I'm going to start with the tip that a lot of you out there probably don't want to hear and don't want to agree with but it is extremely true and if you ask anyone who plays at the top level they would agree with this, off the ball movement is more important than on the ball movement.  You will be a more effective player if you focus on your off the ball movement because most players never even think about that, they just think about what they're doing when they do have the ball. Did you know that the average player in a professional match is on the ball for 45 seconds to 1 minute in a 90 minute match? What are they doing the other 89 minutes, the other 89 minutes and 15 seconds? What are they doing off the ball? And that's what I want to talk about and that's what you need to start thinking about. If you don't know about me I used to be a huge underachiever but through obsessive self-improvement I found my success. Earned a college scholarship, played for my national football team, a YouTube channel with over 100 million views, I've helped players worldwide and I'd love to help you improve faster and achieve more. Thinking about. Okay, so like I said what you do on the ball it's it is important, it's very important, you got to take care of that ball, you got to be direct, you got to make things happen but you're not on the ball that often during the game. Most of the time you're going to be off the ball and we got to talk about what we're doing when we're off the ball. Okay, so two things, I either want you to support the ball, get in good position to support the ball, give your your teammate an outlet so if he gets trapped he has somewhere to go or you're trying to make a forward run so we can get into attacking positions and we can create goalscoring chances for ourselves but also for our teammates. Okay, so when my teammate has the ball and he's dribbling up the field a lot of us we're just watching him. We're slowly jogging up the field or we're slowly jogging up or even worse we're just standing there, we're just watching. Okay, we're saying hey buddy you got the ball go ahead, you got this covered, no you need to get involved in the play, you got to get up the field okay and again show for those passes or make forward runs or if he gets blocked off we need to be there to support him. Okay, let's say you're playing as a center back and this fullback has the ball here. Okay, if I'm in this position this isn't good he doesn't have an outlet he can't go backwards what if he gets trapped he's screwed. Okay, so positioning is what you want to focus on when you're off the ball. Am I creating a passing angle? Am I creating an outlet especially if I'm a defensive player or a central player like the center backs or a defensive midfielder? Am I creating an outlet for him to get out of trouble or am I screwing him over because my positioning my off the ball movement isn't good? Okay, on the attacking side of things am I getting space for myself? Am I making runs showing for the ball or am I standing still and letting the opposing team defend me making their life really easy? Okay, so when you're off the ball when you don't have the ball I want you active always finding new space always moving into new space when you my teammates are going forward am I making forward runs and I'm trying to go forward if my run doesn't work if I get blocked I'm not just going to give up and never make that run again I'm going to go find new space we're always going to be constantly moving off the ball movement that's how you get involved in the play if you're not getting on the ball right now it's not because your teammates aren't passing the ball or your skills aren't good enough it's because you're not active enough you're not making forward runs you're not supporting the ball you're not switching up your runs okay you're just standing still and you're hoping for the ball rather than working on your off the ball movement getting in good positions to ensure that you increase your chances of getting the ball okay so let's talk quickly about the defensive side of things because when you're defending you're not on the ball okay and this is extremely important I talk about this all the time but a lot of us aren't doing it especially our forwards okay their team has the ball and we're just watching what are we doing off the ball can we press to win that ball can we press can we close down these spaces okay can I anticipate where the ball is going to be played and close that gap okay so off the ball movement when you don't have the ball defensively am I switched on am I thinking about okay the ball is going to come into this space a lot of us the ball is getting there and then we're reacting okay you need to be think about reading the play if you can see that he's gonna ping that ball cross view like this okay I need to anticipate and I want to get there as soon as he gets there okay so off the ball movement defensively think about your positioning okay try to read the play don't just react to the play anticipate the play okay so can you work harder defensively to win the ball back for your team working harder when you don't have the ball how hungry are you when you don't have the ball everybody wants to work hard when we do have the ball a lot of us are willing to make those four runs you might not be doing it all the time or as much as we should but we're doing it a lot more than making runs on the defensive side of things okay so think about the next time you're playing what am I going to do when I don't have the ball am I making positive runs am I always active am I showing for the ball am I making forward runs am I supporting the ball defensively is my positioning good what positioning do I need to be in right now can I anticipate the play and read where the next pass is going to go and then get there and then when the defender or the attacker does have the ball can I close them down quickly and stay with him or work really hard off the ball to win the ball back for my team to be more involved in the play the second tip I want to share with you and this is so important I see this in young players and even experience older players all the time how do you respond when you make mistakes so say you receive the ball and you lose possession what do you do after that or you have a chance to score and you miss that opportunity what do you do after that how do you respond okay everyone makes mistakes the best players in the world make mistakes they miss five yard sitters they miss three yard simple passes but what's important is how do you respond okay most players as soon as they make a mistake head is down shoulders are down body language is down their negative self talks going off everyone else is getting on them like come on man what are you doing get yourself together and they just go down and down and down and down okay the only time they play well is if they make no mistakes what happens when you make a mistake you need to respond positively if i get on the ball and i lose possession of the ball okay i shake it off right away first of all i go chase that ball down right away i win it back for my team then i get then i play simple then i focus on my first touch a lot better next time i focus on taking care of the ball playing those simple passes and i work myself into the game okay if you miss uh easy's goal scoring chance or a difficult goal scoring chance you just miss a chance okay most players after that they don't want another chance because they're afraid they're gonna miss or they don't want to even make the run to get in front of the net because they know they might miss that opportunity if you miss a goal scoring opportunity you need to be hungry for the next one because you know you're gonna get it okay it's all about this positive response everyone makes mistakes but very few players respond positively and if you can start responding positively after you make your mistakes get over it learn from it if you like this content check out the soccer success planner you can download it for free there's a link in the description below and for advanced training check out the online soccer academy and over