Poppy's just had a nasty re-er-lisation. What is that?  How big it is? My colleague, you think you could tell us the story behind the tattoo?  I don't think he's very happy. He'll be alright. I don't think he's alright, to be honest.     What have you got a pregnancy test on my leg for? I think you know where. My looks. So, Koby, can you tell us the story behind this tattoo? Well, he was dipping and diving in one or two girls a week, telling me he's been wearing a condom. He hasn't, and obviously, he needs to learn his lesson. Basically shagging girls without protection. Yeah. What a risky, risky man. Russian roulette with your penis. Surgery-loving Charlie isn't loving her newest enhancement. Lip filler. Big mouth, loves a bit of surge.  I mean, there's liberties there. I think it's safe to say, Bobby might got this wrong. It's just a reflection of the fact that you don't really know each other that well. It could be about to have their first argument. Time to move things along. You may remove your fear goggles. I think I've got a piece of myself. Come on, Bobby. You can do it. You put two Bobby Norrises on my arm. Let me explain. Let me explain. Who does that? Who does that? You are the queen of hearts, right? Of everyone's hearts.  So I figured Bobby is the queen of hearts, innit? No, Charlie. You've got me all wrong. You're fucking... You've read it wrong, babes. Oh, dear. Good luck getting out of this, Charlie.  What are you doing? Scotty, can you tell us the story behind the tattoo please? Benny has been in a relationship on and off three years and he always goes running back to her. Always takes her side, always believes her over me. So I've got that there to show that he's whipped. I'm not surprised that he believes his girlfriend because he did shag his ex-girlfriend. How do you feel? I don't like it, but it could be worse. Right, let's hop his over. You know, Scotty, we always save the best, I mean the worst, till last. Do you regret sleeping with your best mate, ex?  You're cruel, you like. I think you deserve this. I know what I think you do. I've got lost in the deep.  Cheater, really?   Another cheating arsehole. Swear down on my and Chloe's life that you have never cheated. Careful. I've never cheated on someone. Drop down dead. I'm gonna drop down dead. Satellite.


speed skating starts slow it is kind of a weird sport that like they kind of just really start skating hard at the very end but not not her so she's gonna take off early she catches up to the pack and now she's in first place even though she's at the very end but there's two skaters from China wearing the same outfit they're different numbers maybe they think that's her that doesn't even matter they just straight up forget that she did that what happens is as she crosses the finish line here they say final lap so she's in first place everyone is behind her even though they're in front of her but it's no one else's final lap so right now there's a mad dash to finish it and the other Chinese skaters in the middle notice she doesn't put her toe out to reach out she stays skating the other two skaters think this is the finish and they stop skating but the other Chinese skater remembered and now she crosses and she gets second and I love the high five between them because they're just like yep


Hello, everyone. Welcome to this webinar where I'm going to talk about how to manage teams who are based out of multiple locations. Anyway, who I am, I am Tanmay Sarkar, Director of Product Clear in Uber, and I have four different teams in four different locations, and this is just the PM team reporting to me. When I include the stakeholders with whom they have to work with, it's much more spread out than four. Anyway, let's dive deep into this to make good use of our time now. Before we progress, let's talk a little bit about my introduction. Why am I qualified to talk about it? Who am I? Kind of things. Well, I, as you can see my education, I did my MBA from Carnegie Mellon University, Depper School of Business, completed in 2012. Before that, I did my BTEC in computer science from West Bengal University of Technology. I graduated in 2005. Some of my hobbies, there are many, but who I would like to talk more about is, you know, traveling. It's traveled 10 plus countries and 35 plus cities. When I was single, I traveled solo. I traveled with my wife. I currently am traveling with my kids.  One day I can give you more tips if you have more time about how to travel with kids. Regarding cricket, this is one of the many sports that I used to play. I play this a lot once in a while now, but I follow this religiously now. Anyway, if you ask any other Indian sport to name that they play or follow, they will name cricket. So it's pretty common in India. Some of my skill sets, I would say advertising and growth marketing. This is where my last 10 plus years have been and this is where I'm pretty solid and can always consult your advice you on anything here. Do reach out if you need any help. Other than that, I would say influencing is a skill set that I'm quite known for and product strategy and execution. It's my forte. This is something that comes most of my reviews or most of my pulse survey that the team talks about. These are my strength. Below you can see that I am based out of San Francisco Bay Area and I have my email ID in case you want to reach out with any follow-up questions or any advice on anything. This is just my short work experience. As you know, I graduated from computer science PTEC in 2005, so I worked as a software engineer for five years back in India in IBM and Oracle. I supported mostly telecom clients, clients like Bharti, Airtel and Telstra. These were mostly integration project on the client side. I did a lot of work back in front and Java, J2E architecture, SQL, PL SQL, you name it. Anyway, I decided to come to US, did my MBA from Carnegie Mellon Tepper and following that, I joined Amazon as a product manager. I was one of the first PMs in their ads division. This is back in 2012 where I worked there for a few years. Mostly, Amazon was proliferating growth. I managed ad servers, targeting segmentation platform and actually grew the business by nearly a billion dollar year over year, till the time where we reached nearly five billion dollar. Following Amazon, I moved to Bay Area. I worked in Edelman Financial Engines. It's an investment tech company. This is where I managed three PMs. I grew from senior product manager to a director of product. I also managed marketing here and I was leading mostly the growth acquisition channel. I built an omnichannel marketing platform here using emails, name it as in push notification, nurture emails, connecting all of those through insights, audience data and chat and inbound and outbound calls. I grew the revenue to 80% out here year over year. Following Edelman Financial Engines, I joined DD. DD was growing rapidly in multiple areas like Latin America, Africa, Europe. These are all countries which were emerging nations and I helped drive the growth there, building their ad tech platform from scratch. This is where I managed. I hired recruited groomed six PMs. This is the experience that was exactly the same that were needed and that's why Uber called me up and I worked in Uber in exactly the same role, director of product, but the only difference is the size and the scale is different. In Uber, I currently managed 12 PMs, built the ad tech platform from grounds up, driving all marketing and advertising spending through in-house so Uber doesn't use much of agencies for their growth mostly because we built an ad tech platform from scratch. Before we proceed about how to manage teams in multiple locations, let's first try to understand the company in this case Uber and this is always the case anywhere you go. First try to understand what are the inherent complexities of that company. So in Uber, there are three main challenges or complexities you can say. First is multiple companies. Uber is just not one company. From the outside it might look like that but Uber is very much like Amazon where you have corner shop, you have postmates, you have Uber freight, you have Drizly, and then of course the matured business Uber B2B, Uber ridesharing, Uber Eats and so many and they are constantly growing. What it means is they all have their own GMs and CEOs and it's a highly matrix org. You have to influence them, you have to get buy-in from all of the cross functional stakeholders and move forward with implementation and planning and execution. The other challenge with Uber is it's spread in multiple GOs. Uber is in approximately 70 plus countries. That's immense given the size of the complexities I already spoke about. Which means you are running 10 plus businesses across 70 plus companies. So the challenge that product team faces here is how do you build something that can scale globally but at the same time can be very locally relevant. So you are embedding all of these local customizations. I'll talk more about it later but you know this adds to the complexities of the challenges. The third most important thing is government regulations. You hear it in newspaper every day something related to workforce, how Uber treats it, should we treat our drivers, permanent employee, should we give them all the benefits, minimum wage, zero emission and then name it.  