And we're back with the breakfast and plus we have care of course We said to look at what the people have to say. Merci a group who is here. And of course, we're joined by toonday Kola Wale who is our guest analyst morning joining us live Vasu Good morning. She was a Kola Wale Oh, yes, absolutely. Yes, absolutely and hope you need to All right, right to the color. Well, it's good to have you join us And very well, thank you All right, we'll start things off and look at the nation newspaper this morning The following headlines on the front page of the nation we came to reverse PDP await directive on presidential poll, all right interesting times for Politics in Nigeria we came to reverse PDP await directive on presidential poll will tell you Who to vote for is what he's saying it will tell you who to vote for he's quoted the same under that headline You will vote for our governor our senatorial candidates house of representatives and assembly candidates Then the other one I will come to tell you where you will vote. Okay More from the nation contempt court jails IG for three months I've been refreshing my feet to see if the police have arrested him. I haven't seen so and delicate back tracks on sack and emotion others Right federal government workers to enjoy 14-day Potentially we sit on a top-treading segment a Senegal through to round of 16 at Qatar World Cup I remember when my Muhammad information me says it's Senegal in reaction to that CNM question and who had who invented Jalof rice More from the nation Petrols X depot price now 210 and 10 naira per litre picture of the NNPCL Group CEO may God help us. Yeah, and MMA honors Okay, and commerce of the nation wish them the best relations of them till who has no plan to return capital to Lagos says a PC Pant party launches portal to raise funds for campaign I saw you know the faces of some of those that didn't seem like they believed in what was happening You know the fund crowdfunding border work and donate in the money to the campaign It ain't seem like you really believed in what was going on. I mean these guys have money already, honestly All right, let's leave the nation for now and move on to the next paper The punch would be what we're looking at but we also need to give credit to Senegal You know if you talk about Jalof rise We give it to them. That's where we originated from a community called love and it was named after it But if it's like I do have will off Okay, oh the wall of will off. Yes. So that's that's where Jalof rise Niger is saying, you know, it's Jalof rise. Well, let's move away from Jalof. It feels like we're hungry, but Looking at the punch. He says Impot duty controversy private jet ownership government over 30 billion Naira tax. That's a lot If the government has this amount of money, why are we complaining about resources? Underneath 17 business moguls banks others move to stop a government from grounding luxury jets aircraft ownership government with foreign registered firms Trustees insist payment illegal and CAA Customs await court papers a budget court plan to set hearing dates for suits. These are the riders you find underneath the boat caption Depot sells 220 naira per liter marketers projected or projects 350 naira per liter pump price. We're talking about petrol now. It's a lot So I saw a tweet when someone was complaining about how did I get to buy petrol for a hundred and seventy naira? Ipman others the cry jump in landing cost or And foresee gloomy Christmas, okay. No, that's not good And away from that 87% of Niger's wrote deplorable W That's the World Bank is quoted to sales because it WHO but it's the World Bank, but do we need the World Bank to tell us budget padding allegation senseless says the finance minister. That's Ahmed Lawn and DLA now suspected drug baron and broader fleas there's a pictorial representation of you know that and That's it this morning on the punch newspaper All right, we'll take a few of the headlines on the daily trust so we can quickly go to our guest Russia, Ukraine war Weapons being smuggled to Lake Chad region Buhari The paper leads to that story call so tighter border security tasks regional force to end terrorism Military Express is commitment to operations. Nigeria spends 209 million dollars on MN JTF in six years well away from that we just quickly take a look at the next paper and which is a distate paper in face of oil thefts CBN's RT 200 initiative records for point nine eight seven billion inflow That's the much we can take on this day newspaper All right to the color is still standing by I miss a color. Well, let's look at Start with what's happening. What the nation is surprised looking at this morning Sure to remind us of what's been happening in River State What are your thoughts on the stance by the governor so far and he's not yet made his mind on whom? Rivers people will vote for and in in 2023, but Question I like to ask is gonna we keep pushing his his powers too far Is it that when the governor says vote for? Maybe a PV presentation candidate automatically all the people in River State will vote for that person will win is he that Influential is any governor that influential to really buy his words determine who people will vote for That's both from gonna know we can He's a very shocking to me It would have yet to meet a governor we can say playing God that he can be some new they have great and like it has water reverse reverse I'm not sure that the government has a kind of level over the entire people of River State at best he calls the color appeal of pressurize or force members of the political party And some of his inner purpose members to vote for a particular candidate for not the entire people of River State Even the video can compare voter So both of particular can be there's another The implication is that we don't have the democracy in Nigeria, and I will not be having a free and clear election reverse it so Which the way we can train about this thing. I have very very fun feeling that Other can be there are other political parties will get ready for me and do whatever I say so trust whatever Distation we can my want to be doing for the people of a little bit shoot for God's sake Stop playing God. Okay, you know colorway you talked about other parties before Mesa comes in quickly and If the if things continue the way they are going in River State You might not have the compliment of those other parties in the next general election. It might just be The PDP or maybe some other parties as we stand APC's presidential candidate was taken to court and what happened in 2019 is happening again He's I mean told by the court that he cannot stand in that election. That's the APC presidential candidate The other parties are also facing court cases. I think a court party is in court Also, there's a bid to stop him from running apart from that the governor signed two executive orders one of them stops the parties from Holding the hosting your campaign offices in residential areas that we know how our country is because of lack of planning a lot of these big men Convert their their their buildings in residential areas to campaign offices. Is it happening for four decades now? The second one is if you want to campaign the state you have to have a written permit or from the state government And you pay five million Naira So if if cares not taking the parties may not be able to campaign freely because one of the party has received a few of them I think at least two have received letters from the government of river state Telling them they can't hold their campaign meetings in the offices and threatening to shut them down And it possibly sees their CFO hotels in Podhakar today may also be afraid to host their political meetings So fear of being shut down by the government of river. So what do you say to all of this? Honour first the king I have looked at the major and constitution I've also looked at the electoral act And I think I'm also compassing Which is the regulations that I like has drawn up for the two thousand and three elections All the actions that the UK has been taking in river state are not in tandem with all these laws and regulations that I have mentioned asking people not to have the offices in that place I think I'm in closing down people's campaign And all manners of people all manners of asking people so so so to register for certain things all the other we must not forget That The general election is a trigger issue. It is not a state issue. And therefore it is very early wrong and improper I'm very unlawful of Governor we'll take a bit of food impediments on the part of the other political party I will enjoy them the other party as well by the citizen to go to court and contact All those impediments and all those things that of the UK is trying to put on there on their path You will also remember that before now before it started rolling out. This is dry draconian orders and and I know that you have been Really, even with members of his own political party that is suspect and not supporting or not in this camp and I said Governor we can't you remember that we used to have a lot we are making a river state who was powerful Who was all powerful? He was also like God When we didn't let power slip through his hand he became a necessary person come may 2020 come June 2023 We can remember and we can show no He will also be fast back to an ordinary citizen and some of the things some of the stuff some of the other He's been rolling out now. We'll come back to hunting. Remember There's also called the law of the camera If you have yourself put impediments of other people if in future political we can also have a political position But it also contains a nation For the office is or whatever like the president is Maybe we can also begin to put impediments on his path We should be able to do things that they will not be scared of All right, all right To the color wale to the last quickly take a look at Another headline It's on the punch newspaper private jet owners to sue the government over 30 billion our task our task that's Very interesting because you have about 91 private jet owners It's a combination of a different persons caliber persons in the society And and they are saying that they are taking the government, you know, they're suing the government the court because They are the cost of import duties is running to over 30 billionaire what for the airline it is an industry That's what very much will be doing well in Nigeria say for example The number of individuals who are private jets in Nigeria The number of companies that are private jets in Nigeria Also know that um, there's not many airlines flying in the world that doesn't come and go They're from Nigeria But besides all these designs all these are