Hello. Hey, what's it going? Good. It's been fun reflecting on the last year and a half or so. Hi, Emily and Paul. Brandon, do you have Justin's slide set you're gonna present? Yes, Sarah. I'm actually gonna present them. Awesome. And I put them in, I copied it and pasted the template, which is a little different what you all have been doing for a slide. So you might have to update the little blurb I put in there, but I pasted in a link to the slides and then I can also present. That's good. And what I'm gonna try to keep it to like 20 minutes or less and just zip through things and then hold questions because I don't know what people are gonna want more and less about. And, you know, except for like, I mean, Brandon, please interrupt me if I get anything wrong or leave anything important out because I took Justin's slides and then added some links and pictures. Diagrams. I'm big. I love the diagrams, the colors. That's great. I'm gonna wait about another three minutes for folks to jump on and mark per request. I am on camera today. Teehee, I was getting so I could draw that photo of you myself. Okay, quick reminder, we do need scribes for today. If there's anybody that can volunteer, go ahead and write yourself into the scribe section of the meeting notes document, which I will paste in chat. Okay, so for everyone, make sure that you add yourself to the attendance list. If you're a new member, or if you have an update, provide your name and we will do a quick round robin on updates before we get to our presentation. Let's go ahead and get started then. Ash, do you have an update? Yeah, I just had a quick update on the key group assessment. So the PRs open for reviews and suggestions. So if you're all are interested in adding your comments, please do so. I'm gonna paste the PR link in the chat for those interested. And yeah, feel free to add your comments. And yeah, that's pretty much it. That's my update. Thanks Brandon for volunteering in Scribe. Who else? I have a reminder for everybody to submit CFPs for our cognitive security day. North America 2020. Links are available in the past meeting notes. Who's next? Brandon, no updates. No other updates from anybody? Any new members? We have a lot of numbers following it. Well, I guess we can get started with the presentation. Sarah, Sarah, you're still muted. Can you see a perspective on security assessments? Yep. All right. So Justin Capos prepared most of these slides, but it's one o'clock in the morning in Shanghai. So I added a little bit of color and links and diagrams and my thoughts to the slides and volunteered to give the presentation. Brandon has also been part of the team from the beginning and pre-reviewed the slides that might chime in. So security, so this is supposed to sort of set everybody's context about what the heck these security assessments were intended to be and where we are now and then there'll be a discussion which Emily will facilitate. So this is from the README. Security assessments are a collaborative process for the benefit of the cloud-native projects themselves and prospective users by creating consistent overview of the project and its risk profile. Justin is the security assessment facilitator, which means he runs the process. I am a co-chair for each ongoing project at Six Security. We have a co-chair representative so that I'm responsible for like communicating to the TOC and the outside world who has any concerns about this and escalating things up or down, I don't wanna really say up or down, but across to the broader organization and to the review team and vice versa. I'm also responsible for reviewing every, for generally being the go-to chair for review of security assessments, although JJ has done a couple either when I served as a reviewer or was on a leave of absence this summer. So the history of the process, in early 2019 we were getting requests from the TOC for evaluating projects, primarily ones that had not yet come to the CNCF and Justin Capos who had done this as a TOC contributor previously for, he'd actually done it, I think for spitting inspire maybe another. He did a first cut at like what our process could be that any number of people could follow. And so we generally thought this was a good idea, we liked his process, but the PR got into the weeds for many months despite lots of effort. And so to break the deadlock, Justin came up with this idea of like, let's just do something that is the sort of least possible thing that we think could work while there were many ideas that would be improvements to that, we put those on the table and that we would do five reviews and then review what works and what doesn't. So we merged the PR in early May with a number of open issues and I linked to the ones that were open at that time in case anybody's curious. So, and then in May, Justin reviewed what we were doing at the KubeCon session and then up now we have four completed and a couple in progress. So even though we haven't finished five, we think it's long overdue to like, you know, do our first five process improvement thing. So this is the sort of very like cheat sheet about the process. We identified the team, both project lead and SIG security has a few reviewers. The project lead provides a draft document or we call the self-evaluation and there's an outline for that. There's a naive question phase where the lead security reviewer or their delegate asks clarifying questions so that, you know, we have a complete artifact. And then the security review team does a close read asks questions, typically comments in the Google doc request revisions, usually like more detail on this item confused by that. And there's a back and forth with the project lead. And then there's a presentation and discussion at the SIG security meeting and usually some further revision and we do a summary assessment where it takes a bit of work to get on one slide and overview of this thing that seems to have value to the TOC because for every one of these we've actually done a presentation and that seems to go over well. So when we, to get unstuck, we all met together at Docker to con in 2019 where most of us happened to be there who were kind of scrubbing in on this process. And we came up with this timeline. So one of Justin's key concerns which I thought was really good is that we should have like, these things shouldn't stretch on forever. We should be able to, if somebody signs up as a reviewer we should be able to say it's gonna take this much calendar time and this many hours to get this done. And maybe it's a little more at the beginning but we should be able to get a reproducible process.  But the idea being we spent a couple of days just asking these naive questions of like, wait, what does this project do again? And sometimes we might personally know but we'd make sure that the artifact contained information about what the project exactly is and what it doesn't do. And then get the security view from everybody to iterate and do the report. And then I wanna go into detail in this little picture at the bottom because that was one of the things where we were like, well, if we only have like a really rough outline of the process, how are we gonna have consistency across the reviews? How are we gonna like make this work without like incredibly detailed documentation that we can't agree on? So what we decided to do is we would start with the four of us who were then Justin Cormack who's also on the call. Hi, Justin. Justin Capos who was actually, we queuesed himself from the very first security assessment because it was in Toto which is he's a contributor to. And then Brandon Lum and myself were the team. And then the idea being all these little dots were at every step, like the rows are different security reviews and we would ensure that at least one person was consistent from a prior review. So we could get to the point where a future requirement of security assessments is that you've participated in a prior assessment but how do you bootstrap that? So one of the things that I'm super excited about is we did a really good job with this, I think. And I'm of course speaking from perspective of having participated in almost every review. So I'm really interested in hearing other people's thoughts on how it went for them. So you can see in the darker colors are the first four of us and how we participate in different reviews. And then we had sort of a challenge as we broadened the number of reviews and we had multiple reviews kind of starting at the same time. And I remembered that Robert was participating in an earlier review but he might've been shadowing but in any case we did do a good job of having consistencies and we decided that if you were a project lead you really got the review process and then you could lead a review and it's exciting. The Ash who I think is also here maybe here today. Yes, I heard you announce yourself is leading a review now. So I think that like what we had written down at the beginning is that it would be ideal that somebody from a project who had participated in receiving a review then be a security reviewer for another review. So they have the sort of inside and outside perspective. So I'm gonna go through these quickly just and then we can come back for any questions or points of discussion. So then Justin, I'll just go over this according to what I've heard from Justin and what's written on the slide. So Justin's reporting what seems to be working is that the completed assessments are valuable to the projects. It scales fairly well and it seems like the review it's not too burdensome for the reviewers and both the project and the assessors the security reviewers get to explain issues in their own words so that you get the sort of perspective on security from different voices. What's not working so well is project and reviewers tend to drop in and drop out. He has a question about TOC requirements which I'll address later in the presentation and assessments vary in the level of detail and the type. So some things go more into threat modeling some have more user guidance review there's been some that have had a lightweight code on it. So there's like variability which he saw as something that's not working and then I'm not sure that's a problem but that's just me. But my view, I generally plus one to all Justin's comments on what's working. I've also participated in hearing from the TOC on each one of these and gotten positive feedback both during the meetings where these things are presented and offline people have mentioned to me. I find that the consistent assessment outline means that doing a second or third review as a security reviewer makes it much easier to like just go through and do the review.  