Hello and welcome back to the craft box. My name is Bringson. Today, we're in episode 127 as it was one-on-one death walkthrough last episode. If you haven't checked it out already, we saved fairies, basically. Today, we are starting by talking to the you're going to the Dark Knight and definitely defeating him. I didn't kill it yet anymore. Faint.   And there is something out there in the darkness. Something terrifying. Something that will not stop me.  That's kind of ominous. Jury's, okay, we will put in a couple of prisms. Turn off my phone. That would be handy. And hopefully, fingers crossed we can do this. How much health does he have? 12,000, okay. That is quite a bit. Bum-ba-da-bum, bum-ba-da-bum. Bum-bum-bum, bum-ba-ba-ba-ba-bum. I'm assuming he's going to use Wraith a lot. And Death Ninja Pigs as well. Oh, Scarecrow, hello. Let's see how much this does. 238, interesting. Interesting. Prism, and we will now. Wasn't meant to discard there.  Oh well. Oh well. Faint. Hello, critical. Balance, interesting. Fortify? Yup, I guess. They just always fortified, yeah, they just always do. It's weird. They don't like dying, it's kind of weird. I think that they would love dying, but nope, they don't. Do another faint, and then we will start our blades. Okay, that did just a bit. Okay. I'm trying U, and we will start blading. Yeah, we'll do that blade. We'll do the two single ones first, and then we will do double if we need it, which we will need it. Just whether we get time to use it before we start dying, but it should be fine because it doesn't do too much damage on me at this stage, which is good. Okay, this is what I was worried about, Death Ninja Pigs. Nice wee weakness there. Thank you. Okay. Do another blade. Okay. Three blades, we will need one more. Which we will use this one, and hopefully if we get another one, it should be good to do that one as well. Okay, and we'll use this blade, and then we will hit, because I mean, we're only on half house, so it's fine. Don't do max. Ooh, did max, unlucky. If he does another wild boar, that could kill me. That's bad. That's bad. Yikes. Well, let's see. Don't do dear wild boar again. Thank you. Yay, no fizzle, here we go. Hopefully, if we can throw it, we should be able to kill definitely. Nope, let's see if we can kill anyway. Ooh, yikes. I knew he would be dead, because he had no health.  Yes, you will die, that's good. There we go. Done. Amazing. Okay. Look, I'll speak to Dark Knight. He's got a really weird voice, like really creepy. I think that's quite creepy. Well, I think I know what's quite creepy. Um... She'll let us talk to him. Okay, I'll be back once I'm at the Jebel Walk. Um, okay. I'm with some people. Oh God, that's not good. Yikes. RIP. Um... Hopefully, we can, um... do this. Uh, we need to team up to do this. And, yeah, we've got a Max Storm, so that's always good. Um, so yeah, hopefully, this shouldn't be too bad. Yeah, so he cheats and crits, apparently. Basically, every other round, the Jebel Walk will remove all traps from himself. And, at the end of every third round, he'll cheat past an enchanted new girl which deals 1,500 damage. And, whenever the meteor is past a 200-plus universal trap, it's also applied to the Jebel Walk. So, he, and that stays around for two rounds, I believe. They're all like Max Wizards. It's fantastic. Bum-bum-bum-bum. Okay, um, let's all see. Hopefully, I just realize that the, um... Oh, it was gonna get rid of that shield, but that's fine. That's fine. We'll, um, deal with that. Kind of worried about this, to be honest. Kind of worried. Bum-bum-bum-bum. Glow bugs. I'm just gonna heal, just because I know this will definitely kill. Most likely. And, I don't know what he's doing, but he might glow bugs as well, which would be good. Whew, okay. Which is why I had that shield, eh? Jeez. Um, okay. That's cool, bro. So, yeah, basically, if you have a good team, the Jebel walk isn't too bad. But if you don't, you can be kind of bad. Kind of really bad, so, yeah. Just be careful on that one. Okay. And glow bugs, yay. Yay for glow bugs. Yay for bugs. Nice. Here we go. That should, basically, end it all. Yep, that'll be good. Fantastic. There we go, that's that. Done. And you'll never find out what's going on. Okay. Let us head to the shrine... ...of loyalty or too loyalty. I don't know which one of those don't really care, to be perfectly honest. Okay. And we will go back to Freya and Nolan, and see what he says now. Do-do-do-do. Hopefully we don't have to do too much to appear the, um, the floating... floating rock pathway or whatever it's called. You've defeated the Jabberwock, cleansed the magical rubies, and punished the Dark Knight for his disloyalty. A truly frabulous day. Yay. Dark Knight errant, that's cool. Rise, wizard. You are promoted to Knight errant for your mastery of the virtue of loyalty. Take the hearts of the Jabberwock back to the wild. Deirdre will show you how to restore the hanging stone's bridge. Okay. There we go, we are now... Knight errant third rank that we've got. Which is fantastic. Wild. Hello. And we should hopefully... fix all of the... problems here. And into the weird... right way is this way. Hello. Deirdre, hello again. You look brighter, wizard. Fire Nullin sent you to battle for the hearts of the Jabberwock. What a fight that would have been to say. Take the hearts and touch them to the fallen hanging stone's. The monoliths will rise up and reform the bridge. Okay. Let us do this then. Let us reform the bridge into the weird. And hopefully... we can then into the weird, which will be cool. They were already... up, but that's cool. That's cool. Weird. Usually they rise up, but apparently they don't this time. Interesting. But let's talk to Deirdre again. Okay. Let us hit into the weird. And then we will probably... end of the episode there. We will see what we can see. In the weird. Do-do-do-do-do. If you defeat some Spectres, perhaps the faux-fire lights will know you're on their side. Okay, so this is the weird. Quite, quite big. And we have quite a while, I think. I think, I can't remember, but most likely. Do-do-do-do-do. Tormented trience is scary. They pull from all the way away. But yeah, this is like the scary, spooky place. It's got like pink water and purple water and stuff. It's really spooky. Oh, they're death. Yay, woohoo. So, yeah. I'll end off the episode here. Thank you for watching. Next episode we will... continue on with this. So thank you for watching and to leave a like and subscribe, and if you've already subscribed, press the little bell so you know exactly when I post another video. And remember, craft outside the box.