scientific and all that You and I would lose That's a special quest In the old I mean in the when Nigeria to take off work Is the most expensive In the whole of West Africa We also don't have an aircraft maintenance hangar in Nigeria here as a tiny country like Kisotia I agree With the airline operator and some of these jet owners and all that That government policies and program with regards to the Nigerian airline I mean with regards to aircraft maintenance and all that in Nigeria and commercial flights and water It's not favorable at all to investment It's not favorable at all to anybody operating a successful airline Remember not too long ago too Some of this fall in the airline Wanted to withdraw from Nigeria Because um The money that they make in Nigeria which they have to deposit it in donor funds earlier you know The feedback was unable to transfer those money to the apparent companies across So there are all sorts of issues in there And the reason we have some of these issues that we have um Airlines who are not patriotic Who will push partners in the will of any Disney or any organizations in which they are not get particularly results in terms of In terms of feedbacks in terms of all this call of the practices Every attempt to run an airline in Nigeria When in actual fact and indeed The South South Africa Nigerian people fly more than any other country in Nigeria so uh the airline The private jet owners and also the operators of airlines and all that She will put their foot down and ensure That the federal government do what it right. Look at the number of them in the airport We are in the country. All of them are I do They are not professionals What they say this is not the private jet of the governor Who fly to a big and come back and not the commercial activities that you and I would have expected And should be the All right. Thank you to the color. Let's look at uh, the security situation in the country the the daily trust lead story is quite interesting uh, the president mount wuhari is saying that uh Because of the russia ukraine war weapons are being smuggled to the lake charred region. Of course, that's very important to the uh security of nigeria and regional stability that lake charred region And he says he's calling for tighter border security I think the the countries of the multinational joint tax force had a meeting Where the president made this known what I thought on this this revelation by president buhari that uh because of the russia ukraine war Weapons are being Smuggled from that war into the lake charred region We're trying to go there. You mentioned the issue of peculiarities I am not surprised that that is happening You and I will know that when wars and your people are happening in certain places Those who are the merchants of blood those who sell arms and ammunition They will take advantage and use it to other arms and ammunition Of certain places and they will go and sell it or go and dispose it in some other places So if arms and ammunition that suggests me for russia or that suggests you for ukraine Is now landing or coming to the Uh, lake charred region one shouldn't be too late for private passes But the question you want to ask is by them right now know that arms and ammunition and weapons everyone for Are coming from those places. What is yours on any point for them as a government? So Of weapons and where they are being imported or where they are being imported Or who is importing them and find a way to block it It is not just enough of the time work on the credit of this paper Without making effort to jam or to block those sources of weapons And you must also remember that the lake charred region Is not the only place and is not the only place where we have a problem The niger data is also one area Even the lake was environment is also not safe too many times And ammunition described as As the ordinary goods are nice and have been found by the negligence cost of the weapons So the ammunitions are watered Ditto for the niger data so many sheets and call Of the of the post or in the ic in some of those places are not at Who are selling arms and ammunition weaponry? So the bandit for the niger data And all those merchants of death that we have all over the country This government has talked too much and too long on issues of armed proliferation And they were falling that description All right, just in a minute let's share your thoughts on this other one is still on the punch It talks about 87 percent of niger's rural roads being deplorable According to the world bank over 200,000 kilometers of roads and out of that 87 percent in that fraction So you have 40,000 kilometer of roads that are usable What are your thoughts, especially where we practice, you know, a three Thea of government the federal government the state and the local government what Let me say this As a way of summarizing the whole thing Look at the number of years It has been taking us to clean the legacy by the express road That is just a road that is less than 100 kilometers And for almost 20 years and we have not been able to to fix that road The road between Lokoja, Ukemei and Nazuta And also very very affordable In fact, it's a nice way of traveling by road in Nigeria today And that is one of those reasons why you find out Bandit's take advantage of the patrols to unleash mayhem on the people The kidnapers take advantage of the patrols to unleash mayhem on the people Most of the people that they attack, most of the people that they have talked And what are you? As people ordinary may would have to drive in a very slow manner When they get to very bad portions of most of these roads We are eventually to applaud and then Ignap Even though this government has said that it has done a lot With regards to infrastructure and all that I am personally not impressed I'm not impressed either in the way and manner All the infrastructures or the outfits or the investment They have made with regards to roads I'm also not impressed even with the With the railway lines that they say they have used it And even the water Transportation is almost common to all over the country Whereas when you go to countries like Netherlands and Northern Water transportation and also Singapore Water transportation is a very very important means of Committing around all these different places You and I are probably most of this time On some of these roads And we know how defraudable all those roads are We haven't gone where we think as a road Neither at the local government level All right Tunde we have to go now Tunde Kola Wale we really need to go And that's because we're really out of time But we appreciate you and your thoughts this morning Off the press we look forward to sharing your thoughts as we proceed All right That's it we've been speaking with Tunde Kola Wale He's a legal practitioner He's been very explicit with his thoughts On some of the major headlines on our paper On the national dailies this morning We'll take a break and when we return It'll be time for us to delve into our first major conversation Please stay with us


Hello, OscillatorSync here, and welcome back to another video in this series where we're building patches from scratch on the Korg Ops 6. So my plan for my next video on the Ops 6 was actually to start doing some of the deep dives into the various different operator modes. But I had this idea for a patch come into my mind, and I kept thinking about it, and I thought it would be a really interesting one to explore on the channel. So we'll be doing those deep dives next, I promise, but first I just really wanted to explore this patch idea in a video. So the patch that I wanted to create was an E-piano, electric piano patch. There are probably a thousand electric piano patches out there for FM synths. But the specific patch I wanted to make or to try and make was an electric piano that was kind of a bit broken. Maybe it was tore extensively in the 70s and then thrown into storage, bad temperature management, and it's been pulled out now and it's working. But it's got weird resonances and it's sort of a bit clangorous and a bit fragile sounding because as nice it is to have like perfect sounds, I find there's a lot of beauty to be found in the fragility of patches as well. So that's kind of what I want to pursue today. So in the last video when I was making the pad sound, I stuck to FM more out of familiarity. In this case, I'm going to stick to FM because I think it's going to be the best way to achieve this particular effect. So let me just set out the basic plan because it's going to tell us what algorithm we're going to start with. So there are going to be sort of two basic sounds that are in this patch. The first is going to be a really basic E-piano sound just to keep the patch grounded. And the easiest way, the simplest way to create that is just with a two operator setup. So just one modulator into a carrier with feedback and getting some velocity sensitivity in there. You can get a lot done with just that. So that's the first thing I'll need in my algorithm is a two op, just modulator into carrier setup. The other part of the sound is going to have a carrier with three modulators going to it. And each of those three modulators are going to be doing a different job in the patch. One is going to be creating an overall kind of weird metallic resonance to the sound. One is going to create some A harmonic overtones that are still related to where you're playing. And then there's going to be another one, which is just going to create an overall tumble change that gets brighter when you hit hard, that kind of thing. So the algorithm I'm looking for is going to be one modulator into a carrier, and then three modulators into a carrier. Now I don't know all of the algorithms off by heart, but I do know that this exists in here somewhere. So let's scroll through until we see if that looks good. So we have two carriers here. We have this algorithm 12, if you're following along. You've got one and three are carriers. Operator two is the modulator for operator one, and then operator three has operators four, five, and six in parallel running into it, which is going to allow us to achieve the effect that I hope we'll be able to create. So other than selecting the algorithm, we are just on an initialised patch. So I'm going to bring up my operator three, which is the one that's going to have the three things going into it. Just a sine wave. Probably going to stick with sine waves. Probably. We'll explore maybe if I think there's going to be some stuff that we can do to make it more interesting. So let's just start with operator three. We'll go into the, so in the mode, it's just on FM as standard, go into its level and go across to operator three, and we'll