G'day. Welcome to Bootlosophy. If you haven't been here before, my name is Tech. I acknowledge the tradition custodians of the lands that I live and work on in Perth here in Western Australia, the Wajik people of the Nungar Nation. Today I'm doing an unboxing. I've been waiting for these boots a very long time. They're Chelsea boots coming in from Los Angeles, Christian Daniel boots. Let's take a look. So these took quite a while to come to me. They got stuck into a postal delivery centre in Perth coming over from overseas. They got stuck for over a week and I had to put an inquiry and make a complaint before they somebody actually sort of forwarded them to my address. But they're here now. Box from Christian Daniel. Let me just put this knife away. It's a really nice box. Let me try and get it out without actually showing you the boots first. So Christian Daniel box. Nice and fresh. Nice gold on black. Let's see what they look like. Oh that's very nice. From San Diego US. Welcome to the Christian Daniel family. This pair of boots was specially handmade for you by our artisans hands with over 30 years of experience using the best materials and not bad reading it upside down. We hope that you wear these boots with pride and create your own story while connecting with the world around you Christian Daniel. Isn't that fantastic? San Diego US which is where Christian Daniel is based. I don't know if you can see that Leon Mexico where they're actually made. So lovely tissue paper covering boots in the in their boot bags. Nicely badge CD tissue papers. There's a card as an initial supporter of our Kickstarter campaign. We want to thank you from the bottom of our hearts. Turning this vision into a reality would not be possible without your support. Really nice. Christian Daniel is a new boot maker started by Christian Ramos. I think Daniel is his middle name as it is his father's name. So using the name Christian Daniel is a real family connection.  They're also wrapped in plastic. I've never seen this before. Gosh this is careful handling. Now they come from the plastic. That's absolutely lovely packaging. They smell gorgeous really. The toe shape is quite round which I like in a Chelsea boot. It means it's really comfortable. A leather pull strap at the back. From the pictures I thought this was textile but it's not. Inside I'm not sure if you can see there's a Christian Daniel badge. Doctor Soul half souls and a Doctor Soul block heel and a lovely black leather. They also do this in a maple tan color which is lovely. That comes with a I think a Doctor Soul day night style soul. I don't have too many of these. I think I only have one pair of boots with this Doctor Soul half soul supergroup. So I wanted these these souls and so I chose the ones in black but you know that's a really nice nicely friend welted boot. So let's take a look at the other one. I have the boot bag.  Gosh this is so well packaged isn't it. No damage in the mail here and it smells wonderful. So just show you these. So in profile it's a really lovely shape. That last is a combination of sleek and rounded and roomy. So that's a really interesting last I think. I'll tell you a bit more about Christian Daniel a bit later but I've waited quite a while for these boots. I think the Kickstarter campaign started in mid 2022 and they did have quite a lot of issues regarding supply chains. The Doctor Soul souls coming from China. I'm not sure if it's Taiwan or China. The Republic got held up. So the whole process got held up. The uppers were done. The bottoming was done but they couldn't put the souls on. And finally it's arrived and it actually looks good. It feels good. The leather looks brilliant. I'm going to put them on my feet and we'll take a look. Okay so this is the Fernando boot from Christian Daniel Boots. I have worn them last night. Went for a little walk but I thought I'd do a try on here just so you can see them on foot. So they they slipped in very easily the Chelsea boots quite snug. The last is a combination of slim and roomy. It's quite wide at the ball of the foot and around the toe but this snug across the instep which means the ball of the foot is wide feels slim and snug to me. I have a sort of a bone here at the ball that sticks out on most boots and I can feel it in this one. This will need a bit of stretch when I'm breaking in. I mean this doesn't feel like it needs a lot of break in but this is definitely a sort of sore point here when I'm walking around too much and that's the part that needs to be stretched during break in. The sole in terms of its flexibility feels really quite good. It's not a sort of solid stiff sole like you're walking on wood until you break it in. The heel is quite a chunky solid heel. It's wide. It's quite a wide heel. It's not sort of tapered or anything and I do find that when I'm walking look you can see you can see that the heel to ball of foot is very in a very straight line but I do feel when I'm walking there's a bit of a clunk as opposed to a roll and that might just be the breaking in. I find some boots do that. Some boots you sort of roll as you walk and in other boots like these and a few others I found is you tend to have a clunk as you walking. I'm not sure if I'm explaining that right. This one is named the Fernando. I understand after a friend of Christians who passed away but really had a life-changing impact on him so it's really nice that he remembers his father's name in his own middle name in Christian Daniel and it's very nice that he remembers people who mean a lot to him. It's made in León, Mexico although Christian Daniel is based in San Diego in California US but these are made in León in Mexico. The leather I believe comes from La Fargue tannery which is the same tannery that Thursday boots use and in fact when you have a really close look at this leather it looks shiny in this light but it's very similar to Thursday's matte black diplomat leather which isn't really matte it's more of a sort of sheen not shiny just a little bit of a sheen. The leather smells like Thursdays as well so definitely from La Fargue. Very soft very supple that's why I think it doesn't really need a lot of breaking in. The last in terms of fit and feel I think is a little generous for me in the heel. I have skinny heels and skinny ankles so in Chelsea boots in particular I do need them to grip me around the back. I think these will be fine because the instep and the actual shaft holds my foot in but I do feel and maybe it will alleviate a little bit once the leather midsole really breaks and flexes. It should alleviate the bit of heel slip that I feel now as I'm walking along. I don't feel I don't feel like they're about to fall off they're not that loose but there was just a little bit of heel lift as I'm flexing my foot you know that flex point at the ball of the foot isn't really flexing just yet despite the fact that I said earlier that it's not a stiff midsole. Alright so I might take a closer look at the boots now. Okay so let's take a closer look at the the boot design and makeup and construction. I won't go through the whole construction I'll wait until I do my sort of full review in about three months time and we can go into the construction then I'll have a bit more time to research how it's done and talk to Christian about about the construction but as you can clearly see it's a Chelsea boot characterized by no laces and the two goring panels on either side a pull-up leather pull-up tab in the back which is very useful because it's the shaft is nice and nice and tight around your ankle. In terms of construction it has three leather pieces the vamp which is one piece up to there I'm there and then two pieces that make up the the back third of the boot that's sort of joint there and then there. It's a Goodyear welt and it's a it's a proper storm welt.  Outside of the welt sewn through to the sole to the outsole through the midsole and the outsole and the inside of the boot sewn to the to the insole. So water resistant, easier to re-sew. The leather as I said is from Le Farc tannery and you can see I know there's a bit of shine because of the overhead lighting but it's really a sheen it's a sort of matte black as defined by Thursday. I really like this leather it's soft it's supple it has rolled and it has started to crease I walked about oh I would have said probably about a mile last night in these just to see how they felt on the foot and they have started to roll as you can see but there's no sort of major creasing and there's no sort of loosening of the grain on top. It is full grain I can see hair holes bit of fat streaks, musculature that sort of thing on it. The sole construction apart from this natural colored welt there's a natural colored leather midsole so that's fantastic leather heel stack and then this half Dr. Soul super grip half sole which is sewn on and then tacked the brass tacks and a Dr. Soul heel topper as well quite a quite a thick chunky one as you can see. Construction wise I think it's been put together really well. I've seen pictures of how they've been put together in the Instagram post that Christian puts on when he was making them. What they do is and this often happens with quality boots they wrap the boot in cling wrap plastic wrap then they do the bits they need to do on the sole and sand and stitch and so on and then they pull the cling wrap off. A little bit of cling wrap was still caught up in it and I just picked it up with a with a toothpick basically pull it out I don't have a problem with that. The stitching all looks pretty good I think there might be maybe one or two like okay slightly missed stitches in the in the welt maybe this one is a little bit more parrot again you know what the hell it's a it's a hand-lasted handmade boot right yeah I guess QC is not the best not 100% and you know like if you look at the welt there is a there is a definite welt joint it's not sort of perfect but you know if you're picky you'll see it but if you're not you won't you if you look at the boot globally let me take a step back look at the boot globally oh gosh that is a beautiful boot so you know it's a bit churlish to talk about the welts not meeting perfectly I think this is not a dress boot you wear this on any casual occasion you kick around in it and so on so I'm not particularly fast about that construction wise structural wise I think it's really good it's very difficult to secure the goreing on a Chelsea boot without it feeling like it might start to come loose this has been done well there's been enough of a stitching through it it's leather lined fully leather lined on the inside so it makes it nice and soft and comfortable there is a badge I don't know if you can see Christian Daniel there can you see that Christian Daniel there is a bad leather sock liner half liner that