Hello everyone. Today we will talk about CERT Mitem, which is my tool, and what it does is automatic exploitation of TLS certificate validation vulnerabilities. We will first learn a little bit about all of these words, what they mean separately, and then we will put them together. We will start with me. I'm Aapo. I come from this Nordic cybersecurity company called Nixu, where I work as a senior security specialist and I focus on IoT. I do quite a lot of work with cryptography and network protocols and sometimes some people put them together to make this TLS thing. I also do security research bug bounty during the nights and weekends and kind of before you go to conferences you start the morning with some bug bounty. I go by Aapo, so please invite me everywhere, shameless bug plug. And I also coach this Finnish-European cybersecurity challenge team from Finland. So good luck to us in Norway in the couple of months. But let's dive directly into TLS. So when you use computers, there's something that you want. So you have your computers. There is some kind of server somewhere. It has something that you want. And to get it, you need to go through the internet. So this internet is a big mess of computers trying to get you what you want. And of course it's made up of different computers in different countries run by different people. And of course there are bad guys. And these bad guys might also want what you want. So they may be able to intercept your connections and listen in. And for this, we have this thing called TLS. So transport layer security. So it secures the connection between you and what you want. TLS basically it's encryption and authentication. The encryption part is basically a bunch of math, kind of cryptography. So people call it like military grade stuff that it's kind of bulletproof encryption. We're not going to be talking about that. So the other part is authentication. So TLS utilizes certificate based authentication. And that's really important because even if you have the best encryption, if you connect to the bad guy, it doesn't matter how well you encrypt the connection between you and the bad guy, they will be able to see kind of the connection. So that's why you really need to authenticate the server first before you make the encrypted connection. And these certificates, you might have kind of heard about them, might have used them. They are these kind of files that have some information and a signature. So this is basically exactly the same as your passport or kind of physical ID. So it has some information about you. It has some kind of signature that, hey, this is a valid certificate for you. In the computer world, the certificates are basically fancy text files that have information listed inside of them. So information like issued by, issued to, public key, some miscellaneous information and a signature. But I think a good take out of this presentation is that these kind of, they are only kind of information inside a text file, nothing special. This information could for example be that you have a certificate that it issued by someone and it issued to someone. It may contain like a public key. This is for the encryption part. Also some information, hey, this is an APO certificate. And of course there is this kind of signature to kind of validate all this data. And how do you make these signatures? You also have your private key. So with your private key, you can calculate the signature and kind of have this mathematical proof of ownership of the public key. So in a sense, you have a certificate and you have a key and this key allows you to use your certificate. And what to use certificates for? Well, you can use these certificates to issue another certificate. So I have my APO certificate and I want to issue a certificate for a server. So I just create this text file, server.pem, issued by APO to a server. It has its own key but I need to sign it with my key. So that's why it issued by me because I have signed it. So this is quite brief introduction to certificates but we can use these certificates now to do this TLS authentication. So server has a certificate that is issued by APO. So we can use the APO certificate to verify the authenticity. We don't need the APO's key, we only need the certificate to kind of validate stuff. But the server needs to have its own key so it can kind of prove that it is kind of allowed to use the server certificate. But yeah, the main thing here and the kind of main point of my talk is that you need to authenticate the server to be kind of, to be sure that you're connecting to the correct thing. So for that we need certificate validation. And of course there have been security problems in certificate validation in TLS quite a lot over the kind of past 15, 20 years. And I think most notably in like 2009, 2012, between those that time there were quite a lot of kind of things. So Moxi had good talks here at Defcon and created these tools to kind of attack certificate validation. The problems are in the libraries and how you use them. And the libraries currently they kind of, they have got some work. So you can use the libraries securely nowadays. The problem is that the implementation part is still hard. It's super hard to use this and we will talk more about those. And 2012 there was also this paper titled The Most Dangerous Code in the World, Validating SSL Certificates in Non-Browser Software. And kind of not much have changed since then. Nowadays we call it TLS, but still it's the same thing and the problems are the same. And we will talk a little bit more about this publication in the end. But I want to give you some overview on what these kind of problems have been. So I think the biggest problem with TLS certificate authentication is kind of, you can see it from this slide. If you don't spot it we can zoom a little bit and enhance. So you might be able to see it. Like what does it mean that you can check the authenticity of the server? So turns out certificate validation in TLS is completely optional and you don't have to do it. So to ensure that you really are connected to the correct server you have to validate the server certificate if you want to. Like usually it's enabled by default, but it can be turned off.  And if you go to Stack Overflow and kind of search for how to fix certificate validation issues they tell you, hey, just turn it off.  And the certificate validation is really hard to configure. So many libraries they allow for kind of secure certificate validation but they might not have secure defaults. So kind of practical certificate validation. It boils down to kind of three things. Like if it's enabled at all, then there's three things left to do. So we need to check the signature. Like it's just a text file. You can make it up. And if you don't check the signature, like anyone can create any kind of certificate. Next thing, who has issued the certificate? So you really need to check this because I just created myapo.pem. I can issue certificates with that. But you kind of shouldn't trust it. I just created it. And also, who is the certificate issued to? So if I issue a certificate to my server, like it's issued to my server, it's not issued to Google's or Apple's or whoever's servers. It's only for mine. But of course, it's just a text file. I can kind of present, hey, this is my certificate. And if you don't check it, it might go through. So kind of has the certificate been signed? So has the math part been done? And this is usually checked by the TLS libraries. So there should not be kind of problems with this. And like who has issued the certificate? So there are these things called global certificate authorities. So basically a bunch of companies who have their own posertificates just kind of shipped out to all the operating systems and they are there kind of by default in the operating systems and then they can charge money to issue certificates for you. So of course these kind of nice players like Let's Encrypt, who they have done that, they have kind of paid for it. They have the infrastructure, but they will be giving out these certificates for free.  And this is something that kind of nowadays, kind of every server has a certificate. And it's kind of, there's a big thanks goes to Let's Encrypt for that. Of course I could just use my aapo.pem. That's valid certificate, it's self-signed because it has issued itself. So kind of you need to check. You can't just offer a self-signed certificate and it shouldn't be trusted. It could be if you trust only that, but you shouldn't be able to create a self-signed certificate on the fly and have someone accept it. And of course is the issue even allowed to issue certificates? So if I get a certificate from Let's Encrypt, like it says that I can't create any more certificates, because of course you shouldn't trust me. But it's still, it's a fancy text file. I can just kind of create, I can calculate the signatures. I have the private key for my Let's Encrypt certificate and I can create more certificates with it. It's not allowed, but if you don't check it, it goes through. Like who is the certificate issued to? I talk about this Let's Encrypt certificate, so I have a certificate issued to me, to my server. And if you are connecting to my server, you should trust my certificate. But if you are connecting to somewhere else, you shouldn't trust mine. But this is one of the biggest things I've come up with that libraries like OpenSSL and WolfSSL, they don't check who the certificate is issued to. You have to go into the settings and kind of enable it. So the default context of OpenSSL, it doesn't have the hostname validation enabled. So if you use OpenSSL, like you might want to check that, have you remembered to kind of enable the hostname validation. And don't let get me started with custom certificate validators. So these are kind of really fun, really scary, but really fun, because you can see kind of quite a lot of different things when you kind of read the source code of someone's certificate validator. So we can take a look at this code, and like if there's some really kind of .NET developers who do certificate validation all day, you might spot them. But let me highlight some problems here. So this is like 15 lines of code that actually do the validation. And on this line, we are checking the elements of the chain, so we are checking the kind of certificate chain. So we only take the last element, so we take the kind of CA, and we only look at that, so we don't even look at the certificate. We don't look at the server certificate, we only look at the CA of the certificate. So for that, it doesn't check who the certificate is issued to. It only checks that it's issued by this certain thing. Of course it doesn't check the signature, so you don't even need to kind of have a certificate from that CA. So you can just make it up because it doesn't check the signature. And like if this is kind of hard for you and might not kind of know how to do this, they made it even easier. So in the end, if all the checks fail, there is this return true. So any certificate file whatsoever doesn't need to be signed, doesn't like any certificate will be accepted by this certificate validator. If you scroll up a bit on the code, we will see where this is from. So this is from this product, Microsoft Management Services, Intune Windows Agent. So if you don't know what it does, it runs every hour and it checks the internet from Microsoft servers that is there a script for it to run with system privileges. And if I intercept the connection, I give my certificate, it trusts me that I'm Microsoft. So of course I have scripts for you that you should run as system. And with that, there is this remote code execution vulnerability. But yeah, we've talked about the vulnerabilities, the issues, everything. We've