Hi everyone, my name is Libin, I joined with Suchit and her chef from Visipay. We are this of course engineers in Visipay and in this talk we like to talk about local availability, how it affects us, what did we do to mitigate it and the steps we took and share the lessons we learned which we all could use in situations like this. Those who do say a bit more about us, we are deaf-searched engineers from Visipay working in different areas and fantastic development and operations. Next slide. So during this talk we like to discuss about what local availability is, the nature of its availability, the areas affected, how did we mitigate it, what are the steps we took, what are the countermeasures we tried, what worked and what didn't. Next slide. To say a bit about our company, Visipay is a fintech unicorn startup based out of India. We work in the new banking space, helping customers have their financial efficacy while they can focus on their business. To talk a bit about numbers and stats, we run roughly 600 teams with 600 current engineers, 100 plus microservices of the last year alone over a wide variety of tech stacks including GoPHP, Python, Java, Node.js, kind of anything that you name it and roughly 2000 deployments per month. All these numbers are just to show how complex, fast-paced deployment or infrastructure is kept up and running while such a series of security vulnerability occurred. Next slide. So what is all about? We all heard about low 4J unless you were in application for like two to three months. So low 4J is an vulnerability that occurred somewhere during December 9, 10 last year. Critical vulnerability, it occurred on a particular framework for logging in Java called log 4J and it courses an RCE or remote code execution. Next slide. So as you all seen, it's been affected by many, many of our enterprise services all over the world, whether it's Amazon, Apple, IBM, Juniper. So the funny thing about this is we normally use our login library to log information about application in some cases, whether to know there's an attack or an exception occurred. And this vulnerability itself affects the login library. So whatever you used to log, if there is a malicious payload, the available library itself will give you an RCE. So that's why the memes are there. So next slide. So what's this about? So this particular CVE named W4W8. First disclosed around December 10 last year. Courses an RCE in a library called log 4J and the name is at log 4 shell. And what it enables a hacker to do is to cause a remote code execution, meaning he can send a particular pattern of payload into a service and execute a code into that service, causing harm such as availability or run some malicious code which bring down the server or extract the data, you name it. But why is such a serious issue? Because this is not the first critical vulnerability that we see. So let's see why this stands out. Next slide. So we'll talk about four attributes of this particular vulnerability. First one is impact. So unlike many of the previous vulnerabilities that I've seen, log 4J is used by most or millions of softwares across the internet. Most of the Java-based application use log 4J as their local library. Now talk about criticality. This particular vulnerability causes an RCE which let users execute code on servers without pretty much less technical knowledge or any other precondition. So it's a pretty critical issue which is why it's given CPSS 10. Now the ease of exploitation. So it's a very simple attack. You can send a very simple payload in any request and get opposed to a server. We can have it in its headers or body or any request. And if that message, this particular message is being logged by a vulnerable library, it can cause the same attack, right? So it's very easy to use, made it very scripted, friendly. A lot of people started using it. We saw a lot of noise and attack patterns over the internet. And the last one is the availability of POCs. Soon after the first vulnerability was discovered, we observed a lot of POCs out there in the internet, which helped a lot of people create botnets out of this and a lot of attack patterns were thrown out in the internet, which were used by scripted all over the world to attack many services out there. So all of these four factors combined make this a very serious issue, a very critical issue because as soon as the availability was discovered, we started seeing all of the servers getting hit. People started reporting destructed services, data being extracted and all of this, right? So next slide. So what is this log4j, right? Log4j is a project from a passion of the foundation. It's an open source logging framework. It's used by millions of services out there, mostly by Java-based applications. And next we talk about a little bit of technicality here. So log4j uses a particular lookup feature called JNDI. It's called Java naming and directory interface. Why we should know about it? We'll look at it in the next slide. Next slide, please. So JNDI is an API framework for applications to interact with remote objects registered with, let's say, RMA registry or a service like the LDAP. So JNDI helps any Java applications to access these services remotely and secure classes or functions that you need, right? Now, why is it such an issue? Because from any Java application, you can use JNDI to call services like DNS, LDAP, NAS, and many more, right? So log4j uses this lookup in