How's it going everyone Caleb here with the late in sports cards next night. We have 2021 flawless football One box break. This is gonna be left side serial numbers. This year is Gonna be 44 thanks again. Like I said, it threw me off in the shadows 43 that time. Let's get it going 44 Thank you all very much results right here one more time We'll get it going. Here we go. Here we go Good luck everyone nice. Thanks appreciate it Chris Yeah, no gaming stream tonight had to give Brad the night off Brad's gonna be working tomorrow He would usually not work on Wednesday, so everyone stays off this week kind of got shifted around a little bit Unfortunately, no gaming stream this evening Okay, here we go. Good luck all X factor. I know it's been quiet Yeah, Sean spice it up. I'm blaming you Sean. I know his name is also Sean X factor. Oh, yeah Yeah, what's up, Sean? Sean times to All right, hold on. You get this other sticker and we can start the break guys Yeah, they want my fingernails cut short and then all of a sudden they got these stickers on the boxes Good, yeah, you can slice it easily Good luck everyone. Thanks again so much for joining. See we got inside here. Yeah, man. My name's Sean Yeah, there's another Sean another Sean Empty thank you again. Good luck here. Let's get this going Is it spelled the correct way Henry Ellard on the dual patch three of 15 there you go three spot Matt T3 spot, that's funny I knew that was gonna happen and Jumbo patch Jalen waddle beautiful one 16 spots check out the patch Stewart there you go. Nice horizontal patch autograph for the Browns Anthony Schwartz 20 of 25 20 spots Colin you go Colin doing well in these this evening Nice Schwartz RPA It is seven spot on the Josh Palmer rookie Ruby autograph seventh spot is Michael F Go Michael 24 spot your terrorist Marshall Jr. Rookie autograph Nicholas L And it's gonna be 13 spot on the Warren moon autograph now 13 James a Go Warren moon autograph. How is this not in case? How 14 of 20 Drew Bledsoe Mac Jones dual auto boom Timothy F Congratulations 14 spots Why is this not in case?  All on card all the time.  Congratulations. We'll encase that for you It's gonna be Ruby gem 11 of 20 Darius Leonard Colts Or 11 spot. I should say my apologies 11 spot Daniel L of one Uh Diamond gem Frank Gifford for the Giants one of one diamond gem Anthony V Congrats You go nice one man. All right, we'll take it. How about two of 15? For the Jaguars Trevor Lawrence Rookie Auto boom Nicholas S That was a ridiculous Box of flawless T law and Mac Jones autos one box there That's really sick. Congratulations Nicholas S Yeah, that's nice allies Very very nice. Hope you guys did enjoy it there this evening We'll have all of those well protected up and sent right out to you. Thank you again so much for joining We hope you did enjoy One more time here's the empty case didn't do a great job of showing that Appreciate it. Thank you very much


Sad to know where all the best toys are and this December many of the hunter's smartphones are just a penny with service in Appalachian Wireless. Stop by your local Appalachian Wireless to check out all of the great smartphone deals that consistently top the nice lists. Ho ho, this Christmas is truly going to be bigger and better than ever. Better service, bigger savings, that is. Ho ho ho ho ho! That's today's Appalachian Wireless! Merry Christmas! Ho ho ho ho! Christmas is the season of giving and today at the Weizberg Walmart it was the Kentucky State Police post-13's opportunity to give back with their annual Shop with a Trooper. We've got close to 80 kids today from the post-13 coverage area which includes Bradthet Knot, Letcher, Lesley and Prairie Counties. And it's just again one of those wonderful opportunities to have a positive contact and interaction with children, to have the opportunity to make this time of year a little bit more pleasant for them. It's just a wonderful opportunity for us. During Shop with a Trooper children get the opportunity to see Santa Claus before going on a shopping spree with the troopers around the store. I did get shockings and a list and then I got tons of shoes and shirts. While it is the season of giving troopers say they are surprised how often children picked for Shop with a trooper want to buy gifts for someone else. The one thing that stands out more than anything is the number of children come in and express the desire to buy for others. For younger siblings, there's been times in the past where we had children wanting to buy for grandparents, parents, even buying food for the family. So the fact that these kids come in and you give them a certain amount of money and they're thinking about others, it just fills your heart with joy and it gives you hope for the future. With bicycles and video games piled high on their carts and smiles on their faces, Shop with a Trooper is always a success. Reporting from Weizberg, for EKB News, I'm Jackson Ladder.


Man, he's like Skullface, but that's my idol. Skullface. That's all. Oh man, that's everything. So what was his favorite song that you liked? With Face? Never seen a man cry. I like that one too.  Let's get back to it. What we had anyway? Jay-Z thing and Face. Jay-Z, yeah, yeah. Yeah, let's talk about that, Jay-Z, because like I said, I love Jay-Force for the entrepreneurship. I'm not, not far as the music, I'm not a big Jay-fan. When I interviewed Mac, he was like, Jay-Z, he loves Jay-Z and he loves Skullface. Think about some of the artists in the South that I really listen to. Let's talk about it. As far as lyrically. My favorite artist, and because I listened, it wasn't that I was... Let me see who it is. It wasn't that I was adverse to a region. I was just more into a certain level of lyrical content. Let me see who your favorite artist in the South was. In the South, I would definitely say that Skullface was one of the... I knew it, I knew it, I already knew it, I knew it, I could have said it. I started to say it. He was the... Everybody said he was bad. He was that lyrical... He was bad, man. He never did a bad verse. Yeah, he was that lyrical dude that I was like, yo, I didn't care what Skullface was talking about. The way he talked about it made me want to listen. I love Skullface. I feel like if any n***a in a booth, anywhere, if I bring Skullface, you're in trouble. I don't care who it is. So that's how I feel. Like, I don't care what you could go get whoever. I'm putting Skullface in there, man. That's Mr. Servant, Mr. Skullface. That's where I come from. People always felt like I was dark, you know, and they were like, man, he's like Skullface, but that's my idol. Skullface. That's all up. That's everything. So what was his favorite song that you liked? With Face? Never seen a man cry, man. I like that one. Dude, you know, I mean, people like a lot of stuff they like, man, but when, the way he spoke that, you know what I'm saying? And I watched that.  And just watching that and remembering that song, you know what I'm saying? And then for me, Face is, he's so, and might sound crazy when I say this, he's so underrated. That's what I say, too. As you can't sit down and have a go conversation if that's what y'all want to do without arguing him. He's an argument. He's an argument. Him. You know, if you're going to put Jay there, which I love Jay, you know what I'm saying? But if you're going to argue about who's the goat, you better be arguing about Skull Face. And it's not just a fact. I'm from the South. You got to look at not just, it's not just a track record, it's music. And then another thing, King's going to want to be with King's.  That's goat stuff. Yeah. You know what I'm saying? I'm not going to say a noz that want to do a song with him. Somebody like Pac, I got to do a song with you. Somebody like Jay reaching out got to do a song with you. That's goat. That's in the goat area.