it learn from it get on to the next one you're gonna be a much better player and you're gonna stay involved in the game what happens is most players make mistakes and then they slowly disappear from the game because again they're afraid to get on the ball they're afraid to make more mistakes don't be afraid to make mistakes making mistakes is part of the game everyone does it and when other people your teammates yell at you for making mistakes don't take it personally okay because they're going to do the same thing five minutes later and you're not going to yell at them you're going to encourage them you're going to motivate them and then the next time maybe they won't do that to you okay but if you make a mistake let's say for example you lose possession of the ball you're dribbling you get tackle you lose possession of the ball or you receive the ball you have a bad touch you lose possession of the ball I want you to chase that ball down win it back right away get that ball play simple then as soon as the next play the next opportunity I want you to go searching for that ball get the ball again ask for the ball demand the ball okay even if I screw up 10 times in a row I'm going to go 10 more times and search for that ball get that ball on my feet and I'm going to play simple play myself into the game okay so ask yourself currently how am I responding after I make mistakes after I lose possession after I make a bad pass or after I miss a scoring opportunity does my head go down do my shoulders go down do I talk negatively to myself tell myself I'm no good why would you miss a chance like that or do I pump myself up shake it off learn from it and go searching for the next opportunity the next tip is move the damn ball move this thing right here let the ball do the work and I'm talking mainly to my really talented skill technical players because I find these are always the players who are taking too long on the ball yes there's the type of player who's just they're a bit slow they're a bit nervous their touches aren't the best their decision making is not the sharpest and they're playing too slow okay they need to play a bit quicker to receive that ball pass that ball move and get it back but it's our talented players who are having the most problem with this idea it's because you have all the skill okay and you need to be honest with yourself are you this type of player are you making this mistake because they have so much skill because they have so much talent and ability they want to show that off every time they get the ball they want to impress their coaches their teammates they want to show their skill and they want to use it to create chances but the truth is these players are taking way too many touches and honestly I love defending that type of player I love coming up against that player any time that player gets the ball I love just pressing them quickly clipping at their ankles going in hard to tackles and winning the ball because they think they're because they have so much skill they have to show it off like I said and they take too many touches they're on the ball way too long okay my defender might come to press them and then I just get in there right away and what happens is they lose the ball they do it again they lose the ball their teammates start yelling at them getting down on them they start getting frustrated with themselves head goes down and they just play worse and worse and worse okay but the truth is this player is way easier to defend than the player who really keeps it simple this guy here always plays two touch he doesn't have as good of skill but when he's on the ball he just gets it he moves it he moves into space this guy's way harder to defend than this guy who has all the skill in the world but he takes too many touches and he takes way too long to make decisions okay if you're a skilled player you need to move the ball even quicker you will have chances to use your skill okay but that's going to come from playing quickly so say I receive the ball in here receive pass find new space get that ball turn play that ball find new space suddenly you'll pop up and now I have space to attack now I can take a couple touches now I can cut inside get my shot on goal okay there will be times for you to use your skill but you need to understand when to do that and when to not and mainly in the defensive third in the middle third if it's in really tight areas here I got defenders around me you need to move that ball okay have a focus on having a really good first touch move that ball then get into new space turn good first touch move that ball can you play two touch move that ball move that ball move that ball move that ball so important the next time you watch professional football I want you to count the amount of touches each player takes on the field when they do take multiple touches I want you to think about what situations or what areas they're in okay did they pick it up on the wing and they had tons of space and they didn't just take ten touches they took ten touches but they sprinted up the field cut inside and then laid off a pass or cut inside and whipped across or cut inside and took a shot okay there will be times for you to use your skill when there's open space to exploit when you're one-on-one you just have to beat one guy to get a shot off okay but the majority of the time watch professional football count the amount of touches they take and watch how fast that ball moves around the field okay if you're a talented player your skilled player realize you're going to get more of the ball if you move it quicker if you take ten touches every time you have the ball no one's going to want to pass you the ball because you're a ball hub okay so move that ball quicker let the ball do the work when you get it pass it move to get it back and you're going to be surprised at how much more you get on the ball how much more you get on the ball how much more you are involved in the play and when you do have your space yes feel free to take those touches use your skills in those dangerous areas okay but the majority of time move that damn ball i want to talk about a very important idea and i used to do this a lot when i was younger and i see players do this all the time is you slowly disappear from the game you might start the game really well like you're really involved you're on the ball you're making runs you're getting involved you're playing really well and then as the game progresses 20th minute you're getting a little less on the ball 30th minute a little less 40th minute you're nowhere to be found second half starts you might start well again 5 10 minutes is good you're sharp you're on the ball you're getting involved and then slowly 70th 80th 90th you're nowhere to be found you haven't touched the ball you're not involved in the play you're not making any tackles you're not contributing okay so in order for you to stay involved in the play for the whole game you need to do a couple things and it starts right here in your mind keeping focused okay if you're not focused on your movement on what you're doing and noticing okay i haven't touched the ball in a little bit i need to change what i'm doing i can't make the same runs i can't stay in the same spot i need to change things up i need to be more active i need to get myself involved in the game okay so try to keep a mental tab am i involved in the game right now if not i need to change that because you'll find again it usually when you're starting the game you got lots of energy you're working hard off the ball you're chasing guys down you're getting involved you're demanding the ball and then as you get a little bit tired and tired and tired you slowly slip out of the game okay so you need to number one ask yourself mentally am i involved enough am i getting involved in the play so keep your focus on being involved in the play a couple things i want you to do number one go searching for the ball if the ball is not coming to you don't expect your teammates to find you you gotta go searching sometimes you gotta change up your runs say if i'm playing a striker i might have to drop a bit deeper into