You know, when I got drafted here in 2016, obviously previous years, it was like 2-14, 3-13. So to really be a part of that first draft class, to turn this thing around, been having winning seasons ever since, just slowly, not slowly, but watching this fan base embrace this city, embrace the team, it's definitely been great. So definitely happy, two-time division champs, but I'm pretty sure everybody's going to come up here, they're going to echo it that, you know, we're not done yet. Season just getting started, so a lot more meat out there on the bone. I didn't like to stick to your business, I just liked the way you kind of focused and did that. Yeah, I mean the entire week we was focused on what our job was and focused on scenarios, anything like that. We understood that obviously the division was on the line and we kind of treated it as such and proud of the way the defense played. Guys were out there flying around, making plays, got some turnovers, got some sacks as well. I think we played really complementary football off of the internal ball that we got from turnovers, so it was great. What is peaking as far as like becoming a championship level defense? Yeah man, I've talked about it previously, you know, early in the year that, you know, we kind of know who we are as a defense, you know.   We feel like we can stop anybody as far as running the ball and guys flying there making plays and trying to get the ball out, turnovers and things like that. We're just a confident group.  So it's been fun for sure. And then what does getting David Long back in the lineup? What does that do for you guys?  He's been out there making plays, so it's good to see him come out here today and obviously get a turnover, which is definitely clutched in the game, definitely happy for him. But I mean, we got a crowded linebacker group now, you know what I'm saying? With Cunningham, David Long and Rashawn, I know Coach is trying to figure out how to get all of them on the field at the same time. So excited to see how that thing plays out. Yeah, I mean, I just think that just our mentality and, you know, all the outside noise saying that, you know, we may not be a good team and eventually a team's going to come in. I think we just handle our business. We just do what we do. The next man mentality that we've been having this entire year where guys have been coming in, getting signed, playing the same week. Guys being out here playing a lot of snaps for us. So, I mean, even that record that we have broke, you know, as many players we have played for our team to still have the success that we've had, it's just a credit to the culture that Vrable and John has built, you know, as far as constructing this roster. Is that the way that, you know, the sense of the idea that we came to see you now? Yeah, I mean, I wouldn't say it is the edge or not, but I think that, you know, it's good to go into next week knowing that, hey, we don't have to worry about nobody. We don't have to worry about if somebody loses anything like that. We go out there, we handle business in Houston, you know, we'll have the one seed. So it's definitely good to be in this position. Usually last game of the year, we're fighting for something anyway. So it's good to go into the last week of the season trying to fight to be the number one seed. Like the position you've got, what you got to lead? Yeah, I mean, we feel like that every single game, you know, if the offense get us a lead and get some points, we feel like we can play with anybody in this league. I think we've proven that, but obviously we had the feeling to do that. So obviously, you know, the offense did a really good job of just not turning the ball over. And I think that's been evident this year that when they don't turn the ball over, we tend to win the ball game. Look at all the adversity, you know, 88 players roster, they have a record for game day, all of the injuries, you know, COVID, everything. How much has Mike Brable just been a catalyst, just keeping you guys eyes on the prize and just continuing to press forward? Yeah, I mean, because at the end of the day, sometimes when guys are hurt, sometimes you don't even recognize it on the sideline. You kind of see, hey, this guy's not playing or even throughout the week, when, you know, we, every team is dealing with COVID, all the injuries we've had. Guys have just been focused on their job and their job alone. I think if we continue doing that and guys keep preaching that we'll be good to go. But I mean, I think we just had a lot of great leadership as well from the players, from the coaches, to the entire organization. I think we just, we're just very hungry. And we was obviously disappointed in how last year, last year ended, and especially on defense. And I just think that, you know, just the mentality this year is just like not satisfied with anything, not satisfied with division champs. We're trying to go win the Super Bowl for this entire city.  A lot of fun. I'm just having a lot of fun just being a part of this entire team.  So obviously being out there on defense, I was kind of joking a little bit on the sideline. I think it's the first time in my career where, you know, I didn't end the game.  You're doing things the right way. So we have to continue to doing that, you know, coming to this clutch time. Obviously, we got to finish next week strong and see who we got in the playoffs. Did you put on the AFC South championship shirt or did you put on the Super Bowl shirt? No, the locker room was like, you know, I'm going to keep that in the locker room, but it was, it was crazy.  I mean, ridiculous people falling and all type of stuff and taking pictures. I mean, we went to division, obviously it's a great reward for all the hard work that we put in this year, you know, all adversity we faced. And you definitely seen as the locker room exploded as we came in, you know, blast music and stuff like that. So it was definitely fun and I'm going to enjoy tonight as well. Trust me.


We're we're focusing on web security and we went through that one aspect of web security is HTTPS and Normally when we're using web browsing we're using HTTPS that application layer protocol and a HTTP message like a get request is created by your web browser on the left protocol stack in the normal case that HTTP get request is sent to the TCP software in your operating system Which creates a connection to the web server? sin sin act act with TCP and then sends that HTTP request to the web server and Eventually the response comes back using TCP Now of course all of that is insecure nothing's encrypted and we don't know for sure that we're talking to the right web server What HTTPS does? it introduces the use of a Layer or a protocol between HTTP and TCP So your browser generates the same HTTP request a get request Instead of sending it direct to the TCP software in the operating system on the right picture. We see that HTTP sends it to the SSL software on your computer SSL is the secure sockets layer Also called transport layer security TLS HTTP request is sent to the secure sockets layer, which then establishes a secure connection to the server and We saw an example last lecture In wire shark that the secure cell secure sockets layer protocol has some steps of establishing a secure connection Negotiating which algorithms we're going to use to encrypt and and to authenticate and then Encrypting the data So SSL does the security functionality everything is still sent using TCP from Browser to web server, but everything inside the TCP packet once the secure cell shell secure shell secure Sockets layer connection is established everything inside the TCP packets encrypted So HTTPS is simply HTTPS using SSL HTTPS on its own is not a separate protocol. It's it just introduces SSL or Sometimes TLS is the newer version so we can encrypt our data, but one of the problems that we have is that To encrypt data We would like to use symmetric key encryption because it's generally faster than public key encryption So to encrypt data with symmetric key encryption both your web browser and Web server need to have a shared secret key So that's the challenge. How does your web browser and web server get a key that they both know So that they can encrypt the data What's the answer? How do we exchange how did it this browser and the server get some random key that they both know? Remembering we cannot send a key across the network unencrypted If I send my keys, let's say from the server chooses a key sends it to the browser unencrypted The attacker can intercept and see my key So that doesn't work So we need to encrypt the key to send it across the network Encrypt the key using what we use public key encryption to encrypt the key and Then once we've got this key at the say at both sides Then we'll use that key to use symmetric key encryption Why use a combination? Symmetric key encryption is much faster So we'll encrypt the key using public key encryption Encrypt all of our data and there's usually a lot of data using symmetric key encryption So we'll look at how that's done and we'll look at some of the problems that arise with that so When we want to provide encryption in web browsing and also authentication It's not just a key for encryption I would also like to know for sure that the other side I'm communicating with is the web server corresponding to the domain www.facebook.com It's not someone pretending to be that web server. So that's the authentication part of it. The problem is The browser and server do not have pre-shared secrets My browser doesn't have a key, which is also known by the server We need to exchange that secret So the way that we do it is we use public key cryptography to securely exchange a secret key and There are different public key cryptographic schemes Some of them are listed here RSA, Diffie-Hellman, Elliptic Curve cryptography I just list them because when we look at some real examples, you'll see their names come up So there are different ways to do it. We'll use a simple example Let's say using RSA Public key crypto is used to exchange a secret key Once both sides have a secret key Then they can use the faster symmetric key encryption to exchange data Encrypt the data with let's say AES and our shared secret key Send it to the other side which can decrypt and It's maybe tens of if not hundreds of times faster to do symmetric key encryption thousands in some cases So that's the approach But it turns out there's a problem with that approach So let's illustrate the approach and then we'll analyze the problem So I'll draw what the typical that the aim is in this case and then we'll see well, what could go wrong in that? so the idea is that we have browser and server and With public key encryption We assume let's assume that the server has its own key pair So a server has its key pair. I'll denote as the public key of S the server and the private key of S the server The browser may also have a key pair, but we don't really need it in this case We mainly use it for from the server. So we'll see how it's used So that's known at the front by the server. It has its own key pair They don't have a shared secret yet. Our aim is to get a shared secret So one approach is that we send a message from server to browser and that message Contains the public key of the server remember for confidentiality using public key