So, good afternoon, I think people are getting ready for lunch, so we are with two more sessions. I will try to make it fast so that I do not bore you with my talk. So, if you are back, we are working for a product and it is an e-commerce product. We are building a module for designing things online. So, the idea was you can design things using your browser and print it on your goodies. And not a, it is very common, but so the users can come to the site, design things and say that this is what I want, that you should be printed on the goodies and then they can pay it and then the design is delivered to the printing vendors and then they deliver the things get delivered to the customer. And they can do multiple things, they can upload their own images and resize it, add their own text, add different kinds of shapes and so forth. And it was working well, that is when we realized that we have a problem, that is we wanted to introduce the functionality to certain text transformation, it is not exactly transformation text features such as actually rotating the text or adding shadows to the text, stuff like that. And that is when we realized that the library that we are using for converting the design that you see on the UI to the PDF, that it was not very precise. It has to be very precise, the colors and the position has to be very precise so that the printers can print it very well, so that it does exactly look like how do you see on the site, it gets printed exactly like that on the, on the goodies. So, we hit with the bottleneck at certain transformations were not working as we expected and that is a huge change. And so we have two problems here. One is that the current library does not support the feature that we want to introduce and we want to release that feature as soon as possible. The next problem is that we already have a lot of features built using the existing library and then we also need to migrate that functionality to the new library. So, what we did was the immediate requirement or what business wants is to deliver the new functionality. So, what we did was we approached it using a concept called or a technique called parallel change. So, what it does is that we have both libraries sitting in the code base, the existing functionality uses the existing library and for the new features that we are adding where we had the issue we used the new library. So, this is the parallel change and over a period of time we migrated from the existing the old library to the new one and that give us enough time to test the new library rather than going to into a branch and doing the entire migration coming back and releasing and hit with surprises this give us enough time to evaluate the new library so that we do not hit with another another surprise down the line. Again this is this is not a very new technique this is called the standard branch by abstraction. So, do not branch the repository instead branch your code and over a period as you gain confidence you migrate it and then how long the parallel implementation should be there it depends on a lot of factors. And things moved on now I work for a product called Good Karma. It is a product that is delivered to yoga studios to it is a B2B product for yoga studios to manage their business and so we started still a start up we started 12 to 18 months back and so the product is evolving and we started with certain idea then we as we onboard new customers or we learn from the market we realize that okay there are changes and that means the changes needs to happen even to our database models. Okay so because of the as the product goes the understanding has to reflect on the product as well as on the modeling that you have done on the on the database. So and you know that database is considered even if you are a start up if you don't have millions of customers even then the slowest moving part of your product is database and that is considered as a very high risk thing because if something goes wrong it is very scary especially on the database side migrations and stuff like that it is very complicated and there is high tendency to become very nervous when database doesn't work as expected. So can we the thought process is can we actually make it less risky and that is the whole premise of premise of continuous delivery if there is something that pains do it all the time so that your pain gets reduced it's not the solution is not know to do that solution is actually do it all the time so that you don't have you you take the pain forward and do it continuously rather than doing it once in a while right and that is where the concept of database is refactoring comes into picture and the the key word here is refactoring the refactoring as per that Martin Fuller has explained the beauty of refactoring is that you do it in small steps you do a series of small steps refactoring which gives you a bigger result and that every refactoring that you do has to be taken to small task as small as possible and that is the value of refactoring if you do it in the actual way and similar things can be applied for databases to okay and that is what I learned during the last few months or say even even close to an year so there are techniques none of these techniques are mine there is a book called database refactoring it talks about how do you structure each migration depending upon what kind of migration you want to do right is it a and are you adding a new validation or are you changing the structure of the database or are you adding new