These are all things that sometimes slows us down where you know every product launch we have to make sure that we are aligned or abiding by whatever legal policies and regulations are. So we go through a highest degree of scrutiny. These are some of the challenges that my teams faced and something that I came to know when I joined. First is and these goes on the same lines that the last slides are which is you know first as I said Uber is multiple company constituted into one which means decision making sometimes is delayed not always. Also you know everything is very consensus based we have to we have to make sure that you know that everything is timely but yet consensus based and you are bringing everybody together into into the execution product execution and strategy. Sometimes it slows things down but you know it has its own merits too. In a company like Uber it's very much needed. The second is multiple GOs. I already talked about it in the last slide what the complexity is but you know in this case my team was co-located my PM team was co-located with the engineering. So I had I had them across five different time zones and this was challenging you know because managing work-life balance one time zone or the other you have they will be you know having late night calls or early morning calls. How do you balance all of these? Third every product launch that my team was doing had to go through a very laborious legal checks and balances and it was slowing us down sometime delaying our launches leading to a lot of questions and frustrations from the stakeholders. These are some things that you know I would like to talk about how I went about solving them. As you can see so there are my approach was fairly simple it was four pronged. First is understand I went I went in I did a series of interviews with my stakeholders a lot of one-on-ones with my teams and also the sister teams looked at their OKRs that were already set up some I noticed that you know there was no OKR at all in certain areas they were OKR but very loosely bound and loosely coupled. Second the next step after understanding things really well I went into solving them. This is where this is where I mostly came up with three main solution collaboration calendar so I looked at all my teams and who they need to collaborate with this is the meetings they need to have. I jotted down all the time zones they are working on and tried to figure out overlaps within them. In the process I spoke to a lot of these sister teams also because you know it cannot be from one side it had to be two-sided and I came up with a very complicated matrix of like what are the overlaps who will work how late and exactly trying to figure out a good engagement policy across the teams. The second was stakeholder reviews this was very useful and very helpful I'll talk more about it in the next slides I have a dedicated slide for it just because you know it worked really well in Uber and it is needed in any highly matrix or cross functional you will need a very thorough review process. This is where I looked at who to include in these review what reviews to have what should be the template of it what should be the frequency of it cadences how do you follow up these reviews turned out to be a great place where I would get very polished and very first-hand feedback from the stakeholders from the leaders and this helped the team reduce a number of these meetings or one-on-ones that would simplify their life a lot more and they would focus my team would mostly focus on execution. The third is a legal roster this is fairly straightforward I looked at all the checks that the product team had to go through and I came up with a very standardized format for most of them where you know any launch happens you go through all of these checks you don't have to always engage with legal every time I got a buy-in for this from the legal beforehand and I implemented it across the team this also was very useful the next was planning now you'll ask why planning is needed you have solved it right like look the thing is you know not all of them will work out sometimes you have to constantly tweak them and monitor them so monitoring what is going on and tweaking and is very needed and that's what I'm calling as planning this is where you know if I'm talking about reviews I needed to work with a lot of these leaders who I need who I wanted to invite in these reviews what their calendar looked like do they have schedule challenges how to remove the conflicts worked with their admin bunch of these communication plan I came up with like you know most of these solutions that I spoke about how would you communicate with whom and in which order right so this was mostly about planning last but not the least it was check you know you solved it you came up with a solution of course as I said you have to constantly iterate and we did the same we had to completely we have to actually reach out to a lot of people to understand what is working and what is not working we did it through various surveys various pulse scores were devised I also worked with stakeholders and got their feedback through my one-on-ones a lot of time these stakeholders would give feedback in the reviews itself and these were some of the checks and balances I had to constantly monitor how we are doing with these solutions last very important thing is remember I talked about okr I came up with a very thorough okr for each and every product areas and KPIs I brought it in these reviews too and got some first-hand feedback and we would constantly monitor how we are doing across the KPIs or these okr progress I mean so as I said reviews are something I have a dedicated slide because this worked really well first I came up with who to invite in these reviews right so every product reviews I divided into multiple parts based on the areas looked at the invite trying to make it small short succinct but also got a lot of people that were needed I came up with a cadence in this case as you can see there were two monthly reviews in a quarter and one quarterly roadmap review the monthly product reviews were mostly about talking about the progress of the product mostly the execution so we are talking about the okr we are talking about the okr progress what we did last month versus current month versus not next month how we are doing per our goals I color coded them here what I have is I've redacted few areas because it's confidential but I you can see the templates out here the second part was talk about roadmap as I said there will be a roadmap review once every quarter and you know we are indicating to the arc that you are open to feedback not only on the product execution but also we are willing to change the roadmap if that's needed in a company like Uber it was very important because you know things are constantly changing over although things are certain things can be slow but you have to fast you have to be fast and you have to react to what the business needs are very quickly as a result roadmap constantly can change and we are willing to change with them that's what we wanted to showcase in the roadmap review we are talking about various projects last four weeks next four weeks coming up with a solid pay payload of our roadmap below you can see some of the timeline of this review and I as I said I reiterate it worked really well and that's why I have a dedicated slide to talk more about it with that I would like to thank all of you for you know spending your valuable time with me listening to this webinar do reach out to me if you have any questions any concerns write down into the comment section out here or email me feel free to reach out I would love to connect with you also over linkedin and you know happy to answer any question you have thanks everyone have a very good day have a wonderful weekend


Hi, I am Kanika and I am going to help you to solve the following question. The question says the hypergenic use of a right-angled triangle has its nth at the points 1, 3 and minus 4, 1. Find the equation of the left's perpendicular sides of the triangle. Let's first take a figure of this question. Let ACB be a right-angled triangle at C. AB is the hypergenic use and this hypergenic use has its nth at the points 1, 3 and minus 4, 1. This means A has coordinates 1, 3 and B has coordinates minus 4, 1. We have to find the equation of left's. That means we have to find the equation of perpendicular sides AC and BC of this triangle. Let's now begin with the solution. Let ACB be the right-angled triangle at C, slope of AC. Slope of AC therefore minus 1 by n is the slope of BC perpendicular to BC and we know that product of slopes of two perpendicular is minus 1. Let's now find equation of AC. We know that equation of line passing through point x1, y1 and having slope m is y minus y1 is equal to m into x minus x1. Here line AC is passing through point 1, 3 and having slope m. So equation of AC is y minus 3 is equal to m into x minus 1 into y minus 3 is equal to x minus 1. Find equation of BC. Line BC is passing through point minus 4, 1 and having slope minus 1 by m. So equation of BC is y minus 1 is equal to minus 1 by m into x plus 4. Now as AC and BC are perpendicular to each other, therefore angle between these two sides is 90 degree. And we know that slope of a line is given by m is equal to tan theta. Now here theta is equal to pi by 2 so this means m is equal to infinity. So for m is equal to infinity, equation of AC reduces to x minus 1 is equal to 0 and equation of BC reduces to y minus 1 is equal to 0 and this implies x is equal to 1 and y is also equal to 1. Hence the required equation of perpendicular sides of the triangle are x is equal to 1 and y is equal to 1. This is our required answer.