cryptography we Encrypt with the other person's public key Right, so if the server has a public key P us in this case the server sends its public key to the browser Because the browser doesn't have it yet The browser is just visiting the website for the first time. It doesn't know the public key of that website so in some exchange the server would may send its public key to the browser and now The browser can generate a shared secret key choose a random number Which is going to use later for encryption and send that secret key back to the server But of course encrypted encrypted using public key crypto So the next step the browser generates a key let's say a Shared secret key K shared between the browser B and the server s and Sends back a response and the response includes the key But we can't send it in the clear so we must send it encrypted Using the public key of the server and when we encrypt with the public key of the server When the server receives this message it can decrypt because the server knows the private key of s No one else does and hence we have confidentiality for that key transfer the key exchange When the server receives that second message it decrypts and it learns KBS Now we know that this is public key encryption because I denote that the key being used is a public key but just to be clear this E here is public key encryption. We've completed the key exchange The browser and the server now have a shared secret KBS So now the data that goes between the browser and server can be encrypted with KBS And it can go in either direction using that same key So we've exchanged the secret now we have some data to send like the HTTP request and the response in both directions we may send messages and We will encrypt the messages Using the shared secret key KBS whatever data we want to send and this algorithm for encryption Is using symmetric key that's the idea with Public key encryption to exchange a key and then symmetric key encryption to encrypt the data Of course, there may be many packets going back and forth containing data all encrypted using KBS This is a common technique for exchanging keys followed by encrypting with symmetric key ciphers Any questions on how this works Can someone learn KBS? Someone other than the browser and server learn the shared secret key KBS What would you need to do as an attacker to learn this KBS? impersonate who if we could impersonate we'll see the server then maybe we can so of course if we Intercept these three messages if I'm the attacker I intercept The first one I learned the public key of the server who cares. It's public anyway. That doesn't help me If I intercept the second one, I can't decrypt it because I don't have the private key of the server So that's no help to me as an attacker And if I intercept the third message or any of the encrypted data again, I can't decrypt because I don't know KBS Because KBS was exchanged using the public key encryption So it just intercepting these messages doesn't help the attacker But there is an attack that involves the attacker impersonating the others and it's referred to as a man in the middle attack what the attacker will do is Be in the middle of the the path between browser and server intercept messages Before they get to the destination modify them and forward them on And the idea is that the attacker the man in the middle between browser and server will impersonate the server from the perspective of the browser and impersonate the browser from the the perspective of the the server Let's see how it works And then we'll look at what we need to do to overcome that So right that was what we're trying to draw and now we're going to try and draw Well, what can go wrong in that exchange a man in the middle attack Start again, but we'll introduce the third entity we have browser server and The man in the middle or a woman in the middle is the attacker and in the middle it means that they can Intercept messages between browser and server. So maybe somewhere on the path in the internet and They can modify those messages as well not just intercept but also modify So what the browser and server do they follow the steps from the previous diagram those same three steps But the attacker will make some changes along the way so again what's known up front the server has a public key and A private key and the server The browser doesn't know the public key of the server So the server sends its public key to the browser. That's the first step But it's going to be intercepted by the attacker. So the normal message sent PUS is sent from server to browser but the attacker intercepts that and Then forwards a message on to the Browser with a modified public key. Can the attacker read this value? Can the attacker read PUS? Yes, it's not encrypted. It's just sent in the plain text. So they see a public key. All right They know it's from the server. It's a public key of the server What the attacker does is changes the value to their own public key Because it's not encrypted and in this case we have no authentication techniques The attacker can make a change without anyone knowing it changes the public key in this message and changes to its own the public key of the attacker and Just to be clear, we should have said that the attacker also has its own key pair Anyone can have their own key pair So it's a message that was intercepted Maybe the from is still from the server the destination is still the browser But the contents has been changed to be the public key of the attacker Any questions on the first attack step? What are you going to do next? question Yeah Right the when I say the attacker intercepts and modifies when the browser receives PUA they still think it's from the server with respect to HTTP then the browser has made a TCP connection to the the The server already so when it receives the message it thinks based on the IP address Maybe it's a fake IP address. It still thinks it's from the server Has no way of knowing whether it is indeed the correct public key or it's the public key of a Because you just receive a message from the server public key. It must be the server's public key What happens next what does the browser do? It follows the normal steps it chooses a secret key encrypts So the browser thinks everything's okay. They generate a secret KBS and They send the response back to the server and the response is Using the public key we just received Thinking it's the public key of the server, but in fact it's public key of a encrypting KBS Send that back to the server Again our attacker intercepts before it gets to the server we as the attacker receive this message Can the attacker decrypt? Encrypted with PUA the attacker knows PRA therefore. Yes, the attacker can decrypt and the attacker learns KBS So we have a problem, but our attacks not finished yet. The attacker has learned this secret key KBS But for the attacker to be successful they must Make the browser and server think that they've set up a secure connection so we continue we Forward a message on to the server Because it's the server is expecting a response. It said it's public key. It's expecting an encrypted Shared secret to come back so the attacker encrypts Using PUS KBS The attacker knows KBS. They know PUS is a public key of the server. They received in the first message They encrypt that and send it back to the server and the server receives what it expects The server sent its public key To the browser the server receives a response Encrypted using its public key of some secret They decrypt because they know PRS and they learn KBS The server now has KBS and the key exchange is finished the key exchange was send the public key receive an encrypted shared secret key KBS and Neither the server nor the browser know that something's gone wrong The server sent a public key received a valid response the browser received a public key sent a valid response What happens next To finish this attack. How does the attacker take advantage of it? What does the Browser do now? Let's say now the browser and server have exchanged a secret so they start sending data to each other The browser sends data to the server and also on the other direction Let's consider from First the direction of it doesn't matter which direction. Let's say the data Is sent from browser to server. Maybe the HTTP get request. We're using symmetric key encryption. We encrypt Using the shared secret key KBS Some data The browser sends that to the server, but again our attacker intercepts Can the attacker decrypt? Yes encrypted with KBS the attacker knows KBS. So the attacker learns the data They learn the data and to make the browser and server think that everything is okay. They send it on to the server The same encrypted data or they can modify the data if that's their aim server gets the data The browser has sent the data But unfortunately the attacker also gets the data So everything sent between browser and server and similar in the other direction Is intercepted by the attacker and they can decrypt all of that data So this is our man in the middle attack The man in the middle the attacker has pretended to be the browser and server and In doing so learn the shared secret key KBS and Therefore can decrypt all the data They can decrypt data. They can modify data and it go undetected because they know the keys now This is a problem any questions about the man in the middle attack How to conduct it, okay What went wrong? Why why was the attack successful? What's the the problem with what the browser and server did? they Used the same key all right, but what what was what led to the problem that the attacker learned KBS What was the step here that was? The the the floor in this this protocol for exchanging a secret Which one do you think is the problem? public key of The public key of the server Was sent in that very first message the server sent its public key to the browser the problem was the attacker Intercepted that and changed it to another one Without the browser knowing That's the problem The browser receives a public key saying this is the public key of the server But it's in fact the public key of the attacker and When the browser encrypts something using this public key It's not aware that the attack is going to be able to decrypt it So the real problem problem here is receiving a public key without having to Without being able to verify that it is indeed the public key of the server We need a way so that the server can send its public key to the Browser when the browser gets it the browser can check and confirm for sure That this public key is that of the server. It's not one of the attacker How can we do that? How could we send some value the public key in this case? Such that the receiver can confirm for sure that it is indeed from this server a Signature We need the server to sign the message Or someone to sign the message just to confirm this is indeed the public key of the server Now the server signing the message won't help if the server signed the message with its private key Then the browser would need the public key of the server to verify But our problem is that the browser doesn't have the public key of the server If the browser knew the public key of the server, we wouldn't have no problem So what we do because when you open your browser you visit a new website You don't have the public key of that website. You've never been