just choose an appropriate envelope. So obviously an electric piano isn't going to sustain forever at that level, but by the same token, I'm not adverse to it sustaining. If you want to like hold out a sound, it just needs to be pretty quiet, I think, wouldn't it? Maybe that an exponential curve makes the decay slightly faster. Let's do it fast. Perhaps it was okay where it was. Or maybe longer. No, that's too long. Just about getting that feel right. And then we'll also have a little bit of release here where things are just sort of dragging off a little bit into a little bit longer. Yeah, I think something like that. We will adjust some of the velocity sensitivity once we've got the basic sound working, I think. So, each of these three modulators are going to be doing those three different jobs. So let's start by adding just an overall sort of weird metallic overtone. So I'll just bring up operator four here and select operator four. We're going to go into its pitch first. Now if we want to have like a fixed resonance to the sound, we're going to want to move away from the ratio mode in pitch where the pitch of the other frequency of the operator is tracking the keyboard. And if we just go to fix, then it's just literally staying in one place which gives you these different fixed overtones. Now we'll probably turn this down quite low. In fact, all of these will probably be quite low because they'll just be sort of contributing different parts of their character as we go in. But let's try and find an interesting sort of bell sound. To a degree, what's going to work here is going to be dependent on the key that you're playing in as well. I always end up playing in C. So this will be tuned for playing in C, which is an interesting aspect of the patch, I suppose, that you can adjust this to sound right for the music that you're playing. Okay, that's the chorus. I want to go to the chorus. Bring that down. That might work. Interesting lower. I quite like that as well. Let's go with that. So 392 hurts fixed there. Now we're going to have to adjust this operator's level as well. So the first thing we want to want to do, if you listen when I release the key, I would immediately, that overtone disappears. We want to make that release a lot longer. We probably want to make the decay a little bit faster. So it's a bit more of a pingy attack and drop that sustain. Maybe make it exponential. Yeah, let's get some some vibe happening there. Let's go into page two or three rather of the level here. And let's get some velocity sensitivity onto this. So let's put it somewhere in the middle and see how that feels. So if I play lightly, play hard, maybe raise the overall level bit more sensitivity. Yeah, that's working okay, I think. So let's bring up the next module later. What we'll do with this one is we'll try and create something that is sort of a harmonic, but is still going to be following along with the keyboard now. So we'll want that in ratio mode, but we're going to want to move away from simple ratio. So a one to one is going to create something that's harmonic and we will come back and add one that's going to be doing this sort of general sort of extra harmonic grit. But this one we want to go a harmonic. So let's let's go to point something and try and find something interesting. That sounds pretty cool. So again, coming into our level for this this operator here, we'll do a similar sort of job. We'll drop that sustain so it doesn't need to stick around so high and drop that decay bit and up that release so it doesn't immediately die off with the overtones. And we'll follow the template that we did with the other one as well by introducing some velocity as well. We had to get quite high with the other one. So we'll do the same here. Probably afford to now bring up the overall level of that operator. It's feeling nice and responsive under the fingers, which is something I always look for in a patch. That's working well for me at the moment. So we'll come on to this last operator here and this is going to be just the general grit when we play harder. I just want it to just ping a little bit harder. So we're going to want to stay with simple ratios with this one. And with our pitch, maybe half, two to one's cool as well. Obviously it's way too much of it at the moment, but we'll dial it back. And let's try two to one. I think that's that's given an interesting vibe. So let's go into our level here again and adjust our envelope at similar sort of idea. We don't want it to sustain at a high level. We want it a little bit pingy. Give it some release. And again, we want a high degree of responsiveness to velocity as well. Cool. I'm feeling that. I might just with this one here put a little bit of detune just so it wobbles a little bit subtle, but it's just adding a little bit of movement without and with. So even the bit that's perfectly in tune isn't even perfectly in tune. Probably drop them a level of that one overall maybe. Yeah, that's that's sounding cool. So the last thing we probably want to do on this side of the voice is just give our career a little bit of velocity sensitivity as well. Just to not as much as we have for the other ones because there's quite a lot of variation going on there, but just so that you have that sort of general feel to the sounds or try somewhere around 30 here with all the other stuff that's going that even that might be a little bit much. Yeah, something like that seems about right. Now, obviously, let's move on to the other operator and get that sort of baseline electric piano sound happening in there as well to hold the whole thing together. But first, as a treat, let's head into the effects section because there's something that I've realized this is crying out for and that is some reverb but not just any reverb that we don't want nice whole reverb. No, no, no, that's not going to enhance this patch so much. So let's go into our type here and come down right to the bottom when we have our spring reverb instead. And that chirpy chirpiness that's adding there and the sort of weird haziness around it is definitely much more what we're looking for here. So it's interesting to note on the spring reverb that we have two parameters that kind of sound like they're going to affect how long the reverb goes on. We have time and we have length, but they're doing slightly different things. So length is changing the length of the emulated spring. And what that will do is make things sound more sort of delay or more sort of short and splashy. So the moment somewhere in the middle, if we shorten the length, it sounds much more like a tank and more of a straight-up reverb. Whereas up at the other end, you can hear individual sort of delays in there and it's all diffuses as well. But what you have to think about is the length of the emulated spring, the sound if you like has to travel down to the end of the spring and then back and down and back and down and back. And the longer the spring is, that's going to introduce like an actual delay that you can hear. So this is representative of what happens in the real world as well. Short spring tanks are sort of splashy and reverby and long tanks tend to have more of that sort of delay and ripple to them. And then the chirp control here is going to enhance that somewhat as well. And since we're trying to make something that sounds a bit broken, I think that kind of chirp there is going to really, really help with that. It really enhances those higher notes and those higher overtones. Yeah, nice. Okay, so let's come over to our operators again and bring up operator one. At the moment, it's going to sound like an organ over the top because our level envelope here is going to be hanging out at a high sustain. So let's bring that sustain down. And then immediately just adding that sine wave in there. We haven't got any of the modulation happening at the moment. Just helps ground our patch really nicely. So let's just turn down this one, just mess with the overall envelope in isolation. Release in there as well. A sine wave in the spring reverb is a nice thing. I keep coming back to this fact, I just like the sound of sine waves with a short envelope. It's just a very pleasing sound to me. Anyway, so let's think about adding a little bit of overtone with our modulator there. And really, like I said, a two operator basic sound is a good starting point for any electric piano sound. Let's come across to operator two and think about how we can shape it. Again, we probably want to shape that envelope in a similar sort of fashion so that things get a little bit darker over time. So I think if we come back to the level envelope of this one, we want that decay to be a bit longer. We can push the output pretty high, I think, because we're going to tame the output of our modulator again with velocity. And again, we'll probably have quite a high degree of that. Electric piano sounds really that easy with FM. Even more, because it's barely happening when we play lightly. Cool, let's just put a little bit of velocity variation with the carrier as well. So I suspect probably on the higher notes here as we go up, we're going to find that things are a little bit too brash. So we will come again, operator two, yeah, we'll be in our level page two and we will apply some of the operator scaling here. So C4 is probably a sensible centre point. So past C4, we want the overall output of our modulator to go down as we go higher so that we get less of that overtones probably a bit too much. And conversely, we might actually want it to go a little bit higher as we go, or louder as we go down to get a bit more harmonics out on the lower notes. This sort of level scaling stuff is fine tuning stuff that really helps finesse your patches as you make sure that they play well across the entire keyboard. So let's bring our broken sound back in and see how everything molds together now. So I think that the attack is just ever so slightly too harsh in a lot of places. So the easy way to do that is just to come into our two carriers, make sure we're on our envelope here, and we'll just add the tiniest amount of attack envelope. It's just going to soften the overall feel of the onset of the note in a nice way. Yes, that's feeling a little bit more pleasant, a little less clicky like that. So let's get a little bit more movement in this patch and the obvious place to look at that is probably in operator two and just having the level of operator two be affected by an LFO just so you get that kind of almost sort of semi-auto kind of feel to it. So if we come over to operator two here, we'll take our operator three out of just for a minute, come into page three of the level for operator two and we'll just introduce a bit of LFO here. A little bit fast but just the tiniest bit there has made all the difference to the vibe of that I think. So we'll come into our mod page, we'll go down to LFO one which is what is automatically rooted there and we'll just reduce the speed a little bit. Maybe try a sine instead of a triangle, probably push it a little bit harder now. Yeah, so I've got this set to key sync common which means that the LFO shape is going to start with the first note that I play down and then all of the other voices are going to follow that. Actually probably what we want is to turn key sync off in this case so that the LFO is free running. It's probably subtle and much of a muchness but it is more representative of just having like a tremolo circuit that's running in an electric piano. Cool, this is really starting to come together I think. So I don't think we need to have any movement, we don't need to have a filter envelope on this. It's not kind of the patch where we want to have like a funky clavinet kind of thing on but I think we probably dial out a tiny bit of the top end just to make things a little bit more smoky.  