When the narcissist does this, it's over. The narcissist saw you as an object that exists to meet their needs. They did not see you as a separate person who they should respect. So they didn't plan on reciprocating what you were giving to them. They didn't intend on there being an equal exchange. They just wanted to manipulate you. Into giving your love and enthusiasm to them. Which they reflected back to you. Which they mirrored into whatever they thought you wanted to see. But they weren't really about any of that. Which is why at some point they began to show you who they really are. They devalued you. And then they got rid of you and found someone else. But when they first targeted you, it was too good to be true. You thought they were your soulmates. Because they portrayed themselves as everything that you were looking for. Everything that you were missing. Everything that you need in your life. But it was no different to an empty box with nice packaging. It looked good on the surface. But once you opened it up, you realized there was nothing inside. But until that point, you were giving everything you had to the narcissist. You invested everything you had into them.  You thought you were going to get something back in return. But they usually won't give you anything. And even if they do, it's going to be far less than what you give to them. Because they always have to profit at your expense. But they future fake. They promise something about your possible future. Which keeps you running on their hamster wheel trying to please them. So that maybe one day they will reward you for your efforts. Because you still have hope. You believe that one day things will be better. You believe that one day they will change. Because you believe that they love and care for you. You believe that they want to accomplish something with you. Because whenever you had doubts, they would give you breadcrumbs of hope. Because they feared that you were onto them. They feared that you were about to figure them out. But at some point, the narcissist pushes you too far. They push you over the edge. They push you to the point where you can't tolerate it anymore. And when the narcissist realises you've had enough, it doesn't mean they're just going to let you go. They will still try to hold on to you. They will try to stay friends with you. So that they can keep you on the shelf if they need you. But if you're onto their game, you will block them. You will go no contact. And you will cut off their flying monkeys as well. Because you know that they mean you no well. When the narcissist does this, it's over when they push you too far. It's a done deal. It's game over. And at some point, they will push you too far. Because they know that you're strong. And they believe that you can handle anything they throw at you. Which is exactly what you've been doing for years or even decades. But at some point, you get fed up of it. You realise they're not going to change. You've had enough. It's over. Which doesn't always happen. Because usually, narcissists discard their victims. Once they've drained them of everything they have. Once they've lost all of their money.  Because of something the narcissist did to them. Because by that point, the narcissist will have someone else lined up. But even in those situations, they have pushed you too far. And it's what causes many people to find my videos. Because they realise that they were being taken advantage of. And once you've got the awareness and the education, it's very difficult for the narcissist to gain control of you in the way that they did before. So they will just ghost you. They will end the relationship completely. Because they know you figured them out. They know you're not coming back. And when that happens, you need to put the focus back on yourself. You need to remember who you are and what you need to do. You need to set strong boundaries.  Because they will see your kindness as a weakness that they can exploit. And you will end up doing things that you don't really want to do. And becoming a person that you don't really want to be. You get pushed in a different direction. You're led astray. But when that happens, you need to find your way back to your path to purpose. And you do that.  By setting strong boundaries. So that you won't be taken advantage of anymore. And then you will have more time to do what you want to do. Thank you for watching. I hope this video resonated with you. Please like, comment, share and subscribe. If you would like to donate, my PayPal link is in the video description. Coaching inquiries. You can email me at coaching.nato5.uk. Thank you for watching and I'll talk to you soon.


Yeah, hello. So as I said, I'm Hano Berg and I want to talk a bit today about how you can find bugs in your software Especially if it's written in C or C++ Yeah, and some very powerful tools that I think not enough people know about yet But first a quick introduction about me So I once work as a freelance journalist and I often write for the German online magazine Golem I also write a monthly TLS newsletter and and Now you can see that I Sorry, these are the wrong slides. I Did almost the same talk a couple of days ago. So Yeah, I write a monthly TLS newsletter and I run the fuzzing project which is a Something I founded like about two years ago and which is funded by the Linux Foundation's core infrastructure initiative Where I try to reduce the number of bugs and security vulnerabilities in free and open source software So here's an example and it's from Qt So There's a problem with this code and so what's actually happening here is we have some kind of array structure and we have an iterator pointing on it and there's a check here that if We're if we're at the last element of this array Then it reduces the pointer by one and therefore like we are pointing to one element earlier Now the problem here is if we have an array with only one element Then we're trying to get to the previous element and then we're in invalid memory. That's not allocated So what happens here is like the the code reads some invalid memory and then something weird may happen This is a real bug in Qt I have actually not reported it yet because I discovered it yesterday while I was on a ship without Wi-Fi So, sorry, I have not been able to report it yet, but I will report it and I found plenty of bugs in Qt and KDE So I actually found a use after free bug in Q make which is kind of the build system tool from Qt I found this bug I just showed you when I found several out of bounds reads of similar kind in Qt, Goy and also in Kwin For the last true I'm not entirely sure who I should blame because I mean the code is using the X IPI in a wrong way But I think the X IPI is it's really strange how it behaves because you like It asks you to use a struct That's but then you need to allocate more memory for the struct than the size of the struct because it tries to read a certain size from it So I'm not entirely sure maybe there's a way to fix this in the X IPI. I have to look into this And to be fair, I also have to mention GNOME I found a bunch of very similar bugs in GNOME For example two bugs in Glib which were out of bounds reads Heap overflow in GNOME session, which is triggered actually every time you start GNOME Out of bounds read in pango Here's this heap overflow in GNOME session. So What what's happening here is that There's there's an allocation for a buffer that contains a list of pointers and it contains all the pointers From arc v plus three more pointers So, um, can you see the problem with this who sees the problem with this? One person that's nice So the problem here is like we add arc c plus three and then times size of the pointer But there are brackets missing around arc c plus three So what we're actually doing is doing three times the size of the pointer plus arc c instead of the other way So it ends up we have an allocation that is too small and it's a very classic buffer overflow And like as I said this buffer overflow happens every time you start GNOME So why are there all these bugs and why don't people seem to find them There's a tool that I want to Suggest that you all should use if you write code Which is called address sanitizer because all of the bugs I just showed you and mentioned can be trivially found with address sanitizer and This is a feature which is part of the GCC and LLVM compiler suites. So it's basically just a flag you add during compilations So you add F sanitize address to your compiler flags and then you get this feature that will analyze these kinds of bugs for you So This is how if you have a project that's written with auto tools This is how and if you have a test suite which some people have and Then this is how you would run your test suite with address sanitizer enabled So it's basically you you