comes up to the ball of the foot just under the arch arch support in these I find pretty good it's quite comfortable I think partly because despite these the width of this area in the and the waist here and the in the sole if you look at this part here it does tuck in and then come out and I think the leather itself forms a bit of a support for your arch apart from of course the steel shank that's in there cork foot bed so it feels comfortable with moldy feet so QC wise not precise but it's good it's not going to fall apart you know and yeah I really like the design of it I think the construction is really good the materials feel good to me they're good enough for lots of other bootmakers and Lafac is a is a really well known certified tenry so you know don't look down the fact that it's in Mexico you know I like it so just before we finish and I'm when I do the full review you'll get the full history a lot of research it properly but Christian Daniel was started by Christian Daniel Ramos in I think 2020 he started off by making a few prototype models both of Chelsea boots and of lace up boots it didn't get until the middle of 2022 when he started his Kickstarter campaign to produce the Fernando and he produced two models during the Kickstarter campaign this one in black from the far tenry with a dr. soul half soul and another one in a tan color which I think is called maple and that one has I believe a dr. soul started day night like soul I've had plenty of day night and at the time I only had one pair of boots with this dr. soul so I chose this one really to get the feel of that soul I'm not I'm not you know particularly for the black boots they're not one of my favorites but I do like black boots they do have a role in in outfits and what I wear and for casual outfits and particularly now as I'm in gray and you can't see my jeans but the black these go really well Christian Daniel Ramos himself I think had a difficult early life with some addictions that he alludes to and has publicly talked about in some of his interviews and in some of his postings but what I really admire about him is he pulled through he decided what his wife was at what his life was worth and he decided to make something off that worth and you know that I'm a big supporter of small boot brands the red wings of the world the Ellen Edmonds the Aldons they will survive these guys need our support they built boots not as a business but with a passion and I think people like Christian deserve our support of boot lovers you know not not just it would be nice to they deserve it because they are the tradition of bootmaking and so I fully support it the Kickstarter campaign started in July 2022 and closed in August 2022 and this cost me 360 US dollars to pledge for not quite sure what they'll go for when they he starts releasing them but that's a fair price you know it's it's a well-made boot it's got good material it's a great last I'm gonna have to break this little little bit in where the bone on the ball my foot sticks into it and it's a little bit cramped but otherwise it's a great last it's it's tight on the instep tight on the shaft so it keeps the fit on the Chelsea very hard to do unfortunately after his Kickstarter campaign closed Christian had a lot of problems with his supply chain coming out of Dr. Sol in I think Dr. Sol's based in the Republic of China which is Taiwan but still recovering from COVID issues and COVID shipping he got these souls late so they were produced late and they've only just come out now the Maple I think started shipping last month and the black started shipping this month and this is one of the first ones highly recommend this brand I think there will be a lace-up model coming out soon so have a look at that go get across to his website I put a link in the description below not an affiliate I'm just a supporter go take a look and of course let us not forget while you're here if you like this video click on the like button and please click on the subscribe button because then I'll be able to bring you through the reminders on YouTube other boot reviews and other boot things so until then take care and I'll see you soon


is hacking with a TPM. Don't ask what you can do for TPMs. Ask what a TPM can do for you. And it's a kind of introduction into a TPM and what you can do with it. And your guest host is Andreas. And here he is. Give a big applause, please. Thanks. Yeah, hi, everyone. So I'm Andreas. I'll be presenting some stuff on TPM. This is my GitHub handle and also my GitHub namespace where you can find some of the stuff or see what I'm working on. And the most important resource for everything I'm talking about is this web link. But you're going to see it in the conclusions at the end again. So who am I? Some disclosure. I'm actually working on TPMs. I'm being paid to work on TPMs. Or I found someone willing to pay me to work on this stuff. And I'm also a member of the trusted computing group, this industry consortium doing all the specification stuff. However, I started working with TPMs about like 13 years ago. When it was still 1.2 times at that point, I was trying to get things working for me and didn't work out too nice because the software was kind of not too well maintained. And the API was some kinds of little hideous to work with. And so about five years ago when the call for participants for working on a TSS2 came up, I basically jumped into the rabbit hole right away of what specification, writing, negotiating, and whatnot in TCG and also implementing this stuff and maintaining this stuff on GitHub later on becomes. And the results of this endeavor I want to present to you. So I'm going to go through some very minimal introductions to what TPMs are. And then we're going to jump right into those two topics of credential protection and some early boot protections. And then just some minor information on how you can get started working on this yourself. And here comes the fun part. So for your amusement and my personal adrenaline rush late at night, I opted to go for some live demos. So what I'm going to be doing is I'll be going ahead and copying all this stuff, switching over into my trusted virtual machine here. And of course, it doesn't work right away. So yeah, I should have unlocked Zulu first. Yeah, so I'll be doing some live demos every now and then. Please don't dust the Wi-Fi here. Otherwise, the presentation will get to a halt very quickly. Okay, what are TPMs? A TPM is basically a security chip that soldered onto your main board. And thanks to Microsoft for giving TPMs to mostly all of us, basically for cheap because thanks to the Microsoft logo program, every consumer laptop, desktop, whatever nowadays has a TPM more or less. So why not make use of them? They are pretty high security chips, I would say. There's like some assurance from common criteria certification which you can trust, must not trust, may trust but every evidence counts, I guess. Of course, there was some TPM dot fails and Tanya and David just talked about it about two hours ago or three hours ago. So it was very interesting. And what it's capable of, it's capable of doing crypto which is what we're gonna be talking about. It's capable of doing some storage and it's capable of recording boot hash values. And that's basically all it can do. So it's a completely passive device. That's the most important part here. And on the right hand side there, you see some old 1.2 versions of a TPM. Nowadays, the chip package is actually a lot smaller. Our TPM is dangerous. I think we've heard talks in the past that the Congress arguing for both sides. TPM's reputation when it first got into the market was these are these nasty evil DRM devices that are gonna remote control our PCs.  So you have some kind of secure element in your PC that you can leverage. And then there is this whole integrity reporting and attestation capabilities that I'll go a little more into detail on later. But don't just take my word for it. Take Richard Stallman's or GNU Foundation's word for it because they concluded that the trust platform module available for PCs is not dangerous. And there's no reason not to include one in a computer or supported in your system software. So I would call that Stallman approved and therefore why not just go ahead and use it. All right, but let's get into the meat of it. Credential protection. Who in here is using public key cryptography in one way or another? And yeah, I'm basically expecting all hands to raise. Who's using a smart card or a Yubi key or a TPM to protect their credentials? And who has optimized this process by just leaving the smart card in there or cutting parts of the smart card out and wrapping this with TESA or using a Yubi key nano? Okay, those are only very few. For you few, basically this is the same assurance level that the TPM is gonna give you as well. And for all others, well, smart cards, you can use a TPM instead to be more convenient. All of you who are not using smart cards but public key crypto, you should maybe consider using a TPM because you got one already and you paid for it, so why not use it? All right, what's the security idea of protecting credentials that comes with smart cards and TPMs similarly? Basically we wanna divide down our authentication guarantees into a proof of possession and a proof of knowledge. So we have two factors that are required or requested from us in order to authenticate. The proof of knowledge is pretty straightforward. It's entering a password, entering a pin to unlock your smart card, whatnot. And the proof of possession is the second factor. Well, what does this actually mean? Well, what you need in order to create a proof of possession is you need something that is not duplicable or not cloneable. So that's the primary feature of what the smart card gives you. What, for example, a soft token or a public key hanging around on your hard disk doesn't give you because you can just see a software, a soft token file and bring it to a different computer and have it run simultaneously on multiple computers. So by having something that's non-duplicable you have something that can be in the possession of only one person at a single time and therefore you gain this extra security. And this becomes especially important on every kind of hacker congress like here or blackhead or whatnot because people around those conferences seem to be very good at recording passwords from looking at you, typing them into your keyboard. So this is definitely a good argument to have the second factor. So the proof of possession, which is usually like your smart card or your Ubi-Kinano can be basically translated into, well, we have a proof of possession of my laptop that contains a TPM. So only if somebody has access to this laptop and knowledge of the pin, those two factors allow them to authenticate