index x how do you approach each of this is very well written in that book and I'll take up two examples that I've used recently while while building the product so this this is called the split column refactoring what it does is so the product has a concept of has a module for booking online booking of trial classes that is the customers can come to the come to they get an SMS to a certain with the link then using an IVA system they go to that site and then they can book a trial class with any yoga studio okay completely automated and what we need to know is that whether the customer has attended the class and and that is not where the funnel ends right funnel ends if they become a member of the yoga studio so first they book it get that they get the SMS that first step then they book a class then they attend the trial and then they become the trial that become a member and that's a success criteria of of of the entire thing right so we had a status field in our trial booking stable and the status fields stays whether they have attended or not along with the status saying that okay have they registered okay so it can be they attended but they are not ready to they are not interested in registering now or can be that I'm not I don't want to register now I want to register few months down the line then there has to be a fallout mechanism right so both these fields together we're stored in the both these data together was stored in this particular field which we realized over a period of time that okay we need to split it and so that we can run matter better analysis on that and then give more insights to our customers and that is when we had to split it and we called it as attendance status and membership status first attention stage says they whether they attended or not if they have not attended membership status may not make much sense but that is not mandatory even even without attending it they can still become a member and we so what we did was we introduced new fields still kept the old field and apart from that introducing the field we also added certain triggers or say even every ORM supports callbacks so that anytime when you save the data to status it has to split and store to these two fields okay so this is this is the first step that you migrate to the new implementation and then there are so many so many I asked as part of the code base or even other dependencies that you have they depend on this field so it takes time to actually change everything across right and even even how do you display on the field on the how do you display on the UI or see even other downstream dependencies that you have which uses the same field so it takes time right so it took you can leave it like that for some time and then until until all the downstream dependencies are moved to the new implementation and then you contract it to the new implementation so this is a end-to-end refactoring process you introduce a migration that is a transition period and at the end of it you contract it to the new implementation and so and rather than doing it as a first one step you are doing it in multiple steps okay so another example is split a turbo where in this case instead of splitting into multiple columns we are splitting into multiple tables so we had a billing cycles which had all the payment details we wanted to segregate it because later we realize that okay one people can pay in installments so one in when they are paying they can say okay I will pay now after a month I will pay the rest of them all so it has to be tracked in multiple tables one one billing cycle can have multiple payments so we had to segregate that the same technique we introduced triggers to save to the new table we changed across the application to use the new structure and then you move completely move to the new one okay so the same thing you have a migration time and then you completely switch back and that is where the the the entire process is called expand you expand to the new way and then you contract completely completely get rid of the old way of doing it and so the what is required for you to implement it what is the basics that you need so that you can always approach this one is a versioning you need to have versioning for all your database migrations every migration has to be uniquely identified and as as far as I know I might be wrong in this case but I think almost all the ORM frameworks supports especially those follow the active record model supports the migration way so that you can quickly roll back or say move forward or roll back to a certain state of a migration that's a basic need enough automated tests as safety nets to make sure that okay none of the none of the changes are breaking especially when you are transitioning and contracting okay this this gives you enough confidence and then the last is how long can can it how long it can take for a team to actually contract and that completely depends on various factor I've been a consultant so I I'll say it depends right so it depends on various factors and how long you want it to be how long the migration how long you need the parallel change to be implemented right it depends on how big is the team how much how much critical is the current migration how much time how much downstream dependencies you have how much time you you may need to keep it so that you gain enough confidence right lot lots and lots of factors that you need to think of on and this is not just restricted to the expand contract pattern it I think it is it is