How would I describe it with somebody? Like it makes reference really easy because I can go right to the section. I don't know whether it'll be interesting to see whether other people read many reviews besides the co-chairs of security. But one of the things that's working is we've had, at the very beginning we're like, well people really wanna do this. You know, will this be a burden? People do this for their jobs. Will they wanna volunteer? So there's been a nice number of interested and qualified reviewers. So that's been good to see. And then the project board I'll talk about in a minute I think has really worked for me in terms of helping that communication outward and inward. So not working so much. The lack of clarity between the security assessment and what the CNC do diligence. Some of that has been their process has evolved. So we've kind of had to absorb a little bit of evolution there. That hasn't always felt so great to the projects but we work on it. And I'll talk about that more in a bit. And then the lack of consistent execution. Some of the, some of times it's individual people dropping in and out, as Justin mentioned. And sometimes there's been process confusion. One person's waiting for the other person to do something and we're just like, wait, it's been three weeks, what's going on? Or a month and a half. So I think there's been some improvements and there could be some more. So I wanted to highlight, go ahead. Kind of just since one of it is not really important was that like there was like a different assessments kind of looked a little bit different. I think I just want to point out it's not that some assessments were lacking in certain areas, it's just that some projects kind of already had prior work done in certain areas. So they just like had a much more expensive amount of content there. So I think it's kind of like every, just want to point out that every assessment kind of met the bind, which we, what we wanted to get our assessments is just that some of them went a bit further to kind of show a little bit more. That's a good point. Thanks, Fred. So I just want to point out for people who haven't been here since the very beginning or maybe have forgotten because it's been so long, what we've done, even though we said we're going to hold all the process improvements to the end, certain things that we're getting in our way we fixed. So the idea of having one of the reviewers typically the security review lead, do review the self-assessment and really go through it in detail has really, I think helped because one is like you get this sort of unfiltered, unbiased everybody reads the same thing for the review team. And it's also easier on people's time. The security assessment queue that I mentioned I put a little picture of it here. Having a blocked column makes it clear which things are in the backlog, meaning we don't have the bandwidth to do them for whatever reason, because we've been trying to only have one in process at a time, but we sort of relaxed that lately. And which ones are blocked because they're missing a component. And typically this has been the self-assessment which wasn't clear at the beginning, right? It wasn't clear that that would be the time consuming bit. And I think there's process improvements we could do for that as well. And then there's a done column which I didn't illustrate because it's less exciting although I'm super excited about it. And then the other thing is we added was the intake process, which was kind of started before this assessment queue because people were like, well, I don't wanna do myself eval if I'm gonna be like sitting there waiting, and what's gonna decide? What if we have two projects ready at the same time and only one review team? Again, this is from when we felt like the review team was the scarce resource. And which I think things are a little different now, but it was a healthy process. We talked it over with our TOC liaisons, then Joe Beta and Liz Rice. And with the different security reviewers. And then we presented this to the TOC writ large and we sort of adopted this process which it's pretty straightforward. It's just prioritization. Mostly we do it on our own, but if at any point the TOC is like, we really need this project to be assessed, they can preempt that and add it in the queue. So the idea is that the TOC won't interrupt a review in progress, but they can bump something up in the backlog. So far it hasn't happened, but that's how they say in government, we serve at the pleasure of the TOC. At least we chairs. So the other thing we improved is the conflict of interest guideline. We saw that in, you know, there was a case where a whole project was stalled because we were like, is this a conflict of interest?  And then it was like, you know, like we don't need waiting, we'll be commits about it while other people, you know, other things would move forward without discussion of something that was maybe as significant. So I wrote up something at the TOC level. Brendan did a nice PR. We actually still have an open issue where things need to be clarified. I noticed some formatting errors this morning. So some of these improvements are very much still in process, but again, there. And then the big question is, how does this fit in with the security assessment stages? So in the last, I don't know, about six months ago, the TOC did some work on really clarifying these stages. There's a process doc about how projects go from sandbox to incubation to graduation. So this was always documented, but there was a lot of confusion. And so there's this due diligence that the technical oversight committee is responsible for like looking at the project and saying, should it be part of the CNCF? And so what they're communicating here is that the majority of their due diligence, the really thorough review happens before incubation. And there's a lower bar for sandbox. And this is a clarification that wasn't, or maybe it's not clear whether it seemed to be inconsistent for those of us who aren't in every TOC meeting. And so this clarified it for us a lot, which was great. But how does this relate to our assessments? Well, first, before we get to the assessments, the CNCF pays for a third-party security audit which is like some traditional sort of quality audit with like penetration testing and code inspection and like ticking all those boxes during incubation as a prerequisite to graduation. So that's important to know that that takes place and has taken places for half a dozen projects and there's an open issue. They're supposed to be listed in our repo and we've been working on finding them, collecting them. So what we've agreed on so far last year with Chris A. who does allow the operations for CNCF is that when a new project requests an audit, he will tell them that they need to do their security, a SIG security assessment first so that that ends up being a feeder for the audit. It should make it so that the money spent on the audit can be more efficient, right? Cause they can take that as an input and then it creates a little pipeline that's nice. And we specifically designed our assessments to not to like slightly overlap but not be redundant with a third-party security audit cause, you know, that wouldn't make any sense. So the sort of proposal that some of us have talked about is that we could make it so that the self-assessment is a prerequisite for incubation. So during sandbox phase, all projects are required to do a self-assessment. That becomes a feeder for the assessment which would then be something that is required for graduation because it's a precondition to the audit which is required for graduation. So that's the idea. We have told our, the TOC liaisons and team that we're not going to propose this until after we do our process improvements after our first five. So while we've talked about this, the reason it is an inked is because our precondition was five assessments and process improvements and then this and some other things, whatever we determined. So I think that we're like the chairs and the TLs basically are like, well, we're close enough. We've completed four, we have two in progress. It's long overdue. We thought we would have done five by now. So we should dive in. So that's the end. I think that's- Yeah, another thing that I'd like to kind of talk add on here is so for kind of the significant barrier as over that, that is kind of a second recommendation that comes as part of it. And so in the repo for the process, they have kind of a question that kind of what are the details that they're looking, the TOC is looking for to the six to about the project. And we were looking through the question there when we were creating the self-assessment as well and also trying to see how we can map onto those details. So that it's not only a good document for assessment, but also we'll cover kind of like the main points that the TOC is looking for in the project. Although at the moment, that's only for projects that are labeled as security projects, specifically not for other projects that should potentially be doing an assessment at the moment. There's not everything's being referred to sick security for incubation due diligence at the moment. Yeah, that's a good point, Justin. We have projects are basic for everybody who haven't been in the weeds here. The every project is kind of categorized with one sick. And so sometimes more than one. Oh, OK. Yeah. So we get sort of like assigned by the TOC. Here are the projects that you use sick security, have some kind of oversight participation with. And most of them are projects that serve a security purpose. What we assess what the assessments call the security providers, right? They provide some key aspect of security. And so one of the sort of open like we have prioritized those projects for assessments, both in terms of our outreach and in terms of what we focus on. But we do think that we've said that we want the assessments to be done, ideally, by all the projects because all projects have a security aspect, right? It just might be, we haven't had that experience yet. So it might be a little different. Maybe it's going to have a different template. Maybe it's not. Maybe it's just going to be different shape. We don't know. So I guess it'll be an open question whether the self-assessment will be required or maybe that's an incubation or going to figure it out. Thanks, Justin. Shall I move on to Justin Kapos's final thoughts? So Justin Kapos, not present, says, he's had a heavily weighted point voice on how getting here, which has been wonderful, right? Because he's driven us to actually do stuff. And many people have this experience. So he encourages SIG Security to form a small subgroup and actually do this formal revision of the process or propose revisions. And he can be available for questions and opinions and to participate if we do this at some, not in the middle of the night, Shanghai time. But he will commit to at least participating asynchronously. And he's excited that we're at this point. So that's the little brief presentation. Thanks, Ann and Brandon and Justin Kormak and Justin Kapos, if you're watching this later, for the presentation. I think it did an excellent job capturing a lot of the historical knowledge in context that we just don't have anywhere in the repo and small instances where it does exist would be very hard to find. So we wanted to kind of bring this up and present it to everybody because there's been a lot of questions about how we do these security evaluations or security assessments for the different projects that are presented to us. And we've gotten to the point, as Sarah had indicated, where we've done enough of them and it's gone on long enough that we feel like we have a much better understanding of where process improvements need to occur, whether or not we actually know what those improvements explicitly need to be. So given the amount of tickets that we have open on this particular topic, and there is one, two, three, four, six last I checked, starting with the original issue to do the process improvement, which is issue number 167, we want to kind of queue up a working group. Hopefully get volunteers from the community. And this is a great way to get involved if this is your first opportunity to start contributing to the SIG. To kind of look at the way that we've done things and the processes that we've had, and how can we improve them and make them better, not only for members of the SIG, but also for the projects within the CNCF that are moving through these different cycles. As Sarah had said in the slide deck, we talked an awful lot about self-assessments being at pre-incubation, some point at the sandboxing stage, which would be ideal and helpful for a lot of projects, because that self-assessment, it kind of gets them in more of the security development mindset about what it is that their project is doing and how does it fit from a security perspective within the rest of the CNCF, as well as focusing on their own development practices. So that's kind of like the background for why we're having this conversation now and what the needs of the SIG actually are. So I want to kind of open it up to any questions that folks may have for the TLs or the co-chairs