in my name or in the name of this credential. Typically the question is, but what if you're hacked? Well, this is a problem for every kind of proof of possession means. So same if you have a smart card in your smart card reader slot. For the time that somebody is able to control your system they are able to more or less use your credential as well but there's two differences. It's temporarily bound to the amount of time that you are hacked. So if you clean up your system you can continue working normally again afterwards and there's the second thing, there's no chance for an attack such as heart bleed where people would, because not every exploit is capable of gaining full privileges. Sometimes exploits like heart bleed are only able to dump certain memory pages out where maybe your key was living and then you're screwed. You don't have that problem if the key is not known to the computer, to the CPU and never stored in RAM or on disk. All right, demo time. How can you actually implement or how can you make use of these credential protections? The simplest way to do so is with the TPM2 TSS engine from the TPM2 software projects. I probably should have mentioned that here. So there was one of the softwares that we installed earlier and actually they did install. That's very nice. All right, in order to use that, all you need is these, I don't know, three commands and therefore I just wanna show them to you real quick. By the way, I'm not using a TPM simulator, just wanted to show that I'm using an actual hardware TPM here. I just forwarded it to the virtual machine for fun and glory. All right, virtual desktop switching. All right, so what we're gonna do first is we are realizing, yeah, now it's working. We're generating a key for the TPM and the next command is then we're gonna generate a self-signed certificate and as you can see, for those of you who've worked with OpenSSL in the past, the first command is a custom command of the software. The second command is just a regular OpenSSL create a self-signed certificate command with some mentioning of the engine and mentioning that we have a key form that comes from the engine and that's basically it. So, we're gonna go ahead and take that, post that in here as well. Well, we're from Austria now. What, who cares? All right, and now we have Curl and Curl is actually capable of connecting us. Well, come on, I should have brought a mouse. So, Curl is capable of making use of OpenSSL engines and don't get irritated by the dash, dash insecure here. That's, I'm running an engine X server right now on the host system and from the virtual machine now I'm using Curl to authenticate using client certificate authentication via TLS. And I guess everybody knows what that means to talk to the engine X. And as you can see, this is the website and the first time I executed that command I couldn't quite believe it because it was so fast and I thought I made a mistake or something. So, just to verify it to all of you, I'll be enabling trace logging and then we see that we have a bunch of communication happening with the TPM. So, we actually are using the TPM to do client side authentication to the server. Thanks. Next thing, so this is why, so first of all why I'm doing this. Of course, doing this to scratch my own itchers. So, I wanna be using TPMs at home maybe for like simple bash script based stuff. And whenever you're doing a bash script you don't wanna put your passwords in there because when you push them to GitHub other people will download them and use your passwords. Yes, so that's another advantage of these. And the second thing I wanna be doing at home I have some web server facing the internet that's basically a reverse proxy on engine X that forward stuff to home assistant and octoprint and whatnot. And I wanna enable this thing to store its credentials safely and securely as well so the next engine X hardly doesn't ruin everything for me. And for engine X it's actually pretty simple to do that. If we look into the sites enabled here it's basically just the default site. We see that we had to post in the SSR certificate and under the SSR certificate key you can use this keyword engine. So hopefully you never store your key in a file called engine because that's gonna be a problem. And we point to the TPM to TSS engine and because of some hideous bug in engine X that people on the engine X forum have been talking about but didn't find a good solution to fix it we also have to specify the engine a second time over here. So once we have all that we can just restart we can just restart engine X and this time we're gonna turn it around so I'm gonna go ahead and take my trusted web server on the host system try to connect to that thing and yeah because it's a self-signed certificate of course we don't trust it right away but we just used the TPM in order to authenticate the TLS connection from the server side as well so with both sides that we can now start scripting. Cool, there we go. All right, so that's the easiest way to get started when you're trying to integrate TPMs into any of your daily bash routines or whatnot. The next a little more complex way to do things is PKCS 11. So PKCS 11 is this standardized API by the open group that is what Firefox uses in order to talk to smart cards for example. And of course we're also working on or like this community is also working on something for that we even have a maintainer sitting here in the room calling you out there. All right and we're currently in the 1.0 RC0 phase for this thing which is also the reason why there is some weirdness that the setup tools don't install whenever you call make install. So if you're trying to like rerun this stuff from home based on these slides note that this is a path into the checked out good repository for the TPM to P tool and the only thing that actually gets installed is the library the PKCS 11 library that's later on used. So anyways, we're taking these few commands here and basically what we're doing is we're initializing first of all we're setting some Python path stuff and stuff like that. We're pointing to storing the database under home. We're initializing the database adding a token which is basically creating a new smart card out of nothing and then we're adding a key. All right, let's see is that running as well? Looks good and there we have it. We just generated a smart card with this random what not smart card ID that you don't really have to care about. But what the cool thing is about this and why I'm actually going into this problem is I wanna use that in order to authenticate via SSH because I don't know how many of you are using SSH client authentication using public keys. That's basically almost everyone. That's cool. Hacker Congress. So and who of you is not protecting their key with a password but using an empty password for that? All right, for all of you, this might be interesting. So what we're gonna do is we're gonna call SSH key gen and what this is gonna be doing is it's gonna just yeah, generate an SSH key and you've probably all seen this. So I'm going ahead and copying this and going into my host machine. And here I'm gonna edit the authorized keys and I'll add this key. That's all. And going back to the virtual machine. Well, virtual desktop inside of a virtual desktop. It's like my right. All right, and then we can log in using SSH and this should also be working now. And here we asked for the pin for the smart card that I originally called label which probably you can find a better name for that. And now I'm in. So it's working as well. But to make things even cooler, what else do we use SSH for? Well, we use it or at least I use it for Git. Git together with SSH. So we'll go ahead, take this key again and we're gonna head over to GitHub and this is my GitHub account. Now it gets interesting. So I'm adding this SSH key and yes, I'm storing passwords. Hey, they don't have client certificate authentication. What else should I do? So the thing we're doing here is basically I'm creating this awesome shell script that contains often SSH invocation with the PKCS11 library. And then we're exporting that under the git underscore SSH environment variable which means that instead of SSH, Git is gonna be calling our new SSH thing and this then translates to invoking the PKCS11. So let's go ahead and clone. And here we have the TPM invocation again and a lot more TPM invocation and there we are. And we can now even go ahead and check out a branch. I think I've used this in my tests. I'm just gonna call it now. Nope, of course. Check out a new branch. Git push origin and it's pushed and you can just go ahead, go to my namespace on GitHub and you should be seeing this awesome TPM authenticated branch push over there. All right, as I said, this is RC0. Hopefully there's gonna be a few hiccups and bugs that we're gonna fix before the final release but looks kind of usable, I would say. All right, coming to the next thing which is highly work in progress. So basically this is about BitLocker for Linux and I've written this, I don't know, I think more than a year ago and there was a merge request on the crypto setup upstream and we're basically re-architecting the whole thing but I just thought for fun and glory I would bring this work that I did back in the days. So what this is doing, so for Lux and crypto setup, the idea is you have a volume key that the whole volume is encrypted with and then you have multiple key slots that are stored in the Lux header of the partition where this volume key is encrypted usually with a key that is derived from the password you're entering and this then looks like the thing we see here in the middle where we have key slot zero of this type and whatnot and so what I did back then was I extended these, yeah, this is JSON, so if you're using Lux at least in a new on-disk format you have JSON in your partition headers which is kind of awesome actually to extend. Made my life a lot easier at the time. So we have there a key slot, so something like that and what we do is we take the volume key and we use one of the TPM's non-volatile memory spaces and we just store the volume key directly in there and so there's, yeah, nothing else we need to do and then what we do for the on-disk format for the Lux headers, we're just storing some metadata for example, what the NV index number is that we stored the stuff under. All right, so demo time again and so this is the crypto setup branch that I checked out and we'll be compiling this live. In the meantime, maybe one more note so the operating system running there in the virtual machine is just a standard Ubuntu installation and I just chose disk encryption and LVM during the Ubuntu whatever setup wizard and however unfortunately that's still using the Lux 1 on-disk format so what you have to do from the install