer in a generic way so that you know, it can be used by other people So who likes him reviews and feedbacks from you guys and then the ass of requirement is a very very key and a very interesting Requirement it is it is sort of a game changer for what we have in the current system So whenever the Redwood engine comes we are really looking forward to it will help you with testing and also adoption Quickly give to your luck for the closing remarks Yeah, so I think Like segdibi has been kind of doubted as the secret sauce of Wall Street. So this is the first Year when we are talking about it In international conferences So this is a very big kind of milestone from our side and our collaboration with foundation DB has been very good So far so looking forward to the journey. Thank you


In this video, I want to show you how to solve a simple rotational kinematics problem. A wheel has a constant angular acceleration. It makes 40 revolutions, while the angular speed changes from 20 rpm to 50 rpm. Find the angular acceleration. Now, first, as with all physics problems, let's have a look at what we know. We know that angular acceleration is constant, so alpha is constant, and we're actually looking for it. We know that it makes 40 revolutions, so we know that change in angle is 40 revolutions, while the angular speed changes from 20 rpm, so we know omega initial is 20 rpm to 50 rpm. So we have omega final is 50 rpm. Now, the first thing that you want to do when solving these type of problems is convert all the units to SI standards. Sometimes it works when not working in SI, but if you don't want to take any risk, convert it to standards. A revolution is a full circle, so if we turn word to radians, which would be the standard SI unit for this type of problems, we know that one revolution is 2 pi. Right. 40 times 2 times pi is 251, and I'm going to save this, so storage button in my variable A. 251.33 rads. Same thing for RPMs, revolutions per minute, what we want is rads per second. So same trick as before, one revolution is 2 pi rads, and per minute, so we want to multiply by one minute to 60 seconds. So we have 20 times 2 times pi divided by 60 seconds. So the rad, the revolution times this revolution per minute is cancelled by minute, so I get 2.09 rads per second. If you have a calculator that can store intermediate values, that would be a good idea to use that. So I'm going to try to store this in some variable on my calculator. So storage E. The omega-finance is 50 RPMs, so we do the same thing, times 2 pi rad over one revolution, times one minute is 60 seconds, this gives me 50 times 2 times pi divided by 60, gives me 5.24 rads per second. So again, I'm going to store this in my calculator, so store C. Now how do we find alpha? Let me remind you a little trick. All these Greek characters here look extremely complicated, but at the end of the day, it's not that complicated at all. Just think of linear kinematics. So here comes the trick. Linear kinematics, what was the acceleration given in, once given as A? What does the change in angle correspond to, corresponds to the change in position? What does the initial speed represent? That's V initial. What does the final speed represent? That's V final. So the question is, if we know that the acceleration is constant and we have a certain change in position, we have initial and final speed, we want to find the acceleration. What kinematics equation could have given us that? There are five kinematics equations for constant acceleration. We just go through the list of them and pick the one that has what we're given, as well as the unknown. Now here we don't know anything about time, which kind of eliminates four out of the five constant acceleration equations. The only one that doesn't have time in there is V final square, is V initial square, plus 2 times A times delta S. Which is perfect, right? Because we have the final velocity, initial velocity, and we have displacement. We look for the acceleration. So the acceleration is equal to V final squared minus V initial squared, divided by 2 delta S. So this is what we would have gotten in the linear case. Now let's just translate this back to the rotational case. Let's go back. Rotational case, we would have had omega final squared is omega initial squared, plus 2 times alpha times delta theta. Therefore, alpha is omega final squared minus omega initial squared over 2 delta theta. Now all I have to do is type this in my calculator. So my final I had stored in C. So in my case, V the omega final squared minus omega initial squared divided by 2, divided by the change in position, gives me 0.0458 rads per second square. And that is how we solve a simple rotational kinematics problem.