about how do you want to deploy database migrations right do you want to have down times then how do you plan your dime times or if you don't want to do a downtime how what is other mechanism of doing it and that's the strategy that you had to build and this is not the this this end up idea of parallel change or expand contract pattern is is is about this low lowing lowing the risks of every release right I mean that's the all idea how can you bring down the risk that every deployment every release is risky but that doesn't mean that we can't release right but you can only reduce that by doing it in the taking care of certain things and what are those principles one is doing it incremental and rather than doing it doing it in a completely taking it as steps itself is a first step and then making sure that any change that you're doing is actually ready to deploy that that making sure that every commit is has enough confidence that you can build that okay it goes to production it doesn't break anything so automated tests and other things helps you in this case and so you can actually you don't have to every deployment doesn't have to be resulting in releases right for example in the case of a migration we have we had actually migrated the database but the user interface or or or or or or it is not visible to the users that okay new changes have been built into the system right and then that is called the risk of dark launching when you're just deploying as a migration it is called the dark launching or even feature toggles help you in this case you can turn off that feature in certain environments because of various reason you want to you don't you're not ready for doing that and so decoupling having having enough mechanism to decouple every deploy from release helps you to lower risk lower the risk of your deployments and doing it in small batches as my as small as possible right and and that's so that's that's very very important without that I think the rest of the things will not work and as a reference I would highly recommend this has a lot of techniques on how do you approach database migrations and some more references and that's it we have time for questions so I can see the parallels between having feature flags and also doing this kind of step where you expand and then contract so what I see happening is over time you have a lot of code where we have things which are really not using you have expanded but not really contacted so how do you so the issue is like you have to remember to keep track of it so how do you do that as part of your planning process when do you how do you kind of do the issue tracking for those kind of things I think it was very important because we don't have do it right it's kind of becoming so that is the reason I emphasize on the strategy okay so what is the approach that you want to take what is the guideline that as a team we want to follow right the same same goes with it can be same goes with future toggles also you can say that no feature no feature toggles can exist in the code base beyond two weeks as if the entire team agrees that okay that's a good time frame then you may need to bring in system so that it is automatically detected or you may have to bring in some kind of system to know that okay there are certain toggles which are existing beyond this time so we had we had used our own backlog kind of thing for feature toggles and this kind of changes to make sure that okay you don't it's it's tracked separately but but interestingly I've heard that there are tools automated tools that certain teams built I've never tried that to check the code say for if it is for future toggles it checks how many toggles are there and then it if if if there are certain toggles which which beyond us expiry time then it phase built so you can go to that level so there will be some kind of a guideline that every team follows for either for expand contract or feature toggle and you can look for that patterns and then have automated systems to fill it that is very great but I've never tried that but having a backlog of yourself and then keep monitoring it when in the normal team meetings or the daily stand-ups bringing that every once in a while might after a while what I've seen is that it sets it down in the team right if you bring it very consistently then I think over a period of time it becomes a habit for that more questions okay thanks


However, the surface energies are practically identical for both terminations. The computed bulk biochemical bond covalency increases near neutral and polar surfaces. This article was authored by Roberts Iaglitis and Ranjia.


High again. In this lesson, we're going to talk about that how to loop through the dictionary keys in Python. In order to do that, we'll make a simple example. Let's make a dictionary. We'll call it myDictionary and we'll put inside it few colors. For example, red, green, blue and so on. It's enough for now. We'll use for loop to iterate through the dictionary keys. We'll type for key in myDictionary. We're going to loop through myDictionary. In every iteration, we'll pick next color and we'll put it inside variable key. And now, let's say that we want to print that current value in every iteration or on other way that we want to print all values of our dictionary. All keys. We'll print them by saying print key. And this loop prints all keys from our dictionary using for loop to loop through the dictionary keys. That's all in this video. See you in the next lesson. Happy coding!