or anybody else with history on this. And then hopefully we can start kind of teasing out the working group in a little bit more of the direction for that to take. I can share the fresh experience from Kecoxides. So in general, it was good and worth doing. Like the outcome I think has a lot of value, even as a reference material for the project. Outside of getting the badge of getting the assessment. I think on a kind of like what could be improved, it has been time intensive on a project site. And I think I was wondering, is it a barrier for some of the project possibly? So it's about professional open source kind of like a non-payment open source. So we could kind of like divide in general projects as having companies sponsoring maintenance of projects, like people being paid to do extra on maintaining the community. Then kind of like projects with good community but more targeted contributions. So companies showing up contributing in a feature but not really stepping up to do something more. And then some projects which had like really non-paid, like all of the maintainers are doing it as their evening or kind of like being engaged outside of work. And like it wasn't totally like few days of real work to work on the self-assessment part. So for, I know some projects which has this kind of like not of maintainers being paid to work on a project and they have aspirations for CNCF. And for them, I guess it would be a hard barrier to work on something like this outside of the working hours and they could stop. So this and what was kind of like mentioned that it would be worth to have a kind of like timeframe. So it starts, it stops and like we don't iterate over and over a bit on it would be helpful. Okay, anyone else? So there's currently several issues. They are linked from the September 17th meeting which Brandon, I don't know if you've pulled them up yet but we'd like to try to get a group of volunteers to kind of work on refining what this process looks like. So we, you've heard from the key cloak assessment how that went. We have plenty of other videos on YouTube from other feedback sessions with other assessments that have been run. And we've also got, we've also discussed a little bit about changes to the process that we've thought about or kind of kicked around in the past. So I'm curious if there is anybody that is interested in joining our working group to help refine what this process is and what it can become. Yeah, and just to kind of add on top of that so I think what we were discussing is that if we realize that there's gonna be various aspects of ways you can improve the process whether it may be some of it is maybe redefining it. Some of it may be making sure that how to improve on the execution and from kind of this working group we may split up into slightly smaller groups to focus on whatever people are interested in. Yeah, I was thinking that like the first step might be to just triage things into like there's a bucket of things that are, this isn't clear. I don't understand this. This doesn't make sense to me, right? That are more like not this doesn't make sense to me but like clearly it's not documented well, right? In certain places. And then there's other issues which are like in conflict with each other. I have this idea which is directly different from this other idea. And so by separating those and maybe, you know first having like doing the detail second, right? Because if we radically change something then the details will change, right?  And then if that group can get aligned or not, right? At least tease apart the big questions and then present back to this group and say okay we considered ABCDEF and we think D and F are good big changes or we considered all these things and actually we fundamentally think it's reasonable with these tweaks or whatever, right? And then go forth and as important a part of process is like having it all written down well so that people don't get confused in the future. Yeah, so I linked the issue 167 which is the source issue to do that first five improvements process. So if there and it looks like there's quite a few people that are interested in contributing to this which is excellent, happy to hear that. If you all can comment on the ticket that way we know who's interested in joining this up and we'll also post it in the six security channel as well for anybody that's not on the call today to kind of start consolidating that. Sarah, do we need to have a co-chair or a TL kind of help run this? I think the last time I bought into it to kind of help with this. Awesome, yes, we've got Brandon involved. Yeah, and so Justin and I will like participate as needed. And yeah, Brandon agreed to be the facilitator of the effort. Totally pragmatic question is, is this nine to five Eastern time block kind of thing or how does the meetings operate? So for the working group at least like what we've done with the other projects is depending on the set of participants, we'll find a time there once for everyone. Yeah. Got it, okay. So far we haven't had a subgroup that it's impossible to find a time. Yeah. Theoretically it is, but in reality, we've found it to be not that hard. If it breaks we'll fix it. Okay, so Brandon's gonna facilitate with Justin and Sarah helping out. And if you can go ahead and comment on the issue 167, which is linked in the chat, that way Brandon and company can start getting together and doing the scheduling and consolidating all the comments and all the PRs and issues that are open about this topic. I'm happy to participate as well, if it's useful. Yep, most definitely. Okay, that went really quick. Does anybody have anything else about the assessments process that they wanna bring up right now? I have a quick question for Justin, actually. Do we, are we seeing a need to present key assessment to the TOC? Good question. I'm not sure at this point, but we should, quite possibly, yes. Okay. So in the past, Liz Rice has said, she always wants us to present. And so I think we should always, like things may change, so we offer and then they see if they can queue up. Okay, yeah, that makes sense then. Yeah. And that guy's doing a ping, I may get ahead to put it on the schedule. The next one that's likely going to be available is going to be probably later in October. I believe, yeah, let me go back and look at a calendar here. Yeah, it looks like the next available meeting is probably going to be October 20th. So plenty of time to be able to get that on the schedules. Yep, and we are still kind of, the PR was just ready for review, so I think it'd be a perfect timing as well. Yeah, if you wouldn't mind being able to put this into your normal updates next meeting where we have the SIG updates to TOC is October 6th and you are all about to get pings on the, come update your slides. So yeah, that'd be super. Thank you. What's the format? So is it repeating the presentation which happened on a SIG or not? It's you presenting a summary, right? There's a one slide. It's very challenging to go into that one slide, but the lead security reviewer is responsible for creating that slide. And then the presentation, like half the slide is the project saying their thing and half the slide is what the SIG says. So depending on how much time we're allotted, one person might give the whole thing, but it's important that a person from the project and a person from the review team be there in case there's questions on either. All right, let me try and bring up, find that set of slides so we can share that with you. It's a miracle of compression. Well, Brandon tries to do that. Did anybody have anything else they wanted to cover? I have an announcement. Go ahead, Sarah. So we have nominated Emily as a new co-chair and the official, and that's been, that's the current chairs, including Dan, whose official term has ended. We have a little not quite overlap. And the TOC liaisons have all approved this. And so there is a, the process is that two thirds of the TOC needs to vote on any SIG chair. So the nomination has happened. It's linked in the notes and in the Slack channel. So the TOC generally really likes it when the community says stuff. So please, specific comments are welcome, and chiming in on the thread. I think you might have to be a member, like sign up for the TOC list to come in. I just wanted to make sure everybody was aware that that's in process. And that's my announcement. Oh, and Dan's here. I did also want to say thank you, Dan, for Dan was one of the inaugural chairs of what was in, originally, the safe working group, secure access for everyone or something like that. I think we had different opinions so the acronyms did four. And then it became SIG Security as CNCF and Dan, it has been, I didn't know Dan when we started this process. So it's been wonderful getting to know you and working with you and thank you so much. Thank you, sir. Great to see you. So is that everything that we have for today? Yeah, I found the link to the slides. I put it in the chat. Okay, anybody else have any announcements? No? I will release everyone and give you all about 15 minutes. Thanks everybody. Thank you. You're welcome. Please, Emily. Hey, Emily, I will change the calendar invite to reflect the new passcode. So. Awesome. Yes, you shouldn't have to do anything but like we should watch this space for next week when like, hey look, Zoom is now gated on passwords, hooray. Okay, cool. Thank you. Should be fun, more to come. Bye.


First up, I'd like to introduce Tina Greger. Tina is from the ANU College of Asia in the Pacific, and the title of her three-minute thesis tonight is Capturing Language. Ni ga ga ima ni ki maim ka na. These are words in a language that would be all but forgotten in just a few decades. Now, imagine the language you speak today would not be understood by your grandchildren. And what if your language was never even written down?  And what about the jokes your dad used to make? What if your own children don't understand them because they just don't speak the language anymore? Of the 6,000 languages spoken today, it is estimated that half will have died in 100 years' time. Many languages have never been written down or studied in any amount of detail. Once the last speaker dies, we will never know what the language was like or what it could have taught us about how people saw the world and how that influenced the way they spoke. My research is on two endangered languages, called Yelmek and Maclau. They're spoken in the south of New Guinea on the Indonesian side of the island. Why those two? Well, for a linguist like me, language that is a terrifying thing. Because to know about language as a system, we need to look at data from as many languages as we possibly can. And funnily enough, the most striking and groundbreaking insights are often hidden in small languages in really remote places. Yelmek and Maclau are today spoken by a couple of hundred people only, and children don't really learn it anymore. Indonesian is spoken in all public domains, like school and media. Especially older people are very concerned about the decline of language and the loss of cultural knowledge and ethnic identity that goes with it. But they didn't have the skills or the resources to do much about it. So that's where I come in, because I can help them with a crucial step along the way. My thesis is the first elaborate description of the languages. But a big part of the project is also to record as much as I can of their songs and stories and their cultural practices. In the picture behind me, you can see what a recording session looks like. The next step then is to get it transcribed, to have it translated, and to analyze it for the description. In doing so, I'm creating a resource for future research on the one hand, but also a resource for the people themselves. So their linguistic and cultural knowledge is preserved for their children and their children's children. And so nobody loses their dad's jokes, no matter how bad they are.


