Hello everyone, so this is the title of the talk, last script is in serious and third party content with care. Sounds a little crazy I know, let's see what's about. So by the way, I am Fishnade Tanya and I work at security and privacy research lab at Info's lab. I have my microproff and gave you two. So how many of you have built mashup for finance? Okay, anyways let's see what a mashup is first of all. As the definition says, it's a web application which combines content from multiple audience to create a new service. It's like you have a service A and you have a service B. You combine both the services and you create a new service, that's a mashup. Okay, we'll see the examples shortly. And then the integrating party is called an integrator. The party combining the content is called integrator whereas the integrated content is called a gadget. So have you heard about gadgets? Gadgets, you heard about it right? And then what's the benefit of doing a mashup? It provides more value at than individual services. It's fun, it's easy to meet yourself and then it's all about JS madness. Okay, here it's about. So have you seen any of these? You've seen any of these? I Google, it's very popular. That's housing maps. Here it's like the, whether it's from some other website or some other origin. And then the gallery is from some other origin. It's from some other origin. You can copy everything and then you can create an application which gives you more value. Okay. So yeah, this is the Facebook widget. So anyone has embedded Facebook widgets in their web pages. And then if anyone tried to embed ads in their pages, at least Google ads and all. So if you have done any of these, you already created a mashup. So it's not something, it's not a new technology. If you have created any of these, you would have already created a mashup. Okay. So mashup and security. So why should we talk about security? First of all, what are the approaches in which you can build a mashup? The whole day we have seen a lot of sessions which are about JavaScript, maybe including JavaScript libraries, Ajax libraries or maybe data visualizations and all these things. So what is the common thing in all these sessions? It's like you try to get the third party JavaScript file and then embed in your web page. Right. So how do you build a mashup? It's basically one very good and very easy approach is to embed excellent JavaScript in your files. Okay. So what is script tag to some other.js file? So it could be a jquery.js or some visualization.js or anything. Right. So the easiest way is to point to an excellent JavaScript file. What is the other way? Loading content via iframes. So you know what iframes are? Vegetable iframe tag. Iframe src equal to you give the URL. So basically what an iframe does, when you give the src, you try to load a content from a remote page and then embed in that particular page. Those are basically iframes. So that's a very basic tag in this chamber. So interestingly, even iframes can be used to create mashups. If you go back and see this iGoogle, so this one gadget or widget. Okay. And then this is another widget. So you can visualize this as an iframe containing src equal to some other information. Right. So you have a couple of iframes in this particular page. And then if you see the other case where it's about Google Maps and having some data on it. For example, let's say I'm a newcomer to Chennai. And then I want to know all the petrol bumps near IIT Madras. Okay. So I can create an application like this where I have a Google Maps API. And then I put all the petrol bumps near I query, all the petrol bumps near IITN. And then I can plot it on a whole map. So there how do I achieve it? I achieve it using JavaScript. So I embed HTML JavaScript files in my web page. And then I can create a simple application like that. So you have iframes way of doing it. You have the JavaScript way of doing it. So there are basically two different ways of doing it. And then what are the requirements of any given measure? It's like you need an interaction between the different components. In this particular case, let's say you have a calendar control here. If you change the date in the particular calendar, or if you say tomorrow's date, I would be happier if I can get the weather of tomorrow. Okay. That's what I mean by interaction. Okay. And then communication. So if you have different widgets, they can communicate to each other. That would be really awesome. So that would be one of the major requirements of a mashup. And then security. So what are the problems related to security we see in mashups? Isolation of origins and secure data exchange. Okay. We'll end this well between these things very briefly later. So same margin policy. How many of you have heard about same margin policy? Okay. We need very good. Awesome. Actually, I'm happy with this. So more people have heard about SOP rather than mashups. Endless you'll come to the point. So what is same margin policy? Let's say you have two different domains. A script from one domain cannot access the DOM of another domain. That's basically what same margin policy defines. Right. So browser has to isolate different origins. Otherwise, what will happen? I have a hacker. I create an email gadget. And then with that email gadget, I can steal the information of your complete web page. For example, I have a web page where I have advertisements. How does an advertisement come into web page? First of all, by some external JavaScript file. Right. So I embed some, maybe Google's advertisement JavaScript file or some other JS file. So when I embed the JS file, that JS file is having access to my entire DOM. So if you're able to read your Facebook friends list, even that JavaScript file can read your Facebook friends list. And it can export to some other domain. Right. So how does browser differentiate between different origins is the main question. So there's a policy in browser called same margin policy, which tries to, does this task for us? Okay. By origin, what do I mean? It's key or protocol, colon slash, host, quote, quote. Okay. That's a good thing. It's as simple as this. HTTP, colon slash, wing dot com. So HTTP or HTTPS, they are different schemes or protocols. And then wing dot com, host and quote number. By default, it's 80 and then there you can see 81. Okay. These examples are from, these are different examples of different origins. Okay. All the three are from different origins. You can see there. Now, if a script is in a different origin, what are privileges does it have? Okay. Let me put it in a simple way. You're saying script src equal to some jql dot js. So what are privileges does this jql dot js have? Or in fact any other js file in your webpage have? It can have full network access, which means it can make index calls and then whatever a genuine, complex work you're doing, the same thing the script can do. Right. You can read and write access to the ROM. That's how jQuery and all the JavaScript libraries work. And then it also stores data. You can store data and DOM, maybe local storage or different mechanisms, cookies or whatever it is. So scripts of one origin cannot access DOM or another. That's the basic policy which is embedded in all the browsers. That's the reason why we are safe and secure at least to some extent. But then even there are workarounds in which this can be violated. So there comes the actual problem. The problem of security comes at this particular place where an SOP is violated. But if you observe strangely, scripts themselves are resulted from SOP. You can always create script src equal to google.com slash something.js. You can always do that, right? So when scripts can't access DOM or another, they can still be loaded from a different origin. So somehow this sounds like a content-free idea. In fact you can see in many of WS Crockford's statements, you can see these are common statements in many Crockford's videos. And then what else are eliminated or resulted from SOP? Any other guesses? Images. Awesome. So image, src you need not give to a genuine image. You can even give some JavaScript code and then that's how a type of accesses attacks are done, right? Image src equal to you can give some JavaScript code there. So even, yeah. If scripts are exempted from SOP, let's say I build an email gadget. You include the JS file from my gadget. What I do is I replace that your script with my same copy from my domain. Now I can access all the DOMs. See, when scripts are exempted, what I mean is, see, let's say you're the developer, you can always say script src equal to, you can load it from your own domain. Yes. Right? You can post the site in whatever domain.com, whatever it is. But then that particular page can load the JavaScript file from your domain, isn't it? Yeah. The statement which I said is exactly the same point. That is not what he was asking. You have a JavaScript, you are creating some DOMs using your JavaScript. Yes.   Okay. Okay, what I do is I delete your JavaScript and... How do you delete it? You said that the DOMs are accessible, right? It's good. Okay. Through your JavaScript you're saying... Yeah. Through my JavaScript, I delete your JavaScript. Okay. But I have a copy of the same JavaScript in my domain. Okay. I load that. Okay. I have a change. Yes. But I was able to access your domains. All right. Your DOM elements. Yeah. That's what I'm saying. See, when I'm embedding your JavaScript, I'm trusting you, right? Okay. How should I trust you? That's the whole point of security there. Okay. That is what you were saying. So, the script is not perfect, right? No, no, no. See, it's like I'm trusting you and I'm embedding your script. The script still loads from your server. But it executes under my context, for the user's context. Okay. See, as per SOP, even if it shouldn't even load from your server, if it applies to a script, but it loads from your server, but executes in the browser's context. Okay. Right? It's as if... So, it creates a cookie from a third-party script also. It will go in your domain, not the third-party domain. Exactly. So, it's executed in the context of the user who is using it. Essentially, script is nothing like... It's working the same thing as the user. Okay. Right? That's the whole point. Okay. Good that you brought this earlier because now, at least, the context can be that clear. So, similar to script, you may just... Even they do the same thing. In fact, if I'm src equal to, you can point it to some other domain. So, all these are like violations of the same origin possible. Okay. So, coming back to the ways of building mashup, one approach we said is script-based approach. Right? When we embed external JavaScript file into our web page, and then we do some coding there. The benefit this one has is very good interactivity. For example, you can see, on Google map, you can plot some petrol bugs, and then you can drag and drop all this. So, the benefit is like... We can clearly see the benefit. It's very interactive. But, the only problem is, as he rightly said, we are assuming that the script is from a trusted source. It may not be from a trusted source. Okay. I'll trust Google, or I'll trust Yahoo, or I'll trust all the big companies. But, I don't know whom I should trust. There's some guy who's saying, okay, my job is to do this job for you. I'm trusting that. Okay. That'll do. Just say, and then I'm including it in my web page. But then, it could be insecure or it could do all the malicious things like that I just said. Right? And then, no isolation of origin. Okay. Okay, let me call these ones. Embedded