The idea that young people are fundamentally different than previous generations because of their exposure to digital technology is something we've been hearing about for nearly twenty years now. It's what I call the digital natives discourse and in the next few minutes I will explore the claims that are associated with this discourse and argue that we need to take a much more critical and skeptical approach to them. So what are the claims of the digital natives discourse? Well, a foundational claim is that people born after approximately 1980 have been fundamentally affected in a variety of different ways by their exposure to and use of digital technology. Unlike older people who had to learn how to use these technologies later in life, young people were immersed in digital technology almost from birth. As Mark Prensky said, they are digital natives. Older people are digital immigrants. Now at first glance, this idea seems to make a lot of sense. It's like a language. If you're immersed in it from birth, you learn it easily and you become fluent and you don't have an accent. When you learn a language later in life, it's much more difficult to become fluent and to sound like a native speaker. But people like Mark Prensky and Don Tapps, God and others go much further than that. They argue that this technological immersion is having an impact on a whole range of characteristics, particularly on how young people learn. Here's a summary of the key claims made about this generation of learners. They prefer experiential hands-on learning. They prefer to learn in groups. They prefer images over text and learn better as a result. They are goal-oriented, highly social and community-minded. And they are expert multitaskers. And they prefer structured, highly structured learning. And of course, they are digitally literate, meaning they are sophisticated users of digital technology. Now those are some pretty significant claims that clearly could have an enormous impact on our educational systems if they were true. But there are three key reasons why I believe we need to be skeptical of these claims. First, and most importantly, there is no research to support them. Second, it's a simplistic discourse. And third, it's a deterministic discourse. In 2008, I led a research group that investigated these claims by conducting research with learners at one post-secondary institution and thoroughly reviewing the existing research and publications. We found no support for these claims. Since then, dozens of excellent research studies have been published that confirm our findings in a variety of different countries and educational contexts. At the end of this presentation, we've provided a link to our website that has an extensive list of published research. Now don't get me wrong, I'm not denying that young people are using digital technologies intensively. There is overwhelming evidence of this. And this use has been growing consistently. But what the research shows conclusively is that this is not a generational or age issue. Digital technology use is growing across the board. In fact, a newly released study shows that internet use is growing fastest among people over 65. What we don't know with any certainty is what impact this growing and pervasive use of digital technology is having on how we learn. A second key reason I think we need to be skeptical is that this is a simplistic discourse that treats a complex social phenomenon superficially and fails to examine it critically. First, it treats technology use as a one-dimensional quantitative issue. In other words, there is an assumption that just because young people are constantly connected to and using their devices, they must know how to use them for all purposes and have a sophisticated understanding of digital technology. The research just doesn't support that. Second, it makes no distinction between social, educational, and entertainment uses. There is an assumption that use in one area translates into use in another. Again, the research doesn't support that. Finally, the discourse exaggerates gaps between youth and adults and perpetuates stereotypes of both. Adults are seen as technologically incompetent and youth as technologically sophisticated. This reinforces the fear that some people have of technology as something they are just too old to learn. The third key reason for being skeptical is that this is a deterministic discourse. There is a sense of urgency, almost panic, a sense that if we don't respond to technology quickly, we will be failing our young people and they will be unprepared. Young people are using more and more digital technology with increasing frequency, so we should use it in education, end of discussion. Sherry Turkle provides what I think is a very thoughtful response to this perspective. She says, I don't really care what technology wants. It's up to people to develop technologies, see what affordances the technology has. Very often these affordances tap into our vulnerabilities. I would feel bereft if because technology wants us to read short, simple stories, we bequeath to our children a world of short, simple stories. What technology makes easy is not always what nurtures the human spirit. At this point, you may be thinking this is all very interesting, but why should we care about a bunch of unsupported claims about young people and technology? Well, the main reason I became concerned about this issue is that I began to see institutional leaders making significant decisions about expensive technology purchases and organizational restructuring that were driven by the digital natives discourse. I heard teachers and instructors talking about the need to change their teaching to accommodate the digital natives in their classroom based on an uncritical acceptance of this generational stereotype rather than an understanding of the students in their classrooms. This discourse has a potential to affect how our educational systems are organized and how teachers do their work. It has the potential to influence costly decisions about technology purchases. That's why we should care. Now, I'm not advocating the status quo, but I think if we are going to make significant changes to education, it should be based on evidence, not hype and speculation. What we need to be doing is asking the right questions, not making unfounded assumptions about young people and technology. So questions like, do young people really understand the difference between social and academic use? What impact, if any, does the pervasive use of technology for social purposes have on education? What is the relationship between social and educational use? Are there intragenerational differences in use of technology? And if so, what does this mean? And what about socioeconomic and cultural differences in the use of technology? These are just a few questions that would allow us to dig deeper into this issue. Treating this as a generational issue is just not supported by research and it is superficial and simplistic.