So without and with. Of course we have the different filter models as well so let's try some of the other low-pass filters so this is the 24, third 12 there, this is the MS-20 which overdrives probably a bit much I think probably six which is the one I usually end up using on almost all my patches because I really like it. Honestly I think this is the basic 12 pole. It's doing a good job there. Yeah okay that's that's feeling pretty good. So I think I'd like to get a little bit of stereo movement going in this. I don't think I want to go for like a full rotary speaker effect on it. I don't think but I think a little bit of auto panning might be nice. Now there's an auto panner inside the FX engine but you can do it just within the synthesis engine as well just as well so I'll do that because I'm not struggling for LFOs at the moment so let's look at our LFOs here. We can just use LFO 3 I guess because we're not assigning it to anything else at the moment. Yeah okay LFO 3 is what we'll use so we'll come into our V patch here and we've got an empty slot here. We'll go to our EG LFOs, we'll go to LFO 3 and our destination is going to be in program and we want to send it to Pan. So yeah immediately I really just like that a little bit of swimming around that's going on here so let's just mess with LFO 3 a little bit. Key sync again if this is going to be an auto panner that's happening within the cabinet of our electric piano. We probably want that key sync to be off so it's just always running and we might want to again try sign instead if we want something that's a little bit swampier. When you're thinking about your modulation shapes for your LFOs the difference between a triangle and a sign is that a sign spends essentially proportionally more time at the extremities whereas a triangle just kind of goes through them it stays in the middle as much as it's staying anywhere else a sign because of that rounding shape at the top spends more time in our case at either side of the panning. So it makes things a little bit wider in general but it also makes things a little less sudden at either end as well a little bit swampier as I said. Yes that's really nice that's immediately made me feel a lot happier. Let's send that via our mod wheel so that with the mod wheel down we don't get any and then with up we get some nice panning. If we're doing that of course we can probably afford to just make it a little bit wider because we've got all this points in between that we can work with as well. Yeah great. Do we want to get any other sort of modulation sounds going on in here? I don't think I want to have a filter wobble I don't think. Ah so instead why don't we go into our effects and think about adding a modulation effect inside here. So we'll come down to slot two. I think a phaser might be quite nice. Let's try that immediately. That's good a bit deeper maybe a little bit faster. Yeah okay so I don't think this is something we want on at all time again so I think I'm going to route this via our modulation wheel as well. So what I'll do is I'll turn the mix all the way down for the moment which essentially turns it off for our intensive purposes so we'll come into the V patch again and we'll go into a spare slot. Source same deal mod wheel destination we want to go to oops I've just no don't randomize anything that was close. What am I doing? Coming into effects to phaser mix take it up to 50% when it's all the way up so with mod wheel down yeah cool yeah that's fun unlike that being on the mod wheel as well so we've still got another slot left in our effects and I've got to wonder if we're creating something that's inherently broken whether the obvious thing to add here would be some distortion not that much though uh let's bring that drive wrong knob let's bring that drive basically all the way down just a little bit of drive so without and with if I play lightly it barely kicks in cool yeah that's adding a lot of vibe I think maybe a little bit more drive we can afford it's a bit much up at the top though um so we could use the EQ here so we have an EQ section and we can find where that harshness is and maybe duck it out a bit so we'll go EQ all the way down so the harshness is kind of around there we'll just tuck it down a couple of dB instead might just round it off a little bit with the phaser and panning there's still maybe a little bit too much at that top end duck it a bit more I think when we go out to the top there we lose a bit of perceived volume I doubt it's getting actually quite about that sort of carving out of the mid-range that the phase is doing is maybe robbing us of a bit perceived volume so let's just fix that up and these are really sort of tweaky stuff when you're building patches but it sort of finesses the patch a little bit so again if we set our source as mod wheel and our destination in program and level we can change the level of the overall program as we move the mod wheel it's it's not a lot I think it it improves the overall range of that mod wheel anything else to finesse here okay let's um just go back to our filter now that we've added all this modulation stuff and just see whether we can go darker I think a bit darker makes more sense now in the context of everything make sure it's not getting too quiet at the top a little bit over modulated at the top there I think probably on the on our dirty side here so let's just really quickly again it's all about finessing the patches come into our modulators here we'll come into page two here with our key tracking probably want to move that center up a bit maybe up to c5 and we'll just tweak them down a little bit we'll just try like minus 15 on on all of them c5 and minus 15 c5 and minus 15 just make sure it behaves better at the top here yeah I think so I think we're probably done that's a pretty nice sounding patch I think I will even go as far as to save that one for later perhaps I'll turn up in a patch pack who knows so anyway I hope that was interesting useful enjoyable and if you did enjoy the video then as always please do hit that like button and make sure you subscribe to the channel especially if you're interested in the opposites because there's going to be a lot of opposite content coming in the next few weeks and months as always thank you so much for joining me till next time take care bye bye


This video was sponsored by Skillshare. Head on over to skl.sh slash polyphonic25 to get two months free and start learning today. One of the most iconic moments of Queen's entire career came at live aid. Standing on the stage at Wembley Stadium, Freddie Mercury put on a clinic in crowd work, singing a stunning call-in response with 72,000 people. And that exemplified part of the magic that was Freddie Mercury. It was more than just the music, it was the way he performed it, the way he worked with the crowd. And honestly, you could say that about so many of the greatest musicians of all time. Whether it's Michael Jackson or Elvis, Beyonce or James Brown, most of the all-time greats are not just musicians, they're performers. Each of these artists entertains and works with their crowd using fashion, dance, and interaction to elevate their musical performance to another level. In rock and soul, this role is usually referred to as the frontman. It's the job of the frontman to make sure that every single person in the crowd is having as much fun as they can, is vibing the music as much as possible. It's their job to read the room, to bring the audience to the same emotion as the music and the music to the same emotion as the audience. And I think you can trace the lineage of all of the great performers, all of the great frontmen of modern music, back to one man, the original great frontman, Cab Calloway. Let's take a closer look. To tell the story of Cab Calloway, it's important to also tell the story of his older sister, Blanche Calloway. Five years cab senior, Blanche was one of Cab Calloway's biggest influences personally and musically. She got her start singing with church choirs as a child, but soon moved to the world of jazz, touring with cabaret troops and becoming a mainstay in the Chicago Jazz scene. She would even make history as the first woman to lead an all-male orchestra in the States. And Blanche Calloway was known for a lively, energetic performance that mixed great jazz with great dancing. This kind of performance was clearly an influence on the younger Calloway who would go on to make his career on entertaining, energetic performances. Blanche even got Cab one of his first real musical roles in the Black Musical Review, Plantation Days. And following Plantation Days, Cab Calloway's music career would begin to take off. He would sing and drum at Chicago's Dreamland Cafe and then he got a gig at the Sunset Cafe, a jazz institution in Chicago. While at the sunset, Cab shared the stage with Louis Armstrong, who mentored Calloway and taught him how to sing scat. Scat is a kind of vocal technique that uses improvised melodies to turn the voice into an instrument. Armstrong was one of the first to bring scat into the mainstream, but it would become a cornerstone of Calloway's performance. And Calloway would get a chance to shine when Armstrong and Carroll Dickerson moved on to greener pastures. Calloway became the band leader for Armstrong's old band and his career took off. Within a few years, Cab Calloway would find himself opening at Harlem's prestigious Cotton Club, shows that would be broadcast over the radio to a national audience, and word of Calloway's performances at the Cotton Club alongside the radio broadcasts would elevate him to becoming one of the biggest names in