another episode of In the Studio. I'm your host, Lynn Weaver. Well, something very exciting is happening in Davis these days. The Davis chapter of the League of Women Voters is back. After five years of declining membership, which prompted its disband, a number of very concerned and dedicated citizens of Davis decided to bring it back. As many of you may know, it was founded in 1920 to support mainly the suffrage of women rights. And the interesting fact is that this 1920, the founding of this league was just six months before the 19th Amendment to the United States Constitution gave women the right to vote. Now, in 1973, the charter of the National League of Women Voter was modified to include men. And one of the things that is very important to be said is that officially the National League of Women Voters is a non-partisan organization. And which means that it neither supports nor opposes any candidate or any party in this country. Well, I have here today three wonderful guests. I have Mary Jo Bryan, the new Davis League acting president or director, president. Bob Funk, the acting vice president of the league and Georgina Valencia, the acting secretary. Welcome all. And thank you for being here. Now I'm going to start with a couple of questions. The obvious one is, and Mary Jo, if you could answer that, what is the principal goal of this revival? And why do you think it's very necessary to have a Davis chapter of the league? Well, thank you very much for doing this because I think that all of us feel the importance and what we've discovered is that there's a great feeling of importance throughout this community to restore the legal invoters back to Davis. And just to give a little bit of further history too, the league had been started back in 1959 as sort of the beginning of the onslaught of the city of Davis and what it was becoming in a university town and was very active in planning and voter education, all kinds of things, very strong and very strong and was like that for many years. So when 2014 came along, we had that leadership had really had, they could not find new leadership to take it over and so they did disband on that. But sometimes in having ideas like that, people see the importance of something and bring it back on a different level. Absolutely true. And I think this is what we're doing. Last year when I was running for city council, I realized how difficult it was to get information out to the general public with declining readership of papers and other restricted sources and Civ and Energy did a great job of trying to do that but name recognition wasn't there. The legal invoters has a great name recognition for voter service, non-partisanship, study, research, taking positions on various issues that they have decided to take a position on. And with all that in mind, when I started talking to people, I can't believe that the cadre of people that I have working with me is incredible. So I'm willing to take this on and I'm so thrilled that we are doing this and that we're doing it with men are in. Yes. And we have. And it's a wonderful organization. I've belonged to it since 1960. Yes. I was also a member. 1969. I was also a member for many years back in Massachusetts and I always valued the incredible service that I do and their presence is essential, not to mention in this particular political climate now with the new election coming next year. We have very strong positions on a variety of issues on both the national, the state and the local issues. So when you become a member of the league, you become a member of all three. Yes. And you can play a vital part in regards to that on your local level, on your state level and with the national league. Well, it's very good to know. And Georgina reminded me a little while ago that they still, you don't, you will soon have a website because you are still in the process of being registered. Isn't that right? That's absolutely right. Yes. We actually had our first meeting on May 29th, which is not that long ago. No. And our second meeting on June 25th and I'm happy to say both meetings, they were organizational meetings and that's how you start this process. They have 15 steps that you take off the website from the California State League. And we've made it to step seven and that's where you put a package together of your governing documents and applications that have come in and create those documents and send it into the league itself, the state league which we did that on July 10th and they'll be reviewing it before the board on August 3rd and we hope at our August 7th meeting to announce that we have their record. Official. Yeah, exactly. Exactly. Well, that's wonderful. But in the meantime, you can go to another website and I'll come to Bob. Who is the founder of Civ Energy. Right. And can you, Bob, can you explain a little bit how your organization integrates or fits in with the League of Women Voters? Sure, sure. And of course you are the vice president. Right. Yes. So, Civ Energy, I founded it in about 2014 and there was an election, a city council election and I worked with the league before they disbanded in order to take the forum, the city council forum that they did and to put it on the internet so that people didn't have to be at the forum. They could watch bits of the forum remotely. That's wonderful. And that was my plan all along to work with the League of Women Voters that the league would do in-person forums and the Civ Energy would do the online discussions continue discussions before and after the forum. And your technical background certainly is very handy for the league and for everybody actually. Yes, it's true. So, after the league disbanded, Civ Energy not only did the online discussions but we have been putting on forums. We put on a forum when Mary Jo was running for city council in 2018 and it was very successful forum, we had over around 300 people at the Davis Community Church there. And so I would, connecting Civ Energy with the League of Women Voters is sort of putting the online discussion together with the traditional in-person forums and the other things that the league does, voter registration, analysis of issues, all those are, we'll be working together with. That sounds wonderful. So you're outing a new 21st century dimension to the league, which is in somewhat a bit of a goal of Mary Jo and all of you, the leaderships to bring this chapter to the 21st century, as I said. Well, the website of Civ Energy is very, very easy and it will display on our screen. It's www.CivEnergy.org. Right, that's right. And you can be reached, I imagine, at your website for any questions. And then of course you will probably announce when the league website will come into being, right? That's right, yes. Well, this is wonderful. I wanted to, I wanted to talk about to ask Georgina how your work, you are a member or the chair, I believe, of the city social services commission. I am. And so of course it seems obvious to me, but maybe not to everybody, how does your work for the city, for the commission, fits in with the work you are planning to do? Yeah. I think it's really trying to understand what the issues are in the community, what the public concern is. For instance, there was a survey done recently that the city asked a consultant to do. And one of the top issues of that was housing affordability. And that is one of the mission statements, if you will, for the social services commission. So we meet on that and we talk on that. We had a very robust meeting on this last Monday evening in regards to housing and our housing policies here in the community. So that's one of the pieces, if you will, that fits really well. And so it just seems that I'm on the social services commission and it just makes sense for me to be a part of the League of Women Voters. But I'd like to add one thing too. And that's really to command Mary Jo because she's the person that really kind of connected us all together. And honestly, if I hadn't run into her on the street and she looked me right in the eye and said, I want to start the League of Women Voters. And I said, I can't believe there isn't one in Davis. Because it's such a Davis thing. It's a Davis ethos to really be involved. And so she's really the firebrand behind it all. Mary Jo has a long, long history of volunteering in Davis and doing fantastic things for the community. So thank you. And this is just a very creative idea that other people should have thought of. But nobody did. Democracy is a part of the participatory sport. And we have to get people involved. And when that survey came out, we saw that from people. But there were things in it that people need to learn about, the process, how it happens, how to participate. And that's what the League can do. And with the help of Civ Energy, we've got a much, much broader way of contacting people. And I think that's so important. I think you're absolutely right. And it always amazes me how little people, especially young people, now how little they know about the process of voting and participating in political discourse. And all these things that are essential and they're not really taught in school. And even at university, unless you are in political science or something, they're not. And it's a must for our democracy. But I wanted to ask, and this time I'm going to ask each of you, so you can choose who's going to start, what are the challenges of currently faces, the League, in our region, and perhaps nationally as well? And choose one or two. I mean, there are many challenges. I can start. OK, good. So in our first meeting, Gloria Partida, Mayor Pro Tem came to the meeting. And she came up to the front to give a little discussion point. And her discussion point was on the fact that she thought that the League in Davis and in the state and nationally needed to be much more diverse. So if you look at the population, the League needs more men. And it needs more younger people. Yes. It needs more people of color.  Yes. Well, who's next? Yeah, I think there's some goals that I'll say are not maybe at a higher level. But for us, because we're at such early stages, one of our biggest goals is really membership. Yes. And diversity is obviously very important, but we also need to get members and our outreach for those members. We're doing it in various ways. I mean, this is a great format. And we really appreciate your interviewing us today, because I believe that helps us, too. But we've been working with the Davis Enterprise, Davis Vanguard, in any way that we can to let the community know that we're here and we're coming back. And we need their support. It's essential. And I was going to ask you that in my next question. Yes, I also am planning to have you back in a few months so we can mark the progress. And outreach is so difficult, because everybody's saturated with things. Mary Jo. Well, I'll take a little different things. Yes. I mean, it's basically understanding the League process in this non-partisanship. Yes. I mean, it takes positions on issues. So we have a housing issue, an air quality issue. And so we will lobby for those. We will never take a position, as we mentioned, on a candidate or a party. And that's very important. But in that process, you have to do some research and study. Yes. And sometimes people feel that we are too slow to act. But I can tell you, I have been in the League since, like I said, 1969, 1970. And I reviewed our local positions from that were put together back in 1995 and updated. And they are relevant today, very, very much so. They need to be tweaked. They need to be active. They may be needed to be rounded out into. But they are right on course. And I just think it's important that you have the background of knowledge and research behind you before you go forward, because I think we've all learned how complicated situations are, funding, all these kinds of things. Well, and of course, you have to prioritize. But I'm so happy you mentioned that the issues and not the people, especially nowadays, it's all about personalities and people. And the issues are all that matters whether you are a Republican, Democrat, I don't know, Mr. Smith of Mrs. Goodie, it doesn't matter. And I think that young people need to understand that in this culture of memes and icons. There is one last question because I'm afraid we're running out of time. It's amazing how 15 minutes go very fast when things are very important. I wanted to ask you, basically you've already answered all that, but Georgina mentioned outreach. Obviously, you want to expand participation and include young people, minorities and men and so on. Do you have, are you working on a strategy to do that? Well, I'm hesitant to say too much right at this point. We are, so the answer is yes, we are. And one of the things that we're doing that's a little bit different from the original Davis chapter is it was really about Davis. And what we're looking at is Yolo County. And we believe that that will help bring us more diversity too. I agree. So that's one of our strategies. But there's others, I'll just, we'll wait. Yes, absolutely, I'm glad that you're thinking of this. And I noticed that there is a Woodland chapter. There is a Woodland chapter. And I was wondering whether you could combine your strengths in some. We've actually talked about that and met with them and gone to their annual meeting. And they're very receptive. Good, and perhaps there's one in Sacramento, who knows? But I'm, there is, yes. But not West Sacramento and not Dixon. I mean, not Winters, not Esparto and not, you know. So there's definitely places that could use the outreach and what we do for them. And sort of help one another. I'm afraid our time is up. It's terrible. So thank you so much. My heartfelt thank you and appreciation for what you do for the community. Bob Fung, the vice president of the Davis chapter of the women, the League of Women Voters. Thank you very much. Georgina, the secretary of the acting secretary, no longer acting in a few weeks, I'm sure, of the League and Mary Jo, the acting president. Thank you so much. And again, go to Civ Energy website to find out more about what Bob and his organization do. And for, thank you all of you for watching. If you enjoyed this episode, you can always watch it again by streaming it at dctv.davismedia.org. And while you're there, you can look at some of the other shows that we have. We have incredible guests and very interesting topics. So once again, thank you for watching and see you next time.