All right, ladies and gentlemen, welcome back to our panel of Red Team Black. So I'm going to start with a few questions dedicated to our two speakers. And then I'm going to go more into general Red Team questions if we have time. So I will start with you, Olivier. We had some questions about RDP. Of course, RDP is very well used in the industry. It's built in on Windows. You can use it on Linux. You can use it on Mac. The question was, are there better alternatives to RDP? I would say wrap RDP in an SSH tunnel. But that might not be convenient. That might be a bit of a troll. No, I think this is the standard. It's really efficient. So there are some proprietary alternatives. And the problem is you need to control the server and the client. You need the flexibility, you need the deployment. So it kind of makes sense that it is in Microsoft's control. So it's a difficult question. And I think it relies on a lot of things. But let's say I would be, I don't know, I just don't. I control all my computing. I don't care about anyone. And I don't need to because, let's say I'm a CSE, something like that. They are a secret service. Then OK, just use something else and enforce it. And make sure you audit it properly because RDP has been audited a lot. But if you are anyone else than secret service, I mean, you must pretty much use RDP. And using something else, it might not have been scrutinized as well as RDP. So no, I think my advice to this still holds is wrap it in something else, wrap it in VPN, keep monitoring it, and maybe speak with the evolution. And I know I'm plugging a vendor here, but they really understand it. And look at what they're trying to do to make sure that it's secure. And if you can't do VPN, or if it's too conky, too complicated, but there are also other vendors doing that. But if you want to avoid additional costs, I think just VPN and making sure that nothing is exposed is a good step. And key patching, key patching. All right, thank you for Rola. Do you have insights on which type of domains, like big tech, large orgs, brands, that you got the most amount of emails from? I don't want to single out any single provider, but I will say that in general, it's a number's game. So the more keystrokes and the more attempts, I guess, to communicate with the domain name system, the more likely you're going to land on a typo squat. So the longer the domain, the more likely it is that there's a typo in it. And the more, in this case, emails are being sent, the more likely it is one of those is going to be a typo. So I would say think about the big providers that have millions and millions of emails going through every second, every minute. And typically, the longer the domain, the more likely it is there's going to be a typo in it. OK, yeah, cool. Next one for Olivier. In your research, I don't know if you read about MS remote desktop services which encapsulate RDP into HTTPS. Do you know if it resolved many of the problems you presented today? I honestly thought that this was RD gateway. So I think it is RD gateway. Does the person who has the question still here? Because if it is RD gateway, then it was in my future work slide. So if it's not RD gateway, then I want to hear about it. But no, honestly, I think this is the remote desktop services. You can enable a gateway which encapsulated in HTTPS. And so for the NLAA, NTLM attack, it means yes. But now, how have they implemented it? If they have implemented it by just layering HTTP on top of it, then as soon as I get to implement that in PRDP, I'll have access. And if they haven't changed anything and they have no reason to have changed the underlying protocol, it's just another encapsulation. I believe that our attack will still work. But right now, it doesn't because we need to do that HTTPS decapsulation. And to be honest, that code is so complex. The guy, are they still here? That code is so complex and hard to maintain that if I ever keep up with it, I might attack it. Or I'll need other interns to do it for me, because I'm not that bright. OK. It's sad, but I'm aging. So Neckrishan would be for Orola. So you mentioned how to do typosquatting. But let's say you are being typosquatted. So what would you recommend to blue teamers in the room? Sure. Yeah, that's a really good question. I think the first thing is to be aware that it's happening. It's really easy to look around DNS. There's lots of good tools out there. DNS Twist comes to mind. It's a free Python script on GitHub. You can find it for free. There's a lot of web implementations of it as well if you're not into running Python. So just being aware that it's happening to your domain is interesting enough. And then you can start filtering for it and looking for instances of it. You can use tools like dig, nslookup, and just see what kind of records are on that domain name. If there's an MX record, that's a red flag. Just being aware that it's there. And you can do a lot to protect yourself and your users from reaching out to that domain. But it's really hard to police everybody on the internet from looking for that domain. So I guess the next best thing is depending on who you are and how