scripts have religious of important page, not the source server. So, how many of you have tried something like openfacebook.com, paste this script in the address bar, and then you'll be able to see who all listed your profiles? Did you see anything like this? There are a lot of... I think it was more popular in the awkward days. Exactly. It's popular in the Facebook days also, but it's in a different way. It's like this, some flash movie is playing. It's like, it looks like YouTube, but not exactly YouTube. So, when you click on it, there's some JavaScript file which is copied into your flipboard. And then, you'll say, put your cursor in the address bar, press J, and press Ctrl-V. And then, hit Enter. Basically, what he's trying to do is, he's making you copy and paste the manuscript in your address bar. So, it's like a different way of doing it. So, it's still popular, right? We do... I mean, at least, out of the video sense, we try to do such kind of things. So, what happens is, you do all sorts of different things, and then you will say, on your watch, you will see some things like, okay, this guy has brought a free Facebook t-shirt. Why don't you try this? Or maybe, oh my God, how did she do all this in company? These kind of things we never really see. So, how does all that happen? It's because the embedded scripts have the same privileges of the equal-to-place source server. So, the scripts are originating from a malicious server, but then they're executing the browser's context, right? So, that's the main problem of embedding scripts in your web page. Of course, they offer the very good benefits, but do you press them? That's the important question you should ask. And the last example that we have is, ads, widgets, execs, libraries, all have the same rights, right? So, if you're using an execs library and doing some very good job, the other kind of scripts we use by widgets as well as ads, they also can do the same good things, all the same bad things. But do we ever care about this? I'm not sure. We don't care here. As long as our work gets done, okay, that's fine. Yeah. So, he's a guy who almost all the JavaScripters respect Douglas Rockford, he's the JavaScript architect at Jamco. So, these are the quotes he himself had in most of the presentations. So, these are really interesting. SOP prevents useful things, allows dangerous things. It's clearly an interesting thing. So, what useful things it prevents? Obviously, cross-out in the execs course would be useful, but then that's stopped. So, that's a useful thing. Then, dangerous things, allowing images and allowing scripts to load from other domains is a dangerous thing. And then, if they just spit from two or more sources, the application is not secure, period. So, he says, it's okay. So, if you're having more than two JavaScript files, your application is not secure. So, whatever is the benefit you get, he says it's not secure, which is true. We know that it's not secure. For at least, we don't care about the security part of it, but we try to get things done, right? Fundamentally, as I said, this is a conclusion of interest. This is really interesting. So, what is the confusion about? You know what access is, right? Cross-site scripting. So, you have a text box. You don't sanitize the input. If I say, script alert high, and then it enter, boom. I can get that alert on my web page. That's basically a basic access example. So, fundamentally, access is a conclusion of interest. I know that access is evil. Cross-site scripting is evil. I don't want it on my page. But at the other end, I know match-ups are useful, and I create match-ups by putting different JavaScript files on my page. So, it's like, you guys are interested in this, you guys are interested in this. So, it's a confusion of interest basically. That's what it tries to say. Then, a match-up is a self-inflicted access setup. So, all of us know that it's an access setup indirectly. But then, we try to create match-ups. That's what it tries to say. The point is, it doesn't say that match-ups are bad. It says, match-ups are the things we changed under a web platform, which was not seen in 20 years. Match-ups brought a change. That's what it says. But the point is, it's being done by language, which has several bad parts, as well as developers who don't have a complete idea of the specificity of match-ups. That's what it tries to say. I think all of us respect all these points, right?  I think it's very much perfect. Then, script isolation. So, if you have seen Facebook, we try to enter different types of comments and all. Or, if you have ever tried to inject a script tag into it, ever tried to have Facebook, insert script elements into it, whatever, have you ever tried that? We try to keep all the good comments. But even if you try to insert a script tag and say, not hi or whatever it is, you still get it as script only. You actually see script executing inside Facebook. Why? Because Facebook is doing something very good. So, he says, okay, sorry. So, script isolation is... Now that we know JavaScript doesn't have any isolation of origins, there should be some way in which one origin has to be protected, has to... should not attack another origin and script should isolate each other. So, how do we do that? Restricting JavaScript to a subset. So, what is a subset? So, it is like agreeing that JavaScript has certain bad parts. We create a subset of JavaScript which does not have all the evil features. Okay, that's why I'm trying to say restricting JavaScript to a subset. So, how do we do that? There's something called Object Capability Security Model. I know it's a very... So, but take a term. So, the idea is very simple. Let's say, okay, if an object in JavaScript has no reference to XML, it has to be requested. And as I said, it cannot be made. For example, you have... Okay, you can say, we are obviously equal to new image. When you are not able to create new image, you can't access anything related to that image. So, that's what I'm trying to say. If we can build a language using this Object Capability Security Model, it does not have all the features of what actual JavaScript has. That's what this particular thing says. So, what are the popular JavaScript subsets? Google, Kaha, it's pronounced Kaha, C-A-J. It's very popular. And then, F-B-J is Facebook JavaScript. And then, Accent. So, these are the different JavaScript subsets which are available. So, what do these basically do? They try to rewrite. So, whatever JavaScript you write initially as a developer, maybe create new government. Do an exact sequence, get some data, map it, put it into your DOM. You do all sorts of things. But then, what do these JavaScript subsets, what do they do? They have a compiler which will translate your entire code into a safe subset of JavaScript in which you don't have access to objects like this. Okay? You don't have access to this object. You don't have access to such kind of things. But why these JavaScript subsets click very well as compared to the other parts of it? Because of the running curve, and usable issues. In fact, even the JavaScript compiler is, even they are like working. And then, I think, as the compiler is for Caha and all become more user friendly, I think this option is like a very good way of creating new subsets. Yes. So, what do these suppliers do? They take your JavaScript and verify that you are not using its industry request. They throw an error and use that or something like that. Yeah, exactly. So, it's like, they take your JavaScript, they do complete rewriting. They do static analysis and then, they do complete rewriting of the JavaScript so that you don't have access to basic objects like example history. It does a couple of things. It also does some level of sandboxing also. So, make sure you're not polluting the globals and all. It essentially rewrites a lot of stuff. It's a development time thing, though. Yeah. No, not at all. No, no, no. So, it's kind of both. So, it's like, you can also take third-party modules, at least the ones I know, Caha and Archive. They kind of try to rewrite your code even for third-party. Okay. So, if you're looking for script isolation, ideally, when you're including JavaScript files in your page and you know that there's a possibility of attack, ideally, you should have done this script isolation by using these JavaScript subsets, but we never care for this. That's another, that's a different query altogether. And then, isolation with frames. Okay, we have seen that one type of matchup can be created using JavaScript, whereas the other type of matchup is like iGoogle, and you can use it in the same way the other type of matchup is like iGoogle. You can create by frames, right? Each widget or gadget is like an iframe, and then they can talk to each other and then exchange data and all these things. So, the benefit of using frames is you have a well-defined, separate security context for each origin. Like, each iframe is like a different sandbox, and then one frame, the script in one frame cannot talk to script in another frame. So, by this, we can say that frames come like the same origin policy. For example, you can see the script here. If you can say SRC equal to the same page in the same domain, okay? And then in JavaScript, you can say frames of 0.content.com.body, which means you are trying to access the content of that particular frame. If it is from the same domain, it is allowed. If it is from a different domain, this script is called such as cross-domain.com. The same code will not allow, you will get an error, you will get security error. So, that's because of the same origin policy. So, one good point with the frames which we have seen is they complicate the SOP, and they can clearly separate different origins. Whereas, JavaScript can't separate different origins. That's the main difference we have here. But then, frames also have a particular problem. This is likely misunderstood and requires a little inter-contest standing. Frames can also be navigated to different origins. Frame navigation is not the same as same origin policy. Now, I think many developers get mistaken in this second point here. Frame navigation is not the same as same origin policy. It's like you have frame SRC equal to some URL here. You can't read the SRC using some remote script. You can't read this SRC attribute, because that's a same origin policy restriction. But what you can do is you can always redirect that SRC to something else. This is not a part of same origin policy. This is something defined as frame navigation policy. This is like increment in all the process, but this is not officially documented anywhere. This is a research lab, and then they publish a research paper which is there in the differences. So, you can see that. So, there were this frame navigation policies. In fact, all the process follows this. Now that we know frames separate different origins and also frames navigate each other. What are we saying? Can script in frame A modify the DOM of frame B? Is this possible? If they're from different domains, it's not possible to go to the same origin policy. But can script in frame A navigate frame B? Yes. You can always do that. So, this is not same origin policy. The next set of slides are based on this particular point. So, are you clear with this? Cross window attack. So, this is possible. I think in maybe I7 was just released or something like that. In fact, it's possible in all browsers. Since I don't have any screen shot or something, I'll definitely look it from the standard security in people's equity. So, it's like you