All right, welcome back everybody and with me I have Wes and Emma directly from the Defconn floor, so welcome Hey, how's it going? Can you hear us now? I can hear you now. Awesome. Thanks for being with us Yeah, definitely live from the floor here like going on still a lot of excitement for a Sunday night or Sunday day, right, but How are things going with you Omar? Doing well doing well is a busy day, but But doing perfect and the biggest biggest thing we got about an hour left of our finals We have one team that Very are I think either 100 or 200 points shy things a hundred points. I have closing it out of getting everything So that's pretty epic And then we got a few other teams that are you know kind of jockeying for a second and third there So we'll see See what happens over the next hour We had a lot of movement on the qualifiers right great towards the end last couple hours So we're really pumped to kind of see what what comes with that But one of the big things that kind of makes this CTF happen Kind of makes it all possible is hack the box So we have Emma here with hack the box and because of them I'll tell you Hack the box has been a partner for probably two and a half three years now Doing a lot of essentially like epic prize donations for us every single event tons of pro labs VIP labs Academy cubes stickers t-shirts Everything like it is amazing what we're able to give away and I would say you're one of our longest one of the longest kind of sponsors that we've had and All of our CTF players know that you know they come play and just the the sure amount of swag and prizes and everything that they give out that there's a good chance they're gonna get it and that's one of the biggest things you know kind of with the hack the box community is able to Give out prizes to everyone so you don't have to come in first second third, right? We do surveys we do giveaways Twitter, you know in Defconn. We had a few kind of pop-up Giveaways every now and then so just had to run down here within 10 minutes or whatever to get something You know people that are just being awesome in like discord helping other people out We're able to kind of give them Academy cubes all sorts of things so you want to talk a little bit about Maybe some of the things that you guys offer. Yeah, for sure We love to give out prizes to tons of different events so we can help encourage the Learning of everyone everything from Academy Cube, which is our latest big product where we have started to move into the more educational courses We also have our pro lab offerings Which is great for everyone who is brand new to experience where it's full networks where you can practice later skills And we also have smaller machines and individual challenges Which you can give a set of 20 active machines where everyone connects a set for free at any point and then we have our retired machines which are Free with write-ups, but you can access the latest two or you can pay a monthly subscription and get your own private instance and everything Which is great for learning and just learning everything So no definitely, you know, I would say like there's a lot of overlap in some of our styles, right? So like in our qualifiers, we have a lot of standalone boxes that are very similar So kind of what are you talking about it? Yeah, the active machines or as well as retired machines Individual kind of standalone. So we have those and those are like amazing a lot of overlap there But then we also have for our finals like the in-depth scenarios, which is kind of like Dante's lab. I can't remember. What are the other pro labs you have right now? Offshore cybernetics Resta and APT labs. Awesome. Awesome. So same thing our finals is just like that where you can actually you know VPN in You know whether it's fishing a lot of same techniques things like that that you kind of see but just different scenarios Super in-depth super amazing. I had a chance to play one or two of those pro labs All I'll say I got stuck much twice Wasted probably a week on one one particular box. I know there's definitely different You know, we have a 24-hour kind of time limit for our CTF here But yeah, I was being my head against one of the boxes just trying to land a Covenant payload learned a lot about like Windows Defender and evasion all that other stuff Which you know may or may not have been important in our CTF finals We learned a lot about you know evasion with Defender in this one a lot of the teams kind of leveled up quickly So with that a lot of overlap between the two And that's why I think like we're a good fit that we kind of offer a similar product Where you know we do this a couple times throughout the year a lot of fun But hack the box is able to kind of offer that you know on demand anytime you want Yeah, like you can always access our stuff, which is great for practicing for these like shorter time-limited events a lot of the stuff overlaps And it's whenever you want after work during school You can practice learn and get ready for these bigger events and train and we ourselves So it's like a few of those big events every year where we love to give out tons of prizes is for everyone You know, you don't have to place great. You just got to participate and we love to give out tons of those stuff Yeah, I think Emma just hit it on the head of like we have that same kind of community feel All right, we want everyone to come out learn something We don't want you to get you know frustrated. It's easy just to say like try harder, right? But we want you to learn and we will definitely walk you through right unless you're a top three team Then we're not gonna help you but Outside of that we want you to learn want you to have fun We want you to level up, you know come back out again And definitely get you know all sorts of swag whether it's the the cubes the shirts the stickers all that good stuff So and the one other piece that I love, you know, we love coming out here and doing it free And we couldn't do that without sponsors like hack the box But the biggest thing though as far as like value right your your return on investment for Training I think hack the box has that right so whether it's the cubes or just the experience right like you can start off for free No price on the 20 active machines But then just for a rather small amount you can actually get you know The vip lab or the pro labs, you know, they're pretty cost effective You can do the academy cubes if there's particular topics you want so Yeah, we also have a good few academy modules for free where you can just give a shot try it out You start off with I think 40 cubes and once you complete one of the Modules you get a certain amount of cubes back for the free ones you get 10 back So at 40, so it's free And no matter what you always get something back We also have offerings for the business side. So if you want to train your whole team You can reach out to us for that. So that's a good way No, it definitely that that's happy. There's definitely a lot that you can do there I've been a part of companies that you know have done some of the private servers things like that It's really great team building experience kind of bring your whole team together do it together You kind of level up your workforce skills. So Huge shout out again to hack the box I can't thank you enough Token of our appreciation. We got we got a coin and a t-shirt for you A few other things, but I know it pales in comparison to what hack the box gives us Multiple times throughout the year. So we love to sponsor as many events as we can get out with the community and make sure everyone Learn something even if you don't get root as long as you get a good learning experience out of it That's what matters So thank you so much Emma for coming out and spend some time with us Uh, Omar, you got anything for Emma? Oh, you're muted Sorry I didn't want to interrupt your conversation on a double meter myself. So uh, no once again I echo what west mentioned. Thank you so much for all the support not only this year But throughout the years you have been amazing not only to the direct in village But the whole community as a whole so um anything that you want to highlight from the from the Scoreboard here Oh, okay. I see I've seen a little bit of movement. I think kind of between the uh fourth and fifth teams They look tied now. So and not that far off from a third place So we I think we can definitely see some movement. They got about 50 ish minutes left. So Uh, I don't know. I don't I think we have first place pretty much locked in but uh, I think second and third is still up for grabs so Also get in there submit the flags. Um Huge shout out to our team doing support kind of back end They've been amazing on the CE red team discord def con discord channel So definitely hit up any of our folks out there if you have any issues or anything like that Again, like thank you to all our volunteers that came out here as well as all the players that came out We couldn't you know over 2,000 players that we had in the qualifiers, you know, something like 22,000 flags submitted It was just epic the amount of participation that we had and the number of people that came up to the booth as well As people playing virtually in discord. We loved it. Uh, and then now with our final team We even had one or two final teams Come by the booth. So that was that was awesome kind of meet them in person So a huge shout out to them and then uh, definitely looking forward to sending out some swag to the top three Awesome. And as a matter of fact, you just touching something real quick One of the questions that we're getting all the time is hey, what what are we expecting from the top three? And what are what are the prices? Oh We got a little bit of everything. Uh, we definitely have a number of courses to include Some of the hack the box whether it's the vip Can be cubes for other things to hand out And I know definitely some of the some of the first place teams have quite a few people on them So we got that as well as various courses from sector seven Offensive security. So there's a lot out there that we haven't, you know, totally given away. So definitely a big swag Thing but the biggest thing that we're going to do is we have a giveaway or not giveaway But uh, we're going to give them some coins. We are custom coins From I think you've seen them in some of our twitter's But either way the red team village in particular for this year that the dunder muffin Uh scenario or theme so huge out they'll get a couple of those As well as some virtual prizes. So Since all the international ones, you know, it's kind of hard to do all the international shipping But they're going to get some some good virtual swag as well as, you know, a few physical gifts there is to make it worthwhile. So Very very cool. Thank you Two things You mentioned yesterday that Anybody can actually create their own walkthrough video and then tweet the red team village ctf and the ctf Um, you know, we're advertising that down below Anything else that you want to expand on on that? Oh, yes. So I know we get a lot of the questions of uh, you know, we're we're a little bit different Than like hackbox. We don't release kind of walkthroughs and a whole lot of stuff I know with their academy cubes. They have a lot of that training to release everything Uh, but even though we don't publicly release kind of walkthroughs for our challenges We may down the road. Uh, we're thinking about it. But what we do encourage though We want everyone who does them to do a write-up. We love seeing those I love for me personally like if I make a challenge I love seeing someone else's mindset like what they thought of it, right? I want to I want to know good and bad Right. Did you like it? Did you hate it? Was this frustrating? But was it frustrated in a good way or a bad way? so we love seeing them and Uh, if you tweet with red team village or the author of the challenge That's listed in all the challenges or myself or uh, pony ip We will go ahead and blast that out, right? So, you know, if you uh, low key looking for, you know, some some traffic to your site Whatever, uh, get, you know, they're all closed or get hub pages Just do