its program, meaning in log4j, you can call other services, mostly say LDAP, right? Now, why this is important? You will see it in our demo in next slide. Let me walk you through the timeline of log4j next. So now we go to know a little bit of log4j library, what the vulnerability is, how it's affecting everything. Let's see what happened during that period of time when this vulnerability was discovered. So at first, the vulnerability was called as a denial of service attack, moderately critical, meaning it was given a score of 3.7. Somewhere around December 10, the researchers were able to further exploit this attack to create an RCE vulnerability, causing a new CVE being reported, which escalated this score from 3.7 to 10 or 9, and immediately after Apache Foundation released the first patch, which is 2.16, soon after the patch, researchers were able to find another further vulnerability, caused them to release another version called 2.17, and soon after another one for 2.7, 1.7.1, meaning it was just not one vulnerability that was reported, but a series of vulnerabilities causing multiple patches from 2.15 to 2.17 over a period of two weeks. So from a team's perspective, from a consumer perspective who are using these vulnerabilities, we just didn't have just upgrade once, but we have to upgrade thrice to have mitigations in place. Next slide. Now let me walk you through the slides or the time that happened around in Recipe. So around December 10, at that time, we first started observing the reports about a zero day about a log4j library vulnerability out there in the world, and soon after, we saw a spike in our traffic. A lot of anomalies were being hit or being sent or requests, invalid requests being sent, and we immediately form a team or a one-room. I think all of us did, and to analyze this traffic, and soon we confirmed that these traffics were indeed log4j payloads being sent to us, and as with the everybody team, we first applied the managed web rule set. I think AWS released the rule set, which is which we get this particular vulnerability, and but soon after, we figured out that this managed rule set didn't work for us, meaning it was blocking certain legitimate traffic. It was also not blocking certain traffic, which were, which have maybe newer variant payloads, right? So we switched from a managed rule set to a custom rule set. We started modifying these rules with updated patterns so that they mitigate these new payloads, new variants, also allows our legitimate business traffic to go through. And around the same time, we also started looking at the assets that we have, meaning how we are impacted from this vulnerability, right? So we use a lot of services which run across different landscapes. So if you want to know how many of our services were actually impacted by this particular vulnerability, right?  So next slide. So to know about log4j, right? So it's not really that easy to figure out whether an application is using log4j directly, or whether it's using indirectly, or whether one of your third parties is using it. So without further ado, we immediately passed all of our servers with first earlier medications which were released, meaning without getting affected, there's no time to manually verify all of the services which were affected. So we immediately passed all of the reductions. And then at around the same time, we started updating our VAFOS with Honeyport data. So why that's important will be discussed in the further down slide. And as soon after updating patching of reductions, we started packing patches using our asset inventory. So a bit about asset inventory will be explained to me for the slides. So it's, in short, it helps us identify which assets uses what kind of components and how they are mapped to different infrastructure components, right? And after that, we started a long journey to patch our services, which are vulnerable to log4j particular attack. Next slide. Next, we'll see a demo of how this attack works. For that, I'll hand it over to my colleague Sajed. Sajed, all yours. Thanks, Sajed. So yeah, like how we've been, you know, explained on how the attack started and the, you know, it progressed. So, you know, we, you know, let's, let's look into how the attack works. So basically on the technical aspects of the attack.   So once identified, the malicious payloads to the server, you know, basically in the request in the form of some headers or very parameters. Like as you can see in the diagram, right. So below the second, you know, entity, you can see a request basically which has, which is highlighted in red. So that is how the payload looks like. So, you know, once this is sent, the victim server logs this particular request using log4j. So here is where the vulnerability is.   So, looking at the same, you know, basically looking at the, you know, attack, we do have a small demo that we can look at how the attack basically works. So, I mean, sure, in this right, we can look at this particular screen. So we do have a two terminals running one on the towards the left, basically is, you know, just part of the screen is basically where a victim or a vulnerable server that is running, basically, you know, server that is using log4j. And, yeah, towards the right, we can see there is a LDAP server that is running. Basically, this is a malicious LDAP server that, you know, that is attack of control, basically running on 1c894. Yeah, so, yeah, so basically, you know, we do know this is a RC. So, you know, for us to identify how the RC works. So here we are running a listener, basically listening for ICMP package on this particular interface, and basically, you know, this is the application that is running or using log4j, which is running on localhost ATT.  