have an advertisement here, and then you have a login form there. Right? If this entire thing is directly JavaScript, what can this advertisement do? As you type the email ID and password, you can actually look into the DOM and you can get your details. Right? So, a good idea is to embed or include the data login form in an I-frame. If this particular login field is in an I-frame, then the script cannot insert into it can't access the DOM of the I-frame. That should be a secure case. But how is that secure? Because the ad has been loaded with the script from a different domain. That's the idea. That script is still running in the same context as this stage. And that I-frame, okay, so you're saying the I-frame should be loaded from some domain other than Google. Subdomain. You have to change the domain in the I-frame. I-frame must be a different domain. Subdomain should be fine unless you have domain relaxation and things like that. Subdomain should be fine. But the problem here is since frame navigation is possible, this ad can navigate this frame to a different frame. Now this like a phishing, a typical case of phishing, this is called frame phishing. Now in this case what we can do, what this guy does is he redirects it to an attacker's page and then whenever you enter your credentials you're actually entering the credentials in there in an attacker's page, okay? There will not be any leader action, no history button, nothing, everything will be the same because it's already a frame redirection there. So this is called cross window attack. This was due to some question. This is due to some wrongly implemented policy in the browser, okay? After these set of attacks okay, this was finally patched and I think it's patched long ago, okay? Now this doesn't work if you're trying to do this in the same thing. Okay, this is already patched. Another type of attacks came. So when matchups were first developed, like for example like Google, you have different gadgets here and then these are legal gadgets. Now you can write some script and then you can navigate all the gadgets to legal gadgets. Now this is like dangerous. Yes, sir? This is a pretty good example. How is it patched? I mean, because the policy still allows that. I'm going to the point. There are a couple of slides there. Okay, so these were the set up. Sorry? Yeah. So this is cross window attack. This is possible because of one wrong call in the browser. This is patched. Again, after that patched a new type of attacks came. Same window attacks where one gadget can redirect the brains of other gadgets. Now this also patched. So what's the actual problem? So they seem to be some problem other than same origin policy. Right? So am I trying to hear? Able to follow through here? Past, slow? Okay. You said in same origin policy something can't access other domain's DOM element. Right? Script of one domain can't access those script of another DOM. Other domain. Okay? So this evil gadget is one domain and the other gadgets are other domains. Right? My frame is Google domain. Okay. So how can evil gadget access Google domain's DOM? That's what. You're not accessing the DOM. So if I'm able to access the content inside this. Okay. You're just navigating it. Okay. Okay. If I'm able to say if I'm able to read this gadget. element or do something then that's variation same origin policy. I thought the element or source is also reading kind of thing. No, no, no. So only that we are navigating this to an evil gadget. Okay. So even more dangerous, right? So you can create some fake login problems or whatever and you can steal your data. Right? You navigate, can I navigate from other DOM and frame? Let's say I have an iFrame which is from the same domain. Okay. And I have five more and it's from the same team. Okay. Like I can navigate the other's iFrame from a different DOM and iFrame. So you're saying it now? Yeah. This was possible previously. Now it's not possible. This was possible previously. See all these gadgets are from different domains. Okay. Now this guy can navigate any other guy and it's kept on the domain. He can't even be able to access that I think I'm right, from the other domain. How could he change it that way? When he says that iFrame of zero, it will throw error, right? No, he can access the parent, right? Top dot, he can access. Okay. When he says top dot, you get all the elements inside that top domain which is the parent, right? Now he has access to the parent. Now he's saying parent dot iFrame of zero iFrame of one or whatever. Right? But it's possible. Is it possible? Yeah, it was possible. Top is always accessible even if you're from different domain. Yes. Not all the properties with some properties of it. Some properties like location can be accessed. Exactly. That's the entire concept of neavigation based on that. Right? So, we are hopefully aware of this. So we are not accessing the content inside this. We are already navigating this. It's possible because he's accessing his top then top dot, framework, location or whatever it is. Right? So what are the real culprits? So here is the main culprit. There's a policy called Commissive policy. What it says is, okay, imagine this outer box is a browser window. Okay? And imagine the inner box is a iFrame. And this arrow means this fellow can navigate this fellow. Okay? So, reduting this particular way. So, if you see the last one, you have two different windows. Okay? And then the second window has an iFrame. Now, this window can navigate the iFrame of this. This is cross-window attack. This is what we have seen in the first window. But we need to have to get a handle of the window. All right. Window doesn't open. So only those windows? Right. Okay. But you can't only see the window open, I guess. That's the only way you can get a handle of a window, right? Yeah. We cannot get a handle of the window. The opening browser is the only case. If a browser gives you a way of getting handle to other windows, that will be rather scary. Yes, of course. You can just open a window that has a Gmail and read all the content out of it. At least I haven't read it. At least I never had read it. I think it's only window to open it. Yeah. Because it's like opening browser contest. So that's really the only way. So let's say this guy opened this window. This window is opened by this guy. Even that is sufficient, right? And at this moment we have to handle this eye frame. That's even dangerous, right? So this is cross-window attack. If we have seen that this is passed. Now this is a window having two eye frames. This is another eye frame. So it's like nested eye frames. Descendants. Now this parent can navigate child one as well as child two. Okay. This is another case. And in this case you have only an immediate child. You don't have a descendant below the child. Right. Only one child here. So this is called curvy suit policy which means an application, a premium application in any of this case is possible. Okay. So a quick question Krishna. Yes. So let's say I have my ad network also. Can I just migrate all the other people's eye frames to my domain? Sir, my ads on their eye frames is it possible? Now. No, it's not possible. They fixed it always. This is existing if something like that would be really cool. I can run my ad network much better way than that. In fact, many have become millionaires during the days of, you know, I have to end all these things. Okay. This is fixed in all the cross window attacks is possible. They eliminated this off and then they had only these three things in place. So this is the window policy. This was existing till some phase, but again they said same window attacks is possible. They have knocked out this one. This is the descendant policy. So you don't have the last two ones here. You don't have cross window thing and the same window attacks here. This is a descendant policy. All the let's say a new presenter is coming up. You can follow this policy. That's what W3C says. There's also something about China policy. It even doesn't allow the descendant navigation. But there's a problem here. If you don't have a descendant navigation, it will be like too strict or almost all the communication will be breaking here. So they said let's maintain compatibility. Let's not be too strict. Let's follow the descendant policy. So that's what finished. So that's what they defined this descendant policy to be followed. One more thing. Nothing is in the hands of photographers. All this is in the hands of browser vendors. What are the huge fears for the descendant policy? As in the second part, there's a child policy in mind. You're asking about this one? Yes. It's different actually. Yes, I can actually I can think in the terms of attack on it. No, I just actually there's okay. There's a concept called some space. Okay. So before the post pieces came I came about a smash. They came with a a product. Okay. So what does this? Let's say you have content from two different domains and then you need to exchange data between domains. There's no genuine way of doing it. So what did it is? Let's say it's from a sub domain of Facebook. Now you can relax. There's something called domain relaxation. You can relax that sub domain and then you can exchange data between these two. Now this becomes a data object. Using similar thing, let's say you're having a partner. You can have partner.facebook.com. That is this one. Again you go to domain relaxation and you can exchange data between these two. What's the point? So it's like a a broker where this guy is trying to get his product. So other than that I can't see any genuine use case where this will be used. But then it's a particular point which I'm going to show in time. Yeah. Five minutes. Oh so so many things to cover. Okay quickly. So fragment identifier messaging. So all of us know this. We use something called hash message. We use this for communication. So previously how to do two different friends communicate. It's like if I can have it passed the other way. So previously before instrument post message came this was the way which two different friends communicate with each other. But then once instrument came we have a lot of good things. For them we have post message API. Using post message API you can post data one way frame to another way securely. Could the window.name hack could be used for transferring data across if you have a frame can you say frame window across. In fact that used to be one of the ways. You won't get an event like hash change on it but you can use it for transferring. In fact there's also this resize event. People try to resize when you resize the window resize event will be fired. Even using that we can exchange data. So all these are different hacks but then not so popular because the amount of data if you use if you interchange is like really less. So post message using this you can exchange a lot of data. You know to whom you are actually sending the message for example post message you have post message message and target origin. So you can say whatever message here it is then you can you can have your target origin like this Hello partner and then you are secure because you know to whom you are transferring this particular message right and then there's no but from this you also have this Sandbox and CRS specifications in HTML5 so what does this Sandbox thing do it will it takes a write listing approach for example when you say write listing Sandbox it will not allow scripts form submissions form works it will not do all this it will not allow all this kind of things so it's a write listing approach wherein say you