much leverage you have and where the domain is registered, you could try to do a takedown request if it's a brand infringement. I think the key is first understanding if somebody's doing it, simply, I would recommend looking at a tool like DNS Twist. It's probably a good place to start. Okay. May I add an additional question? Do you know if they are provisioned to, so we know that you can't purchase Nestle because it's a brand that is a trademark, right? But do you know if typo squatting kind of falls under the trademark infringement stuff? I'll say that from what I've seen, there are definitely efforts out there to police it, but I think it's on a registered by registered basis. I think it's gonna depend on the TLD. There's a lot of factors at play, but generally if it is being policed, it's not being policed very well. I think it's incumbent on the trademark owner to actually fight to go and have that domain revoked, and they do have a lot of power. There's a lot of levers in place for brands to protect their trademark that way. I think it's a mixed bag about whether or not you'll be allowed to register at the first place. But so you, sorry, Martin, you typo squat pretty big names, right? Yes. And you got nothing. You, like no one kicked your door or, you know. Not yet. After the talk, maybe we'll see what happens, but no, not yet. For 45 days, so I'll say that those domains have been registered and active for a lot longer than what I started working with them. Okay. But there's a lot of conversations now about what do we do, what's the responsible thing to do with the domains. So I'm open to discussions. If anybody has ideas, I have ideas about it as well, but yeah, so far, got away with it. Okay.  So I'm gonna, I'm not, I'm just gonna jump on this question. So are there legal concerns about doing typo squatting on a specific company? Is it considered as attacking this company? Yeah. That's a really good question. And I've lost a lot of sleep over it recently, especially knowing that I'm gonna present it in a very public forum. I think yes. I think depending on what you're doing with it, I don't think owning the domain is necessarily enough to call it a criminal act or an illegal act. I think depending on what you do with it and how you use it, maybe, is it illegal to steal mail from somebody's mailbox? Is this the same thing? I think there's a lot of questions about it. I think intent is important. I mean, if I'm in front of a judge and saying, I really wanted those e-transfers, that's one thing, but if it's for security research, I would like to think anyway, that we have a society that wants us and encourages us to point these things out and try to correct them. So I mean, in my case, it's a risk I'm willing to take. I'm not gonna share data with anybody. I'm not gonna talk about personal information. And I would discourage anybody from trying this. It's already been proven you can do it. You don't need to do it at home. In the case of a red team engagement, it's a great tool. I think awareness is probably key. So I think, yeah, it should be illegal, but how do you enforce it? How do you police it? Those are the bigger questions. I agree. And would you like to add on this? No. No, thanks for asking, though. But it was a very good question and it's a very difficult situation. I agree. I agree too. Okay. I work a lot with the CyberTreat Intel team and most of the companies are based there of security prioritization based on threat actors, documented activities. So I was wondering if you have, for your both research, used such Intel, have you seen attacks like that been made by, for example, ransomware or publicly known groups in their campaign, in their TTP? Wanna go first? Go ahead. Yeah? So recently the OCTA breach, which we heard about was RDP. So yeah, I removed that from the slide unfortunately, but I mean, it was just a screenshot saying, hey, RDP is important, OCTA. But yeah, no, so RDP is attacked and there's a lot of IPs out there and some of them are my honeypots. So I'm increasing the number of exposed RDP systems, but it's used then, it's a low hanging fruit and it's brute-forcible. So of course, and the ransomware groups, they're going after a low hanging fruit, but in the OCTA case, they purchased credentials on a forum and then you leverage them and there are RDP credentials for sale on forums. So yeah, yes, it's real, it's used and it's not gonna go away, but I mean, stop exposing RDP. In my case, what I can say for sure is that there are a lot of, I mean, I spoke about it a little bit in my slides, just from the three sample domains I looked at, I think it was over 400 different domains with active MX records that were nonsense domains that don't have real services that I'm aware of behind them. The bigger question is who's behind them and what are they using them for? I think the part of my talk that was most interesting and I think impactful for me is that it's a passive technique. I can stand up a mail server completely anonymously on a VPS anywhere in the world and I can receive these emails. What I do with them, I think as an attacker, I think that's something that needs to be