a walkthrough shoot it to us and then well, we'll blast it out because we love reading them And then we love just, you know, push them out there for other people because we get those questions Is a lot definitely after an event We shoot them out to some of the other people when they call and they hey, I got this question about this challenge I don't know how to do it and be like well this other player they did a write up for it. Here you go Check it out. So please do write ups tag us in it and we'll you know, we'll retweet Uh and like it so Awesome, and I'm just Trying to type superfast in here, but I put a banner down below with your twitter handle So, uh west is not researcher and also pony ip. So if you tag them both Uh, please do so and then the last Announcement you what you just mentioned, you know, please join the conversation at the defcon official server And I have the link in the bottom of the screen as long as well as the channel So with that, thank you again. Emma so much for your time and your help So one last one last thing. How can we get a hold of you? Uh, you can reach me on twitter at 0x e m m a Uh, shoot me an email because I'm talking about anything. I'm a hack the box dot e Is there great ways perfect perfect? So definitely any you know questions for emma or the hack the box team reach out Emma's community manager. So definitely loves hearing from people. So please, you know, reach out hit them up Hit them up on twitter any kind of thing like that. So it's great stuff there. So Again, thank you so much to hack the box. Thank you so much to our players Hope you have fun still about 45 minutes if you want to stop by the booth last 45 minutes That's great. If not, we'll see most of everyone at closing ceremonies for just the announcement of the winners, but 45 minutes, please, you know, keep on speed of those flags. Have fun Thank you. Thanks knock who's there this guy? What's up red teamers? What's up defcon?  I like cheap things.  No, it isn't Not even you boy and girl geniuses can do it You would have to be the human equivalents of cars with doors that open like this or like this. Are you? Can you will you don't help from the red team village and today We are here with Omar Santos from the red team village as well as our guest ipsec from hack the box Hey guys, what's going on? Oh Uh ipsec hack the box has been a long time supporter of the village. Can you tell me more about the company? Yeah, um hack the box is a hands-on security training platform And our main goal is to make good training readily available to anyone in the world If you're new to a topic or just the field in general We have hack the box academy and it's a guided learning experience Which just means we have written material in hands-on labs and again when building this Accessibility was our number one desire. So we created the pound box which allows you to have a Whole operating system in your browser. So the machine you're doing these learning on doesn't even have to be powerful You can do it on like a chromebook if for some reason you want to do it on a phone you can I wouldn't recommend that But everything's done within a web browser if you want to bring your own os We also provide a vpn pack for you so you can join your os to the vpn and go on learning In addition to the academy, we have unguided learning, which is what we're most famous for This is the weekly challenges machines or entire like networks We put out on the platform and that we ask people not to publicly talk about these challenges until they retire Which is typically 20 weeks This is my favorite and what I credit most of my success to because it really enforces building good social relationships That not only help get you the help when you need it But also when teaching it often validates your understanding of it And it's proven to help memory retention So I have a lot of friends from my in my social network that include barry I met him through another friend who met him at derby con which is a similar event of red team village And the funny thing is both my other friend kyle and barry all lived within like 30 miles of each other But we met like hundreds of miles away. So definitely like Important to go view and travel and experience the community because you'll never know who you find and how close people may be It's a small world Absolutely, I think we've all been cooped up these last few months here I think a lot of people are excited to go in person to las vegas to attend death con And so we're really excited to see some of our old friends and make some new ones Um speaking of of that community, you know hackbox is a very vibrant community both on their discord as well as all over twitter Can you tell me a little bit more about the people behind hack the box? Maybe some projects that you might be working on Yeah, we have a innovation team that's designed at like pushing what we think is the limit So typically most of our stuff is either a docker or a vm or image And the innovation team is looking into google cloud aws and azure To provide a pro lab called black sky which is just based upon those types of features So if you want to exploit iam or do a lot of those unique cloud things black sky lab is going to be that We also have as you said the discord community We have road runner who runs that and they help provide a lot of good support and just learning to anyone In addition to a bunch of ctfs. I think we run the ctf like every other month or something. It's insane Well Talking about the ctf and talking about all the activities, you know throughout the years you guys have supported the retin village Tremendously. So first of all, thank you and thank you. Hack the box So one of I got a couple of questions, right? So one of the questions is, you know, what will you say that is the best part about sponsoring Community efforts like the retin village ctf this year I mean, obviously it helps the community grow and most of my like Relationships I can credit almost all my professional success as to leaching off my friend's knowledge because no one can know everything And I can't speak for anyone to hack the box But I know a bunch of my friends at hack the box are super excited to play a ctf built by other people And we've played the red team village cts for quite a while I vaguely remember one. I think two years ago that involved exploiting a printer, which was new to all of us We're all like big binary exploit people and then through a different architecture at us that we never really Experimented with and it was just a lot of fun to play so super excited to Sponsored an event that we can participate in and learn new things to hopefully put out on our platform in the future Thank you. Appreciate that. I think that you're hitting my next question. Which is why do you think sponsoring the The red team village this year is so important for the community Yeah, um number one it's important to like With covet and all we want to increase the socialization and everything we've been all cooped up And the red team village incorporates all of hack the boxes things. The main thing was being accessible If you can't travel you can do it online and form a team And additionally if you want it's available for the high cost of zero dollars Which it lines with kind of our methodology and what we want All our machines are available for free for a time and then once they retire Then you have to pay a small fee to gain access to it because hosting 150 images permanently would just be expensive can't do that for free Additionally, I believe infosec is a unique profession where team building activities have immeasurable impact If you look at the non-infosec teams, they still do team building activities like you have that gimmicky trust fall and escape room etc And they're doing them just to help build that social bond between co-workers So you know, it's valuable since that's the only thing they care about in the infosec world We have cts that is just like that on steroids. It has all that same social bonding benefits. Like I mentioned earlier I play cts with barry. I've played cts with oxtf. Mr. Ben John Hammond a bunch of people I just have a lot of fun with playing these cts along with co-workers And in addition to that social bond that you build It also gives you a lot of techniques that you may be able to immediately provide your work value because you're Joining hands with a bunch of other companies to learn things It wouldn't surprise me if you do the ctf and then find something you can immediately turn around to do on your job I remember doing almost any pro lab I'll use offshore as an example where the frithold involves exploiting splunk And I had a pen test that I kept missing this vector on because I just didn't know it and mr. Ben put it in that pro lab So when I did that it was just like an eye-opening thing of oh god, what have I been missing? So definitely the big social aspect is huge here Awesome, and and I couldn't agree more and and once again, you know, thank you I have one more last question when it's around the benefits that your team actually will receive By participating at the you know that kind of red team village ctf this year Yeah, um hack the box and red team village are almost anonymous and what we provide and are methodologies So the only unfortunate thing is the red team village ctf is a yearly thing Well, hack the box produces new things on a weekly basis It's probably not to the scale that red team village will be doing just because it's constant But if you're itching to do more after doing the ctf definitely check out the platform if you haven't And go over to hack the box because I'm sure you'll love the challenges we put on the site Awesome. So once again, thank you so much for supporting us. Thank you hack the box You know for sponsoring the red team village and I hope to see you at defcon. Yeah, take care I I'm bair darnel with the red team village and I'm here today with ryan dory and matt eidelberg from octave Everybody and uh, thank you so much for being here today and I want to uh, Thank octave for being a sponsor for the red team village ctf this year Your support really helps uh, and it goes a long way at uh, allowing us to provide a big event both in person and virtually Can you tell me a little bit more about octave? Yeah, absolutely. So to put it very simply octave is a pure play cyber security partner and what does that mean? We aim to do security all security all the time, right? We can help in ways of advisory deployment and even manage operations, right? So ultimately our our goal is very simply to Help organize the organizations realize a more effective security program and posture And uh for for both of you specifically what what do you do at octave? So I am a senior director inside of threat management, which is a large umbrella But I specifically have the privilege of leading our attack and pen team Um, so my focus is on the direction of success of that team and I achieve this largely by enabling the great folks around me Such as uh, mr. I over here Attack and pen my primary role is leading the adversarial simulation services. This is our Branch that focuses primarily on red and purple team operations My role in there is not only executing these types of engagements We're also focusing on helping to innovate the team and grow more operators to perform these types of engagements All right, and uh and for the for that attack and pen practice. Uh, why do you like working there? Yeah, so for me first and foremost, uh, it's it's the close family atmosphere that we have on the team And what I mean by that is I've been on the team for almost nine years now I've been in attack and pen the entire time and I'm not alone in that There's several other individuals on the team that that have been here for a single amount of time such a such as matt himself So what that yield is a really good dynamic of folks to work well together while we Simultaneously, you know pursue our passion of offensive security And just to add on to that I would say in a single word the community The team itself Honestly strives constantly to push the boundaries to teach each other new things whether or not it's a you know failures From