Morning, everyone. Let's, I'll take like one or two minutes for project questions. Yes, and? What's the benefit of, for the cross-eyed scripting prevention, you say minor modification to PHP program. Yes. What's the benefit of PHP over another scripting language? It's one of the most widely used, well, case language, but I don't want to just tell you now. So we could use it. I think that'd be fine. Yeah. Yes. I think you're more difficult, maybe. Other questions? Yes. For the project where we have to limit the payload automatically, do we need to do something like, you send a request and like in verb soot, you capture that request and modify and then send it to the server? For, specifically for which one? For automatic acceptance of payload limitation. Yes. For that, you, for that, that's the precise one, right? So you want to not just use, so specifically you don't want to just use the list of payloads, right? You want to understand when an HTML content is paid, what characters do I need to execute JavaScript and automatically generate that payload? So the input would be that request and that target page. Yes. Yes. And then based on that, you generate automatically a precise payload. And we can use like wonderful applications like WebGoat or RAM application. Yeah, for that you don't, you don't have to, you can think of this as a module that you can plug into one of those other tools. Like you don't have to develop all that yourself, but you need to get it so that, so that it is very precise by taking into account the HTML part size and the context that the output is used in. Excessive production on the server side and the input on the server side. I can't hear what. Excessive differential on the server side. Yes. So when we look into Java, web-based applications, you do this, so the response is always HTML. Say that again. If you have an STPI with Java-based web applications. Right. So for excesses, you need a response to be always HTML, so that. Yes. So can we go into that direction where the response can be the request is some base advertised for Java-based web applications? Oh, you mean you do it for Java instead of PHP? Yeah. That would be fine. I think it's also more difficult, but maybe. So I think you have less. I mean, you may have to use some like reflection because you need to figure out what are all the parameters that are being sent in for this request. Right. It needs to be very dynamic. Can I use an XPDP solar dispatcher where XPDP solar dispatcher. So when I get a push there, I can push it up and. Yeah, but you can't just filter because you need to see what's being used. Right. If you put it into the database, if it's never used in HTML, you shouldn't filter it. Or you only need to filter it when it's being output. That's the trick there.  Yes, exactly. But yeah, you wanna hook the things that are coming in so that you know what came from the user. And then you also wanna hook the output function so that that way you can properly sanitize anything that needs to be sanitized. That's what I think. Yes, perfect. Cool, all right. Let's get on with it. Okay, so we've got the web and we're learning about the technologies that build out the web, right? So that we can understand the web-based attacks. And so we saw cookies. So if somebody were to fracture our memory, what are cookies, the science-delicious things that we like to eat? Yeah, they're just key value pairs or yeah, they're just data that the server asks our user agent to store. And then every time we make a further request to that website or that domain, we send those cookies back, right? And so we saw that there's actually a lot of different policies that the server can specify. So that the server can specify how long the cookies valid for. And so the user agent, right, the browser is actually responsible for enforcing these policies about expiring cookies and restricting cookies to the proper domains and paths, right? So can the server like force the client to do these things and force it to make sure it expires cookies after a certain amount of time? No, right? So actually the server also has to enforce this policy, right? The server also has to check expiration dates and make sure it's expiring cookies in sessions on its side. Also, the user agent is free to delete cookies at any time, right? They can, the user can at any point just delete all their cookies, right? For maybe space reasons or storage reasons, probably not as relevant nowadays with hundreds of hundreds of gigs of disk space. Or the user decides to clear the cookies. So all of this, the purpose of cookies, right, goes back to sessions. Is the website, the server site code wants to establish some session, right? To understand and talk to the server. So we want some time limited interaction of the user with the web servers so that I can know you're the same user that made this request. And so this is why it has to be implemented at the web application level. So you have to use cookies, use URL parameters or hidden form fields. And the most common way sessions are done is the server generates a unique, or in this case unique specifically means random and unguessable. So unique session ID and sends it to the user agent as a cookie, right? And then on the request, the user agent sends back that random unique session ID and then the server looks up at its database, okay, this is this user, right? So what would happen if I just said, I sent you a cookie that says, hey, your user ID is one. And then when you send it back, I say look that on the database and say, look great, it's user one. Here's all your data. Was that good? So will that work to do sessions? Does it functionally work? It won't work, right? Log in, accept the cookie, I say your user one. Every time you get a cookie, I say, okay, your user one, here's all your user one's information. Right, that'll work. What's the problem there? It'll become a user on the system. Yeah, the cookies live on the browser, right? You could right now go and edit any of your cookies on your browser and you can just say, well, I wanna be user two or user three or user four or any other user on the system, right? Because the server is trusting that you're sending a valid cookie, right? So that's why in order to be really secure, we need these sessions to be random and unguessable. Otherwise you can get that. And what also does this mean about the security of this session cookie? So what happens if I'm, let's say sniffing your web traffic on our local network or on our unencrypted wireless and I see your Facebook cookie. I can store it. Yeah, if I just store that and I make a request to Facebook using that cookie, right? HTTP doesn't know that it's actually not you that's making that request, it's me, right? And so this is why actually HTTPS is so important is because it secures the cookies in transit from your browser to the server. And because cookies are used as session in session. So sessions are key enabling component of web applications, right? If you wanna have sessions, you wanna be able to link different requests together. And so in the early days, in the start of the web, you would write a web application by writing a completely custom web server that would receive HTTP requests and run custom code based on the path, the query data and would ultimately return the dynamic HTML page. Does that sound like something cool that you would want to do every time you wrote a web application? How many people have written a web application? Did you write an entire web server to do that? What was that? There are cases. There are cases? What cases? Who does that? Box. They actually wrote a capital applied system. They ran, or they designed an entire web application of the web server. Yes. You can do that by about, do people do this nowadays to make a real web application, right? I would say no, right? And one of the drawbacks is you have to keep, so you have your application, right? That custom code that you want to be executed, but you also then have to keep your web server component up to date with the latest HTTP changes. And you've seen the HTTP 1.1 spec, right? It is pretty long, yeah, right? So then every time that spec updates, you would have to update your web application, and everybody on the web would have to do that. So basically, as a matter of abstraction or kind of a separation of concerns, right? We say, okay, let's separate the web server into its own component, and that will accept HTTP requests, then it will forward those relevant requests to a web application to further process, right? Now you can upgrade the web server and everything will be great, and the back end web application will be fine. And now you can actually develop a web application, well, without worrying about HTTP is a little bit, without having to parse the HTTP protocol itself, right? You don't have to worry about supporting all of those different 400 error codes and 500 error codes, right? You can just deal with that. So the basic way I think about web applications is we have our client and we have our web server, right? And the client makes some HTTP request to the web server, and then there's some other web application that could be on a separate server, it could be on the same machine, that kind of is not quite as important. Somehow that request is forwarded from the server to the web application. The web application does processing, returns some response back to the web server, which then forwards that response onto the client. Cool. So there are a number of different technologies that have gone into web applications. We're just gonna look at two of them right now, mainly due to time reasons. If we have more time, I talk about CGI web applications and how you could write web applications in any language, and it's just really nice, older standard. So we're first gonna look at active server pages. So ASB, any kind of experience coding in ASB? Nice, okay, cool. So ASB was Microsoft's answer to CGI scripts. They said, man, we need people to be able to write web applications, and we want them to use Microsoft technology to do that. So the first version of ASB was released in 96, which is actually kind of crazy when you think about the web kind of started in 1990, and I have Microsoft creating languages and tool chains for this. And the idea was the program is a mix of text, like the output that you want the HTML, the pages to be of your text, tags, and a scripting directive that says, hey, at this point in the output, interpret this as either visual basic or J script code. And you could also have server site includes like in C, like a pound include. And the idea was that the scripting directives were interpreted and executed at runtime. So when you fetch the page, everything that was not a scripting directed would be output normally, but scripting directives would be executed at runtime.  