media if you wanna do that is you have to call this crypto setup convert that converts the Lux 1 to the Lux 2 format header and then you should be ready to go. All right, so yeah, we compiled, we installed, now we're updating the inner drum FS just replacing crypto setup who doesn't do that all the time and the next command that we're running and you will see that the only difference in the command is we're adding a dash dash TPM here which calls out to using a TPM slot for that and we're entering an existing password. We're entering a new password and this new password is then used for the TPM to authenticate and we only have five minutes so I'll just skip it right ahead so this is now all set up and on the next reboot the system is gonna ask me for the TPM based password and let's see at this. So what we see here is this second key slot is now of TPM2 type. All right, one more thing I wanna present for early boot is integrity checking. This is based on what Matthew Garret talked about at the 32 C3 and this is the link to his talk. You should definitely go watch it. So this is about verifying the integrity of your early boot by sharing a secret between your TPM and your smartphone and yeah, I just did a re-implementation. I'm gonna showcase that as well. So in preparation for that, it's time for all of you to get out your smartphones and open your free OTP app or your Google Authenticator so you can verify that everything works as intended. And this one I actually pre-compiled. By the way, if there's somebody in the audience who's good at GTK GUI design, please come talk to me after because that was my attempt at doing this. All right, we're gonna be protecting by binding to PCRs zero through seven and this is gonna basically validate on each boot that these PCR values were the same that they are right now when we are trusting the system. So that means if you have a kernel update or you update your init RD afterwards, there's gonna be different PCR values. So you will have to go through this process again. So everybody has scanned this hopefully into their free OTP or Google Authenticator. Then we can go ahead and we can actually start rebooting the system and hopefully this works now because the most complicated part about all of these demos was actual, actually mode setting for Plymouth between Grubb and Plymouth, believe it or not. All right, and there is this number which is very large and on the screen. So it was eight, two, eight, six, eight, eight. Was that correct? Awesome. And the second thing I'm doing now is instead of the highly secure password Andreas, I'm typing in one, two, three, four. You have to believe me, which is the TPM password and it's actually booting through using the TPM here, which is, oh, come on, there it is. So that also worked with Lux. All right, I hope this gave you some impressions of what you can do with TPMs today already. If you wanna get started joining the effort, joining to Hegan stuff, this website up there is like our community page where we have a Gitter. So you can come talk to us, talk to me, talk to the other devils. You can have a look at those two header files, which are the most important ones right now. So the FAPI is rather new. We just released it, or just merged it into master, I think one week ago. So go ahead, have a look at that, test it thoroughly. Have a look at the tools. The all the tools that start with TPM2 underscore are basically one-to-one mirrors of eSAPI or ESUS, and all tools prefixed TSS2 underscore are one-to-one FAPI mappings. And here's one more pro tip. When you're developing and something randomly fails all of a sudden, it usually has to do with TPM resource exhaustion. And this command down there frees up the TPMs internal RAM again so you can continue working. All right, thank you. Thank you, that was Andreas. And it's question time. We have questions from the internet, and we have questions here in Clark. And look at it, you two have the same shirt. A very nice shirt, resource exhaustion. Okay, so maybe we start with number four, please. Ah, okay, so let's say you have your encryption keys in the TPM, and your federal government is somehow influencing the vendor of the TPM. So there could be maybe some way to get the encryption keys. So this is not a good approach. So it would be nicer to enter your big fat mantra to get your keys. And they are x-word with some other keys that are in the TPM. And so you need to have both to encrypt your look stuff. So this should be made like this. So you could not, let's say, take the person, torture the person and try to decrypt the data on another computer because it has a different TPM without a secret. So you should have real two-factor authentication, not having the keys in the TPM, because I would not trust it. Okay, depending on your paranoia level, but that's definitely a nice idea. Thank you. Only having questions, please, no comments. Okay. Questions, that's the role. Number two. I have to use Windows, which is encrypted with BitLocker and a second partition. How likely is it to accidentally destroy the credentials for BitLocker when working with these tools? Well, that highly depends on which tools you're using for which purpose. The tools that I used here and everything that I showed does not install persistent keys. I think, actually PKC11 is installing a persistent key so that drains some of your resources and also the crypto setup stuff and the TOTP stuff consumes some NV space and depending on how much of the TPM's resources, Windows, wants to claim for itself, you could run into resource exhaustion there. But other than that, there's no keys that these tools or the demos I showed would be deleting. So you can just go ahead and use those. Okay, thank you. Maybe we'll have a question from the internet. Do you have a signal, Angel? Yeah, other hardware tokens like a YubiKey, for example, they might have a button that you need to press in order to have some kind of proof of presence so that software cannot use it in the background without you knowing it. How to do that with a TPM? Currently not, but I'm hoping or I have been hoping for a TPM with an embedded LED for 10 years now. Well, more likely maybe we'll see some GPIO-enabled TPMs at some point in the future and depending on what we can do with those we might be able to include this or similar features in there. But so far I think there's only been research prototypes I once implemented a TPM on an Cortex-M3 myself in order to demonstrate the usefulness of GPIO coming right out of the TPM, but that would need to be developed first. Okay, thank you. Number five, please. Yeah, hi. Can you implement the universal second factor or VDO2 and TPS? Do you plan to do it? Yes and no. You can implement parts of FIDO using a TPM which is the basic crypto operation. However, FIDO also includes the custom data formats that are usually also handled in the FIDO token where you have some counters that you're incrementing something like that which the TPM does not store internally because the TPM doesn't know about FIDO data structures and vice versa. However, for FIDO2 I think there was this TPM attestation mode but that would need to be implemented by someone. So if you want to start working on that, please come talk to me. I'll gladly be of help. So there's a lot to do and yeah. So if any of you are searching for something to do, you can just go ahead and look at this GitHub IO community page. If you go to the software tab at the top and you scroll down, there is a list of programs. So we started with the programs that already have TPM support and then we have an even longer list of programs that we wish had TPM support. So there's also other things like WebAuthN or WebCryptoKI or whatnot where I would love to see more TPM support or even as simple as GPT, which yeah. Okay, number two please. Hi, how many different keys or smart cards can you store in a TPM? Is it just one or can you save more in there? The nice thing is that the principle concept of a TPM is that the TPM stores only very few keys. Usually it's just one in this case and all the other keys are then encrypted with this key and stored on disk, on hard disk. So with this PKCS11 that we have here, you can have as many keys that you have hard disk space available or as many keys as SQLite will allow you to store in a database with the reason of those search times, I would say. Thank you. Number four please. Hi, thank you for the presentation. I have a question related to kernel upgrades. If I upgrade my kernel, is there a way I can measure what the kernel will be on the next boot and tell my TPM that just resealed the currently sealed keys with the future PCR values that it should expect on the next boot? In theory, absolutely yes. That's totally simple. So a researcher will tell you, this is not a challenge. The engineer is gonna tell you, well, this is kind of a problem. And the problem is that you somehow need to know the reference values beforehand. And then you have to recalculate the whole measurement chain that went into that. And so this is a question of reference integrity measurement distribution that there was also a track at the Linus Plamos conference tackling this problem. So this is mainly an infrastructure problem rather than an actual problem of the TPM or the TPM base software. Okay, thank you. So we just have one more minute, so I'm very sorry. We can't take any questions more in the room, but I'll have one last question from the internet. Yeah, if I don't trust the TPM in my machine, can I just solder in a different one from a more trustworthy vendor? Are they compatible in that sense? Yes, as far as I know, they have a compatible pinout and a compatible SPI protocol. And that's the nice thing about standardization is that they are compatible. So sure, go ahead. Except for maybe inter-PTT FTPMs that run in the management engine.  Okay, thank you so much. If you want to get in touch with Andreas, go to the website, you've seen it before, and thank you for now. And maybe another applause for Andreas. Thank you.


This is an announcement from the Takesaki Range Control Center to all launch operators and personnel. We have reported that the main engine was ignited but the SRBC were not. We are examining the situation. It is expected that it will take longer to examine the situation. The status of A3 launch vehicle number one will be announced to all launch operators as soon as it will be confirmed. We are ending today's launch status report. Actually this is our first flight of 57 meters scheduled for today and today's mission is this. First of all, a lift vehicle. Yes, there it is. Finally standing there to LCC, the launch control center and this for example, the strength of the wind, amount of precipitation or the condition on their sides. Japan means Japan in Japanese but now it says.