previous engagements to help educate for future Kind of tests or even success stories. It's all about sharing and kind of bolstering each other through knowledge sharing Absolutely, and you know and a plug for that that giving back to the community aspect You know I was on your github the other day and uh, I was looking at the scarecrow And I know I've got that on my list to do a deep dive on after after def con You know love love the fact that uh, you know a lot of big players in information security Share that research share that tooling that they create Yep, that's what we strive to do here And for your team, um, you know, what types of people work there? Well, what are their backgrounds? So it's a good variety of backgrounds, right? So we have folks uh some from being a good part of us being veterans To business minded folks to engineering folks, etc, right? Uh, but like I mentioned earlier, there there's the ultimate commonality, right of a shared objective of offensive and passion for offensive security testing And then what we qualify that success really is is helping leave our clients better than we found them at the end of the day And of course, you know folks have a very specific Or can't have a specific subset of interest inside the team That could be of iot to embedded to wireless to low-level windows stuff to evasion Etc, right? So there's definitely some some sub pockets for people to really go a mile deep on Great and with such a diverse group, uh, what makes somebody a success in amp? So aside from a technical acumen, which obviously is held, you know, it's an important quality on this specific role, right? Is the ability to show ownership and leadership and give back to the team? Really, you know owning a specific service or an offering Helping others mentoring, etc. We hold that in incredibly high value um, and then as we mentioned earlier with regard to Like source zero and scarecrow, right is the the public thought leadership to help the team immediately and then also give back to the community as well Yep, and just to add on to that. I would say the eagerness to learn and improve your tradecraft Um, honestly the ones we see that excel the most are the ones that not only focus on themselves But also make sure that they help their fellow teammates or co-workers whether or not they're struggling with something or helping to help them Also pursue and grow their talents. Those are the ones that I see often have the biggest success here That's great. Uh, absolutely. I mean this is this is a team sport doing what we do Yep For the for the red team village one thing that we we really love to do is is offer a lot of Environments for training. We do workshops. We we've we uh participate in a lot of different cons Um, and one thing, you know, we want to do is bring as many people into this community as possible And so I'd like to ask for both of you, you know, what is your advice for people who are interested in cyber security as a profession? Yeah, absolutely. So I mean I'll speak to you know the path that I took to get here And I think it holds true to the to the question, right? But I think it's very important and imperative for folks to have a a deep foundational understanding to as to how Things work, right? So what I mean by that is how does active directory work? How does networking function? How can you manipulate these things to maybe Work outside the bounds it was intended to right so that can apply to even development web applications, etc Um, oftentimes I get asked by people that are a bit younger and stay in college or whatever and they're like Hey, should I take this security class and become a pen tester? Well, I would really encourage folks to get a lot of those more foundational understandings to how things work Before they move to the stage of trying to you know, move to the adversarial emulation types part Yep, and I would just add to not just focus when you're learning on red team tactics It's incredibly valuable in the current landscape to Focus on both blue and red team Having that ability to speak both can really augment your skill set and you know This is very much a cat and mouse game based industry and just knowing both sides their playbooks Can really help you understand the strengths and weaknesses of both sides So when you're coming up against say a red team or a blue team You know what they are great at and what their weaknesses are to really help plan out those attacks or even your knowledge set to improve on Those that is phenomenal advice This industry is is a challenge because there's so much breath and depth that you can take Not to mention that it's evolving every single day. It's impossible to keep up So you've got to have that thirst for knowledge and and without that foundation. It is quite difficult I mean you might throw that exploit and get that get that shell back But then the question is what do you do next? Right? And so Great advice. I want to thank both of you for being here today Thank you again for the sponsorship looking forward to to meeting you in person And and also with with DEF CON right around the corner You know looking to to engage with old friends and and make some new ones. So so thank you again Absolutely. Thank you for the opportunity and we're looking forward to seeing some folks out at DEF CON Knock who's there this guy? What's up red teamers? What's up DEF CON?  I like cheap things.   Close your eyes Feel the energy Hey, can you hear me all more with the stream? Can't hear no Oh walmar. I can't hear you but uh, hopefully you can hear us. Maybe give us thumbs up if you can hear us But we are you can hear you. I can hear you now. Perfect. Thank you. So we are definitely live from the floor so I'm here west also go my knob researcher get austin here with me Definitely one of our ctf builders uh system dome on the on the tweeters So either way we got about two minutes left here looking at this scoreboard There's a lot of movement a lot of you know kind of back and forth Well first place though has been pretty pretty rock solid staying in first there But we did we get any last minute movement between Yes, son of anton jumped up a bit I called the two boxes.  So we got Approximately one minute left here then we are going to close down the scoreboard or pause the scoreboard So with that, uh I think it's uh, I don't know what any kind of commentary what you saw on the scoreboards movement I just I'm just I can't say that enough like I'm just extremely impressed with like uh, all the team Like a lot of most of the teams were able to get into the into the network Uh, I know windows defender was kind of giving uh giving out some beatings, but uh Now they ended up they didn't get in I've seen a lot of like innovation Um, I mean obviously ai generated an ept or just absolutely killing it Um, a lot of like really elite folks there. I'm just super impressed I'm really glad that someone was able to to get through all the boxes And get all the way to the last box and get the last flag. I know Are one of our challenge designers who wrote that last, uh, Poneble Um, he spent a lot of time and effort and he was explaining to me how it works And you know, I probably wouldn't have got that in a million years. So, uh, god bless Whatever for a reverser had to kind of go through that, but um, you know, what what a champ That's all I gotta say that that's incredible. So it is it is official. Uh, We uh, you know, we'll be closing the scoreboard here in a moment But it is official. It is 12 o'clock Local time here. So with that the competition is over. So huge shout out to ai generated They not only came in first place, but they got every single flag We I will tell you last night We were kind of having this whole debate and you know, kind of leading up to everything of You know, is a team going to be able to kind of close this out and really Check off every box on the board and ai generated came through and did that So super huge shout out to them Very impressive work. I had a little skill involved is just absolutely like mind boggling, especially in such a short time frame Like I know it took us just walking through it with the answers It took us quite a long time to kind of get through and I know there were some hiccups on the infrastructure side a little bit Um, and some of the understanding on some of the callbacks and whatnot But I'm really glad to see that they just absolutely like swept it out and also a huge shout out to ebt And then the hack street boys Great name by the way So don't forget. Uh, definitely at closing ceremonies.  Uh, they'll be They'll be dancing across the stage there for a little bit. Uh, so definitely come on out and see them I don't know what song they're gonna pick, but it should be pretty epic But with that, yeah, definitely ebt and hack street boys like the level of talent I would say like as we were going through in qa in this, you know, you're talking about the people who made this Going through in qa and the the challenges Making sure, you know, things worked as as expected We took a long time to kind of go through this scenario multiple times over and over again and We thought we, you know, we're getting faster each time, but we still we still never did it in 24 hours And you know, yeah, it's it's one thing to kind of go through knowing the answers But then, uh, you know, when you try to design some of these puzzles and some of these challenges To be solvable and you're not sure if you give them the right hints or whatnot And we were kind of discussing amongst ourselves like we're not sure if anybody's going to get through even to the second network Um, and just you know with a scenario right of the supply side attack and kind of like uh Subverting that code base to then get execution in the second network And we had quite a few teams actually get into the second network, which I was impressed with and kind of writing that that back door Um, you know, just really impressed and uh and kind of like a true testament to you know It's a red team village ctf great red teamers Um, hopefully, you know, the teams had fun Learned a lot. I at least hope I know I did and then uh as well Just, you know, hopefully this came close to at least somewhat of a realistic network or something You might see in a red team engagement And hopefully you found it was more related to current events and kind of some of the the the novel like apt techniques That we've seen from this year, um, especially on the threat intel side and uh kind of reflected In the two networks, so so definitely, uh, I'll be honest. I think we lied to you all We said there's going to be no a pentest report required at the end of this, but You know look at the teams like the talent that you had You know, if you haven't had any like walkthroughs or any, you know, the particular boxes or anything you want to share You know, uh, we definitely love to see those write-ups, you know, make sure to you know If you write up anything put it out there Whether it's you know on your blog or get up pages or whatever it is, right? We'd love to see it. So definitely tweet it out to you know red team village dm any of our folks either Pony IP myself not research or system dumb And then we'll definitely throw that out there As well as retweet and all that we love reading those right so whether it's qualifiers rounds or the actual finals That's it's pretty amazing. Just kind of dig in and out You know kind of get a glimpse of that mindset that you had as you're going through the problem Uh, just be able to see you know, what what you thought on solving this challenge And then we also, you know, we designed a lot of this with like a specific flow in mind of like Hey, we expect them to go this way and you know, sometimes we're like, oh Well, you know, they can use like these three different tools to accomplish that or they can go this way or maybe that way Uh, I love just seeing when someone does, you know, something totally creative something I'm not familiar with and I was like, man, I didn't even think about doing it that way So I love seeing that. Uh, so please, you know, definitely, uh, if you if you're feeling froggy and you want to um You know, write up that pentest report, uh, please