seen this code. We kind of now have an idea on what to do. But how to actually do it? How do we attack against certificate validation? So we had these problems, like the certificate validator needs to check these three things. So who has issued the certificate? So if you want to attack that, we can just kind of self-sign some certificates. If it doesn't check for it, it will go through. We can also take our kind of let's encrypt certificate and we can sign new certificates. If it doesn't check, is the certificate actually allowed to create new certificates, then that might go through. Also, if it doesn't check who the certificate is issued to, we can get the certificate from a proper CEA, like let's encrypt, for our website and we can try to offer it to the kind of client application connecting to us. And the signature, if it doesn't check, has the certificate been signed? We can just change, kind of get the original certificate. We can put our public key there and then we will have the key to the certificate. Like it shouldn't work because the signature is invalid. But if you don't check the signature, then it will be a valid certificate. So, there's me, there's what I want and the TLS connection right there. So, if someone goes between the connection, generates some self-sign certificates, gets some let's encrypt certificates, does all of this, and does the man in the middle? That's it, that's easy. And this thing, this was taught about 14 years ago. So, there's nothing new in anything that I've shown you here now. So, why am I talking here to you? So, when I was a kid, I looked at those kind of moxies presentations and when I got into penetration testing, of course, I wanted to try these things out. But when you are attacking kind of a phone or a laptop, it's not this. This is the kind of easy thing, but actually it looks like this.  Like on a phone, you might have hundreds of different TLS connections. And when you have hundreds of applications with hundreds of TLS connections, you have so many certificate validators to test. So, how do we actually test kind of all these certificate validators? It might take like 30 minutes to kind of test one connection, and if we have 100 connections and you're paid by the hour, like it will take too long. So, we need automation. So, we want to automate attacking these certificate validators. So, each connection might have a different certificate validator. Like, one of those connections is from Intune and it has this funky validator. So, we need to kind of differentiate between the connections. So, because we need to kind of offer many certificates, we need to know which connection is what. And for that, there is some information available, like completely black box.  You have this team called SNI, so server name identifier. So, that is something that you can kind of see from the connection. So, you see that there is a client connecting to a server and it asking that, hey, I want to connect to this host name. So, from that, we kind of know that, hey, this is like, this is a connection. And if we see that connection, that type of connection, we can kind of think that, hey, this might be done by a single certificate validator. And kind of every time, it will be kind of the same application and maybe the same validator. So, we want to kind of attack this. So, I created this tool called cert metem. And it does exactly that. So, we have a client. It wants to connect to this auth example. And when it first connects, we will kind of intercept the connection and stop it there, kind of freeze the time and start to do some things. So, first, we will fetch the certificate from the auth example. We will generate all the certificates, do all the kind of test cases that we talk about and then we will start to test these certificates.  And then it fails the connection, it terminates the connection and then it most likely tries again. So, you might need to click retry or something or wait a bit. But at some point, it will make a connection to auth example again. And then, we will offer the certificate where we have replaced the key. It fails, we will offer a real certificate, our Let's Encrypt certificate, for example. It fails, we will try to use our Let's Encrypt certificate as a CA, and it fails. So, we need to just let the connection go. So, it connects to the auth example. And the auth example, kind of, they talk in TLS, so we have no idea what's going on. Of course, if the kind of server is called auth and it's the first connection from the application, it might be doing some kind of authentication. And usually, kind of authentication libraries are secure. Like, they have done their stuff. But next, like, if you let it connect to the auth example and do the authentication, like, in couple of seconds, you will see a call to API example. And we will do the same. So, we will fetch the API example certificate, we will generate the certificate, so we will kind of try to clone it as close as possible with kind of different attacks we talked about. And then, we will start to test this. So, we give it the self-sign. It fails, we give the replaced key. It fails, we give our let's encrypt certificate. And what is this? We see a connection kind of go through. So, it will try to connect to us. And we, of course, accept the connection and it will send to us this payment post-request. And there's the authorization token. So, even though we didn't kind of intercept the authentication, we now have the token to authenticate as the client. And, of course, there's some kind of business critical data in the post-request. To be really thorough, we close the connection and for the next connection, we give this real service CA test. And it fails. But now we know that there is one test for this particular connection from this particular client that we can use to intercept it. So, now comes the man in the middle part. So, we connect to API example from cert metem. And for the next API example connection, we will give the real certificate. So, the let's encrypt certificate. So, kind of not there. It's not real. But yeah, so let's decrypt. And we will get the same post-request. It tries to resend it. And now we kind of give the kind of push the connection through. So, we send the data to API example. And it kind of, it can then give some something back. And the next connection, like it connects to API example. It wants a software update. And we can see the software update coming from the API example to the client. And because we control this flow, we can see everything. So, of course, we can change this. So, for Intune, this would be the case where you kind of, it tries to get the script. And then the server is like, hey, there's no scripts for you. But we can modify it to always say that, of course, we have a script for you. Cert metem doesn't do that. It's only for figuring out where these vulnerabilities are. And then you can use these certificates generated by Cert metem to actually do the attacking. But yeah. So, I have demo of this tool. So, let's see. So, let's go here and start. So, on the left there is a terminal. So, I have set up some redirections. And if anyone wants to connect through my computer to the internet using these TLS ports, these will be kind of redirected to a port on my computer. So, 9900. And there I will have Cert metem running. So, we have a Windows machine connecting to the internet through my machine. And we are redirecting the TLS connections to Cert metem. And here we can see the connections and see the tests. So, there are multiple connections trying to kind of connect to the internet. We are giving certificates and then in the end you can see what happened. So, nothing received. So, we didn't receive any data. So, that's supposed to happen. Like, if we give a bad certificate, we're not supposed to get anything. So, we either get nothing received or we get some error. But there is this kind of red error message here. It says that this go.microsoft.com connection and we use the real certificate. So, we have, if we give a less encrypted certificate to Windows, it will kind of connect to us. And there is this two connections related to each other. And we can go see the logs. So, here we have the kind of all the traffic logs, what certificates kind of worked for what host names. And here we can see the actual data that was downloaded by Windows. So, this is a configuration file to configure where Windows sends the login credentials when you login. So, this is nice thing to kind of intercept, because here we can change all of these. Like, every kind of URL definition we can change to something where we have the certificate for. And now, Windows trusts us. And that was kind of a vulnerability that I found with this tool. And, well, quite critical one. Next, we have more Windows. So, now we've kind of logged into Windows. We will kind of modify the parameters a little bit of shared with them. So, we will run every test twice. So, sometimes these kind of applications are a little picky and they kind of don't. The first connection doesn't go through and you need to run the test twice. But here, we are setting up a work or school account. So, we are connecting our laptop to our organization. If you are running this GUI applications we might need to kind of retry. It doesn't automatically retry stuff. So, we need to just click on retry. And here we get a connection again for our Let's Encrypt certificate. And it asks us, where should I go if I want to kind of connect to the organization. So, I can now intercept the connection from here and I can set kind of take control of your machine by kind of forcing it to connect to my organization. So, this was another vulnerability found with shared with them. And now, after hard days of work I want to play some games.  But I don't want to play by myself so I want to go online. And what best way to go online then through shared with them. So, we can see here it's making different connections to the internet through shared with them and we're trying to intercept the connections. And while this application is a little picky it's kind of, it has a connection it really wants to get through and then after that kind of when we have run our tests we will let the connection through and then there's another one it really wants to get through. So, we need to kind of do this multiple times. But this is only for the kind of figuring out if there is a vulnerability phase. So, when you are actually exploiting this and you know what connections can be intercepted then you don't need to kind of retry anything. You can just, for the certain connections you can just offer the certain certificate and be done with it. But I think now we are starting to kind of go past these first phases of the kind of going online and those parts of the application had a certificate validator that works. But when we get kind of through the first five connections we start to see connections with really bad certificate validators. So, all the red are connections made by this game that are vulnerable for this. And when all the test cases have been kind of gone through we will start to see the actual data go through our machine to the internet and we will see everything here. So, here we are intercepting connections from a PS5 game. And, again, a vulnerability found by CertMittim. So, let's see. So, we are getting these connections. Here's the log from CertMittim and I think we're changing up. We're booting up an iPhone. I have to kind of take the HDMIs out and plug them in now. But yeah, we have an iPhone here. So, let's make it a little bit bigger and connect to the internet with Wi-Fi. So, soon we should start to see connections made by an iPhone. And, of course, good part about CertMittim that it's multi-threading. So, you can do all of these tests kind of at the same