It's actually still supported a minimum of 10 years from the Windows 8 release date. Actually it's probably ending closer to the end of life. Okay, October, 2026, 2022. Trying to think of, is that a long time away? I don't know, it looks like, the date looks like a long time away, right? But I think it's actually not 26 years away. Yeah, we would talk about that for a bit more time, but. But then what's the acceptance rate of that person? Yeah, I don't know. I think there's probably still a good amount of ASP pages out there. I mean, that's part of the problem with the web, right? It's once you have some kind of technology out there. There's websites that are supporting it and running it, right? So you can't force everyone to upgrade. So let's look at what this looks like. So the basic idea is, we have our server site and our code is in-between these brackets and the percent signs. This tells the ASP engine, hey, at this point evaluate, set string name equal to request.queryStringName. And then if string name is not equal to the empty string, then do this constant text, right? So this is outside of the scripting directive. This is gonna be constant, right? Now we're gonna remember we're inside of an if branch right here, okay? Then we're gonna write out response.writeStringName. So this is gonna write out at this location this string name which came from the queryStringName. And then the else, we have to terminate our if blocks. We have an else statement that said you didn't provide a name. And then we're gonna end our if statement. So what are the benefits here of writing an application in this way? You don't have to write like full HTML code. You don't write full HTML code, what does that mean? I mean, it supports conditional things based on the user input. So you get to provide some logic and logic study. Oh yeah, so you can, I didn't say that you can, this is full-blown DB script, an entire program language. You can do whatever you can do in the normal program language in here, inside these scripting directives. So the full power of language. As to code in, it's, you can access databases, you can do anything you can do with modern ones. It's simpler, it's easier, it's a little easier to understand how to do some of the dynamic HTML generation stuff because it's all in lines. You can see it in a repeat statement, see how it builds out. Right, so you can easily see, well maybe I easily write, but you can see that some of this is gonna be output conditionally depending on the conditions. And you can see the conditions right there. Or some of the downsides. Or MVCs, everything in one page. Yeah, so it's cheating ahead a little bit. But yeah, right, so everything is in one page, right? Do you write? I mean, yes, you can do includes, but, I don't know, when you write a normal, kind of large-ish application, do you put all of your code and everything in one file? Right, you think about, think about Facebook, right? If you have Facebook written like this, right? You have to do things like loop over comments and fetch things from databases and do things and create tables, right? So you're mixing in all of this like logic of the application and what needs to happen and maybe you have some output transformation, like you change people's names or capitalize them or whatever. And it's all mixed in with the output of the HTML of the page, right? So these can, I totally agree this style is a lot easier to get started in and develop things, but it starts to turn into crazy spaghetti code when you have like halfway down your ASP page, you have a database query, which is just like crazy trying to think of everything that happens, right? It's like there's some database query that's happening while you're generating the HTML of the page. But this has some nice things, right? So this request.query string, so what do we think this does just based off the name? Yeah, get the, in the query, right? The URL has key value pairs. So this is getting the value of the key that has the name of name, right? And so this is actually kind of nice. So it's providing a bit of a framework for us, the developer to parse those things and handle all that URL stuff so that we can think of it in a more abstract way. So this is kind of these web application frameworks. So ASP is one example, PHP as we'll see is another example. The basic idea is these frameworks try to make it easier for developers to quickly write web applications, right? Oftentimes what happens when you're writing web application you're doing the same thing over and over, right? You're trying to get a certain value in the URL string. And instead of parsing that string every time yourself of looking for the question mark and then separating that into key value tokens separated by ampersands and then separated by equals, right? You can have the framework actually provide all this functionality. And so they can make it easy to extract input from query parameters, from four parameters. They can actually handle all the cookies for you or say you can have a method called set cookie, right? You don't have to worry that actually this is going to have to set this header in the HTTP response and this header has to have a certain format, right? The framework can take care of that for you. Same thing with sessions. You can, a lot of frameworks will provide the ability to handle sessions transparently for you. Oftentimes security, right? So that's actually part of what you're doing in some of you for the projects, right? Is you're providing kind of a mini framework or library or kind of shim layer to handle security for the developers. Even databases, so some frameworks handle talking to the database and fetching data. So now we get to PHP. PHP is a recursive acronym that stands for PHP, the hypertext preprocessor. So it is very similar to ASP so it's a scripting language that can be embedded in HTML pages to generate dynamic content. It's similar to JSP and ASP. It was originally released in 1995 as a series of CGI scripts that were C minors. So this is kind of important as we're gonna get into, A, we're gonna look at how PHP, like not how, but the fact that PHP is so popular on the web. I'm gonna look at some of the crazy features that PHP has from a security and understanding what the heck is going on in perspective. So it's important to keep this in mind that it was just like a series of C binary applications. And on, in 1988, PHP 3.0 was released. You can think of this as peak PHP 3.0 was installed on approximately 10% of the web servers on the internet in the late 90s. That's 10% of all, would you love it if any software you wrote was on 10% of the web servers on the internet? Yeah, that'd be pretty sweet, right? PHP 4.0 was released in 2000, PHP 5.0 from 2004. Finally added support for objects. So there was no way to do objects in PHP. 5.6 was released in August 2014, which is the latest version. So they've still been trying to develop PHP 6.0. I think they actually moved on to calling it PHP 7.0 since it's been taking so long. So if we look at the popularity, it is actually kind of insane. So from this company NetCraft, which looks at the usage of web application technologies, the number of, let's say, host names that are using PHP, I mean, this is just in 2012. It's like, what, 100 million? And it's actually even above those about halfway through there, so I don't want to think about what number that is. The number of active sites that are using PHP, so PHP is an incredibly popular and used web application technology. It's actually one of those things that it's hard to remember because a lot of times there's a lot more buzz about Ruby on Rails or Django or some of the node.js, web frameworks, all these kinds of things. But it's important to remember that actually PHP is the huge behemoth of the web. There's just so much more software written for the internet, for the web that uses PHP. Okay, so just like ASP, the PHP pages are parsed and interpreted on every page request. So you can run it in CGI mode, so a new copy of the PHP interpreter runs every time a page is requested, or you basically embed the PHP interpreter in the web server so that that way the web server knows to interpret every page, so you don't have all these instances of the PHP interpreter. This is mod PHP for Apache, if you ever set this up and enabled this, this is actually what it's doing. It should sound terrifying, you're putting a PHP interpreter inside your web server, but that's the way we do things. It's a completely new and different language. It's C-like in its syntax, and it's kind of, I like to think of it, it's basically like a language that's custom designed to build web applications. And it's specifically grew organically over time, so they have a lot of weird things, like you think about modern languages, oh, you want a namespace, right? So that functions that you declare, that way if you need to use database functions, you could maybe include the database functions and use those functions. If you don't have that, you just have all the MySQL functions started with MySQL underscore, and I believe the Postgres functions are the same thing, so there's a lot of weird design choices. So I'm looking at a quick example, so just like in ASP, everything that's not inside of a PHP tag is going to be output const, it's going to be just output. So here, all this text is going to be output, everything within the bracket question mark PHP and the question mark end bracket, that's going to be interpreted as PHP code. So this is going to, when this executes, this is going to execute this PHP code, echo means it's going to return that to the browser, and it's going to output startP tag, hello world, endP tag. Questions? So some of the features of PHP is dynamically typed, so this means that you do not have to specify exactly what the types of your variables are. It has string variable substitution, as we'll see, so inside a double quoted string, you can substitute the values of variables at runtime inside that string automatically. Your dynamic includes or requires, so when you include a function, instead of saying include specifically this PHP code, it actually will, that string that you include can be computed at runtime and can be arbitrary. It has super globals, which are so much better than regular global variables. They have variable variables, you can have variables that reference variables variably, as we'll see. It has crazy features like registerGlobals, which will automatically create local variables in the scope of your program with the names of parameters that come from the user. Crazy, all right, so string variable substitution, so here's PHP code, we have the start on our PHP tag, so everything we get here is PHP code, we're going to echo, this is a simple string, then we're going to echo variables inside of a simple string, so the single quotes means it's a simple string, but if we set some variable, so in PHP, variables start with a dollar sign, so that's kind of nice because they're easy to identify. Really, this came from Perl, is that right now? Does that language do this? I feel like this came from somewhere else, but anyways. So you can easily tell variables because they have dollar signs in front of them. And then we can say he drank some dollar sign juice juice, and so because this isn't double quotes, this dollar sign juice in the string is going to be interpreted as substituting in for this juice in here. And we can even have a really complicated thing, we can make an array of juices, and then we can say he drank some dollar sign juices, bracket zero juice, and this will be actually evaluated at runtime. And you can even include the curly braces here to be able to do a substitution based on something complex in here, like any complicated expression that you want. So we're not even out there yet, but some of you have started looking at cross-site scripting vulnerabilities, right? So part of cross-site scripting is when you output something that came from the user. Well here, is it really easy to tell what's being output here? And what's being output here is a constant string, right? But actually at runtime, part of the string is going to be substituted with a value that maybe came from the user or maybe did not. Questions on this? This is kind of an important thing to understand is how PHP, like these are, they're PHP specific features, but they're features that make it easier for the programmer to write programs, right? But then make it more difficult as our job of, but it also makes it easier for the programmers to make security mistakes and have security vulnerabilities. Yeah? Can you explain the last paper in the value basis for example? It allows you to use an arbitrary expression in here. So you can, I think you can, can you do concatenation? I don't know if you look at exactly what it means, but it means that you can use the single quotes here as for this index inside the juices array. The other thing confusing about PHP is it's arrays and dictionaries