just uh, you know, tweet it out to us So then we could, you know, share it with the community and kind of let everyone know Kind of get a glimpse into, uh, you know, what it was like doing the finals So we'd love to hear from any of the teams that are out there and what their experiences were Yeah, via feedback and then also, um, you know, if you if you see the handles on some of the Challenge designers from falls a lot of those people also worked on the finals too You know shout out to, you know, like Waldo and and and Mike and, uh, you know, Conehead as well People who are helping kind of like interface with with you all and answer questions Bob Dole All those folks rub pain So definitely, uh, if you think about all the the targets that you interacted with right There's a whole another school of support targets behind that So with that like so many boxes per network, right and each team had their own instance So we're talking about 20 instances for the top team Definitely aws loves us. We spent a pretty penny with them But with that, you know, it takes a lot to kind of create that as well as support it, right? So huge shout out to our support team kind of running, you know Sporadically kind of throughout the night. We tried, you know, I know we weren't going to have, you know coverage all night long But for part of the night, we're able to kind of get some of that coverage as well as in this morning Kind of help the teams long as they made it through the network So huge shout out again to AI generated I'm looking forward to some feedback from you all as seen as you made it all the way through We were a little worried with that binary exploitation at the end. So Yeah, uh, so so impressed with, you know, the kind of skills And I will tell you that uh Our land hb designed that final, uh, exploit at the end there And I think you would love some of your feedback and just kind of what you thought about that Uh, because we were we were geeking out about it last night. So yeah, we want to know. Um, but yeah, again big shout out to ept Uh, and then uh, yeah, I generated obviously and then haxtree boys and then also some of the other teams We had the yee-haws out here, uh, physically present with us. So thanks for hanging out Um as well, like, you know, like I said, I'm looking at the points I've seen like most of the teams got into the network Um and got to kind of play around with it So and then obviously thanks to the sponsors and stuff for covering the cost that that it takes to uh To host, you know, you know, 20, uh active directory environments, uh, you know in the in the cloud. So yeah, thanks to them Awesome. No, I definitely loved it. Uh, and uh already starting to get poked up. Uh, I will say uh, my My discord is a bit unwieldy right now way too messages pending for me. So Uh, bear with me. I'll try to respond to some of you guys. I think snow scans just hit me up So super stoked. Uh, I'll try to talk to you all later Once we hop on this and then but definitely closing ceremonies Uh, all the teams will be announced at closing ceremonies and then we will work with the captains of the teams So definitely please stay in contact with myself. Uh, via the the emails that you provided as well as the discord handles And we'll work out logistics, uh But just give us a little bit of time to kind of work out the logistics and get the, you know prizes and everything out to you all You know our sponsors need a little bit and uh, I'm sure just like you all I need to take a nap at some point. I'm I'm a I'm a bit tired here. But uh, again, thank you all so much and then, you know huge shout out to uh, omar Uh for kind of handling our streaming without omar Uh, I would be struggle busting right now trying to try to juggle all of this. So huge shout out omar Thank you so much for kind of coordinating a lot of this You know, uh, make it if possible so we can come to you live from the defcon floor and kind of sharing all this Thank you. Thank you. It's quite the opposite And um, I'm gonna take the opportunity to actually congratulate Some of the winners of the oscp courses that we were given away yesterday We promised that we were gonna announce it this morning and I failed to do that. So You can probably take your money back now But uh, the congratulations to good speed not just bob and susan b123 Actually pretty cool handles. So you're the winners of the oscp courses that we had yesterday um We're gonna announce more giveaways, you know throughout the course actually probably even after defcon We do have a couple of more prizes to actually give so be in the lookout To a few things, you know the discord server Definitely twitter And of course, we're gonna be announcing many many other things In the upcoming in the upcoming hours or so now the other thing is that our next event Is a hacker one activity con and Once again, you know, thank you. Naham sec. He's actually been instrumental Definitely on day one with all the The panels all the interviews, you know all the streaming. So thank you. Thank you again ben Or naham sec for all your collaboration on all your work here But we'll help to see you and hacker one activity con and the details about that con is in the bottom of the screen And the red team village will be there So with that, let's go in a quick break and then We're gonna be again announcing a whole bunch of other prizes a little bit later on Thanks a lot Omar. Take care. Thank you. Thank you. Knock knock. Who's there this guy? What's up red teamers? What's up defcon?  I like cheap things.  No, it isn't Not even you boy and girl geniuses can do it You would have to be the human equivalents of cars with doors that open like this or like this. Are you Can you will you don't All right, we're back life And once again, congratulations to ai generated Ept and hack street boys You were the winners of the ctf this year And one more time to announce the winners of the oscp courses Congratulations to good speed not just bob and susan b123 as I mentioned just a few minutes ago We will have a few additional prices. So stay tuned and definitely be in the lookout in twitter I'm gonna try to bring the defcon floor right now live to the stream. So bear with me just one second Hey, west. How you doing? Hey, how's it going? Yeah, so we're uh, you know, again, congratulations to all the teams, right? ai generated ept hack the street as well as you know, the entire top 20 that made it the finals, right? That is huge to kind of make it to finals So great, uh, you know showing I hope all the teams learned something, right? I think we all learned something about defender evasion As well as you know, I'm not some spearfishing as well as you kind of got further in the network, you know Defender was out there is catching a lot of different things whether it was the actual binaries or heuristics So definitely a lot of fun. And uh, definitely I saw a few teams learned a little bit about some ci cd there's I think uh, some some fun experiences, uh, some teams kind of, you know, deleted some services or overrode Broke some of the things, uh, but we're able to kind of restart a form get them going again like that So a lot of fun and excitement out there Uh, definitely for the teams, you know, to kind of do that supply side interdiction get in that ci cd pipeline Pop out into another network. Uh, and then from there just kind of pivot and uh and go So it was a huge huge experience. I definitely loved it Uh, I'm glad to hear you don't kind of feedback from some of the teams. Oh, yeah, but we're here at the Defcon floor We're just kind of wrapping up now take taking down the projectors things like that Uh, as we kind of clean up into the contest floor here, we'll make our way to closing ceremonies Uh, with that, you know, they'll make some announcements, uh for everything that's kind of going on Uh, for all of our top three teams in the finals But again, like we just want to thank all of our balls, uh, every single player that kind of came out Uh, a lot of points on the board a lot of flags mission So we definitely think everyone had a lot of fun And then with that, you know, our top teams were just, you know, showing that skill and then making it to the finals Yeah, a lot of great feedback too. Um, I know I've learned a quite a few things and we're going to go make it better for next time And uh, yeah, we really appreciate like all the the good vibes and uh, and constructive feedback and the very minimal hate Like obviously this community is like really great and amazing and I've loved like interacting with you all So if you uh, if you slide them idms at some point like we we interact or help you with a hint or something like that Yeah, I appreciate you guys all uh being so cool. So yeah, definitely and then uh, especially with uh, you know, the ctf next year A lot of lessons that you all learned. Uh, all I can say is that we're going to take it up another notch Uh, it'll be difficult. So again, we'll have another kind of red team Engagement right a little pentest engagement here.  I probably review some notes From what you did this time and uh, kind of be ready to take it up to that next level. So We uh, definitely looking forward uh, follow us kind of throughout the year You know activity con everything else Those will be a lot of our kind of more standard jeopardy style kind of board qualifiers rounds So kind of follow us throughout the year a lot of you know New challenges will be coming out and then definitely def con next year We'll have the full blown scenario at the end huge, you know huge environments all that great stuff All right Thanks again and as was just mentioned our next event is hacker ones activity con And uh with that I think that this is a close at least for this stream If you're on site, please go to the official Closing ceremony from def con and before I lose my voice as well Thanks again Absolutely


Gaul United, forming a single nation, animated by a common spirit, can defy the universe. So reads the inscription of a French monument, dedicated to the ancient Golic leader, Vercingetorix. The monument was built in 1865, and was essentially a piece of unifying propaganda by the French Emperor of the time, Napoleon III. The character that the monument reveals is a fascinating one, however, as he led one of the most famous revolts against Rome in history. The story starts in 52 BC, when Julius Caesar had briefly left Gaul and was in Northern Italy, at a secluded spot in a Golic woodland. Celtic leaders met to discuss the situation with Rome, which was in control of a large percentage of Gaul after six years of war. The Golic leaders expressed their anger at the fate of Akko, the former leader of the Senones, a Golic tribe. The previous year, in 53 BC, Julius Caesar had tried and convicted Akko of treason, after the Golic leader had inspired his people to fight against the Romans.  Needless to say, this had left a bitter taste in Celtic mouths, and ultimately inspired rebellion. As Caesar wrote in his commentaries, the Celtic leaders decided that it was better to die in battle than to resign themselves to the loss of their ancient military glory and the liberty inherited from their ancestors. The meeting ended after the Golic leaders took an oath to stand by their fellow Celts against Rome, and it was decided that the Carnutte tribe, which meant the horned ones in Gaulish, probably in reference to their helmets, would be the first to strike. The Carnutte attack occurred in Senabu, which is modern-day Orleans in north-central France, when the attack of the Roman force stationed on their territory. The news of the attack spread rapidly through Gaul, feeling a spirit of revolt. The young Vercingetorix of the Arvini tribe was one who proselytised the spirit, inspiring his fellow Celts to rebel. His uncle disagreed, however, feeling that it was too risky to oppose Rome, and expelled his nephew from the town of Gurgovia. Undeterred, Vercingetorix began rallying his fellow Celts from the surrounding countryside, and soon after, he was named King of the Arvini tribe. In the following weeks, he managed to unify a whole range of Golic tribes behind him, and he was elected Commander-in-Chief of the Golic Resistance.