the midfield to pick the ball up or if i'm out on the wing i might have to come inside to get that ball okay go searching for that ball get out of your position a little bit i would much rather you'd be out of position and get on the ball then stay in your position out there on the wing and never be involved okay your coach might not agree with that but personally if you like this content check out the soccer success planner you can download it for free there's a link in the description below and for advanced training check out the online soccer academy but personally i think you as a player you need to be involved as much as you can and there will be times when you're staying really wide and you will get involved because you're demanding the ball you're getting your width early you creating space for yourself and you're getting on the ball but if you're not getting the ball do something about it don't make the same run switch it up okay go searching for that ball on the other side of things if you're not getting involved i want you to go hunting for the ball and what i mean by hunting is on the defensive side of things okay start anticipating the play when their team has the ball they're moving it around can you anticipate where the next pass is going to go and then go hunting for that ball and when i say hunt that doesn't mean you're jogging slowly to get that ball you're sprinting after that ball you're chasing you're pressuring that guy you're forcing them to make a mistake you win the ball back for your team and then you either exploit the open space that's given to you or you get that ball you move that ball and then you start playing those little passes getting moving around again go searching for the ball getting involved in the play okay so number one mentally ask yourself am i involved enough no i need to do something about it i need to switch it up i need to stay mentally focused but i need to stay physically focused and involved with my movement okay second go searching for the ball when your team has the ball go searching find new pockets of space don't always make the same run definitely don't stand still because no one's going to give you the ball but switch your runs up so you can search for the ball get that ball on your feet then play those little passes combination play get involved in the play and finally the probably the best thing you can do if you're not getting the ball is work harder defensively go hunting for that ball okay can you chase defenders down can you chase midfielders down when your defender is closing someone can you come and double okay can you go hunting for that ball win that ball defensively and you're going to get way more involved in the play okay so think about those things think about being involved for the whole game extremely important this tip will absolutely transform the way you play if you actually use it it does work as an extremely simple piece of advice but it's so powerful and that is i want you to be extremely direct what does that mean that doesn't mean i'm just going to kick the ball at the field direct as in going one pass to beat everything i'm still trying to play nice football i'm still trying to keep possession and move the ball but whenever i have space i'm trying to attack you need to score goals to win the game okay if i'm always getting the ball i'm going backwards i'm never going to score goals so whenever you can ask yourself get a head shoulder check look over your shoulder is there space get turned can we play forward can we move forward play forward move forward play forward move forward whenever i get the ball i'm trying to attack i'm trying to be extremely direct if they're not going to close me down if they're giving me all this space i'm not going to get my head up realize their space and then jog into this space okay i already know their space i receive the ball my first touches in the space i sprint at that net if nobody closed me down i just score the goal celebrate and win the game for my team okay most of us we're getting the ball like i said we're getting turned now we got our head up now we realize their space we're still a bit hesitant we're still looking for a pass rather than going forward and being extremely direct okay so the next time you play i want you to think about if i have space i'm always going to take my first touch into space towards the net okay if i have a teammate who's open in space i'm going to get him that ball as soon as possible if you were out here and you were in this if someone was out here and you were in this position and you were in open space you wouldn't want him to take a couple touches dribble up and then make a decision you would want him to get you that ball right away okay so when you're on the ball ask yourself can i play forward and then join in the attack or if there's no passing options can i dribble forward and be very direct either get to the sideline and whip across or get in the box and get your shot off okay but i want you to think about being extremely direct every time i get the ball can i score is there a chance to score is there a chance to help my team score is there a chance to get an assist i'm always trying to play forward saying that sometimes you can't play forward sometimes i receive the ball and there's three guys on me i'm not just going to turn into trouble because dylan said to play forward no okay you got to know when to play forward and when to keep possession of that ball maybe i just play that one touch and then i go find some new space receive okay this guy's off me now i can turn now i can dribble forward now i can play that pass but try to always go forward if you can if you can keep possession of the ball try to go and get that ball again and then play forward be extremely direct go for goals at every opportunity possible i think we can agree that there's sometimes when your teammates piss you off they really frustrate you because maybe they're not playing quick enough they're not playing smart enough they're not playing hard enough they're not playing with enough energy or intensity they're not playing with enough urgency okay certain things will frustrate you and it almost feels like you can't do anything about it and maybe even worse you start expressing that frustration verbally you start yelling at them you start putting your hands up in the air moaning groaning what the hell are you doing getting really frustrated and showing this emotion okay but guess what that isn't going to make them play any better now i know like especially in like english or those uk countries of different countries real hard working football countries if a guy makes a mistake his teammates are usually like what the f are you doing man they're all over him they're verbally just tearing him apart and they think that that's going to make him play better and for some players it might okay but personally i think there's a better way to motivate your teammates and make them play the way you want to play and that is by leading by example okay so if i want my teammates to play with more energy with more intensity i need to do that i need to be pressing guys i need to be closing the gaps down i need to be getting the really tense going in hard for tackles if my teammates see me doing that then they're gonna get a little pump of energy they're gonna say hey if he can do that i can do that or if he's gonna do that for the team i'm gonna do that for the team okay so instead of getting down on your teammates lead by example as well when you're on the ball if i'm on the ball i'm making sharp touches i'm playing quick passes i'm moving on the ball if you like this content check out the soccer success planner you can download it for free there's a link in the description below and for advanced training check out the online soccer academy