are basically the same thing. So this is an array at zero is apple, at one is orange, at, no, two there's nothing. The other one is a key Kool-Aid one goes to purple. Is it even, don't you? I have to actually look at it. I don't remember the exact semantics here. I know it's used to do more complicated string variable substitutions. Like you can't just do the single quotes in here because it needs to know that this whole thing is a variable substitution. So this is to say everything within here is a variable substitution. Cool, so we can dynamically include or require other code. So this is from WordPress. So this is from the WordPress page and this is how actually WordPress does things. So it will load the WordPress environment and template. So it calls require. So just like in C, when you include a file in C it's as if that code is just copy and pasted exactly where you used to include. So this is why they're wondered in a C header file you usually have those if not defined tags. That's because when you include a file multiple times that code is just copied in. So if you have one file that ends up including the same file twice you don't want two copies of that code in there. So what's happening is that this code is actually including wp-blog-header.php in whatever the current directory name of underscore underscore file is a special PHP variable that specifies the exact current location of this file. So it's saying wherever the directory of this file is include the thing that's in the same directory as that. So other important things, the dot operator here means strength and patination in PHP not plus like they're used to also frustrates me. So what this means is looking at this do you know exactly which file is going to include? Yeah, it depends on wherever this file is currently in the directory structure, right? So think about like moving a file around you can clearly change what this code does because it could include the wrong file. Then the other thing that what happens here is this requires inside this scope here. So any, it's just like it's copy and pasted in. So any global variables that this wp-blog-header.php file creates, those will be accessible to code after this requires statement. And similarly this wp-blog-header can actually access these variables like this wp-use-themes. This is declaring a global variable called wp-use-themes. So let's look at this example. So it can check if this wp-blog-header is set. It is not set. So this does not exist. It will create this wp-blog-header variable. It will also itself require other files. And then, yeah. I think something to add here. If I remember right, the dollar sign wp-header if you have that in as a header it automatically does on the headers puts them into variables for you. So that's automatically done. There's no like, three string requests. What do you mean in a header? Like, all your header variables I think are automatically done. So your value parameter is the dollar sign. Maybe I'm looking at the price and maybe I'm misrepresenting it. I don't know what header variables are though. That's fine. Like that. So all the things included in the request header are automatically done. Oh, ah, we'll look at that. That's a feature that you can choose to enable or disable. They used to be enabled by people. Yes. So, yeah, you can see this craziness that it's actually like setting up these absolute path variables and wp-include variables to load this template loader library which probably got set by this wp function. So like trying to even understand not only what the code does, like that's one thing. This is like, what code is it actually including so I can understand what this code does, right? Changes and can change at runtime. Okay, some other PhD miss features. Allow URL include is a setting in PHP to allow HTTP and FTP URLs to include functions. So when you set require or include, you can specify a remote HTTP address or FTP address. And then it would at runtime go download and make that HTTP request, get that page and execute that as if it was part of your code. And this setting also enable, you have to enable allow URL F open which allows you call F open, which is file open, with the URL and we'll do the same thing. It will allow you to read URLs as if they were files on the local file system. And so the remote file will be fetched, parsed and executed. So is this a good idea? What could be some problems with this? Anything about the TCP characteristics you can completely control when it's reading? I think about it, right? Even if this URL is hard coded, let's say. If it's an HTTP URL, that's going to some other computer making HTTP requests, if I can hijack that, I can maybe alter the HTTP content that gets sent back, if it's not encrypted. And then that content that gets sent back it's executing it as if it was PHP code. Also, I mean, it's just a completely crazy feature.  If you're including code from some other system that you may not have even written, it's a execute, crazy dangerous, right? I mean, what happens if that, you're increasing the attack surface, right? What happens if that other server gets broken into, right? Now if they change that code, your application is going to start executing it, right? And it's not like this code that just executes on the browser or something. There's something that's executing on your web application that has access by design to all of your user's data. Your web application can access the database because it has to access the database, right? This, now you're pulling in code from who knows where and just executing it. And then, so even if you're not using a constant string, but you happen, if the attacker can influence what you're including, then it can make you include my code and execute it on your server. And I've completely owned your PHP application. So Superglobals, so this is, so yeah, okay. So Superglobals are these dollar sign underscore variables. These like underscore, dollar sign underscore get, dollar sign underscore post, dollar sign underscore server. These are special variables that the PHP interpreter creates for the PHP application based on the HTTP request. And they're, the tricky part is they're accessible by any piece of code that executes in the application. So for instance here, if you try to, in this WP comments post, if the request message is not a post, then it's gonna tell you, hey, I only allow post. And the HTTP response code is gonna be 405. And it's gonna quit and exit and stop processing. Otherwise it sets up this variable comment post ID if this dollar sign underscore post, so this is a comment post ID and the key values that was sent through post. It will interpret that as an integer if it's set, otherwise it'll set it to zero. It's gonna get the post based on that. It's gonna check if the comment status of that post is empty, then it's gonna do some action and this is some callback that's gonna do, who knows what, because WordPress is very strange. It's supposed to be very extensible. So anyway, so this is showing that these super globals can be accessed from anywhere. These dollar sign underscore server, dollar sign underscore post. They have variable variables, which are something that, I honestly don't know of any other results on that kind that allow this. The idea is on this line I'm creating a new variable called a that has the value hello. On this, now here, the dollar sign dollar sign means I'm now creating a variable with the name of whatever's in dollar sign a. So this is creating a new variable dollar sign hello with the value world. So I can echo a and echo hello and it's gonna output hello world. So this is just like automatically creating a variable in this scope. It's crazy. That seems super weird. Why, why, why, why do you want this? And then you can access this also in the double coded strings by using a dollar sign and then curly braces and then dollar sign a. So this will, again, look up the variable name with something with a, look it up as a variable, what has the name hello and then output, yeah. It's kind of trying to do like the, make it easier to do the equivalent of eval and javascript or something. It's like we're trying to come up with a way to make it easier. This is a terrible idea. Even Python allows something similar. Yes, but you have to, at least in Python, it's clear that you're doing something weird, right? You have to look up in like global or locals or something and you can look through values and you can do it that way. But I believe all of those start with underscores, right? So that's like implicitly means that that is kind of unsupported. You're digging into the guts of Python here. This is just PHP. Like this is just $2 sign, so like this is how we roll with PHP. Yes, I'm sure it was to more expressivity and that kind of stuff. I'm sure you can, I'm sure you can do really cool things with this very distinctly that you could maybe not do in other languages as easily. It's still, it makes like trying to understand what this does if you see this in an application. You have to understand what could all the possible values be for variable A, right? And if variable A ever comes from the user, then we can control any other value and change their value in the program. So, gosh, it's crazy. Okay, then we get into registered locals. So, the idea was, well, man, it's really annoying to have to, whenever I wanna access a variable, I have to access like dollar signers for post, bracket, tick variable name, right? It's like, God, we're gonna be so much better if PHP just automatically created variables based on those names that get sent in. And so, it would register all environment variables, get variables, post variables, cookie variables, and server variables as global variables in the scope of your program. So, think about what's happening is PHP is automatically injecting variables into your script and the scope of your script based on input from the HTTP request. So, the HTTP request, so the variable name, so the HTTP request variable name, right, the key value pairs, is the PHP variable name and the value is the PHP variable's value, right? So, where do the values come from? From the user, which is also from the attacker, which means that these can be arbitrarily changed and altered. This was actually the default until 2002 for a long time, this was the default of PHP. And so, honestly, when we look at it, it actually does make the code, I'll definitely give this, it makes the code a little bit easier to read. So, for instance, let's say I have this feedback page here. So, I have some feedback code and I say if there's a name and if name and comment, then I'm gonna open this user feedback file with append only. I'm gonna write out name colon comment and then I'm gonna close that file. And then I'm gonna say, hey, good job, you submitted the feedback. Right, and so in my post method, I'm gonna have a form on here with a post with a name and a comment field and a submit button. So now when I submit this, right, it's gonna go here and it's gonna automatically create a name variable in a variable called dollarsignname in this scope based on whatever the value is here. And it's gonna automatically create a variable comment in here based on this value that I typed in here. So actually, this does make it, I mean, actually makes it a lot easier to read. So we'll actually see in a bit later why this is such a bad idea. Okay, so we talked about, so these are kind of some of the PHP miss features or I'd say features that are probably not exactly what you're used to when you look at project language. So we've talked about those. We talked about sessions, right? We want sessions with the user so we can see what they done. But is that all we want? I mean, do we just wanna know that you were the same person as five minutes ago? Right, we also wanna know are you the same person from a year ago, from two years ago? Right, so what we really need is some way to store the state of the application. Right, we want our users to be able to interact with our application. We want them to be able to save data information, whatever, and we need to be able to store that. Otherwise, it's really difficult to make a real application, right? Because we have this cooking mechanism, but cookies are fundamentally limited in how much data they can store. I guess not fundamentally. The browser will limit the size of the cookies, right?  