Migration impacts us all, whether it is to escape war, conflict, extreme poverty, the effects of climate change or to seek work and educational opportunities, people continue to migrate, providing benefits to our local, regional and global communities. Since its establishment in 1951, IOM has become the leading international organization dedicated to promoting safe, elderly and regular migration while harnessing the potential of human mobility. In 2016, IOM became the UN Migration Agency, giving migrants a much-needed voice on the global stage. The organization covers a broad range of migration areas, such as assisted voluntary return and reintegration, border management, climate change, labor migration and development, camp management, humanitarian and peace building, or research and policy on all migration topics. IOM's dedicated staff are providing policy recommendations and operational support to governments in over 600 field locations in more than 100 countries across all continents, from Afghanistan to Zimbabwe. IOM is ensuring that the well-being, safety and dignity of people on the move is always respected in emergency and non-emergency situations. IOM is an equal opportunity employer with a diverse and engaged workforce of over 25,000 personnel, providing high-quality migration services to beneficiaries. More than 90 percent of IOM colleagues are based in field duty stations, working as doctors, nurses, lawyers, economists, psychologists, project managers, emergency coordinators, social workers, engineers and much more. IOM seeks committed professionals with a wide variety of skills in the field of migration. On the IOM's website recruitment page, www.iom.int.recruitment, you can find all the information about what kind of profiles are required in the organization and how you can join. We encourage you to follow IOM on social media to keep up-to-date with the latest work and exciting opportunities.


Hi, this unit deals with the analysis of the main functional elements of claw structure on a traditional basis. Put more simply, we will discuss notions such as subject, verb and object. In the context sections, which contains an e-lecture, a video about the functional analysis of sentences and one microteaching video per syntactic function, we will discuss the main approaches towards functional analysis and we will look at each syntactic function in detail. Use the question set in the how to proceed section as default guidance and in particular the hyperlinks associated with the questions and, as usual, tick off each completed activity. The mastery test is an identification task where you have to define the syntactic functions of randomly chosen elements and sentences. It should be easy after content mastery. Finally, the suggestions for the in-class activities contain several complex sentences ready for a detailed functional analysis. Here you can show real mastery. Make sure that you do all the tasks. This is a solid background for further studies in syntax.


Hi everyone, I'm Joe for jaspyscasebrakes.com coming at you with 21-22 Panini Court Kings basketball. Four box, pick your team number one from a fresh case here, and $1,000 of rate credit being given away if you follow the instructions right over there. Two winners, $500 each. If you have multiple entries, yeah, you could win both, your name could be randomized to the top. All right, so here we go, Tuesday the 30th, happy True Tuesday. So if you got a little rooftop next to your name, that means you won that spot, that won that team in a filler. And Aaron ended up with double last spot mojo before he pulled the remaining team's Rockets Heat. So thanks to him, thanks everybody for making this happen, I appreciate it. Excuse me, excuse me, getting all choked up over the spring. All right, so there's the court Kings basketball, I could use a knife here. And let's see which four boxes we're going to do. The next pick your team is up. Fantasy football season is upon us, and Jeremy's saying that he's got a pretty stacked fantasy team here. 14 team league, Lamar, Cup Gabriel Davis-Godwin, Mark Andrews at tight end, and Aaron Jones, Etienne, AJ, Dylan, RB, and Fleck, that's not bad at all. All right, we got four stacks of four, we'll go one, two, three, four on the dice roll. If I roll a five or a six, we'll just roll again. Three, one, two, and three. We're going to go with that stack over here, and this stack we will save for next time. And there's the, and I'll probably just probably roll do another dice roll here, but these boxes may get mixed up a little bit here. But we can definitely run this back tonight if you would like that stacked up over here. All right, well, let's see what we got in this one. One autograph, one memorabilia card per box, on average, a little US Open Tennis on the background as well. See what we got here. We got a redemption on the bottom here. Any guesses on that redemption? Moses Moody, Damian Lillard, Josh Christopher Rookie, and then D'Angelo Russell, 80 out of 99, Timberwolves, that's going to go to Matthew, and all cards shipped in this course. And the relic is CJ McCollum, Art Nouveau relic for the Pelicans. Diego's guessing Ja Marant as redemption. I'd be shocked if Kyle Pitts was in here though. Terry's agreeing Ja, he never signs. Oh, nice Jeremy. How was it? Yeah, that's right Rex, we're giving away