Hi there and welcome to Little Garden on the Prairies. It is a beautiful sunny Saturday morning down here in my indoor growing space and I would like to just take you on a tour to show you how my Cracky hydroponic plants are doing. I'm starting to see a lot of progress and growth happening with my plants. I also want to take you to my grow tent where things are not going quite as well. I'm having a few issues with my cucumbers, leaves are turning yellow. Being this is my first year using a grow tent, I'm kind of learning as I go and trying to figure out different things that I need to do to keep the plants healthy inside the grow tent. It's definitely a different process than just simply growing on the shelf here with lights. So let's get started. I'll take you on a little tour and let you see what's going on. So I have raised up the lights here so we can have a good look at what I have growing here as far as my Cracky hydroponics. I have my five different peppers coming here. They're all looking pretty good. Getting lots of leaves growing. Just check out the roots here. This is the candy cane sweet pepper. So some good roots going there. I think this one here, the Sunbright, was one of my slower growing peppers, but I see now it's got some roots reaching the nutrients now, so it's going to take off. This is a basil that I cut from my basil plant outdoors this fall and set it up in the Cracky. And I've been harvesting the odd leaf off of it already. And there's my lettuce. I'm very excited because it's going to be time to harvest a bit and make a salad pretty soon. The fastest growing is the romaine here. And this is called salad bowl, which is just a leafy lettuce. My arugula and spinach coming along good. So I'm pretty excited to have my first homegrown salad and I can take some cuttings from these green onions that I have going to add to the salad as well. But I have a fan set up here so that it is blowing on my Tiny Tim Aero garden tomatoes. They have lots of blooms on them now. So every evening I come and turn on this osculating fan to try and help with pollination. And hopefully in another week or so we will start to see some little tomatoes forming. So it's time to check out what's going on in my grow tent. I've got two tomatoes, two cucumbers, and a strawberry plant going here right now. So I'm very excited to show you my strawberry plant here, which has one tiny little red strawberry on it. So there's not a whole lot of strawberry here to share with anybody, but I'm still very excited that I successfully grew a strawberry indoors. And there's more blooms coming here. So it's something I might try to expand on and get more plants going in the future using this crack key method and maybe increase my strawberry harvest so that I can actually have some to share with my family. My Russian Saskatchewan tomato is doing really good. And you can see here you can see here that we have some flowers coming pretty soon. So this has been just growing in the crack key with some really strong roots going. This other tomato here is called the Scotia tomato. It's been a lot slower to grow, obviously, and I haven't set up also. I've added an air stone to the water just to see if it increases or speeds up the growth. I haven't seen any really noticeable faster growth in this plant. And here are my two cucumber plants that are starting to really shoot out some vines and tendrils and wanting to do some climbing. But I'm pretty concerned about the yellowing little leaves. And from what I have researched on this, it means that they are possibly lacking nitrogen. So I'm going to mix up a new solution of nutrients with a higher nitrogen content to them and switch out the water and see if that makes a difference because I really don't want them to die out now because they have been doing really good up until this point. So I'm just taking a little closer look here at my cucumbers. You can see the leaves on here just massive. This is the diva cucumber. It has only female flowers, so you don't need to worry about pollination. And when I was having a little peek in here, and as you can see this, it looks like we have our first little cucumber coming here. That is very exciting. So something I just realized that could be part of my problem here with my plants is the fact that I did not have my light set at a high level of illumination because when I set it up, I had to turn down really low. So that wasn't too bright for me and just realized that I had never turned it up. So a real rookie mistake here being a first-time grow tent user. So I have turned up the illumination of the light. We'll see if that helps out with my cucumbers. So I'm going to use my three-part formula Holland Secret Blend here for my cucumbers. I'm going to follow the late vegetative stage as far as my application amounts, which is going to give me a little higher nitrogen level, I think. So we'll see how this works out for the kukes. So it's not very easy to do. You're filming inside a grow tent here, but I think I have it kind of set up so you can see what I'm going to do. I'm going to dump out the water that is inside these containers and try to replenish.  So we'll see how this goes. I will just remove the lid. You can see it's got some really nice healthy roots. These are like the air roots that kind of shoot out. There's about a half a container left here of nutrients. I'm just going to dump them out and replenish. So I'm only going to fill this about halfway full, I think, so that there is a good amount of air still. Even though this one does have an air stone kind of pumping air into the water, I'm really hopeful that this little cucumber here is going to continue to grow. This is my first cucumber. I see I have another one coming here and another one coming here. That's very exciting. So I really hope I can save this because I see these leaves are not looking very good. So again, we'll try to remove the top here without disturbing too much. The roots smell so good. You have to just stop and take away from them. Fresh cucumber smell. Okay, so hopefully I didn't disturb the plant too much there. Lost a few of our play balls. No big deal. We will have to just keep an eye on it. So hopefully with me figuring out that I didn't have my lights turned up very high, refreshing these nutrients with a little more nitrogen in it. Hopefully we will see some improvement in this plant and get some cucumbers. So we've got everything back in place here in the grow tent and we will just keep an eye on these cucumbers to see if we can keep them going and producing some cucumbers in the next few weeks. So please stay tuned for upcoming videos. Maybe we'll have some more strawberries, some baby tomatoes coming soon. So if you haven't already started growing indoors and are wanting to learn how, please check out some of my other videos. I have a lot of how-to videos on different vegetables that you can try growing indoors. So thanks for watching and we'll see you in the next video.


Ja, tudi se vseh različim, da je vseh vseh vseh različim, ne vseh različim, vseh različim, in vseh testujem, tako, da se vseh različim. Tako, tudi, koncert je vsojnjena, vsojnjena, in vseh, kako jaz vseh zelo vseh zelo vseh zelo vseh zelo. So, C, C++, portrait or whatever, you have all those memory issues, right? You read too much, you write to the wrong place, you free the memory and then use the memory and so on. In principle, the same rules would apply to any program in any language. We could, for example, feed randomized input to our Python program to see if it doesn't fall into an infinite loop, but it would be much less useful because all those bugs that come from lack of safety wouldn't be there and programming is much easier in those languages. So, this talk is about fuzzing of essentially CRC++ programs. And if we work in this area, we have to have a whole set of tools. I mean, we ramp up the diagnostics in the compiler. We tell it to turn on the all possible options, all possible warnings. We run our program under a bargrind. We do cover it, we do a GTM. It's another static tracker that can be hooked up to in github. Sometimes it provides very nice results and so on. And then we write tests and we put asserts in our code. And all those things are tools that you just need to use. And if you don't use them, you let some bugs that could be easily caught, not be caught and maybe be found by your users. And so fuzzing is yet another tool in this whole suite. And it also builds on those