For example, if we look at the terminal on the right, so where we are sending a call request, so we are, we are sending a call request to localhost 8080, that is the vulnerable server. And, you know, we are, we are adding a header XAP of origin, which is, you know, which is basically, which has the payload of, you know, log4j. So, the payload is, you know, it contains LDAP pretty well. It is sending a request to the attacker's controlled LDAP server, but some, some, you know, payload in that, which, which I, you know, explain what the payload basically is and how it looks like. So, yeah, so if you look at this payload in the end, so this is a B64 encoded payload, which basically brings the listener that we are running, that is running on one, one and two, one, six, eight, fifty six dot ten. So, that is B64 encoded and it is used to hit that vulnerable server. So, as soon as, you know, we hit this request using call, we can observe it on the left side of the screen, which, you know, where we start getting hits. So, this confirms that, you know, the payload worked and we started getting there and our ping on the receiver. Just to point from this, we'll try to log into the, you know, vulnerable server using, you know, Docker Exit. So, we can see what exactly is happening itself. So, by a simple PS, you know, we can see that ping on this particular IP is basically run. So, this confirms, you know, that there was a code execution on the victim server. So, yeah, coming back to the slides, we, you know, we saw that, how that works. So, moving on to the response side of it, you know, how did we respond to this? So, this basically, you know, we had a three-step process where, you know, we started with a short-term, medium-term, and a long-term. So, the short-term, we, you know, concentrated on back updates, on updating back rules, then adding environment variables with containers, which will be covered in detail for the slides. Then, in the medium-term response, we did, you know, we did use data from Honeypot, which again, will go in depth, and we did a DAX simulation. And in long-term, you know, it was updating the affected versions and, you know, basically the updates. So, you know, moving on. So, this was one of our, you know, short-term or short-term response. So, where, you know, we started with BAF. It was basically our first an earlier of defense. A few things to talk on BAF, right? We initially went with this, which is AWS managed BAF, which did not work well for us as it was very generic, and it did block a few of our management rack. So, you know, as a result, we had to move to a custom rule, custom rule set, where, you know, where we manually, we constantly and manually updated the rules after our defense. So, we were getting this, you know, the payloads and bypasses from few ordinary online resources, such as Twitter, blogs. And one of our major sources was sans, you know, a honeypot that was set up by sans. So, yeah.  You know, these were the rules that we were using. And moving on, like, you know, talking about updating BAF rules with honeypots. So, why did we, you know, reach here is one of the things. So, you know, there were a lot of bypasses. I'm considering this BAF and we are using some some sort of patterns to, you know, predict it. There will be a lot of bypasses that will be coming, you know, as initially we were relying on BAF. We had to look for bypasses. So, based on the payloads and, you know, bypasses, we were adding custom BAF rules to block malicious traffic. So, for this, we use sans honey data from sans honeypot. Basically, sans had set up a honeypot which had a lot of data coming with respect to the payloads and bypasses. So, talking a little bit on honeypots, you know, sans have set up honeypots. So, basically, these honeypots are some systems which are used to lure attackers to gain some insights and inform their hacking attempts. Basically, you know, collect data on what kind of attacks or payloads of patterns that are being used, which were, you know, accessible through their APIs that was publicly available, which had all kinds of data with respect to the, you know, attacks, payloads, and bypasses. So, we had a simple setup where, you know, we pulled sans honeypot every 15 minutes to check for new payloads and bypasses.  And this was so whenever, you know, we fetch our data and this particular data, like, you know, for example, bypasses or payloads was sent to our BAF rule checker, which validates against our, and if it passed our, you know, BAF rule, basically on considering this is a bypass or not, we were getting alerts to our slack channel, which was then manually reviewed and updated by So, this helped in looking at different payloads and bypasses to, you know, to basically update the BAF. And talking about attack simulation with honeypot and other, you know, defenses said, we also wanted to internally run these payloads against our servers or to check for any vulnerable servers, basically to simulate attacks. So, you know, we had, we had a setup where, you know, we had one attack commission and Tina server, basically we've been using candid tokens to