pass some C flags to your configure flag To your configure script and some C plus plus flags and some linker flags And then you compile as you usually do and then you run your test suite So I think we can agree that this is not too hard like if you're developing code like Typing in these free lines. It shouldn't be too hard But apparently it seems like several people have never done this before. There's a question I just wanted to say that in KDE our CI does use those flags So we sometimes find some of the mistakes. Okay, so so the thing is that we're missing more tests So what I just heard is that KDE is already doing this in their CI system But it's you probably never start KDE with these flags Because as you would have found all the bugs. I told you earlier, but these were all fine found by just starting KDE with these flags so, yeah But it's just it's good if you do this. That's great. Thanks. GNOME doesn't do it. So good So so how does this ascent thing work? So what address sanitizer does is it reserves an amount of a so-called shadow memory Where it tracks for each byte whether that's allocated memory or not So if you do a memory allocation, it makes this as valid or if you Create a stack with a function call then and but it also makes sure that between the allocated space There's always some so-called poison space. So if it changes the stack layout that between variables There's always some poison space so it can detect when you Overrun a buffer no matter if it's on the stack or on the heap And the most common bugs you can find with this are out of bounds and use after free There are other kinds of bugs it finds but these are the most interesting because they are very common And also that use after free bugs are the most common security bugs in complex pieces of software today So especially if you have something like a browser then usually the memory corruption issues there will be used after free So this is an out of bounds read access Relatively simple code. So we have an array with two elements Then we create an integer which we assigned to and then we try to access element with the index two of that array and As array started counting by zero two is invalid. We only have an element zero and an element one so I Have this code here and now if I compile this without anything special Then I just see some garbage number print it out Because okay, it's reading some invalid memory and there's something in that invalid memory and it just prints that out. Okay now we add address sanitizer and We add G because then we have debugging information and that gives us a better stack trace that's just the reason for it and Then we run this and then I have to unset this variable and then we run it again And then we get this very nice error message So it says a read of size for because it's an integer for bytes in line 5 column 17 and It also here says That okay, the address is located in the stack of this thread that's generated here, which is our main function so So you run this code with address sanitizer You hit this bug and you it the program terminates and you get a very very detailed error message So if you know your code, you should be able by reading this error message to figure out what's wrong and This is a user of the free bug Very simple example. We're allocating some space with see a look. So it's initialized by zero Then we print some element of this array and then we free that and then we try again to print something so That's now invalid because we just freed this buffer. So we should not read from it anymore, but we still do so I have this code here and the same If I run this with address sanitizer and for use after free the very nice thing is it tells me basically three important things The first is okay. Here is the use after free access then here is where this stuff got Allocated and here's where it got freed because like these are the three pieces of information you need to Analyze this to analyze a use after free bug So, yeah, also very nice. Of course, these are extremely simplified examples You will have much more complex examples in your code, but that's the basic ideas always the same what a use after free is So I kind of got this I saw okay There are these many bugs you can find with address sanitizer And I made it kind of of my mission to like test everything with address sanitizer and fix all these bugs So what I did was actually I Started building a linux system with address sanitizer like with everything except a very few core packages where it's more difficult build with address sanitizer and It runs like I can run it in a VM or I even have a server where it runs and Just by doing that just by trying to create a linux system with address sanitizer enabled I found bugs in things like bash core utils man pitch in OTR Pitch in OTR is kind of security sensitive. I don't know. Maybe this is important Yeah, and also a Qt and KDA so we're at Qtcon here and many other things So basically just by compiling stuff with address sanitizer and then trying to use it Yeah Yeah One more thing When I did this I thought this may be something I would recommend as a kind of special hardened system for very security sensitive Things but it turns out this is not a good idea because address sanitizer is not designed to be a security tool It's designed as a testing tool and if you do this you end up having Security vulnerabilities introduced by address sanitizer For example, if you have suit binaries with address sanitizer, you can basically use the the error message Functionality and let it dump files with root permissions and then you can get root with that So it's a good thing to find bugs Great to test things, but it's not good for production use at least not in the way It's implemented right now. Maybe there can be some future address sanitizer plus plus That's usable for production, but not the current version. It's testing tool and like the overhead is You have like 50% CPU overhead and but and quite some memory overhead because this shadow memory takes quite some space so yeah and Now I want to get into the next topic which is fuzzing so fuzzing The idea is very simple. It is you you take some Invalid input and test the software with it So the very Thoughts thing I'd like to phrase this is you throw garbage at software and see what happens. So in practice If we take a simple example like we have an image parser and we want to test it Then we take a valid image like a JPEG or a PNG and then we just add random errors to it Like we just add in some characters flip some bits delete something whatever swap parts of it around and then we test if that crashes the code we're trying to test and Who of you has heard of the DARPA cyber grand challenge recently? So quite a few so here a bunch of press articles about it So what DARPA watch AI hack into AA at DARPA cyber grand challenge AI hackers will make the world a safer place And also Elon Musk says DARPA AI hacking challenge will lead to Skynet So the general theme of these articles was okay. There are now some some AI bots in computers in some shiny glowing Boxes like on the lower left. That's a picture from Defconn where these boxes were like on the stage and and they're hacking each other and automatically finding vulnerabilities patching them and exploiting them and Then by that they are basically trying to replace Security professionals with AI bots. So they want to replace people like me With an AI bot and then these AI bots at some point, of course will create some Skynet and Suppress humanity and we will have some matrix kind scenario So if someone wants to replace me with an AI bot, I mean I'm cool with that that's I mean totally fine I will find something else to do, but I would like to understand what's going on here, right? So I'd really like to understand this and all these articles were like very shallow I didn't get any technical details of what's going on here and here's a PR video I'm not sure the whole video, but like some parts of it. You can see the the fancy colorful things on the Defconn stage Game started at 0 945 seconds Pacific Welcome everyone to the first ever fully automated cyber security Automated competition Sandra managed to discover and prove a vulnerability in one of the services that we call opsim But this is a unique situation and it's something we were kind of hoping to see they actually managed to discover an unintended Vulnerability so each of these each of these services that's written just like real-world software It's impossible for us to have made absolutely certain that the one vulnerability that we intended is the only one that's present So the discover this vulnerability and actually begin trying to prove that vulnerability against other teams Very very early on To have to what we have going on here because in that five-minute window that Deb mentioned