other tools, because fuzzing is just generation of input, so it's not on its own, it doesn't do much. So, I think it's a bit surprising if you haven't done it, but fuzzing tends to find different bugs, because while random input is very much different from normal input and then you just find different issues. So, the concept has been around for a long time and people have been doing this for years and years, but there have been two technical developments which made it much more mainstream. So, first is that we can instrument the code and know exactly which branches in the code are taken and we can take this data, so we take an input sample, we run the code, we look which paths through the code were taken and then we try to generate a sample that takes different paths and whenever we hit a different path, we know this based on the coverage feedback. So, we are not blind, we can see where we are going in the code. And the second thing is that people started using genetic algorithms to actually take this feedback data and try to generate inputs which would hit more new places in the code. So, I mean, you can think about this as a black box optimization problem where you have a, well, you get generate some input. The input space is very large because you have, let's say, a kilobyte of data that any bit and any byte can be set to an arbitrary value in there. And then you run a program and you get some number that specifies what the coverage was. And you flip one bit and then the coverage changes completely. So, it's an optimization in a very non-linear space where the fitness function for neighboring points can be completely different. So, in this kind of scenario genetic fitting algorithms are generally the answer. And this allows us to find bugs in this enormous space of parameters much faster than we would otherwise. And the kind of a third non-technical development is that people have made it really easy to use or relatively easy to use and it's just nice. So, fuzzing is about just generating randomized inputs in the program. And I said that it's randomized but not random. So, I want to underline the fact that if you just took input from devurandom and fed it directly to the program this wouldn't be very useful. So, many years ago, ten years ago or something like that people started fuzzing system calls. And so, let's take a map. And it has a bunch of parameters as the protocol that specifies how the mapping should be done. And it's an integer so it has four billion possible values. All of those values, only two or three are meaningful. And for any other one the program of the function being tested will immediately return a result that the input parameters are invalid. And this is just not interesting. But so, if we feed random data to the function we will only pass this one parameter. I mean, useful value for this parameter once in every three out of, let's say, four billion times. So, we will spend a lot of time doing nothing interesting. But once we have the feedback coverage we learn that, well, without knowing it up to hurry we learn that there are a few useful values and once we hit them, we keep them and then we build solutions, test samples on top of that. So, how does it work? We have a very simple entry point function that takes a blob of data, so an array of bytes with some length and runs the code to be tested. This interface is very, very simple and this is nice because it allows us to completely separate the stuff being tested from the whole testing framework because we can do this kind of function in any program for any library being tested and then, of course, once we have a fuzzing engine that gives us inputs, we can attach it to any of those programs being tested and it's a very nice split. So, as part of the code being tested we write a function like this and we consume it in two ways. The first one, the straightforward one is that we just write a simple main function that takes a file, reads the file into memory and runs this function. So, it's just a way to test our code once we have a single sample. So, we compile this, run it and then, well, maybe it crashes and maybe it doesn't crash. If it doesn't crash then we go back to the beginning. We haven't found the bug, but if it crashes then, of course, we have something to fix. And this, if we found the crash input then, of course, it's interesting and we save it to the file. So, before I said that this fuzzing test builds on top of the other tools. So, when we compile and run our program if we just do a straightforward compile and run it, it won't be very useful because, well, the problem with memory bugs in C is that you can scribble some memory and your program can crash, for example, a week later. It's not so easy to actually always have an invalid program crash. So, we compile the program with all the memory sanitizers, leak checkers, and so on and try to make the program crash as fast as possible if it actually does something wrong. And, of course, we turn on all the asserts and the bug checks and so on, so on. So, that's one way. And the other way is that we take the same function but we link it to a fuzzing engine. So, it's something that we'll call the function over and over with different inputs until it finds one that actually causes a crash. So, yeah. I mean, we want to apply, well, whatever we can to find the bugs to make the program crash as fast as possible and what kind of bugs do we find? I mean, this is... I think that the first ones, the ones at the top are pretty obvious, right? I mean, if we write past the end of the buffer and our program is compiled with address sanitizer, this will be called because there is a guard inserted and so on. Invalid freeze, unaligned access and so on. And then hopefully we can also find more subtle bugs like buffer over reads and use after free. But also memory leaks. And what it wasn't... At least for me it wasn't obvious and I wasn't expecting this, is that fuzzing tends to find either hangs or very slow runtimes in different parts of the program. So, for example, in system D we have this case where a contact file was being parsed and the location of the starts of the different headers in the sections, section headers in the file, were put in a list. I mean, this code was completely fine. There was nothing wrong with it, but once you had a thousand sections, the access to this list became quadratic and if you had a million, it was essentially an infinite loop. And a human would never write a conflict file with a thousand section headers, most likely, very unlikely, and this is exactly the kind of thing that randomized input gives you. And it's not so unlikely to happen, because, for example, we do automatic configuration with Ansible and maybe somebody writes the generator in a way that actually creates a file like this and the... I mean, occasional people would have a conflict file with a hundred section headers and the program would run a bit slower, but not enough for somebody to notice, but using fuzzing, we kind of nicely discovered this. Right. So there's a few different ways in which the coverage feedback can be done and the one... I'm going to be talking about deep fuzzer and it uses a sanitizer plug-in to annotate the code. So... there's two... two ways that we can run. I mean, once we have the... our entry point function, we can either run it as a single program invocation and then generate a new set of data and start the program again and again and again. And this works okay, and it is very... I mean, it is the most general, but it takes... it has the overhead of starting the program over and over. And... well, a slightly better way to do it is to do it in process. So... but for this to be meaningful, we need to have no state left, right? We need to have... well, no threads, no global variables, nothing that...  