want scripts and respect to E-Altern has support for these Chrome existing version supports all of these in fact Chrome is the first one to support I think this one Sandbox are not secure and then okay so we have Ajax here we have Site-A and the server of Site-A Site-B server of Site-B now this this blue communication is Ajax from a browser now this this one is the CRS specification one problem see the frames have now if you frame an application you have all very good benefits but the only problem is framing attacks where this clickjacking is there you know you heard about clickjacking so there's a dangerous way in which your clicks can be stolen in fact all your Facebook spams are due to this clickjacking stuff and then there's frame phishing attack we have seen then I go we have to yeah okay so this is the partner website so this is my partner's website it's posted on board number 81 so this is a different domain from my actual website okay so my actual see here it doesn't have anything just says the part of website this is my actual website okay now I want to communicate to my partner the same thing which I have shown so if I say hello partner or this is a poster fine now coming back to the dissonant policy which I have said where you have nested frames approach you have the nested frames approach now this is this is the same site this is my actual site and this is my partner okay now what I have done here is I have grabbed the entire site in an eye frame okay now this is the this is actually an eye frame here you can see the border here this is actually an eye frame this blue one is the actual site but this one is the parent site but since I am opening the entire thing in an attacker window okay now this attacker is redirecting this gadget to an evil gadget it's because of dissonant policy now this guy is redirecting to this guy right now you have an evil gadget here yeah so click that in let's say there's some site where you can vote up I am voting it up votes 1, 2, 3 whatever I go to a feedback site how is this session going on manually then I submit so what it is happening see because there's a little button there it's actually an eye frame which it's containing the other site the previous site so this is a simple click jacking okay so actually this is an eye frame this contains the previous site so in a way the vote up button is above the submit button similarly you can also do in the JavaScript way I keep super like in this and then I come back to my page and I refresh it votes got English now what happened here can you see this button here below my cursor you can completely hide it and nobody will notice yeah that's how click jacking does that's how whatever I click there's gonna be a vote up yeah wherever I click I'm just going to vote up right so I can increase my session this can be a Facebook like button also you can just get I have a Facebook like button demo not for the vote but still like my code like my session okay I don't have I don't have internet access but then if you can see the code of this it actually has like button here when you click it like for Facebook so these are the craving attacks which are there so you should be careful of these craving attacks and then so the best summing up quickly of using measures you have to use you have to go for JavaScript subsets if you are using life frames you have to take care of all you have to use all the HTML5 specifications and also take care of HTML5 the craving attacks that's the security of doing our measures so that's it Krishna can I add something to this sure sir so the thing is Krishna's talk precisely about if you are a consumer of a third party script or third party library and all and he precisely covers most of the most important points but let's say if you are a producer of a third party library and you want to write a third party component that others can consume there are a series of articles by one of our regular presenters Rakesh just look up for Rakesh by third party library if you are building third party widgets go through that as well he did that in Pune and Bangalore he couldn't come to Chennai because of some personal work but go through that that will be a really good complement with this talk yeah five minutes five minutes extra thanks Krishna


We good. I just noticed my audio was muted. There's gonna be there's gonna be some issues on this one We're trying new things. We're having fun. Yep. People are saying muted master sergeant. I see you. I hear you. I'm on it I'm on it We're doing something new today. I haven't I haven't played a game in well at least I haven't played a game online streaming Quite a long time But we're gonna be doing spider-man 2 the wand says mute. I think that we're done. Are we still muted? Are we good? We know. Okay. I think we're good now. There is a situation I am supposed to be streaming to twitch in tandem. It says I'm live, but I do not see I Don't see it showing up on twitch If anybody could tell me Well orange get says welcome back. I honestly forgot how to even check if I'm live on twitch Oh, you're live baby. Okay. He says I am. How do I not know how to like I legitimately don't know how to find myself on here Let's go to channel. Just give me a give me a second to like figure out my life. I don't know what the frig Maybe I have to refresh. Oh There I am. Okay. All right Okay, it's working sweet I am on twitch and I am on YouTube at the same time. So if you are not a Twitch subscriber, I completely understand why I haven't been streaming over there in like a year But there was a time when I was doing it constantly and now guess what guys All the live videos are gonna be streaming in tandem both on twitch and on YouTube Isn't that insane? If you have a Amazon membership a prime membership It's a free thing you get a free subscription on twitch if you don't use it you'll lose it Jeff Bezos gets it in his pocket. So just subscribe to me on twitch You don't have to even watch you just you just give me the subscription. It would be awesome. It'd be great Like I said, this is I mean, it's been a very long time since I've done this So and since I'm doing both in tandem. It's there's gonna be some issues Let me know how it goes. Please be honest. We're gonna play spider-man 2 While I'm playing I plan on chatting movies because this is a movie channel. Let's begin Please let me know if you hear audio from the game. That was a big issue in the past I'm using StreamYard to do all of this. It's a dance And I really don't know if there's any way to adjust Audio levels on here. I think it's auto. Do you hear audio on the game? Well, there's no audio to hear. Oh my god Challenge level. What do we have to work with folks? We have spectacular friendly neighborhood That's for people that really don't want to do anything Settings for player difficult to like balance. We're gonna go with balance. I think that's kind of the popular one None none of this matters. All right, let's begin. Oh wait, I should put subtitles subtitles are on Did the spider-man 2 tell us on finally no perm unfortunately? No, I did not get enough money for the game I just went ahead and You know bit the bullet Thank you for reminding me though perm fam I gotta tell you super chats are the name of the game on this channel on youtube If you're a twitch person you can you can do stuff there too. I don't remember anything about twitch But super chats are the name of game they get featured via a lovely little overlay and then I communicate with you Let's do a recap, right Brian Miller says no game audio. That is not what I wanted to hear Let me look into it Okay, well that didn't help me Let me let me just play around. It's what we do audio options speaker default mic Yeti Let's let's see what we got You can do extra camera, but I don't want an extra camera So turns You know, this would be a problem. We got some super chats. I might as well read them while I sit here in sweat The wand for two dollars says will this be another horizon bore situation? The wand shot out of a cannon with a an edgy comment. Yeah, that horizon zero don too was not a fun stream I was very bored by that. Thank you wand Master sergeant with a gorgeous ten dollar super chat. This is a super chat. Hope you're doing well master sergeant Thank you as always And perm for five dollars all started off. Good luck with the game audio.  No, but that would come off the controller. I don't really want to can I do that even? I don't think I can do that No, no, that's ridiculous Screen sharing no audio.  Where is it? Where are you? You know, I could just I could just be really ghetto and play the audio right off of my computer I wonder if that would work just to kind of like get through just to power through this No, that would sound terrible too Okay, uh Is that loud enough? Anybody is that is it loud enough to do it this way? I'm hearing good. Okay. I'll just wake my son Connor up. He's above me It doesn't work. I don't have a lot of time left. How's the quality of the video and everything? Is it all right?  Oh my god. I would love if that was the case. I can calm the audio down We have a new teacher joining us today My name is Pete.  All right Surface tension is all about As the force exerted parallel to the surface of the And anybody, uh, I Uh, mr. Morales, is it? Uh, are you sure this isn't something you can handle yourself? I'm sure Okay class, uh Parker got gray hair already or just some lighting Let's be the lighting Oh, my mic is loud I turned it down a bit Mike better now This game really makes me feel like i'm spider-man Sorry, I looked I looked over at the chat and I lost what I was doing Still the same okay Okay, my mic is down a lot How does it sound now?  I can't pull the audio Off because it's gonna it's gonna catch my voice twice if I do that Yeah, well, yeah, it's better because now i'm not uh, i'm not having them the audio come from my computer End from the mic at the same time. I think if I press play right now Let me listen on my phone once won't work. I guess it won't work That's sounding good, but I think if I'm playing the game and talking well, just let me know Let me know if it's okay. I am on a macbook I am on a macbook.  I cannot look over while I'm playing this Okay, I am on a macbook when I'm doing this Game audio is gone How can that possibly be? The game audio went down because my mic audio went down. Let me try upping the computer audio now and try it That's good. It was fine on twitch. Okay, where are we at? Where are we at with the audio? Is it is it good? Is it bad? I want I want to get it figured out for at least tonight. We'll figure it out better another night But uh for right now, this is what we have I don't know if I want to putts around too much with the Call it there. It's good enough there. Okay, maybe we just call it um Again, this was kind of a trial by fire situation as it always is We did get a nice super sticker in from dark room reviews. Thank you dark room reviews. I appreciate that Yeah, I can hear the game audio. It's good enough. Okay. Well I mean, there's a way that I can privately kind of try a stream Maybe I'll try a stream privately tomorrow and just listen to it myself Thank you mic hunt. Thank you mic hunt Let's continue. Oh, we're running now. We're moving Another day at the races Let's dance Okay, okay It's time to tango Oh my god I saw super chat. I will jump into it in a second. I appreciate it Goodbye Dwight Oh, thanks for coming Miles. I know you were busy Why is he? Just goes the other way He just leaves Okay, oh, that's the writing Okay Okay, I'm coming.  I dodged that.   