that she was hoping for That actually managed to be proven and patched by several of them basically represents A leap forward in program I mean all the talk about state machines and all the possibilities state machines really reminds me of one of the papers We published recently we published paper driller, which is supposed to augment Fuzzing with symbolic execution Did you hear he said fuzzing so okay at this point? I thought okay. This is something. I know something about So yeah, okay, so maybe yeah because you know if people talk about artificial intelligence these days I don't know how you feel, but I get extremely skeptical I think a lot of stuff is called artificial intelligence, which isn't really anything about artificial intelligence and Okay, so this seems to be about something about fuzzing and I Talked to the the leader of the winning team David Brumley and he told me okay They are using a tool called AFL or American fuzzy lock And immediately this became something I'm very familiar with because I use it all the time And then I learned not only the winning team, but basically most of the teams were using American fuzzy lock The first place the second place and the third place all were using American fuzzy lock So basically that's the real winner of this competition We can argue what the question was is American fuzzy lock is AI I don't know I don't think AFL is the skynet but It's pretty smart. So maybe it's some kind of AI. Yeah, so This rabbit is an American fuzzy lock, but it's also the name of a tool And to understand what American fuzzy lock does I want to go a bit into like What different strategies there exists for fruzzing? So the very original idea is what I would call dump fuzzing where you Only add errors at random to an input and test it so That's easy. It also I mean it it's surprisingly effective already So you already can find a lot of bugs with it, but it's not going very deep into your code So if you have some complex issues, it won't find them And then you can do something which I call template based fuzzing where you do Where you write a fuzzer that's specific for a certain data structure So you could do something like you want to pass an image parser and then you try things like What happens if I put a zero into the width because that doesn't make any sense So let's see if the parser correctly handles that The problem with this is it's a lot of work because you have to do it for every data structure your fuzzing and Therefore I say it doesn't scale if I want to pass all the software out there I will never be finished and This new thing that came up with AFL is what's called coverage based fuzzing and what this is doing is that it You're adding some extra assembly as to instructions during the compile step and these allow the fuzzer to learn something about your code paths and When you have an input to the to the tool that generate that triggers a new code path Then the fuzzer sees okay This is generating something interesting because now we trigger new code and therefore we should continue fuzzing with this as a starting point And this leads to some pretty impressive results So there's a blog post by the by Michael Salewski the author of AFL where he started to fuzze a JPEG parser with garbage input and After some hours it created valid JPEG files so Maybe that's already kind of skynet thing, I don't know It's a really pretty impressive so Yeah, so AFL made this idea of coverage based fuzzing possible and You work in two steps first you compile it with the AFL wrapper Compiler thing and then you start the further so and to show you also that this is really easy Yeah, you run like still auto tool space But you run configure your pass CC and CXX so that you run it with this compiler wrapper Then it's always a good idea to disable Shared libraries because then you don't have to fiddle around with LD preload and anything Then you build it and then you need some kind of sample file that you want to fuzz Put it into a directory which I always call in but it's just a arbitrary name And then you run this fuzzing process Which where you put the input directory? Output directory and the path to the thing you want to fuzz and then you add these add-at and then the fuzzer will call this executable with and pass the file that's currently tested at this add-at position And this is how it looks So nice asciiart interface The most interesting part is the upper right corner because there it shows you the number of unique crashes That's a bit of a lie because You will have duplicates there The detection of unique crashes doesn't really work, but it tries to err on the side of caution. So And it also detects like hangs if you're stuck in an endless loop or something And the number of paths it detected and that's also important because if that number Doesn't change if it stays at one or two then probably something is wrong with your setup and you check that And I'm inclined to say AFL probably found bugs in every single important piece of software that's written in C So in open SSL open SSH JPEG, PNG, SQLite, Knoopig, Bash, Stagefright, Stagefright was the Android thing that made some headlines last year Yeah, so really a lot of bugs found with AFL. There's a list on the web page. That's quite impressive So it made a huge impact like on bug finding in in the free software world And So I I now told you about AFL and address sanitizer and there's a very obvious thing to do And that is to use both at once because address sanitizer finds these additional classes of bugs that are hard to find otherwise and AFL is a very good fuzzing tool. So you can just use both at once What you have to do is basically AFL already has a feature built in for that which you can enable with an environment variable AFL use ASAN you then need to disable the memory limit from AFL because address sanitizer has this thing that it allocates this shadow memory and it is only a virtual Allocation, but it's several terabytes So it's only virtual memory So it doesn't really use that memory But if you put a memory limit on it, it won't work Therefore you just need to disable the memory limit This can of course cause a situation where you have an application that uses a lot of memory and everything will crash But in my experience that That almost never happens, but that's the reason why AFL has a memory limit in the first place So simple solution just disable the memory limit and you're done Okay, who remembers this logo? I hope everyone This was the hard bleed bug probably the most famous bug in any piece of code ever made headlines everywhere So At some point I was asking myself, okay, could we have used fuzzing to find a bug like heart bleed and I have to say here, okay, one of the people who found a heart bleed actually used a fuzzer, but it's a proprietary tool that's Specifically targeted to TLS. So it's not kind of a generic father It is what I earlier called templates based fuzzing and it's not free so I cannot test it so but I wanted to know like can I use the tools that I use for fuzzing to find a heart bleed bug and Okay, one problem is that American fuzzy lob is file-based and this is kind of networking so but the open SSL API has a nice feature that I can basically Do a TLS handshake without really doing a handshake. I'm just passing buffers back and forth So I have two instances of open SSL and let them talk to each other But without any real networking involved and then I could like write something that I just Swap one of these handshake messages with a file that I pass on the command line and Doing this after six hours. I was able to rediscover the heart bleed bug And then I got an email from Kostya Seribrani who is the developer of address sanitizer and a couple of other things And he said he has this tool called lip father and it's able to do the same thing, but in five minutes So that's also quite impressive And lip father is it's modeled after AFL, but it works a bit different So what AFL is working on executables lip father is working on functions And that's much faster because it's faster to call a function than to run an executable But there's a downside to it and that is you have to write code to actually use this And because the big advantage of AFL is that it's just so simple and with lip father you need to write code This is an example for an Fuzzing an open SSL function with lip father So we're basically writing a wrapper function here that gets a buffer passed and the size of the buffer And then I'm just calling this open SSL function, which is called as one and B string copy I pass this this buffer and then Very important here is that I check if it succeeded and if it succeeds then I free The structure it generated again because if I don't do this then I have a memory leak and as it's running this like millions of times The memory leak