Super Bowl tickets, and that big mixer at jaskyscasewrakes.com. All right, the redemption is going to be Charles Barkley. Legacy Portrait Signatures, now I'm going to have to consult the checklist. What edition? Which edition of Charles Barkley is this? Let's go to groupbreakchecklist.com. Let's go to their basketball section. Let's go to the, where's Court Kings here? There's 21-22 Court Kings. Group Break Checklist, Group by Team. Charles Barkley card number six is Phoenix Suns Edition. Card number six, Legacy Portrait Signatures and Parallels, Phoenix Suns. So that's going to go to Nico Martin, there you go Nico. Suns Edition of Sir Charles. Diego's asking, is the deal with the Super Bowl tickets, are the Raiders making, we have to take me? I would appreciate that, I would certainly, I would certainly appreciate that. I might spring for, you know, I might be so happy that I might pay for your hotel room if that happens. Or we'll just stay at Joe P's house, we'll just crash to this place. A live auto over here, we've got Jonathan Caminga and Anthony Edwards. No, if the Raiders go you don't have to, actually Diego, yeah, so Diego if you win and you take me, I guess I'll have to crash to your place then. It'll be maybe food and drinks on me. 142 out of 149, DeMonte Sabonis for the Kings, that'll be for Nico, Jalen Suggs goes to Greg in Orlando, and Davion Mitchell will go to the Kings, Nico, some promising rookies here. We've got Art Nouveau, Chris Middleton, here comes another promising player here, that's for Nico and the Bucks, it's Fresh Paint Autograph, France, Wagner, Rookie Autograph. I know Magic putting together a nice little team there, good group, a good crop of youngsters there. With the Magic, that's a 42 out of 199. Yeah, Jeremy said he went to the Super Bowl in Indy, was hoping that his Packers were going to be there, but didn't happen, but was nice to see Brady lose. Yeah, that guy has done, doesn't that guy have enough? There's Clay Thompson and Austin Reeves, he could have a nice season, Austin Reeves. Yeah, exactly like Hans and Franz. Christo Warte and we've got a Moses Moody to 25, that is for Dan and the Warriors. We've got Rookie Expression, Jared Butler, two-color relic for the Jazz, that's going to be for Nico, that is out of 25, Nico, kind of hard to see, there it is, four out of 25, and Pistons, ah, no offense to Richard Hamilton and his infamous face scarred, we were hoping for a different Piston, Terry with Detroit, that's the right idea though with the team, 44 out of 75, brushstrokes autographed for Richard Hamilton. All right, final box, and then we'll give away that break credit, we've got another four boxes in the store, ladies and gentlemen, Jaspy's casebreaks.com, we've got LeBron James, Bones Highland, Christian Wood, Zion, hoping it could be a comeback player of the year for Zion, Usman, Desunmu, and KD, looks like he's going to stay in Brooklyn after all, after all that. All right, the relic is Gordon Hayward, piece of his jersey, that's for Charlotte, that's going to be for Brian. Ooh, and a Raptors, is that a Raptors auto, is this the Raptor we want to see? It is, heir apparent autograph, Scotty Barnes, a lot of times I feel like he's a redemption, but here's a live auto, Scotty Barnes, that's not a bad auto for a two letter autograph, I'll take it, and that's Wesley who won the Raptors in that filler, 118 out of 199 for your reigning rookie of the year, and there you go boys and girls, nice, I did see that, right, I heard that on the radio today, and ten years later, Serena won a match, Pools hit a home run, and then Bichette's kid, Guerrero Junior's kid, and Vigio's kid had a hit, ten years later, twenty years later, all right, let's flip back to the list over here, I'm pretty sure Kubooms are in this court Kings, I'll have to double check that, but I thought yes, all right, so we got everyone's names here, here's the full list once again, sort by column A, by your first name, so if you buy at least an even number of teams, half of those become entries for a chance at break credit, big break credit too, Aaron bought two teams, that's an entry, Brian got three, for the purposes of the promo, two count, that's an entry, Charles with an entry, with two teams, one entry, Dan two teams, one entry, Greg two teams, one entry, Matthew two teams, one entry, Niko went big on this, Niko got 14 teams, that is seven entries, and then Terry and Wesley with just one each, they won those spots there, all right, so let's just, got Aaron, Brian just want to make sure, Charles, Dan, Greg, Matthew, and then Niko's seven spots, all right, so two out of the 13 spots are gonna get $500 of break credit each, top two, good luck everybody, top two after three, a two and one, good luck, fingers crossed, one, two and three, it's Brian and Niko, congrats to the both of you, $500 break credit each going your way, now usually I'm not one to tell you what to do with your break credit, but we are giving away Super Bowl tickets, that's right, Super Bowl tickets in our big high-end mixer, and there's fillers for it too, so you know maybe you could put a little bit towards that, compare this break credit in Super Bowl tickets, that'd be pretty awesome, so congrats to Brian and Niko, thanks everyone for watching, breaking with us, I'll see you next time for the next basketball break, bye bye.