Hello, welcome to this week's CMC markets index snapshot this week We're going to be looking at the u.s. Endac 100 that's based on the u.s. NASDAQ 100 and there's an interesting chart breakout pattern that's taken place and that comes in Alongside some record earnings that we've seen from its biggest component Apple Along with some general positive momentum in the technology sector of which the NASDAQ is is largely based around now Technology stocks have been outperforming in u.s. markets for the last couple of years now in 2013 and 2014 There were calls that the sector eventually would have to have a downturn and a couple of periods throughout the year There was a big sell-off on the back of over stretched valuations but as of yet is still one of the best performing sectors and for now this breakout in this the NASDAQ 100 which does have a large concentration of technology shares which suggests that the trend has not ended yet and Part of the reason for this breakout is its biggest component Apple has reported the biggest corporate quarterly sales ever recorded by a u.s. Company and Appears to be going from strength to strength there was even reports this last week that the company may be going into Producing automobiles that comes on the back of it soon to be released Apple watch. There's also Apple pays There's a number of products coming out from Apple which are really encouraging investors Legendary investor Carl icon has suggested that it's worth triple what it's worth right now So there's a lot of upward force behind Apple and that's helped this NASDAQ break break higher NASDAQ has actually been a lager in terms of u.s. Indices We've seen multiple new highs made in the Dow Jones industrial average and the S&P 500 But not so much in the NASDAQ 100 that has not yet overtaken its peak that it's made in the year 2000 at the height of the dot-com bubble So should this breakout continue there is a possibility that will move on and try and catch up with some of the other indices So let's have a look at the chart now and see what was he what's progressing So this is the daily candlestick chart and as you can see we've got this declining channel which we broke higher from last week and Some of the level just keep in mind here is that if you take the full height of this channel and project it from The breakout area we'd reach a level that's about 4525 so that's a hundred percent extension of the the channel height a level coming in before there is 4,430 that's the 61.8% Extension which can sometimes offer a bit of a barrier to the move higher But but ultimately Should we in fact treat this pattern not so much as just a channel but actually a bull flag So taking into account this massive move that started From the lows down at 3700 then we could be looking at extending that whole first pole of that big long move higher beyond the breakout and that could take As higher towards the 4816 that you can see just at the very edge of a monthly chart if you pull that up on the the new the US And at 100 which was formed as I said back in in the year 2000 We do have a quick look at the client sentiment quite an interesting result here actually because in terms of the number of clients Bearing in mind this does change on a fairly frequent basis. There seems to be a tendency to go long. So of all the clients put together a Bias to going along the end act 100 but taking position value Actually more of a bias to the short side suggesting that some of the larger positions being taken are short the market So interesting to see how that will play out whether in fact It's the number of clients or the position value of our clients who actually went out on this Whether we see a deeper correction and a top being put in or this extension in this in this breakout going higher So that's it for this week CMC markets index snapshot. We're of course looking at the US and that 100 Got to keep an eye on the overall technology sector here So there are some big names involved there the likes of Microsoft Google and the like and so forth But a big one is Apple and so we have the next quarterly earnings for Q1 Will be big to see whether the massive momentum that they built up over the holiday period With record breaking corporate sales can be sustained


Last class we ended up with a graphical illustration of the material variance which had two components the usage as well as the price variance. In that example that we saw the direct material variance the graphical illustration was easy to understand because you had one favorable variance and one unfavorable variance. Now let us just try to understand from a different example through a graphical illustration a case where both the variances the price as well as the usage are either favorable or unfavorable and then see how the joint variance behave and then what decision when it comes to attributing the reason for a particular variance difference to either price or usage. Now in the previous example that we saw we had a standard quantity of 825 and standard quantity of 900 while the actual used was 825 and a standard price of 4 rupees per unit and the actual price was 5 rupees per unit. Now in this case of an example that we would like to use let us assume that instead of the 825 that was actually consumed we are consuming 1000 units as against the standard units of 900 and see how the variance behave. This I will illustrate it through a graphical to an illustration. Now if you look at quantity our standard was 900 and now in our example we are saying that we are using 1000 units of that specific cost object. The standard price was 4 and the actual price let us say is 5. So let us see what this means for the purpose of our analysis. Now if I decide to represent the variance in this illustration we know that the total variance which is material as well as the usage will be 3600 which is standard quantity times standard price of 4 minus the actual is 1000 and the actual purchase price is 5 per unit so it will be 5000 and in this case it is 1400 unfavorable variance. Now this 1400 unfavorable variance could be because of usage variance as well as price variance and when we calculate independently what is the usage variance and the price variance. You will find that both have an unfavorable component and let us see how this is and let us see what is the effect of material usage variance on the total variance and what is the effect of the price differential the price variance on the total variance. Now out of this 1400 a minimum of 900 unfavorable variance I would attribute it to the effect of price because we find that there is an incremental of 1 for this entire 1000 units that we purchase. So if you look at the price effect if I say this is because of the price effect so the price effect on the total unfavorable variance is a minimum of 900 this is unfavorable. Why because this $1 differential over this 1000 units of actual consumption and that is the price effect likewise there is also a minimum effect that can be attributed towards the usage differential. So the usage effect similarly a minimum that can be attributed because of the usage is 400 why because the excess 100 that we consume here at standard cost of 4 will attribute to a minimum variance of 400. So this makes this 900 plus 400 1300 unfavorable while the total variance is 1400. We can easily attribute 900 and 400 to the effect of price and to the effect of usage respectively. Now compare this with the previous example where we had 1 unfavorable 1 favorable and the net unfavorable variance was easily attributed either solely because of price or solely because of usage. In this case we have both the variances being unfavorable adding up to 1300 but the total variance is 1400 that the question is this remaining 100 is it because of price or is it because of usage and we do not have a standard interpretation that says it is because of price or it is because of usage because what we see here is price effect is only 900 and price effect I mean usage effect is only 400 this is the numbers speaking for themselves then what where shall we account for this 100 technically we call this a joint variance we say this is an effect of both price and usage but it when it comes to the shop floor decision making level because we are talking about the variance analysis from the perspective of deciding where or where is the scope to reduce cost to make sure that the variance the amount of variance is reduced and we can do that only if you are able to attribute the reason correctly and in this case a joint variance only qualifies and it only says this 100 unfavorable is both because of price and because of usage and if that is the way in which we are going to interpret this then it is a little difficult to find the real reason whether it is because of price or because of usage and how to reduce this 100 so invariably what happens in real time is this 100 is attributed as the price variance because this the reasonable expectation it is that it is the purchase managers job to make sure that he buys the materials at the standard price whatever be the quantity even if the actual quantity is more than the standard quantity then it is the role of the purchase the responsibility of the purchase unit to ensure that even the excess quantity is purchased at the standard price so that is why we fix this joint variance technically we call this joint variance otherwise this 100 unfavorable variance as a price variance for the purpose of identifying a specific reason for an variance mathematically formula wise the price effect is 900 the prior usage effect is 400 the joint effect is 100 that explains the mathematics behind this understanding but then the managerial understanding is well independently price effect is 900 independently usage effect is 400 but because I do not want a middle level answers to say that this is a joint variance it is a via media solution I do not want via media solution I want to pinpoint and say this 100 unfavorable is because of a particular variance and in this case more often than not we say it is because of the price variance the reason is we believe that it is the purchasing unit responsibility to ensure despite the usage being more than the standard the price has to be fixed at the standard price so this explains the direct material variance now just as we have the direct material variance the next thing that we are going to see is direct labor variance direct labor variance in the case of direct labor variance the understanding remains the same just as material instead of material we are talking here about labor instead of quantity since it is labor variance we are here talking about time and instead of price we have a particular labor rate still retain labor price and instead of usage we are talking about the labor efficiency so this is about direct material variance and this is the direct labor variance so just as we have direct material variance we have direct labor variance and the technical definition is we are understanding how much of labor is required to produce one unit output of the standard cost object and that labor required how much is it going to cost at the given labor rate hours so we need to understand that just as we have direct material variance the labor variance will try to see how much of labor is required to produce one standard unit output of the cost object and how much of that is going to cost when that cost is measured by way of a standard labor rate that will be applied on the extent of labor that is being performed so just as we had the material usage variance and material price variance we will also have in this case labor efficiency variance this is link this is a parallel to the material usage variance and then we also have the labor rate variance is equal to the direct labor variance now why do we have these two because the direct labor variance can arise due to two variances one the standard labor hours that is estimated to perform a task let us say is x minutes and then when I actually perform the task I might end up doing it in x plus delta x or x minus delta x so the actual is different from the standard labor hours that we expect the task to be completed with it so this is the efficiency variance now just as we have the price variance in materials there is also this labor rate variance which will arise because we expect that this particular labor which is going to be undertaken for a particular period of time is going to cost me certain amount say y and actually when I do that the task the labor rates may vary it might become y plus delta y or y minus delta y so a mix of both the efficiency variance which is the measure of how quickly or what is the delay in undertaking a particular task plus the rate variance again how financially prudent I am in ensuring that the labor rates that I pay is close to the standard estimates it could be more or it could be less how much more or how much less than the estimated rate or the estimated time determines the overall direct labor variance so the same formula if we are going to apply to labor variance as well then the efficiency variance the efficiency variance will be the delta time into the standard rate the rate variance will be delta rate times the actual time same thing like the price variance and usage variance just in this case the usage is replaced by the term efficiency and price is replaced by the term rate let us just take an example to understand this better suppose we say that to produce a cost object y we require a standard time of 9 hours so to produce one unit of a cost object we need 9 hours and the standard rate at which I engage the labor is let us say 4 rupees per hour so the standard time is 9 hours the standard rate is 4 rupees per hour now actually when let us say I am going to produce 100 units so I am going to produce 100 units of that particular cost object and the total labor hours that was consumed let us say is 825 hours was consumed and the cost that I actually paid was rupees 5 per hour the same example as we did for material so the there is some variance because our standard should have been 9 hours per unit in this case 100 it will be 900 then 4 rupees per hour but in this case it is 5 rupees per hour so that should definitely be a variance and what is the variance is what we are interested in knowing so we will calculate that because now if we need to calculate the total actual direct labor cost it will be this 825 times 5 right 825 times 5 but actually it should have costed me only 900 times 43600 means standard the standard expected is this so there is a difference of 525 this is unfavorable because the actual is overrun the estimate by 525 so this is the direct labor variance now if I want to really probe into this and understand how this 525 came it is not just this 3600 minus 4125 it is correct but then if I want to know how I