will add up and at some point I will run out of memory and my father crashes Therefore if you use lip father keep in mind you have to write a wrapper that's free of memory leaks Yeah Then something What's also an interesting method is what's called differential testing so the typical fuzzing scenario is to look for these kind of memory safety issues and crashes and But you can also do other things and if you have a function that has a clearly defined output Then what you can do is take two different implementations of the same thing and then compare the result and Some area where this works really well is Mathematics because if you have something like an exponentiation or a division or then we can agree that this has a clear Result, I mean there's no discussion like two times two is four and not something else so if two Implementations disagree on some mathematical calculations, then one of them must be wrong. Yeah At least one of them must be wrong. Yeah, I Didn't run into a situation where two were wrong in a different way at the same time But maybe that happens And there was a bug in OpenSSL in a function called BN square which is squaring so you multiply a number by itself And in very rare cases this function would produce wrong results And these were so rare that it was in one out of two to the power of 128 And this number is so large that if you use this function with random input You can do this for your whole life and it will never hit this bug So it's a very rare bug, but the surprising thing was American FuzzyLob was able to find this bug. So maybe this is another indication that there's some Skynet thing going on I don't know The first person who showed this was Ralph Philipp Weinmann. He had a talk about big num vulnerabilities at blackhead last year It's on YouTube and I recommend watching it. It's very interesting And then I tried this and AFL is really good at this So I found a bug in OpenSSL in the modular exponentiation This is the function that's basically RSA and Diffie-Hellman. So Kind of important. Unfortunately, nobody found a way to exploit this, but it's still I think it's Something where you should look into that. It's correct Then in the elliptic curve code from Nettle, which is used by Gnutial as also in the modular exponentiation of NSS In the pulley 1305 authenticator in OpenSSL This has no CVE because this was never released in a I found the bug before they released the code. So, yeah And in in matrix SSL, which Have the interesting property if you had a zero to the power of something it would crash And then I thought okay. I can do this over the network. I just sent them an RSA signature That's zero because then it will try to exponentiate it and crash and that worked. So, yeah And also like there were situations where it was wrong results and they were not really they haven't really fixed all of that. Yeah, I Wouldn't recommend using matrix SSL Yeah, so One of the things I run into when I do these things is the vast majority of bugs I mean with these bugs there's no discussion These are bugs and also usually people agree that this is a security vulnerability But if I found something like an invalid read access on the heap for one bytes which happens extremely often then people tend to argue is this a is this a security vulnerability or not and and I Find these discussions a bit pointless because I say okay, it's clearly a bug I mean that you're reading invalid memory. You cannot do this So I say okay, can we just like skip the discussion whether we call this a vulnerability or not? I simply don't care. I want you to fix this and we're done with it So I think in many situations, it's just easier to fix the bug than to have the discussion on how severe this is Yeah Then I want to mention a couple of more tools So this address sanitizers there are a couple of other sanitizer tools I just think address sanitizer is the most interesting. There's undefined behavior sanitizer which Finds many small things that the C standard says are undefined and that essentially means if you do these You cannot have any expectation of your code that it does anything Reasonable it can just do whatever it wants the compiler can optimize it in a way that if you do this You cannot expect it to do anything sensible There's memory sanitizer which finds a uninitialized memory problem with that is it's nice But it's tricky to use because you need to compile all the libraries you use with memory sanitizer And if you do C++ even the lip standard C++ So that's a bit of annoying to use and there's threats on the ties of which is mostly there's a question Same thing you just said is valid for address sanitizer as well So if you don't compile a lip C++ with ace and you won't be able to find bugs that are triggered within Lip C++ by your code and it's the same for why you that is true That is true, but you can still use address sanitizer to find bugs in your own code and not in the standard C library While if you do try to do this with mSAN you will just get random false positives that make no sense at all so the difference there is You you get better results with ace and if you compile everything down to the last library with it But you can still use it if you only compile one thing with it Yeah, and there's also a threat sanitizer, which is like mostly interesting for large projects like browser for KDE It's probably also interesting, but Yeah So here's an example for Ubisan what we're doing here is we're shifting the variable By J and J is minus one and that's invalid. You cannot do a shift with a negative value. That's undefined And the next thing here is a integer overflow, which is also undefined And I have this code here as well And the difference here is that Ubisan doesn't terminate your application So you can find multiple bugs at once and the latest version of ace and is also able to do this But you see here shift exponent minus one is negative and signed integer overflow And here's an example for memory sanitizer, so we have an An area here and then we set element one and then we access element number of arc C Which is by default one, but if we pass a parameter, it's more so So if I run this I don't get an error But if I pass any random parameter, I will get this here use of uninitialized value Okay, then there are a number of these tools also available in the kernel So there's a kernel adder sanitizer kernel Ubisan kernel Tsun And there's a fuzzing tool called syscaller, which is trying to adapt this coverage based fuzzing to the kernel space with syscalls Yeah, I'm not super familiar with those. I just once tested Ka Sun and it found a bunch of stuff in my GPU driver Yeah, but yeah then One kind of biggie is network fuzzing because nobody really found a very good solution for that yet. So You run into a lot of trouble like trying to do this because you kind of need to define like when You're basically you need an application that terminates after one Connection attempt and things like that and there's a tool called preemie, which is trying to Put a file and then simulate the networking calls and Like let the file look like it's a TCP stream and there's a patch to AFL But which tries the same but all of that is pretty fragile and doesn't work very well So I haven't seen anything there yet that that works as flawlessly as the file-based things and that's Something I would like to see Yeah, but yeah, we're not there yet Then there currently seems to be some research interest in Combining fuzzing and something that's called symbolic execution. So symbolic execution is basically it comes from formal software verification and the idea is that you're basically trying to analyze a piece of software and Analyze all kinds of states the software can get into for all kinds of inputs And the problem with that is if you try this on any real software It will just have so many states that it will never finish And you're running this analysis So what people are trying to do is to use fuzzing and if the fuzzer is stuck that it cannot reach a certain Part of the code then they try to use symbolic execution for it I am kind of looking forward to see whether this will work or not So some people in the DARPA challenge have done this But there's nothing there yet that you can just use and try out So there's one thing has been published. This is called driller, which the guy you saw earlier in the video was talking about But it is like for a Artificial operating system that was used in the DARPA challenge and not for a real operating system Therefore it's kind of questionable how this translates to real So this is like open research and we will see but I I must say I'm a bit skeptical if this is really something That will lead to significant interesting results Yeah What I want to say like all of the tools I presented to you are free Unfortunately, not everything