showbiz. And that was because of the way Calloway was able to work a crowd and lead a band. Watching Calloway performances almost 90 years later, you can still feel his charisma. Watch the way his dramatic facial expressions are able to create both comedy and drama. He was also an incredible dancer. Look at this performance of kicking the gong around. Calloway's dance begins calm, restrained, but as the song goes on, he lets loose with vibrant, fluid dance moves. The influence on pop stars to come like Michael Jackson is evident, and some have even credited Calloway with popularizing the moonwalk, though he called it the buzz at the time. One of the most impressive things about Calloway was the way he was able to adapt his movements to his space. Look at this 1933 performance in pajamas where Calloway and his band perform in a train car. This energy, creativity, and versatility meant that Calloway was a perfect candidate to take advantage of the emerging medium of film. Calloway appeared in a number of film shorts throughout the 1930s, helping to set the standard for musical performance on films. These kinds of performances were a clear influence on shorts like Jailhouse Rock, which would help turn rock and roll into a phenomenon a generation later. The exaggerated motion of Cab Calloway's dancing helped define another aspect of film cartooning. Calloway was one of the first performers to be rotoscoped into animated cartoons. My favorite of these is probably his performance in St. James and Firmary Blues, one of three songs he did for Betty Boop cartoons. These videos are strange, dark, and just really funny. Calloway's physical humor translates naturally to cartoons, and his movements would inspire animated dancing for years to come. In fact, Calloway's performance in St. James and Firmary became the main inspiration for the Uggie Boogie song in The Nightmare Before Christmas. But of course, the physical performance is only part of why Calloway had the success that he did. He wanted to reach the heights he reached without creating some fantastic music. A big part of this was due to the talented bands he led. Throughout the 30s, some of the most gifted musicians of the era played under Calloway, including Choo Berry and Dizzy Gillespie. But Calloway was no slouch himself. He had a real powerful voice and a real knack for scat, something that you can hear in a song like Nagasaki. Calloway knew how to work his music around his stage persona too, and you would often hear him working call and response choruses into his songs. Of course Calloway didn't invent the call and response, but few were able to do it so effective. He had fun with the crowd, sticking his chorus in their head as he brought them closer to the performance. It's the kind of crowd work that Freddie Mercury would put on display decades later. And of course the call and response chorus that Calloway is most famous for is Mini the Muture. Originally recorded in 1931, Mini the Muture was a monumental success for Calloway. It sold more than a million records, making Cab Calloway the first black artist to hit those numbers off of a single song. The success of Mini the Muture allowed Calloway and his band to become the first all-black jazz orchestra to tour the American South. In live performances, Calloway would improvise call and response scat lines, getting increasingly complex until the audience couldn't follow. This call and response became forever associated with Calloway, so much that he even became known as the Heidi Ho Man. He also starred in a 1934 short film called Cab Calloway's Heidi Ho. It's worth noting that the Heidi Ho might have been another remnant of Blanche Calloway's influence.  By the time the 1940s rolled around Cab Calloway was fading from the spotlight. Though he still featured in the musical Stormy Weather, a landmark film that saw some of the biggest black performers of the time hit the silver screen. That appearance would start a trend, as swing faded away Cab Calloway made a new career out of musicals. The most notable of these probably came in 1950 when he played a role in Gershwin's Porgy and Bess which ran in Broadway, Paris and London. Then in 1980 Calloway enjoyed another moment in the spotlight thanks to an appearance in The Blues Brothers. Despite being more than 70 years old, Cab Calloway is still able to bring his signature dance energy to a memorable performance of Mini the Muture in that movie. And Cab Calloway kept performing until his death in 1994 at the age of 86. The legacy that Cab Calloway left behind is massive. Many of the greatest performers of the modern age owe something to Cab Calloway. Thanks to his natural charisma, his creative eye and his incredible dance talents, Calloway was able to change the way that we interacted with music and he was able to lay down the blueprint for the modern frontman. When I was making this video I really fell in love with the Betty Boop cartoons that Calloway featured in. I thought the animation style was just so vibrant and fun so I decided to look into animation a little bit. Luckily for me Skillshare has a whole host of courses on animation. I really enjoyed Libby Vander Ploeg's animation for illustration. But if animation isn't up your alley, Skillshare has plenty more to choose from. Skillshare is an online learning community for creatives. With thousands of courses on topics like illustration, design, photography, music and more, it's the best place to go if you want to kick off your new year right. Skillshare's courses take on all skill levels so whether you're a beginner looking to learn or a pro looking to hone your abilities you'll be able to find something useful. Most classes are easy to take too less than 60 minutes long with short lessons that can fit into your schedule no matter how packed. So if you want to start off the new decade on the right foot you can explore your creativity free for two months by going to skl.sh slash polyphonic25. If you're looking for a place to start why not try Storytelling101 by Daniel Jose Older. Everyone's got stories they want to tell and that course will teach you some of the fundamentals that you need to get your story out there. And again you can try it all for free by going to skl.sh slash polyphonic25. After those free two months an annual subscription is less than 10 bucks a month so it's a really affordable avenue for self-improvement. So why not give it a shot chase your creative dreams and start the 2020s by challenging yourself to learn a skill that you've always wanted to learn.


Hey everyone, welcome to rotten code aging standards and Ponying IPv4 passing across nearly every mainstream programming language Let's get started So I'm just starting off with a meme here. I got from JF or Joe Swabic Twitter account everyone Please stay calm or releasing PSC's for the unpatched vulnerabilities. You can better evaluate security posture. I Thought this was fantastic And I asked Joe if it was cool if I could put in the presentation This is a quick disclaimer none of the research today was paid for it's all in good faith Nothing today represents our employers future past or present None of us under any gag orders apart from vulnerabilities that are still pending You'll see on the next slide all of the content in the slides is creative commons zero And all the trademarks logos blah blah blah are property of the respective owners So what we'll be discussing today, so we'll be discussing today a litany of CBEs These are CBEs that we accumulated of the course of that last I'd say nine months With some of them still pending because they're quite large and they take a bit of time to fix obviously So two of them will be releasing today that have never been seen before and we confirm with all the vendors and everything like that That is cool to talk about them including the Oracle one. We've mentioned below. We're getting to that a bit soon So the format of today's talk is how to be following this type of vulnerability How you as a researcher or a hacker can horizontally scale your own abilities whether that be for good or for bad Some proof of concepts for some of the vulnerabilities the exploitability of a vulnerability this caliber or type and Further vectors or attacks or research that can be conducted by anyone who is willing to get involved Some takeaways we want you to take out of this is that every day is patched Tuesday patched Tuesdays a meme No longer exists except for maybe a Microsoft or Oracle and how do you patch an entire class of vulnerabilities this size and just a quick Apologies to anyone who has to leave the conference early because some of these vulnerabilities might affect some of your code bases and Lastly, we just want to show you how to exponentially magnify some of your research threat medals or thought models to magnify those attacks and once again horizontally scaling your research so Applying it across all different types of languages and also the ability to pick up existing vulnerabilities and apply that across existing code bases whether that be Finding a vulnerability in one language and then applying it in the next language and so on and so forth so I just want to start with a quick picture of a typical NIST CVE scorecard Basically 9.8 That's the maximum you can get for a vulnerability excluding scope being changed or unchanged and this is all what you can expect from a Pretty high caliber vulnerability where you can get remote code execution or server-side request forgery or things like that And just quickly as an intro you're listening currently to sick codes and you'll be hearing from Kelly Curtis soon We'll be presenting work based on some of the work that we did with John Jay hacking Nick sale Osala Victor VR leg chin who and Harold Hunt So I just want to start with the octal numbering system Most people understand this numbering system, but basically there's no eight or nine You can kind of visualize this numbering system as in counting to ten except you're counting with closed fists And you're counting from zero and you've only got eight fingers Therefore you're counting the maximum of seven and then you just start from the next number up So that would be ten which would be one and zero and how do you get to this? Numbering system from what we know as decimal. Well, the easiest way to do it is you just go from left to right on a number That's been prefixed for the appropriate octal Formatting you basically start from left to right and then do eight times the power So this number here has three digits. Therefore we go to one and zero So eight times two eight times one eight times zero and then we multiply that by each digit in each box So one times eight to the power of two Zero times eight to the power of one and then zero times eight