And... I wrote that 100 milliseconds is not bad, but we probably want to do thousands of samples per second, so I think we want to go below a millisecond for a single run. And there is a number of fuzzing engines, so engines which generate our inputs. Lipfuzzer and AFL are the most... are the two most popular ones. And... they both do coverage-guided input generation using genetic algorithms. There is also Hong Fuzz, which is a new thing. I think it is kind of the same idea. O3 have the same ideas and provide the same functionality just in slightly different implementations. There is another one. There is Radamsa. It's a tool that outgrew out of a protocol testing... network protocol testing project and it tries to... it doesn't use coverage feedback. It just tries to analyze your input sample using some syntax analysis and then generate another one that is... similar syntax, but... well, mutated. And... it generates surprisingly interesting input samples. Okay. So we have that and now we need to... well, we actually need to do the fuzzing, so we need to apply CPU power to this and there's a very nice project that provides this. It's a Google-funded thing that grew out of Chromium testing. So, essentially, the idea is that you have an open source project, you hook it up with OSS Fuzz, you provide a number of fuzzers and they will run the fuzzers for you. So they... a number of fuzzers, a number of configured sanitizers and they run it in a cluster. Report bugs with kind of like responsible disclosure, so they are... only accessible to project members initially and then after they are either fixed or sometimes they are opened up to the public and it kind of works automatically nice in this way that they will clone your repo and if a fix is pushed to the repo, they will close the bugs automatically and so on. So, in the project we have to have the fuzzers and a way to build them, I mean, essentially a build target and on the OSS Fuzz side, we define a Docker file to prepare a build environment and build our program, a script to build it and if we have the target, we call the build target and some small metadata. So, let's do an example. I mean, I said it's in ksync, but this part is actually pretty generic. So, the entry point function was called doIt in my previous slide now it's called llmvfuzzer test one input, but essentially it's the same thing, right? So, it's a blob of data with some size and does whatever the code needs to do and returns zero if everything is okay. So, a practical consideration is that in this case I want to test a compression function so the function takes two parameters, a blob of data and a compression algorithm specified as an integer and I want to have both of those things in my single blob of data that is given from the fuzzing engine and somehow I need to encode those two things. So, I treat the input data as a header and then use the first byte as the algorithm and the data as the remaining data but also I put a few bytes of reserved space. So, the idea is that as the program as the fuzzing progresses and we find crushers, we save them to files, but as we try in the future we might need to add more parameters and then we want to keep the data stable. So, this is a way to have the input samples preserved and usable in the future even as we add more parameters and mutate our this function I mean this part here. Right? Oh, I wanted to add the if we if we are running under a fuzzing engine we don't want to output any logs or anything like that we want to run as fast as possible so there is this I mean something like this is there to make it possible to turn on the back logging because it is useful when you are actually debugging a crash but otherwise you want it to be completely disabled and so the actual testing we get the data we split it up and then essentially the interesting part is that we call a decode function on the buffer and either it crashes or it doesn't crash okay, so this is this is the actual testing part so I said that there is also a docker file and this is the ugly part because building each iteration of the code takes I don't know why it likes to download so much stuff but it's like a 100 megabytes per iteration but you know it's relatively simple stuff I mean you copy some different project adjust it a bit and then you're done so how does it work we have a helper to call docker for us build image, build the fuzers and then run the fuzer and wait for it to crash so so this is the this part installs the all these dependencies were specified this part essentially calls our build target to build the fuzers and well and then this runs the binary so this is an example output it well it's it is running with lead fuzer and it is using the address sanitizer and there's some limit on memory and the maximum time for it to run and so on and it just feeds samples on the screen it gets up to 2 million samples so it's pretty boring but at some point it crashes and this is in white and black but the nice thing is that if we this is actually pretty colorful output from address sanitizer that includes information about what was the bad memory access that we did and so on and we have the trace back and the important part is here at the end that we get a file so this is the file that now if we run our send alone fuzer with this file we get a crash and we can start it gdv or whatever or bargrind and actually find out what the problem was and I don't know I put some links in the slides for tomorrow documentation and I know I'm out of time yes so I have time for questions please go ahead 2 or 3 20, 30 so I wanted to say this that if you look at the advertisement page of any of those projects in fuzer and AFL they have a long list of projects in which they fuzz and for pretty much every of those projects they have a list of bugs and another thing is that if you start fuzing you immediately pretty quickly find a few easy bugs and then it quickly falls off so if you don't fuzz and there is somebody who wants to find a bug a hole in a project to do simple fuzing and easily find an issue if you take the preventive step of doing it yourself you actually make it much harder because then you don't need to fuzz for 50 milliseconds you need to fuzz for 5 days and that's a completely different problem more questions? ok


Er mwn i gael y gweithio awrthyr llei. Mae'r gweithio ei gael gwybod, er mwyn i'r gweithio awrthyr mae hynny a efallai fan gwybod eu teulu'r awrthyr yn ei gael ffocosig ar y gwybod rhaen nhw i gweithio awrthyr i'r gweithio ar ddi gylingio ei casus gweld amser ganddoeddol a'r gweithio i gael hyd yn eu gael awrthyr i gael am y cyngor ar gyfer yr waith i gael ei gael gweithio ei fawr dim, felly'r awrthyr mae gweithio ar gweithio ar gweithio gwybod. If you don't build on these foundations, you're really, really likely to fail because they're awesome. So that's why I've been doing open source for 152 days and counting. Partly to give back and partly as a process for me to learn lots of new things very quickly. Learning new things such as hardware.  You can thank me later. And prior to this I wasn't really doing any open source whatsoever and that was mostly due to this project Conduct IO. It was around the time that I was starting to learn AngularJS and Ruby on Rails and I wanted to get really good at it so I banned myself from working on any other projects in my spare time. This project really suffered from a ship it failure. It was never quite ready. The mobile version or the API and the documentation just weren't ready and I was a bit too precious about it and never shipped it. 18 months going by. I've not worked on any other project. I'm just feeling incredibly demotivated. But eventually the cycle was finally broken when I released Kevlar. This little project that I spent an hour building and tens of thousands of people used it and this got me excited again. I built another thing that I wanted to build for myself for the JavaScript group that I run which is a polling system, real time polling system and I released this and hundreds of thousands of people started using it. I got excited again. Even a French university used it to run their student elections which was just amazing. So I decided I'm going to open source like everything. So I'm going back through my old hard drives and finding old tools that I built and things like that and just putting everything that I've ever built up and this taught me quite a number of things. So one of those things is to ship early. This is the first version of Kevlar and the mobile experience on the left was really sucky the first version. But it's not nearly as sucky as the one on the right. No website whatsoever. So ship early, ship often. I wish I shipped early with conduct because on day 18 I decided that I'll just put that live as it is because you know a new attitude I'll just go for it. And it's something I spent 18 months on and nobody uses it. I don't even use it. So nobody cares. And this GIF really has nothing to do with the talk but I think you all agree it's awesome. So lessons learned, working on other people's projects that spaces you to new processes and different opinions.  