It's tracking your face over mine. I'm offended because I'm the prettier one. Oh All right, this is where I see myself again. I'm still hiring. So if anyone's looking for a job No, I don't need your drone anymore Cricka So we are finally here Striker we've been watching over this project for Half now so this feels really good to finally be here and get on Alrighty we've been tracking this project since a year and a half ago and it's finally open For media day and I couldn't be more excited. I'm really excited for what the park has to offer today I hear we're gonna get to ride around 1 p.m. And we're gonna get a reverse POV and I'm gonna make sure the reverse POV is my first reaction because I want to Give you guys the honest first reaction of me on you punch striker because I've been told many times that I make the Faces and the weirdest reaction when I'm on a ride So I'm super excited about that this full ride looks absolutely amazing The theming is out of this world compared to Leviathan. It makes Leviathan look like a plug-and-play coaster That's how well-themed it is and they're not even done as you can hear behind me They're still working on frontier Canada But it looks like you punch striker for the most part is complete and I can't wait to go check it out So stay tuned for more We are standing in the old location of orbiter and as you can tell it is no more So what it looks like they've turned it into is just a path But what's interesting is there's they've left in the old like exit booth But it doesn't look like it's fully the old exit booth. It looks like they've turned it into something protecting electrical They've got some speakers over here some dirt piles still No grass There's still a lot of work to be done over here And then there's a water piping system right behind me on the ground as well So I don't know what this could hold for the future, but at this current moment this puddle in no longer house Our ride it doesn't look big enough to even If it were to have something in the future It's probably going to be beaming or maybe a kid's ride if they decide to go down Maybe the dolly would grow out where they mix thrill rides with kids rides instead of having the separate kids section And the adult rides which I actually find very interesting like how dolly would does it so hopefully wonderland Maybe decides to do something similar and we see maybe some family kids flat rides placed behind us It would be perfect for that, but definitely don't see anything Coaster related fitting in here and less you see signs of mind buster being demolished And I definitely don't see signs of mind buster being demolished anytime soon And if I were to be honest if I were to see mind buster demolished I would definitely lean more towards a splash works expansion, which I'll explain in a different video why So I think you're gonna see the next coaster kind of going over in the action theater whitewater canyon area If there is one coming in the next five years, but for now, let's not talk about that We're gonna talk about you con striker and frontier Canada moving forward you con striker Don't care if I don't fall like what about that one time? I fell down the hill and you made sure my camera was okay and not me I laughed at him. He made sure my camera was okay and not me What do you story actually? This ride is absolutely amazing so much better than I actually anticipated myself a front-row ride is an absolute must What do you think of the ride walkie-bye it's good, it's ready fun 10 out of 10 great addition to the park So what's been your favorite part about you con striker so far? Probably the drop. It's just it goes on forever. Yeah It I just can't I don't have words for it. It's just amazing. It's absolutely amazing I can't put my hands up going through that tunnel. I don't know what it is I'm six foot three and I honestly feel like I'm about to lose my arms going through the tunnel.  We just spoke to the VP of the park and put a lot of information I'm gonna put that into a video for you guys separate from our vlog here So you're just gonna have to wait for that But lots of awesome information about the future of Canada's Wonderland What you con striker what year it was supposed to actually come out because it was supposed to come out earlier than here And we got confirmation of that But yes, they have a lot of work still to do so as you can see behind me, it's an active construction site The buildings are not complete. So the mess hall is still being constructed The Coca-Cola refresh station is still being constructed The theming is not done for you con striker yet. So there is still more surprises in the works We got confirmation of that as well, and I wouldn't be surprised If we saw some fog machine or miss machines popping up Definitely, I think you're gonna see that This rides insane Other than you con striker, what have you enjoyed about media day so far? This is your first media event The food the food free food the food What did you even get? I got the sliders the The gourmet sausage and lemon chicken. What was your favorite? The gourmet sausage the gourmet thing No, I looked over in the whole mid-course for shaking You don't see them they're riding it like it's