there before their public key May change on a regular basis So we need some way to distribute that public key But we need it to be signed So what we do is we get someone else to sign it We get someone else to sign the public key of the server saying this is the public key of the server When the browser gets that signed public key the browser verifies Using that someone else's public key that it is indeed the the real public key of the server So the signed public key Will see is a certificate We'll see the steps for signing it in a moment, but we'll introduce the little bit more detailed terminology and Notation so the man in the middle attack is the problem here It allows us the attacker to discover and decrypt all the data So for web security, we need something more than what we did in our protocol. We need some signature and The the signed public keys will refer to as certificates with digital certificates so the step the server Creates a key pair PUS PRS like in our initial step. We needed a public key pair But then What the server does is the server contacts some other Entity will call a certificate authority CA for short and This certificate authority will sign The public key of the server The idea is that the authority confirms this is the public key of the server When the browser receives this signed certificate, it can verify. It's the correct public key How do we sign something? So the approach is that we're going to sign the public key of the server. How do we sign a value? Write an equation for signing the public key of the server hash Hash of what remember how we do a digital signature. What do we do? We covered it in the previous lecture hash of the data and then encrypt the hash value with Private key of the signer. Okay, so we we hash the public Public key in fact here what we want to do is not just hash the public key What we want to do is include the identity of the server something that IDs or unique uniquely identifies the server So the concept we will see is that we hash We have the make some more space The concept of signing We'll see a little bit more detail for a certificate, but the concept is that we have The identity of the server How can we identify a web server? What thing do we commonly use to identify a web server? If I wanted you to tell me about the Facebook web server, what address would you tell me is that of the Facebook web server? Tell me louder What's what's the name of the Facebook web server? Not Facebook. There's a bit little bit more precise Facebook.com Okay, or A domain name all right web servers are identified by domain names So when I say the ID of the server in practice, we'll see it's a domain name So the ID of the server is combined with the public key of the server This just means concatenate or combine them together join them together So we have a domain name for example and a public key of the server we want to sign that and Remember to sign something we calculate the hash of that and then We encrypt the hash value with a private key example of the ID the example of the public key are not right, but It could be a you've generated in one of your homework say a 2048 bit RSA key One of your homeworks you generate your your public private key pair So that's what would be included here the public key of the Facebook web server Now we will add one more item to what we sign with a public key They may change over time So a public key has a lifetime So I may generate a public key today and maybe it has a lifetime for one year and One year later. I'll need to generate a new public key so We will say that we'll include another piece of information a timestamp or some time information about I'll just denote it as t here the timestamp For example, it may include the start date and The end date of this key in other words this public key This 2048 bit RSA key belongs to Facebook or more precisely www.fb.com in my example and this key is valid from this start date and Up until this end date Don't trust it before the start date. Don't trust it after the end date. So we have a period of That it's valid for so I just denote that in short as the timestamp T So that's the main information that we need to sign This would be generated by the web server. It knows its own domain name. It generates its own public key It knows it sets a start and end date We calculate the hash of all that information and then Encrypt that with a private key Who's private key when we want to sign something We use the sign as public key who's going to sign let's consider what if the server signs This public key So if the server signed their own public key Then we've got two problems one is that The browser doesn't know the public key of the server to verify That was our problem the browser doesn't yet know the public key of the server if something is signed by the private key of the server We will need the public key of the server to verify that but we don't have that so we can't verify it and In fact if it was signed by the private key of the server There's nothing to stop to someone else to create this signature maybe Steve comes along says the ID of My idea is www.facebook.com. I generate my own public key It's definitely not Facebook's and I sign it myself Then there's no way to For the receiver to be sure that it came from Facebook or me So we can't self sign here. We need to sign by someone else So we signed by what we call an authority Or a certificate authority to be precise Someone else signs this I'll denote the private key of the CA the certificate authority maybe it's also a This is this is also maybe a 2048 bit RSA key The private key but of a certificate authority. That's the general name and In fact, we'll see that later. There are different companies and organizations that act as certificate authorities One of them you may see that comes up Verisign is one Komodo many others We'll talk about them later So that idea here is that The server is going to send its public key to the browser that was the very first step that we needed The server sends its public key to the browser But with the man in the middle attack the attacker can modify it to anything it likes. That's the problem To overcome that problem The server is not going to send the public key on its own. It's going to Include its ID its timestamp and get that public key signed by someone else This someone else is called a certificate authority and the idea will be When we send this signed value to the browser the browser will be able to verify that it came from It is that of the server As long as it has the public key of the authority this part is the signature I'll just to know the signature component is here and Normally we don't just send a signature We send the real data with the signature attached questions on how we generate this signature when you access a game when you're Using line or Facebook on a mobile app if they're using HTTPS they are obtaining this signature all the time Because your browser or your application doesn't know whether you're communicating with the right server or not Any questions on how to generate the signature? The signature here is the ID of the server the public here the server some time values or timestamps Signed by someone else so we need to talk about who that someone else is in a moment But let's call them the certificate authority what we do This signed value which I just wrote down is this component here Timestamp public key of the server ID of the server hashed Encrypted with the private key of the CA that's the signature component and We of course attached the signature to the data The data was the ID the public here in the timestamp all together See there are four parts ID public key timestamp signature All together what is that called? What do we call it? What do we call CS? CS what is it? Very important part in web security when you set up your own website. You must generate this CS is what we call the certificate of server s It contains the server's identity like their domain name their public key some timestamps saying how long this certificate is valid for and This part at the end is the signature of all of those three data elements This certificate of the server is signed by who? Who signed this the certificate who signed CS? Have a look it's in there somewhere who signed it who signed CS Have a look on the equation there Don't say server. It's wrong. What's a signature mean encrypt with Encrypt the hash with which key? Private key of the signer So who signed CS? CA the certificate authority So be careful here. It's the public key of the server Signed by the authority the certificate authority in lawn It's like you coming to me and saying here is my public key and I sign it as the authority Confirming yes, this is your public key and now you have a certificate and you can go to other people Those other people that trust me They see my signature Know it's your public key and that's how we'll use it in web security So we say that the Certificate of the server is issued by the authority the certificate authority. This is the concept There's a more detailed Specification of the format of such certificates the the standard for what to include here It's more than just these values and it has a particular structure is referred to as x509 We will show you some real certificates later, but And we'll see they're in x509 format, but the concept is captured by this one. Let's see how it works With respect to our browser and server We have our browser server We will not show the attacker yet to start the server has a certificate and it's a To note it as we'll write it in full CS ID of s You don't have to write down the full one. It's on your slide the public key of s timestamp and Encrypted with the private key of CA The hash of what what's here these three values I'll not squeeze them in there We take the ID the public key and the timestamp We hash them Encrypt with the private key of the authority And this is the signature component. This is the data component That's what the server starts with and the concept is that we instead of sending the public key on its own to the browser We send the certificate instead What does the browser do when it receives the certificate? The server has just sent its certificate to the browser. What would the browser do? Remember our aim is like the previous protocol exchanges a key KBS But now we're using a certificate the certificate contains P us That's what we want to learn the purpose here is for the browser to learn the public key of the server It's included here Is the browser sure that this certificate is indeed the certificate of the server and not an attacker Well the way that we try to check if We have a signed value we verify the signature How do we verify the signature? Remember back to the basic concepts of the signature if we sign it with a private key of a user to verify We decrypt using the public key of that user So we try to verify the signature So the steps we take at the browser we receive the certificate and then to verify We decrypt Using some public key The signed component I'll just write the signature Because I can't fit it all in the signature is this component Be careful the encrypted part is the signature. This is the data component So we take the signature we decrypt which with which key how do I verify the signature who signed it Signed by CA therefore we should verify with a public