time. So, have a PS5 controller on one hand, iPhone on another and just go nuts. You, of course, need to, again, retry the connections a couple of times until you get inside the application. This is a lot faster. It has kind of better error handling. And here, we start to download LinkedIn. So, we, again, need to just click a couple of times, see what connections are made and just see that no test kind of goes through. But, again, there are so many certificate validators, so we just need to find the insecure ones. And here, when iPhone downloads apps, all the tests fail or kind of go through. And here, we can see an iPhone application being downloaded, or we can see the plaintext data of that. And we can see here LinkedIn application downloaded from an iPhone. And, again, vulnerability found by CertMittim. And, yeah, this kind of keeps on going. The list is quite big. Here's MatterMost, giving us the MatterMost authentication token that we can use to take control of the victim's MatterMost. So, here, again, vulnerability found with CertMittim. And I just want to highlight kind of, I have quite a lot of these here, just for you to see that this kind of, it's quite easy to find this. Of course, it's staged in that way, that I know that these applications are vulnerable, but we've just tested, in less than ten minutes, we have tested, like, five or six different applications. And here, we are playing a mobile game, and we are getting quite a lot of kind of certificate validation vulnerabilities. And, kind of, sometimes these applications, kind of, they don't show the errors, but they still don't go kind of further. So, we might need to, kind of, kill the application, restart the application. Sometimes applications, like, crash when you do this test, because, kind of, at no point in the development, kind of, the fourth TLS connection failed. Like, usually, like, if you are connected to the internet, you, kind of, everything goes through, or nothing goes through. But here, we will, we can see, kind of, some update files, some definitions, whatever, downloaded by the game. And here, we can see, kind of, the, now all the tests have been, kind of, done. We can see, kind of, many in the middle here. And one good thing about the cert metum is that you can actually, kind of, use these applications quite well.  And you can, kind of, download applications. You can just keep this on. So, at my home, I just, kind of, have everything connected to cert metum all the time. And then, kind of, sometimes, I just, kind of, look at the screen and see some red things there. So, then I just have to, kind of, report the vulnerabilities. So, yeah. So, this is basically how you use cert metum. And after you found these vulnerabilities, you can, kind of, go check the logs. So, what this, kind of, writes. We can see the actual, kind of, intercepted connections. Here, we can see the, kind of, certificates that were, kind of, used to intercept these connections. So, you can just take these certificates and, kind of, kind of, now it's the good part to, kind of, make your report to, like, if you are a pentester, then you just say that, hey, these connections from this application have these vulnerabilities. And this is just a log that shows, kind of, when a connection was made by who and to what and what the test case was. And let's take a closer look at the actual output of cert metum. So, here, we can see that there are connections that we couldn't intercept, connections that we could intercept. And, yeah, and it shows here, kind of, what kind of data it can intercept. Yeah, so this was the demo part. And here are some CVEs, kind of, all of these were found by cert metum. And there are lots of, lots more coming. I found approximately 80 vulnerable applications on different operating systems like Android, iOS, Windows, Mac, game consoles, IoT. There are some things that I do this, of course, professionally, and through bug bounty. So there's lots of things that I can't show you or talk about. But there are some funky things that I found with cert metum. There's approximately 40, zero days currently that I know about that can be found with this tool. So if you go, kind of, connect your phone to cert metum, I guarantee you, kind of, from this audience, there will be, kind of, vulnerabilities found. So maybe the airplane mode goes on now. Mostly these zero days are from, kind of, not so big applications, some games, kind of, not that kind of important stuff. But I think the biggest thing about cert metum is the scale on how many vulnerabilities, kind of, are found with this. And some fixes rolling out in the coming weeks. I've had so many emails yesterday and this, kind of, today morning from the bigger players that, hey, we have fixed this, can you test? So I think, kind of, telling them that you are going to DEF CON to talk about the tool really helps motivate developers to create some fixes. And yeah, more vulnerabilities found every week. I found one this morning. But yeah, so what can you do about this? So if you are a developer developing applications using TLS, so pretty much any developer of any application, you really should read the documentation of the libraries that you are using. For example, Python's SSL documentation has this, kind of, big red box right on the top that says, hey, please don't do these things. And you might want to check that are you, kind of, doing those things. And no custom certificate validators. If I ever see a customer with custom certificate validators, they will, kind of, hear from it. And the reason is that the built-in validators, they support everything you need. Like, I've never seen a real use case that wasn't supported by the actual validators built in to that, kind of, like, languages or whatever. And there most likely is a reason that if it's not supported, like, there's kind of reason why it's not supported. Like, you shouldn't do that. There's most likely a vulnerability in there. One big thing is checking the host name of the certificate. If you use OpenSSL, WolfSSL, you really need to check the host name. You, kind of, you just need to enable that check. And you need to do it every time you initialize and, kind of, SSL context. So if you have, kind of, used OpenSSL, you have done some TLS connections, kind of, have you enabled host name validation? Maybe not. At least the windows didn't. There are some, kind of, you can create some unit test for this. So there is this website called BadSSL that there are these, kind of, similar certificates hosted online, so you can just, kind of, make your application connected there. And if it's, like, if your application accepts a BadSSL certificate, then, kind of, the test should fail. And, of course, setting up CertMitim in your, kind of, workplace, run everything through it, see if it finds something and then fix it. Otherwise you might be getting a lot of bug bounty reports soon. And bug bounty hunters, pen testers. So for you, just run CertMitim against everything. It's really easy to use. I have my, kind of, dedicated laptop for it. It always is, kind of, hosting. It has Ethernet connectivity, it has Wi-Fi. So I just need to connect something to it and it will show me in couple of minutes, is it vulnerable or not.  So yes, you can run it against everything. It's quite reliable. Nothing has, kind of, broken horribly. Sometimes the applications crash and the thing reboots, but it only does it a couple of times and then the tests go through. You will definitely find vulnerabilities. And the profit part is this little bit of yes and no. So let's first talk about the yes.  So if you, kind of, hack something really important, you will get a lot of money. And this is, kind of, so these are everything found by Certmitum, me reporting them, and this is the reply. The no part is that this, kind of, managed middle attacks are, kind of, kind of people don't like them. For some reason, kind of, some vendors are not worried about connecting to insecure Wi-Fi. Same with this. I tried to, kind of, not include the word man in the middle. I just said, hey, we need to do DNS, kind of, attacks to, kind of, get this. And still the answer is, like, if you need to do some, kind of, DNS attacks, then this is out of scope. But how many people here, kind of, trust their DNS? Like, it's, kind of, universally, kind of, not that well. But in some countries, you might not really get that good DNS replies. And this was, kind of, a really funny one. So this is not a vulnerability, because TLS best practices are out of scope. So, well, yeah, this might not be, kind of, when they say that TLS best practices are out of scope, they might not mean this. And then some vendors don't really have any idea what's going on. So this one is saying that the issue is in, kind of, the cloud provider, so AWS or whatever. Kind of, they are the TLS server. Like, it's not our code. And I'm checking their client application. So it is their code layer. And the problem is that when the, kind of, bug bounty programs, kind of, if they want to give you negative points, they can. And if you go see my hacker one reputation, it's not that good. So I have quite many, kind of, not applicables or out of scopes and these kind of things. So I just try to do the good thing and report it. But yeah, sometimes I get peace. So I think my main thing is for the platforms themselves. So many of the middle and TLS are out of scope in most programs. So there is this kind of default thing that says that TLS and middle attacks are out of scope. But they are mostly written for web application targets in mind. So if you have a server, kind of, man in the middle is not that critical because you, kind of, don't control the client. So it's a user's responsibility to have a client that connects securely. And also, like, TLS servers, they don't do the authentication part usually. So they only do the encryption and the encryption is quite good. So that's why problems in TLS are usually not problems and that's why they are out of scope. But for client applications, these triagers, they refuse to accept these kind of reports from certmitten. And the list of nodes, so there were the four nodes, three of them actually paid me a bounty after, kind of, some back and forth me explaining that, hey, this might not be what you mean by, kind of, TLS best practices. So I propose if you run a, kind of, back bounty program and you have TLS clients, you might want to include that, at least for the clients, insecure certificate validation should be in scope when impact can be demonstrated. So this is just, or then just make this that, hey, this is out of scope. So then I won't, kind of, bother myself to report it. This TLS library developers, so we had in the beginning this, kind of, publication, the most dangerous code in the world. And it was written in 2012 and it has this kind of conclusion was that future research is needed for these three things. So the first one, we need a better black box testing tool to discover errors in TLS connection establishment logic. So this is cert mythum, so 11 years later, we have successfully done the first thing. The second and the third things, however, kind of, still bad. And I'm hoping with the release of cert mythum, these might get more, kind of, we can then move on to the second and the third point. So this is basically just make better libraries. It's really hard to use them. There are so many vulnerabilities because they are super hard to use. So please make them better. And with that, we had cert mythum. You can find it in my GitHub. There's the link. It's up there right now. And go use it and make the world a better place. So you can find me here at Defcon at Nixu, at LinkedIn, at Backbounty. And if you have any questions, I'm available here next to the stage after this. It's done so pretty much now. Thank you.