an elevator. Oh, we have Tyler from coaster kids here How many screams do you rate this again five plus screams highest rating crazy intense awesome coaster number one at the park Arguably with other people. I agree with you. Don't worry As you can see here, this is going to be the gift shop for you con strikers So you'll exit down the exit ramp and come into the gift shop There'll be fun pics and Richard I sold here The theming is absolutely impressive for you con striker It's definitely the best themed attraction at Canada's Wonderland You got mine carts with rocks all over the place. It looks like you're on top of a mountain As you walk around the attraction I really like that it gives it this look like you're on the top of like a Yukon mountain You got the striker mining co-established in 1896 Yukon Territory and look what we have here if you remember those old teasers for the coasters And they had those designs at the bottom of the teasers. There's the logo. So it definitely meant something Again, it looks absolutely amazing riding Yukon striker with no line is fabulous I'll go up the exit ramp for you guys actually Let's go up into the station Yeah, let's go up into the station Because it's the most themed station here Kwan Dyke Outfitters What's a Kwan Dyke anyway? Well, it's an ice cream bar, of course No, it's an area I think it's an area in the Yukon Territory I'm cracking down below if I'm wrong So the queue line is really small It's smaller than behemoth This is it? So I'm a little nervous Fingers crossed this thing doesn't over There's the queue line One section of switchbacks Then goes into A second section of switchbacks Let's tip you upside down for a second So you can see Hopefully that worked So unnecessary So this woman has to wear a chicken suit because apparently she chickened out of riding it No, is that actually what happened? I think so So if you look here This is this bin system that they took from a dive coaster in China Basically what you're going to do is you're going to load your belongings Onto These bins on the other side of the loading station And then the bins are going to travel up into the ceiling of Yukon Striker So you're going to come back down over here where you can pick them up and then exit down the room It's so like It's so picturesque Yeah It kind of just looks like the animation of just how smooth it is The ride is butter smooth It doesn't have that rattle that Val Raven has And I rode Val Raven opening year and it had a rattle then too It wasn't smooth like this, this is butter smooth The track, the ride is so smooth You can feel the track shaking and not the train It's absolutely amazing And then look at this amazing shot of Yukon and Klondike Outfitters Like they've gone way overboard in terms of theming at this attraction It's absolutely impressive I couldn't be happier Minor details all over the place and they're not even done The first row, the second row And we have not ridden the back We're going to ride in the back and then obviously I will give you my reaction to which row I prefer Right now row number one has it I've never been more scared We have my reaction on two rides for Yukon Striker And how do you think I did?  The first and only the first That's it? How many rides did you get on this? Two? There's the on-ride photo camera Okay, so I was wrong There was on-ride photo I said the on-ride photo wasn't installed yet But I was mistaken because I was so scared I didn't notice it But my team just notified me that the on-ride photo is right there And they're right This is why I have a team You're not going to be able to see it from here This is a terrible angle Right there It's on the second drop out of the mid-course brake run We have to get shots from over there after Yeah We have so much time What time is it? It's two We have three hours So I think we'll get a ride on the back row Is what we'll do And then we'll go film again I have an announcement to make soon About a little ride challenge For myself That's going to help with fundraising for a special organization So hopefully I'll be able to make that announcement soon They're planning a lot of wet marsh plants too So that's going to look really nice Again, very impressed with what they're doing I can see river work They're still doing near the turner of the station Again, it's a very active construction site I'll show you again Again, I know I'm biased But I really love this ride What do you think of it? Yukon or heavy? Yukon's amazing What do you think of Yukon? Give it a 5 1, 2, 3 Go get on it Alright Tyler So we just got off Yukon Striker What are your honest thoughts on the ride? It's absolutely amazing The only other dive coaster I've ridden is Shikra At Busch Gardens Tampa And this absolutely demolishes it The drop is Absolutely insane through the title If you're on an NC you feel like you're just going to get like Not going to make it through The time on the Zero G roll is incredible You feel You're just going to fly out and there's a ton of airtime I love the Vestor Strains They do tighten on you a little bit more But they are super comfortable Yeah, I would definitely agree Compared to Val Ray but the Vestor Strains are a lot more comfortable Being 