that the DARPA challenge made is free, which is kind of a pity But like AFL lip father address sanitizer all the other sanitizers. It's all free software So there's essentially no reason not to use it. So just use it and fix your software with it And Now this is something that kind of came up in the past couple of years What I'm doing here is mostly fixing bugs in c software, which are typical c problems And you know, there are these people who've been saying since forever that we should just rewrite everything in some safer programming language And this debate has now accelerated because there's rust and a lot of people like rust and Um, I think this is I mean, I'm not joking here. I think this is a serious debate We should have whether this is really the way to go to try to fix all these c bugs which pop up again and again Or if we shouldn't like move to some something safer. So But I mean, this is also kind of questioning of if what I do is the right thing to do. So yeah But I wanted to have it mentioned and yeah, maybe someone wants to rewrite qt and rust that would be cool um Okay, so and and finally something is anyone here working for red head No, uh, that's sad anyone working for dibion or like involved with dibion Okay, so you will be happy. Um So I thought okay, I will fast package managers because like why not They pass stuff and then that's good for fuzzing and I can test if they are have same code So I fast dpkg And um, I was impressed. So I reported two bugs to the debian security team And eight days later there was an update and the security advisory with these bugs fixed for both from dibion and ubuntu So that's pretty good, right? I mean if you have a vendor reaction like that, that's cool. Um Then I fast rpm so um in november last year I reported Three bugs in rpm passing to the red head security team Got an answer. Yeah, we just got 30 crash reports for rpm. It may take some time till we tackle this um, okay a bit about rpm and rpm is It was originally the red head package manager But in 2007 they decided to make it an independent project. It's now the rpm package manager It's used by redhead and zoosa and some others Um, so it's kind of independent although I mean rpm.org still belongs to redhead. So but The redhead security team says however, we don't own rpm.org domain. So they disagree with the who is data. I'm not true rpm.org is a track installation Track has a bug tracker. So I could report bugs there. That's great Then I tried to register an account and I got a certificate error. It was expired in 2012 and it didn't match the domain name But then I ignored the certificate error and created a bug an account anyway And then I found out okay. I still cannot create a bug It tells me I should ask on the mailing list or on irc whether I'm allowed to create a bug I And then in the communication with redhead I found out okay, there's a github repository But there's no link on the web page to the github repository Which is yeah, I don't know And then uh, okay, maybe you want to find out what's the latest version of rpm There's some disagreement. So if you go to rpm.org slash releases is just 412 01 In the github repository it says 412 0 and fedora is using 413 0, which This doesn't seem to be an upstream release for it Yeah, so status right now is a one stack buffer overflow that I reported is still unfixed in the git code And in the release you can find at least once you can find maybe there's a secret release somewhere I didn't find but in the release you can find all these bugs are unfixed And there are more and then some people kind of uh, there was a Discussion on reddit where someone said this is all boring because This is all after the signature check So I tried it again with pre signature check and still found some things I'm not really sure what to do about it right now because They seem not to be willing to fix the situation. So the thing here is these bugs are not that interesting But what's interesting here is that the development process of rpm seems to be completely broken Like I mean, that's not how you do things. Yeah, we hopefully can agree on that Yeah And a small announcement here, uh, there's a berlin security meet up and uh, the next meeting is tomorrow So if you're interested in security and cryptography, you may want to come it's at the musilla building community space And that was my talk, uh, thanks for listening Please test with address sanitizer and please use fuzzing to test your software And now I'm open for questions It's more a comment again than a question. Uh, I'm one of the developers of poplar the pdf, uh, library Oh, great. I want to talk to you. I I get I randomly get the People saying yeah, I have this pdf that crushes the thing. It's like yeah, I did that. Yeah Yeah, maybe that then I say can you report the bug and then like no because it's a security And then we end up in the same situation You mentioned like they don't want to report the bug because it's a it's a vulnerability But I want them to report the bug because it's much easier to track if it's in a back tracker So Yeah, I understand The thing you said, let's not discuss about it They just fix it But sometimes it's like they don't even want to give me the file to fix it because they think they deserve more, uh Things than using a back tracker So I reported a number of things in the bug tracker and they have not been fixed and it's more than a year ago Oh, really? Okay. Let's fix them now. Um, or send me an email Um, and also, um The gnome bug tracker has no option that I as a bug creator can create a security bug That's kept secret the bug tracker has this ability, but I cannot trigger it. So maybe that's something so Maybe we should talk later because I have yeah, I think there are stuff that can be improved and yeah Uh, one thing that I would Uh, ask you is do you know if anything for actually fuzzing user interfaces because I mean Fuzzing file file-based things is one thing but user interfaces are also prone to Well, in well, yeah missing input validation. Let's put it that way. Yeah, okay. So Um, first of all, you can just like use them Um Or start them like as I said, I started kde and I think four or five different bugs just by starting it Um, what I did for a while was run my email client with address sanitizer enabled Um, the problem now is I know there's a user of the free bug and I don't manage to fix it because it's like complicated And now it's a bit scary because I know there's this bug. It may be a security bug and uh, but So that's actually but I think that's a good way to do it Like if you're the developer just occasionally run your application with address sanitizer enabled Um, and there has been some work done by lipo office where they simulate user interactions with a fuzzer But I have not looked closely into this but Yeah So, um, can any of these Principles also be applied to let's say safer languages just like rust or camel. Yeah So I mean it It entirely depends on the language So what you can always do is these things like differential testing where you're just doing some correctness tests That is like independent of any language if you have a function that produces wrong output Um, and there are all kinds of things to adapt afl or similar tools to other languages So I think there's an afl rust and The o-camel people are also using it. I'm not sure how how exactly but I've been told so and there's a go fuzzer The the thing the the question there is what are you looking for? So some of these safer languages Can crash like they crash if you have a buffer overflow Some of them just like tried where crashing is not really a valid thing I mean, they can still crash when there's a bug but There are all kinds of ways to adapt this to safer languages But the I think the the thing is that C has most of these crashing bugs therefore there it's The there you get most of the output Yeah You mentioned that you run the address sanitizer on cute. Did you also try fuzzing cute? No, not yet I just did this in the past couple of days because I thought I have to do it for this talk One question you mentioned these rare back bugs in mathematical code, which is actually pretty typical How does the father find that? I mean if it's so unlikely that you really get the right input That's a very good question and I hope I I wished I knew the answer. So there are people kind of So it would probably require some very detailed analysis of what's going on my guess here is that AFL has a tendency to create repeating patterns And that seems to be more likely to trigger these kinds of bugs But there was for example a discussion I had with the developer of lip father because he was very angry that There was one bug that AFL could find and lip father could not find And he's well that cannot be in Lip father is the better tool and and he fixed