First we have the dancer, Mirro Chah. Let's welcome her before the dance. Hello everyone, welcome to this wonderful day. My name is Margaret Costantino. I'm the director of the Center for Refugee Services, which is one of the sponsors for this beautiful event. This is our sixth year of helping with World Refugee Day. It's an opportunity for us to come together, not only refugee communities and immigrant communities, but also people who've lived in San Antonio for many, many years. So it requires all of us to help newcomers who come into our neighborhoods and who are looking for jobs, who are looking for friends, who are looking for understanding, and who are looking to contribute. This is why the Center for Refugee Services was started about four-and-a-half years ago by a group of community volunteers to welcome newcomers and to help them make that transition to their new lives in the United States. He talked about, he said yes, what he found here, the freedom. So he talked about the education here for his kids. It's better than there in Iraq. And also he said that there in Iraq, you know, education these days costs a lot of money. Yeah, because, you know, the public schools are not, these days are not very good there in Iraq. So for that reason there is what we call private schools. And private schools cost a lot of money.  So you've been going to school here? Yeah.  College North. Pardon me? College North. And you like it? Yeah. Good. Next year I'm going to hobby. Yeah. Yeah, for sixth grade. It's hard. The school year is hard. But if you, like, if you come, well, you're going to learn English a lot. Well, it really is a community. We will come and have conferences with their students at their apartments. We encourage families to come up to the school as often as possible. And we like to be involved outside of the classroom. I mean, it's a community effort. It's not just one person that can really help these students and their families. It takes the village, you know, to really help them. So coming out here is just another way that we can support them and their families. For the Northside Independent School District, it is the newcomer school. So all the new refugees will come to our school from pre-K to fifth grade. And then after that, then they'll go to more of their local schools. So they're actually bused in. This is a large population that lives within our school boundaries. Tell me about the different languages that you're facing in school. I know in my class there's at least six to nine different languages in the class. Just depending on, you know, the flow. Because our classes are constantly growing because refugees are constantly coming into the city. It's not something that's static. And so sometimes we will have more, many more countries are represented than just languages. Because we know that not just one country speaks Arabic. So it just varies, you know, from month to month, really. Welcome Yalana, who is going to dance next. I want to say something to Ms. Litor and Ms. Rust and Ms. Allen to thank them that they teach us a lot of English. We will be like in sixth grade and we will be ready to sixth grade. And even Ms. Allen, my brother's teachers, they help a lot with them. They help a lot to teach us a lot of English. And I thank them because they make us ready to sixth grade. We are blessed to be your teachers. We are. You had been working with? Yes, with the U.S. Army. So I worked for the U.S. Army for more than two years. And after releasing, you know, because the U.S. Army withdrew from Iraq. So they released us, me and my son, because we together worked for the U.S. Army. And then we worked for a security company. It is also an American one. It was called Torres. And we worked for that company also for one year. And then, you know, we came here. This is our last destination. And you're staying? Yeah, yeah. Thank you so much. Thank you. On behalf of Masjid Bilal Ibn Rabi, Muslim community here in San Antonio, we welcome the refugees and all those who support them. We are impressed and championed all of the efforts that are being done to recognize the imbalance and the injustice that has been done to people all over the world.


The people of Burlington and the people of color in Burlington have elected you to take care of us Please do that harm reduction the the overall goal is To transition from use to recovery So it's it's helping people make steps to that in that direction without coercion or force. My real purpose is To stop these annoying calls that disturb the elderly and handicapped For a lot of people it can be hard to stand up and walk to the phone just to hear another robo call We did find in our research that girls are taking advanced level math and science classes in high school at Comparable rates to boys. It's much much higher than it used to be However, when they go to college, that's not translating into choices of major. We did gender identity training It was two years ago, but we invited the LGBTQ community and to do Gender identity training but beyond that if it's important for us to have a specific liaison I'm sure that we could find somebody who would take that on so we have two events coming up We have one on the 30th of May, which is at zero gravity. It's a mix and mingle We'll have public access TV bingo and door prizes and beer and and then on the 13th of June We're having a screening at the film house in Burlington on the waterfront and that'll be a retrospective Screening of the past 35 years. We're putting together those segments now and a reception and a little party Is there any further discussion about the transportation component of this? Hearing none all in favor say aye All opposed the ayes have it was unanimous of all the intelligent sources. I have read and I've read a lot of them Christopher Steel is the only one who identifies this Russian traditionalist world order as a as A goal that rush this motivating animating Russian activity And I always say if believing that every child young adult an adult should have access to equitable services and Access to resources in an equitable manner regardless of gender sexual orientation race ethnicity disability Any type you know religious beliefs if that makes me politically biased I'm very proud you know to be to carry the bias with me We know that in the summer kids have what they call might call summer slide And they if they don't continue reading throughout the summer that they can almost lose a whole grade level So we focus a lot of energy on that window allies become valuable in the eyes of the law When does hate cease to be exonerated behind the badge and lighter skin and God forbid you wear a hoodie in the rain while having black skin with skittles in your pocket You can taste the rainbow, but you can't taste freedom You can taste your own blood, but you can't taste the rainbow and car fentanyl and all these other synthetic analogs as a form of Bio and chemical terrorism and ever since I've been coming to the NPAs I've just been so captivated by this awesome place for community members to connect and have open discussions Especially the fact that the very first item on the agenda is speak out. I think that's so cool


Hello, everyone and welcome. This is Melissa Armour with the Stock Swoosh and I am looking at WFC. So I had a couple emails today about what is involved with the Entry's class. Again, there's no prerequisites for the Entry's class, but I do think that it's more valuable if you've taken the golden gap as far as what you're gonna get out of it, because again, you still have to be looking at the right stock in order to get the entry right. Do you follow what I'm saying? Anyways, long story short, this was one of those trades where the Entry's class, you would have learned how to do this or how I saw this to do this trade. This was WFC, we shorted this. This was November 3rd. This was a really big train because my position size was large and it would have been big for anybody that did it that did all the ads. So the advanced class, the Entry's class goes over how to do ads. Where to know you get the confirmation, where the placement is of the Entry, where you can take more size. And sometimes that when we do an ad, we double our size. So it's like two trades in one. Sometimes when we do an ad, we triple our size, which is like three trades in one. I can't remember the last time we really did four trades in one, but anyways, this had three ads, which was really, really great. And so this is a good example of what you learn how to do and how to find it. And the Entry's course was this WFC. And again, we shorted this and this went to the target. The target was 22. Okay, here this was again, this was the into the close here on the, well this was into 315. Came down here, but it really hit, you know, three o'clock, 315 in here. You could have got out at three o'clock. Target was 22, which I'd called in the morning when we did it. So this is a trade that you could have been in theoretically all day. It was up and it dropped pretty much into the close. Went into close, went to the target. The target was only 30 cents from where we took the trade and yet it was a huge trade. Why? Because of the ads, because of the ads that we did, okay? And the stop placement. So, you know, this is the kind of thing you'd learn how to do in the Entry's class. And again, it's an advanced Entry's class. You don't have to have done the Golden Gap course to take it, I do think it helps. Because again, you have to be looking at the right stocks to go long or short to take the Entry's in. Okay, which is always the case. But anyways, this was a really nice move that did what it was supposed to do. Timing was right, stop size was great. Went to the target, had the confirmation multiple times and went in the right direction and you could have done the ads. So, you know. And again, that's not something you have to do but I've been calling them in their room which I know not everybody understands what I'm calling them. So, if you're interested in learning what I do with that, that's what I teach in the half day class. It's a half day class and I'm running a sale for the holiday if you wanna do it. So, and it's gonna be in December. So that's a scoop. Any other questions, just feel free to email me.