6'3'' and a little bigger They didn't bother me at all And if I'm the seat very comfortable There's definitely a lot more leg grooves And the seat that comes down on you And I like that The proportions are insane But what's your favorite element on this ride so far? It's really close between The first drop in the front row And the Zero G roll Because I don't know, the drop If you have a decent room you just feel like you're flying out Zero G roll you just get Most hangtime I've ever gotten on anything Yeah, that drop goes on forever It's 223 feet It's the same height as that one But that drop's got that extra height It's definitely impressive The front row ride on this coaster Is a must Definitely love it What do you think about the theming? The theming is incredible best I've ever seen it at Cedar Fair Park I haven't been on Copperhead But this looks better They're still doing construction so we don't know what's fully ahead yet But the station looks absolutely incredible The trains look beautiful There's the station Around the station There's just like all boxes that are like Yukon And there's this really beautiful Frontier Canada sign As you walk into the section I really like the Frontier Canada signs I like the attention to detail There's a lot more to come So we did have an off-camera interview With the VP of the park And we got some interesting information So as you can tell I don't know if you can see it behind us But Frontier Canada is nowhere close to being done Unfortunately the weather over the last month Has set the project back just a bit So we're looking at maybe A delay on Frontier Canada It looks like they're really trying to rush the buildings But even some of the buildings that have been complete For weeks now are nowhere near done I honestly thought the merch store was going to be open And that doesn't look like it's anywhere near done construction But other than that it looks really impressive I will say there's a lot of work going on Inside Whitewater Canyon So that's what I thought was interesting As it was going up the lift you get this great view Of Whitewater Canyon and there's construction workers Actually inside Whitewater Canyon Doing work on Whitewater Canyon So we'll see what that is As soon as the park opens so we can get over there But do you have any final thoughts On Whitewater Canyon? Must come down to ride no matter where you're from If you have the chance to Or if you have to try to Just get down here Do whatever you can to get down here It's totally worth the drive, the flight Whatever you need to get here Just ride with me You must drive front and back Yes, I'm very confused between Front versus back But the back pulls you over that Drop and it's insane Awesome, what's your YouTube channel? My YouTube channel is TylerSpaceCoachyCocci And my Instagram is at CoasterAddix And we'll be having lots of You construct your photos Lots of off-ride content and more to come Yes, go follow him because we're going to be Collabbing with him all the time this summer Awesome, thanks so much guys, we'll see you soon Alright, so I'm here with Tyler who has ridden Yukon Stryker 21 times? 21 times I've been on it 5 times I lucked out, they closed the ride a little early So that's a little unfortunate, but Tyler What is your favorite part about Yukon Stryker? Yukon Stryker is amazing It's way better than Val Ray then I like in the back better than the front Because you get more whipped in the back But the front is still good because If you go on the end seat on the left side You get some great hangtime on the vertical loop It's amazing, the fee-ming is great I think it's the second best fee-ming At Cedar Fair Park, other than Copperhead of Carowinds Which I saw 2 weeks ago It's outstanding, I'm blown away from Yukon Stryker So what did you prefer? Do you prefer Copperhead Stryker Or do you prefer Yukon Stryker? I think I prefer Copperhead because The hangtime is better But Yukon is definitely the best dive coaster I've ever been on and everybody needs to Come here and ride this thing Where does it rank at the park? It's number 3 for me We differ there, but everyone has their own favorites What's your favorite thing about a coaster? I like I personally like rough coasters I also like rough coasters I like airtime, I like a tensiny That's why my number one coaster Is I-305 for example Because it's so intense, it's so aggressive The less like coasters I like That's why I like in the main RMC BMN's up there too Since I've been like Growing up here for a long time now That's awesome Do you think I overhyped the ride? No No, I don't think you did It's a good ride, right? Well today was successful Was it? Yeah it was pretty successful How so? I got on Yukon 17 times It's tracking your face over mine I'm offended Oh Alright, this is where I see myself Again, I'm still hiring So if anyone's looking for a job No I don't need your drone anymore Cricka Yeah, say what you will But Hermione will always be on the sweater That's what I thought Someone's filming B-roll for us That we gotta go get our camera What about him? A space waster A space waster?  Our photographer In the wild That's you last year So Some might be asking What are we gonna do now? King's Island