key of CA and Here's an important point of the how certificates are used in web security The server sends its certificate to the browser to verify the browser Decrypts the signature part with the public key of the authority But we have a problem We meet need to have the public key of the authority to do this verification Where do we get the public key of the authority from remember our Original problem when the server sends its public key to the browser the browser is not sure if it is the public key of The browser or the attacker So we're using a certificate To verify that certificate we decrypt with the public key of the authority Therefore we need the public key of the authority. Where do we get the public key of the authority from? We ask the CA to give for the CA to give us its public key and How do we send public keys now? Instead of sending a public key on its own what we're going to do is send a certificate Really a certificate is a signed public key The certificate is the public key with some other information Confirming by someone else that it's the public key of the server So in fact, where do we get the public key of the authority from? We need to get the certificate of the authority the public key of the authority would say it comes from the certificate of the CA Where do we get the certificate of the CA from? Where do you think it's going to come from? From the CA what do we do? We send a message to the CA and say please send us your certificate They send the certificate of the CA who signed the certificate of the CA The CA signed its own certificate the problem with signing your own certificate is that You need the public key To verify it How do you know someone else didn't generate that certificate? We still have the same problem If we ask the CA for their certificate Then we need the public key of the signer to verify it. We want to verify everything we receive So we have this recursive problem To verify The certificate of the server. I need the certificate of the authority To verify the certificate of the authority. I need the certificate of someone else But to verify their certificate. I need the certificate of someone else So we have this recursive problem to stop that at some point we must trust a certificate and not verify it and In practice what that means? Normally your browser has the certificate of the authority loaded into the browser When you install your browser on your computer the creator of the browser loaded in some pre-existing certificates of authorities and We say that they are trusted So in this case It's trusted or known in advance The server sends its certificate to the browser To verify we need the public key of the authority or we need the certificate of the authority Instead of asking the authority for that The simple approach is we'll assume that the browser already has it When you installed your browser it was programmed into it to include some certificates of authorities In other words, we must implicitly trust this certificate if we do trust it Then we can verify and we verify we find that it it works and Now we learn the public key of the server and Then we can continue with our other steps of sending the response or the generating KBS This is the second state of step of our protocol and as before We select a KBS and we encrypt that Using the public here of the server When the authority receives that message it can decrypt and learn KBS and Then subsequent data can be encrypted using KBS Let's recap and see what What we've done and why we did it. So let's go back to the attack from the start The normal idea was the server sends its public key to the browser The browser generates a shared secret key KBS and Encrypts that using the public key of the server sends it back to the server. So they both now know KBS That was our our approach But we had a problem We were subject to a man in the middle attack if the server sent its public key to the browser, but the attacker intercepted We had no way for the browser to know if the public key was modified along the way So the browser may receive a different public key and if they do Then the attacker can then learn KBS So the man in the middle attack the problem was that the received public key was not verified So the solution we're using We don't send the public key on its own We send the signed public key and the signed public key is referred to as a digital certificate The public key as well as the identity of the server the time stamp to say how long it's valid for is Signed and a signature is simply hash Encrypt with a private key We say the public is signed by an authority It's the authority confirming this is the true public key of the server The server therefore sends its certificate to the browser CS It includes the public key but before the browser uses that certificate the public key it verifies and the verification approach involves using the public key of the authority and At this point we assume that the browser knows the public key of the authority It was maybe programmed in the browser such that they can verify Once they verify they know it's the real public key of the server and then can send KBS back Encrypted with the public key of the server and that's the general approach we use in HTTPS web security We issue certificates to servers and they send the certificate to the browser Those steps are summarized here the certificate of the server The server sends the digital certificate to the browser The browser verifies the signature Using the public key of the CA, but there's a little bit of a problem there To get the public key of the CA we must have the certificate of the CA But that needs to be signed by someone If it's signed by someone else then we have this recursive problem at some point there will be a self-signed certificate See the certificate of the CA contains the public key of the CA Signed with the private key of the CA this allows the browser to verify and The browser to get the certificate


Creative writing activity for the ESL classroom, travel itinerary. Individually or in small groups, students choose a place they want to travel to, either within their home country or abroad, and write up their dream travel itinerary. In addition to the imaginative aspect, you can help students practice practical skills by requiring them to look up and include things like real bus departure times, real hotels, or short descriptions of sites they want to visit. You can format this activity in a variety of ways to match the language levels of your students. For example, students at the elementary or pre-intermediate levels could create a table of each travel day with a short simple schedule of their plan for each day. Meanwhile, students at the intermediate or advanced language levels could write full or more detailed descriptions of their travels. If you wanted to expand this activity a little bit more, you can have students present their travel itineraries to their classmates in order to introduce each other to different destinations. Thanks so much for watching. We are ITTT the leading provider for TEFL and TESOL training courses. If you like this video, please subscribe by clicking that button down here and click on any of the videos here on the left for more interesting teaching tips for getting certified to teach English abroad and online.


We were in a tough battle and we were going to win it and we're not going to take anything from the SS. The SS were the ones that were bad, they were the ones that killed all these troops and we were going to get even.  You got problems. The battle was very hard and the weather was horrific. The atmosphere there was, we've got to do this, we've got to beat these people. We want to get this thing won and get it over with. The battle started on the 16th. There were very tough fights through all the villages. And the entire ball from there on was just nothing but one slug mass continually. Anybody that says they weren't scared is a liar because I know a lot of tough guys that just as scared as I was joined the service when I was 15 and worried about my age to get in. But like everybody else, my occupation was chosen by the Army for me. It was an exciting thing to ride along in a tank and I don't know, you kind of felt like you were king of the hill or something. That attitude when you were a kid, you know? Daredevil was a radio call sign. There's always a continual push, push, push, push. Therefore, we didn't get a lot of sleep. We didn't get a lot to eat. And we were very stubborn about the rest. Even if you're moving slow, you're pushing because you don't have to keep the enemy on their heels getting them moved out or killing them. Everything with the 82nd Airborne that our unit was, we're going to win this thing and we're going to win it our way. It reminds me of something happened in the bulge. A friend of mine was a tank commander. His tank was going down a firebreak one night and he came face-to-face with this Tiger Royal tank, the biggest tank the Germans had. Generally, if you come face-to-face with a Tiger Royal tank, that's the last thing on Earth you see. But in this case, nothing happened. He thought, well, maybe there's sleep inside. So he fired a star shell over this tank. And sure enough, when it lit up, the crew must have thought they were on fire because they all bailed out. Well, he was up in the turret with a .50 caliber machine gun. And he fired and he killed three of them, wounded one and one ran away before he could get them. He captured this tank and he radioed back to battalion and said, I captured this Tiger. He said, it's run and I'm going to take this sucker all the way to Berlin. It just seemed like the weather was against us. The Germans coming through Belgium had stopped at the town of Malmedie. It just so happened that part of the 7th Armored Division was passing through what they called Five Points, which is a point above Malmedie. When the Germans got there, they captured something like 92 American troops that were part of a convoy that was passing through Five Points. They captured them, had them stand with their arms up, and then they machine-gunned them and killed every one of them. There were five who made it, who escaped. And they came down to Malmedie and told the story of what happened. When that word got out there, all the troops, all of a sudden, the atmosphere, the morale, everything changed. Luckily, we were with the 82nd Airborne, as far as we were concerned, the best outfit over there. And we were going to get even. We had a high respect for the infantry. They were the guys that did the dirty work. We helped them do it. When it finally ended there, in the balls, if somebody would have told us at that time that that was the end of the ball, we probably would have said, so what? Because that portion of the fight was over, but that didn't mean that you then got a rest. You just kept going. That just meant we were going on into something else. January 25th was still cold, but we knew that even though it was cold, it was not going to be like it was before. We thought we were doing pretty good when we got the Siegfried Line, because of course the Siegfried Line was the entrance into Germany. That little ball was tough. Don't get me wrong, but the Siegfried Line was equally bad. Once we crossed that line, we were in Germany, and that's where we were headed. That made us feel good.