Hello students, let's work out the following problem. It says the Cartesian equations of a line are 3x plus 1 is equal to 6y minus 2 is equal to 1 minus z. Find the fixed point through which it passes its direction ratios and also its vector equation. So let's now move on to the solution. The equation of lines are given as 3x plus 1 is equal to 6y minus 2 is equal to 1 minus z. Now this can be written as taking 3 common. We have 3 into x plus 1 by 3 is equal to taking 6 common. We have 6 into y minus 2 by 6 is equal to taking 1 common minus 1 common we have z minus 1. Now again, this can be written as x plus 1 by 3 upon 1 by 3 and this can be written as y minus 2 by 6 and 2 by 6 is same as 1 by 3 upon 1 by 6 is equal to z minus 1 upon minus 1. Again, this can be written as x plus 1 by 3 upon 1 by 3 is equal to y minus 1 by 3 upon 1 by 6 is equal to z minus 1 upon minus 1. Now again, this can be written as x plus 1 by 3 upon 2 is equal to y minus 1 by 3 upon 1 is equal to z minus 1 upon minus 6. This is by multiplying all the denominators by 6. We have this. Now the direction ratios ratio of the liner 1 minus 6 and the points through which it passes that is the fixed point through which it passes r minus 1 by 3 1 by 3 and 1. As we know that the Cartesian equation of the line passing through x 1, y 1, z 1 and having direction ratios a, b, c it is x minus x 1 upon a is equal to y minus y 1 upon v is equal to z minus z 1 upon c. So here, this can be written as x minus of minus 1 by 3. So the fixed point through which the line passes minus 1 by 3 1 by 3 1. Now we have to find the vector equation of the line. Now the vector equation of the line passing through the points x 1, y 1, z 1 and direction ratios a, b, c is given by x 1 i cap plus y 1 j cap plus z 1 k cap lambda times a i cap plus b j cap plus c k cap. So here, the direction ratios are 2 1 minus 6 and the fixed point is minus 1 by 3 1 by 3 and 1.  Therefore, the direction ratios are 2 1 minus 6 and the fixed point through which the line passes is minus 1 by 3 1 by 3 and 1 and this is the required vector equation of the line. So this completes the question and the session. Bye for now. Take care. Have a good day.


is going to be a little with Paley family, OK? And we're going to further suppose that there exists constants. Let's see, what am I calling them, c0 and delta. And for each dietic cube, q, a function bq such that the following is true. We have the following three conditions, OK? First condition is that bq is in L2. And the L2, while the square of the L2 norm, is controlled by the measure of q, OK? And you might think, is that a little unnatural? Maybe if we're talking about local things, maybe the bq should be supported near q. In fact, you can actually think of it that way. It's actually equivalent to formulate the theorem that way, right? So you could just as well think of bq as being supported in, let's say, 5 times q. OK, but it's kind of convenient to do it this way. It simplifies the proof slightly. There's just one last step we have to do, OK? Second thing is this sort of weak equitivity condition, which is that the average of q, the average of bq, on its own cube q with absolute values on the outside or taking the modulus, because this could be complex value, is bounded below by delta, OK? All right, and the third thing is that, well, it's sort of like a Carlson condition, except not really because the measure itself is depending on q. What we're going to assume is that if we integrate over the Carlson region associated to q, theta t applied to the testing function for that cube q, that's also going to be less than or equal to c0 times the measure of q, OK? So before we prove it, maybe a couple of remarks are in order, OK? Notice that if bq is the same, it's just one function b, one accredited function b, or it's even pseudo-creditive, for all q, then this is just some theorem. Then this is theorem 4.4, because if this measure here is not depending on q, then this is a Carlson measure estimate, OK? Yes? Oh, thank you. Yeah, I guess I should. OK, we'll come back to the remarks in a second. Thank you. Thank you very much. It's always important to give the conclusion of your theorem. You probably already guessed what the conclusion is. The conclusion is that the theta t gives rise to a bound of square function, OK? So the square of the L2 norm of the square function associated to theta t is bounded by the square of the L2 norm of f, where, of course, c is going to depend on all the usual stuff. C is going to depend on dimension, a little with Paley estimates, the constant c0, the constant delta. I guess that's all the constants that I have, OK? All right, and then one more remark, which is that condition 2 is a sort of weak pseudo-accurativity condition, right? Because if the average of this function over every cube, cube, every dyadic cube, cube had this property, that would be dyadic pseudo-accurativity. But the point is that we're only assuming the securitivity condition for Bq integrated on its own cube, q, not on other cubes, OK? Yes, if Bq is equal to some constant function, not constant function, but to some globally defined function, B for all q, right? That's when you have to do the localization thing. I glossed over that. Yeah, remember I was saying that you could equivalently formulate this with a localization here. Yeah, thank you, you're right. That should be clarified, OK? Modulo localization, you're exactly right, OK?  And since you can localize it, somehow this is weaker than saying that the B is in L infinity, right? You're only insisting on L2, not L infinity, OK? All right, and the last thing is that the last remark is that this is sort of a weak dyadic pseudo-accretivity. We assume non-degeneracy of Bq averaged only over its own cube q and not on other cubes, OK? All right, nonetheless, we're going to find out that there are still many, many cubes on which it is accretive, OK? All right, so how do we prove this? All right, so what we want to do is to use, again, we're going to reduce to the T of 1 theorem for square functions. That was theorem, was that theorem 3.1? Yes, theorem 3.1, OK? In other words, we need to show that the integral 0 to the length of q, the soup on q, I'm being too small here, the soup on q of 1 over the measure of q, integral 0 to the length of q, integral on q, theta T of 1, squared dx dt over T, is less than some uniform constant, all right? We boil us down to that because we have a little wood-Paley kernel for our theta T's, all right? But now, here's where we're going to use that John Nirenberg theorem, or John Nirenberg lemma, OK? So by the Jn lemma that we just proved a moment ago, it's actually enough to show that there exist constants c1 and a double positive. And for each q, dyadic cube, a family consisting of non-overlapping dyadic subcubes of q, such that the complement of the qj's, which is this set that we call the eq, is at least an eta portion of the measure of q. And such that this full Carlson measure estimate that I wrote down is replaced, where instead of integrating over all of the Carlson box rq, we only integrate over eq star, OK? So that's what we need to show, right? And then if we can do that, then we invoke the John Nirenberg. And this turns into that, and we're done, OK? All right, so what are we going to do? OK, so we're going to do this by a stopping time argument. OK, so the first thing we're going to do just for convenience, ah, I've erased things now. But notice that by rescaling or by normalizing bq, we can assume, in fact, that the average on q of bq is precisely 1, right? You just divide bq by its average on q, OK? And the price you pay is that then the constant c0 becomes c0 over delta squared, if you think how the normalization would go then. Then the constant c0 goes to c0 over delta squared. But for simplicity of notation, we'll just again call this, call it c0, OK? But remember, for now on, when you see a c0, it's really c0 over delta squared, OK? All right, so we're starting off with this. And we're going to subdivide q, diatically, and we stop the first time we get a qq. We get average on q prime or q prime sub-cube of q, where the real part of the average of bq is less than or equal to 1 half. That's when we stop, OK? All right, and we let the family f then simply be the maximal cubes that we get with respect to this property, right? The cubes that are maximal with respect to that property, the cubes that were we stopped the first time, OK? Our cubes that are maximal are the dietic sub-cubes of q that are maximal with respect to the property that, let's call it dagger, that the real part of the average on qj of bq is less than or equal to 1 half, OK? All right? And now we just need to show that these guys are the qj's which let us do these things, OK? So first of all, well, maybe let me see it this way. So the claim then is that for this family f, we have the following two things. That a, eq, which of course, again, is the complement of the qj's, is at least such that eq is bigger than or equal to a that times the measure of q, OK? OK, and b, such that for x and t in the associated eq star, remember which is rq minus the union of the rqj's, we have that the real part of the dyadic averaging operator of bq at x for that x and t is going to be bigger than or equal to 1 half, all right? OK, so let's see what that is, OK? Of course, a is just a restatement of this, all right? And b is what's going to allow us to prove that, OK? So remember we've normalized so that the average of bq and q is exactly 1. So we have measure of q equals integral on q of bq, which is going to be then we're splitting that into the integral on eq plus the sum of the integrals on the stopping time cubes, qj, all right? And notice, OK, since this average was equal to 1, which is a real number, we can take real parts and that doesn't change anything. So we can actually take the real part here and the real part here, OK? All right, and then here we use Cauchy-Schwarz. This is going to be less than or equal to square to the measure of bq times the L2 norm of bq. And this is going to be what? Well, remember what was the stopping time criterion? The real part of the integral on qj is bounded by 1 half times the measure of qj. So this is less than or equal to 1 half times the sum of the measures that qj is. But these are non-overlapping dyadic subcubes of q. You sum them up. At worst, it's q. It's actually less than q. But at worst, this gives you the measure of q with a half, OK? And this, if you remember, we had an estimate for the square of the L2 norm of bq. So when you take the L2 norm, you get that. And this, of course, is trivially less than or equal to 1 half times the measure of q. And of course, you hide that bit, OK? So you hide that bit. And we have now 1 half measure of q on the left-hand side. And then you divide through by this. And you get 1 half, measure of q to the 1 half is less than or equal to square root of c0, measure of vq to the 1 half, square both sides. And you get we obtain a with a to being what? 1 over 4 c0, right? OK, so what about b? Well, b is essentially automatic just by definition, OK? So remember what is the, recall what is the definition of the dyadic averaging operator. This is the average over the unique half open cube q of xt, where q of xt is containing x and has side length at least t. So that it's a minimal one with side length at least t. So that length of q of x over t over 2 is less than t is less than or equal to the length of q of xt. Sorry, that got kind of cramped, but all right? And if you think about that, what that means is that consequently, then by construction, if xt is in eq star, then the q of xt that we get is not contained in any qj. You can see that by just a little momentary reflection on the geometry of the situation. And what does that do for us? Well, remember, these guys were the maximal cubes with respect to this property. So if you've got a cube q of xt that's not contained in any of these guys, then that's a cube where in the stomping time construction you have not stopped yet. And so the opposite inequality to this holds, OK? So hence, have the opposite inequality to this thing we call dagger. And therefore, what do we have? We have that delta, not delta, a half. A half is going to be less than or equal to the real part of at bq of x for all xt in eq star, OK? All right, and that proves b, OK? All right, so the last thing we need to do, remember a, which we've already proved, gives the ampleness of the complement of qj's. And the last thing we need to do is somehow use this to get the control of