here live from the national in Atlantic City. This is Friday. This is our second break of the day. We have 2022 tops tops tier one baseball. 12 box case number 15. Pick your team style. Got Alexander M. Padres, Andrew S. Rays, Chris S. Pirates, Daniel V. Metz, Darren V. Rangers, DoD, Cubs Marlins, Brewers, Gilbert with the Tigers, Gerard Giants, Jessica Rockies, Jimmy L. Mariners, John F. Royals, Kevin C. Guardians, Kirk has the Yankees, Cardinals, Red Sox and Dodgers, Matthew W. Bluejays, Rich F. Phillies, Brian M. Braves-Reds, Twins, Sean T. Orioles, Sho, F. Angels, Simon S. White Sox, Steven M. Debacks, Suzanne with the Ashtos, Tyler, Nationals, Utah Aids. Good luck everybody. Thank you very much for joining. We'll switch over, filter out some of this noise. Here we go. Favorite Red Sox for reliever ever overall? Oh, I saw. Yeah, that's a pretty tough answer. Jersey Card, Yankees, D. G. Lemay, Huda 399. Gage to mechanism? I'm gonna forget. Yankees on that one. Moises Alou on the Ashtos Auto Bronsig. I've never seen an Alou Ashtos card. It's a 25. And a good first box here. Bat Relic Auto going to these Twins. Paul Molitor to 99. Minnesota Twins. McDodger's Trey Turner to 399. I would probably say he's one of the most underrated players in baseball. It's a 299. Auto, Nick Fortes, Marlins. Favorite Red Sox pitchers, Pedro. Matt Olson, A's Auto to 299. It's Pedro, then a wide gap. Then for me, I'd probably go, for me personally, what I've watched, I'd go Leicester. And then probably Beckett after Leicester. And then I'd probably get to it. I'd probably get to sale. I know that the contract now doesn't look good, but when they got him, he was, dude, like 300 strikeouts, season, stuff like that. Nasty. Plus, he closed out the 2018 World Series. Jersey Dodgers playing Kershaw to 249. That's just me first, though. Jersey Carter, Tyler O'Neill to 349. Pardons. I don't watch Clemens on the Red Sox. And like, I'm at the age where Clemens in my mind is like a Yankee or like an Astro. Rookie Auto Orioles, Spencer Watkins to 299. And Brandon Crawford auto to 299. Giants. Derek Lowe's a good one too. Yeah. I don't have to change it up. Maybe Lowe over sale. Maybe Lowe over Beckett. Jersey Card, Metz, David Wright to 249. Jazz Chisholm auto to 299, Marlins, nice jazz. And now you see it Orioles, bronze, ink, auto, Eddie Murray, nine of 25. Wakefield. Wake is a good one. How could I forget Wake? He was there for 30 years, I feel like. Like it's your race, man. You got 249, Blake, Snell, Badres, Serena's favorite baseball players, G-Man Joy. Got Jake Myers, Rookie Auto to 299 Astros, which is a great answer. G-Man's awesome. And auto for the Cubs, Fergie Jenkins to 299. The top voters for these, if you have 75 point, those probably work the best. We're using 100 point currently. We didn't bring 75 points, top loaders, but they will 75 should work perfectly. The relics to be 130 point for the most part. Rookie Jersey Angels, Brandon Marsh to 249. He's like the new Charlie Blackman, just because he looks like that. He plays outfield. Rookie Auto raised Josh Lowe to 299. He is super under it. If Troy played for like a bigger market team, he was in a spotlight. People would think he's like a well above average first baseman, especially for power hitting in 299 A's, Matt Chapman. And he's good defensively too. Like he's one of the rays that I'm afraid of when he comes out of the bat. I just, I don't know. Yeah, Rich was telling me that there was a batbarrow pulled and it was Joey Gallo. It was game use. Are you sure? Did he play it for the Yankees? Cardinals Jersey to 249. Paul De Jong. And that's called KK. That's called Auto Lopez, Rookie Auto Blue Jays. Nice auto, auto. And twins Byron Buxton, tier one, salad auto to 299. Then he packed here. There we go. Jersey car, low cane to 399 Brewers. Jersey car twins Byron Buxton to 349. Is that Michael? Rangers, Rookie Auto, Yanni Hernandez to 299. And Darryl Strawberry, he signed all over the place on this one, to 149, Matt's auto. Are you a master of right now? I think that I'd do it here. Jersey, Boba Shet to 299 Blue Jays. Rich, Matt is ripping masterwork right in front of me right now. Got from El Reyes to 299. Auto Cleveland is very distracting. I love that word. What's that? Red Sox, Rookie Auto, Jared Durand to 299. I know we're watching each other, but breaking different things. Speaking of Star Wars, guys, Star Wars Finest releases today. Those breaks will be tonight. Make sure you check out the schedule on the website, guys. Top's Finest Star Wars. Jersey car and Braves are on the Junior to 149. I, for one, love Star Wars, so I just won. I'm so glad they're coming out with more Star Wars products. It's honestly overdue by tops, I feel like. I think. I just realized I say I feel like all the time. I must get annoying, guys. I'm sorry. Red Sox, Ricky Jersey, Jared Durand to 199. Orioles, nice hit here. You got Cedric Mullen's Auto to 299. Yeah, Brewer's Rookie Auto, Jake Cousins to 299. I do always say that. I have to change it up. I have to, I don't know how to correct it. Ooh, we got a nice hit coming. I didn't see who it was, but I know what the card is, like what style. Batralli Cubs, Ron Santo to 99. What's up, guys? You guys having a good day? Oh, okay. Gotta get you. Gotta get you a hit, then. Austin Meadows, Auto for the Raise to 299. Got to pull a Philly's hit now, guys. Have to. That's a nice card. Royals, Salvador Perez. I like these. A clear one. Clear one, Auto, Salvador Perez, Royals to 10. Pull the Shohei yesterday. All right, last one. I'm going to need a Philly's hit. Oh, dude, look at this one of one. Triple Patch, one of one, Astros, Michael Brantley. Three colors on the bottom and the top patch. Unfortunately, there is one of these, like, seal lines on the bottom. So we're going to send them to box and wrap her with that one. It's factory damage. Nasty Brantley, though. Congrats, Astros. Got Kent Herbeck, Auto to 299 for the Twins. And on the back, Astros again. Wow, what a box free. Jersey Auto, Jose Altuve, it is 75. Ice Altuve. That's going to do it for the break. Thanks again, everybody. Got another case coming up next.