Hi, my name is Chris Dancy and I'm going to show you how I've learned to look at people's phones and tell them about the life They're living and the life they will lead. So right away what I noticed about this phone is it's full You've got no room for anything extra. I mean page after page after page and busy and when you open it It your phone is there. It's very simple white and gold So you're someone who really really admires things that have lasting value I love the fact you don't have your battery percentage on so you're someone who thinks about stress. Yeah, I know right? So yeah, you're very mindful of your stress So I get that a lot of times the apps we use are nice, but it's their icons that speak to us now whenever we see icons Overfaces they usually mean a little bit about that person. So if you notice over these young girls face You've got the YouTube icon so YouTube is where a lot of entertainment and dreams so she's very creative


I'm here at the main mall with my friend Victor in his store which is called sufficient classic and Victor and I go way back. Yes, in fact I was kidding him because I found some pictures of when I first met him. What were you doing there? Well that was the time when I met you, by that time I was still young and still doing music. How old are you now? Yes, so now I think time to shift and people going up and I think. Got serious, right? Or maybe to a different path. Yeah, but I want you to briefly speak about what you were doing then. Come on, don't hide it. Yeah, so I used to do like music, so we used to like travel different stage and do performance. It was in high school times. Okay, and you were hoping to be recognized? Yes, definitely. And I'm not making fun of you because I've known a lot of people who started off with, you know, that skill and you wanted to be a rapper and your raps, but your raps were different which is why we use them for our program because and how were they different? Well it's different because I was encouraging young to be brave and to use the talent that they used to have is just in them and they just need to learn it out. So they were inspirational raps. Yes, inspiration. And clean language. Yes, definitely. I think that was the other thing. Because at the time I was working with the same gentleman I work with now, Anthony Bezier, and we wanted to bring you two events and have someone inspire and you were good. Yes, yes. But like you said, times move on. Definitely. Things change. Now you're originally from? I'm originally from South Sudan. And you came here at what age? I came here at 15 going to 16 years old. Okay, what high schools did you go to here? Well when we came we arrived in New Hampshire, Manchester, New Hampshire. Okay, which I know I went to Central. Oh, same thing. Oh my gosh. I didn't know that we both graduated from the same high school. Only a few years apart. Yes, Central High School, oh my god. You seriously? Yes, I graduated from Central High School. Oh my goodness. I won't tell you man. This world is too small. But I suddenly thought, oh my gosh, she's from Manchester, maybe we went to those. Amazing. So then eventually you came over to Portland. Yes, yes. I know other people in your family, so I know a little bit about your background. And you had to, like everybody else, you had to find a way to, and once you'd graduated from high school, to support yourself. Tell us a little bit. This is something other people need to know who are also maybe new. You have to try a lot of different things. Tell us about some things you tried. Definitely. So after when I finished my school, I tried, because I've been working a lot, so I was thinking of doing, you know, star business. Because I have experience of business since I was young, but not that much. So my first business was transportation. So I had my first cargo van. So this cargo van, I got a contract. I went online, indeed.com, and just put my experience. I have cargo van, I can deliver. You purchased the cargo van. Yes, I did. I went, I tried to get loan, but it seems like I have a bad experience with loans, so I rather deal with cash right away. So I bought it at the, you know, just a savage storage. Right. Well, that's one of the things that everybody has a problem with, is getting capital when they want to start up on their own. So how long did you do that, delivering cargo for people? Well, I did it for one seller year. I had a discontract with this company called Golden Way. So they gave me some loans. I took some from D.C. I transported some goods to Wyoming. I went to Iowa. So you got to see the country. Yes. I drove all the way to California and Utah and Texas, Arizona. So it was beautiful.  So it kind of encouraged me. It's like you make, you make okay money, but if you get 18 wheeler's truck, you might make more than that. All right. So it kind of encouraged me. So I came back to Maine, Portland, Maine, and I got another contract with Bob's furniture. Oh, okay. Right. I used to deliver some furnitures and I did that for like one year and raised me some capital. And basically I went and I purchased my first 18 wheeler's truck. Which I believe you still own. Yes, definitely. Definitely. So I put that on lease right now. Someone is leasing it. So this investment that eventually you drove a big truck long distance, right? Yes. And so then, and again, I hope you understand what I'm doing is breaking it down for people.  Yes, definitely. Because you were a family man by then. Yes. Yes. It's difficult. It's difficult. I mean, especially when you're trying to do business and you're going to be putting 100% into it, it's just your family's going to be there. You're not there for the kids. And it's kind of funny because when I did my first runs to California, and it was close to Christmas time. So I had to make my trip back before Christmas. Oh, boy. And my kids was like, dad, are you going to come for Christmas? I was like, yeah, I'll make it. But unfortunately, I made it really like I made it on December 2024. Wow. You came down the chimney. 2021. I came at night too. And the woke up in the morning was like, oh, dad, you're here. Oh, that's great. You and Jackie now have six kids, right? Yes, yes, yes. All together, yes. Yeah, all together. Big family. Big family. Big responsibility. Yes, yes. And then at some point, I guess, from our conversation fairly recently, you told me that you ended up traveling to Africa, you and Jackie, mostly probably to get in touch with family and see things you hadn't seen. And while you were there, was when you, this was, was this in Dubai? Yes, yes. We went to Dubai. And actually, we went to Tanzania too. And we, that's what kind of encouraged, we just went accidentally. But I think, you know, the plan just went perfectly. We went and went to this big market, we found, you know, I like dressing suits. So most of the time when I go to church, people are like, Hey, where did he shop? Can you take us to a shop or whatever it is? Just shop with him. So it kind of encouraged me too. But when I went overseas, I saw a store, the selling suit. So basically there were, if you are just a regular customer, they can sell your suit with higher price. Of course. But if you were, yes. So if you have a come, like you want to do it for a company, whatever it is, so the price is kind of, is, is reasonable. Right. So, yeah. So basically, me and my wife, we thought it was a good idea to start this. So our first investment was about $3,400. That was the first purchase that we made. Were you scared? I was, yeah. It's very, I was very scared. I mean, because you buying something, you don't know where, where you're going and how you're going to do it. Figure you're just going to have those suits in the closet for the rest of your life. Yeah. And probably knock people doors. You're like, Hey, I got super sales. Yeah, I know. It's scary. It's scary. Yes. Yes. But it comes with risk. So, yeah, I know I have to interrupt here and just say this is, I've been working with, with people from other countries, particularly Africa now for over 10 years. And I find it absolutely amazing that you guys are willing to take risks. I wouldn't have taken for all the, no, I'm sorry. I wouldn't do it. And my family would have said, don't do it. Don't do it. You know, I mean, I have some skills in terms of making things, but I would never have thrown all my all, you know what I mean into doing that. Yes. Yes. Yes. Yes. So you were nervous, and I'm sure Jackie was scared too, but you went ahead and did it. Yes. Did you start right here in this particular space? No, actually. So when we got the place, I mean, when we got the suits, we came home. And so we bought the suits and we bought some different purchase for, you know, the brand names also for the women. But so we want to start, my wife is like, let's just do it locally. So we went and asked the price for locally, but I was concerning about safety and someone can come and break in your store and can steal. And another thing, you have to put a lot of work on advertising just to make sure people that know your location and so they can come and get some, you know, stuff from you. So I was like, okay, you know what, I think it's a good idea, but let's take another risk. Let's come to the mall. Go whole hog. In other words, don't just find some hole in the wall that nobody knows is there. Yes. Yes. Let's go where everybody goes shopping. Exactly. Very good. You went to the market. So we took this huge risk and I believe it's a good idea because we don't have to do a lot of work on calling people or putting flyers. The advertising is here. People are going to walk on. Everybody just walking through and when they see something good, of course they'll come and we're trying to get. So I have what the market, what people want. And when you have what people want, they always come and get it. That's right. Let's talk about what you have because that's one of the reasons we're here. Yes. Where would you like to start because we are going to have some photographs. We're going to overlay to this, but we're also going to, you know, take some things and show everybody. Yes. Yes. So basically here we have a lot of different colorful suits and tuxedos. It's beautiful.  The price is reasonable. Our regular suit here is $194. It comes with three pieces, jacket and the vest and the pants. So here I have collection of many suits here, but I have this children's suit here. It could be for wedding or birthday. It could be wedding or birthday. I'm a grandma, so I'm looking at it going, oh, yes, yes. It's very cute. It's very, very nice. And I remember you came last time, you found the yellow, like, gold. Yes. The one looked like Michael Jackson would have worn it. I wish I'd bought it. That one has been. It falls right off the shelf. It's out of the stock right now. Yeah. Yeah. So we do have also a black tuxedo for children as well. We have all different size from one, one years old to 12 years old as well. So it's beautiful. It comes with, with the bow tie and the price is reasonable too. It's $145. So all three with this can go on with that. And we have different ones. So we're not going to go too far, but that's okay. We have a blue one too, shiny, sparking. And we have this, this classical one with some, you know, checker, green. Yeah. That's, I think that's called a plaid picture. Yes. Yes. Yes. Okay. The plaid one. Yeah. Beautiful. So I have. And then for the big boys. Yeah. For the big guys here, I have one of this, this one here is a great tuxedo. It's gold and black. And I got to be honest with you, when I first met my friend Bazeer, he would have gone, oh, buy me that, buy me that. I love it. And I would have said, ah, but now I've been to African weddings and all the men look just as good as the ladies. I mean, they are wearing some very sharp looking clothes. And my tastes have changed because I can see, I think it's because when, I hate to say this, American men don't dress up very much. And to see something like this, I'd be like, wow, I never would have seen my father in that. But I'm starting to like it. Yeah. I'm starting to like it. This one is kind of famous in African, African parties. If you go to African parties, you see a lot of people wearing those kind of tuxedos. Yeah. All right. And we have a gold one. There's gold here. Wow. This golden one, shiny. I'll tell you, a man looks very nice in something like this. It's beautiful. A lot of prom kids love this. They used to have, we brought some couple of stocks in it right now. I believe there are only three left right now. So we also have wedding suit for men. If you're looking for having a wedding, we have three pieces sets here. It comes with the jacket. It's a piece of lint. Jacket and blazer and divests and the pants as well. Oh, the vest is black. Yes. Okay. That's interesting. That's okay. It looks nice. The reason also this one, this business kind of encouraged me because I went, when we had our first wedding, me and my wife, we basically, I struggled. I was looking for men tuxedos, wedding tuxedo. I couldn't find any. Really? I drove all the way to Boston. It's just not what I want. And also my son was, I couldn't find anything for my son. Yeah. It was a household. I used to drive all the way to New York. Because people here don't buy a tuxedo. Yes. They rent one. Yeah. And that's just, I think the man should, I mean, certainly a woman would never rent a wedding dress. Yeah. Yeah. And I think it's a big event. And I think the more, what, the bigger the event, the more you should invest in yourself and how you look and how you feel. Yes. You know, that's a hand, that's a handsome suit. Yeah. So yeah. And we just have a couple of them here. And here we have a good double breast tuxedo as well. And we have this for children as well. So as you know, you can see around this tour also. Yep. I'm going to put some more pictures up of what you have. Yes. Definitely. Something for everybody. Yes. Something for everybody. Yes. On the women's side, what do you find that people like the most? All right. So if you need to get up and go get something, it's okay with me. Okay. So women are a little bit difficult, trust me. We struggle on selling for women here. Okay. Yeah. So we have women suit as well. I think part of the problem though is that the women have many more stores to go to in the area. Yeah. Do you think that might be part of it? Maybe. Yeah. But it's difficult to understand. I can hold this one. So we have this suit. That's very nice. Two pieces of suit for women. Just two colors. It's very beautiful. Yeah. Very professional. Yeah, it is. And we also do party dresses as well. I like this one a lot. I couldn't wear it anymore, but it's beautiful. So we have just party dresses.  