Here's all, you know, two gigs of text or whatever. Like just store this and send this to me every time you wanna take a request, make a request. Right, so where can we store the state? What are some of the options that we have? Maybe store it in the database and have some unique key that can be used as an identifier. We can store it in the database, what else? In a database, where else? But the only place we can ever store things in. File system, yeah, we can store it in files, right? Actually get away with a lot with that. What else? Memory, yeah, we can store things in memory, right? So you can store things in memory. We can store things on the file system. The file system could be just a file system. It could be an XML file. Maybe we store things in an XML file. We could use a database, right? And so the database is the most common, so why? More structured and easier to access. So structured, easy to access, easier than a file, though? It's pretty easy to open a file, right? Or controls around it, what else? Indexing. Just adding your section up there also might be good for that application. Yeah, right, so one of the problems with memory is if I wanna have multiple web applications, multiple copies of my server, they would need to somehow synchronize all their memory so that the state was consistent across all of them, right? But if I have a single database that multiple applications can access, well then, multiple copies of the application, then it doesn't matter which server fields that request, they should pull the information from the database. Yeah, there's also a whole host of other databases or a whole other area of research, right? There's a lot of research into making them safe and consistent and fast and so that they don't lose information, right? Whereas if you do something in a flat file, you may have multiple concurrent requests that overwrite things, right? You basically are implementing a forward version of a database yourself, right? So yeah, you get ACID compliance, which is great, right? Ooh, so what does ACID stand for? Atomicity. Atomicity. How's that work? Consistency, integrity, and durability, good. Awesome, you also get concurrency, right? There's also great separation of concerns, right? So now you can write your application, the database can be a completely different technology, right? And maybe you can swap them out and you can run the database on different server, right? You can have multiple web application processes connecting to the same database. What are some of the cons in which sense? What sense? Do you have to have a database application running?  You actually have to know a lot about indexes and all of those things, right, about how to optimize the database. Also, it's very hard to change tuples. I mean, the format that you've sorted in, it's not essentially backward compatible if you choose. Yeah, so it actually makes, so one of actually the very kind of finding things is that it makes, so updating your application, right? You wanna add some new code or do something. Well, you may need to change some column in your database, right, with an update. But let's say you make that update, but now you need to roll that back because that introduced more bugs, right? So now you then remove that column. It's not as easy to update and change a database over time as it is to just change the application's code. How do you query databases, normal databases? SQL. So now you have to know another language, not only do you have to know and understand HTML, HTTP. We didn't talk about JavaScript yet, but JavaScript, you need to know your server-side language like PHP and now you also need to know SQL, right? Everything's starting to get crazy. So the classic kind of way this was done is what they call a length stack. So Linux, Apache, MySQL, and PHP. So you have Linux as the server, you have Apache as the web server, MySQL as the database, and PHP as the server-side code. And it's kind of a nice way to think about separating applications into these four pieces because you can easily swap out and mix any of these components, right? You can run this on Windows and then it's like a WAMP server. You can swap out Apache for Nginx or one of the newer web servers. You can swap out MySQL for Postgres and you can swap out PHP for also any other kind of language. So yeah, you can completely change all of these things. So MySQL is currently the second most used open source relational database. So what is the first? Postgres? No. What was it? OracleDB, no, also not open source. Definitely also no. SQL server, no, also not open source. SQL light. SQL light, yes, why SQL light? I don't know, I just guess. Not only Android, also iOS, yeah, every single one of our phones is running SQL light. It's used not only in iOS and Android, it's also probably gonna be used on the Mac in certain places too. So yeah, it's actually really interesting. That's the most widely used database technology. Why do you have MySQL on the slide over that? Oh, because MySQL is used more in, so SQL light's really good for like an in memory. So you get the properties of database. You can also use it to like go to a file. So it's easy to use in simple scenarios, but it doesn't scale really well to like a complicated, multi-process type of thing. So MySQL is much more used and more frequently used in like a real web application sense. Not many people use SQL light for a web application, but SQL light's also really well tested so it's very, very durable. So MySQL was first released in May of 1995. Actually a really crazy coincidence is this is the same day that Sun released the first version of Java, which is kind of crazy. But yeah, and it's also weird because Sun eventually bought MySQL for a billion dollars in 2008. So yeah, anyways, I don't know. That coincidence just is super weird. But also really cool. Okay, so when we come back, we will talk. So now we've got all the web technologies break and we need to store our state somewhere. So now we're gonna talk about databases. So you can see that web applications are crazy complex mostly because of all the different technologies.


Welcome to the weather forecast for the week beginning, Wednesday, January 18th, 2023. I'm Chief Meteorologist John Insworth at Longmont Public Media. We have a new moon, Saturday the 21st, sorry, nothing to see, but there's a lot to see on the sun. If you're interested, there's a ton of sunspot activity going on. Looking at drought, not much changed last week to this week, a little worsening down here in the south and over here at the Kansas border, but a large portion of Colorado is now drought-free. Going nationally, a lot of drought relief in the west, really it's only this little patch out here in the Great Plains, southern Great Plains that has a large-scale problem going on. If you look at our snowpack animation, it's the best I can do that. This is the current, you can see we're heading way up into the positive territory, we're way above average, 134%. And that's even better now that we've gotten some more snow. So up to 7 a.m. Wednesday, it's 7 o'clock is the official observation time and so the storm continued beyond this, so I'll have to take a look at today's data in just a moment. About 5 inches around Longmont, about 4 or 5 inches bolder, a little less up in the mountains, and then another inch or so, inch and a half inch, came in the next day. Looking at Denver, it is near the airport, got about 6.8, taking a look at the official Denver storm total is 9.2 inches, so I definitely picked up a few more inches. Then the next day, up in Fort Collins, they got about an inch more the next morning, but you can see totals just to the west of the city, 5, 6, 7 inches in town, 4.5 or so, and lots of good moisture with that. It's just fantastic stuff. Okay, take a look at the severe weather, that storm is kicking off some severe weather in the south as it moves. Then the bulk of the energy goes up into Canada, a little teeny area there, and then off and away. Looking at Wednesday, we had the wraparound snow, a break between storms, and another one that comes in that you might see a little bit of snow around Longmont and Denver, but this one's going further south, and this is going to help put a little moisture down in those southern counties of Nisto. Looking to talk about with smoke, normal is 44, for high and 17 for low, and we are hugging the low end of that normal range with Friday showers, Sunday, Monday showers, and unsettled weather going into next week, so we're going to stay cold and have repeated chances of snow. On Wednesday, we had the storm wrapping around and heading out, looking at highlights into the future. For the upper air pattern, looking at Saturday morning, Friday night, there's that low passing kind of to our south, and there's the best closest snow to Longmont, still could get some up there. Sunday night in the Monday, we have another trough coming in, and some snow for the northern part of the state. And Tuesday, we have a little ripple coming behind a sharp trough, and some snow again. Some models have that Sunday, Monday storm a little bit more serious, and so I have a higher percent, I could be in trouble on that one, but we'll get to that in a second. So you can see that there's a ridge off the west coast, this is turning off that continuous shot of massive storms in California giving them a break. Northern west coast, Oregon, and Washington state are going to keep getting stuff, but we are just seeing north winds keeping us cold, and trough after trough coming through this northwest flow. Just little ripples like that one right there, could kick off a brief snowstorm. Yep, looking at temperatures. The west stays kind of mild, this is more Pacific air, and this is not coming from northern Canada or the pole as much as it's coming off of the ocean. You can see it's chilly, definitely cooler than normal in the west, this is up to Monday now, and lots of heat out east, cold fronts are pushing into Texas and trying to get into the Ohio valley and like that, and then we warm up and a real cold shot comes down, but largely it's going to graze us, we're going to back to our cold front out of that, but it's not a direct hit of the coldest possible air by next weekend, but it does hit about two thirds of the nation, east of us. There goes the storm from Wednesday, Tuesday, here comes the Friday storm, digging south, it's definitely giving Kansas some snow and moisture, here comes our Sunday Monday storm that could be bigger, I'm kind of suspecting it will be, but it's not in the models, all the models, yeah, the GFS doesn't see it. Alright, taking a look at precipitation over the next five days, we do have some moisture coming in, this is less than an inch of snow or an inch of snow around Boulder, so whatever happens on a weekend Friday, going into the weekend is not much, over the next ten days it's about a quarter of an inch of liquid, and so you've got, you're in the three inch, four inch area, going ten days out, so with the cold temperatures, the snow that's there isn't going to go far, so on there the cold temperature is 28, 30, it's 20, it's 30, right around 30, we just don't leave that cold regime with that northwest, the north flow, maybe overdoing this with Sunday Monday snow, but we could have an impact on the Monday morning commute if the more snowy models verify. Taking a look at precipitation, just nationwide for fun, do some bonus here at the end, over the last seven days the West Coast got hit a lot again, ten, fifteen inches plus, twenty inches in small spots, over the next ten days you can see southern California gets a break, but the northern West Coast and northern California still has it coming in, Rage is still going to send the storms their way and the southeast gets a lot of precipitation as well, over the last ninety days you can see places on the West Coast have received forty to fifty inches of water, that's amazing, that's just colossal, and taking a look in the future, there finally looks like the La Nina that we've had for a few years is shutting off and we're switching over to an El Nino pattern by next Christmas, as it sets in, the week episodes of El Nino typically make the West warm, or at least neutral, but cold on the east side of the Rockies, if it gets to become a strong episode, you get so cold, unusually cold here, for all the different periods of time, November to January, December to February, it's a winter impact thing, working in precipitation, on week episodes we kind of stay neutral, a little wet on the west, bringing slopes, and for moderately strong episodes, the winter months are still kind of neutral here as well, so we'll see what happens from that, Longmont leader or Brunfield leader has frequent weather updates and local news, this has been chief meteorologist John Insworth, keep looking up.