can break this into two components then we calculate the efficiency variance and rate variance so the efficiency variance in this case is delta time times the standard rate in this case the delta of time is I have taken 75 hours less and the standard rate is since I have taken less time than actually I estimated this is a favorable contribution to the efficiency the next is the rate variance will be delta rate into actual time the delta rate actually overshot by 1 the actual time is 825 since the overshot time factor is unfavorable so it is 825 unfavorable now this rate unfavorable variance of 825 and a favorable efficiency variance of 300 put together is the reason for the total direct labor variance of 525 still unfavorable so this explains where this 525 comes from it comes from the combination of an unfavorable rate variance of 825 and a favorable efficiency variance of 300 put together is this 525 unfavorable variance so now we understand that just as we fix responsibilities when it comes to direct material variance here also such variance analysis is done to see where the responsibility lies if it is rate variance then labor rates have increased could be reasons within our control or beyond our control we will have to make a study if it is because of efficiency variance then we know that it is not because of rate variance but then because of some efficiency in the engagement of labor that I am able to do a particular task quickly or I am taking more time than it actually has to so that analysis can be made if we are able to split the labor variance into efficiency and rate and then when we are able to identify the reasons for this variance then we will quickly jump into action to take some managerial decisions now the next thing that I would like to very briefly touch upon is the overhead variance now overhead variance we found that the standard cost will have a material cost will have a labor cost and we will also have an overhead cost now in the case of material and labor we are able to allocate by way of usage and rate by way of efficiency and rate the extent to which a material is being consumed to produce one unit of a cost object the extent to which labor is being consumed to produce one unit of the cost object so we are able to directly allocate cost components when it comes to material and labor the overhead cost is also a particular cost element which can also be traced to a particular cost object I am talking about direct overhead cost because this entire analysis is about direct material cost direct labor cost and direct overhead cost which means that relevant cost for a particular cost object is traceable which means I can say that this overhead cost this overhead and the extent of this overhead can be traced to a particular cost object while in material and labor we know the direct quantity that is consumed the direct material quantity that is consumed the exact labor the hours that is being consumed while in overhead we do not know the exact amount but then we determine it using a predetermined rate so we will have something called the predetermined overhead rate now to calculate this predetermined overhead rate we need to know two things one is the estimated production activity the estimated production activity level in this case we will call it as the standard volume so we will use the term standard volume and at this estimated production volume the total overhead cost so we need to know two things what is the standard volume or what is the production level that we anticipate and for that particular standard volume what will be the total overhead cost that we would be estimating that we would be incurring now if you recall the same behavior we also studied when we understood the cost volume relationship with regard to fixed cost and then we calculated what is the total unit fixed cost when we calculated the unit fixed cost we were able to appreciate the cost volume relationship likewise the same analogy the same concept in this analogy of overhead cost can also be used to calculate this predetermined overhead rate so what is the difference in this case the fixed cost that we saw earlier is nothing but the overhead cost here the overhead cost is the fixed cost here so let us I will just give you a small example to understand this the total cost that we use to calculate in the introductory session on fixed cost variable cost is the total fixed cost plus the total variable cost in this case the total cost is the total overhead cost the total fixed cost will be the total fixed overhead cost per unit of total fixed overhead cost is the same except that the relevant cost here is the overhead cost now the unit variable cost is the variable overhead cost per unit and of course the standard volume of the production level so if you look at the graph here I will have the production volume let us say x this is the standard volume and the total cost in this case the total overhead cost the behavior remains the same this is the fixed overhead cost and then this becomes the behavior of the overhead cost with volume the rate at which this behaves depends on what the unit variable overhead cost is now with this how do we calculate the overhead rate R the predetermined overhead R it is the average overhead cost per unit at standard volume so how do we calculate this average cost the simple calculation is we just divide the total overhead cost at standard volume by the number of units represented by that volume or to put it in a mathematical expression this R will be the total fixed cost plus the unit variable cost times the volume which is the standard volume divided by S let us assume an example the budgeted fixed overhead cost is 500 and the variable unit variable overhead cost is 1 and the standard volume is 1000 times technology gets a little inconvenient also unit variable overhead cost is 1 and the standard volume is 1000 so the predetermined overhead rate in this case will be 500 plus 1000 divided by 1000 so the overhead variance is the difference between the overhead cost that is actually incurred and the overhead cost that is absorbed by the production volume now there can be just as we had usage variance and price variance efficiency variance and rate variance in labor the overhead variance will have two components to it namely the production variance and the spending variance production volume variance and the spending variance the reason that the overhead variance arises is because the production volume variance arises when the actual production volume is different from the standard volume that is been used to calculate the predetermined overhead rate so that is the reason why we have a production volume variance and the spending variance is the estimated overhead cost itself for a standard volume the actual overhead cost is not equal to this estimate you have to very carefully understand this the concept of overhead variance itself is based on an assumption and the closest or the exact parallel that we saw to understand this is the behavior of cost when we understood the cost volume behavior fixed cost variable cost and in this case the cost is qualified to be the overhead cost except for that the behavior remains the same while in material variance and labor variance we are able to quantify exactly the extent of resources that gets consumed in this case we are not able to exactly quantify but at the same time we know that certain portion of the overhead cost can be directly traceable to a particular cost object except that we need some basis on which this overhead cost needs to be allocated and we calculated that basis by estimating the predetermined overhead rate of that predetermined overhead rate holds good for a particular standard volume and for that particular standard volume an estimated total overhead cost now with this understanding at the backdrop now see how can an overhead variance arise two things the production volume that is the actual production that we do if that is more or less than the standard volume then there is a difference in the overhead and that is called the production volume variance or the actual overhead cost that is being incurred can be more or less than what it was estimated to be at the standard volume that is the spending variance the effect of both the production volume variance and the spending variance will be the overhead variance the overhead variance is a little tricky subject to understand the concept to understand but then very simple for the purpose of this discussion it is enough if you understand that apart from the general overhead the selling general administrative expenses which are indirect in nature and cannot be traced to a particular cost object there are some specific overheads that can be traced to a particular cost object which is determined by calculating a predetermined overhead rate which is linked to an estimated overhead cost at a standard volume and if the actual production differs from the standard volume then there is a production volume variance and if the actual overhead cost differs from the estimated overhead cost the standard volume then there is a spending variance. It is little complicated to it looks complicated when I say this but then when I just split overhead variance is production spending variance and wall production volume variance and spending variance it is easy to understand. So, from the overall variance aspect let us see, when we started this concept of variance we said to ourselves that the very purpose of doing this is to go into the nitty gritties of a cost analysis to see why we have done better or why we have not done better. And this we can do only if we are able to quantify the cost elements with reference to a cost object and this quantification we can do it at three broad levels at the material level, at the labour level and at the overheads level. And to do this we need to first understand what would be the estimated material conception, what would be the estimated labour conception, what would be the estimated overhead cost. And then we split the material into usage and price and remember we are talking here about direct cost only, we are not talking about indirect cost because they are not directly traceable to the cost object. And when it comes to material I am just trying to sum up what we did in the last three four classes. So, when it comes to material we would like to understand to produce one unit of a cost object, how many units of the different material inputs that we need and at what rates to be get them. That times the total number of units of the cost object will give you the total material usage and total material price variance. At a unit level to produce one unit of the cost object how much material I need and at what price I am going to buy this particular material. This is at the material level. Likewise at the labour level to produce one unit of a cost object how much of labour hours do I need and how much am I going to pay for this labour hours that I need to pay for one unit of the cost object. And again for overhead what is the predetermined overhead rate that I will be using to allocate the overhead cost to a particular cost object. And all these three put together will give you the detailed variance. So, material plus labour plus overhead level is the variance. Now at the beginning of this concept of variance analysis I said we do this because management accounting as a subject by itself is something that has got to do with looking inside the organization to see what is happening at the various cost breakdown elements. And to see whether there is a scope to improve and increase efficiency and productivity. And that we can do only if we are able to break down these cost element into final elements and then look at it from a monetary perspective because we are talking about finance and everything is monetized. So, we need to look at it from a monetary perspective and hence this variance analysis is done to fix or identify the reasons why material has been excessively consumed or why material is not being competitively sourced, why excess labour is being consumed, why we are overpaying or underpaying not underpaying but optimally economically paying. So, these are reasons that we will find and if there are best practices that are being followed how can this best practice be replicated across the organization that is also one of the reasons why we do this management accounting as an exercise. So, it all revolves around the slippery term called cost and I told you that when you hear the word cost a lot of things get associated with it. It is as good as saying cost is the amount of money that I spent to buy a particular resource but it is beyond that and that is how we saw how cost is being split into various different elements and what we have seen till now is not the overall perspective of cost because there is still more to this we have something called activity based costing, we have something called joint costing, we have something called differential costing. All this I am not going to get into because we are just going to cover only the basics of management accounting and I feel that this is enough to understand the cost volume behavior and what fixed cost unit variable cost is, how the total cost varies, how to calculate the economic, the break even point then how to do this variance analysis to ensure that there is improvement in process efficiency and with that we will kind of stop not venturing into differential costing, joint costing, product costing and all that because that again activity based costing these are all again bigger subjects by itself but then one thing that I want to also teach the classes one particular model that emerges from this cost study and this is something that you will often do let us say you are engineers. So this you will encounter when you are working in a manufacturing organization or any production any organization that engages in production or manufacturing, we handle inventory and you know how critical inventory is for an organization and what I will be trying to do is we had a little bit orientation in accounting. So we are going to see how cash is important to an organization and how we need to increase the time that is taken to optimally utilize cash. We are just going to see the cash conversion cycle increase or decrease as the case may be to make sure that we efficiently manage cash and how inventory planning is an important tool that contributes to an efficient cash conversion cycle and for that inventory planning how the cost elements involved in the inventory planning play a very critical role. So next class we will just try to see a cash conversion cycle and inventory planning mechanisms and how cost elements influence inventory planning as a result of which cash conversion cycle also gets positively or negatively impacted. Thank you.