theta t of 1 in the sawtooth, OK? So consequently, for x and t in eq star, we have that theta t of 1 of x will be less than or equal to twice theta t of 1 of x times at bq of x, OK? All right, which means that therefore, when we integrate on eq star theta t of 1 squared dx dt over t, this will be less than or equal to 4 times the same integral. And at that point, we're going to go ahead and integrate over all of our q, because this guy's work is done once we've got this inequality. And we have theta t of 1 times at bq squared dx dt over t, OK? And now we use a trick that we've used a number of times at this point, this little trick of quite from my error, OK? What we're going to do is write theta t of 1 times at of b. We're going to write it as itself minus theta t plus theta t, OK? It's the familiar thing that we've been doing. So this will be theta t of 1 of x times at minus theta t applied to bq. Oh, I guess I need more parentheses. And then applied to n, and then evaluated at x. And then we have plus theta t bq of x. And then what happens? Well, then we have to look at the contribution of each of these guys in here, all right? And the contribution of this guy is OK by hypothesis. That was hypothesis 3. It said precisely that theta t of bq integrated over rq with respect to this measure gives you the bound that you want, OK? And the other part, we're going to call this rt of bq. Of course, there's the usual thing that by construction, since at are averaging operators, this at of 1 is 1, we therefore have rt of 1 is 0, OK? And then that last guy we handle in the usual way. We handle rt in the usual way. So therefore, it's enough to show that we have quasi-arthogonality up to some constant, that there's some positive alpha. Oh, maybe I shouldn't use alpha, because alpha's the little bit exponent for some beta positive. Right, because once we have this, if that tells you that gives you bounded square functions, you pick up the l2 norm of bq, but then you use, you get a bound in terms of, so you get, and then in that case, you get a bound on the order of the square of the l2 norm of bq. But remember, by hypothesis 1, that's controlled by the thing that you want, and then you're done. All right, so this part, I'll leave as a bit of an exercise. It's, you don't quite have, because of this at, it doesn't quite have the smoothness, the standard little wood-paley smoothness, but it does satisfy this weak sort of l1 condition that you work with in exercise 2. And then you get this, and then you're done, OK? So that's it. Thank you for your attention. Any questions? Any questions? All right, well, thanks for all your attention. Have a good rest of your time here.


I just want to discuss one of the things that you're talking about is let's say as a designer, one of the things that I look at first is how a website looks and you've talked about themes in Shopify, but how easy is it to design or build my own, like if I have created my own custom design, how easy is it to implement it and what are the limitations that I might come across whenever when I'm trying to implement that? Definitely, if you have any custom build design, you can definitely implement it very easily. You just have to import the same into Shopify's library and you'll be able to use it. And since if you are implementing a design that has been created by you, you might be aware about the import and export functionality that works in all of the platforms. So you just have to import the particular theme that you have built into the library. It will be converted into the liquid format because Shopify has a different language coming into picture when we build Shopify store that is liquid. So it will convert it into liquid and then you will be able to use it definitely. People definitely buy themes from different platforms as well, different websites where they find a better custom design themes for them, which is not compatible initially with Shopify, but they can definitely convert it into Shopify compatible format and they can import it back into the Shopify library. So Shopify has given open options to all of them? Sure, but in terms of this, doesn't Shopify still have a certain structure that you have to follow? Like you have a home page, you have category, what if I want to have a sale and they want to create a custom landing page? Yes, definitely, okay. And what about see again, the question that I also wanted to go back to was what are the parts that are difficult to customize or should not be modified because Shopify has a certain structure for that that we need to follow. Correct. So basically, see limitations, I would cover it in such a way where limitations is something which is already available on all the platforms, but the structure that Shopify follows do not restrict you to do anything. Suppose if there are structures available in sections, you have to build your sections there. In sections, you can do any of the things. For example, if you are building a custom section for you, you can build anything into that particular section. If you want to keep it an image text, you can definitely do that. Shopify does not restrict the basic structure, the one structure that you are making. The overall structure is definitely restricted. It has to be in liquid and the pages that you are building should be from Shopify's new pages section, where they're allowing you to create new landing pages. So everything can be done there. I don't think there is any limitation coming up for the structure point of view. Also, if I may add, Shopify gives you access to edit HTML and CSS. So let's say if you want to build your own template, you can do that. Regarding limitation, I think there are few limitations that any merchant or developer should be aware of. First thing, let's say if you are on normal Shopify plan, let's say if you are on $29, $79 or $299 plan, you will not have access to checkout stage. If you want to make any modifications around those areas, you will not be able to do it because checkout is restricted in these plans. But if you are on Shopify plus plan, which is the enterprise level plan, you also get access to checkout and you can do much more things. Let's say if you want to edit, edit checkout in some form or the other, you can do that. This is for security purpose that they don't allow access to checkout because they want all their orders to, you know, they don't want, if the checkout gets hacked or something like that, then the payments and everything can get hacked. So Shopify does not allow you to do any checkout customization. The other customization that I've seen that, you know, some, I would say that there's a particular structure to the URL of all Shopify stores. So let's say any product page will always contain slash products in the URL. Any category page will always contain slash collections in the URL. That's how Shopify has been designed. You might say it can be good, bad for SEO. They have mixed opinions because, you know, let's say that like Google is becoming more, you know, some Google SEO consultants might say that you should have shorter URL structure, etc. Those slash collections and slash products add some characters to the URL. Apart from that, I think because Shopify allows you to access HTML CSS, you can build your own type, any type of landing page that you want. There's not much restrictions around that. Okay. All right. I guess maybe we can dig into that later. But let's talk about the, okay, one more question I had, right? You have a simple website that you're starting to build, but you also mentioned integrations and additional apps that you can add. At what type or what kind of functionality, like among the hundreds of websites that you have built out, right? What are the common integrations that you have seen or you have realized that would be needed? And at what point of complexity would that come in? That would be one. And the second would be normally in a website that you're building on Shopify. What would be a reasonable number of apps to add? Because, okay, I think what would be a reasonable number of applications or integrations to add into your website before it gets too heavy or slows down? So basically, there are a couple of apps that are really important for you when you're starting to do something. If you want multiple logistic integrations, see, Shopify offers one logistic integration directly into the Shopify. But there might be... Could you clarify what you mean by that? So, suppose if you're using one of the logistic partners to ship your products, for example, I'm using as my logistic partner to ship my product. But there are people who are using local deliveries, multiple local deliveries to ship all the products, to cover all the pin codes that are available in India. So for that, you might need one extra third party app where you can integrate all the logistic partner at once and you can ship all the products. So in that case, you need one of the plugin. It is not difficult at all because Shopify has built everything DIY kind. You can do it everything by yourself. So you just have to click on the ad app and the integration is done. You just have to approve it from the admin section because there are staff accounts coming into picture. When you create one of the Shopify stores, it is created by one of the admin accounts. And with every account, there are multiple staff accounts coming in. So app can be added by any of the person, but it has to be approved by admin only that we need this app. So once the app is approved, you can open it and there is documentation available for the onboarding of all the apps. Definitely, people can follow the documentation and it is completely DIY. Most of the apps are DVD. There are apps which require some of the assistance. In that case, you can directly reach out to the app developers, not Shopify. You can directly reach out to the app developers who are into ecosystem. They'll help you out. And talking about the important apps that would come into picture, that also depends on how you want to create your online store because there are people who install Whistlist app in the starting. Whistlist is something which people want to customize. So there is already multiple customized Whistlist app available on Shopify. They don't want to build a custom Whistlist section for them. They readily integrate one of the plugin available on Shopify. Most of the people integrate the Returns app because Returns is something which is not available on Shopify. Shopify has no return management solution in the picture. So for that, there are multiple apps in the picture. So people into apparel industry because apparel has a lot of returns coming in. So they integrate the return app. So it is based on the category that you are working with. If you are in apparel industry, the section and the number of apps would be different for you. But if you are in a different electronic industry, then it would be different for you. So it is completely, it depends on what your industry is and what app would suit you better. Okay. So what are the implications of using apps? For example, one of the things that you mentioned that it allows other businesses to build apps. Shopify gives that option for businesses to build apps and integrate into the marketplace. But that also implies that using these apps has a certain expense. Is it maybe for every transaction or on a monthly basis? How expensive can it get when we are using, let's say logistics and returns and maybe something for the front-end in terms of customization or whatever else? Absolutely. It starts free of cost. There are many apps which are free of cost as well, but it goes to a very high extent also because while you are scaling, you might need products that could help you scale because when you are already reaching out a level where you are selling more than 200, 300 products every day of a very high amount, then definitely there are multiple things coming into picture that you need to take care of. And everything cannot be provided by any of the platforms. And then what people do is, people build custom things for that, which is a very one-time high cost. You have to spend a one-time high cost for that for building that particular feature. And to manage that, it becomes complex because things getting changed every day. Technology is getting changed every day. If you are getting one app from any of the app stores, from the app developers, they'll keep them updated. But when you'll try to update all of the things every time, then that might end up very costly for you. So it ranges from free to a very high