That's sweet. Why have we not gotten a good new matrix game? I wasted on one the frick just happened What is going on? Okay Maybe that was supposed to happen Man, we've got to get you on what is that clapper and boost your social media game streaming on a friday at this quality Would net a newcomer 150 views easily Oh, really? I'm like super bummed out about the quality because the audio is a shit show right now, but I appreciate it I don't know what clapper is though or what does that say clapper? Yeah We got a super chat from jan. Let me read that quick before it gets too dicey jan Thank you for the five dollar super chat. How's your weekend going so far any plans? Also, I love spider-man 2 movie one of my favorite sam ramy movies. Hell. Yes Big sam ramy fan still. I love spider-man 2. It's also my favorite spider-man movie Although I really love into the spider-verse as well What am I doing here? Finishes are devastating attacks Okay There's your hero shot Oh, beautiful shot.  I'm yelling timba web wings. Oh Here we go. Oh, it's got kind of the controls of batman arkham asylum I like it I just went straight through that thing Like it was nothing Speaking of sam ramy. There's some ramy stuff right here Went right into it again.  Oh my god.   Oh Some great writing there I saw this at uh, this is like at an e3. Well, I know they don't do e3 anymore But whatever this was is like a special presentation thing I saw five nights at freddy's with my kids today Not great Not great My son connor 11 he was pretty stoked for it Um, it started at a 10 for him But it just kept getting worse as the movie went on and I think he ended I just asked him before he went to bed and he said dad tell him He's six and a half pathetic Can't wait for the craven movie, huh? Yeah, I didn't think five nights at freddy's was anything worth writing home about I thought it was pretty mediocre And again for an 11 year old boy to give a movie a six and a half that translates to more of a four Because kids are a lot more generous with movies than adults Wait five nights at freddy's is on peacock Or some nick or the nick cage movie Um, okay, so this was kind of a weird That was a weird place to put a title card. So we just got done with this epic sand Oh, look at that trophy pop is gorgeous.  Yeah the experience is so magical today. I'm gonna tell you something I was not having it today I again I spent you know each ticket for the kids is 12 bucks. I have the regal pass.  It's fun I loved going to movies as a kid It was cheaper when I went um, but anyway these teenage girls come in and it's just game over right out of the gates They are loudly talking with each other Throughout the entire all the trailers that come up loud talking through all of them laughing loudly and I'm like, okay We're gonna just let it go the movie's gonna start and they're gonna just magically not be annoying Wrong They start laughing loudly during the opening scary sequence.  That's verbate on what I said Normally I would be like, can you please be quiet? But they were driving me insane I mean, yes, I had my 11 and 14 year old and I like went full Full mama bear, I guess you could say I'd say dad bear, but the dad bear leaves and oftentimes will try to eat his young I don't want to eat my kids so I lost it. I completely lost it. But you know what those girls didn't talk anymore during the movie So maybe that's what I do from now on.  No, she I should have remembered She's my daughter What am I supposed to be doing? I just got lost in the why am I doing this? I guess i'm supposed to be doing this to to put all out the sand. Oh that did it. Okay You're welcome I'm on my way there now kid I don't really like go up this building. Oh here we go. What is all this stuff? The launchers for high altitude weather stop talking so I can open it Kick it Kick it kick it Oh, he's done talking now great What would you have done if they said are you adam from adam does movies? I would have said yeah, I am Tread lightly I got nothing to lose Is that Kenzo? Is that the the one and only Kenzo from Fortnite fame what in the hell is happening? What? Wait am I in a drone? I wasn't paying attention. Oh god. I don't think I got all of them, but I did all right Well, they counted that How you been Kenzo? Hope all is good in life Level two So I was thinking Not obviously this stream, but when we do play multiplayer games I thought it would be fun if we did like a super chat of 10 or 20 bucks and You could join me for a round or two. We do like a pay-to-play Conversational thing maybe a round or two of fortnight You know just have fun with it. Of course, I can't even get the audio to work right now So it'll it'll be a couple more streams Vinny Vinny I paid for two dollars of this. Yes. Yes, you did Vinny I paid for the other 40 some dollars You have leveled up and earned a skill point you can spend skill points and learn a new attack and moves pro sex to a Continue. All right. Well, this is kind of like the last game Is a shared skill tree Oh, that's fun Okay, all right Just probably want to get the basics or I don't want to purchase this I don't want to purchase. Do I have to? Okay, I guess I had to So I can't get anything else.    How many freaking takedown animations did they make this time around? That's crazy Throw in that at Jerk Can I can I teabag him? No, I can't teabag him Kenzo.   What do you want from me? Okay, it's pissing me off that there's the those like uh exclamation marks above Whatever. Oh, what am I doing R1 and up? Oh, that's sweet There's a lot of stuff to do in this one.   Oh, all right Well Island twig in the mix Island twig I basically went on twitch exclusively for you Because I'm like I haven't seen him in a long time But I'm on twitch now and I'm playing a game Wait, I want to switch to miles. I guess Oh my god, there's loading. Oh my god that loading was so long Uh, yeah, I'm asked for sergeant. He keeps it between his butt cheeks and look how clenched those are All right, hold R2 then release R2 plus. What am I doing? Oh, okay seemed excessive In the first game you could do tricks when you were falling. How do you do tricks again? No, not like that Okay, okay, calm down What is it? Oh, it's uh l1 I think Yeah Where am I going? Oh, I'm gonna go up here Yeah, I was doing that. I don't see anything that looks like a launcher Maybe it's sort of sand Jenga, what what am I doing? No That's how it's done. That's how it's done. Okay. Oh, you know, what's nice is Because I'm tandem streaming I can see my twitch and youtube comments all in the same window. That's sweet Uh, yes, kevin. I'm back on here We're doing it. We're gaming again once in a while and talking movies at the same time. It's remarkable Oh, we're doing this again. This didn't go well last time No, no, it's like trying to find the g spot And I nailed it. Let's wing around the rosy That's the kind of cinematic quality you get from me right there Hello the view with drew peekaboo Rapidly press I've been doing this all day What There's a locksmith up the street Perfect dodge turns red. Uh-huh. Yeah, I'm familiar. Let's do it Shoot me It's right Stay down That's the first animation I've seen repeated Little busy ma What? Mrs No, I've not experienced any glitches kenzo. I have however experienced some some roughs going with the audio per use Perry just before a melee an early parry will be less effective. Oh parry. Okay Tyler parried him pretty good Oh my god Not doing well fam Freakin heal Why can't I heal? He's break dance fighting No, oh my god. I thought I parried I thought I Tyler parried Gotta remember how to do this again. Well, that time it was no problem.  Okay? Well, that time was like nothing You're not so tough. Not so tough big guy. Uh Why is it? Why is it say there's a notification?   I've swiped open four times What am I supposed to be doing clicking on that? Oh my god, the map is larger than it was last time Much larger Oh, thanks to view with drew appreciate that um What am I supposed to be doing? Okay, that's I guess that's what I was supposed to be doing Minutes to midnight is the best album ever Um I wouldn't go that far, but it is a good album I'm not gonna lie minutes to midnight was always a little bit of a disappointment to me after meteora I still think meteora and hybrid theory Are linking parks best But but a lot of their stuff is still great afterwards minutes to midnight's great What is it like the hunters?  I can't remember what that one's called Yeah, gta. Yeah Now here we go for the thought wait at the hundredth time Here we go for the hundredth time hand grenades in every line I thought venom was in this game. Where the hell's venom? Mm-hmm there is It's mine That guy didn't hit the ground for five minutes. Oh, I just wasted that Why am I rotating this Why am I rotating this? Rotate rotate. Okay. Thanks Hey meteor is garbage What? Wow, I don't think I've ever heard that from anyone before Meteor is garbage Okay, this is I'm having an issue with the swiping thing. Here we go. I think I'm pushing down to our is the problem No, you do too much already Whoa, whoa, whoa, that was not the right direction to do that Yeah, I know how to swing game.  I'm gonna bring up Uh on spotify I have crafted several playlists Best of emo best of female pop best of rap hip hop Best of rock best of alternative and within each one of these gems I have made custom art for them so you can see right here I have these beautiful black and white photo covers With the splash of green for spotify and in here is Oh, he's gonna be they're gonna be in rock. They're gonna be in my rock playlist Alphabetized, of course Lincoln park slash fort minor I threw above threw them both together I have one two three four five six songs From hybrid theory It was the greatest hits playlist I have one two three four five six seven eight nine From meteora Minutes to midnight. I have one two three four And we're done burning in the skies What is that album? I got three from the lost in the echo The bottom line is meteora has don't stay somewhere. I belong Lying from you easier to run Breaking the habit numb nobody's listening.  