My Spanish speaking friends, she was like, she was, she was like, it's not that hard. You just like memorize some exceptions. A lot of it is an understanding of how to learn a language. Like one of the things that's great about great, but about Chinese is that the grammar doesn't follow what you would use in a romance language, right? And so when you learn it, or at least when you understand it, you can't really translate it word for word. So you don't. You just know what phrases refer to, like, well, yeah, I like, I want it different. And the grammar in English is very simple. There's so many more cases, even in Spanish. Russian has like dozens of cases for words. Well, the biggest thing that slipped me up in Spanish was gender. Right. Yeah. We don't have to do that. Oh, I think English pronunciation can be difficult, but English grammar probably is easier, I would guess. There's gender. There's also, you know, being polite versus talking to your friend in many languages. It's like, it's really rude to say it in a, in a, in a, yeah, and to and all that. All that's just impolite to everybody. Yeah.  Actually, we got rid of the informal one, didn't we? We kept the polite one. Uh, are, are you, are all y'all ready? Are all y'all ready to do the show? Yes, I already are. Already. I already cat. Okay. Here we go. Sarah with the read in three, two. Brian S. Richard has supported independent tech news directly for about a day. You want to be like Brian, become a DTS member at patreon.com slash DTNS. This is the Daily Tech news for Thursday, May 23rd, 2019 in Los Angeles. I'm Tom Merritt. And from Studio Feline, I'm Sarah Lane. And from the pod feed podcast, I'm Allison Sheridan. And I'm the show's producer, Roger Chang. We are going to talk about Tesla. We're going to talk about gender bias in your voice assistant. We're going to talk a little bit about a lot of things, including rotten tomatoes, changing how they display some ratings, which means I'll disclose that my wife works for Rotten Tomatoes. It's going to be a jam-packed show, folks. Let's start with a few tech things you should know. The world's largest contract rather chipmaker, TSMC, said that shipments to Huawei would not be affected by U.S. restrictions for the time being. TSMC spokesperson Elizabeth Sun said that the company is assessing the impact of the U.S. restrictions. Lenovo reported a tripling of quarterly profit on strong PC sales. The company said most of its products are unaffected by tariffs, but CEO Yang Wang King said it has contingency plans to shift production to its centers outside of China, such as India, Mexico, Hungary, Brazil, and the United States. PC and smart devices revenue grew 10% on 9% growth in shipments, and mobile lost money despite revenue growing 37%. PC outgrowing mobile. It's the top-secretary world. Walmart began selling its own 8 and 10.1-inch Android tablets under the on-brand, so they can stay on-brand. It's got two ads, O&N. Has a 1280 by 800 IPS display, 2 gigabytes of RAM, 16 gigabytes of storage. Runs Google's Android Pie, and the 8-inch model costs just 64 bucks, 10.1 inch, 79. But those are amazing. Bloomberg says it obtained internal documents showing that Amazon is working on a wearable designed to detect a user's emotional state based on the sound of their voice. Amazon patented a system back in 2017 to determine emotional state by vocal analysis and offer suggestions. The wristband, which is code named Dylan, uses that system. Dylan would pair with a smartphone app and eventually tailor responses based on our emotional states. A beta test is underway, but it's only experimental at this stage. I'm sorry, but I just picture it saying, Allison, you're getting too emotional, and then I break it with a hammer. Your TSMC hammer. Software developer Panic unveiled a handheld 74 by 76 by 9 millimeter gaming device called Playmate.  Instead of game cartridges, Playmate comes with a series of 12 titles released over time with new titles unlocked each week, starting with Crankin's Time Travel Adventure. The Playmate should ship in early 2020 for 149 bucks with pre-orders available later this year. All right. It's horrible. I always loved Panic's FTP program. Yeah. So how about that? Oh, look at that. All right. Let's talk a little bit about where Google Duplex is these days, as far as how many humans are not only using it, but being the Duplex voice. Sarah? Well, Google says that about a quarter of calls that are made with a Google Duplex system start with a human rather than the AI that the system usually relies on. Now you might say, well, why is that happening? Google says this happens when the system is unsure if the business being called actually takes reservations or if the user of Duplex is suspected to be a spammer. Google also says about 15% of calls that begin with AI will need a human to intervene at some point. Google uses data from the human-made calls to train its AI. Yeah. This is in response to a New York Times story that was kind of calling them out like, ah, we were getting this, this person that said they were a human. Were they really? Well, yeah, it turns out they were. And Google is like, yeah, we do this because we're trying to make Duplex better and we want to make sure that it doesn't cause undue confusion on the side of the restaurants. This story confuses me, though. This is saying before they call, they already know that they're not going to use the AI to make the call. So how do they know that the user is suspected to be a spammer if they haven't called yet? I'm going to guess. I'm guessing that certain businesses that are listed that the Duplex user says, yeah, use Duplex to make my reservation. Google probably has an index that says, are we sure they take reservations? Right? Either by knowing, OK, they've got an open table link. OK, totally know that. Or it says very clearly on their website for reservations call, et cetera. But if it's unclear, they may kick it to a human because that is a more complex negotiation if they're like, oh, we don't take reservations and they say, OK, I'm really sorry. We'll note that, add it to the database, et cetera. That seems to be what they're saying. OK. What's interesting to me is, OK, if we're saying 25% of those calls end up having to be made by a human because the system is just a little luncher and doesn't want to get it wrong. So how many calls are made per day, meaning how many humans need to be on hand to be there and step in? That's my question. Because we don't really know that Duplex is in early stages. Yeah, I mean, I'm guessing they probably don't have that high of usage. But it's like, is it like five people sitting around an office being like, ah, Duplex being weird, let me call the restaurant.  Again, I'm going to guess it's a call center of some size, whether it's huge, I don't know. But yeah, I'm guessing they have some people dedicated to this. Maybe they I'd be curious to know if there are people dedicated or if these are people who are also customer service for other things. And then they just get routed to Duplex call every once in a while like, oh, OK, I got to make a Duplex call. Here we go. That would make the most sense. Yeah. I do think it's interesting that, you know, in this world where we sort of fear AI taking over every time we see it used practically, it needs help. It can't do everything that people are afraid it can do. Yeah, we're afraid of Duplex. Look, Duplex doesn't even work. Rotten Tomatoes is changing how it calculates its audience scores. These are the ones with the popcorn icons next to them, not the rotten or fresh tomato scores based on critics reviews. Those are the famous ones you see advertised in movies and everything. That's a whole different thing. If you go to Rotten Tomatoes dot com and you look, you'll see a little popcorn score. That's the audience score. That's what they estimate the audience thinks versus the critics. Well, recently, the company stopped user reviews from being posted until after the movie premiered because people were bombing movies they didn't like or because they wanted to make a political statement of some sort. So they said, well, we're going to make it so that until the movies out and the general populace can see it, we're not going to allow reviews to go up. However, they went a step further today. Now, when you leave a review, it will ask you if you want to verify that you've seen the movie. If you're verified, you'll count toward the audience score. If you're not verified, you can still leave your review, but it'll just get lost in the list of reviews. It will not count towards that audience score. At the moment, the only way to get verified, though, is to buy a ticket through Fandango. Fandango is owned by Fandango, which also owns Rotten Tomatoes. They're all part of one company with movie clips as well. And that is majority owned by Comcast. So if you buy through Fandango, then you can verify your Rotten Tomatoes review. Rotten Tomatoes says it's working with AMC, Regal and Cinemark to verify purchases direct from those theater chains later this year. They're working on some ways to make sure that if you are part of a group and you didn't buy the ticket yourself, you'll be able to verify your review. But that's forthcoming. Right now, it's only the purchaser of a ticket on Fandango that can leave the verified review. Well, there have been enough gaming of systems that you mentioned, Tom, that I can see why this is moving in the right direction. It sounds somewhat convoluted. But yeah, if you're if I am hell bent on leaving a bad review and I have to go through a couple more hoops, then I probably will because I really want my review to count. If I if I feel that passionate about movie in a good or a bad way, I would want it to count. But yeah, the being open it up to more movie chains would make more sense. Yeah. And Laura Roman asked a good question. How about outside the United States? Fandango operates in multiple countries that operate outside of the United States, but it doesn't operate in all countries. So if you're in a country where Fandango doesn't sell tickets, then, you know, if you're outside of Brazil, they operate in Brazil, but maybe they don't operate in Colombia. And if you're in Colombia, it's like, wait, I want to leave a verified review. Well, you can't yet. I haven't figured that part out yet either. I never noticed there was anything but the tomatoes. I never noticed the popcorn. No, look for it. Yeah, I I can't. Well, sometimes they