And welcome to condo insider it's Thursday at three o'clock and this is our typically show our where we try to educate board members and people who live in a condominium on the various issues going on here in Hawaii and elsewhere. You're probably going to get sick and tired of hearing about this over the next year or more. But we're going to talk about reserve studies. The next frontier. This has become a very hot topic across the United States. Community Association Institute, the national trade organization recently issued new public policy on reserve studies, almost every legislature across the country that has any kind of condominium in it. Invested in passing laws to tighten up the safety for condominiums for residents. This all stems from the building collapsed champagne towers south in Florida surf side Florida be exact often it's called surf side. And 98 people lost their lives because the building call. It collapsed because allegedly for years. The board of directors had tried to get the owners to approve a special assessment. So they could repair the cracks and the structural failures, you know, and as you may or may not know and concrete buildings. The concrete embedded in his rebar that's the structural strength. All concrete is porous water gets into the concrete, the rebar rust deteriorate the structural integrity is lost. And depending on circumstances. In this case, the building collapsed, killing 98 people. This has caused all sorts of interest and panic throughout the United States, and legislatures across the country have enacted laws, but in addition CAI without new public policy, saying this is what Association should do with respect to its reserve study. I'm going to talk about that today can I give you my crystal ball what's going to happen in the future, and a little bit of what's already happened here in Hawaii. So you can understand how important this is. I would tell you I'm predicting now that you're going to see more lawsuits, more claims, more problems coming down because of the fact of an association, not maintaining its property.  Let's talk about Florida just briefly. Okay, the building collapsed people died. Work wasn't done this board had tried for several years. He's tried so long ago that the original estimate to repair the building was 9 million. At the time of the collapse. They had an estimate for over 15 million to fix the building. The building deteriorated further which required more work, but inflation certainly took hold of respect to that. The issue is we look at Florida the biggest problem. I want you to pay attention to this in the Florida law the condo statute. You have to have the owners approval to assess the homeowners for the repair. So that means that $9 million or 15 depending when you were looking at the number needed had to go to a vote of the homeowners. And the homeowners would never approve the assessment, because they were going to have to borrow the money and raise the maintenance fees, a couple to $300 a month to fix the problem. So every year the board or throughout the year would try to get the homeowners to approve the loan. And they couldn't get the owners approval. And finally just before the collapse. My understanding, they did get the homeowner approval but it was too late. Even the roof that needed to be repaired the regular roof. The contractor had refused to go on the property, saying that the property was too dangerous to work on. Now, in some ways you can say well, we tried the board that they can be tried but the owners wouldn't approve it. Well, it kind of ignores other things the board could do like go to court because of the safety and conditions and get an order and, and those types of things but that's kind of relate this to Hawaii for a second. Under Hawaii's condominium law. The board has an obligation to maintain the property period. And the law provides that in Hawaii. You can assess the owners, if it's $100 million a billion dollars whatever it is, the board has the right to assess the owners to make the repair and has an obligation to make the repair. If you have time to not when you get to these mega numbers, the board goes and wants to borrow the money if they don't have enough reserves which is more times and not the case. The board to borrow the money versus assess the owners, they have to have 50.0% exactly half of the owners consent to the loan. More people approve the loan that don't approve the line so it's pretty easy to get to 50%. But think about this way from a liability point of view, as you as a board member you have an obligation to maintain the property. If you have reports from engineers and experts saying you have a serious problem, and you have the authority to make the repair, you just have to assess the owners which nobody wants. Do you expose yourself to liability if you haven't take action under your fiduciary duty as a board member to fix the building and I think you probably do. I think more of those losses will come to bear. Now, I'd be the first to admit that some of the structural design is unique to the champagne tower itself. I don't think structural failure is going to be a commonplace thing, but people buy and sell property and expect unit to be in good shape, and to say there won't be litigation arriving out of this would not be true. Well, let's just review the fact that on Hawaii, Board of Directors has the unlimited authority to assess the owners and have the legal obligation to maintain the building. And so if they don't do that and there is a catastrophic problem, or even a problem down the road. Is the board member going to be safe from the good faith argument that well, I did the best I could I don't think so, because I'm an expert a lot of lawsuits. I can tell you now that there's more and more lawsuits coming about, which I'll discuss them later in the show regarding reserves. What happened with the legislature in Florida, after they had this catastrophic problem, 98 deaths, a $1 billion lawsuit settlement. The legislature had a fixed their problem with regard to owners. Having approved the assessment. So let me ask you the question, what did the Florida legislature do. They talked to the person in Florida, who was my counterpart, who gave me the answer what the legislature did. They did absolutely nothing. They took the position of the legislature in the last legislative session that this is a one off situation. It's not going to happen easily and often. So they don't need to do anything about it. Now that's what they did, but then the bad news is the public everybody went nuts over this. They, they address this problem that's serious. So they went back into a special session, believe it or not, and they passed one law. And the one law basically said that associations over a certain number of years of age, had to have a structural inspection of their building and have a file with the building department. There weren't any changes to the authority to borrow the money, but there were requirements that the building be inspected by a structural inspection, which I guess brings government involved if it fails the inspection and what's going to happen next. And so that's kind of what happened in Florida but let me tell you what happened in Hawaii. We have with act 62 act 62 has five parts to it, of which one of the five parts has to do with reserves. I would tell you as a preface to this, one of the other bills offered this year was to mandate structural inspections for building. And I can tell you I bet that's back next legislative session, and you're going to see more efforts to require associations of a certain age and size or whatever it may be. To have structural inspections. And so that's coming it's not here today but what are the act 62 do to us with regard to reserve studies. Now, effective January one 2023. It did basically three things. There's always been an argument and developer putting out a public report new building underestimate reserve funds to theoretically and intentionally reduce the maintenance fees to make it easier to sell the units. Well, developers have previously relied on the FHA 10% minimum requirement. Be towards reserves and the maintenance fees. It's kind of their scapegoat to say, well, we took 10% of the maintenance fees. Well, the new law act 62 says developers have to do a reserve study. They just use some artificial number based on the HUD guidelines and the FHA guidelines for for maintenance fees. And frankly, I would have to tell you I've read those guidelines that's not exactly what they say when they say 10% is adequate. But either way, let's just say, and now developers have to do a reserve study. And many don't know we've always heard the level one, two and three for existing projects for reserve studies. There's a level four reserve study for developers. So this law says that as a part of those public reports that in fact, developers must do a reserve study. So that number becomes more accurate.  Number two, it changes. If you know there's two methods of doing reserve studies. Two funding methods, one of the percent funded basis, others called a cash flow basis. If you were doing the cash flow, you would project out 20 years and the administrative rule said that any component that had a remaining life more than 20 years didn't have to be in the reserve study. Well, what x 62 did was change it to 30 years. So that rule of the 20 years no longer exists. Certainly when you have large items with long lives like elevator modernization that have a life of 30 years, you're going to have to include that in your calculations now from day one and not wait 10 years to do it. It's going to be better for you in the long run. It's easy to pay for it over 30 years and 20 years of the cost should stabilize the reserve contributions in the future but act 62 basically said that if you choose to cash flow which about 99% of all the condos and why choose, you have to do a 30 year project in effect in January 123. You have to do your budget in the fall of 2022 so you got prepared to amend your reserve study to look at a 30 year cycle. But the third thing they did that was frankly a post to this. Primarily because of the language. Basically it says if you do your reserve study and it's not done by reserve professional. And you must have that reviewed by a reserve professional. At least every three years. So if you're in house doing one or your management company that doesn't have accreditation and doing reserves, and you have to do a reserve study. You could go to someone who's a reserve preparer could be an architect engineer could be a CI reserve specialist could be a member of the association professional reserve analyst was lots of people to do this. And you're going to have to review your reserve study to determine the sufficiency of the reserve study. That's interesting because the language was so vague didn't really decide who a really reserve state professional is. Basically it calls a reserve state preparing and doesn't really put any real requirements on that. But then it doesn't address the things that you go and you have a reviewed and the guy reviews it says your reserve studies no good and you say well thank you for your opinion. Thank you for reviewing it. We're going to keep the one we got we're not going to do anything about it. And that's kind of the problem didn't really give much destruction or specifics to condominiums and what they have to do. I want to talk about this some more and we're at the halfway point. So we're going to take a one minute break and come right back, and I'll give you the rest of the story. Back to condo insider talking about the next frontier reserve studies and before we took the break I talked briefly about this issue that the in the reserve study that. Well, lost my train of thought for a second that you have this three year requirement to have a review and it didn't really specify what that really means and so what it means to board this potential liability. Think of it this way. If in fact you have an obligation to maintain the building. If in fact you have a reserve study. You did yourself. If in fact I would prepare who qualified said, your research studies no good. And you do nothing about it now there's an assessment down the road, or a new buyer down the road says how come you have to raise my fees 25% you didn't collect enough in the beginning.  