All right, uh, what do we have left here? I'm probably going to This was a test stream, of course We've been going since 10 30 11 30 12. We're gonna end soon um If you have any more super chat questions Or support Please throw it now or forever hold your piece. I don't actually know what I'm supposed to be doing Can't open the thing right now. So I'm supposed to be finishing this mission Oh, I can swing with them sweet can I web wing with them you think I cannot web wing One Jay Jonah James and I'm carrying around that's awesome It's funny because I was just on hack the movies Livestream the other night I was giving Tony shit because his mic was having technical issues and I was saying that You know everything I do is just perfect And then we spent a half hour trying to figure out audio on this And we didn't really figure it out Oh, he just left Something about going on vacation. That's incredible. Hey, also while you were gone I found out that I got Grand scholarship Are you seeing it? Good job bud Either your voice just exploded or my tv did oh no Sorry to hear that A beautiful super chat from pizza werewolf for 99 cents. Thank you pizza werewolf Pizza, I think you're a hack the movies guy, right? Or were you were you just an adam does movies guy? I can't remember. I feel like I've seen you on hack the movies before On this on his stream. Where's my car? Oh I'm sure that you're gonna figure it out Good man pizza Good werewolf Werewolf of taste one thing at a time completed Old monkey gets in right at the end My definitive spider-man, I don't really have one honestly I like all the spider the spider-man actors They all bring something to the table kind of like batman I think a lot of the batmans are good in their own way Obviously, I'm gonna be partial to toby just because that's the one I grew up with but Andrew Garfield. I've appreciated a lot as time has passed Yeah, sorry old monk. It's uh 11 50 here and I I was just trying to get the waters tested. I'm probably gonna start these streams a little earlier I started them at 10 30 before because You know, it was early. I I just kind of stayed with it I was doing at 10 30 because I had a lot of like trying to set things up and tear things down But I got a real good groove going when I started using stream yard And um, yeah, so I might start streaming a little earlier. Maybe even 9 30 or 10 I think I pushed earlier to 10 at least and then we can play a little longer stream a little longer And like I said, these are going to be going on twitch at the same time I think it went okay on twitch outside of the audio of course being an issue um, I think the twitch thing went well, so Tuesday I go live. It won't be a gaming stream. It'll just be a You know regular movie stream However Because we do have the game going I'll probably add more streams in so the reliable ones will be Tuesday and Friday still But then on top of that, I'll don't be surprised if I show up on a saturday night or a wednesday night You know, I'm in south carolina with just my wife and two kids We see each other all the time they're homeschooled So having a couple hours to myself to hang out with you guys at night not a big deal Especially if the if you know, there's super chats coming in and whatnot Tenge for us as mic audio wasn't that bad honestly just the game audio. Yeah, we'll get it figured out I'll do a I'll do a private stream. We'll figure it out Yeah, Kevin, uh, I would love to do movie streams Unfortunately, unlike with gaming movie streams get copyright hit every single time So you can't just do like a fun watch along unless you do a prime Stream which alienates a lot of people. It's just a disaster Sorry I had to manage both streams, but thanks all for coming Yeah, shout out to orange get as always for moderating the streams really appreciate it as always sir Um, and again since these are going to be going up on twitch now because I think it it worked well, um If you have a subscription to throw away on twitch go ahead and throw it to me because Every week you're getting a couple streams now Guaranteed there's no reason for me not to tandem stream it plus they will be doing the These won't be but my movie based ones will be going on the podcast as well on spotify Apple podcast blah blah blah blah blah And lastly, I would just say thank you to patreon and youtube join members You can become a member on youtube by just hitting that join button and there's a one dollar a month tier just one dollar Same with on patreon and you get extra perks like Hundreds of exclusive videos that are actually really funny amazon prime free sub.  All right. I'm gonna leave it here This was a lot of fun. I'm glad to be gaming again. I don't know.  I think it's a 16 hour completion Yeah, okay, I can handle that no big deal And then we'll probably get back into something more multiplayer based so that uh some people from the community can come in I think that would be fun as well upcoming Episodes of the podcast are gonna be fun. I got some music ones I'd like to do two of them right out of the gates that I have in mind is best musical scores in movies Obviously, some of them are gonna jump out right away Jaws Star Wars Jurassic Park Pretty much everything John Williams is done But another one that I think would be even more fun to do are movie Songs that are so iconic because of the film like when you hear a song you think of the movie Immigrant songs one that recently has popped off because of Thor 3 Obviously, that's not a new song bohemian rap city whenever I hear queens bohemian rap city I instantly think of wanes world. I think that would be a fun podcast video to do or maybe I save it for a live stream I don't know. We'll figure it out. Thanks guys. I'll see you real soon and hope you enjoyed the setup for this Take care


In this episode, we'll be talking about how do you land their perfect service design job. We'll also talk about how do you actually plan for fulfilling career after you've been hired. Finally, we'll talk about what organizations actually think they are hiring service designers. Here's the guests for this episode. Let the show begin. Hi everyone. This is Angela Yeh, and this is the Service Design Show. Hi, I'm Mark, and welcome to the Service Design Show. This show is all about helping you to build organizations who put people at the heart of their business. The guest in this episode is Angela Yeh. Angela has over 20 years of experience matching employers and designers, and in this episode, we'll talk about how we can close the gap between what designers want and what corporate organizations want. Angela has a really interesting perspective on that. I think a unique perspective in the design field, and she's going to share that with us in this episode. If you're new to this channel and would like to level up your service design career even further, make sure to click that subscribe button as we bring new videos at least once a week. That's all for the introduction, and now let's quickly jump into the talk with Angela. Welcome to the show, Angela. Hi, Mark. Thanks for having me. Awesome to have you on. I really love episodes where we're going on the fringes of service design, because that's what we learned the most, and in this episode, we'll definitely be doing that. Angela, for the people who don't know who you are, could you give a 30-second introduction? Sure. I'm the founder of two businesses, Yay Ideology, which is an executive recruitment firm specializing in design, strategy, and innovation. We've been recruiting in this space with corporations and consultancies for more than 13 years, but myself, I've been in this space recruiting for quite some time. By the way, prior to that, I was a designer design director. The other company that I founded is Thrive for Design, and it's an executive coaching program for professionals in this industry. People who are wanting to pivot and succeed rapidly in this industry. It's really interesting, because you're in the design industry, but also outside of the design industry. You're like the matchmaker, or you have at least a completely different perspective on design, I think, right? Yeah. So, most people have been in this industry in some sector, some category, evolving within it. My space, I've been watching, let's say, the platform and the world of design as it evolves throughout all of these years. So, it's fascinating. Super interesting. Yeah. Can't wait to hear your stories. Angela, this is called a service design show. You're not a service designer by any means, but do you actually remember when you got in touch with it? Have you ever heard that term? And when? Well, and then, just so you know, my undergrad was psychology with a minor in sculpture, and then I got my master's in industrial design at Pratt Institute. So, having been in an industry as a design and design director, I've seen this industry evolve. And I remember, well, let's talk about this. I remember when the word research, design research first came about. I remember when the first term design strategy came about. And then, I'd say about 15 years ago, service design became a terminology in itself. So, yeah, yeah, yeah. Yeah, and it's been a space to itself. It's interesting. It's still one of the newer burgeoning categories of design, you know? And it's fascinating who steps into it. Sometimes people come into it from time, some from business. You said like about 15 years ago, so that will be about 2004, 2005, do you remember in which context that was? Where did you pick it up? Well, you know, I think the terminology comes from the practitioners. I mean, in this industry, people in this space were starting to define what they were focusing on, right? There were people who were crafting an expertise far before business understood the terminology. And in fact, you know, there's a debate about sometimes are you working on something if it's human-centered design or is it service design or is it experiential design? It's interesting, because sometimes it depends on who that practitioner is and their perspective, right? Their optics. We love those discussions. Angela, all right, awesome. You gave me some really interesting topics and I think they will be super valuable for anyone watching and listening because there are the non-typical topics on the service design show. We're going to do an interview, Jess. Are you ready? Yeah, let's do it. All right. Topic number one, here it comes. It's called relating design. And do we have a question starter and can you show it up? Let's see, relating design. Why? Why relating design, right? So let's talk about relating to design as I would imagine your audience has mostly professionals building their career, right? And when you talk to employers, clients, I think the biggest challenge is why do you bother teaching employers and clients how to relate to design? I think that most businesses today have a rudimentary understanding what design is. It comes from where they've first felt the need for assistance for some businesses. It could be aesthetic driven for some, it's technology, is it service, is it systems, right? But their knowledge of what design or strategy or innovation, depending on their optics, their perspective, it only goes so far. A lot of times I think companies don't realize what full impact that design can bring to the table, right? And I think it's so critical when you're dealing with any client to always know how much they're aware, right? That's the first step. But as professionals, I guess that, you know, my space is understanding the difference. Let me just say that I sit between employers and clients and talent. So there's a gap in that, you sit in that nexus, right? There's a gap in that conversation. And also we've also sat between business and design. So in some respects, the language there, the disconnect, right? So you really need to understand what that your counterpart, their level of understanding is, right? So that you can have reference yourself. So you mentioned, you're sitting in the gap between the employer and the designer. Like, could you describe that gap? And like, what is the maybe the most common mistake designers make when trying to bridge that gap? Yes. So we have companies that come to us from all backgrounds, all sectors, all sizes, right? Corporations and consultancies. Corporations meaning not the consulting space, right? And the biggest quandary that employers tend to have and or clients that they're looking for an agency for us to introduce one, they say to us, I can't tell the difference from one individual to another. And most common line that we've heard is that someone said to us once from a VP executive to mid-level talent, entry-level talent, they say the same thing. They all say, I'm a designer and I solve problems, right? This is one of the most popular, you know, lines that we've all had in design to start with. But as this industry has grown so fast, you cannot stay at that level of conversation, right? You need to really know where do you excel? What space, are you literally in the space of service design or is it user experience? Is it, you know, experiential design? Is it design