researched, maybe canary tokens and sending things out to these addresses and just seeing what happens. I'm really curious about that question as well and I don't know who's behind them. It would be interesting to see, I don't know of any known cases other than other research I've seen on the subject, but I don't doubt that it's happening. Would be my take on it. Okay, thank you. A quick question for Olivier about RDP. Do you know if two factor authentication or multiple factor authentication would mitigate what you just presented this afternoon? So I think it depends on how it's implemented and I haven't looked at implementations. I would be interested in knowing popular free ones because I don't wanna pay for service to just attack it, but let's assume that it's a pin added at the end of your password. Then the net and TLM capture would work, but the hash would potentially be harder to crack unless you know what that is, the NIP appended and then you add that to your cracking rules. So this would still work, but is this how they implement two factor for RDP? I don't know, I'm sorry. No, no, no, but I mean, I needed to ask but I think it's a fair answer. Now we're gonna talk about Honepods because it's a field that is growing in the cybersecurity industry and there are some companies that really make products that make it easy to deploy Honepods. So I think PRDP is a great project to build Honepods. There will be probably something to do with your work, but do you think it would be a great idea to use PRDP for Honepods and literally have, let's say, sophisticated actors with breadcrumbs, you put some hints, you put some password on the network and have them reach your server and monitor it. What do you think about that? I think this is what I'm doing right now. No, but the problem is that lately we had actor interact with our Honepods and some of the attacks, they kind of stopped doing them and then I was like, why is so? And looking at the replay, I was like, okay, they're transferring a large amount of files. So I reproduced it and it turns out we have a bug. So the transfer really slows down. I'm not sure quite what this is, but I think that we're so eagerly fetching client-side files that even on a stat system call, so the equivalent of a stat system called like, I wanna know the size of the file and I wanna know the permissions, for example, we are grabbing the file. So if the person mounts a drive with a lot of stuff on it and then drops with thousands of files, drops a folder, well, explorer.exe will do a stat on all these files in order to just show how long the transfer will be. But Pyrdp in the middle is doing just like, whoop, whoop, whoop, whoop, whoop, whoop, whoop, whoop, I want all of them and so we have issues to work on regarding that. So unfortunately I haven't caught, but we know, so we've seen the minor, crypto minor stuff being transferred and stuff like that, but we do have scalability things to look at. Also, for example, like on a typical week, we'll have like 17,000 replay files to look at. So I really have a triage problem. The problem with those replay files is that they are all unique and binary, but they are all unique and even if you hash them, they're all unique because they are time stamped in that protocol. So I need to find a way, and Lisandro was working on that actually not so long ago, but we need a way to factor out all of the time stamping and the bits of the protocol we don't care about and then focus on the interesting things because the other thing I want to do with those honeypots more so than finding threat actors is finding also attacks like potential zero days or blue keep and stuff like that. We do have blue keep detections and we do have detection for a couple of them built in, but like why did the protocol fail or who is this, what tool is this guy using that is creating this kind of interaction at the protocol level. So we're all looking at that, but it's a shit ton of work and I have a small team and we're not making money with any of this so this is why it's slow. Makes sense. All right, I'm gonna jump into more high level questions about red teaming, the field in general. Just do your best guys. I think it's gonna be fun. So my first question would be based on your work. What do you think is the cyber security industry's best next move? That's a really kind of big question I think. The next best move for the cyber security industry I think is train more people. I think there's a lot of need in cyber security and not necessarily experts of a super high caliber but there's a lot of work and just grant work that goes into research, whether it's going through honeypot files or looking at stats and email collection there's a lot of work that can be done and I think there's a lot of interest in the field and I think hire more people is probably the first thing I would say is the next best thing we can do. Train more people. I'm glad you finished, but with train because hiring more people is stuff right now. Okay, I'll try, this is super accurate and good. I'll try to go in a different direction. Okay, so during the pandemic, something that I was not doing a lot that I started