I know that if we don't get our act together, we will continue to be outperformed by other communities that may not have as much as we have to offer. But if we can put our disagreements to the side and come together for the sake of building something bigger and greater, it can happen. So I would say, when I think about what keeps me up or what concerns me, it's togetherness, collaboration. And that's what keeps me going, is getting people together. Yeah, and it's something traditionally we have not been good at in this valley, in southern Nevada. And I've lived a lot of places.


So yeah, absolute pleasure to be here to talk to you today. Hello. My name's Simon. I'm from the UK I'd love to hear where you're from. So please ping in the chat and I'll say hey I'll give you a call out, but I'm gonna jump straight in because I think I have about 30 minutes So I'm gonna is that right Edson? I have about 30 minutes. So I'm I'm Finishing about a quarter past ish. Is that is that correct 30 minutes 30 minutes. Okay. Cool. Cool I'll try I'll try and do that. Hey, I can see in a client Raphael and so this is strange a danger So let me go this full screen.  I'm gonna do a few slides slides are boring So I'm gonna jump into life hacking as soon as I possibly can this is called strange a danger It's about how we find security vulnerabilities and our applications before well before they find you before someone else finds them My name's Simon Maple. I run the DevRel team here at SNCC at SNCC We are very fond of creating developer solutions for security. So security solutions for developers as it were How do we get developers being more secure and and using you know doing security focused activities as part of their usual day job? I've been in Java for well over 20 years now and My background is as an engineer for IBM working on web sphere and other amazing middleware products like that I Also run the virtual jug the London Java user group and I've got a couple of awards there If you wanted to reach out, please do on Twitter at SJ Maple Okay, let's start with with something that hopefully everyone is aware of and and and absolutely loves I'm sure DevOps it helps us deliver value very very fast. It allows us to write some code in an IDE and push that to To production later that day later that hour. We can do it very quick We can do it often and we can do it in a predictable way However, when we do things like that, there are a number of other things that don't fit that model One of which is security and that's why DevSecOps is a Wonderful incredible buzzword which which was created and loved by many What is what are the problems though? That's something like DevSecOps solved? Well with this speed up of people wanting to push code to production often and quickly How does things like the traditional security audit? How does that fit in we do that from what I understand once every 25 years where the whole Security team come from their dungeon. They come to the developer and they say no you cannot push this because we have a hundred Vulnerabilities that are open if you push that so what happens is the developers they end up hating the security team a Security team end up hating the developers because they put in all these shiny libraries. How do we solve this problem? Well DevSecOps is similar to that DevOps mentality where we try and pull these different silos these different teams together So that security has made a first-class citizen in that pipeline so every time we push we make we have security considered We have security tests running and we know when regressions occur because customer data could be compromised Yes, Equifax know that all too well as do any Equifax user This was the winner one of the headliners that have has made the news over the last few years I'm realistically the reason that this breach occurred and so many millions of US customers Had their sensitive data breach Was because of a popular library called Apache struts and Apache struts as we know is an open source library One of the reasons why open source libraries are so useful is because everyone can just use them and adopt them and grow Based on them one of the horrible things about open source software is that when there is an issue Whether it's a bug or a security problem that bug or security problem exists in many many different Places now. That's not a criticism of open source. That is that is almost like a It's a it's an issue that exists because of the popularity of open source now when we think about something like Struts we can see that when the Apache struts vulnerability that affected Equifax Was announced it was you know mid-march There was the spike in the number of people that were attacked number of tax that occurred rose significantly and this is because a Exploit code test code became available and anyone who was anyone could just run this test code And I'll show you how anyone who was anyone could run that test code because I'm about to run it now What I've got if I come back Here Maximilian lots of Star Wars stuff. Yes, it's my Millennium Falcon and my atta and these are these are Legit toys from the 70s, which I got hey Mark. Hey Uday. Hey, Libina. Hey Vijay good to see you all from lots of different places. So sorry. I'm getting there. I'm getting distracted, right? Let's let's go to let's go to my browser From here what I'm going to do is I'm going to show you this to-do application This is a very simple to do application as you can see I can create a to-do. Let's buy my wife some flowers She definitely deserves them flowers. There we go. Let's add a due date of 14th of January 1970 I better make that high I guess add that there we have an idea of 11 We have a title we have a due date etc. Etc. If I click on about We can see all the different tools that that we use here all the different frameworks. We're using struts a vulnerable version We're using spring version 3.2 a very early version of spring We're using hibernate because we love to make poor life decisions So here because we know we're using a vulnerable version of struts We're going to actually exploit that now So I'm going to come back here and on this page here I'm going to show you not in that directory though Let's go back one and into my exploits directory.  Oh No, that was not all I wanted at all in this head as far This is a header that we're going to be sending on a request to my vulnerable struts endpoint We'll see a content type straight away that content type is illegal So we're going to go straight down into an exception path once we hit this endpoint Now it is illegal because of this percent Oops it is illegal because of this percent and brace and there's also a brace at the end there Now when we go through this exception path We'll go through a library called ognl Which as one of the things it can do is it evaluates certain pieces of text to give us a richer Output or for our error messages and that's how one of the ways it can be used now It's going to evaluate anything within this percent brace A piece of text which is great because we've got a bunch of code that can execute here of which We're going to create a new process builder passing in commands The commands we're passing in our bash and bash is going to run a command called cmd And this is just in big letters command. We can substitute this in just a sec So let me go to my Little cruise sheet here Let's grab this one. I'll walk you through this As we run it so I am cutting that file exploit headers file I just showed you we are doing a string substitution and on the command keyword there for ENV This is going to print out our environment variables I'm just going to curl this to an endpoint that endpoint currently is set to my local host But instead I'm going to point that to Figure I'm going to point that to this and This is my to-do application which is actually in fact running on a Heroku app environment So let's curl a Heroku application that to-do list and now that's all we're going to do We're going to send just a plain curl request get HTTP request over to that endpoint We're setting up our header so that we're passing in an illegal content type Which evaluates OJ and I will evaluate a piece of that code if I hit return there Hopefully after setting all that up. There we go. There are our environment variables You can see our Java options. You can see our path You can see our working directory our Java home and a whole bunch of other stuff and believe you me some people not anyone on this Call I'm sure but some people will put sensitive information into their environment variables and an evil person like me evil love Will pick that up and potentially do some nasty stuff with that at this point. I have Execution rights I can write I can execute commands of my choosing And that will run under the process and use the privileges Of the process of the user that is running that process in this case I think this is just a tomcat server or something like that So I am now running under the user of that tomcat service and I can now execute whatever commands I can under that user so that was the exploit Let me come back here and we'll go through a couple more slides and then we'll start hacking again So Lo and behold, this is your application We have a very small circle in the middle and that's your code That's the code that you write in your IDE and then we have this huge amount of code around the edges And these this is all your open-source dependencies and this is very common to see Your your code being the much smaller piece of your application And it's because we leverage so much amazing open-source stuff So here's a great example and why don't I ask you if if I can? To in fact, I can't see it just now that sucks But let me ask you to put your answers in the chat as I go through this There are 19 lines of code in here. There are two direct dependencies and this is just an application which grabs a file and stores it in Amazon's s3 now I'm gonna ask you a couple of questions I want you to put those answers in to the chat and I can't see it right now But as soon as I stop this presentation, I'll be able to see