Well, I know this is all brand new but I would say that there's going to be some lawyer out there who's going to say look, you have an obligation to the statute to fix the building you didn't fix it. You did a reserve study, your reserve study was not any good according to a reserve preparer who looked at it, and you didn't do anything about it. So you have some personal liability with respect to this because it could be considered gross negligence or intentional and willful conduct. And of course, there's defenses for that. But the say that you're free and clear from this because nothing is going to protect you better than doing a reserve study and doing what it says. Well, what I find is that the future is very clear to me. Next year you're going to see structural requirements. I hate that because every time there's a problem. Everybody wants to pass a requirement.  Now you have the structural requirement. Now you have the city and county how little wanting you to have to do all these studies on electricity usage requirement. You know, then you have the proposed study that all associations have to evaluate the EV charging station needs a requirement. You know, it gets to be this is expensive. It doesn't mean that we shouldn't do some of these things, but to try to litigate this or should legislate this into a mandate, all this has to be done by a certain amount of time is foolish. You know, first of all, look at the number of buildings under the new city ordinance, where you have to have this study of your electricity using this is commercial and residential buildings. I don't know enough people are in town to do this in the timeframe they've established itself. I'm not a big fan of government mandating some of those issues. I do think we do need to clean up the reserve study issue a little bit because the practice has been we'll do a reserve study. We've got that task done we're not raising maintenance fee and kick the can down the road to a future board or a future set of owners but I can guarantee you what you're going to see in the next year or two structural inspections be mandated. You'll be required at some level to have a professional reserve study prepare. Do your reserve study, and you will have an obligation to implement that study versus this greatness we have within the statute today, and it's going to become a bigger item so I would say to you upfront that I'm going to talk a minute about the common mistakes. I'm not going to make a reserve study and a common problems and some of the litigation but if you if you're honest about it, and you accept the fact you live in a condo and you have to maintain the building. If you accept the fact statute requires you to maintain the building. You may not like the answers and what you need to do to maintain the building. You really don't have an excuse not to maintain it. The property values are going to be affected by how well you maintain it. And I've seen so much misuse of the reserve study concept, because people were kicking the can down the road. And let me tell you, my number one belief in future litigation. My number one belief of the major mistake that condominium is making their reserve study, and they do it every day they blame it on inflation. Here's an example. I'm an expert on matter with the condominium was a fight over the reserve study. I've been now managed by arbitrator, I'm going to say a person who agreement was to have the arbitrator manage the final decision. Well, here's the problem. So if you look at the annual contributions of that reserve study. Rounding it off. It was about $100,000 a year, which would be divided by 12 by the number units or percentage of common interest, whatever it may be. Well, if you look at it because that 100,000 year didn't give them sufficient cash in future years, they would go into the negative which they can't do by law. What they did is they proposed an increase the reserve contributions every year of 3%. So when you look at that over 30 years, that 100,000 a year becomes 600,000 a year. Now think about that that means the reserve study contribution, which in that case was about $100 a month per unit would now be $600 a month per unit, plus the maintenance increases which are going to have inflationary things put on it. But people don't realize or people refuse to admit or people look the other way is when you do a reserve study the software itself is using the future value of that component to be replaced that roof with a paint shop. So since it's using the future value and administrative rules define the future value is $20,000 it's got a 20 year life you'd be putting $1,000 spread evenly to all the owners and the multiple calculations you do to create the reserve study. Well, if you say well I'm not going to do that like this 3% does, I'm only going to collect 800 this year that 850 next year whatever it may be, you're really kicking the can down the road to force yourself to meet these components that you're not addressing now that 30 year elevator job, you're kicking that can down the road. So you're going to cost you a whole lot more in the future is evidenced by the example of 100,000 to $600,000, where the if in fact, they were today put 130,000 a year into the reserves, that number would stay constant for 30 years. Now, what I see is happening is that I was involved as an expert on a lawsuit on this, where, in fact, the lawyer argued that that's unfair you're not collecting the amount you're supposed to according to administrative rules, it's supposed to be a straight line even number. And what you're doing is taxing future people. So the old people are people want to buy and sell get out before the damage is done. I think there's a lot of legitimacy to that. I think you're going to see, particularly as reserve studies have to be more perfect with better data, you're going to see more people trying to kick the can down the road which is going to result in lawsuits. The example of that, I was an expert on a Maui project, where a new owner bought a in a project and made that argument saying hey I just moved in, and I'm getting an assessment because reserve study was inaccurate. Why should I you should have been collecting that from my buy my seller or from some other owners is sold prior to me buying into this. So, in that case, it's going to be an argument that's going to come forward and as much as it may be a bitter pill to swallow. I think it's important we all recognize we have an obligation to collect on a even basis for 30 years amount of money projected to fix the building and maintain the building. And part of that has got to be that you do a good job of looking at the components remaining lives through replacement cost. It doesn't make any sense to argue that we have a good reserve study if you've left out the central air conditioning system or the roof or, or something else you need to, as the statute requires you to identify all the components actually over $1,000 in value. You need to put some energy in as most boards get through their budget and the reserve study look at it quickly. Are we raising the main disease yes no, and they pass it without much discussion on the individual line items and components within the reserve study. It's important that the board do that that they really take a look at that and as I said I'd be hiring a professional from a larger scale, kind of any of them to give me a base. It doesn't mean you're screwed because even if you find you haven't done the best job, you're better off changing it over the next two or three years to get it to where it should be, because you have time over 30 years. Let's try maybe to do it all the first year. There are ways and techniques you can use quickly and early in the reserve study, bring the number up to where it should be, and give the owners notice that over the next three years we're going to do the following in my example to get us on an even keel but I don't think for a moment this reserve state thing going to hit the fan. It's going to hit the fan because of the fact that I do a lot of reserve study work and I countlessly look at buildings that have deferred maintenance that the reserve studies are inadequate, and they're not thinking it through. And that's why I'll get off the board this year and up next year's board and worry about it. Well this is going to come back to affect all of us because I think this is going to be the new frontier is going to be condos have to do a reserve study over some number of units will say 50 units has to be done by a professional that has one of the following qualification reserve specialist apra architect engineer. The board has to implement the reserve study on an even level basis. I think there's going to be more and more requirements in there. I think more that will erode your good faith argument where you're not obligated to do personally for any of the damages that may result on this. And that's kind of my message today we have about 50 seconds left it looks like the new frontier reserves is something that the boards and homeowners need to look at carefully. That's going to affect your property values. It will affect your maintenance fees because you're going to have to get in line with the real requirements are. At the end of the day if you don't do that. I think you're going to see litigation, you're going to see claims of personal liability, and you're going to see all sorts of stuff that are not going to be something you're going to want to be involved in. So, anyway, a who we hope and always nice sharing with you my thoughts, or I have to bring you bad news but this reserve study is the next frontier and next challenge or condominium association. Thank you so much for watching think tech Hawaii. If you like what we do, please like us and click the subscribe button on YouTube and the follow button on Vimeo. You can also follow us on Facebook, Instagram, Twitter and LinkedIn and donate to us at think tech Hawaii.com. Mahalo.


You run a family and it's terrible for my kids. He does something that we talk about in the true crime workshop called trancer. And you'll see, I'll bet you when you get this guy in the interrogation room, you start hammering him, he's gonna become emotionally unavailable.  That's a good way to break eye contact and we'll see it again.  And it's not the case. He's still doing the trancer. He breaks off and goes into the emotional piece. I don't feel sorry for him here. There's a lot of red flag in his behavior, that drawing with his eyes and then breaking eye contact in that trancer so you can't talk to him. And it's a way to escape questions. He's put together all this information. Now he's pitching it. He's fishing to see if you believe him with a lilt in his voice and in his eyes to the side. The minute you do, he moves to the next element of the story. That's a bad indicator for a person who's being truthful, typically.