They can go all together. What a couple. I know, right? Yeah. Yeah. Maybe a 25th wedding anniversary party. Yes, definitely. Yeah. And if you're looking for a wedding that's also white and white, you look beautiful. Yeah. It's very nice. That's really pretty. Yes. Let me have you. I don't want this to get dirty. Yes, fine. So what do you think you would say? So say you run into some young guy who's from some part of Africa right now and he's looking to start a business. What are some advice that you'd offer him? I didn't ask you this question before the show. I'm sorry. Yeah, that's fine. So all I can tell you, first thing, you must be a person that takes risks, especially when it comes to business. Because business, they have a lot of business, but if you don't try something, you won't know it. So you must learn how to get in there and have faith. Believe that whatever dream that you have, just believe that it's going to come true. And it won't just come overnight. So you have to work through it. It's like a ladder. You step by step and be constant with it. And definitely you will see the results that you want. Have any problems, any things you wish you'd known when you went into this? Because I know you're a man of faith, and I'm going to put in a little plug here. You are also a pastor of a church. How do you juggle all this? The business and the pastor and family? I'm everywhere. What? You're everywhere? I'm everywhere. Yeah, amazing. Yeah. So I've tried a lot of things. So music first, and then a father. And then driving truck. And working here and also have another job. You do. You didn't tell me? You didn't tell me? Well, I work at Granite Bake here. Oh, okay. Yes, yes, yes. So I do have another job.  So that gives you a backup in terms of income. In case anything happens, you know, have at least a backup. Yes, definitely. So I'm going to add some advice.  Yes. You know, have a little bit of something else planned, backup. Definitely. So even in trucking, if you go in transportation, if you want to be in trucking, if you want to lease, like for example, I have one lease is out there, I'm planning on getting another truck, but I'm not going to give it to the same person. I'll find another person that I'll lease it to. In case that one, his business goes down. Right. I'll take my truck, but that one is still running in the same time. So as you say, don't leave all your eggs in one basket. Yeah. In case it gets run. Yes. So that's why I wasn't focused on one business. I was doing transportation, and now I'm into clothing, into transportation. I think you're going to do very well. I think you've done very well. I shouldn't say going to. I mean, it's been a few years since you and I talked. Yes, definitely. And when I saw the store, frankly, I was like, wow, Victor, the guy who was a rapper, and now he's doing, but you've always been a people person too. Yes, definitely. That's part of it. You know, I don't think you can run a store, a business like this, without liking people. Yes, yes, yes, yes. And letting them become a part of, because I was watching you selling a suit to a young man earlier, who's going to a prom. Yes, yes, yes. It was going well. Yes, yes, yes. Yes. So thank you for letting me interview you. Yeah. And I hope this brings plenty of business to your store, because I think we need more people from different places who are willing to take the risk of diving in. Yes, definitely. And it can't all be those big chain stores. I'm sorry, I've got this. That's my little soapbox I get on every once in a while. Yeah, yeah, yeah. So it's, it's beautiful.  Yes, yes. Instead of supporting big corporations. So this, this working pretty good. Great. Working pretty good, yes. Victor, thank you. Thank you very much.


Welcome to the next talk. You can hack everything. Welcome to the talk. You can hack everything but just shouldn't get caught. So first of all, who has found a vulnerability of you and had doubt about telling it due to fearing consequences? And who would want to find a vulnerability? All right. Well, you're certainly affected and this talk should be relevant for most of you. Most hackers are faced with the situation that they found something, they dig into something and know that people who own the architecture, they've compromised that this has some consequences and they don't like what they've done. And this talk is about how to deal with such a situation and ideally not get in such a situation in the first place. Linus and Torsten are experts on IT security and you might know them from a hack on the election software. They found some vulnerabilities in there. So if you want to hear it in German, there's a podcast of Lokbuchnetzpolitik. But for now, please enjoy the talk. Thank you very much for coming. Great that so many of you are here. And I appreciate that lots of you did the first mistake right now by signing up showing up for having hacked something. So actually, both of us have never hacked anything. So we've seen lots of hackers over the years who had to go to jail and there's lots of risk involved when hacking and who diminished the joy. So lots of legal procedures, kicked-in doors and so forth, really unnecessary things and it might make sense to actually think about how you can still be free and also be free in the future. And we know hackers are just free beings and we really like you to stay free, paint beautiful pictures like free beings and yeah. What this is basically about is OPSEC. OPSEC basically is depicted here nicely. Very nice teaching material from Russia. There's also a concern for them over there apparently. And we also have... We would like to start with the very first computer warm and you never should overestimate your capabilities, which is basically the first lecture already. We know this since the very first computer warm. The very first big warm that was also recognized internationally. That was the Morris Warm. Lots of vulnerabilities in sent-mails fingers as how we're abused and also weak passwords to kind of spread itself. And back then that led to a failure of parts of the internet in 1988. And some of you might ask why is this warm called Morris Warm? Because his inventor, his founder, was pretty proud of this warm and told everyone how it worked. And at some point he stood on campus at Harvard. On a chair, on a table and was just preaching about the warm he had developed. And yeah, he basically just spread the word. Everybody heard about it and somebody passed this info on to a journalist. And well, he was faced with this. And the result of this is that this warm was named after him. But he had to... He got fines, he had to go to prison. Basically he could have avoided the whole thing without all this need of spreading the word about his work. The same actually applies to a bank robbers. This guy here, he robbed their bank. And you know what do you do when you actually have experienced something entertaining, something great? Well, first of all you take a selfie, right? You can also take a second one or photograph the people you've collaborated with or eat what you've got. And then, well, this is basically the road straight to instant jail. And you might consider this just a one case example. But if you actually keep looking, you'll find plenty of these examples and lots of experts who kind of make the most same mistakes. And it always ends the same way.  This gentleman is displaying on a picture. And basically he was sentenced because he showcased all of this and this legally obtained money on Facebook. So let's move on to car hacking and the pioneers of this field. We again are faced with the same phenomena. First car hacks were pretty analog and pretty brute force. And the pioneers in this field were those two young guys. They had a major hack. They basically just broke a windshield and they stole an iPad from inside a track. So what do you do first after such a deed? You go to a shop where you have Wi-Fi, a Wi-Fi network and just start gaming with this iPad, this illegally obtained iPad.  This is my brother Dylan. He's also a money team. This, my good people, is what we get from a good night's hustle. Well, and since they connected this iPad to the Wi-Fi of Burger King in this case, something happened and well, it had to happen. And the owner of this truck handed over the video one week later to the police and the police knew the two and well, took care of the rest. Well, let's go back to actually our main focus of the talk, computer hacking after this quick detour to the analog world. What can actually go wrong when you as interested internet user or online shopper, what can go wrong? You want to just buy something online and start clicking around and then somehow click on a wrong icon or just get detract in a way. And actually we're talking about a threat level here. A threat level for the person hacking in this case online shop. So you in this case have a certain threat level and this level rises if you're not using software anonymizing your activity or other cases. And so you might think, well, I better use Tor in such a setting with a software made for anonymizing your activity. And well, potentially you will find a cross-site scripting and well, now the threat level slowly rises. You have Tor, you have Tor, but the threat level rises and if you potentially find a more critical vulnerability like a SQL injection and even a remote code execution opportunity and you'll see the threat level rises and goes up and up. And well, this is not more like very simple hacking. It gets more serious and you potentially even find some credit card information and this threat level has now risen to a pretty, pretty high level. And you know, once the threat level goes actually back rapidly and this is when we talk about prison, because once you're in prison, things have been settled and you can be sure that you won't get pursued again for this one deed. And basically when we look at this threat level, at the very first stage you should have already used a software for anonymizing you because as the owner of the website you're trying to hack, they'll get aware of that activity and kind of start to trace back and they get suspicious. Yeah, so that actually happens pretty frequently. Like people say, oh, I found something and well, I look more into this and by actually using Tor. And the main point here is you should have used Por in the main case, in the first case. So you could also look at the data privacy regulations that they have and maybe you have a right to be forgotten. There are companies that only save their locks for seven days. Maybe you just need to wait. So generally, be careful when being a data traveler. Let's also place our friend Alberto from Uruguay who at the afternoon was on his computer with his girlfriend and he was looking at a cloud and he said, oh well, health data. Have they got an admin? Oops. Oops. You see, that was the oops. So he wrote a mail to Serge Uruguay, the central authority of the country. This is about health records. And he received a very fast response by the director of the cert. So they took this very seriously. Maybe this wasn't so dramatic because the hacker wasn't really about to do anything. So this was maybe not that bad. For him, this was over. He had notified cert. They had taken responsibility. They will deal with this. Alberto was to carry on with his life as normal. After one year, he realized that, well, they closed the admin-admin, but now they have unauthenticated file access. So maybe I'll just go and sort of notify cert. Again, some time passed, about two