This is stock number AT338A, we are here at Summit Automotive in Fond du Lac, Wisconsin, your new and used Ram and light duty truck headquarters. Today we are checking out this like new 2018 Ram 1500 regular cab long box eco diesel. From this HD video you will be able to tell that this truck is extremely clean all the way around and it should be with only 30 miles on it. White silver is the color and we shoot all of our videos in 1080p 60 frames per second so if you have HD capabilities on your computer tablet or smartphone device and want to see just how clean this truck is turn them on right now because it is like you're right here looking at the truck with me and definitely your best way to check out the vehicle before seeing it in person. If you want to check out more pictures of this truck on the upper right hand part of the screen is a link to our website so click that and check out those photos. 17 inch painted alloy rims like new Goodyear Wrangler 26570R17 tires with just about all the tread lock. You can still see the little wear knobs on it because there are only 30 miles on this truck. Headlight lens is absolutely perfect no dents or dings on the front bumper and you may ask why are you doing a video on a truck with only 30 miles on it because even brand new vehicles sometimes are not perfect and we want to give you the most accurate representation of the vehicle as possible so when you get here there's absolutely no surprises. No scuffs or scrapes on that rim and as you go down this side of the truck you can see just how clean the body is how reflective and mirror like that paint is and this truck is pretty much pretty much perfect I've seen it all the way around a couple times now I didn't see any dents or dings on it whether you're close by or far away you want to make sure you get the most accurate representation so you can do your buying and shopping from the comfort of your own home in fact we offer a summit auto fast pass option where you can apply for financing get a payment quote and even appraise your trade right on our website so that when you get here all you got to do is drive the truck and love it. It has the plastic wheel well liners which keeps your frame and under body looking like new back tires have just as much tread as the front tires four wheel disc brakes and the back rims are in excellent shape as well as we come around to the back of the vehicle your bumper is in absolutely perfect condition no dents or dings in that full towing package which includes receiver hitch four pin and seven pin wiring the tailgate is in excellent shape bright silver metallic really a good-looking color it does have the locking tailgate and backup camera has the factory spray and bed liner in the truck and that is an excellent condition and down this side the truck just as clean as that passenger side no dents no dings no scuffs no scrapes definitely a like new truck back rim absolutely perfect and no dents or dings on the door inside the tradesman package gives you the gray cloth interior there are no rips there are no tears on these seats side current airbags does come with the rubber floors manual crank windows auto headlamps and as you hop inside the truck here there are indeed only 30 miles on this truck has the digital speedometer outside temperature display steering wheel is absolutely perfect cruise controls and gear selector on the right information center controls on the left this one does have AM FM and Sirius XM radio capabilities at your turn dial eight-speed automatic transmission your push button four-wheel drive factory brake controllers stability control your backup camera shows up in the rear view mirror right there passenger side floor and seat are an excellent condition you do get the latch child safety system and a storage bin back there and if you're looking at getting a fleet of these type of trucks we actually have three other ones exactly like this truck in stock in fact they are right there so if you wanted to buy three or more definitely able to accommodate you on that I'd like to thank you for checking out the video today and hopefully from this HD video you'll been able to tell just how clean this truck is all the way around inside and out and it should be with only 30 miles but we want you to be 100% positive so you can make that trip under the hood we have the three liter Eco diesel engine base very clean runs very smooth this truck is 100% ready to go and to see more pictures of this truck or one of our other 450 new and used cars trucks SUVs minivans Wranglers half tons we quarter tons one tons you name it we got it go to our website www.SummitAuto.com full pictures and descriptions of every single vehicle from two locations all at SummitAuto.com and if you'd like to check out more HD videos you can go to youtube.com slash summit auto remember to like subscribe and share on this video and all the videos that you see there in fact in a second you will see link to subscribe to our YouTube channel on your left it links more half-ton truck videos like this one on your right if you have not been to our website on the bottom a link to this vehicle on our website click those check us out and we really look forward to helping with this like new 2018 ram 1500 regular cab long box eco diesel thanks again


Thank you very much for joining. So in the next 40 minutes, we'll be talking about free and open-source software tools for making open-source hardware. My name is Leonon Avie and I'm a senior software engineer at Consulco Group. The company I work for provides consultancy services for hardware bring-up of embedded devices. But I'm here to talk something a little bit different and it's not just software, it's both software and hardware. The agenda for today spreads in three directions. First we'll speak about open-source hardware. After that I'll share some experience that I have with free and open-source software tools for designing printed circuit boards. As I said, I'm a software engineer so I do this as a hobby. But I want to do an overview of the tools that we have that are free and open-source to do this job. And finally the third direction and the final part of the presentation is about making cases with 3D printing services and using free and open-source software CAD. How many of you are familiar with open-source hardware as a term? Can you raise your hands? Oh, that's perfect.  Just for the record, I have to say that open-source hardware is quite similar as open-source software. So the idea is to share the design of a physical object that is publicly available so other people can benefit from it. For example, students can use it to educate. Other people can modify the design, even sell it. And the open-source hardware movement is getting some traction in the recent years. When you have a physical project that you would like to share in terms of schematics, in order to make it open-source, really open-source hardware, you need to pick up a license. It's the same workflow like with open-source software. And you can even use some of the licenses that are available and popular for software. But since software is different from hardware, I recommend you to pick up a license that covers better hardware. I have listed here some of the popular licenses that I have seen in open-source hardware projects. Of course, these are just a few of the licenses there. There are a lot of other options. You can even make your own license that fits perfectly for your product. If you're not sure, just have a look at the other open-source hardware projects. Read the licenses and pick the one that's you two best. In my case, I prefer the Creative Commons open-source licenses for hardware products. What are the benefits of open-source hardware? The first thing is that it gives confidence that the design will be available even if the original manufacturers stop producing the device. It's a common case in the industry that some companies make a product after a decade. This product is no longer on the market, but there are still systems that are based and using these devices. This could be a problem for maintaining a system based on certain hardware devices. With open-source hardware, you can be sure that you will not be in this embarrassing situation when you have a system that's running smoothly, but the hardware is not there on the market because if this is an open-source hardware, you can make it on your own. The second thing is that open-source hardware is putting pressure on the price to be low because when you have an open-source hardware product, you know the bill of materials and, come on, we are all engineers. We can go and check what's inside. We can see the parts and that's how we can see if the price is fair. Open-source hardware is about making fair prices as well. Another benefit, and this is probably the most important in terms of embedded devices, is that you can customize the hardware. You can make your own devices by getting the original hardware, by contributing your changes, customizing them on top of what has been already shared. It's all about sharing knowledge, educating people, and getting feedback from the community. For small companies that are making open-source hardware, this is really important because this is how they can get feedback from high quality engineers and they can improve the product that they're providing to their customers. Who is making open-source hardware? I bet you all know these names and speaking about open-source hardware, I believe number one should be Arduino. It's widely popular. Everyone knows it. It was one of the very first embedded boards that became so popular and it's based on open-source hardware, which means that anyone can manufacture it. Of course, the Arduino is a trademark, so other manufacturers use different names. There is a company in my hometown, Olimax, which are also making a lot of open-source hardware. Sparkfun, Adafruit, even big corporations like Intel, Google, and IBM nowadays release some of their hardware products and their open-source hardware licenses. There are a lot of examples about open-source hardware. I have selected just a few of them. Let's start with Arduino. As I said, this is the bright example for open-source hardware. Everyone knows it. From students to professionals, we all love Arduino. Miniboard is a product which is with Intel Atom CPU. It's a very powerful single-board computer that is entirely open-source hardware. There are a few versions of Miniboard over the years. This is the last one, Miniboard Turbo. Before that, we had Miniboard Max and the original Miniboard. I bet you have all seen this. Google released the cardboards in order to make virtual reality more popular. They shared the design of this physical object so anyone can do it. You can buy a pizza, grab the cardboard, and out of it, you can make a Google cardboard for virtual reality. This is a fine example of how big companies are also joining the open-source hardware movement. Another example like this is the IBM TJ bot. This was released actually this year. This is a friendly robot that you can build, put on your desk, and talk with it for serving some simple tasks. All-IMAC Star is one. It's a do-it-yourself laptop. All-IMAC is a company based in Bulgaria. I'm coming also from Bulgaria. Their headquarters is in my hometown. The day before yesterday on Saturday, they released it on the market. We had a workshop and it was amazing because just in about 90 minutes, everyone was able to make with his bare hands to assemble a laptop that is open-source hardware. It was a fantastic experience. Since we are in the Czech Republic, my last example that should inspire you how great it is open-source hardware is about the 3D printers. Have you heard them? Okay. Okay. All right. Yes, a person on the first row said that he even has this printer in his office, one of these printers. This is a 3D printer that is open-source. It's capable of making open-source hardware as well. Isn't that great? So how to make a really entirely open-source device? Open-source software has been here for decades. We are all very well familiar with free and open-source software. But speaking about open-source hardware and putting things together, both open-source hardware and open-source software is