that And I'll be at a I'll be at a maybe give a prize to someone or maybe it will just be some some kudos How many indirect dependencies do you think we have on this application? So we have two direct dependencies how many indirect or transitive Do you think we're gonna have on that on that application? So these are the dependencies that each of those two dependencies will pull in I'll give you a quick second to put your put your ideas in there The answer It's 19 so only 17 dependencies now I can't see the answers right now But I'm sure because this is the Java track and not the JavaScript track Everyone's gonna be trolling on JavaScript and they're probably putting in millions hundreds of millions Trillions maybe but it's just 19. So it's not as bad as it could be however now the next question How many lines of code do you think we're gonna be deploying? Is it this is this is the lines of code in our application there for 19 lines of code in our IDE plus The number of dependencies that we have so how many lines of code are in all of that? Now typically I'm gonna guess right now that some people are putting maybe tens of thousands or a certain number of thousands Some people might go crazy and say let's put 10 million or something like that the answer is in between It's about 191,000 so almost 200,000 lines of code now The key here is don't just look at what's in your IDE the application you deploy is 200,000 lines of code here where the application you see is this 19 lines of code to be very conscious of what you're deploying and of course You're not necessarily going to go through all of those lines of code They may not all be active in endpoints But we have to be very conscious of what we're deploying because what we maintain and what we have to secure is what we deploy It's not the code in our IDE alone How many more slides have I got let me see let me see let me see I'll do it through Oh, no, I don't want to go through too many slides. Let me go through this one How do we how do we then go about fixing this? So we know there are vulnerabilities We know we sometimes introduce them ourselves. We know sometimes Sorry, we know sometimes we introduce them with our pull requests We know sometimes they're introduced in existing code that we've deployed into production We need to know and test at every stage and the key thing here is testing early This is like the typical shift left or giving that Responsibility to the developer to make sure they're empowered enough to test their code before they push to a repo to maintain that When they do get to the repo tests are made so that people can Understand if they're introducing new vulnerabilities and can't regress and also so that when we get to production Even if today there are no known vulnerabilities in our code in our open source libraries and open source Projects even though there's nothing there today What if there's something that is found tomorrow or a week later or a year later? If we're not going through this pipeline who is testing for that and how do we know that these new things have come around? So these are some of the things that when you think about I'm happy to Mean you can see some little SNCC logos here I'm happy to talk about this offline as well if people are interested in learning about how SNCC can do that But let's let's hack. Let's go terminal. So I'm gonna jump To Here we go. Oh, actually, let's have a look at that. Let's have a look at what people thought So actually sir, okay, so so not too bad 20 54 42 14 Leap from Sebi nice one 200 indirect so of around the same kind of the same kind of number as we had 1500 lines of code 29 K from Osama 1850 4,000 100,000. So yeah, almost pretty low Sebi with another ridiculous answer. That's awesome. I love it Sebi Okay, that's cool. That's cool. That's cool Right, let's let's jump to another application. This is actually a node application two reasons one because it doesn't matter too much It's a vulnerability is a vulnerability and we're just gonna exploit a particular vulnerability here called directory traversal And secondly, it's actually more fun to hack nodes because it's easier Well, that's a lie. That's what I say from a Java background. Anyway, okay So this is a to-do list application. I'm gonna buy some milk. That's my to-do. There we go There's my to-do up. There's my little to-do. Let's uh, let's buy my wife some more flowers by wife flowers Add these regular to-do. I can also click on about The bestest to do up ever just an about page which has been served from us as a static file This is all fine now. What I'm gonna do is I'm gonna show you how we can scan this I'm gonna do it from both sides the blue side as well as the the red side So let's go ahead and scan this. I'm gonna go into my integrations This is just using SNCC, but you can use whatever you wish From here, I am going to go into my repo and I'm going to open up goof And what we're now doing is we're connecting to github. We're looking at the the goof application from github and we're now going to we're now going to Try and find the manifest files which are in that application from the manifest files will be able to build up a Dependency graph and we can see where vulnerabilities exist in that dependency graph So if I was to view the lock here, this shouldn't take too long In fact, it's already found that it's already found the bait the Jason package So it's recognized. It's a it's a JavaScript node application and any second now and it takes literally a few seconds It'll it'll we can view the project in fact and hopefully see see the snapshot here Here we go. Okay, so we can see the number of dependencies And this is a great way of looking at your bill of materials You can see direct dependencies, transitive and where your vulnerabilities exist But what we want to do is look at a specific directory traversal And I've a directory traversal here we go a directory traversal vulnerability is one whereby we are we have maybe access to a specific vulnerability and we are looking at how we can potentially break out of that Sorry, we have access to a directory and we're looking at how we can break out of that directory Into potentially a private directory or something like that. So how are we going to do that? Let's have a look. This is coming from an ST module So the ST module is one in which provide it serves public. Sorry serves static content to users So let me go back over to the application How let's ask in the comments. How are we going to hack this? Let's do this together We want to hack this is a directory traversal any ideas of where we even start which part of the application Do we want to attack which part of the application? Do we want to hack? so, so yeah, please do Please do ping in the comments as to as to which page or how I should go about doing that And we'll I'm not gonna hack this you're gonna hack this. So let's let's let's try and let's try and do this together What do you think? Okay, nothing just yet. So the two it's it's there's nothing in the there's nothing. I haven't shown you It's it's these two pages the about page and this page with with looking for For ideas in the input box in the input field in the text box. Okay. What should I what should I do here? Inject code into the data to be evaluated and dot-dot slashes. Okay dot-dot slashes. So dot-dot slashes in here, maybe I Got got slashed to the URL. Okay. Now we're getting somewhere. So which URL the The home page or perhaps our about page if we look at our about page Maybe maybe our about page. Whoops. Maybe our about page is a little bit more interesting So if we look at our about it's got it's got a directory structure in there. So if I come back here Let's go to a fresh Go to a fresh page and let's curl it Okay, so there's our there's our Oops There's a there's a about page. There's our about document. We can see this is the URL I'm gonna do a dot-dot slash. I presume so add Chris Chris Holmes is saying add dot-dot slash To the to the URL so something like this. Okay, hopefully this is gonna work. Let's see if this works Okay, so we can see This is just some HTML we can see by my wife and flowers we see the dot-dot slash we see by milk This is actually the home page Give to do homepage. So what's happened is ST is a ST is a real library. Okay? It's a real library that recognizes. We're trying to do a dot-dot slash So we're on the right lines, but we can't type dot-dot slash because it is looking for dot-dot slash Okay, Mark Harding. Awesome. Mark Harding has suggested replace with percent 2e instead of a dot now percent 2e is as all great hackers know well done Mark Harding is the URL encoding of a dot so if we do a dot-dot as URL encoding what we're suggesting here is That ST isn't going to be looking for percent 2e and it's not going to be normalized because we're sending curl So if I do this bang we have a Directory traversal we can see that because we're outside of the public directory and I'm just gonna quickly go back to my Browser and in fact while I'm doing while I'm gonna show You back in the browser think about what you want me to do next think about as an as an attacker What would you do if you if you just broke in and started looking at this where where would you want to go? So think about that just for a second in the meantime what I'm gonna do is from here I'm gonna do exactly the same thing with percent 2e And 2e forward slash and by doing percent 2e percent 2e here We actually get back to the home page and that is because my browser Normalizes the percent 2e it turns that it decodes that back into a dot before sending that okay as a result as a result The ST directory does see the the the directory So it does see the dots and as a result knows it's a it's a it's a Directory traversal so Marco wants to do something crazy. Look RM minus RF the DB directory So what is this? Let's go back to it. Let's go back to our vulnerability Let's go back to our vulnerability and see what our vulnerability is so fast to come back here We're in Directory traversal right so fast to go into directory traversal and let's click on more about this issue We can see