it now and he fixed it by adapting this Pattern generation thing that AFL does because these are really horrible bugs that can live for 10 years or so. Yeah And and and this is where probably the symbolic analyzation really would help right because it can analyze Mathematical structure of the code So I had this discussion with people who are doing formal analysis and symbolic execution and they said yeah This is our thing is good for finding these bugs and they asked him how many bugs he has found with it And he had one and I had like five so I'm not sure if this maybe maybe there's a But I feel right now that fuzzing is at least Produces more results, but AFL isn't doing no no Analysis of the code at all right. It just checks new code paths. Yeah, that's it's analysis. It's doing it's fine Find the correct number that then triggers this code path and this so yeah So I mean this Yeah, maybe we can later have a discussion, but the all this formal verification stuff it all this sounds very interesting, but then The then you're not so impressed by the real results that are produced by this. Okay. Thank you I have one comment like I'm one of the guys who actually tried to build all of the kde and cute applications with asen And I haven't seen your bug So I was wondering whether that could maybe be due to me not compiling libex kcb or stuff like that with asen enabled Because like I I'm not using gen 2 right. I didn't rebuild all of my system so So I think if you build qt and kde on top of it with asen you should find them Maybe it's new Hi, I have a comment from from my practice my job We have Soft commercial software based on open source components, so to say we use qt. We are still at 4.4.8 And I'm using velglind and address sanitizer for years At the beginning as we started using these tools it took us Year or two to eliminate bugs from our software And At the moment the last I would say four years I am hunting jobs bugs in in libraries like Lip font config or G lip or something like this and I'm not sure should I really report all these bugs where I Actually have only the stack trace and the place where it happened and I don't don't really have time from my manager to To look deeper into it and so my job is limited to putting all these stack traces onto a suppression list So I don't have a good answer today. I mean the That's basically something you have to deal with the upstream projects if they kind of accept Low quality bug report. I have a similar situation that I can run this gen2 and try to compile all the packages with address sanitizer and then I have a bunch of log files with address sanitizer errors, but Like I won't ever like look into all of them So I'm wondering if I should just put this online somewhere and have some crowds So I don't have a good answer to you. Sorry, but I mean ideally these projects should at least all Use some kind of address sanitizer testing themselves If there are no more questions, then please give a hand to hano. Thank you


Yesterday Frontier revealed new features coming next week to Elite Dangerous Odyssey and Elite Dangerous Horizons. In this video we're breaking down for you everything we just learned. To make sure you don't miss any of our videos hit like and subscribe, remember to click the bell icon and select all notifications and to help directly support this channel you can also join our Patreon via the link in the video description. City managers Zach and Bruce hosted the regular Super Cruise News live stream yesterday afternoon and as part of the show they revealed the expected launch window for Update 9, some of the new features that will be included and interviewed two of Frontier's developers about their work on Elite Dangerous. So what did we learn? Well we knew that patch 9 for Elite Dangerous Odyssey was fairly imminent as it had been billed previously as early December, we now know that whilst no specific date is yet set the update is scheduled to arrive next week. We already know that Update 9 includes the new SRV, no details are yet available on that as it's expected that Frontier will want to introduce and talk about that particular feature in isolation on its own dedicated stream, however we did learn about the two other major new features arriving next week. Firstly, the new multi-limbit controller module will be arriving with Update 9 and importantly the new module is landing for both versions of the game, Elite Dangerous Horizons on console and PC and Elite Dangerous Odyssey on PC. Zach and Bruce spoke to senior game designer Derren Hallil who had been working on the much requested module and he explained how it was going to work. In essence, the module will be available in different role specific flavours and, as the name implies, will perform the role of many different Limbit controllers at the same time. The current task specific Limbit controllers will remain in the game and will be better and more efficient at performing their one task than the multi controller is. Think of the new controller as being a kind of jack of all trades but master of none, the original controller being very laser focused on just one task but being better at that task as a result. You will only ever be able to install one of the multi-limbit controllers in each of your ships at a time and they come in the following flavours, Xeno, Rescue, Mining, Operative and Universal. The team showed a table of the functions associated with the new role specific controllers which you can see on screen now. The Xeno controller can program Limpits for decontamination, research and repair. The Rescue controller can program Limpits for fuel, hatch braking and repair. The Mining controller can program Limpits for collecting and prospecting. The Operative controller can program Limpits for collecting, recon and hatch braking and the Universal which is only available in size 7 can perform all of the functions. The controller will only allow you to add a single one of its functions per fire button so for example running the Repair controller you won't be able to fire off repair and fuel Limpit from the same button press, they'll need to be set against two separate fire buttons. The multi-limbit controller has been a long requested feature from the community and it'll be interesting to see where in the game it finds its place and how the existing controllers fit around it. The team then spoke with principal gameplay programmer Dominic Corner about the second new feature coming next week. From Update 9 mission givers can now potentially appear at an Odyssey settlement and when spoken to offer a mission to a player. The mission giver can apparently be any random person walking around within a settlement but they will be shown on your compass as having a mission available. The mission givers will be staff members for the dominant faction at the settlement and will give missions that serve that faction specifically and the BGS conditions affecting that faction will govern what missions will be generated. While you're at the settlement either having just picked up the mission or returning to drop the mission back off the NPCs themselves are still vulnerable, that's to say if they're killed by you or another player you essentially won't be able to pay that mission back in. We're not sure yet what the end result of that action would be, whether the mission immediately fails or you simply can't hand it in, clearly some science of the slightly murdery variety is needed there to get some solid answers. If you have a positive result it's worth making sure that they get to see the end of their shift with all their faculties in tact, in working order and with no new plasma induced facial orifices being present. This new update to the Odyssey settlements and mission system will in principle at least see the games thousands of settlements turned into mission hubs. It should certainly add an extra layer of dynamism to the mission experience and it'll be interesting to see if and where Fdev take this implementation of the mission system in future updates. Another important update we have for you, Frontier have announced that this Friday, the 3rd of December, they will be releasing their end of year community update, talking about the year that has just gone and what to expect from them as we move into 2022. These updates almost always these days include some important nuggets of information and possibly even details on unannounced features. So as soon as we have that we'll bring it to you here. What are your plans for the new multi-limbit controller? Are you already planning a rework of any role specific ships you own? Let us know in the comments below. That's it for now, thanks very much for watching, if you enjoyed this video consider subscribing to the channel and maybe take a look at one of our other videos linked on screen right now.