research, right? So is one of the common mistakes that we're not able to be more specific about our craft and the value we're delivering and clearly articulating that? Absolutely. And at the other side of that, on the other side, listening to talent, I completely understand, right? Because the other side of the story, we have talent that say, I am not, just because I've been in the world of CPG, I'm not gonna be in that space forever. Just because I've solved the problem in healthcare, I'm not gonna stay in that space forever, right? How do people evolve is an interesting question. And I would say that, in fact, professionals in these spaces evolve quite a bit and in fact pivot quite a bit, much more than in any category, I'd say. You know, if I were to, you know, someone's in accounting or in law or in medicine, they kind of tend to stay in their sector and move linearly, right? Straight down their path. Yeah, and I think we'll get to pass in a moment but I've still puzzled like with trying to relate design to an employer or a client, like what are, could you give us some tips and tricks, maybe questions that we should be asking if we're sitting next to an employer that help us to relate to them? I think one of the biggest things that professionals tend to tell us when we have people coming to look for an opportunity or coaching and navigating their career, one of the most common things people tell us is they say, I would love to be in a company where the corporation or, you know, let's just talk about the corporate side because there's so many people interested in that track, right? I would love to be in the corporate side where the corporation has a high awareness of design and a full respect for it incredible amount of investment in it so that I can just do my craft, I can just execute and do what I love doing, right? Well, what people don't realize is if you really wanna navigate and progress in your career, you want to be able to speak to people who don't have a high awareness of what design is that don't necessarily know how to invest in design just yet, right? They need to really speak to that first basic, you know, level customer, right? And to me, that's one of those skills that are absolutely invaluable. In fact, the people we know that are really capable of moving up the ladder, those people will always know how to speak to any denominator of clientele, right? That to me is one of the biggest issues. Most people want that comfy environment where the corporation spends, you know, hundreds and thousands of dollars, big teams of talent, right? But actually, there are some really pivotal career moves where you go to a company and you're one of the first ones to begin this and think about how many companies today while there are so many stories about which corporations know how to invest in design, there are hundreds and thousands of companies that are still at that nascent level of awareness. Right, right. We've had some people on the show who are like the first and still often the only service designer in their organization, even though they were big. So it's, yeah. You touched up on something that relates to the second topic. And let me hold it up because I think it's a good moment to move into that. This topic is called Creative Career and you mentioned something about navigating your career and do you have a question starter? I do. Okay. How can we, right? How can we create a career where we're thriving? Let me just say that when a corporation finally works with a top consultancy, let's say someone like IDO, right, or Frog, do you think it will poorly of that corporation when they finally worked with that corp consultancy and they finally solved their problem? Or do you think they have gone to the best experts to figure it out, right? So the same thing for professionals, employers, corporations, they need to find the best talent, right? But what employers look for, their unicorn, their best candidates, it's not necessarily what, when they're looking for talent, they're not necessarily looking for designers, everyone that's out there, right? You need to know if you're the ideal candidate for them. Particularly outside of that, you need to understand when those opportunities are right for you. And I understand that, how do you pick, right? How do you choose? So you have to really understand it's not just the size of the company, it's not just how many years have invested in it, you really have to understand what is the gift that you have? What are you looking to grow, right? How are you looking to evolve so that you can identify the best opportunity? Those are really good questions that I also sort of had, was following on, like, okay, knowing what you want and what you're good at and where you wanna be heading, like, that makes it easy to navigate your creative career. But what I've heard in some of the best episodes is that there isn't like a typical career path for designers, it's hard to find role models, it's hard to sort of reverse engineer where you wanna be. I can't move up in the organization, I can't move left and right. So what is your experience with designers? We just start at a corporate and then need to want to move to the next stage of their career. So let me just say that more than 15 years working with professionals in this space, right? There, most people I don't think realize their issues until they are midway in their career, at least seven to 10, 15 years in. Then they start to realize that they're finding some issues. What we realize that in any company, any sector starting off in an industry is easier, right? Because in any company, let's say the hierarchy of any company, a typical pyramid, how many people do they need at the mass level a lot, right? So the bar is a lot easier. Let's say it's like entering in a marathon, every company has one, everybody can, you know, register and win, doesn't matter how fast to some degree, as long as you're participating in some sense. But as you get to that final stage in your career and you're wanting to move to that top sector, it gets really hard. Harder in the sense that both the employer have much more rigorous standards for what they're looking for, but what people don't realize is for yourselves as professionals, people also, their requirements are higher. They need to know exactly where they wanna go rather than wander as in in the earlier years where you can have the affordability to kind of, you know, organically discover, right? So I think it's part and parcel following intuition of what is what attracts you. We find people that don't follow their career, don't follow what they're really passionate about. And then we have people where they're following a ladder, a straight up ladder and they're trying to evolve to the next step. A lot of times professionals don't understand what it takes to get to those final levels to stay in this industry. And by the way, it's a very hard industry. It's more competitive today than it has been ever. There are more people coming into this industry than there are real viable opportunities. So you have to really be aware of how you yourself are progressing, be absolutely aware of what you're striving for, how you're reaching out networking. I think the traditional methods of networking don't work today. I think you really need to hear and listen to yourself and understand what's important to you. Yeah. So I was like wondering, knowing that people run into these issues if they are seven, eight, 10 years down their career path knowing that what is it that junior designers getting into this field can do today to actually start planning for what's going to happen in eight years? Yeah. What's your take on that? When you start planning for junior designers, I would say I think at early stages of junior designer, you want to be open to try and taste the cornucopia of all the different opportunities, right? That is the stage to be at the buffet table, let's say, and try a little bit of everything to see or in research what's out there through your networking, through your discussions. I think that at the earlier stages, it's almost through serendipity of tasting what's out there. Now, from the other perspective, I will tell you in all the employers, in all the clients that we've ever talked to that want experts, it's in that high level expertise is where it's really hard for them to find the right people. And on the inverse, we have high level talent where executives are evolving their career and trying to pick and select the right type of opportunity where they can really excel and continue to sustain success in this industry, right? That's where it's really, really hard. I have employers that know everyone in the industry, but yet it's hard for them to determine which candidates are right for them. What makes it so hard? It's hard because I think from a creative standpoint, again, creatives like to leave the door open and say, I'm an expert and I can solve any problem. But to really know where you're, the quality of how you execute and the style and the quality of your optics, I think it's really important to know that. Because I think each individual will bring, let's say, like musicians, right? Let's say you had different musicians that were jazz. You all create the same song in a different tone. The result would still be beautiful and different. And the same thing in music, we create different results, right? And for different clients, it's not about necessarily numbers, right? It's not necessarily about revenue. So you really need to understand how you're creating success for your clients, how you're delivering results. And I guess, yeah, this is what you help people to do, right? That's the core of your, that's the core of your servers, right? Yeah, I mean, to ask these questions to figure that out. Yeah, I mean, for me, this is where my optics come in. This is where, for years, understanding talent. We have clients that have been wanting to evolve their candidates. And it started with top-level candidates that wanted to apply for certain opportunities and not being able to make it. And then trying to understand how to choose. Like at every step of the career process, let's say interviewing, there are some people that got stuck at not even knowing where to turn. And then there's some people where they can't even gain opportunity to have the door open. And we have some customers that we work with where they have too many opportunities coming to them, but they're the wrong ones. Right, right. Or then people who get into opportunities that seem amazing because everybody knows them, but then they get into these opportunities and then the situation isn't what it seems. How do you evolve and progress within a company? And on the inverse, we have employers who say, we've got a phenomenal team of talent. How do we cultivate them? How do they grow them to the next level? And that's exactly, I think, our third topic. Because it's about hiring design talent. Do you have a question around this one? Yes. Well, I wasn't gonna pull up how can we, but when will? So let me talk about when will, right? Part second half of this question, building and hiring talent, creative talent is the first stage a company's going to. When they first work with a consultancy, the consultancy lands this beautiful deck on their lap and they say, wow, how do we insert this credible initiative and implement it? And then it doesn't. So then they think, when will this happen? So then they bring in design talent. Oftentimes, first stage of building and hiring design talent doesn't necessarily go so well. When it comes to management, the