doing again is play D&D, Dungeon and Dragons, and I'll link it with cyber security. So one of the first things, not the first, one of the latest offerings of my company is tabletop exercises for threat simulation and so what I liked when I heard that is that we are now in a state where we are assuming breach. We no longer think we're gonna protect them. We are assuming breach, but now we are testing you. How are you gonna react? And what's the drill? Do you have plans? And this can be done in a simulated way without much cost. And what's interesting is that you can go deeper and then validate it one day. We'll have red teamers validate the plans, but for most organizations, and we deal with medium-sized company and smaller companies, but for most of them, sitting down with smart people who play some corporate D&D. Okay, let's simulate like, oh, this user received an email and clicked on that link. What's your visibility? It was downloaded. What do you have on your endpoint?  What are the map drives that are accessible to that computer? And you just played, you even could roll some dice if you want. Like, oh, the N drive was encrypted. I had eight.  And I'm not doing the service that it probably doesn't look like that at all, but to me, it sounds interesting. And then you can, this is very effective in low cost because it's just a long half-hour, half-day meeting of simulation. And then imagine the client has a long list of stuff to look at. He was like, I couldn't answer half of the questions.  So I think we are at a maturity level where we can get a lot done and effectively done to get better by knowing how long to spend and then buying the things that will protect us, but not buy first because you have a capex, you know, use humans to buy intelligently products instead. And I think this is where we should go. Awesome, awesome answer. I was gonna talk about purple teaming. I think the industry really needs purple team exercise. They shouldn't pay for big red teams just for having a surprise and a big report that showed them that they have some mistakes. But I really like your answer. I would love to be invited to such a dungeon and dragon game. So another question, not an easy one, but anyway. What's the best way to use a red team for companies? Again, based on your work, if you can. Like, should it be to shake, to rattle the company's cage to show that security is important? Should it be to ramp up the technology, the process, the humans? How do you see red teaming in the industry? It's a really good question. And I think a lot of times red teaming, penetration testing is misplaced. It's the sexy thing to do, right? We're gonna hire some hackers and they're gonna show us how they broke in. I think it's often mistimed or maybe not conducted in the right frame of mind, in the right context. If we used an analogy earlier, if I take my five-year-old and bring her to the Taekwondo arena and I say, test her. What's the result gonna be? I don't know if it's a very productive exercise to just do red team engagements without first taking the baby steps before you're ready for it. I think purple teaming is a great use of red team assets to work alongside and train blue teams, train against each other. And I think that red teams are a great validation tool and I think when you reach a certain maturity in your security organization, that's when a red team is really valuable. But I think you can start with basics and not necessarily need a red team to introduce you to the basic best security practices all the time would be, I guess, my opinion on that. Thank you. And it's also kind of a bloated term right now, like everyone's a red teamer. I don't know, man, I'm sure you're not. And if you have a scope, are you really a red teamer type stuff? But I think this is the definitions and we don't have, do we have a standard bodies that defines what are these or we're just like... The problem is that there are many definitions. If you follow spectrographs, you have their own definition of red team. If you read someone else, it's something else. I think it's a language abuse. So red team is usually used for offensive security or just pen testing, ethical hacking. In my opinion, red teaming is really about, you know, training technology process humans. I follow more the spectrographs definition. So it's about simulating a threat actor based by using several TTPs to create training opportunities for a blue team. But in the industry, it's used for anything, you're right. Yeah. Good answer, Marc-Tain. No, but I just want this to be clear, right? He is the one who should answer those questions. So this guy manages a red team at a large institution and he, like I am a director of research and what about you? I didn't read you. I like red teaming stuff, but I'm not a red teamer either. I'm interested in it, but I'm definitely not at the caliber of either of these guys. But I don't need to be to pull off an effective attack either, which is sort of what I was getting at is we don't need the best hacker in the world to prove that you're fundamentally insecure.  