Welcome folks. Hi, Jeffrey. Hey, good morning, everyone. Good morning, Kayleigh. Give it a few minutes for people to trickle in and probably get started at five after. Also, while we're waiting for more people to trickle in, if anybody would like to add anything to the agenda, please go ahead and do so. Okay. If everybody's cool, let's go ahead and get started. Just a reminder, these meetings are recorded. So if you ever want to go back and re-watch something, you can, and then additionally, you know, try to keep our conversation civil and clean. So, CubeCon just passed. I apologize, Taylor and I. We took last Monday off, so we missed some stuff. I know there were some security discussions. I don't know. For anybody who was here last week, did you guys kind of do like a recap? Any like solid sessions that like the groups you go back and watch, maybe not seen enough specific, but things that might like relate to our field around like the security space or the networking and plumbing space or anything like that? We can put together a list if that helps. I don't think anyone's gathered them. It's just, yeah, because the YouTube videos or the recordings are not released yet. Sure. And if anybody like, there's one line where I just, this was really just a chance for someone to like speak and be like, oh, this was really cool. I think the group should look at this. And then I think Frederick, it'd be a great idea to your suggestion that once all the videos are uploaded and available, maybe we just kind of put like a little miniature library together of things that we should like look into. Trying to think. So we did have, looks like Taylor's got a cool list here. So we'll go back and look at those. Maybe, you know, we'd like to discuss some of the things that came out in them. I know there was like the maintainer track. We had a couple of people. One thing we might want to consider too is, you know, the maintainer track was of course on the last day about dinner time. So we did get a lot of people from the Asia Pacific region that showed up to the call or the presentation. So one thing we might want to consider too is obviously we've had a very, you know, Western Europe, North American friendly time. We might want to consider in the future how we get some of our friends in Australia, New Zealand, China, Korea, et cetera, India more involved. So Taylor's put that list up. We can add links later once they become available. And if anybody wants to go back to the notes and add some sessions that they think were awesome, please do. I don't know if anybody's got some topics they want to dive into too that I kind of want to look in is I don't know, Frederick, if there's anything from last week that we need to continue to double tap on. And I see that Ranny's on here, but I was actually thinking now that we're kind of past mostly ministry stuff, we've been talking around best practices. I do think working asynchronously will help us and we can start fleshing some stuff out. But I think another topic that would be really good to look into is Ranny had started this discussion around dealing with NAT in BGP. So BGP is a faculty life, obviously in the CNF space and NAT is everywhere. So it might be something, I thought it'd be like a good discussion post-CubeCon to start like digging into alongside some of the least practice or least privileged security best practices, et cetera. So if anybody else wants to potentially add new topics or say, let's look somewhere else then by all means please speak up. Yeah, on the security part, I'm going to put together some, I'm going to do a little bit of writing to discuss the software bill of materials and with the some of the stuff that's going on there and how we can start to put recommendations towards people building towards it. This is, it's still a very early space. So the tools are very immature but there's a lot of work that's going to be put into that particular space because one of the requirements are sticking in the US government is that critical infrastructure also follow the guideline or follow the requirement I should say. And the question that becomes how long will telecom be considered to be or service provider be considered to be critical infrastructure? And if so, when will it be considered? So they may not give, they may not initially define it but they may expand it over time. So in short, what defining for people or describing for people what it is and where things are heading even if there's nothing concrete that they can do right now because of the maturity level it's still useful for people to know what's coming down the pipeline. So I have some stuff I'm going to write on that and I'll put it inside of a full request there on. Cool, and I was looking at last week's notes. So yeah, the signing and verification of signatures is this eventually going to lead in like I know I've talked to Taylor about this we had some discussions about air gap installations private repositories, et cetera. This is actually a topic I've been looking at internally myself recently is this notion of signed images and creating trusted repos only allowing things to deploy into production that are signed, et cetera. Which I feel like one of the things about cloud native and faster and more agile software releases is sometimes we collect things a little fast and loose and they need to go fast sometimes outweighs our need to be safe. So I'm just curious too, Frederick if that's going to be involved in this I know it's something near and dear to my heart is if I'm working with vendors one, two and three like how are we creating that secure supply chain between them in the microservices and CI space? Yeah, it's part of it, but excuse me it goes a bit deeper than that. So it's actually looking at not just what's the signed image but looks at the contents and tries to work out what's within those signed images and does so recursively throughout the vendors. And part of the idea is that let's say that someone pulls in a library that has a vulnerability in it and they compile it in statically so your images don't pick it up. Then because it's in the software bill of materials then you still have visibility into the fact that this thing was pulled into your system and ends up giving you the ability to rely on tooling that has information from the source as opposed to relying on image scanners to try to pick it up. And so it's part of it is trying to move the bar is trying to move the bar further to the left in the build system. But the other part on it which is where I think the real benefit is if we can pull this off properly as an industry is going to be around the additional tooling we get which allows us to determine what's in our infrastructure because a large problem that I've seen on major enterprises is that many major enterprises have no idea where things come from or what's running. Somebody leaves the company, their server is there that they're not sure if they can shut them down or not because they might be doing something important. And this will help give them some of that visibility as well into by maturing the entire tool change. So a lot of people will hyper-focus on the Esfam itself which does provide some utility but I think the real utility is going to be around the tooling that generates around it. Anything else that we want to touch on in this space? This up here in case there was anything that didn't get finished last week I wasn't here so I'm not sure where you guys ended because it's not. Rainey I don't know if you would let me put you on the spot or not but I was wondering if we could potentially talk about this discussion you started if you wouldn't mind potentially giving us a little overview and we could kind of talk them. This is something I know specifically as a service provider is near and dear to my heart. And I feel like there's probably multiple ways to address it so. Yeah it's been a while as you can see February it's like nine months ago. I'm not sure I remember what triggered it but anyway I think just there was some discussion that reminded me of some similar issues back in the days from the sleep and voice over IP days. I think some of the concept might be applicable here. Basically it's the idea of your network function running in a cluster and the local IP address of that the container sees or its end of the IP socket may not be the actual public IP address and there needs to be a way for the network function to know what is the externally routable IP address so it can advertise it in something like a BGP. So there are several techniques out there. I mentioned a few of them. I don't know how prevalent they are these days but stun and turn used to be popular like 10 years ago. So something like that may be used as a best practice for a network function like a router to discover it's externally routable IP address and use this in the application protocol, in this case, BGP. Breathe in true. If anybody else wants to chime in. I know Ian and I have talked about this one a lot. I think this one is interesting, like just the concept of putting a route reflector in containers inside of Kubernetes. You know, it's not as straightforward as you would think it would be and specifically for the like issues that Rani just mentioned. Everyone's quiet this morning. I always talk a lot. I mean, so some of the things that we can look at right is obviously there's some of the things here. You've got the any other ideas. I know to, there could be, this is always the dangerous one, but CNI based approaches, right?  So then theoretically, you can go and host your services in a pod that has an IP address that is advertised and therefore is the source address versus adding through the host address. I don't know if anybody else has got any thoughts on this. I'm also curious, do you like, I've done limited stuff with this, but if anybody's got an experience like the notion of putting lots and lots of these endpoints out there and BGP best practices around where you set your aggregates et cetera, so that you don't constantly have a bunch of entries being added and withdrawn as pods spin themselves up and spin themselves down. I think there's probably even just an engineering context is more and more people look at peering what they're underlay with both Calco or Sillian. We could put out some best practices or work with the network plumbing group because I think this would probably be within their space as well, but like how do you sit there and properly, look at this from like a large scale network perspective with BGP as far as how and where to advertise. I don't know if anybody's got any thoughts on that. But it's something where like I've seen where we've done like limited context and stuff, but like the way that we handle our route tables in some cases are quite massive and having tons and tons and pods come up and come down. It's not something we've won. So we basically set like, we use EBGP a lot more than IBGP for instances like this to make sure that we're like protecting the bigger route tables. This is a bit of a connection storm issue basically.   