this is our CVSS score. So our CVSS score is is you know the the the score out of 10 based on the how the vulnerability or how by exploiting this vulnerability The how much pain you'd get based on what it can do What kind of build up you need? What is the attack vector etc? And you can see that the scope here is unchanged So what unchanged means is if someone was to exploit this you can be effectively read only you can't make changes To the to the end system. So this is just as a result of us doing this. We can only read so that's a good idea Marco But what can we read? Well, let's have a look in this directory We've got a whole bunch of stuff. So we could have a look at why don't we have a look at the app.js? See our source code here Maybe we do something instead. Maybe we have a look at our package Package dot no, what was it package dot Jason and that here's all our other direct dependencies, which we could potentially Try and find other vulnerabilities to so maybe we could see something like human eyes MS is an interesting one Human eyes MS has a let's have a look at it Human eyes MS has another vulnerability in it Oops Did not mean to do that Human eyes MS. Let's let's do a quick search on human eyes MS human eyes It's got a read-us That's marked fresh marked marked Moment braces Human eyes MS. Okay, human eyes MS pulls in MS which pulls in a Sorry and that has a regular expression Directory traverse so regular expression denial of service. So let's try and hack this What is what is this first of all? Well a regular expression. We know what that is a denial of service We know what that is a regular expression denial of service is by computing a regular expression which takes so many cycles We are we are effectively taking up the resources so much could be computational could be something else But we could cause a denial of service on that thread So let's try and cause an exploit right now. If I go back here What you'll see is if I was to say by milk at this time in 30 sec. No, let's say yeah 30 seconds. No, let's go two days What it's done is it's it's parsed that it recognizes I'm doing in followed by a time and as a result It's turned that into milliseconds so I can maybe do something like a I don't know a Reminder or a notification and then it's just representing it here embraces as 2d So what I could do is provide a string which causes this thing called a catastrophic Baptracking and catastrophic backtracking is where I would do something along the lines of that and This is a string whereby I can type a pattern like a and a number of bees and that will match However, if I type a and a number of bees and then a C This number of bees Can be matched in a number of different ways It could be matched by the plus or it could be a matched by the star or a combination thereof So it could maybe do the first couple with the plus the next couple with another plus because of the star and so on We don't know but as soon as it gets to a C some Regular expression engines will backtrack and we'll try and find all permutations of this B plus B plus star whereby It'll try and match these bees and see if we can find a C at the end Of course that will never happen But it would try and exhaust all those possibilities and as the number of bees in here grows the the number of steps exponentially grow that we need to exhaust so Let me come back here and let's actually try that so what I'm going to do is I'm going to quickly Type MS to I'm gonna just to save my typing I'm going to try and send this I'm going to echo some content It says buy milk in and then we're going to print out 60 Character fives minutes. Okay, and we're going to send that across so I execute that there We go buy milk in and there's 65 minutes. Okay. Is this going to actually cause a? Denial of service well, let's ramp this up to six hundred six thousand sixty thousand Run that again. It comes back very very quickly enough. I was to come back to my Refresh this page you can see the result the requests are coming in just fine despite that being infinity days The requests are coming in just fine. However, the problem here. The reason we're not getting a delay is because this Actually resolves first time it finds the match What we need to do is stop it from finding that match and we can do that by just adding a typo at the end So now it has to pass through all these fives it gets to minutes But because there's an instead of an s here. We're replacing that with an a it's gonna backtrack through all of these fives So if I hit return there we hang we pause I'll come back here and I'll type hello And I'll hit the mic. I'll hit my keyboard hard And display it making a loud noise nothing happened until which time is that times out or the number of permutations? complete and a minute about Now That thread comes back and it executes it goes to all those other It goes to all those other requests so regular expression denial of service through a Sorry a denial of service through a regular expression being way way too long ways you can fix this of course You could you know look at the look at the the string you get and if your string is Anywhere near this size You would you would you know make sure you can't You won't pass that you would you would not even look at it another way is up is you know fixing the fixing the actual vulnerability by Going up to a newer version of your of your library now in this case the vulnerable module is MS the The the library which is pulling in MS So this is our direct dependency is humanized MS at 101 the fix is to upgrade Humanized MS to 102 and this is the minimum version which pulls in a fixed version of MS Okay, so now if I was to go in and click fix this vulnerability The idea of being this is going to now send a request back to back over to GitHub and Let me just click now open a fix pull request and we'll see We'll see this, you know working nicely in in conjunction there So I click on files change you can see the file That we changed there one zero two versus Versus one zero one what you'll also see is a number of other things in that I am making checks on all of my all of my You know Changes to make sure our Delta Doesn't get doesn't get affected. So are we introducing any new changes? into into you know into our repository based on this pull request and those are both licensed changes and and SNCC in terms of the Vulnerabilities so we can do this at various stages here. I've shown you the The repo you can also fast to come over here. Maybe and say let's do this via a repository here is Here is that Java goof Java goof application, which I've just got in IntelliJ. I've done a quick scan You can scan whichever Maven project you want and you can see all the vulnerabilities here And I can click on one of these to say let's upgrade a specific version The suggested upgrades are always given here And I can just kind of like come a long click and it'll show me which motion I need to upgrade So this is super important But I think there are a number of other things other than tooling which is which are extremely important and that is that our thing that our thing is like, you know Changing that mentality to pulling security in earlier in the development environment having security mavens that exist in your In your development team so that there are individual developers that recognize and understand that you get that you know, you get much much You know more Experience and expertise in the develop in the development stage also code reviews are absolutely key making sure that when you go through a code review You're not just looking at code of your that you're writing but also code that you're pulling in one other thing Actually, I'll show you is If I go to my pull requests One other thing that's really really important and I'll show it in snick here But you can you know, you can do this however you like is what happens when you get a vulnerability that is That's existed for ages in your production environment, but that hasn't been known Well, one of the things that we can do here is raise an automatic pull request So this is an automatic pull request, which you know, you're just kind of like running in the background By that's happening automatically. You don't actually have to put anything through the pipeline and what you'll see here is A file change that has occurred This is the this is the smallest version jump you can get which includes this fix And this is that the product has had vulnerabilities that couldn't be fixed or couldn't be patched because no upgrade was available But now and your upgrades have been made available and as a result we can automatically we automatically send a pull request Which can patch that very similar if it's a new vulnerability that wasn't known previously So there's a whole bunch of other things like this that can be done, but it's all about making Putting security into the developer flow and the developer workflow That's that's everything I've got to say. I hope I hope you enjoyed. I think I'm pretty much at time now I hope you enjoyed. I hope you enjoyed the session and Happy to take questions If if there are any Simon you are perfectly on time. Thank you very much. Excellent. Yeah, British as usual In the chat Yeah, the last one Question sneak sync sneak sneak versus white sauce bolt. Okay. Yeah, so white sauce again an SCA tool So now we know right seby. That's what snick stands for Yeah, white sauce is a is a another tool that does similar things from our point of view we have Our the way we work is from a very developer first oriented way so Everything that we do is focused on developers and I think if you was to try both together You will you know enjoy the snick The snick way of working the way it allows you to do things in a much in a much more kind of like developer friendly way we also have in in certainly in my opinion and also a number of other people who are who are Who are using our database? We have a number of major groups using our database We have an entire security team which really do some amazing work in both finding new vulnerabilities and also working with Vendors that do that. So I think I would say our vulnerability databases more complete in that sense as well But I would say, you know, it's all about user experience and I think you'll find if you use snick You can you'll see the differences. It's very much more like a yeah, would you use? I would you use IntelliJ or would you use Eclipse? It's all about that user experience So give give that a go and I think you'll find out, you know, there's significant difference in terms of the usability Amazing. I couldn't see any more questions in the chat Well, Samo, I was amazed by what snick can do. So yes, maybe I should run it on my projects Absolutely, if it's they are vulnerable Absolutely, and yeah, if you if you want, you know, it's in it's entirely we have paid plans But it's entirely free just to go ahead and sign up and you can use that both that Both, you know, as I've shown in in the in the repo as well as with Docker scanning We're already integrated with with Docker on Docker desktop and things like that So you're more than welcome to kind of like try all that out for free and use that month on month So please please do go ahead and try it out awesome So in a well in in behalf of the definition organizing team Thank you very much Simon for this amazing presentation and I hope to see you soon in the next opportunity Thanks very much a pleasure pleasure to speak to thank you for having me