level where I can say more than $1,000 also. There are app available for more than $600, $700 as well. But that completely depends on the volume that you are doing. Most of the apps are volume based. If you are selling 100 products, then the prices would be different. There are pricing structure, pricing plan made by Shopify developers only. They have provided multiple pricing plans. For example, there is one annual pricing plan. There is one-time pricing plan. There is a recurring pricing plan that you can build. You can also build a custom pricing plan for any of the customers. You mentioned, right? If I am building something completely custom, I need to maintain it and make sure that it is updated. But how reliable are the apps that are there in the marketplace that, okay, I use this app? How do I know if one year from now, I'm going to be able to keep using or do I need to change or use something else? As a customer, I might be selecting Shopify considering the apps that are there for certain functionality. But what if that app is discontinued? So how do I know which apps are likely to be reliable? Do we have information about that? Yes, definitely there are reviews available. You can check it out. Most of the apps have pre-trails. While you are using any of the things, you can definitely refer the reviews that are coming in. Shopify promotes a couple of apps in the featured section. You will be able to get it from their staff pick section is there where they promote. They have different sections for the app. For example, you can see app which is worthy to use is a section on Shopify App Store. You can get onto that. There are sections which is called useful apps in India. So this is the way they have categorized the app section where they list the apps which is actually important for the customers. They put it into featured section, the app which are doing very great, who are receiving very great reviews, they put it in the section which it says app worth using for and there are multiple sections for that. So since for one single thing, there are multiple apps available, you have options to try and use. You can go ahead with trying multiple apps and then decide which suits you better. It's just So I was ready about Shopify Plus or Shopify Gold, right? Do you recommend customers using that and at what point would some would that be useful? At what point is something like that? I'll take this. So first of all, see, Shopify is very smart, but they charge $29 in the basic line, but they also charge 2% as a transaction fee for $29. They charge $17, then they charge 1% transaction fee. So that is on top of the credit card? Yeah, yeah. In India, actually, in US, actually it becomes part of the Shopify also acts as a payment gateway and it includes the payment processing fee also. But in India and other countries where Shopify is not acting as a payment gateway, these are additional charges charged by Shopify. So let's say $29 to $79, that $50 difference. If you think about it, as soon as you start making more than 3.5, as soon as your revenue crosses 3.5 lakhs per month, it makes sense for you to pay $79 and 1% transaction fee. Similarly, as soon as you start crossing 35 lakhs figure per month, it makes sense for you to go to advance plan of $299 and just pay 0.5% transaction fee. And then similarly, as soon as you start doing more than 1.6 crore or something like that, then on Shopify Plus, you just pay 0.25% transaction fee, 0.25%. So if you're doing those many transactions, etc., the transaction fees goes down if you are on a higher plan. The other thing is also, if you go to the higher plan, you get some more features. So let's say on $29 plan, you can only have two staff accounts. But on $17 plans, you get ability to sell something called gift cards, virtual cards to your stores, so that people can purchase gift cards and gift it to friends. And also you can add five staff accounts. On $299 plans, you can have more staff accounts and you also get additional some additional features. On Shopify Plus, you get even more automations and even more functionalities like you can have unlimited staff accounts, you can create five stores or 10 stores that you can Shopify Plus. Let's say if you want to create a separate geostore for a particular location, let's say if you want to create a subdomain with local content, local pricing, etc., you can create some stores in the Shopify Plus plan for being one fee. So you can have 10 different stores for different geographies. You also get power of automation. So as soon as you cross, let's say, as soon as you're doing 1.5 crore a month, you need a lot of automations like you want certain emails to go to certain team as soon as something happens. So let's say if somebody has given us one-star review, your customer service team should be able to should get notification or this has happened or let's say somebody, as soon as you get an order which is high risk, you want your operation team to receive a notification or some in some form, let's say in Google Sheet or any email, etc., all these automations, Shopify has built some advanced automations for enterprise Shopify Plus plan. So I think as soon as you reach those revenue numbers, it makes sense for you to upgrade to Shopify Plus. One of the things that's also been happening quite a bit, right? This rise of Jamstack, rise of headless CMS and headless e-commerce platforms. If I want to, if I already have attractive or fancy website and I want to integrate a shopping cart into my system, like let's say if I want to build a very rich UI like Apple or Apple website, right? I can't, a website like that would not be easy to implement directly on Shopify. So if I wanted to integrate shopping cart functionality into an app that I already have, how easy or what is it possible with Shopify and what plan would I need to be able to do? All right, so let's say Shopify has some tools available to create, to integrate Shopify back into these different channels. So Shopify is something called flowfront APIs, which you can use to create a custom backend for these. And also Shopify is something, some integration with Unity. Let's say we have a game and you want to have, you want to, let's say, have, you want to set some merchandise on this game platform, apps, etc. You can use Shopify, Unity APIs and SDK, etc. to get, to build some solution around it. The, the process is same. So the front end is powered by whatever, whatever system that you are using, the backend, where you know the management of catalog running, creating a feed, order management, etc. will be powered by Shopify. You can, you can disconnect front end and backend using these APIs already available by Shopify. Shopify has created some tools to help you with that. Okay. So what, basically what plans or what, at what point would I be able to use functionality like that? It's available on all plans, all plans. So 29, you can do this on 29, 70. So I can, I can, like, I can integrate the API even on the $29 plan? Yeah, yeah, you can. Okay. The other thing is also, we need to know that like normally people who will use Shopify, and I mean to say about, had like a question around headless, when should we use headless solution, etc. Normally the merchants who are using Shopify are merchants who don't want to, who are, who don't want to invest in tech, tech staff, actually. They, they have capabilities in branding, sourcing products and other stuff. They don't, they, they, they, they necessarily don't want to become a tech company. They want to become more like a consumer company. So, so, so generally I've seen that, you know, I would like to say that, let's say these merchants, they are, they, normally they, they are looking for a simple solution to actually sell this product. They are not looking for complex interactions, etc. But even having said that there are tools available on Shopify, which you can use to build those interactions and those type of principles. Sure. So, in the standard, like a lot, we have a lot of different e-commerce stores in India, right? Especially some of the larger ones. At what point, like, the many, most, many of them have their own custom or they use different platforms? Like, what would be, what would be the reasons to not, like, what would be based on the customers that have come to you or on the current people in the, current players in the market? What would be reasons to not use Shopify? Like, one of them was if your functionality doesn't fit. But at what scale or not, not just talking about the type of business, like a marketplace doesn't fit or a subscription service doesn't fit. But are there other things to other factors like maybe scale or control? Like, what are the other factors that you would consider for using or not using Shopify? Or I guess maybe let me put it this way. What would be the most complex website that you have seen or largest website that you have seen that is using Shopify right now? See, definitely we have been looking at larger websites. For example, you can see Headphone Zone. It's a very big website. You can see Raymons. You can see Lenskart. You can see Fanhood of Book My Show to sell Merchandises. They are there. Himalaya is using Shopify. And there are multiple more big crème clients who are using Shopify right now. So by forgetting this that why they are using and why some people are not using, that would be difficult for us to answer. But to answer your question that why the people are using Shopify, they don't want to get into the basic hygiene things. They don't want to get into the security things where they had to check multiple times if there is any issue coming in. They don't want to get into the uptime, the bandwidth thing again and again to see if the sales volume is high, they need to increase the volume. If it is not very much high or if the revenue is not coming up, they need to decrease the bandwidth. And there are multiple hygiene that you have to follow while running up a website. They don't want to take care of sales only. They don't want to get into all these stuffs. And even they want to hire one expert for this, will take care of all these things. People who come and Shopify generally approach in such a way where they hire one expert, keep their Shopify's technical things with them and they focus on selling the products. They focus mainly on sales part, which is important for an e-commerce merchant, I believe. Okay, so let us say that I already have a store. I'm running on e-commerce or on Magento or on Spree or something like that. How easy, what are the implications if I say I'm considering Shopify and I'd like to move to Shopify? How easy is it to migrate? And what would be these, are there any specific implications that are there when moving to Shopify? All right, I'll take this. So normally when you are migrating, you want to do first of all content migration, product migration, you want to migrate the old orders, data migration, you also want to migrate customers. And sometimes you want to retain the old design that you have. These are the broad things. And also you want to make sure that, let's say if you're migrating to Shopify, you want to know, you want to make sure that the old integrations that you had, the old methods of working, etc, still stays, you know, let's say you can still work with the same payment gateway or same same ticketing solution or customer support solution, etc, while moving to Shopify. These are the main considerations that you would like to see, whether you can migrate the old content orders, etc. And also whether you can have the design that you want and whether you can use the same integrations or you will require new partners or new type of solutions to do the other bits. About the ease of migration, I think it depends actually from migration to migration. But I would say there are lots of tools available, which makes it easy for you to migrate. There are some like even one click migrations available from WordPress, WordPress, Magento, where you just need to connect these tools and these connect these two platforms and these tools will convert the data from these Magento and WordPress and convert it into format with Shopify content and import all this within one day. And we don't, it depends actually. So sometimes if it's very complex, we have handled projects which had like more than 4 lakh orders and 2 lakh customers, etc. During that time, we need to make sure that all the information which is being exported from Magento or WordPress, etc., is in the format that Shopify also understands, etc. And we need to do some manipulation