to the power of zero And this one's really easy because one times eight to the power of two eight to the power of two 64 So one times 64 and the other two multiply by zero or nothing Therefore the answer is just adding it all up you get 64 Now let's go to a more interesting case We got the one at the front again So we got 64 second one there eight times two is 16 and then the last one there Anything to the power of zero is one therefore seven times one is seven add it all up. You got 87 And this is what we traditionally know as decimal or base ten. This is what we've got ten fingers for One times this is exactly what you do when you know normally counting numbers is you got your hundreds your tens and your ones So ten to the power of two is a hundred ten to the power of one is ten ten to the power of zero zero Pardon me. It's one and then you got one times a hundred is one hundred And you got your two times twenty two times ten is twenty and seven times one is seven to get one two seven That's your typical base ten or your Real-life numbering system that you currently know is decimal or regular numbers To go backwards from octal between decimal to get from decimal to octal. We do remainders So hundred twenty seven divided by eight is fifteen remain to one keep the keep the remainder on the right-hand side Fifteen over eight is one remainder seven and then one remainder eight is zero remainder seven and then you get the The octal number is the right-hand digits Basically you lined up next to each other like a one seventy seven So notably from that example, you would have obviously been looking at the one two seven a really recognizable number This is a check host if anyone doesn't know it's an awesome website Russian website believe there's no Capture anything like you just plug in an IP address you can ping it You can mainly what one of the things I get out of it You can discern between DB IP maximum and I think it's IP to address or something like that You can maximum you can maximize your you all sent by comparing the three and calculating where a database is getting its Geolocation from in some cases So zero one seventy seven if you put that in your address bar You'll actually go through to your home address But if you put that without those your under the throat, which will allude to later You actually get to a Brazilian IP and I'm not gonna Blur this IP address out because it's pretty well known but one seventy seven dot o dot o dot one is somewhere in the middle of Brazil and then the reverse of this is the Resolution of zero one two seven which goes to eighty seven dot o dot o dot one and that's some random one in Italy I think before we were looking at this that was owned by level three communications But it looks like someone else was actually Taken up the roster on that IP address there, which is quite interesting So this actually this vulnerability as you can see where it's kind of heading is based on the fact that some passing libraries I'd say all of them pretty much have some sort of nuances in the way that they pass IP addresses in that Daniel Stenberg Who runs the curl project he? Fixed this in 2018 on the lean-ups or canoe side where 177 with a zero on the front which means octal would actually resolve to the funny address that's located there in Brazil And he called it a funny house, which I thought was quite hilarious and the part of this Presentation we're alluding to in the terms of rotten code is that a lot of people have different ideas of how code works and Implementations and standards and changing Schema things like that It's not a blame game but a lot of languages have turned bugs into features or Things that they've added along the way have actually been the incorrect way to add them or there's typos or there's manipulation or even there might be Code that's been inserted maliciously through I guess road commits But another part we want to allude to is how well tested use some of the libraries you've been using and how well do you trust those libraries? This is an interesting exit We got from Wikipedia in the in the term of octal a lot of different ways You can prefix numbers to represent octal numbers a lot of people might remember the backslash 73 is being the most common way of Referring to octal where by zero oh is actually Typical of octal and then zero X is typical pexa decimal and that's true in C And then furthermore that was actually taken up by a python. Oh Camel Haskell Raku Ruby TCL PHP and then we've got ECMAScript, which is actually JavaScript space rule structure or standards and We'll get into that a bit later on but there's actually some confusion there based around the standard so that ECMASix and a couple three and a couple five are all different in the way that they Should or shouldn't pass octal values And this has been discouraged in quotation marks that does not mean that it's been Employed but I'll just quickly say for the record you can use the use strict to avoid this kind of instance So a lot of IT devices that don't have the sort of capability or even memory allowed a memory allocated to the device where it can actually realistically or Reliably pass on IP address passing IP addresses should actually be the same sort of meme as passing HTML IP addresses are a bit complicated in that if you do a while shark you'll see the mac address pop up You'll see the IP address pop up in hexadecimal, but what do you want sees octal? Okay, so that's a little thing that a lot of people are missing is the octal usage of numbers everything boils back down to libc So depending which operating system you're on we knows can We'll keep winners aside for the moment but all of its based on Translating network addresses from hexadecimal into something readable into either 16-bit network representation 32-bit Etc etc or even into the octal format The reason is for using that the reason we do that is to obviously use it in other programs So programs like a program communication So this is really funny me me yelling at my computer because my code isn't doing what I want it to do and then On the other side my code is doing exactly what it was told to do In this picture here, we've got a This is just a while sharked up just to sort of emphasise the Packet itself and what you can actually find out of the packet Let's you click on the different parts of the packet and identify what's there Obviously if you're a bit more savvy with the network address translation, you just see the Bites themselves or the other way to do it is just to click on the source address for example 10 Dot 8 dot 160 dot 2 3 5 I believe I'm behind a VPN and then you can see each individual by it there the four bytes are represented As the actual integer values 10 8 1 6 2 3 5 and that's the full IP address But where did the dots come in from well the dots come in from translating so they're not actually part of the packet That's where the kind of the issue lies is that most of the translational errors come from people Not understanding that or skipping parts or just human error But the only real reason that people use octal is kind of like just basically for testing out SSRF And that brings us to our first Entry to the story here, which is the Node.js project private IP which has got something like 12,000 weekly downloads we came across this about nine months ago when John Jackson and Harold came across this vulnerability when they're working and One of the vulnerability purports they received was in relation to SSRF. So someone was able to request Server files belong to the server when in the real world They weren't actually supposed to receive those files and the way they use that was using SSRF techniques involving Submitting octal numbers to the module and getting to a publicly facing module and getting back private files that belong to the server and And just for reiteration here, and this is 12,000 weekly downloads of this project the project hadn't made updates and for about three years and What a previous year it was a bunch of regular expressions in a form that I would probably say is unmaintainable some people would beg to differ but the Maintainability of rejects in this format is quite hard for someone to just come along as a newbie Particularly if they don't know rejects or if they're not that strong or familiar with it But there's better ways to do this Well, we thought at the time a better way to do it was using big Sitterbox and sitter ranges so you can see here. We've got let private ranges. We've got a bunch of private ranges here that we allocated And just here just quickly just showing you the private internet. So this is just a really classic document from 1996 Where they've got the RN reserve ranges as specified. These were the free These were the three basic ones at the start as you clearly see point number six security is not addressed in this memo some examples of where Public Idre public IP addresses may or may not be used is like Arrival and departure terminal displays at airports, which we now know clearly need TCP IP and Then cash registers obviously they use TCP IP connected to the WAN now Money machines all that sort of stuff. So they've got some of this wrong Banks weren't supposed to be connected to net now. Everyone's literally banking on the net. So and Then yeah, two of the addresses that we had in the tests were actually We're actually false They're actually incorrect because they are actually private IP. So they shouldn't have been in the public IP address test case for the original Package public IP we removed those obviously and then we added a bunch more test cases there This is the new IPv6 rejects the Vasco and other maintainer from the Lib Lib PTP, I think they added IPv6 as you can see rejects is rejects You either love it or hate it. I love it. However in this kind of context, it's not really Maintainable to a level that we'd expect for application that's used by X amount of thousand dependencies And that's probably the reason why the original package was not updated for three years and rejects So here we're looking at The second module that we found was netmask. That's the one we added. You're looking at three million weekly downloads This is a big one. This is a lot bigger than the other one. I'd say in magnitude in order of magnitude larger 9.8 critical for this one with Harold and John Jackson So here's the first CD we had insufficient rejects in private IP 1.0.5 was in this insufficiently Filtering ranges that were actually supposed to be private ranges And that's why people could actually submit URLs to applications using this package and that she get Files that belong to the server, which is obviously disastrous and Then after that because we'd actually added the netmask project in there Someone actually came