Welcome to Nation Beat. I am General Novel bringing you this brief on the pulse of our nation and highlights around the heart of St. Lucia. The Eastern Caribbean Supreme Court takes another step towards modernization with the e-litigation portal. The first synthetic plane field on island is nearing completion and quail heritage month at Fido Beach. The integrated electronic litigation system e-litigation is the next step forward in the increasingly sophisticated use of technology in the courts. The Eastern Caribbean Supreme Court through the Office of the Chief Justice is implementing an e-litigation web portal within all courts in all the OECS member states and territories for the electronic management of cases. This new system replaces the judicial enforcement management system. The e-litigation solution is a web-based online application that will provide court users and stakeholders with access to assigned services anytime, anywhere and on any device including smartphones, tablets, laptops and desktops. ECSC's Chief Registrar Michelle John-Veebles explained that the courts have been anticipating the e-litigation portal for years now. We needed a platform with refined features which allowed electronic filing, electronic case management, electronic notifications, payments, docket or cause list preparation, designated judicial and attorney access and so many more e-capabilities. We needed an application which was custom made for our court, taking into consideration our peculiarities and needs while serving as a platform to improve the delivery of justice to the citizens of the OECS and to improve the operational efficiency of the courts, both at the appellate and original jurisdictions. The ECSC's Chief Justice, her ladyship Dame Janice Pereira, indicated that the ECSC wanted to find a solution that would leverage cutting edge communication and internet technology to better manage and improve inefficiencies. A number of assessments were carried out as well as examining various systems to decide which would work best in the favor of the court. But this is not just about us, the judges and other officers of the court. It is more about the significant benefits that it brings to the people whom the court serves across its nine state jurisdiction. I am keenly aware that not all of us embrace change with ease. Some of us may think ourselves too old, but change is really the only constant. And so, if we are truly to remain constant, we can only do so by embracing change. Crimson Logic, a Singaporean government-connected company with a proven record of accomplishment in creating websites for courts around the globe, was charged with the responsibility of creating and maintaining the illitigation portal. The portal was launched firstly in St. Glutia on Thursday 25 October 2018, with the other member states and territories to follow. The local football fraternity will soon bolstate off the art facilities as the first synthetic playing field is nearing completion. Here's Ryan O'Brien with the details. St. Glutia's first synthetic playing facilities are expected to be completely laid by Friday, with the FIFA-sponsored project in Granivier, Denver, now at an advanced stage. Misut Okutuko is supervising the placement of the surface. It starts with a base. A base is a well-drained base. As you know, we have a lot of rainfall over here. And to make this field playable all times during all the year long, you have a drainage system, which is a build-up, crushed stone sub-base. On top of it, we have a perforated carpet. Perforated means that it has small holes. It gets the water through, so we don't have any surface water afterwards. And now the carpet is laid down on the specifications of the FIFA. And now we're doing the infill. The infill is a material-crashed rubber. Actually, it's recycled car tire, which gives you the specifications for a natural grass field for the sliding resistance, stock absorption, ball roll and all those things. Now we are halfway on the infill process and expecting to be finished on Friday. Lyndon Cooper is president of the Saint Lucia Football Association and he is anxiously looking forward to the commissioning of the new facility. It's definitely going to be a venue for all national teams to train. And the plan is to actually have most likely both the semifinals and the finals of all our domestic competition. But we are actually trying to make it an international-sized venue in the long run. The government of Saint Lucia is currently in the process of establishing synthetic surfaces at certain venues on the island. Ricky Alexander is executive assistant to the minister responsible for youth development and sports. We are very excited and happy to see that similar to what the government is planning to do at various sporting facilities around the island, that you have the FIFA Gold Project on the way with the artificial turf, which is what we are hoping to do in some of the various sites and venues around. Minister Estefan, Minister for Youth Development and Sports has clearly indicated with support of the government as the lead minister for youth and sport development that the government is serious and focused on professionalizing sports. The Souffremini Stadium has been airmarked to be the next facility on island to have a synthetic surface. From the Department of Youth Development and Sports, I'm Ryan O'Brien. This is Nation Beat. Stay with us. Everyone is at risk for getting a foodborne illness. While most foodborne illness cases are mild and go unreported, long-term health complications and even deaths can occur from a foodborne illness. Foodborne illnesses are called by contamination of food at any stage of preparation. If you are a food handler involved in home-based food production, meat, fish, chicken, or a big shop, as a food vendor, how you prepare food can put your customers at risk. Do you know the risks and how to avoid them? The St. Lucia Bureau of Standards can help you. For more information, contact the St. Lucia Bureau of Standards at 456-0546 or email SLBS at candw.lc or visit the website at www.slbs.org.lc St. Lucia Bureau of Standards, making quality and standards our way of life. Welcome back. The National Emergency Management Organization, NEMO, is in the process of reviewing recommendations coming out of a two-day consultation on the revision of the legislation guiding disaster management in St. Lucia. There were a number of priority items coming out of the two-day consultation with stakeholders of the National Emergency Management Organization and other relevant agencies. One such item is the formation of a smaller committee. This committee will encompass key individuals referred to in the act. The committee is soon to be created with a view of tightening up recommendations made so as to, at the soonest, get the new act through the legislative process. Acting Deputy Director of NEMO, Maria Mada, highlighted some of the recommendations. One of the recommendations that most persons would be familiar with is that we are looking to establish a proper name for the Secretary at the office at Bezi. Most of us would refer to it as NEMO, but NEMO in itself is the umbrella body which makes up the whole process. So NEMO in itself involves education, fire, police, the Chamber of Commerce, Met Office and so on. But the office at Bezi is what supports the whole NEMO. It's the administrative link for NEMO. The suggested names include the NEMO Secretariat and the NEMO Coordinating Unit. However, no names have been finalized. Mada added that the progress made was not without its challenges. We can look at the definitions that are usually in the beginning of an act or a bill. What we notice is when we were going through the definitions is that the definitions that are aligned to the, to SIDIMA and another from another organization. So most times the definitions are not clear and that is something we have to see how best we can look at and put into the act. The committee is expected to be formed over the next couple of weeks. From the Government Information Service, I am General Norville. NUSHA has secured the ninth position globally and fourth originally in the recently released Henian Partners Global Citizenship Program Index. The annual report now in its fourth edition provides a systematic analysis and comprehensive benchmarking of the world's most important investment migration programs and has become the industry gold standard for this type of evaluation. The 12 countries were evaluated according to 10 indicators. Reputation, quality of life, a visa free or visa on arrival access, processing time and quality of processing, compliance, investment requirements, residence requirements, relocation flexibility, physical visit requirements and