Finally, Sillian has support for BGP for having read this article, but I mentioned the BGP support there. So are the options then to either say that you have a separate service for setting it up or you try to do it in the, let's call it the Kubernetes control plane or you try to do it in the networking control planes. Are those the three options or is there a fourth one that we just haven't considered? The three option and the one that I've seen used the most basically is not necessarily advertising this pod space, but rather to bring a specific interface to the pod being that route for reflector and leverage, like was mentioned, CNI based approach. So you could have multiple interfaces and then touch a specific pod. We have a specific interface. You know the other service with the specific interface that does that and then it sets up the rest of the network from there. Exactly. So you wouldn't necessarily touch or do anything regarding the pod service itself or the Kubernetes layer. You would just bypass it completely by adding an external interface to it. Yeah. One thing I just kind of wanted to mention on that topic since we run into some of these issues when we're talking about Kubernetes interfaces, of course that everyone now seems to be talking smart nicks of one way or another. So even if you're using CNI and Syllium and whatever happens, the offload of larger pieces to these kind of smart nicks coming in will probably be the next step for a lot of the telecommunications space just for cost pieces mainly. I think I misunderstood something. Is the goal to have the CNI handling BGP or is the goal to have within the cluster an application or a pod that is say a route reflector and the application or the pod itself is handling the BGP traffic? Exactly. Is that where we're getting into that point that then we're doing packet processing on a CPU again? So we're trying to like catch up with all these notes. So one, I think we're just like spitballing here and coming out with discussions, right? So for one, the smart nick thing is a completely tangential thing. I would say that side like, I was just mentioning CNIs because this specific topic right here is around NAT, right? And so really just BGP, we should probably start a discussion around just like BGP pest practices, which would I think fall into like the security or least privileges kind of like top level domain where then you would have lots and lots of subdomains that we could tease out. So like a CNI is just one way to do it, right? Because you can basically get away from NATing by directly advertising pod space but there's definitely some pitfalls into that especially around some of the discussions that were just managed on, you know, who is managing the control plane at that point? Are we having the CNI talk to something? Are we gonna have some kind of plug in?  Once we start mapping this into our underlay, right? Well, like I said, we've done limited stuff. We're like, we'll peer like specific clusters like a limited set of pod space so we can advertise like cluster IPs, et cetera.  I mean, there's much, much bigger implications. Pardon me, I can't talk this morning. Haven't had enough coffee.  I mean, the whole concept of BGP and Y is popular is because it's stable and it has this notion of convergence, right? Like, so what does that look like if something is constantly churning? And I mean, it's doable, right? We see this with like, you know, VXLan and EDP and implementations and routing by MAC address, et cetera.  So I would say, you know, the SmartNICs would be one path where we might do this and then we'll let the SmartNIC handle this and we've passed that through into a pod. There's the concept of I'm gonna put something that needs to understand and speak BGP within the pod. So then how do I handle the NAT issue, which is what Ranny has up here. I think there's a lot of stuff that we could tease out in the space. I would like to capture what we'd like to have in the future, even if it's not, doesn't look possible now versus what we can do today. So they, in the original discussion post Ranny had listed the application querying the orchestrator about the assigned IPs. So that one seems more like dynamic services and treating this whole thing that way. And there's probably other areas that that could expand on like being able to use the SmartNICs and anything else that comes up. So an ideal situation, what would that look like? And saying, here is how we would love to be able to describe our services this way, the BGP and here's how it would work. And some of it may not be there, but if we could say, eight out of 10 or six out of 10 pieces are ready, but these four critical ones aren't, then we can go and actually share that directly with like the Kubernetes plumbing working group and SIG network and everyone else and start pushing that forward while we also work on what can we do in the meantime solutions. It seems like if you're gonna have, if you're not going to directly attach interfaces to a pod that's handling the BGP and maybe even you're using some way of directly attaching that pod to a SmartNIC that's off where you're offloading stuff, then you're gonna end up with some type of BGP that's broken down further into components where you're needing some service level. I don't know if that means an operator or if there's something else that's more generic that's expanding on the current capabilities for having IPs assigned to services, which you can do, but it doesn't seem like that's handling everything needed right now. So potentially we're getting into that service chain where the service connects to an interface that then does the BGP and then whatever it runs that on if it's CNI or the SmartNIC or whatever. Well, I want us to like keep the, sorry, I was talking in the mute, trying to answer you Taylor, like there's definitely some like lines of responsibility when we talk about attaching an interface, right? Like if we pass a SmartNIC into a pod, then we're giving it the physical interface versus a TAP interface, et cetera, but like I think what we're really discussing here and please correct me if I'm like not thinking about this right is really the provisioning of said interfaces, the provisioning of said services, like what are the lines of demarcation between potentially Cates and a generic CNI like type of exposure, something where we're actually passing forward, sorry, passing through some type of physical interface to a pod that's been like offloading some of this capability so we're not actually doing that packet processing in the pod itself. And then like what the relationship between the Kubernetes control plane versus the rest of the network control plane looks like, right? But I mean, I think we got to be careful saying that like if we use a SmartNIC that we're not like attaching an interface because we still like how we attach that SmartNIC to the pod it's either gonna be some type of direct pass through or it's gonna be through a CNI, right? Like using, I don't know, like MULTUS and DSRV, said CNI, et cetera, right? So, it sounds like we're really talking about this. Say that again. Yeah, it needs a similar setup. Even if you're using different components to reach the same end result, what you want to do is that you want to make it easy to set it up. Yeah, this is how you can connect it. Right, because at the end of the day, right? We have an interface to a pod that like exposes it to the rest of the network, right? Like that doesn't go away. There's just a lot of ugly ways to do that right now and exploring the best way. And BGP because it's very finicky happens to have some strong opinions on how you should do that. So then that's when we have to start figuring out like do we just put SmartNICs everywhere and use node labels and just say, this is a NIC that's gonna make this a lot easier. It's gonna handle all of the BGP negotiations here on this discrete chip on the NIC. And then it's gonna have an interface that passes through directly to the pod and all the pod does is offload traffic to it.  Cause there's gonna be a CNF developers who are gonna develop software that does packet processing in pods that is ultimately gonna need to be able to then talk to the rest of the network. Which I think that's probably one of the like things that have been like hotly debated since MOLTIS and everybody first showed up on the scene, right? And the film stuff, it was really good for quite a lot of traffic. We've been playing around with it and it seems to be working, but the key is how much traffic are you actually pushing through it or not? I think one convenient thing about this use case too versus some of the other ones is since this is a control plane exercise too, we don't have to get super far into the weeds around data plane acceleration, et cetera, right? Like this is specifically around understanding how to basically advertise routes, withdrawal routes and do this within a potentially nadded and containerized world. So I would like to just call out that and while I know at some point, this BGP speaker would probably be attached to some type of data plane as well that we would then have those things. Like we don't necessarily need to solve this IRV and fast packet performance in a pod for just pure BGP. I think if no one else has any topics they specifically wanna discuss right now, I'm gonna start putting in some PRs. I've been kind of like slammed with work and getting past the conferences, but have some things to discuss and I know Frederick said he's gonna do a write up, but is there any other topics that anybody would like to add to today's discussion? Okay, then we'll give everybody 25 minutes back. Oops, that's stuff in chat. It's just a meeting notes. Excellent. Okay, I'll chat with everybody next Monday then. Thanks everyone. Thanks, Chef. Thanks, Chef. See you. Bye. Thanks all. Good day.


Here's more from Boone now, including additional thoughts on what Morales brings to the Yankees. Obviously a switch hitter, you know, to balance out our lineup a little bit. So, and we feel like, you know, even in Oakland, I know the numbers weren't great, but we feel like the underlying numbers were a lot better than what he's done so far. You know, coming off a good second half of the season a year ago. So, a chance to get a quality major league hitter, I think, is definitely something that was exciting, especially in the short term right now. His body of work, his career, this guy's been a really good hitter. I mean, we've seen it firsthand, obviously playing in this division with the Blue Jays the last several seasons. And basically we feel like he's still that guy. And just because the numbers weren't great in Oakland, you know, some of the underlying numbers suggest he's a lot closer to what he's been the last couple of years than what the immediate numbers were. Obviously we needed that spot and knowing that he's not going to throw for four weeks.  So, you know, always concerned when a pitcher goes down with an injury. But right now I'm treating it as, you know, what it is on his face, which is the shutdown. And then hopefully he's able to build up and be a factor for us at some point this season. We're probably talking about at least a couple months now before he's an option to get back with us. So, you know, a lot can change between now and then as far as what our needs are, where we determine he's at. So all those things will kind of factor into what kind of role he has for us potentially in the second half of the season. It does seem like it's going well and there's small improvements every single day. But we're going to get to the point where a range of motion and the exercises that he does where that feeling it at all is going to be out of there before he graduates. I know he was in there running today and he's doing lower body things. And he's doing, you know, the exercises, the bending, the range of motion things that kind of test it out. But all with the idea of pushing to the limit of not feeling it. And once that feeling is completely out, then he'll start graduating baseball activities and we'll have a better timeline on things, but he's not quite there yet. I've just been pleasantly surprised at how much he's surpassed what I envisioned in every way.  He's fit in really well with the group. There's been an energy that he's brought to the ballpark every day. He's been a really important player for us in his time and it's, you know, certainly we needed it. And he's been really, really fun to have for us. I mean, there's times we're sitting over there on the side and we'll be like, wow, that looks like a right handed slider that he just threw. The movement he gets on pitches and, you know, when he's, you know, in a good place and filling up the strike zone with it, it's a big time weapon and I feel like he is continuing to get further and further away from the injury and get further and further back to being, you know, the dominant reliever that he can be. I feel like he's throwing the ball really well right now. Kind of the way looking at it is obviously everyone's available in this first game. We'll do all we can to win that and then kind of depending on usage, there could be a couple of guys that we potentially use in a second game just depending on how they come out of this first game.