vary somewhat wildly. Yeah. So I usually just stick with the critics. And I think most people do. There's a lot of the the same sorts of things that are happening everywhere on the internet where, you know, people try to hijack a system to make a point. Rotten Tomatoes is trying to combat that. And as I mentioned earlier, I have health care thanks to Rotten Tomatoes, because that's where my wife works. I've got good news for everybody. Ad tracking, not always evil. Yay, we can just go home now. No, ad attribution looks at something called conversion, which is the data around ads being clicked and leading to purchases. Something companies need to know to better spend their ad dollars. But of course, once they're tracking you, then they'll want to know everything about you that they can possibly get and they can't. Apple's developing something called Privacy Preserving Ad Click Attribution, rolls right off the tongue to solve this. The system limits the number of campaign ideas that makes it harder to track individuals. Only the website where the ad was clicked can measure those clicks. That cuts out third party tracking. The browser will occasionally delay sending the conversion data for up to two days to keep it from being associated with other browsing data. And then this is all done at the browser level to limit what data the ad networks and merchants can even access at the beginning. The system is available in a preview release, and Apple is proposing it as a web standard through the W3C web platform incubator community group. You know, Sarah, this really confused me. And I'm going to have to ask Barbara Schatz, who explains everything security-wise to me what the distinction is here. But in Apple's Safari user guide, they say, if you select prevent cross-site tracking in preferences and privacy, they say, and I'm quoting, unless you visit and interact with a third party content provider as a first party website, their cookies and website data are deleted. So what is this for if I can already check that box and none of this ever happens in the first place? Not everybody checks that box. OK, but why did they have to come out? So that with this privacy preserving ad click attribution is part of the WebKit consortium thing that they are part of that the open source and all that. I just I don't understand what it is. They already had this. Well, this is. But right now it's a standard, not like this would be default. Yeah, this would be whether you've decided to check that tick box or not. This is going to happen and it's going to prevent that from happening. And the reason they haven't made a default is they don't want to have that backlash against advertisers. So there it sounds like their solution is let's create a way where the advertisers can get that conversion rate tract that they need. Everybody agrees they need without violating privacy. And then we can protect the privacy of more users that way. OK. And it would apply to more than Apple if anybody more than Apple was using WebKit. Yes. And that's why they're submitting it to the W3C to try to get other it up. Yeah, other browser makers on board. Please do still ask Bart about it, though, because I'm reading what he says as well. Right. A report from the United Nations Educational, Scientific and Cultural Organizations says people will speak to voice assistant machines more than their partners within the next five years. The report is titled I'd blush if I could closing gender divides and digital skills through education. This report alleges that Amazon and Apple's voice assistants fuel gender stereotypes. Female voices are used preferentially in household devices versus navigation in vehicle devices, which tend to be male voices. The study recommends not making assistants female by default and to use the assistance responses to discourage abusive language. The study notes that the percentage of computer and information science majors in the US has dropped from 37 percent to 18 percent in the last 30 years and calls for more women in technology development roles to help avoid this kind of bias. Now, I thought this was was a fascinating study. One of the things they showed they've got a little chart in the article at CBS News that shows the responses of the four different assistants to abusive languages. And it was really abusive language, I should say. It was really interesting to me how submissive Siri was.  Well, I would never teach my daughter to respond that way. Right.  But the Google assistant would at least say things like, I don't understand when it was being somebody who's being obnoxious, which is what Amazon's assistant usually does to me when I'm being. I'm not trying to be obnoxious, but sometimes I'm frustrated and she'll just kind of sit me down. I it's funny. I agree with a lot of what you just laid out, Allison. And there's interesting conundrums and some some some some thoughts that I have on this, they go at a deeper level. But I will say that because I do you Siri quite often, I have for a long time and especially when I'm mobile, that's just that's my AI of choice. I did switch to a male voice just for fun, just to like do something different. And it just really bothered me and I couldn't deal with it. And I don't think it was because it was a male voice. It was because I just didn't want change. I liked things the old way. I had become familiar with her cadence and the way that she did things. No, there might be more to that. And I didn't really think about it that much until we started talking about this. But I do think that there's a lot of gender bias and so many times we are unaware of it and that's for everybody. Yeah, I think the this article in particular was not or this story was not so much about how often we say I'm not talking to you Siri or Amazon or whoever. It was more about like actual abusive things. You know, if you say you're hot to Siri, she'll say, oh, how can you tell? Where, you know, Google Assistant will kind of dodge it and say, some of my data centers run as hot as 95 degrees Fahrenheit. There are more profane examples in the article. And that's where Google Assistant just goes, my apologies. I don't understand where Siri's over there saying, oh, I could blush. And Alexis says, well, thanks for the feedback. You know, that is weird. I don't know. I have trouble envisioning a team of women writing that response and choosing that as what we would have written. I think there's a reasonable chance the researchers are correct. And if there was a higher percentage of women working on the programming of the of the responses, you might not get that same kind of response. I have the male voice set for Siri. And so I'm going to try something real quick here, because I've never done this before. Are you going to be profane? Hey, Siri. You're hot. Ah, ha, different response. Now, I don't know if this study has an exhaustive list of the responses, but that does seem to be a more male centric response. I'm just well put together. He's very well put together is is definitely a phrase I could hear. So that's interesting. Yeah, you're right. The responses do change. Maybe they pulled out the most subservient ones. That's possible. They also said that in in Europe, they tend to use male voices more because they have a history of male domestic servants in upper class families. That starts to feel like, well, then every response is bad of a distance. And I'm not sure that those countries have more of a tradition of that.  I thought it had the female voice by default. So I don't know. And a lot of this is it's it's it's it is an evolution of the conversation of when a company might introduce, you know, a chatbot is a little bit more modern, but some sort of helper, helper assistant, you know, and and you kind of get these female names over and over, you know, and after a while, people are like, well, hold on. I mean, you know, why is the assistant always a woman? And and I think that that introduced a really interesting conversation, but we're still having it because as as as this AI becomes more and more robust. Yeah. If your assistants have different answers for some sort of a cheeky question or or worse, why? Yeah. So I think this gets back to the general diversity thing. We've talked a lot about Google having problems with what their AI recognizes as an African American, for example. And if they had a diverse workforce, maybe those mistakes wouldn't have happened. I think this might fit into that same category. And it just keeps coming back to we got to get more girls in attack. Yeah. And there's there's I just did a Tech Republic top five on on ways to improve recruitment of women in IT. And it was based on an article that was written by a couple of women at Tech Republic based on some actual research out there. So you can go check that out at techrepublic.com. That that is going to help. I mean, I look at this too and I wonder, why isn't there a gender neutral voice that I could choose? Why does it always have to be male or female? Yeah. And that is possible to create. So there's yeah, there's all kinds of questions about how this sort of thing reflects our gender roles. I don't think it's as I don't think it's, you know, dangerous to society, but something important to think about. And another example, like you say, Allison, of of where a more diverse workforce would would help us have better products. Side note, John Flowers wrote in not even related to this, but I think it's a wider version of the same talk telling us about a talk he heard from Karen Bartelsen, past president of the IEEE speaking about ethical design. He says after her talk, he asked her if people should feel bad for yelling at their Amazon Echo or Google Home. She said that yes, some people treat their home devices like pets and don't like it when people yell at their pet. I continued the question with if we have affection for our devices, we won't be willing to put them in places of danger like firefighting and chemical spills. And she said that this is definitely why we have to be careful giving too much effective behavior affect as an emotion to robots we need to not care about. But that may change as robots eventually achieve sentience. Googly eyes. That's what I was going to say. So cute. Won't do anything. What are you going to do? Reprimandum? Well, folks, if you want to get all the tech headlines each day at about five minutes, be sure to subscribe to dailytechheadlines.com. Today in an email to employees obtained by Reuters and actually it's easily obtainable everywhere across the internet right now. Tesla CEO Elon Musk said the company is on track to deliver a record number of cars to customers in Q2. Previous high mark was ninety thousand seven hundred delivered in Q4. Then they had a drop off in Q1. And the company says it has 50,000 new orders as of Tuesday. Of course, this leak, if you can even call it a leak, when it was spread as far and wide as it was happens a day after Consumer Reports described Tesla's new lane change assistant function as like monitoring a kid behind the wheel for the very first time. We talked about that on the show yesterday. Well, we got an email from a Tesla driver, Craig, who says as an owner of a twenty seventeen Tesla Model S, I'm not quite sure where Consumer Reports is making their observation. Autopilot is a huge stress reliever as someone that drives very long distances almost every day. The system lets you know well in advance of any lane changes and is fully customizable from mild all the way to a Scott Johnson Mad Max level of lane changes. No, seriously, it has Mad Max and it has Elon has suggested even adding an LA mode. The system used to be like a seventeen year old driver, but now is solid and a joy to use on the highway. Anyway, just a thought from a fan in Orlando, Craig. Well, thank you, Craig. We also have another brand new newly minted Tesla driver with us. Allison, you sent us a video of the lane changes that your Tesla does. How do you feel about all this? Well, I think I might know what they're talking about. Now, I haven't done there's like twenty eight different kinds of autopilot. He kind of features in the Tesla.  