So yeah, that's brilliant. Don't be afraid to give stuff away. Not everyone wants to steal your ideas. I have time for new projects. Because everything's open source, if somebody wants the scale to a billion users go for it like I care. So I have time to focus on new stuff that actually interests me because I don't need to maintain the bits as much now nobody is ever going to use my work ever again. And I have less time for other things. So doing open source every day is quite difficult because I have to find the time for it and writing and doing events and things like that. I have less time to do that. So that's a negative. I've been Adam Butler. Thank you very much. I've actually just raised my Twitter handle from this slide which is really annoying. But my name's Claire. My Twitter handle is Cytation which is the word Cytation with a K because Ks are cool. And I work for a company called Yumi in Sheffield.  As part of this, I've been really thinking about data and what we ask users to give us. And a lot of this data is really sensitive. And something that's quite close to my heart and my interest is how do we ask people what their gender is? This is really complicated. This is kind of complicated because not everyone fits into the male-female box. So this is kind of half, hey guys, forms are a bit weird. And this is also kind of let's learn about non-binary agenda in less than four minutes, 20 seconds, which will be great. So between 1% and 5% of the UK population identifies as having some form of gender variance. This can be kind of intersex people. This is people who have kind of a chromosomal or physical abnormality. It's not really the right word. It's people who kind of don't fit into what we consider to be like the male body or the female body. There are people who are transgender and these are people who are transitioning between one gender and another. And these are also people who are growing number of people who identify as non-binary. These are people who identify as a third gender or as having no gender or as being a mix of the other genders. So this is a really difficult concept I know and it's awful for a lightning talk but there we go. But it's also really hard information to get because it's very personal. But how do you let people who don't identify with the male-female checkbox use your website in a way that's comfortable for them and is important for them? So the main issues these people will face are privacy is a massive issue. A lot of trans people, a lot of LGBT people will be in multiple identities at once. They may be out to their friends but not out to an employer. Google hangouts recently when that changed to hangouts from SMS outed a load of trans people because it merged all their Google accounts together. There's a lack of official identification. You have to be male or female on a British passport currently. The terminology is varying and if any of you guys have ever tried to look this stuff up there's a lot of words. There's a lot of very complicated words and there's a lot of insular words that belong to this community that you probably don't understand and it's really easy to give offence accidentally. You need to be aware that users will need to change information often with this whole multiple identity thing. People will be moving from one identity to another. They won't have official identification because that either doesn't exist or it's very difficult to come by and requires a lot of money and time and effort. You need to be aware of these things. I gave this talk at a UX conference and I had to explain to them I'm not a designer to which they all have. That explains the balsamic diagram rather than drawing anything nice and HTML. The first thing is to be really obvious about privacy. This matters to every single person with any piece of data that they give you but for things like this it's also very important because it's very sensitive data. Always say this field is going to be visible or it's not going to be visible etc. Don't use titles as a workaround. This really irritates me because people are like we can't ask them if they're male or female. That's kind of rude so what we'll do is ask them if they're Mr or Miss. I have solved that problem. Don't do that. A lot of people use doctor on a form to get around that. I have seen forms with doctor male and doctor female as separate fields especially do not do this. There is a gender neutral title if you have to ask for a title. You don't legally have to have a title but there's MX pronounced MIX and that is a gender neutral title that's accepted by the DVLA, accepted by the passport office and accepted by banks and utilities companies. The third thing is to really ask about what you care about.  Do you care about physical attributes? Do you care about their body shape? Do you care about whether they are going to have children or not? Whether they would give birth or not, that kind of thing. Ask about those things. Make it really easy to change information. But how do you, if you have to ask about gender because like a high rep has said all the marketers really care about gender right and we have to ask is how else are we going to know if they like Barbies or Hot Wheels right? So if you have to ask, three text fields of the way. I've got a blog called asking about gender in which I'm collecting examples of really good ways to ask about gender. So a way a lot of people are doing this now is you have this big list of options. You see Facebook in the bottom corner, OKCupid.  But kind of having the three text fields are letting people pick from multiple options. Oh god, I'm running out of time so fast. It's really good because you've got these. You can still kind of say we've got like, we don't have two options. We've gone to like 30 options or whatever, but that's fine. You can still do stuff like that. If you want more information about this, take a photograph of this slide because these links are really good. But these are kind of organisations that deal with other organisations talking about gender, non-binary gender and how best to kind of work with these people and take information from them. Thank you very much. So I've been doing a lot of open source projects on my own. So I have three of them here which I'm going to have to go through at speed because five minutes isn't four minutes and a half is not so much, OK? So the best thing is you just read this. The first one is an e-commerce engine. It does all the normal e-commerce stuff. It's on GitHub. It's very small. I used to use Spree for six years if anyone knows that. It's much smaller. One can actually understand it. And it's made for Europeans. It has VAT built in. It's an organisation. So anyone can do extensions easy. It's a website. I've even written user and development guides. There's tests and my wife's using it in her shop for a year. It's pretty stable. So don't check it out if you like it. So then I was very encouraged how fast that went, this own e-commerce thing. I went ahead and did what I've always been thinking about is a Ruby or virtual machine. Specifically I've been wondering why are those not, why don't they compile the code and why don't they use Ruby? We all hear, we all think Ruby's the better language, but nobody seems to be using it for a virtual machine yet. I've started. The reason, of course, is that C folks sort of own this compilation thing and it's supposed to be really difficult. So I picked up some gem and cleaned it up a bit, tested it, took me four weeks to