So I think context matters and time and place and asking yourself, why are we hiring a red team? For what, to embarrass us? Are we doing it to actually improve our security culture? I think that's what it comes down to. All right. That's gonna be my... So the next red team questions goes to Marc-Tain directly. Do you want me to read it? Okay, I'm gonna try, but... Or we'll have like us and then you. That's nice, I think. Well, I was gonna say it's my last question. We have just a few minutes left, but I will try to answer it. And it's, I like the... It's the worst question because I know it will raise a debate, but... Nice. It's about red team, the R-T-O-S-T debate. So red team open source tools. So a lot of people care about sharing. They say that sharing is caring. You should publish your open source tools. You both have very awesome research. It can be good, it can be used for the good but also for the bad. And so what do you think about publishing all your work? You said, Roland, before that you wouldn't publish your data, but maybe you will publish tools to accelerate this work. So what do you think about this debate and would you publish your job? I'm a little bit biased because I'm a net beneficiary of open source tools. I'm not a net contributor. I think there's a lot of value in open source but I do respect the fact that people will spend a lot of time developing techniques and developing tools for themselves. Personally I'm on the side of open source. I think if you discover a vulnerability you should disclose it and do a course. I think putting tools out there that people can take advantage of. They're great learning tools, as you say. I tend to be on the open source side of things. But again, I'm biased because I haven't spent hundreds of hours developing a tool that may be obsolete three days after I release it. You want me to answer first? Oh man, I'm kind of a philosopher in my times. And I think we lack perspective. Like, pirate re-existed and was authorized or happened without no one doing anything against it. Because it was, you know, all countries were separated.  So I think we're at the era, like basically we're creating firearms, okay? I wouldn't, like, this is not Gozegir's opinion of anything. This is my own here, okay? I think we're creating firearms and I don't think you're allowed to create firearms right now, right? I don't know, to be honest, I don't know. I know people tried to pre-treaty print them. Maybe we're allowed, and in Canada and the US it's probably different. But I think that we lack this perspective. So for now we're doing it, we're having fun. But eventually, 100 years for now, if climate change didn't kill all of us, we will look at this and be like, these guys were crazy. Like, they were allowed to create destructive tools and put them online, whereas the defenders were not sharing, right? That's the asymmetry of it right now. And now the blue team folks now are sharing. Twitter accounts with IOCs automated and stuff like that. And there's a lot of blue team talks, good blue team talks now. When I started, that didn't exist. Blue team were kinda like, this must suck. You look at IDS all day. I'm bugging the pentas badass. Now blue team is sexy, which is good, which is very important, which is part of education that is going on. But they still have sharing problems because the organizations that they are in don't understand that they should share. It's not the fault of the blue teamers themselves, it's the fault of their organizations. And so this asymmetry is not helping them. And so the red team, they collaborate, they create patreons, they have tools you can now have like paid for offensive tooling that eventually becomes free, like the Porchetta Industries guys, which are very good. They're actually really, really good with RDP right now, following all that stuff. And at one point, maybe we'll be like, you know what? And it will be an incident.   And so, and sorry if I'm talking against you, you'll have time, you'll be retired by then. But I don't think it makes sense if you think of it from far enough. And last thing, I told you I was a philosopher, okay? So think about this, at one point, fire protection, you had to pay for it, okay? You had a badge on your house. It was like up in with money. And if you didn't have that, the firemen would come and water the house that had the little badge, but the other house would burn, right? So eventually it became so much of an issue that it was nationalized or municipalized. I'm not sure which, but like it's part of the things that we need as a society. And so I think eventually government will be so pissed off that it costs so much money to so much companies that there will be like, you know, AV and ISP protection and security in general will be mandatory, like built in the things and which means that, and if it's regularized, it will mean like anything trying to be against that will be outlawed, maybe. I don't know. I'm just a philosopher. I should write a book. We just need to finish on that. That was an amazing question. So thank you, everyone. I hope you enjoyed. I wish you a lot of flags this weekend. Pray with me for a Windows track, maybe. It would be fun. And that's it. Thank you, everyone.