something a little bit newer. So for an embedded device in terms of since we are at the embedded Linux conference, apart from the open-source software stack, we need an open-source hardware. The heart of the hardware is the printed circuit board and we need a case. So making the case is actually the most difficult part of my experience. It's time-consuming to make it. You need a few attempts and it wasn't that easy to produce a plastic case for quite some time. But now we have this very affordable 3D printer so anyone can build a case. So the question that is the core of this presentation is, is it worth designing open-source hardware products with expensive proprietary software tools? Is it worth paying thousands of US dollars for licensing the software that we use to make open-source hardware? Let's have a look at some of the options that we have for the software for making printed circuit boards. EGO, this is probably one of the most popular among hobbies that is not open-source. It's very popular because it has a free license for small two-layer printed circuit boards with some limitations of the size. It's also free for students but it has a paid subscription and not that far ago, I think it was in the beginning of this year, it was bought by Adobe. Altium, it was formerly known as Proto, probably a hardware engineer who would recommend using Altium but the problem is that it's a very expensive tool, of course it's a very good tool as well. Other popular tools such as Orcat or SolidWorks Electrical also require high-phase. So I forgot to ask you by the way, how many of you are hardware engineers? Okay, and how many of you are software engineers? Okay, we have a few hardware engineers, the majority are software. I'm also a software engineer so take whatever I say about hardware with a pinch of salt because you know I'm just a software guy. And speaking about tools for making hardware, it's kind of a religion. If someone is used to using Altium, I don't expect him to switch to free and open-source too. But if you are designing a new product, you want to try something new or even if you don't have any experience with any of these software, go for a free and open-source option. So what we have on the market as of today, that's free and open-source software. There are a lot of suits for designing printed circuit boards. These three are among the most popular according to my knowledge. I have listed them in order of difficulty. So the easiest one is Fritzsink. After that we have JIDA, I'm not exactly sure about the pronunciation although I tried it. And finally we have Kikad in this list. Let's have a look with a little bit of details of each of these applications. So Fritzsink, it's made for kids. It's really simple. It's free and open-source software available under the GPL version 3 license. It's cross-platform, it works on Linux, it works on Windows, it works on Mac. It's widely used by the community for making sketches and this is the main purpose. But you can also design single layer, very simple single layer printed circuit boards. It's written in C++ with Qt, the source code is in GitHub. So if you want to contribute something, just go to GitHub and create GitHub pull request. The fact that it uses the Qt framework makes it cross-platform. So this is how it looks, really convenient for making a small tutorial or even not that small when you need to make a simple sketch. Now the next project is called JIDA. I'm not personally using this one but I did a bit of a research regarding it. It's quite old project actually. It's again free and open-source software, again GPL but this time version 2. It also works on Linux, Windows and Mac OS. For me it's really important for software to work on my machine and I'm a Linux user as you can guess. So cross-platform is something that I look every time when I select a tool to use. It supports, it's a professional tool. It supports printed circuit boards with multiple layers. It's written with GTK and the source code is again in Git repositories. And now we're coming to my personal favorites that what I'm using for designing my hobby open-source hardware devices. It's called Kikat. It has a long history with more than 20 years. It's free and open-source software under GPL version 3 license. Again cross-platform, works anywhere. It supports PCB with multiple layers, no limitations of the site. It has some nice integration of 3D viewer so you can even preview the board that you are designing. The contributions for the development of Kikat are coming from CERN and it's been a very rapid development in Kikat in the past couple of years. It's already well adopted by the industry. The company Olimax that I've mentioned in one of the previous slides used Kikat to design their laptop. So the printed circuit boards which are highly complex within this DIY laptop are designed using Kikat which is a fun example that Kikat is capable of handling not only hobby projects but professional projects that involve printed circuit boards on a lot of layers. It's written in C++, the source code is in git repositories. So this is how the PCB view of Kikat looks like. So basically the process is that you first do the schematics, after that you select the footprints and you go to the PCB view where you place some components. This is an open-source hardware board for Raspberry Pi that I've designed in my spare time and this is just how Kikat looks when you use it. I would say it's not that complex and user-friendly. You need to spend some time researching the documentation and probably in a few days you feel like home using Kikat. While preparing the slides for this presentation I found another tool for designing cat software. It's an online tool that really impressed me. It's called MeowCut or something like that. I'm not good with pronunciation, sorry about that. So it's online tool that you can run within your web browser and you can make a printed circuit board. Again, it's a free and open-source software tool. It's written primarily in JavaScript, Python and Go. That's kind of normal since we're speaking about something that runs in your web browser and of course a backend in the cloud. The source code is in GitHub. It's kind of basic but it was really fun trying out this thing. The project is still live although the contributions in 2017 that I spotted were a little bit less compared to what I saw in the previous years. But if you have some spare time, have a look at this, it's fun. So a few recommendations if you're designing a printed circuit board. How many of you have designed a printed circuit board? All right. I'm just sharing some of the experience that I have. As I said, as software engineer at the beginning I had a lot of failures making printed circuit boards, you can guess. The few things that I would recommend any one of you to follow is first to go to the manufacturer of the PCB that you prefer to work with and to check their minimum requirements for tray spaces, drills and angular rings. This could save you a lot of time and a lot of failures. Unlike the software, when you're making a hardware you first have to design something after that you have to manufacture it.  With hardware it's a little bit different. Keep in mind the complexity of the assembly process while designing the PCBs. I have done a few failures because of this. Sometimes the design is valid, it works. You can assemble it once but actually the assembly process could take too much time. So when you're designing the board, keep in mind how to make the assembly process easier. Finally, it's about the case. As I said, based on my experience, making a plastic case or whatever kind of a case is the most difficult part of making an open source project. I would recommend considering the design of the case while making the printed circuit board. It's a little bit hard to do it this way but still keep in mind because the final product should be for users and users like, not only users, even developers. We all love to have not a bare printed circuit board. We love to have a device in a nice case. The question is where to print a prototype when you have a printed circuit board schematics. I'm personally using, I have personally tried all these options. The first option is a really nice website called OSH Park. They're providing services for making prototypes for two-layer and full-layer boards at very affordable prices and very good quality. The process is super simple. They have instructions how to export Gerber files and Drill files and to upload them to their website. They have one big button on their website where you just press upload your designs and in a few seconds you will see an image of your board that you can review. The process is really simple because you don't have to select all the annoying options. They just have pre-selected all options for you to make a high-quality board and they have a purple color. That's the trick. Of course if you have a local factory nearby you can go there and use it. In Europe there are a lot of factories that are like this. I live in not that big city and we have like two factories providing services for making printed circuit boards. Yes? Okay. Yeah. I'll just repeat the question. So the question is since I'm based in Bulgaria are the prices competitive compared to the Chinese prices? So the answer is no. Using local factories of course making production in China is always cheaper. We all know that they have a huge experience in manufacturing. But if you make just a prototype making in Europe especially in Bulgaria the price is not that higher. For me I prefer to make them locally because it saves me time for the transportation. If I use OSH Park they have a really fast delivery but still it takes a few days. Same goes for China. Well with the local factory I can visit the factory and directly get the prototype. So the difference here is it depends on what kind of a project are you asking for. Because if you are speaking about a complex board that involves like six or eight layers there are not so many companies that can manufacture such kind of a board.  But if you are designing a two-layer board or a four-layer board making them in Europe is fine. So now we are entering the next stage of the presentation. It's about 3D CAD software for making physical objects like cases. I have selected some free and open source software tools which I believe are popular for designing a 3D object that can be after that 3D printed. So the list here includes OpenSCAD, QCAD, FreeCAD and Blender. In the next slides we'll see with a little bit more details each of these software. Is anyone of you using them? Can you? Oh, okay. Let's have a look at each of them. So OpenSCAD this is my personal favorites and I believe every developer should love this project because it's really simple. On the one side of the screen you write code, on the other side you see a physical object. Isn't that gorgeous? Of course designers hate it. So it's a free and open source software. It's script-only. The only option is to write a script, no other options. It's available under GPL version 2 license. Again it's cross-platform compatible, works on your Linux distribution on Windows or Mac OS X. The fact that it's cross-platform is because it's based on the Qt framework again. It's written in C++ and the source code is in GitHub. So you know how to contribute code if you find a bug or something. This is how it looks. So here is how you write code. It has its own scripting language. You have to mind the learning curve at the beginning. You have to put some efforts to learn the scripting language but it's straightforward in my opinion and especially for making simple cases like this one here you can learn the script quite fast and make something. Of course this process of making cut objects, physical objects using scripting language is appropriate for more simpler objects if you want to make a very sophisticated case. It might be a little bit difficult with OpenScat. So there are other free and open-source software tools that you can consider. Let's have a look at them. Qcat is one of them. It's a two-dimensional cut software, again free and open-source software, again written in C++ with Qt and again works on multiple platforms. Freecat is one of the most