around it and then get it done. Okay, so basically, so in general, would you recommend if you are moving in right, would it be something that a person who is not very technical would be able to do or would you recommend that they hire a Shopify expert to handle a migration like that? If you have a big store with lots of legacy data, I think it's better to use an expert to make sure that there are no issues while migrating. Also, we need to make sure, one is let's say having migration but also about making sure that for the customers when you migrate, you need to switch off the old system and switch on the new system and make sure that everything is working. Those things might become risky and complex if you are doing on a live store which is living and breathing with lots of traffic quality coming in and you need to make sure that even your old URLs have to be re-directed so that you don't lose any SEO juice that has been created over the long term. So you want to make sure that all these things are covered. So first of all whether merchant has the knowledge of all this stuff and whether he or she has those capabilities, they can do it on their own but they need an expert to make sure that they are following all the checklists of whether they have thought about this, whether thought about that etc. And also, most of the migrations are also to solve a particular problem. So let's say they were not able to do certain things in the old system that they want to do on Shopify and also it's not just mig it, it's also about upgrade. If you are moving to a new platform, you might as well upgrade your system to better let's say do customer service or better present the product or better speed etc. So ideally, if you are an expert, they might even be able to give you more solutions which can simplify your processes. Yes. So we are talking about moving into Shopify but one of the things as an engineer or as a software developer thinking about is if I'm using a platform, am I locked in? What if today Shopify meets my requirements? But two years or four years or five years from now, my shop is big and for some reason I need functionality that Shopify does not provide and I want to move out. How easy is it to get my data out of Shopify and migrate to a different platform or migrate to a customized platform? See for that I believe, for example, Shopify has readily available tools to migrate on Shopify. You can definitely get all the data from the Shopify but to move on the platform which you are looking for it should also have some tools available to get data from other platforms. So none of the platforms that is in the market locked you up because nobody can make you hostage when you log into any of the systems. You are free to move in and move out at any point of time but when they are making this experience good for you to move in, the other platform that you are switching to should have the experience of moving in from other platforms as well, from Shopify to I guess, much a door WordPress, there would have been tools available. So you need to check out for that if there is any tool available and if you want to migrate and for custom, if you are doing it custom then definitely depends on you how you want to put that data back because you can definitely get all the data from the Shopify at any point of time. So Shopify is an American company. They have been in the Indian market for a while but I guess the question is like how do they understand the unique challenges that are there in the Indian market and are those needs generally met by third party integrations or does Shopify themselves have any changes or the way they run the business or the way the product works? Does it fit into the Indian market quite well? Shopify is a Canadian company actually. So Shopify does some things which for especially for Indian market and for other local markets, they do build some first place tools. For example, in India, COD is big. You might even see 60-70% of orders being placed on COD, which is not common in different markets. So especially for India, they built a tool which allows you to restrict COD to certain pin codes and also maybe charge extra money for COD. So Shopify themselves created a plugin which is accessible to all the stores who are using I&R as a currency. So yes, Shopify does make sure that if the market is big and if the need is high and they are able to solve it using their own system, they can do it. And also as Sakit already mentioned, there are lots of merchants who solve, there are lots of app developers who solve local issues. For example, let's say if you are selling in China, you want to have some going to integrate the Chinese supply.  If the demand is big enough, there are lots of app developers who build those type of solutions. So this is true for all geographies, not just India. But yeah, to answer your question about India, Shopify has built something for India like advanced COD because the demand was high enough. Okay. So I have a question from YouTube from Sanjeev. What is the difference between WordPress and Shopify? So WordPress and Shopify more likely both are a platform where you can create your online store. There is WooCommerce powered by WordPress and Shopify is already there. So difference would be in the functionalities and the difference would be in the user experience that is coming in. Different would be in the plugins that is coming in. So it's short of a thing where you can use and decide. Like me selling Shopify to you would not make any sense. And I can definitely give you the key benefits that Shopify is offering. And WordPress already has certain benefits offering to the market. But you'll only get to know that what Shopify has more than WordPress would be when you start discovering the things. Like for example, there are multiple things that make your operation very easy. The plugins that I said, the process of customizing your website, the process of managing the catalog, the reviews, the SEO thing. See, the SEO thing is a very big thing that Shopify is already providing. While entering a description, there is one more field in the description field where you can write the meta tags. Where you can enter how the SEO will look like. Like on the search page, on the Google search page, how the title and the description will look like. So that can be directly done on the description page itself. So having multiple things at one point definitely makes more sense to you if you're trying to get it done from different login screens, from different dashboards actually. Also WordPress is content first. The WordPress was a blogging solution actually for us. We are a publishing company. If you are more into content where you are creating, posting posts every day, etc. I think WordPress was designed around that when it was launched. And like I know so Shopify was designed around e-commerce. So if your business is around, let's say just making sure that you are publishing the best content and e-commerce is an afterthought, then maybe WordPress would be a better solution. Similarly, if your business is around e-commerce and the blog is just an additional way of getting traffic, then maybe Shopify would be a better solution for Sanjeev if he's looking at two different, comparing these two platforms. So basically WordPress, if your initial focus is content and Shopify, if your primary focus is e-commerce, that would be your recommendation. So with WordPress, it's not a hosted solution. You also need to think about, you need to maybe hire a developer to actually put WordPress files on your, we need to buy a server place and put all this. But it is available also as a hosted solution. Yeah, I think they are managing WordPress solutions also. Managed solutions are there, so that should be fine. In your experience, have you seen customers who have started on Shopify and then at some point have moved to their own platform? And any particular reasons around that, or do you not see much of that happening? Generally, I've not seen much because the way Shopify works is, as you grow, your needs become more and more complex and Shopify is able to handle those needs by using some plugins or the other. But one common reason why I normally see people leave Shopify, especially in India, is if you are trying to sell products in international market, Shopify, the checkout happens in store currency, generally speaking. So let's say I'm selling on IANA and the checkout also happens in IANA, Indian rupees. But if you are selling in, let's say, USA and you want checkout to happen in USD and you are selling in Europe and you want checkout to happen in Euro, et cetera. There are some tools available which allows you to do those checkouts on those stuff. But sometimes, you need also some complex solutions. So some people actually leave because they are not able to have multiple currencies and multiple, they want to have different price for different geography and some complex solution which Shopify cannot power. That's one reason that I've seen. Also, the other thing is, let's say if you are selling stuff which cannot be, let's say, some stuff that maybe Shopify does not allow to sell. Currently, everything is available. Let's say the government of India decides to, so they have to, they are two local government rules. Let's say somebody is selling alcohol just to give an example, which at the time when Shopify started, there was no rule around it. But after the government or some local government brings in that rule that you are not allowed to sell alcohol online, just to give an example, then Shopify will also have to follow the local law and might ask you to leave Shopify if you can't sell restricted products on Shopify. And then you need to have your own solution. You can't use Shopify. You have to follow the rules. So technically, you can't even use your own solution if you're not allowed. People will still go ahead. Yeah, I understand. But at least if you are on WordPress, you have your own rules like in Shopify. Sure, with Shopify. So one of the other things that I think you mentioned because they're important is SEO and social ads on Facebook and on Google.  For example, I have a particular image that I use on my website. But because of the design of my site, that same image does not fit on the Google ad card, right on the Google ads or on Facebook ads. So can I customize, like how much customization do I have there, both in terms of SEO and how much control do I have? And how much control do I have over the images that go for the Facebook or Google catalogs? Well, I'll take your first second question first, which is like how much control do I have on Google and Facebook ads. So let's say, take your example, let's say you have a particular first image which works for your website and you want to have a different image on the ads. The direct integration that Shopify has, free integration with Google ads and Facebook ads, will take the same image and send it to the Google ads and Facebook ads. But if you have a slightly complex, different non-standard requirement, currently it's not available in the solution that Shopify has made. But you can use a third-party tool, something like let's say data feed watch or simple as Google ads. There are some tools available, which allows you to have different image on these platforms and different image on Shopify. We like to use a custom bridge between these two different solutions. And just like that, you can also have different title on website and different title on ads. You can have different, maybe you want to have different data on ads. So those type of tools are available, which allows, which works, which will take data from Shopify and will allow you to make some manipulation and submit it to Google and Facebook ads catalogs. About SEO, I would say, let's say in SEO normally there are more than like, say there are 200 plus known factors which affects the ranking of a particular website. Like from website speed, content, unique content, domain authority, the authority of the backlinks, well-timed, over-sticking. There are so many things which affect ranking of a particular content. Shopify, because it allows you to edit HTML, first of all, Shopify already mandates themes to put the structured data directly into the theme. So almost all the information is easily accessible to Googlebot or Bingbot, whichever, all these bots who are decoupling the website. It's already, they can easily read the data. It's not just by going through H1 Tech. There are also some structured schema markups already made into the Shopify, which these bots can easily read.