years of silence. He had already forgotten about this. And then the company that has those health records, they get an e-mail from somebody saying, give us Bitcoin. And the person blackmailing them said that they had the health records. And if they wouldn't transfer 15 Bitcoins in a certain amount of time, they would go to the press and publish the information of all people who are HIV positive. I'm not sure the press would have been interested, but the police was certainly interested. You always need to think about the police. You can identify them by these hats. There is a star at the front of the hat, so you don't forget. So somebody wants Bitcoin now. And again, for a while, nothing happens. And then Alberto's door is kicked in. His house is searched. Again, brute force attempt, as we know it. And now this happens. The police can't believe their eyes when they enter this apartment because they find so many interesting things that they will say at a later press conference about this and sort of exhibit all their findings. Looked like this in the picture. Stacks of credit cards, blank credit cards tend to not make the best impression. This is true for the supermarket, but also in your cupboard when the police comes around. Also, card readers. So they set this up very nicely. Cards, card readers, everything. The question would be if the police actually thought about OPSEG and maybe censored the credit card numbers, we're never going to know. And of course, what you find at any hackers or criminals' house, what do you find, of course, the mask of anonymous... They find the mask. They also exhibit it. We don't have a mask with us. Strategic concerns and strategic money reserves. And... Very telling. They found Bitcoin. Very telling. And that's what the blackmailer wanted. So case closed. And one Bitcoin added up together. So, questionings, threats, police incompetence. And what Alberto does is confessing falsely, hoping that during the following procedures he would meet competent people, but that hope was wrong. He spends eight months in jail in prison and he is left out on bail at the moment. He's very sure that he didn't do this because after responsibility disclosing information, you don't send a blackmail. Especially if it says, please transfer 15 Bitcoins to the following account without actually giving the account or the wallet number. So as we have put some fun at Alberto, we actually contacted him and he had to say a few things and we welcome him to our video screen. After spending eight months in prison, I have to tell you that I've learned many things. One of them was that I should know how to manage the truth. When, who, where, how much information you share are key elements in order to stay out of trouble. After hearing my story, people tell me that they're learning is that they should not report security incidents. And for me, that is sad. Report them. I don't report them anymore because I was forced to and that is the way that I managed the truth in my case. I hope to be there next year and share with you the outcome of my experience which is crazy. So guys, keep on hugging. So the device that he was holding in the video that looked like an ISM jammer is just a very sad misunderstanding because the police hadn't taken it when they searched his house as well as 30 hard drives and he doesn't get those devices back because the police are saying that this would take way too much time to look at everything. So what we learn is it kind of makes sense to keep 127.001 as a very clean and tidy space in the wrong eyes looking at some devices that are taken from your house can be trouble and they might just try some logins. What else can give us a way on a technical level? We've talked about how to incriminate yourself. Maybe people are too honest sometimes. But what are the threats that can get dangerous for us? I could say they're kind of a kind of metadata similar to fingerprints as you can see here. Nowadays there are almost no things that don't contain metadata. The question how to avoid metadata and what can be done with metadata is very context dependent. So we always have to look at the content where the data was actually generated. So one of the most important things that you need to think about before even starting to hack anything what traces am I going to leave? This is the part where we want to try to address younger people or people who are just starting out to hack things to give you some ideas to think about which devices which software I'm using what traces do I leave? If I'm just at my computer I'm going to leave traces I have a smartphone that I'm carrying around with me So where am I leaving logs? What are the identities that I leave? Even if I'm using pseudonyms or if I'm using anonymizes and what technology do I use to stay anonymous? Pseudonyms, cryptographic keys that are used on multiple systems which is a bad idea because cryptographic keys only exist once that's kind of the idea but if I just copy my VM and some host names or keys might be the same making possible to trace back to me Logs are one classic there are always strategists who have files in TrueClip volumes because they heard that this is better but have enabled logging on their operating system level which says which files were opened with what application so the logs basically tell everybody what videos and files may be in the encrypted areas and this feature for many people this is just a feature they just want to know it's less work you need to type less this might actually break your neck if you just want to use this operating system to just hack around a bit the important thing is investigators or people after you can create identities of you whatever pseudonym you're using they can create profiles they can analyze your coding style your orthography your pseudonyms and forums where you show off the people looking at the devices that they took during the search of your house they're just going to look at how you deal with a terminal shell they can find out how many experiences how experienced you are with the operating system and also the coding style so maybe if you leave back functional extension to the kernel this is going to be analyzed later and there's software that does that same thing as detecting plagiaries plagiarized works there's works about how to trace back binary code to the original author basically to for example to attribute malware there are many things that you need to take care of and basically you need to find out yourself which tools you're using and what they and which side channels they open which kind of telemetry and how can I turn it off there are the rules of the internet written by anonymous nobody is really anonymous anymore but we'll talk about that later they have put down these rules to sort of get the fuck out as one of the rules one of the rules for the people who wanted to stay anonymous yeah, here come we're to a this is a nice fail of a hacker by the name of Warmer a photo of his who posted a picture of his girlfriend's breasts and he was very proud so even the police thought he'd sort of get the fuck out so he took the picture with this iPhone and the photo included GPS metadata so we award Warmer the Mario Bart award for the most superfluous OPSEC fail most gratuitous fail of course so how do we do anonymity in the internet if even anonymous can't really do it we don't want to be discovered the problem is that our IP address tells a lot about our location so we are looking for something that covers our IP address so if we google that the first thing we found is VPN service providers want to be anonymous on the internet just use a VPN this advice is given often so let's use a VPN VPN provider we connect to them might be an open VPN connection or whatever so this means that our original source IP address is covered and hidden and nobody on the server can know the servers that we then connect to so then we go to our target in this case it's an evil company that we want to hack and they're like what's going on? weird traffic it's a VPN endpoint so what can we do? are we secure now? we just assume that the VPN provider is going to shut up and not disclose our IP address we don't know them, we haven't met them but so the idea was actually that we don't have to trust anybody we don't want to trust anybody because what happens at the VPN provider we have an account we pay, we make payments so they're not going to offer this for free so they're probably going to have our email address credit card data, Bitcoin wallet whatever possibly there are logs but we don't know maybe the VPN provider just enables a login option with the next operating system update so this can happen there can always be surveillance at the provider level and the problem is we don't want to trust anybody so we just start at the beginning in this case it went wrong so we're going to have to find a way where we don't have to rely or trust anybody else we just don't want to and we also need a different target so maybe some sort of alternative in case you don't know this is the logo of the German right wing party alternative for Deutschland so this time we're going to use Tor you may have heard of that it's kind of easy the traffic is just going to go through several nodes encrypted multiple times you're sending towards the Tor entry your traffic which is encrypted multiple times and now the Tor entry knows who you are but only in the message encrypted to the node it said which next node this traffic is to be passed on this is going to be passed on you can also configure this until you end up at the Tor exit and the Tor exit is going to do the hacking and if the target looks at this then the Tor exit is going to know where the traffic came from but the middle node doesn't know anything and the entry knows who you are but the Tor entry doesn't know where your packets went which way they went so this is much better you don't have to trust as many people because they just can't know unless of course you're dealing with a global attacker or a global enemy which is bad for you but just for your small data journey we don't have to issue travel warnings unless you're too stupid so now we have the technical requirements to be safe and secure on the internet but now our own intelligence comes into play and this is the level where we need operational security before that we don't really need to start or think about OPSEC this is also what a student of Howard University thought and they were not well prepared for the exams they had that day so what you do how can I actually make this exam not happen there are not many options one of the solutions that usually works is a bomb threat we all know that here are strategists at Harvard he knows, they know how to use Tor and they send their threat message saying in which rooms they planted bombs of course including the room where the exam was to take place so this reaches Harvard and what do they do of course they call the police look they say this is come over Tor dear nock just check if any of our students use Tor at the time question so of course everybody had to sign in by their names to the network and this person got a free ride to the prison or to the police station so if we hadn't signed up on to the network and use Tor for this very limited space of time to write this email this wouldn't have happened so let's continue with anonymizers this is a very a topic that has very important to the public discussion hidden services so we're going to turn the whole anonymization network on its head we don't want to be anonymous as an attacker and hide our service in the net so we make people reaches through Tor so the police agent has to go through Tor and at some point the packets arrive at our node so our packets are routed differently through Tor so now we have a server on the internet that can be reached by many ways and it's very hard or impossible to find out where this server is actually located always of course assuming that nobody controls the whole internet or we're just stupid so we can prevent some of that by not writing any logs on our hidden service we don't use any known SSH keys we only give a local network to our hidden service catching it or constructing it to a 10-0-8 and only the connection to our hidden service is done by the onion router so it cannot be connected to the internet like this so even if it tried if it tried to do a little ping it could never escape to the big evil internet as you can see on the left so now we have our hidden service and we're very happy because the big evil internet can only reach us through Tor if you know how to do this and have some ideas this will take you about one or two days to set up and then you can just become a drug lord and now you can really screw up your own opsec again so to stay with the topic of the darknet Germany there was this guy who had built a forum and a marketplace so running this kind of service costs money so they asked for money to be able to continue to offer those services and those donations were collected as bitcoin just so I have a hidden service I use bitcoin, I'm in the darknet this all fits together very well so what do I do so now