popular free and open-source softwares because it combines both words. You have the option to design based on OpenCascade, to design visually and it also works everywhere. It's again cross-platform compatible. You can see the recurring pattern that it's written in C++ and Python with the Qt framework, the source code again in GitHub. How many of you are using Freecat? Just a few of you. So it's more difficult than OpenScat but it's easier than Blender, the next thing that we're going to see and it's made especially for 3D objects after that you can print. Blender is not exactly a regular cut software, actually it's not a cut software at all. It's a professional 3D computer graphics suit that is widely used for making animation movies. I'm pretty sure you have all seen the big book movie with this giant white rabbit. It's very popular in the embedded world. You can also make visual effects with Blender but you can also make 3D models, export them to STL files and 3D print them. Again it's a free and open-source software available under GPL version 2 license. It's cross-platform, it's written in C++ Python using OpenGL and of course again the source in Git. So when you have a 3D object already designed you have to export a file called STL and out of this STL file in order to 3D print it you have to convert the STL to a file called Gcode which is specifically set for the printer that you have in because different printers have different settings, of course it depends on the material and so on. So UTIMAKER, the famous manufacturer of 3D printers, has made a free and open-source software too called UTIMAKER Cura which is software for slicing and preparing STL files for printing. It supports not only UTIMAKER 3D printers but many more and it's probably one of the most popular or the most popular open-source solution for this job. Again it's a free and open-source software, it's available under the lesser GPL license version 3 cross-platform so you can use it on any popular distribution that you have for a desktop. It could be a Linux distribution, it could be Windows, it could be Mac OS isn't that great. All of these free open-source software tools that we are reviewing in this presentation support multiple platforms. UTIMAKER is written in Python and QML and the source code is in GitHub. This is how it looks. Actually the screenshot that I took is a little bit older because I received an email last week from UTIMAKER that they released the third version of the software but this is a little bit older version, I think this is 2.5 but you'll get the idea. Once you have an STL file, you import this STL file, you see something like this, I have a very basic printer so here is the dimensions that my printer can print and I have to put the object that I want to print in a way to fit the dimensions of the supported dimensions by the printer. So we're coming to the end of the presentation and I would like to come up with a few conclusions. In this presentation we briefly went through some of the, not all of them, but some of the free and open-source software tools available for making open-source hardware and I hope that I managed to convince you that open-source hardware is a viable business model and further more there are enough free and open-source software tools to make open-source hardware because it's valuable not only to share the schematics of the free open-source hardware, sorry, it's not valuable only to share the schematics of a hardware product under open-source license, but it's also valuable to share it in a way that other people can easily contribute and use this product. And one more thing, no matter if you're making software hardware, share it under open-source license. So thank you very much and we have like five minutes for questions. Any questions? Yep, hope it works. So I have a question regarding licensing. If you may be now in Linux world there is something that happened recently named copyright trolls. So how can I make sure that if you release your hardware under some open-source license that you will not try to take some money from me and which line since it's better to use in order to prevent this issue. Okay, well it's a tricky question and as an engineer I'm not sure I can provide you the exact answer because this involves a lot of knowledge about walls and wires. So it's a hard question for me to answer directly. What usually you switch license? So I prefer to publish the things I do and to reuse open-source hardware under creative commons. But of course creative commons have different versions so pay attention to the version and read carefully the license if you're not sure. Take some time to speak with a warrior that can provide you exact information. Okay, thank you. So as a software engineer like yourself I've played around with Fritzing and Kikad and a few of the others and I know that a lot of hardware designers among you like to roll your own footprints, at least that's what I've been told. I found things like Fritzing are really good, there's a lot there already, but it's very limited and when you want to step up going to someone like Kikad I don't know whether you found it, but I found it extremely difficult to find the footprints of stuff I wanted already and obviously as a hobbyist in my spare time with this it takes a lot of time. How did you find that? Did you find that easy, hard or was that a major pain point for you? Yeah, excellent question, Boozai. So making the footprints is a really important part of making the hardware because it's part of the assembly. Once you do a print circuit board it could work but if the footprints are not exact this could bring a lot of pain during the manufacturing process, even if you're doing a small volume manufacturing. Yes, Fritzing is good for making schematics. I don't find it very useful for making print circuit boards since it supports just a single layer board or although there are some services for making from Fritzing to something more complicated, but I personally use Kikad for making two-layer boards and Kikad offers a built-in library with some footprints but honestly if you have to build a high quality product it's better to pick up the components especially speaking about the SMD components, the surface mounting components that require surface mount technology. So pick up the components, have a look at the data sheet, at the last pages of the data sheet there are exact dimensions, physical dimensions of the components and based on these physical dimensions it's good either to check the libraries if you're using ready libraries or to make your own footprints. This could save you a lot of time. I made this mistake to use some libraries that I found in GitHub for a certain SMD component. Of course it works, it's fine but for prototyping but after that I had some problems with the SMD assembly. So maybe I would like to add information to that. So Kikad does not only ship some libraries with it but they're working on an open library that you can use with your Kikad. So if you're on footprints that do not really work just fix them in their GitHub library then we're not only having an open source tool but we're also having an open source library that we can really use in that and I guess then we can benefit from all that open source things that they come out there. Yes that's exactly thank you very much for the additional information. Sorry if I misled you it's not that the components in the library doesn't work all of them work and they find but sometimes there might be slight differences and one important thing that I have to add is that certain companies are sharing the libraries that they're using to design their own products. For example Olimax shared the libraries that they did for their products because they're using Kikad but they're making their own footprints for each component that they're using and they published all these libraries in GitHub a few months ago. Okay one question over there. I missed first few minutes of your presentation maybe you already discussed that you talked about 3D printing of cases what about 3D printing of PCBs? Oh okay 3D printing about PCBs I've never tried that. My process of doing 3D printing circuit board after doing the design is just to go to the factory the beginning I mentioned that I'm a software engineer so the whole thing with hardware is more like a hobby for me and it's really great experience but as soon as I have to get from a prototype to a real printed circuit board I prefer to leave this to the professional companies that are providing it as a service. Have you tried making 3D printing circuit boards? I didn't do myself but I'm interested in this technology because of some you know flexible PCBs or something like that or chips inside some plastic or whatever you don't need to have them separate file for case you could create devices as a whole. This is interesting but unfortunately I can't provide. May I jump this question from my practical experience Tamberman holding case we have a mill we do it with milling for two-layer PCBs but it's already a new sense getting the through context done when it gets to four-layer PCBs doing it in-house is completely crazy if you don't have at least 10 million budget it's just crazy but generally my experience is just get yourself a reliable vendor in China kick them until they have a three-day turnaround and do that it's not worth it we bought the mill because my wife is a mechanics freak and she uses it for mechanical assembly we milled two PCBs and after that the whole company we got together and we said fuck this shit we're never doing it again okay thank you all right just another question over there yes you thought you said that MSMD mounting I mean after you make the PCB you have to assemble the components yes I'd love to make like a board with SMD LEDs but how I mean I can't do that myself depends on the size of the SMD if you're doing like with sizes 0805 or 0603 you can do it with a soldering iron you just need to practice a little bit okay YouTube can come to the rescue but the other option is to go to a factory that does not only the PCB but also the assembly process any recommendation a big recommendation it's sad that doesn't seem to do that there is another company called OSH stencil that can make a stencil for you after that you can place a paste and put it into an oven I highly recommend you not to use your kitchen oven 0603 is easy to do by hand if you have a mantis microscope that's what we use in the company a vision mantis inspection microscope and then it's really easy to do by hand the trick is you tin one pin and then you put the component down and then you take another pin then just solder them down it's it's not particularly difficult I mean in my company everybody can do it even the the 55 year old advertising lady already took a shot and she got it working after 15 or 20 minutes she was able to reliably solder them the things is two things number one you must fuck the EU by leaded solder no ROHS shit and number two use colophonium and number three they use an Ursa or another high quality soldering iron if it costs less than 200 bucks it's not suitable sorry for jumping into you answer no problem thank you very much for the addition I'm afraid we're a little bit late so thank you very much for joining if you have more questions I'm around you can come and ask thank you very much for joining


Chief of Air Staff, Nigerian Air Force Air Marshal Ayo Amal has assured of the commitment of armed forces to equip retiring officers and men of the force with the right entrepreneurial skills to enable them reunite with the civil society. Air Marshal Amal at the combined passing out ceremony of trainees costs 1, 2023 at Oshoody, Lagos State, said the outgoing senior mid-level officers are fully ready to impact positively on the economy of the country. He said the training of outgoing military officers and men is a way to grow the nation's economy. Amal advised them to put the various skills acquired in the training to use while congratulating the trainees for the successful completion of the six months course aimed at preparing them for effective reintegration to civil life. Hello, hope you enjoyed the news. Please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.