transparency. Each indicator had an equal weighting of 10, producing a total score out of 100 for each country. St. Lucia scored 57. St. Kitts and Nives and Grenada slid slightly down the ranking but they maintained strong scores of 61 and 59 ranking 7th and 8th respectively. Antigua and Barbuda is ranked 4th with a score of 64. Dominica is in 10th place. The programs were evaluated by a panel of independent experts including immigration and citizenship lawyers, economists, sovereign risk experts and academic researchers who took into account a broader range of factors pertaining to each program. On Sunday 28th October St. Lucia Square Hall Heritage celebrations will coincide with global festivities marking International Creole Day. As the weekend begins, activities here will heighten. However throughout the month of October, organisers have been registering success with the various events among them is the honouring of cultural icons more in this report. As part of St. Lucia's solar festival and Creole Heritage Month celebrations, the Ministry of Culture in collaboration with the Cultural Development Foundation, CDF and the Folk Research Centre, FRC, requested Creole activities to honour a musical legend from the Belvi community who has made inspiring contributions towards St. Lucia's musical cultural heritage. His name is Joseph Ramopolion. He was born on the 10th of July 1929 in the community of Belvi VA4. Encouraged by his father, Ramopolion began playing the violin when he was 15 years old under the guidance of his uncle Flood Polion. Flood Polion won the best violinist competition in St. Lucia twice and was recipient of the St. Lucia Medal of Merit Silver from the Governor-General of St. Lucia for the year 2000. Minister for Culture and Local Government, Sanitary Honourable Fortuna Belarus, stated that the Creole icon series gives St. Lucia's the opportunity to appreciate their iconic heroes. So for us Creole Heritage Month is a month where we really get to connect with our grassroots and we're really hoping that St. Lucia's to take advantage of this opportunity to continue to read, learn and understand the history, know who the heroes will in our society and what people have contributed. And I think as we move around the constituencies we see a lot of that happening with the various events that have happened. Senator Belarus also emphasised the need for the youth to be more involved in cultural events. The month of October has always been that month where we celebrate our Creole heritage and we want to encourage people to participate, citizens to participate and to give off themselves and listen and learn. Another important program that we do have is the schools celebrating the Lama Grit Festival. That's happening in an ecumenical service in the community of Grusely. You know, we've talked a lot about getting young people involved within the cultural activities of St. Lucia and Lama Grit has really been one of the programs that our young people have taken to because it happens during school time and then you have a captive audience and so we're quite happy with the response that we've seen from the schools. Creole Heritage Month will accumulate on October 28th with the celebration of Creole Day in designated communities marking the end of St. Lucia's Solarisama Festival. Reporting from the Ministry of Equity, Social Justice, Empowerment Development, Sports, Culture and the Local Government, I am Shavari Marius. That's a nation beat. Join us next time on NTN at 7.30pm with a repeat at 7.30am and on this station as we fill the person heart of our community. You can also catch up with us anytime on the St. Lucia Government Facebook page or YouTube channel. I am Channel Novel.


Hi, I'm Zor. Welcome to Unisor education. We continue course, which is called math plus and problems presented on unisor.com Now this is about solving problems and what's important is these are not your usual problems, which you might actually solve in schools where those problems are usually just to illustrate certain theoretical concepts. Now the problems presented in this particular course are not of that kind. These problems need thinking.  Now these are unusual problems in the respect that you have to really think about how to solve them. Nobody told you how to solve, how to approach even these problems. Well, unless I put some hint maybe in the textual description of these problems. Now all the problems on the website, well actually all the lectures on this website are presented together with textual part, notes, parallel of the video and the notes on the same screen. Well, the notes are basically like a textbook. Now as far as the problem solving, sometimes I put solutions, sometimes I put just a hint or an answer to the problem. During the lecture, I usually present the problem and the solution. So if you are listening to this lecture first, before you're reading the notes, I suggest you to pause the video immediately after I present the problem and try to solve it yourself. It's very important. The whole purpose of this course, Mass Plus and Problems, is for you to think independently first, before you reading or listening to or watching solutions to these problems. Okay, now today we will solve a few geometric problems and there are others. Now I have to mention that there is a prerequisite course for this. It's called Mass for Teens presented on the same website. Now all the courses including this and its prerequisite, the Mass for Teens, including Physics for Teens and Relativity for All. All these courses are totally free. There are no advertisements, no strings at age, signing in is optional. So basically you just consume as much knowledge as you want. We share the knowledge. Okay, so the problems are, I have one, two, three problems. The problem number one is related to a relatively known fact that the geometric average between two positive real numbers is always less than or equal to their arithmetic average. So this is geometric. This is arithmetic averages. And this is a known equation. Now why is this particular equation algebraically can be very easily proven? Because you have to a minus b square is greater or equal to zero because it's a square, right? a and b are let's say it's positive real numbers, which means that a square minus two a b plus b square greater than equal to zero. Which means I will add four. So a square plus two a b plus b square greater or equal to four a b, right? Now this is a plus b square and this is two square root of a b square. Both are positive. So I do the square root from both and a plus b is greater than equal to two square root of a b and two can be brought here and you have exactly this. Okay, so this is an algebraic proof, which is fine. But I would like to prove it geometrically. And that's very interesting actually. If you can just bring together two seemingly unrelated things. Well, personally, I think it's just kind of a beautiful thing in mathematics. If you see that the same thing can be approached from two absolutely different directions, I think it's a very interesting point. So here's the point. Okay, you have a circle and diameter. Click any point and do this. Okay, so this is perpendicular. This is point p. This is point q. This is center of the circle. Now, let's consider this point dividing the whole diameter in two parts a and b. So a plus b divided by two is equal to what? Well, that's the whole diameter divided by two is a radius. So it's basically radius. P o. P o, right? Okay, now I would like to prove that pq is square root of a times b. How can I do that? All right. Well, let's say let's say this is equal to c. pqc. Okay, now consider triangle pqn, which is the right triangle because this is the right angle and triangle pmn, which is also right triangle because this angle is supported by diameter, half of the circle. So this is 90 degrees. But they have a common angle, right? So again, pqn and pmn are two right triangles with the same angle, which means the all angles are the same, which means triangles are similar. From similarity of these triangles, there are some proportionality of the sides. But now consider yet another triangle, pmq and the same pmn. Again, this angle is the same in both, right? Again, pmq and pmn. Both are right triangles and they have the same angle. So again, they are all similar. So what my point is that triangle pmq is similar to the big one and this one is similar to the big one. So all angles are equal between the small one and the big and the medium one and the big, which means small and medium are also similar to each other because they have the same angles. Now, let's just express the similarity in proportionality of the sides. Now, small catatoules A is divided by small catatoules of this medium triangle, which is C, is equal to a bigger catatoules, which is in a small triangle, which is C, divided to a bigger catatoules in the medium triangle B. From which, as you see, C squared is equal to AB and C is equal to square root of A times B. But now, let's just think about it. This is R. P O, this is R. Pq is C, which is square root and radius is arithmetic. Radius is a hypotenuse of this triangle P, PqO and Pq is the catatouse. Hypotenuse is always greater than the catatouse. So perpendicular is always the shortest distance between the point and the any other point on the line. This is perpendicular, so this is the shortest distance, much shorter than this one, which basically means that C is less than radius. C is square root of AB. In case P would be in this position, radius and and this particular Pq would be, if P is here, then O and Q are coinciding, in which case A and P are equal. So in case A and P are equal, you will have equality. In all other cases, you will have the C is greater, is less than or equal to, is less than or equal to R and that's why C is square root of AB. It's less than R, which is A plus B over 2. Genetic average is less than or equal to Arithmetic average and the quality only if A and B are equal to each other, which means Q and O coincide and P is also, P-O is also a radius. All right, so that's the first problem. Next