we need to exchange our bitcoin at some point and get real silver at some point you might want to actually have some euro so at some point this anonymous money leaves the digital world and goes through a bitcoin exchange and to your bank account and in this case this is where it broke because this uncovers your identity because we're actually using a german provider a german bitcoin exchange so it won't be any different of course they will actually disclose information who is the actual recipient and to whose bank account the money went this is a leads us to the Satoshi Nakamoto award for anonymous payments or this was a very well thought out donation platform and and what's interesting about this case is that there was some clean police work no they did the work without any without prohibiting anonymizers without saving data so there were weapons traded on this platform and they say that the police in this case and they always nag about that they get no data anymore that they need more have actually done good work in this case without surveilling us all the time pretty nice right so we can all say anonymous right so we get some nice metadata all right now move on to Wi-Fi who's using Wi-Fi in this room actually well they used to say that you should go to coffee places and use their Wi-Fi to do hacking well Wi-Fi is not only anymore in your own apartment those signals are spreading way way further and some anonymous members got to learn that the hard way because in front of his house they placed a van to observe his network and just see when there was a lot of activity even decrypted they just traced the amount of traffic when is their activity and by by knowing this they were just correlating activity to to other occurrences and it turned out that was the case and they managed by knowing this volume this activity amount they were able to kind of trace those deeds back to him and imprison him so Ethernet in fact is also part of OPSEC another killer for another killer for anonymity is the possibility of a smart phone and with its functionality like Bluetooth and so forth it's also leaving traces marketing there's actually the marketing companies that offer that offer services to track MAC addresses of devices and every time you basically venture out and walk walk around outside you are leaving traces with a mobile phone but actually you can you can change your MAC address right yeah that might be true but your phone is not simply on and it doesn't only know all the different Wi-Fi networks you're using and even though you're changing your MAC address from time to time your device is sending out the probes of the different SSIDs that it has been logged in and you might not count on that but with this information those deep probes it's pretty easy to identify you because you have a very unique profile that you're leaving leaving out there well actually I think we got someone just looking on the street who has been in the dark net so kind of really unfortunate here so this is very unfortunate the manufacturers of devices try to get rid of this by randomizing the MAC addresses but just by logging into different Wi-Fi networks and by leaving those traces it's pretty easy to identify you so what's the main learning here if you don't want to get tracked then simply switch off your Wi-Fi capabilities once you leave your apartment or when hacking something which might occur so let's move on to the next case you know sometimes I'm actually doing consulting and this is an example from my work this is a case of people who voluntarily trains they volunteer their time and are interested in judging their their actions and actually they had mobile phones that they only use when on site for the client which seemed nice when coming up with the idea and they in fact only they only use it on site at their clients and you know what the police actually traces those different areas where mobile phones are active and they realized see they simply traced the activity in the area where those people were active and were simply able to manage those guys because they were just waiting for the live tracking to show up the phone numbers that in the past occurred in the context of those sprayings a quick disclaimer this is not actually related to my clients like this is from a random group of sprayers so so what happens after such a finding such a case the name of those groups they are being actually connected to individuals and at some point they'll be a day like in five or ten years you might be able to trace all those activities back to one person like profiles are being created in the background and you know the more often you do this the more riskier it gets and you know if you've done it 19 times and it always went fine you think like okay it's gonna be fine again in the 20th occurrence but actually that might be not just the case and some organizations actually in the digital realm well the first lesson overall is you should know your device and you should be able to use the tools that you're using you should master them not simply just download a tool that somebody recommended and somebody who has read something about it really know your device deal with the technology know the technology and use the one that you master best for example web browsers it's a pretty important topic like lots of web applications and lots of services you actually need to explore by using browsers and today actually it doesn't matter what browser you're using they all have certain vulnerabilities or certain certain issues for example Mozilla they have a very popular extension install and this extension changes the ownership and this new owner is simply adding a tracking feature which happens in cases this can quickly reveal your identity and be a risk so always question what actually happens when you update an extension it's worth looking at the ad business the ad industry they're really good at tracing people like browser foot printing and all that stuff lots of different approaches to profile people comparable to those Wi-Fi pro requests used for profiling the same actually applies to browsers so be aware of this and how about using profiles that you can discard once you use them or erase the data once you use them set up a new operation system from time to time and be aware that certain data leaks of those browsers are patched as quickly as possible and well another advice here is really disconnect things that you can disconnect from each other like separate services and minimize the risk and as an example use one computer with the it's like your hacking workstation on the left like with different software installed and different measures that prevent data to be leaked there might be still data leaks like that who nicks can't prevent but it's overall at least minimizing risks of data being leaked accidentally so your devices let's have a look at your devices don't let people tell you certain things don't follow advice by people regarding certain operation system you should just use the system that you are well accustomed with that you know well you master that system and that's basically the way to go and laziness actually is also a pretty big killer of anonymity like you gotta be you gotta look into the future when doing opsec I'm using Tor no matter what like even if I'm doing simple online shopping just to be sure to not leave any trace due to laziness you never know there might be a target server that is blocking Tor exit nodes you know that happens from time to time or captures are just simply more and more a pain once you once you use a Tor exit node and those are all measures to basically get you to a point where you switch off Tor and for a moment not conceal your anonymity and this laziness might actually cost you your identity well in the future we might see canneries more often there was a talk actually last year on canneries on canneries and embedded devices well it's basically any certain patterns that are being left and that are being monitored for like if somebody is googling for those patterns it's comparable to like a honeypot approach with a database with certain data inside and a attacker that is that is using this data later on in a different setting like researching the patterns in my honeypot data trying to gauge the worthiness the value of the data he obtained and those approaches might also be pretty dangerous for for anonymity and revealing your identity so always be skeptical be aware that there might be traces and people are trying to get at you and actually place traps along the way you know in other cases somebody is installing this smart meter or it's coming along with a smart meter this is the device this is now being installed as we speak in the digital first euphoria and well this is actually collecting lots of data but I mean no worries you know it has been certified by an authority like the German internet security authority so no worries right but nevertheless we we recommend to not use those kind of devices and we're pretty skeptical what more devices will be come up in the future that reveal lots of data well it's also worth looking at yourself and your characteristics like are you lazy it's like you're kind of not skeptical enough if things have turned out well in after 19 times you just trust things that turned out positive in the past and you just make assumptions like nobody will look at this log because nobody has looked at it until now and always always ask yourself if this is actually a good approach and and you shouldn't spread too much information that's something we talked about earlier like if you go on go out partying are you a person that likes to brag to talk about your great achievements so this is also a pretty big weakness for your anonymity well let's look again at some kind of features and your way of conducting yourself it's like your grammar style it's your way of writing in an online forum technical skills that are pretty unique that only a few people have and showcase and investigators will look at those kind of unique skills and try to trace them back to just the few people of having them featuring them you might leave along something along the way certain functions and things that simply stay on the machines that you have been on and those things are being traced back to you and investigators are looking at this very thoroughly and in addition to that just take a deep breath try to do these things a bit more discreetly and at the rate of don't brag don't make illusions don't be overconfident it's one of the most important points also this money question don't be greedy money is not going to make you happy anyway I believe that if you've been hacking for years this is a very dangerous thing to become overconfident act like you recommended to act to your parents don't click any links they're sent to you by spam don't click on any attachments and don't be silly, careless one of the telling weaknesses is a case from the context of anonymous so he has a kid and a family and is liable to be blackmailed and pressured and might just tell about you this is Fneas Fischer nobody knows what they look like nobody knows if this is one or more person and the pseudonym is somebody who hunts Trojans opened the gamma 5 team and all investigations were dropped because there were no traces of this person or this hacker and we give we want to give the hat tip to this person of course so our conclusion pseudonymity is not anonymity don't tell about your plans never be in a situation where you have to trust somebody be paranoid before and not after the fact know your devices separate activities and devices makes a lot of sense to have a variety of devices especially if you're searched like Alberto if you have many devices they only take parts or some of them you might be left with some other devices and don't touch cybercrime there were people who are better than you and didn't make it forget about bitcoin, it's dropping so just leave it be and then we only have one thing left to advise you never hack without a ski mask and not without ethics and there was a talk about an introduction to the hacker ethics on the first day just save yourself some trouble work on the light glowing side of the force and you're not going to be in trouble thank you I have one too it's going to be fushing again it's going to be


The south of the Russian Black Sea region is home to many roadside plant communities which have been characterized by high adventivization and low invasibility. This is largely due to the presence of highly abundant and competitive invasive species in the area. The total projective cover of codominant species from invasive species is also important as it can reduce the levels of adventivization and invasibility. Along the Black Sea coast, the highest concentration of roadside plant communities with relatively more competitive invasive species occurs between the Mzimta and Sheikh rivers under the moderately humid subtropical climate. These communities are found along the Flat River Valleys where the Terrain Ruggedness Index indicates a greater than 50% chance of their occurrence. This article was authored by V.A. Chadeva and R.H. Shigosov.