You could choose to be accurate about which one you're talking about. The one I have experience with is where you're in autopilot mode and so it's steering and it's staying within the lanes and it's slowing and stopping depending on traffic, if you turn on your turn signal, the it has solid blue line showing you the lanes that things that can see you turn on your turn signal. The lane you're trying to turn into turns into a dashed line. If there is a car or anything impeding you changing lanes, it will turn red dashed. Then when the traffic clears, it will move out and it will turn blue dashed. It moves out. And then once you get into another lane, now it's all solid blue. So that's not completely the total autopilot drive navigate me from here to their mode. But what I noticed in some cases, we put it, turn on the turn signal. It waits till the car goes by and then it smoothly moves out very graciously. But I was driving in some pretty heavy LA traffic and it was it did jerk face mode where it could make it because it accelerates zero to sixty in three point two seconds. It's a bullet. It could accelerate enough to not slow the guy down behind me. But I never would have pulled in front of that guy. And I realized one of the things I think it can never understand is how long have you been waiting to change lanes and how long is it going to be?  You would make the turn that it did. But I could see that there was plenty of space behind that guy. I would have let him go and go after him. So I wonder whether they ended up in a bunch of situations where it did what it could safely do. Yeah, without the context of being gracious to your fellow drivers or the fact that everyone's been cutting you off and you've got to get over a lane or something. Yeah.  That's I'm kind of wondering whether that might be part of it because in two very different circumstances, it was a jerk in one and not in another. Yeah, but there this may just be an example of the difference between what objectively is safe and what we psychologically considered to be polite driving. Yeah, well, I didn't feel it safe, but it was like, OK. Yeah, I've I've been accused of being an overly defensive driver, so whatever. That's just I like safety. But what if the the person or the team over at Consumer Reports with their model, you know, going through those tests had a certain way that they feel about how one should drive their own emotions? Yeah. Yeah. All over again. Yeah, it might be part of that. The other thing I wanted to comment on, though, was this this high mark they're saying they're expecting, or at least Elon Musk is saying that he expects they're going to deliver a record number. Remember they the federal and state tax rebates are being diminished for Tessels because they have shipped so many cars. Once it gets passed, I think it's 200,000 200,000 cars, a given manufacturer, they start phasing out those tax rebates. So it was seventy five hundred dollars last year at the end of the year. It dropped to thirty seven fifty by June. It's going to cut in half again, which is one of the reasons I bought in April. So that might be causing another acceleration of of the of the purchases. Yeah, and that isn't necessarily mean like these these numbers are bad or something, but it's like if this is the thing that's driving it may maybe that drives Tesla to enough of a scale that it can continue to sell them at higher numbers, even when it loses the subsidy. If enough people have them and the prices can come down because they're manufacturing more of them, problem for Tesla up till now has been they can't make as many as people are interested in. And so that that really is what they need to fix. And it seems like this memo is saying they're fixing it. Yeah, it did take me three weeks to get my car, but it was kind of a special order. It wasn't one that was in inventory. There it is possible to get cars in inventory much more quickly. I found the overall buying experience to be really, really frustrating. You got a website and you go on there and you put some stuff in and then nobody will talk to you until you have a delivery date. They won't have any conversations. Nope, don't know anything. No idea. Nope, nope, nope. They said it'd be two weeks for my car. It was almost three weeks. Nope, can't talk to you. Don't know anything. Nope. And and you can and they tell you to download the app, but there's nothing in the app but a picture of the car you don't yet have 15 minutes before your delivery. All of a sudden, there's this flood of wonderful information. Here's how you can learn about your car and what you can do and blah, blah, blah. So it's really fun. But that time from when you place the order until you have a delivery date is really frustrating. How like a tech company? Also between Mad Max and Insanity Mode. I mean, yeah, are you doing yourself any favors about people, you know, buying into the idea that all this Tesla AI is really, really safe. Yeah. You know, that is very interesting. You know, it does make a lot of Steve put it really well. When we were driving back from Fresno on a long trip, he said that having the self driving in the lanes allowed him to pay attention to big picture stuff more than am I driving between the lanes? So he never felt like he had any ability to stop paying attention. That was not on the playing field at all. But he wasn't looking at the lanes. He was looking at situational awareness of vehicles coming up on his left, or maybe there's a tire, a piece of a tire in the road in front of him. He was paying attention to those things instead of concentrating on steering. So I think it made him a little safer. But it just doesn't feel that close to self driving to us yet. Well, thanks to everybody who participates in our subreddit. You can submit stories and vote on others. DailyTechNewShow.Reddit.com. If you hang out on Facebook, Facebook.com slash groups slash Daily Tech New Show is your new favorite group.  It is speaking of googly eyes. We got a couple of good emails about this. Jeff wrote in and said, just listen to today's show. He's talking about yesterday's show. Wanted to share my Marty the Robot experience. And he had he had sent a couple of pictures that I wish I had a better picture show in the googly eyes. But my 18 month old son, Caden, loves Marty. Every time we shop at Giant, we have to track him down and say hello. Marty has sensors that check the floors for spills and messes, alert staff by paging them to the department. He moves very slowly and he beeps every time he changes direction. So you can hear him from a few hours away. I feel like the googly eyes definitely makes it easier to accept Marty as something that is there to help. And then he even wrote in again and said, I've now been back to Giant. Here's a better picture. Marty is really cute. He's he's adorable. It's very tall. He's tall. Yeah. And from from his non googly eyes side, you kind of go like, I don't know. How cute is that? His face is quite cute. Yeah, I could see why they put the googly eyes on him. Because when you're seeing the side without the googly eyes, it looks pretty imposing. Like we had an email from Caleb who hates Marty because he beeps all the time and he takes up the aisles and he doesn't like him. But I think Marty really does appeal to children because Scott also wrote in and said a couple of months ago, we saw Marty in a local giant food store. And my four year old daughter loved it and followed it through the store as it navigated to its charging station. We didn't see the googly eyes until it turned around a dock. The eyes are only on the right side of the robot. The giant store had some Marty stickers and coloring pages for to hood and joy. And it was a good intro to robots for her. Well, I'm glad to see they both spelled googly the same way. I was struggling with how to spell that the other day. And I know we're very precise about spelling in grammar on this show. We'll have to check with the the the Academy of on how to properly spell googly. I think no e g o o g l y. Right. Yeah, that's the way I would do it. Yeah, googly, but not Google, just a different kind of Google. Well, thanks, everybody who wrote in about Marty and and everything that you always write in, keep them coming. Also, thanks to Alison Sheridan for being here today. Alison, where can people keep up with your fabulous work? Well, the best place is pod feet dot com. And I'm doing a little segment calling called Tesla Tech, where I'm kind of spitting out little bits and pieces that I'm learning about the cool tech in the car. But I did want to just kind of show one other thing. I did a video tutorial for screencasts online on Text Expander, which is a text expansion program for the Mac and Windows. I started out real slow, explaining how it works for the noobs, but I accelerated up into some of the really advanced stuff you can do in it, like embedded snippets and date math and even some programming stuff. It's really cool and I'm very, very proud of it. And that is at screencasts online dot com. Hey, folks, if you want more of me, I've been doing some guest appearances this week, comedyfilmnerds.com. I got to sit down and chat with those folks about some hot movies coming out like Rocket Man. And just this morning, I joined Patrick Beja's The Filious Club. I know Patrick's schedule has prevented him from being on Daily Tech News Show. So if you miss Patrick, go to Frenchspin.com and download The Filious Club. It's me and a pro Brexit Brit named Gareth, all talking about things like Brexit and the Alabama law and all kinds of stuff. So go check that out at Frenchspin.com. And thank you everybody. So I got to I just got to play The Filious Club. Man, awesome, awesome, awesome show. Never miss it. I love it. Yeah, it is one of my essentials, too. Thanks, everybody who supports us at Patreon, patreon.com. Slash DTNS. I have a by request editor's desk coming out this weekend about spoilers. If you're at the associate producer level or above, you get that. So go become a member if you aren't already, patreon.com. Slash DTNS. Feedback at Daily Tech News Show is our email address. We're also live Monday through Friday at 4 30 p.m. Eastern 20 30 UTC. Join us if you desire and find out more at DailyTechNewsShow.com slash live tomorrow with Shelley Brisbane on the state of accessibility technology. And then for all to be back tomorrow, too. OK, then. This show is part of the frog pants network. Get more at frogpants.com. Oh, a minute too long, that was because I plugged two things. Sorry. Oh, that's we just we're having too much fun. Yeah, we just had two hot like beefy topics, too. Yeah, I will have you know, Tom and Roger and Allison, it is raining. Oh, yes, at least at my house. It's raining. It was yesterday. Yes, we were talking before the show like, is it going to rain? It looks like rain.  It's raining. You know, this is the one thing I don't like about driving in LA is the rain. And it's not that I'm not used to driving the rain. I'm from the Bay Area. It's rains all the time. I'm surrounded by a lot of people who don't seem to drive in the rain. Well, and also it at least my neighborhood is very hilly and the drainage system is just bad. So it doesn't take much for water to start pulling up. And so cars are going through and it's shooting out everywhere and then people get freaked out. That's always like if it rains for half a day, I'm like, it's going to be horrible. It's going to be puddles everywhere. I just washed my car. I did, too. You caused it to rain. Yeah. Well, I always wash my car. So that's cheating.  