and found another vulnerability and then One thing led to another we actually found out that netmask itself was vulnerable, which was hilarious and you can see here that It's pretty much exactly the same vulnerability And then another guy named riot act came in midway or another researcher named riot act He came in halfway and actually found another Cve because the complete fix wasn't actually correct And this was only scored a 5.3 because I think was only out for like two days Although it is the same impact as the first one So we're in Tmux in a container. I just wanted to run through the netmask Cve So this is the last vulnerable version before we started making changes with the maintainer And we're just picking an arbitrary cider block 31 000 slash 8 First address in this block is 31001 last address and So then this block should contain 31 5 5 5 However, this block should not contain 0 31 5 5 5 because 0 31 is 25 in Decimal if we convert it properly Now we'll see the same thing in coffee. I wanted to show coffee because netmask itself is originally written in coffee And it's transpiled to node Okay, that's the same and Unfortunately, that is also the same now. Why does this happen? Underneath in the netmask library This function parse int is being called and so parse int if it's not passed a base as the second argument We'll just chop that leading zero right off and pretend it got a decimal when 0 31 should be 25 It'll just come out as 31 And we're gonna see the same thing in coffee Unfortunately, even though coffee has the advantage of not accepting leading zero notation otherwise, right? so we should be using 000 if we really want octal in coffee All right, so what? So back in 2018 again Nikola Gregor responds to curl guy tweeting about Octal he says yeah bad octal conversions are a legit way that we can use to get around anti-SSRF filters if you haven't heard of Nikola He's associated with port swigger as an official burp sweet trainer He teaches people how to use one of the most popular web app hacking tools in the world And he references his talk from app sec Euro 2015 and says yeah, if you're interested check out pages 24 to 28 of my slides So it's pretty clear that this is an accepted way to get to a place where we can achieve SSRF Once we can bypass input validation, we can potentially execute local code Around the time we were doing this research in March The node net mask package had about 238 million lifetime downloads So it's a bit more popular than private IP It had around 2.8 million people downloading it directly every week about 170 packages public in npm declare it as a dependency 289,515 packages on github declared it as a dependent last we checked the dependency graph as well So it's pretty popular for a node package. I'd say In AXA's original write-up on bleeping computer. He mentioned Perhaps rightfully the pearl component net net mask which inspired no net mask net net mask had the identical flaw and its maintainer Joel was very quick to file a CVE and Push out a fix pretty much as soon as the article came out or slightly before which is very commendable And it also kind of lit a fire under us We were having a good time looking at things or at least sick John and I were So then we started looking at other cider parsers and trying to see well, okay What else could there be out there in the world that does this exact same thing and doesn't quite work the way the maintainer intended So the last time this package was updated was 2016 which is fairly reasonable cider parsers don't exactly change a whole lot This is another package a bit like net net mask which inspired no net mask within the pearl ecosystem So we've installed the vulnerable version We've got our proof of concept on the right and the deal with this package is you're supposed to use a guard function is Underscore IPv4 before you call is private underscore IPv4 or is public IPv4? And we didn't do that because it wasn't documented that you needed to do that before the fix The documentation was changed as part of the fix So we're just gonna run it and show you the output here real quick and so like with net mask and everything else the Idea here is an attacker could submit input data Which is in octal which should be private and ends up pointing to something that is a false negative Which results in SSRF bypass and same thing with things that should be public and are not So there's a couple of things that do work here a couple of things that don't work here If you wanted to exploit this you would just sort of have to experiment to see what was going on But the trick is guard function If you're a little bit confused you actually go to seek doc codes and in the releases section You'll find a big write-up about the original net mask vulnerability And how it affects you it's actually quite a large write-up. We go into all the details about that vulnerability And they're sort of a table Where you can compare net mask to decimal and then the reverse of that and what you should expect But what I'd like to point out is the comment section So in the comment section is a reason for the double check So that was actually a small zero day that came through in the comment section Another one in the comment section was padding for an anonymous user So IP address, I mean, this is just zero days getting dropped into the comment section Which we I didn't approve them at the start, but I did actually end up approving them because it's been enough time So you can see our pad your octals you do all sorts of crazy stuff and then Lauren's the only reasonable thing is to consider IP invalid trying to convince some people that it should be considered that is futile and I tend to agree with Lawrence because only IP addresses without 8s In the octal range alphabet So you literally I'm missing 20% of your entire address space so yeah And one comment from Tony from Tony Choum. I tried to get in contact with Tony He was one of the guys that mentioned to us early on that Java is probably worth looking at and we did actually not looking at that I'll email Tony and Tony. I hope you hear this, but yeah, I appreciate The heads up I couldn't approve you coming at the time because it was technically zero day, but we've been in touch with him. Hopefully Ping back When you're initially learning about a type of vulnerability It may make sense to try and find it everywhere you can like if you're trying to figure out how a reflected XSS works It can be interesting to try that on Basically everything you come across and so we applied that to octal a bit We knew we had some leads to go on from some of the things people were saying And there are just so many vulnerable cider parsers that even when we were putting this talk together We were still finding more so not only is it Possible that there are more out there that are vulnerable like this. It is quite likely So if you don't really get what's going on at the moment Basically, we're just applying the same CVE to a whole bunch of different languages a Python pearl go lang Java Java script in the form of Node.js and another pearl one and here's the one by Dave So we opened a issue at Chromium project stating that the V8 engine is wrong Because 8 doesn't actually exist in the awful octal alphabet after the number 7 is 10 And that's relating to decimal only So it's apparently working as intended and we open up an issue on ECMA and They've said they don't want to fix the issue because it's too old It's not even a bug apparently But yeah, so you have to be just up a deal with it Going over to the Mozilla developer reference for a second to check out what it says about these errors that we were Discussing with the Chromium team. We see a couple of things here So firstly as mentioned by the Chromium team octal literals the leading zero format literals which represent octal integers We'll throw an error in strict mode, which is nice But this doesn't exactly help us with either net mask or with the behavior of parsant Which still allows zero prefix literals and put as strings or integers even in strict mode so the second thing is Javascript mixes zero prefix literals that get interpreted as decimal with zero prefix literals that get interpreted as octal And we find this one of the weirdest foot guns we've encountered so far with Javascript aside from Parsons behavior To explain this a little bit since the only digits in base 8 are 0 through 7 This means there are some extra zero prefix integer literals allowed by the ECMA spec and they get interpreted as decimal After the Chromium project we opened one at Node.js itself see if they could do something about it Mozilla apparently doesn't treat it as a legal octal constant. That's be good as it isn't there's like there's only seven numbers and so v8 rejected it Node.js rejected it and Pretty much then the last The last opportunity we had to raise the issue was with ECMA itself and I said that these numbers don't exist They said websites will break and the end of the discussion is No one has claimed this doesn't make sense Just that we can't change it because it break it will break a bunch of websites. So the bug Has moved into feature status So he will present a Rust CV go lang CV a Python one and some Oracle stuff So Cheng sort of decided for rest that they would just reject zero prefixed octets Which is likely the right decision So leading zero on IP string interpreted as octal literals Simple demo here. We see that Zero one two seven becomes one two seven when it shouldn't be Yeah, this may cause security vulnerabilities in certain cases The specification also allows hex formats and IP strings Yeah, so the end Result of this is only decimal is allowed in Rust which is Better for user input. Yeah, it's not at all obvious that we should parse octal IP addresses seems exceedingly unlikely to come up outside of security advisories. Yeah So this made it into one point five three point zero, which is super cool Congrats Cheng Fixing the comments Fixing the code and referencing the same RFC draft as the Python thread did interestingly So which says that octal is a rare format for user input for IP addresses and we shouldn't parse it Yeah, if number Starting with zero is not none. Then we don't you know, we don't want to mess with that octet. So tests To make sure that octal things are error hex things are error And let's just run the little proof of concept from our CVE So this is the version of Rust from before the one with chains fixing it I'm gonna compile it real quick and Then you'll notice that we're changing Individual octets at a time. So second octet third octet Fourth octet and then the first octet. So we've got zero two six zero two six zero nine three and then zero nine nine at the very bottom and None of these are