Hey curlfriends, I'm Bianca Renee and you're watching Bianca Renee Today and today we're going to talk about the dos and don'ts of deep conditioning. Yes, you could be doing it wrong. Okay, maybe not wrong per se, but there are things that you can be doing in your deep conditioning days to make sure you're getting the full potential of your deep conditioner. Now I actually came across this article on NaturallyCurly.com which is an amazing website with everything you need to know about NaturallyCurly hair. There's some great articles on there, definitely recommend it. And this one was called the dos and don'ts of deep conditioning your hair. And then I saw that it was actually written by somebody that I know, should have known because it was written so well. So this was written by Christina Patrice who was also known as the main objective on Instagram and here on YouTube and she made a great chart breaking it down. So I thought the article was so good that I wanted to share that with you guys today and kind of give my two cents and kind of cosign everything that she's saying. I will make sure to put her full article down below in the description box. Make sure you guys read it and check it out and follow her at main objective here on YouTube and Instagram. Now the first thing at the very top of her list is deep condition weekly. Wow! Or oh yes here on my channel. If you guys are new to my channel I am doing a deep conditioning challenge where I'm challenging all of you guys to deep condition your hair every single week for a full year. And then I want you guys to show me your before and afters and I promise you you will see a dramatic change in your hair and Christina also believes you should be deep conditioning once a week. But if you have very dry hair you even can bump it up to twice a week. One of the deep conditioning don'ts is to not overdo it. I personally always do my deep conditioning treatments for 20 minutes and that's all I really need. Some of you I know like to do a good overnight deep conditioning treatment which may work for somebody but I personally have read on several different articles including this one that after 20-30 minutes it's not really doing anything anymore. Like you've drained all the nutrients you can get out of the deep conditioner after about 20-30 minutes and then it's just kind of sitting on your head for no reason. Christina even said if your deep conditioner is not making your hair more moisturized after 20-30 minutes then you need to get a new deep conditioner because it's not doing its job.  But really pay attention if you don't really notice a difference between 20 minutes and 8 hours of sleep save your pillowcases and don't waste your time. The next do is to add heat. I know I know I know. Don't freak out. I'm not saying to straighten your hair that's still a no no we're not straightening our hair anymore right? Okay good. But what I do mean is that when you are deep conditioning it actually is okay to allow some heat to open up the hair shafts of your hair allowing all the deep conditioner to actually penetrate into the hair shaft.  This is by thermal hair care heat caps and it's a reversible flax seed type cap that you could heat up in the microwave and then deep condition with this on warming up your deep conditioner and allowing it to really penetrate in your hair. These are pretty affordable I believe they're like 25 bucks I'll put a link below for you guys but I use this every time I deep condition. If you don't have a heat cap or own a big old steamer another option that Christina recommended was to put your deep conditioner in a hot bowl of water. It's actually going to heat up the conditioner so that way you could apply it onto your hair while the conditioner is warm. Also opening up that hair shaft and adding a little bit of heat to your deep conditioning treatment. I haven't tried that one yet but I definitely plan to. Another tip on this chart was to balance out your protein and your moisture. It is okay to do a deep conditioning treatment every week but is not really recommended to do a protein treatment every week. There is such thing as too much protein you can get like a protein overload you might become protein sensitive or you may already be protein sensitive so I and both Christina would recommend alternating between your deep conditioners and your protein treatment. Deep condition one week protein treatment the next. I probably use a protein treatment like once a month I'm starting to think that I may be protein sensitive I'm going to do some more research on that and give back to you guys on a full protein sensitive video. But I don't really need too much protein. Protein is really good if your hair has a lot of damage or breakage and you have really weak hair you need to like build the strength of those bonds that's when you want to use a protein treatment. Another big don't in the deep conditioning world is to not invite bacteria to your hair now you might be thinking how do we do that. Now if you're making a DIY hair mask that's not going to last forever make sure you keep that in the refrigerator and only keep it for about a week because then it will go bad and you don't want to just add fungus to your hair store bought products have special ingredients in them to help with the shelf life of it making the ingredients like last longer so you don't have to just throw away all your product after a week. So that's what store bought products contain but if you're making it straight from scratch at home with like eggs mayonnaise milk avocado I don't even know what that stuff's going to go bad eventually. So depending on what's in it you really only want to keep it for a couple of days keep it refrigerated make sure you always do a little smell test first to make sure it's not too funky and make sure you don't see a little green or black things floating around in there. Another deep conditioning do would be to apply your deep conditioner to your ends your ends are going to be the driest part and also the where you get split ends and any breakage so you want to really heavily apply all that deep conditioner to your ends give it the most love it. Now Christina even recommended to apply it to your ends first and then move your way up I also am guilty of just slapping it on top and then moving it down but it really does make sense to switch sides. One of the biggest deep conditioning don'ts is don't blow your budget I could not agree more with this point there are so many different deep conditioners now that the curly natural world has evolved into what it is today that you don't necessarily have to spend a lot of money one there's definitely DIYs you could just do with the ingredients that you make at home but there are drugstore and high end products that could work just as well as long as you find the right one for your hair type. Don't just think that if you go to Sephora or Ulta that that mask is necessarily going to be a million times better because it's more expensive than the ones you find in the drugstore. If you're looking for a really good high end deep conditioner I'd recommend DevaCurl or Briogeo and if you're looking for a affordable drugstore one I'd recommend Shea Moisture, Cantu or Maui Moisture but with that being said that actually brings me to the last point on this list which is don't be fooled just because a deep conditioner is like $40 that does not necessarily mean that it's better than your $5 deep conditioner that you got at Walmart you really need to pay attention to the ingredients as you start learning more about what products are in your deep conditioners. You might just hold up your cheap deep conditioner next to your expensive deep conditioner and realize that they have the same ingredients. Now I really think Christina nailed it on the head with this chart that she made about all the do's and don'ts on deep conditioning. The only one that I would personally add as a curly girl is to make your life more easier and convenient when doing your weekly deep conditioning treatments.  So if you follow me on Instagram or Snapchat you will see that I always do mask Mondays where you will see me put on a face mask and a hair mask and you're killing two birds with one stone. So these are all the curly do's and don'ts of deep conditioning I hope you guys found this article and this video helpful. If you learned the thing or two make sure you give me a thumbs up and subscribe. I post two new videos every week. Make sure you check out the full article on NaturallyCurly.com and also follow the main objective for weekly curly tips. If you want to know more about the deep conditioners that I use or my deep conditioning challenge make sure you check out my curly hair playlist and you can learn everything you need to know about curly hair. I promise I answer all questions on this channel you're in the right spot so hit that subscribe button and come back next week for more videos. I'll see you guys next time. Thanks for watching Beyond Coronet today.


Russian officials consider a U.S. written answer to Russian demands over Ukraine. U.S. diplomats said the document offers no compromise to Russia. In Japan, Prime Minister Fumio Kishida confirms a South Korean military report that North Korea again launched two missiles. He called the North's repeated launches regrettable. Reports say U.S. Supreme Court Justice Stephen Breyer plans to announce his retirement. And in Brussels, a German survivor of the killing of Jews in Europe during World War II speaks to the EU Parliament to mark International Holocaust Remembrance Day.