biggest question they get from the C-suite is, when will we see results? When will we see results from this amazing design talent team? You tell me, they're the best of the best, right? But sometimes when we've seen this with mergers and acquisitions, we've seen that this is a big trend, right? When these consulting firms, manager and consulting firms, or holding firms acquire these design teams, there has to be culture match, right? Collectively, that's an issue. But individually, you have to understand the team design talent's different. There's a different kind of an incentive that's required. And I think that when business treats design talent as traditional business talent, they're not necessarily gonna attract them the right way. And when they hire them, they may not bring the same quality of results the right way, and worse, hey. So traditional business talent and traditional design talent, what's the difference for you? Let me just say that the methods of general MBA, the general language of business, those incentives don't work. We have corporations that will come to us and say, we want the best of the best. And this is a line that a lot of companies will, that has been used quite a lot. But corporations say, this is an opportunity of a lifetime. You will be able to take this product category and transform it, and creatives know this line, right? Then they'll talk about how, well, people have been with our company 30 years now, right? And as creatives, creatives go, okay, that's great. That's not what I'm looking for. I'm looking for rapid growth and rapid progression. I want to keep evolving. I want to keep bringing impact, right? The incentives that traditional business offers design isn't always the right thing that will be attractive to a creative. It's like someone, one of our creative leads once said to us, it's like they're trying to feed beef to a unicorn. So have you seen some companies that are doing it right, that are hiring design talent in the right way? The exceptions, who are the exceptions and what are they doing? We all know the corporations that have been investing in design for years, right? The PNGs, the PepsiCo, the IBMs, the Uber's, the Amazons. But, and here's another thing though, for those companies, they have spent millions of dollars understanding this space, understanding the talent in this space. And here's another pattern that we've seen is most people, almost everyone we talk to, if they're in a certain sector, they will talk about that one to top three companies within their category. But what they don't realize is there are so many corporations that need design leadership, that need service design, they need your optics, right? They need your help, but yet so many of them don't even know the terminology to find talent, to find this talent, right? So in the examples of the IBMs, the capital ones, those become pretty boring pretty soon, right? And are you seeing like, is there a shift going on in how companies, I hope so, how companies are approaching to building and cultivating design teams? Well, there's a mass trend going on now where businesses are investing in design, right? So you're seeing so many corporations everywhere, building an innovation lab, hiring creatives, as many, right, as possible. But we hear different kinds of stories from people where the title, the job description, the interview process is amazing. And then when they get in, they realize I've, there was one company, for instance, how many corporations now say that they're a startup more than 10 years in and they're multiple rounds of funding and tens of thousands of people on their company now, right? And they're still a startup. And I remember one candidate where he got in and he said, this is the job of a lifetime. Everyone in all of my colleagues are envious, right? And he goes in less than three months in, he's building his team, he's bringing great results. Even at that earlier stage, I mean, you can't be launching everything, but immediately speaking to the founders and the founders are like, great, you've done a great job. Now just do what they did, you know? So you really have to listen to see how much the company is looking to invest in your capability. Right, and that's like the question, I think that is super relevant, to understand how many designers have you had before? What is your design heritage? Where is it? What's more, right, exactly. How much do they really understand what it takes for design to impact, right? Because they're all trying to, can we get this done in quarter two, you know, in so many months, right? What's the quality of the results that they're ready to invest in? And I think let's talk about investment. Like what are they truly going to, not just hiring a person, but let's say if someone's interviewing, don't just to say, you know, talk about what your compensation is, but really understand what will it take for them to truly invest in something that results their quality, right? And yeah, and it's like you said, there are many companies who are still not in the, you are still at the early maturity stage of this. So we can't expect all to get into companies that fully impressed design, but at least we should be asking questions that allow us to make a better judgment in what we're getting ourselves into, right? And it's not about maturity, of how long they've been doing it. It's more of the willingness. No matter what stage companies they're at, they all need- How committed are they? We're change agents, right? This space that we're in, we're change agents, we're pioneers. So you're gonna be dealing with companies that are at different stages of awareness of design, regardless of how much they've been investing in the design throughout the company's history, it's how much are they willing to go the distance for quality results, right? Awesome advice, Angela. I always give my guests the opportunity to ask us a question. The viewers, the listeners of the show, is there anything that you'd like us to, what is the English word chew up on? Think about- Do I ask it a viewer of the audience? Yeah, the audience. So the people, what is it that we can think about? I would ask people to look around you and look in your daily life, right? Not just at what's popular, but to look everywhere and tell me where you think you see the need for service design. Where is the most uncommon place, right? And sometimes maybe the most challenging spaces. Let's look for that. Because I think this industry has such an incredible ability, we've such an incredible capability with this type of optics. There's so many problems to be solved rather than just go for what's popular, look around for the more uncommon problems to be solved. That could be a pretty long list, but I challenge everyone now watching and listening to this to actually contribute. Angela, thanks so much for sharing your perspective on this. I learned a lot and I think we can learn a lot more. I'll include all the links to your profiles, your programs, your company down below in the show notes if people want to learn more. Thanks for making the time and sharing this with us. Thank you so much for having me, Mark. So what is your take on Angela's question? Where do we actually need service design? Leave a comment down below and I'm expecting a lot of comments this time. If you enjoyed this episode, click that like button and don't forget to share it with somebody who might enjoy it as well. If you're looking for more, don't forget to check out this video because there's even more awesome content to be found. Thanks for watching and I'll see you in this next video.


Hello America, my name is Frida Karan, I'm a military chef. Today I would like to welcome you to my home. So I don't normally just cook at work, I cook at home for my friends and family and also my boyfriend. Wait, much better, let's get to work. So today we're going to make lamb, which is one of my favorite meats actually because just because it brings memories from back home.


So let me now introduce the speakers. No, I will not introduce all the speakers. I will introduce speakers one by one, if I may. So Serge Equay is the president of the West African Development Bank. He's been in the private sector also, and you have both, I would say, the vision of the private sector, the vision of the public sector, and of course, the standpoint of a very important development bank. You have the floor. Thank you, Mr. President. Thank you for having me. I won't be too long. I would just like to highlight four major key policy objectives we face in Africa in general, I would say, and more specifically now into our region, the Sub-Saharan Africa. The first one, it's addressing the food insecurity. I think it's a major threat we have to deal with in a context where we are in a region where the median age of our population is 20 years, and we all know that our population doubles every 25 years. So that's a real threat in the context. You know you have previously described. The second key policy objective is related to the way we should manage the shift in monetary policy. The new area in which we are, and I have to say that when we last met last year, I was among those who was believing that the inflation would be temporary, a temporary stage, and I have to say that today, when we look at things in details, it appears that we're moving into a new area. I would even say back into the 70s, where I don't know if you, I'm sure you do. I'm sure you do where you remember where Mexico was funding, was getting access to capital markets in the late 90s at 18%, 10 years maturity. And that was not coming to anyone as a surprise. But today, getting funding at 18% is a real, real, real challenge. So the shift into monetary policy with this idea, this reality of the majority, not to say the whole, our country's sovereign would no longer have access to capital markets, that's gonna be a real threat. That's gonna be a real issue. The third one is the way we would consolidate public finances and meet tighter financial conditions, definitely. And the last, surely not the least, is the way we would be setting up the stage of sustainable and greener growth. We have last year, at Beowaday, launched a sustainable bonds with 750 million Euro, six times over-subscribed. And back then, my credo was cash being king, cash being king, we would have to do whatever to get as much funding as we could. So my very last point is, I think to tackle these issues, we need to see how to strengthen the chair one capital of our institution. Answering to this very question, the one and only question that matters, that is, who bears with the first losses? Who bears with the first piece of losses? So Mr. President, this is in a nutshell what I wanted to say, and I could elaborate down the road. Thank you very much. Thank you very, very much indeed, Serge. It is very clear, very concise, and of course, we understand very dramatic. You mentioned 18%? Yeah, back in the days, yeah. Mexico, yeah. Yeah, I mean, of course, I have the memory of Paul Volcker regaining control of inflation, inflation in the US at 14% or something. And then, of course, a dramatic recession and a dramatic financial crisis in the emerging world, Latin America first and then practically all the emerging world, you're absolutely right. I take it that we are not in the same situation because the central banks are not nonchalant. If I may, they are not letting things go. They have decided with some lags, as I said, but to re-take, regain control of the situation. But thank you very much for this very, very impressive and quite dramatic picture.