translated correctly. You know same parsing logic applying to all the octets With goaling folks had been talking about limiting the size of allowed octets for a while So goaling would allow you to just throw a correct ten of zeros in front of something and allow it to still be treated as decimal So like zero zero zero zero zero one nine two would still be one nine two But really all you need is three digits to get to two five five Which is the max size and decimal for an octet. So when our write-up came out people started talking about it in the same thread and Go lang eventually decided to mimic what rust did and return an error on zero prefix input Which is good because it avoids the ambiguity of allowing Both octal and decimal especially when zero prefix octets are probably just a footgun that most would rather not have So here's the change made it into one point one seven Thanks, Roland Docs change We now reject IPv4 addresses which contain decimal components octets with leading zeros And then this is just a little check on that first digit. I guess reject non-zero components with leading zeros boom Here's our proof of concept from the CVE and we're looking at octets one at a time again the last Two little sections here are just trying hexadecimal We're trying some of the things that we knew worked with net mask and kind of shouldn't have So we're trying, you know, some cider purses will also parse IP addresses that are just a single integer and so that's what the last one is Second to last is just throwing a random hexadecimal octet in there for grins So we've got it built we're running it. Yeah, so the hexadecimal ones don't work which is Encouraging but the octal ones do that zero on that leading zero on those octets that are in An octal format just gets stripped off And so just the same as decimal is how they end up being treated Which is not what we want of all the languages we looked at that we found to be vulnerable I think Java was my favorite. So we're running 11, which is the LTS version. So compiling it real quick Yeah, so we're looking at one octet at a time again and Up to 255 we are interpreting as Decimal we're just stripping that leading zero right off and then zero two five six becomes one seven four Hexadecimal on the other hand seems to be fine Fewer dotted quads, which is a format I noticed in the documentation seems to work out fine What else get by address I need address get by address seems to work fine Java net URIs seems to be fine. Java net URL seems to be fine. It's just I net address get by name and funny thing about Stopping interpreting as decimal at 255 is probably somewhere There's something that's looking at three digits out of an octet and trying to figure out what it is So after some back-and-forth with the Oracle security bug triage team where we were like well, it's broken And they were like well, we're not really sure why and also It performs differently in different environments We simply weren't sure whether for ourselves the issue resides with the underlying C libraries Properting system or with the JVM or with the Java compiler And obviously the question comes in there where Java actually is supposed to run in a virtual machine aka JVM The difference is basically that if you run Java code just on any operating system without a JVM Obviously you'll get different results and the benefit of that is that you can see the vulnerability being played out between Applications, however, it won't actually pay out the real world unless using Java outside of a JVM So we tested against a couple of different JVM's just to see what would happen and as well across different operating systems so JVM wise we tested using hotspot and Also against growl and we saw our proof of concept code perform consistently. However We did see different results across different operating systems That's where obviously the security team from Oracle decided to just say it's not really a bug and it's the responsibility the responsibility is actually downstream related to libc and does not affect Oracle's product and we asked them if it was cool to actually discuss that and They said yes, so that's where we are So these are just some examples of cider parsers Where we took the time to investigate and discovered Unique ways for handling octal the point we're trying to make in this talk is Very few people actually handle the octal IP address format correctly some of the other Languages which we didn't look at but could have include Lua and Ruby and maybe someone else with interest can come along behind us and Take a peek at some of the other things out there During this work we came across a wide variety of articles and blog posts and just opinions about how IPv4 parsing should actually happen But not so much in the way of a single formal definition From a discussion around a reference IPv4 parser in a blog post that Dave Anderson wrote back in December For such a simple-seeming idea it is hard in general for people to agree on what an IPv4 address actually should be Well, I've read the spec but most of it is cursed so I'll just implement this subset which fits my definition of acceptable The textal representation of IPv4 still doesn't have a single standard Grammars or other specifications for the IPv4 address format do come up occasionally in RFCs like 1918 which is the private internet one that we talked about earlier and a variety of drafts that were simply never ratified for one reason or another and incidentally also in the definition for IPv6 The representation has evolved over time and this in addition to people simply not knowing where to turn has led to a bunch of Certainly different definitions that mostly interrupt rate, but sometimes just clash in fabulous ways a Handful of the reference definitions out there simply say something like dotted decimal form and just leave the rest as an exercise to the reader If you want to truly parse IPv4 addresses This is the bullshit you have to put up with and we do IPv4 is still the most widely adopted IP address format currently IPv6 has according to the internet society been operationally deployed somewhere since at least 2002 and Became standardized just in 2017 Currently only around 35% of the internet even supports IPv6 according to Google stats So until IPv6 achieves wider adoption, we'll just have to keep on with IPv4 as well Pretty much anything we used to parse IP addresses Whether it was originally intended to parse IP addresses or not is just gonna have some interesting ifs ands and gotchas So back in Chang's Rust pull request. He mentioned RFC draft 6943 Which is from all the way back in 2013 if the parties involved in a security decision use different algorithms to compare identifiers Then failure scenarios ranging from denial of service to elevation of privilege can result The authors do a decent job of walking through exactly what we've shown in this talk And so here's a little table They're using a couple of different different terms false positive and false negative a false positive means two identifiers were equal But should refer to two different things like the octoliterals parsing is decimal literals and netmask and other places For example zero one seven seven Equaling one seven seven so on the other hand a false negative would happen when two things should have been equal But we're not like zero one seven seven not equaling one two seven when compared this draft has existed since before a lot of the code That we demoed today Not everyone reads spec before trying to implement something or even knows it would be useful But it does come in handy as a researcher when you're trying to understand how something would behave ideally Back in 2019 Python decided they wanted to remove any and all Checks for octal. Just you know, it's a rare IP format. Who really needs that gosh. So here's the pull request where it happened So here's changing the tests No more error message No more no more ambiguous rejection Leading zeros are ignored and are no longer seem to specify octal octets. Yeah, that's the good part And so we're gonna look at the issue where this pull request is discussed And which was reopened following our net netmask report here again in a second And so they're actually referencing an RFC which rightly says octal is a rare format. You shouldn't handle it Unfortunately, that leads to inconsistencies with other programming languages Utilities written in other programming languages the underlying operating system. So You can't really ignore it even though you'd rather once now that we've got octal We've sort of all got octal. So in This case having octal off by defaults Would be a better outcome, but that wasn't what they did so we're gonna look at Python 3.8.0, which is a vulnerable version and We're gonna run this little proof of concept which Victor and sick wrote here We're gonna run it with pseudo so that the network calls ping work So you'll notice that Linux is handling 010 correctly But Python is not just like we saw in the pull request Yeah We've got our suspect IP rate and we've translated it using the IP address call And then we have fed it into ping twice once as itself and once as translated into the bad IP Bad IP stays bad Suspect gets translated correctly We got this far because we worked as a team and we were able to pick up across time zones None of us got paid to do this. We've all been collaborating in our off hours whenever those happen to be We'd love it if people were a bit more skeptical of the battle-heartedness of their dependencies in the future We'd love it if there were a formal definition for the IPv4 address format or at the very least for how to handle IP address Octets in base 8. We'd love it if ECMA rejected zero prefix literals containing decimal digits But even if those spec changes happened there would still be code out there were some things just slightly wrong Spec can guide future researchers or programmers and understanding the differences between the ideal world and whatever issues have become features But it's not going to magically make things perfect If it's critical for code to behave a certain way It may be useful to ensure the behavior of your underlying dependencies matches your expectations before you rely on them One thing we did find really useful was the ability to report these issues to the security teams at all the various organizations and At least discuss and get pointed in a different direction if necessary If we hadn't been able to get in contact with the folks at Rust and Golang and Oracle and so on these vulnerabilities Would continue to be live in the most current versions of these languages and libraries So thank you so much to everyone who is receptive to working with us to fix these issues and thank you for watching our talk