look for responses or feedback. We started, you know, sending out the payloads to all of our supplements as part of URL parameters headers and body of directors. So our DNA server would, you know, send an alert if there was a hit that it received. So, basically, this is how it worked. And, you know, we started monitoring this internally to check for our vulnerable servers and services that were present. So, moving on, I think now our colleague, Harsha is going to take over from other protection or measures responses that we had. So, who do you, Harsha? Thanks, Sujit. Like Sujit explained, we had multiple layers of defenses put at the off layer to prevent our systems from getting exploited. Now, let's go a little deep towards the application side. As a short-term solution, one of the mitigation measures that we have done is to patch all our systems, the workload, the workloads, the deployments, crown jobs with this environmental variable, log4j format misses, no lookups whose value is set to true. Like Levin mentioned in one of the previous slides, we make around 2000 deployments per month. That's really very high value. And there's a very good chance that these environmental variables that we injected into the deployment manifest make it overridden. And freezing deployments is not something that we want to do. So, to not affect the developer productivity and at the same time to ensure that these applications are not vulnerable to this attack, we came up with a solution to use Kubernetes dynamic admission controllers.  It sits between the requester and the Kubernetes API server. And what exactly did this mutating admission controllers do is, like the name says, whenever there is a mutate or an admit even, these controllers made sure that the objects are created with this environmental variable injected in them. So, this diagram shows how a request reaches the Kubernetes API server and where the admission controller code sits and how it injects the environmental variables. So, moving on to the long-term solutions, one of the long-term solutions to ensure that the applications are not vulnerable to attack, to this attack is to obviously ensure that they are upgraded if they have vulnerable log4j dependencies. Now, the interesting piece comes here, log4 shell attack can be carried out even if the applications have third or fourth or ninth layer dependencies. So, how do we identify the applications that have direct or indirect log4j dependencies? For this, we initially took the help of dependabot. What these dependabot? Dependabot is an OSS scanner that compiles all OSS dependencies across the repositories in the organization. Dependabot helped us identify the vulnerable log4j dependencies in our code. And initially, we made use of dependabot to identify the applications that are log4 shell vulnerable. We also made use of SIFT, SIFT is an open source tool that helped us generate and respond from the container images. So, basically these two tools helped out identifying log4j dependencies both in the application and the container images. There's an interesting thing that I would like to speak about here. That is razor pay asset inventory. Razor pay asset inventory turned out to be our silver bullet in identifying production systems that are affected by this and that are vulnerable to this log4j, log4 shell attack. It helped us identify the container images, the applications and the owners and the mappings between them. So, we do have a tool that gave us information about all the assets in our company and the relations between them. Now, having such an inventory in a company where there are hundreds of microservices and being able to quickly identify the owners helped us incredibly well in upgrading our systems as quickly as we can. And what exactly is this tool and what are these assets if you're interested to know more about it? There's one more talk from Satyaki and Sandesh from Razor Pay Security team who will be speaking about the asset inventory project at Razor Pay. You can follow the below link to know more about it. So, we put some short-term solutions, we put some long-term solutions to prevent this attack. Are these defenses enough to stop the attack? No, because we used many third-party applications that we directly or indirectly run that may use a vulnerable log4j versions. For example, we use Looker, Neo4j, Redis Labs and the problem is we do not have sufficient high-level control over what the third-party provider runs either on our systems or in their systems. And for this, the only solution we had is to keep track of the vendors, the upstream providers and have back-and-forth communication with them to check if their systems are updated so they do not log any of these log4j attack payloads. Our major provider AWS also kept us posted on how they patched their systems and which of their services got affected because of this. And coming to the third-party dependencies, we made use of GRIP which scans the contents of a container image to find known vulnerabilities in some of the major operating systems and also to find vulnerabilities in language-specific packages. You can go to the next slide. So what next? We had plans for prevention. The next important thing that comes into the picture is monitoring. Monitoring the egress traffic and how we exactly went about monitoring during the log4j time, I'm going to explain. We gathered a threat list of IPs from various sources like sands and