So the focal point of your Hogwarts legacy playthrough in regards to progression is something very important to the player. This is the hub, this is the tracker, this is your guide to the game when playing and today guys I will tell you everything you need to know about the wizards field guide. How's it going guys? My name is dpj and if you do enjoy the video leaving a like really helps out and if you like what you see and want to see more be sure to subscribe. So the wizards field guide is the centerpiece of progression within Hogwarts legacy. This hub will tell you everything you need to know about your progression while playing but it's more than just that. It's the place you check your inventory, your level, your challenges, absolutely everything. So on screen now you can see the wizards field guide menu. This is brought by simply pressing pause on your controller but a little backstory I guess to help you understand why you have this. Players enter the Hogwarts legacy narrative as a late entry fifth year student. So there's a lot of catching up for you to do in regards to learning about magic etc etc. This particular field guide is a gift from the Ministry of Magic that Hogwarts has given the player in order for them to basically equate themselves with the school. So yet like I said it's basically you're playing catch up and the wizards field guide is here to help you out. So pausing brings up this guide. So let's go through each section here, each page each card. First we have the overall level. Now level progress comes through earning XP which is given I believe in combat, progress in the games, door requests etc etc. Just how you would imagine but it's also given out you can find in secrets like collectibles and more. Also notice the house crest on the level icon and under wizards field guide book as well. It's pretty cool. Next up guys we have the map. Now I've made a video talking about this and this game's scale in regards to the open world beyond Hogwarts and what no doubt this does reveal the true scale which is something we have yet to see as I make this video. Yes there's been hints, there's been clues, but actual confirmation on the map size we are missing. We then have quests which is self-explanatory. This tab no doubt beholds progress under main quest which is said to be an engaging story based around the fact we as a player will come to find that we possess the unique ability to manipulate powerful ancient magic hidden in a wizarding world. This forgotten magic is no return and the player will have to uncover who or what could be beyond due surgeons of this old power as well as discover those who might be seeking to harness it for their own purposes. But beyond this guys Hogwarts legacy is an RPG and offers way more quests fully voiced quests which can be found everywhere in the castle and no doubt beyond. Each quest has multiple choices for player to choose from. This meaning the game has multiple endings and it said that almost every player's quest decision matters. It brings a unique experience for every player and it means the game has huge replayability and this tab this quest tab beholds everything we need to know about each quest we do progress. We then have our post which is a system we don't exactly know how it works but I'd imagine just like any in-game messaging system going off the original books and the movies we get a gist of what's going on here. This is where we will be notified on certain instances of progression tied into things we are doing so you can now or even yet to find within Hogwarts. Next up we have the settings tab which I don't think I need to explain. We then have the challenges tab now this is a tab we do we see inside this is a page or card we do see inside and as you can see here on screen there are five further tabs within this challenges tab which basically show an overall progression for the player within Hogwarts. We have combat challenges quests exploration field guide pages one we have seen a couple being collected within a few gameplay reveals we've had and we also have the room of requirements tab which we do know will be a hefty one due to the amount that can be done here. This I'm really looking forward to exploring more progression has always been something I love completing especially when it's there I'm sure for you to check out on the fly we then have the collections tab now like the pages we have seen being collected around Hogwarts via these reveals there are collectibles within the game and there are many many things for you to find now once said pages are found I don't know if it triggers something else within their collections tab mean you can unlock or even progress said things further or if you are rewarded for collecting a certain amount a grouped a lot but I'd imagine there are collectibles scattered around the entirety of the open world map within Hogwarts legacy so the next tab is the talents tab again we have seen inside of this page so our talents are where we obviously upgrade ourselves as a player as things we can use to help us along the way now if we can quickly it seems there are 50 talents for us to upgrade here and we use talent points to unlock them now I first thought when we level up we would get a talent point but looking at this screen here we can see the player is a level 12 yet there are 15 of these talents unlocked and well that really doesn't add up so there could be another system in which we use to earn talent points I can't confirm that yet okay so the first two cards on the left at this page we actually don't see what these are but if I had to guess I'd say the first one represents spells due to its color blue and as we know this is almost always associated with mana and magic in other RPGs so that's what I'd imagine the first one is the second one I guess would be something to do with gear upgrades of some sort now starting from the far right because these we do know we have the room of requirement this is now our home within Hogwarts and consists of basically our goal to to upgrade craft brew rays and much more in regards to our player progression we then have stealth where these abilities improve your ability to sneak around unseen which is cool we then have caught these talents improve our overall effectiveness as a witch or wizard so the talents tab is basically where we upgrade ourselves to progress further in this game next up we have our inventory card this we don't see inside but I'd imagine it consists of things we found collected or even farmed through craft create or brew things would take back to the room of requirement things used to make those spells for those tools which help us in battle and much much more and probably even items to progress the story quests and things of that nature and lastly guys we have the gear tab this is of no doubt a place where we switch in and out our gear we find upgrade or even created a point in which we know is heavily customizable so that the player can play the game the way they want to play but again this is a tab we haven't yet seen inside so I'm just going off instinct here but there we have it guys that is what we know about so far of the wizard's field guide if any more news drops surrounding this or anything else Hogwarts related I will have you covered right here on my channel but guys if you enjoyed the video leaving a like really help us out if you think I've missed out anything important other players should know please leave a comment down below and hopefully guys I'll see you on that next one


The COVID-19 pandemic poses severe challenges to democracy. Authoritarian leaders are using this crisis to expand their power and silence their critics. In many cases, parliaments and judges are being sidelined, journalists are being harassed, minorities are being scapegoated. That's why International IDEA, alongside many partners from around the world, has published a call to defend democracy. A statement which by now has been signed by over 70 leading democracy and human rights organizations, and almost 500 prominent leaders from over 100 countries, including 13 Nobel laureates, more than 60 former heads of state, and scores of respected activists, journalists, public intellectuals and academics. At this time of great danger, we have all come together to shed light on the importance of defending democratic institutions. Democracy is needed more than ever to preserve our fundamental freedoms, to deal in a fair way with the consequences of this pandemic, and to make societies more resilient in the face of future adversity. You can also sign the statement. Go to our website www.idea.int and join this cause. We must not let democracy become just another casualty of the coronavirus.