get a hello out of it. No C code, what sort of involved. Also parsing is supposed to be very difficult. Ruby parsing probably is if you do it like 100%. But if you don't then it's not so difficult either. It's understandable actually. What is difficult is Ruby. Ruby is actually quite complicated. Always sort of, if you think about what send or what blocks are, I'm always getting confused about what is with compile and runtime. So I've written a book. Well, I'm in the middle of it. It's the basic. I can do executables by now. I've got an architecture virtual machine, a register virtual machine, arm assembly code, got some tests. But it's definitely a work in progress and if anyone's interested in virtual machines, very welcome to join. And the third one is I picked up sort of by accident is a wiki, which I was supposed to do with Florian who has maintained Gollum Rails for a number of years. But he's dropped out now. So I'm alone, which I don't really want to be. Anyone. So, well quickly, one and a half minutes. Wow, that helps not reading them. Just to go through them again. Oh, no, no questions, questions with us. No questions. I've got a confession to make. This has nothing to do with Ruby whatsoever. For years and years I've had an interest in just generally how the internet works and sort of learning. I spent a format of years reading RFCs because otherwise it would involve talking to girls and that sort of stuff that just frightened me. So just to give you a brief overview of the domain name system, how it works. A famous quote, there are only two hard things in computer science. Cash and validation and naming things. DNS involves both heavily. So this is just taking us through how a DNS request works. We have my laptop on the left-hand side here. We're looking to make a web request to my home page, the was.name. So first of all, the laptop checks to see if it's got an entry in its own sort of local static list of host names. That's stored in et cetera hosts in most systems. If it doesn't find something there, it checks to see if there's something in its local cache which is stored in memory and managed by the C Library. So it's available to all applications usually. If it doesn't have the answer there that it can answer immediately, then it sends out a request to a local DNS server. This will usually be configured automatically via DHCP or something like that, but it picks up the IP address of a name server it can talk to. Usually in your home network, this will be the router sitting at the edge of your home network. In my case here, I'm using Google's public DNS, so it's making a request straight out to the internet to <IP_ADDRESS>. And so Google's DNS looks to see if it has an answer to the question already in its own cache. And DNS can be ridiculously fast because it often does have the answer to these questions and it can just answer straight away. However, in this case, let's say it doesn't. What it's then going to do is it'll either talk to its peer DNS server, which will be another one close by, or let's assume that it's talking directly to the well-known set of root servers. Now every copy of Bind, which is the internet nameset of Stamen, there are a few but Bind is the most popular one, comes prepackaged with a list of root servers there are 13 of them and the IP addresses for these root servers. This is kind of the way you bootstrap the domain name system. And so it picks one of these root servers at random, let's pick c.root servers on that, and it sends off this request to say, what's the record for what's that name? Now the root DNS servers couldn't store all of the information for all of DNS everywhere. The sheer number of entries is just incredible. So what it does instead is it's authoritative for the root zone, which means that it knows all of the DNS servers that you could go and talk to for each of the top level domains. So .com.net.org.name. So it can't answer the question directly but it can say, listen, for the .name domain, go talk to this set of servers. And for a bonus point, I'm going to give you the IP address of these servers as well, just because that can be helpful and that will shortcut your next step. And so it sends back saying, for the .name domains, you want to go talking to g6.nsltd.com. And so Google's DNS, looks to see if it's got the answer.  Right, so Google's DNS goes, it's got the answer to the question. I'm going to talk to g6.nsltd.com, ask it the same question. It's going to reply saying, I don't know the answer either. But I know the .name domain is served by cloudflare.com. So go and ask them instead. So the Google DNS server goes, okay, right, let's ask cloudflare.com. At last, we've got somebody who's authoritative for the .name domain. And so it returns back the IP address. Google DNS server caches that for the next person to ask. And it returns it back to the laptop. And that's it. Hello, everyone. I'm Francesco Canessa. I work for Quil content. I'm going to talk to you about next-gen payment system. But what are this next-gen payment system? I'm going to talk about Apple Pay. You can pay with your finger. Or Google Wallet. I don't know NFC. Something. No. Paypal credit cards. Yeah, like 70s systems, maybe. No. Bitcoin. No. Yes, Bitcoin. Why Bitcoin is better? It's not the 70s. It's new technology. So your stack will not talk to, I don't know, Cobble or Fortran code. Hopefully. No. And it's a push system versus a pull system. So basically I'm going to talk also about microtransaction and the reference client. So why push... No. It's a push system, not a pull system. So basically you have to authorize the transaction with your private key. Because it's based on public key cryptography. Like asymmetric cryptography. So there is a key pair, public and private. And you sign your transaction when you want to send money with your private key. And that's why it's a push system. And it's like WebSocket versus long polling. Almost. I don't have time unfortunately to explain everything. But yeah, let's talk about why it's good for microtransaction. I choose these three are my favorite. Of course there are tons of why Bitcoin is better. But yeah. Micro payments or microtransactions because there are no transaction fees or at least the transaction fees are very very small. So in normal you have a like fixed fee that is 20p. That's why when you go to a shop and you say can I pay with credit card this ice cream and say not minimum it's 5 pounds, sorry. And yeah. This is the current value. Bitcoin is not very useful as currency. So there are millibits that is 1,000 of Bitcoin and right now it's 20p. So 1 pound is 5 millibits but we don't care about the price because Bitcoin is an awesome piece of technology and we are programmers we don't give nothing about technology. Not about the price. We want to develop things because the world needs us. I mean we are programmers we are powerful and we can program now money. Like directly Bitcoin is a server like you don't have really a client server system like in every PayPal has its own servers or I don't know credit card like Visa Mastercard have their own servers and you talk to an API. No. This is like full system where every server is a node so I have only one minute and I will introduce you to Bitcoin D that is the Bitcoin D one. You have to download it via Bitcoin.org and it's a reference client so it's the main open source project around the Bitcoin ecosystem. There is a configuration where you can set the user password and this if you are on a laptop because now the blockchain is very big so you have to use these settings and you can use it via ROJSON Bitcoin CLI and you can check my presentation because I don't have time. There are a lot of things like you can ask for the balance, you can ask for accounts and the main account is the empty string account but you can create name one then help list comments and then this is an address and there is a dump private key command that gives the private key then the send and that's it. This Bitcoin this is mastering Bitcoin for more really written by Dres Santongolis and I have 3D printed some Bitcoin tags that I am going to throw you so watch out.