is, I would like to prove something which is very obvious. If you have a triangle and the median Cm is median and angle C bisector, which means these two angles are equal to each other. We have to prove that this is a socialist triangle, which means CA is equal to CB. Well, let's think about it very simply. Now, since Cm is a median, M is middle point between these two. So these two segments are equal to each other. Now, this is a common side between these two triangles, CmA and CmB. Now these angles are the same because it's angle bisector because it's also not only the median, but also an angle bisector. So what do we have right now? We have two sides and an angle. Isn't that sufficient to say that the triangles are equal and therefore CA is equal to CB? Absolutely not. Now, there is a problem with, in the same course, I think it's Geometry 01. So it's in the same course, which is basically about this particular case. I was asking in that particular problem, is it possible to have two sides and all angles of one triangle to be equal to two sides and all angles of another triangle? But Triangles are not equal to each other, not congruent to each other. And the answer is yes. Why? Because this angle is not in between these two lines, two sides which are equal. The theorem, which is proven in the in the regular course of geometry about triangles, about congruency of triangles, quality of triangles, is if two sides and angle between them are correspondingly equal to two sides and angle between them of another triangle, then triangles are congruent. Now this angle is not between these two and that's sufficient basically in some cases to have triangles totally different. I mean they are similar to each other because angles are the same, but not equal to each other. One would be bigger than another, so to speak. And again, the problem geometry 01 in the same course exemplifies this particular case. So this is not a good way to prove what I'm going to prove. We need to find somehow a different proof. So now it's a good time for you to basically pause the video and think about it yourself. And I will present a solution here. By the way, it's a solution. It doesn't mean it's the only solution. There are probably other cases and other ways to prove this, but I'll prove it this way. So let's do it this way. Let's expand the CM, continue it beyond point M to point Z on the same distance. So CM is equal to MZ. This is equal to this. Okay, and connect it. So what do we have right now? Right now these two angles, this one and this one, are vertical and therefore they are equal to each other. Now these two sides are equal because CM is a median. So what do we have? We have triangle CMB and AMD. They have sides and angle between them. So in this case, we can use this theory, which means triangle CMB. I will use equal instead of congruent. In my view, they're supposed to be basically equivalent. I know there is some difference, but I don't think it's essential. It's equal to D triangle D, M, A, D, M, A and CMB. These two triangles, these two, are equal congruence to each other. By sides and angle between them, angles are vertical. Okay, great. Now what do we have? Well, we have from equal, in equal triangles, opposite to equal sides, there are equal angles, right? So this angle should be equal to this one. But this one is equal to this because it's an angle bisector. So we have triangle C, A, D, triangle C, A, D with two equal angles. And in the triangle, from two different and opposite to two equal angles, there are equal sides. So triangle is Asosos. C, A, D is Asosos because these angles are the same. By the way, if you forgot how to prove that, think about this. It's a very simple proof. Which means this is equal to this. Okay, but this is equal to this in turn. Right? Because again, opposite to equal angles, in these two triangles, there are equal sides. Which means since this is equal to this and this is equal to this, therefore these two sides are equal to each other and the triangle is Asosos. So what's creative about the whole thing? Creative is that we have extended this line, C, M, to the same distance. So C, M is equal to M, G constructed this triangle, proven that this triangle and this triangle are congruent. And from this we have angles are the same and therefore sides are the same. C, A, D is Asosos. So if these two sides are the same and these two sides are the same, then these two are the same. That's number two. Number C is a little bit more unusual, I would say. Let's say you have inside this convex polygon. Now, first of all, what is convex polygon? There are different equivalent definitions. One of the definition, for example, is that all inner angles are less than 180 degree, less than pi. Another definition is that from any point you can connect this point to all the vertices, basically to all the points of the whole polygon and the connecting segment would be inside the polygon. So between two points of the convex figures. So let's say this point and this point. If you put the line, it will be completely inside the polygon. And that's basically a more general definition, not only about polygons, but about any geometric figure, closed geometric figure on the plane. It's convex if two points can be inside or on the border connected with a segment and the segment would be completely inside. So any closed line will divide the plane into two parts, inside and outside. So whatever is inside, and I'm talking about non-self intersection lines, closed but without self-intersecting. Inside, outside. So if any two points can be connected with a line completely inside, this is a convex. So let's assume we have a convex polygon. So my question is, let's just put all the different diagonals. All the possible diagonals. And let's just assume that no diagonals are no three diagonals are intersecting in one point. Okay? Okay. My question is, how many points of intersections are? So that's my first question. How many intersection points here? My second question is, you see there are different angles here. This is an angle. This is an angle. This is an angle. This is an angle. So my question is, what's the sum of all these angles? Well, to tell you the truth, when I first saw this problem, I was kind of puzzled. And it's not easy to basically kind of approach this problem. So in this case, I suggest you to pause the video and think about yourself. So let's start first with the number of intersections. How can we calculate this number of intersections? Well, apparently it's not really very difficult because any intersection, let's say this is formed by two diagonals from four different points. So if you take any four points, let's say this point, I'm talking about vertices. This, this, this and this. So this is a quadrilateral. Quadrilateral, this is a diagonal and this is a diagonal and this is a point of intersection. So any quadrilateral, which can be formed from these, in this case, six vertices of the polygon would generate one intersection point. So if you take any four vertices and draw two diagonals, any four vertices and draw two diagonals, you will have an intersection. Which means that the number of intersections is basically a combinatorial problem. How many different groups of four points I can choose from and given? So if you have n points given, and if you remember the course of combinatorics, which I do present at the mass proteins course as a prerequisite. So I'll just use the formula. If you don't know the formula, go back to any textbook or my lectures in mass proteins on combinatorics. Number of times you can pick four out of n is n factorial divided by four factorial times n minus four factorial. Remember factorial is right. One times two times three times z times n. Now let's call it lowercase n. So this is the number of intersections. Okay, great. So now the next problem is how much what's the sum of all the angles which are formed by all these. Now angles are either inside between two diagonals and we can summarize that sum of these is 360 degrees which is 2 pi in radians, right? Plus n goes at every vertex. Now, but we do know some of these and some of these. Some of these is 2 pi times n. 2 pi times lowercase n. Because every point of intersection gives me sum of angles 360 degrees, 2 pi radians. Now, sum of all the inside angles in the polygon is, well, I hope you remember, it's n minus 2 times 180 degrees. Now, do you remember why? Well, let me just remind you. If you have any polygon, take any point. I'm talking about convex polygon. Every triangle is 180 degrees or pi radians, right? So if you will combine all these angles, you will have n times pi. But you shouldn't really count all this, which is 360 degrees, which is 2 pi. So minus 2 pi. So sum of all the angles, inner angles of a polygon is always n minus 2 times pi. So if you will add them together, you will have an answer. That's sum of all the angles. Now, in one of the future lectures, I will use this result to calculate how many different areas I have. If I put all the diagonals, if I have some, how many different areas I have. Now, that's a little bit more practical problem, if you wish, because sum of all angles, I don't see it as a practical problem. But by how many different domains I will divide a polygon. If I will put all the diagonals, that seems to be really kind of a nice geometric problem. And I can solve it using this in one of the future lectures. Okay, that's basically it. So what I suggest you to do is read the notes for this lecture. Don't read the solution even if I put it there. There are some hints, maybe. You can use it or you don't use it up to you basically and try to solve the problems yourself. The whole thing actually makes sense only if you solve problems yourself. Now, whatever solutions you already have, they should really contribute to your repertoire, of your approaches, your techniques how to solve problems. And that's what's very important.  Some problems which nobody else solved before you.  That's the whole purpose of this course called Mass Plus and Problems. That's it. Thank you very much and good luck.