I like that. Jeeves rides again. Man, I wish I would have thought of the word Jeeves, the name of Jeeves when I was explaining that because I'm like, I can't think of anybody right now. But there were so many of them working towards less rotten tomatoes. Fewer, I think we want to say. Didn't they just want to tweak me? Not everyone's a critic. Stop that.  Jerk face as a service.  Yeah, all right. That's what we'll go with for details. So a Tesla shirt. Because at this point, it's like I might ask, is that really one of the names of the mode? Because he would like we got Mad Max in there. Maybe we'll cause it to become the mode. If someone says to me, I drive like Mad Max, I'm like, oh, that sounds dangerous. Well, I'm wondering if maybe the names are a little too aggressive and they just called it like speedy mode or, you know, too much a too much a speeding. It sounds like that would be something where I'd be like, OK, yeah, right, you're, you know, you're what would you say? I'm five minutes out mode, five minutes, lying mode. If anyone's five minutes out, there are never five minutes out. No, one's talking because they wouldn't bother at that point. Five minutes means like 15. I want you to just chill. That's what I do anyway. Because the internet, we have a wrath of can. Oh, I love that. That's fabulous. They got they got. We're participating in floating participles. Oh, I like that one. You was using the wrong words. Oh, I like that one. That's good. If I was were. Oh, and that friend at the bottom put good grammar internet. I guess you're trying to do all good. Yeah. Wrath of can from Cervantes, 47 in the discord. That's my favorite. So what would say you, Sarah Allison? I like Wrath of can. Let's do it. Well, come here. There it is. Oh, it was in there. It's in there twice MWK 1309 as well. Oh, well, now we really have to choose it. Yeah. That split the votes. You have to decide whether to put the splitting the infinitives. You put the at the front or not. I mean, it's a lot to decide here. What's the actual? Yeah, the wrath of God, I think. Yeah, isn't it? Actually, Steve would know Steve tell us Star Trek to the wrath of con. So, yeah, that's fair. So Cervantes was first. So Cervantes for the win. Cervantes gets the square. What are they going to bring back Hollywood squares again? OK, when they we know what any in one. The problem is there's too many. There's too many jobs for actors to do other than. I mean, isn't Hollywood squares where you kind of just kind of cooled your jets for a while until you picked up like your next work? Well, they had a mixture of regulars and like kind of like, oh, this person's kind of cool. And they're only here this for this. Gilbert Godfrey was on there for like a year or something. Whoopi Goldberg was the middle square for like 10 years. Oh, but who is the guy? Paul Lynn. Oh, Paul. Paul Lynn. Oh, he was fabulous. But there was another guy. What's his name? He was mocked on Saturday Night Live really well. Shoot, like recently anybody. No, old, old way back. Here are three names, right? Yes. Yeah. Steve, say it. I know. I'm searching. A Rosemary was in it for a while. It wasn't even really my favorite show, but it was there. It was like every time I forget about it, it gets resurrected. It's a show that you had up running in the house when you were doing something else. Yeah, like laundry or anything. Right. Yeah. We're Jeopardy. You have to like really pay attention. So I know a woman named Kaley, who is a teacher in Japan. She teaches English to little Japanese kids. Oh, yeah. I've done that one day. And the way she teaches them, she has programmed using JavaScript, she has recreated 1980s game shows because she's a freak about 1980s game shows. So in JavaScript, she has written Jeopardy, for example. And then she has, she's reconditioned old iPod touches and put new batteries in them and used makey, makey, makes it for the for the buttons so that the kids can can buzz in and everything. It's it's crazy. Maybe she can do Hollywood Squares, but she'd have to animate little people like Charles Nelson, Riley. Yes, that's it. Got it. Thank you, SP Sheridan. Oh, he found it. Yep. Yep. He put it in. Oh, there we go. Good job. I don't even know who that is. Charles Nelson, Riley. Oh, he was. I mean, I probably do, but I don't I don't remember Saturday at live. Oh, he was a character actor, wasn't he? For a while, two or no. All right, I'll look him up. I think he was only he was on the show way too much. I don't think he had any other gigs. I actually, when I think of him, I think of Mystery Science Theatre making a Hollywood Squares reference about Charles Nelson, Riley riffing off the Saturday Night Live parody of Charles Nelson, Riley from Hollywood Squares. I like it. I like it. The Ghost in Mrs. Muir is where I remember it, which is probably 20 years before any of the rest of you were born. 1968 to 1970, he played Claymore Greg. It's the most blues we're in the Stanley Cup every year. I was definitely not alive yet. He was also on Match Game, huh? Oh, yeah, yeah. I like don't know him. Petty Duke show. Yeah, you wouldn't. Wait, was it on Hollywood Squares or was it Match Game? Oh, because, yeah, like, I don't feel like I know this person. He was on the Hollywood Square. The Match Game Hollywood Squares hours. I mean, yeah, I'm remembering him. I'm remembering him from Match Game. That's why. But it was all smushed together. Yeah, there you go. That's why you don't know, Sarah. Well, I am looking at some gifts of Charlie and he had some fun fashion back in the day. I'll tell you what. Just. Did anyone watch the All in the Family? Good. All right. The Jefferson's live versions last night on ABC. Did not. Were they good? Was it really good? I missed it. I wanted to watch it. And I kept thinking it was on Thursday, for some reason. And then Eileen got home from a screening and she's like, Oh, is the did you not watch the thing? Is it still on? And we like caught the credits. We caught the like. Oh, thank you, everyone, for watching. So it was live? Yeah, it was a live stream. A live broadcast of them doing the show. They don't have like an on-demand thing with your. You can watch it on Hulu now. Yeah, they broadcast it live. You know, the way the idea was to watch it live. Yeah, yeah, the idea was like, this is going to be a live performance. Yeah, I remember when they did it with Peter Pan. Yeah, exactly. And Christopher Walken is hook. Yeah. That was that was fun. It was interesting. I watched it. I watched it. This was Jimmy Kimmel and got Norman Lear to cooperate, collaborate and put it together. And they had Woody Harrelson as Charlie Bunker, as Archie Bunker. They had Marissa Tomei as Edith. Jamie Foxx, George Jefferson. It was a great cast. I never watched it on the family, but I did watch the Jefferson's. So some of it, I probably wouldn't get the ha ha, you know, like callbacks to the old show. But Jefferson's. Yeah, my parents didn't. They watched all in the family sometimes, but they didn't like it that much. They loved the Jefferson's, though. We were very unlikeable, but oddly likeable at the same time. We were we were all in the family house, for sure. Didn't didn't take to the the Jefferson's. My and they didn't run concurrently, right? No, Jefferson's was a spin off.  So all in the family was I was probably just not allowed to watch it because I was. Yeah, my mom thought Archie Bunker reminded her of her dad too much. So that wasn't a good thing. You know what? I've heard that more than once from other people. It's like not necessarily their dad, but like it was close to the truth. You know, I honestly don't see it.  Sally Struthers, though, was was a real strong female character for women's rights and stuff and fighting with her, trying to get her mother to stand up to Archie and all. Maybe that's why my mom thought Archie Bunker reminded her of her dad because she wanted to be Sally Struthers, you know. I feel like Sally Struthers was probably on Hollywood squares. Well, she was definitely doing a lot of work for Save the Children. Wasn't she? Like, wasn't she one of the? Yeah, yeah. Because that's other than that, an Archie Bunker, that's all I remember her from. She did all the commercials for. Feeding the children, right? She did it. Save the Children. For the prize of a coffee. Yeah, I think that's her one of her lines, isn't it? Well, that's that was part of that organization. They had a guy who did it, but like for the price of cup of coffee, you can provide nourishing meals, life-giving medicines, coffee. But, you know, that was back in the 80s. Coffee was 50 cents or 30. I thought Sally Struthers also said that. No, she might have. I know they made they've parodied that one line a lot. They parodied on SNL, where were the people that they're standing in front is like, ask for more money, not just for the price of a cup of coffee. The the one I always think about my my dog looks completely pitiful when she goes in voluntarily into her crate.   So I can't say not that she hates it. She just can't stay watching. Yeah. Well, that's. Yeah, it's now I want to see this all of horrifying enough to. Spring and action. Well, I did rescue my dog, but she still looks. Are they going to replay this or can we watch it on Hulu? I checked this morning. Oh, you can. Yeah. OK. You don't get the juice of watching it live, I guess. But I don't know if we did it anyway. I think it was delayed on the West Coast. Oh, OK. We weren't watching it live to begin with. I got to see a live this third to the last episode of Big Bang Theory. I got to be in a live audience for that. Oh, really? How was that? Really, really interesting. The the bits are like two minutes long and they they do everything at least twice, sometimes three times. And they've got a little MC guy who's to entertain you for the long stretches in between. And you the the sets are all like straight across. So you can't actually see all of the sets, but you can see like three or four of them. And every time they do a bit and then they go to do it again, the guy would go, OK, you've never heard these jokes before. Laugh again.  Right. And and I thought it was real interesting is at one point they did something really sad because I mean, there were some moments coming up to the end and we all went, oh, and they stopped and went, no, you're here to laugh. Well, don't do sad stuff. The live studio audience. You get what you wanted before a highly disciplined live studio. It was the three two or three episodes before the one I saw. It became the longest running live audience sitcom. It was very, very fun. So if you saw the last one, you are now the record setting audience, a member of the record setting audience, I guess. Yeah. Yeah. Well, had you ever been to something that had been filmed before live? No, no, they take your phone from you before you go in. So there's no no proof I was actually put in a little in the little pouch or did they just like file it away somewhere? They had little pouches. We left ours in the car because we knew ahead of time. Right. They do that for a lot of the screenings, too. Yeah. In the pouch, but. We Robert Lloyd Lewis was the producer of Dexter, and he's a fan of Apple Podcasts and he happened to listen to my show. And he asked me if I ever wanted to come up and see the set of Dexter and we're like, oh my gosh, yes. And so he said we were allowed to take pictures, but we were allowed to show to post them anywhere. So we were allowed to show them to people, but like in person. And it was so funny because we were so excited we took all these pictures. And when we got back, we realized, look, there's a picture of a closet. Yeah, but those are his kill shirts hanging in the closet or here's an air conditioner. It looks like an air conditioner had air conditioner. It was it was really funny. That was amazing. And that was a video, folks. Thanks for watching. We appreciate everything you do to help the show. Audio, folks, stick around. I've got more tales to come.