crowdsets and we closely monitored if any of our systems are interacting with the threat list of IPs. For this, since we are mostly the folks on AWS, we took the help of AWS detectives IP address analytics to figure out whether there is any interaction from any of our systems with the threat list of IPs. As you must already have known that the detective takes its feeds from BPC flow logs and cloud trail events, it helped us determine if there are any events of interactions with the gathered list of IPs. We also ensured that this gathered list of IPs is continuously updated with some custom scripts. You can go to the next slide. So what went well for us? Having an asset inventory, bomb services and other in front, making use of them to quickly identify the application owners and upgrading the applications in a warfront mode really turned out to be a silver bullet for us. Our defense and depth mechanism also helped us in reducing the attack surface. Our web application firewall was the first layer, that is the first layer of defense that we have put, blocked a ton of log4j payloads from entering our systems. The next thing we deployed, we patched all our deployments so that with the environmental variables, so that they do not make the JNDL lookups. Next, we upgraded each of the applications that have dependencies on vulnerable log4j versions. And finally, having custom built warf rules that can understand the business context also proved out to be very helpful for us, as our firewall rules managed to block more attack traffic than some of the managed warf rules provided by the third parties. Thanks, Libin, Sushit and Shri Harsha for an amazing discussion around this. I think I was the point around the asset, the software asset inventory, which is generally not very exciting for security folks, turns out to be a real key element during these times. So that was a great message in that. One of the things that I was thinking when listening to your talk was also those couple of weeks and what a roller coaster that was, and of course also some of the months that followed after that. But this is quite ingenious. So I am pretty excited about this topic and I love the session. I had a couple of questions myself. Maybe I'll start with one of those. One question I had was you were talking about how many assets, right? So you started looking at how many assets were impacted. I was thinking, what can you do about the infrastructure components that are affected, where there may be dependency, for example, on a third party to upgrade their infrastructure components? How do you tackle that or what do you think is the best way to tackle that in such a scenario? Sandesh, do you want to take this question? Sure. So I work with such a discharge as well. So yeah, so that was a much longer drawn out process than fixing our own systems. I think it didn't take us, so one, it was not always clear if log4j was used by all our third parties. We knew which of them kind of used Java and which game, etc. So we had a fair idea if they'll be relevant or not. We then had to reach out to our vendors to figure out if they're using log4j or not, and then figure out if there's an update, etc. Some vendors, I must say, were extremely proactive. They actually sent us things even before we asked them, right? So which was great.  Here's what you need to do to upgrade. And in the meantime, here's what you can do to stop. So that was great. But with especially one or two vendors, I don't want to name anyone. It was a long drawn out battle process, right? And I think one thing we kind of realized, you know, this is kind of goes back to the security hygiene in general, is that if you're using older versions of a particular product, right? And then you haven't upgraded because of other reasons, for regression reasons or whatever it is, this is when, and something like log4j happened, that's when it comes to really biting, right? Because now you don't want to upgrade to the latest version because, you know, it'll break a bunch of stuff. But at the same time, you can't not upgrade because it's vulnerable to log4j. So this was a good lesson for us on, you know, why you need to upgrade, you know, have better patch hygiene and better hygiene as well. By and large, I think it was okay. It was a long drawn out process, but it was fine. But there were definitely one or two instances where, you know, I know Harsha is smiling because he didn't fit some of them. It went on for a really long time. You know, we were holding outlets and the wall of rules and everything. Yeah, I think as a security team, I mean, I would like to add that you also grow with the vulnerability, right? So that time when the vulnerability was adapting and for 2.16, again, they had another issue, then we went ahead and patched that as well. So you grow and you grow to get that patience as well, gradually. You grow old actually. Good point. One, another question while we are getting some of the other questions was, I was thinking of, so we heard a lot about what security teams can do, right? And I think a lot of these including some of the alternate controls that we could use for the vulnerability that could be applied. There are solutions like WAF and other things, which you have clearly called out. Looking back, is there one thing that you could tell the developers, maybe all the developers or audience that are watching us, what can they do to be prepared for zero days like this? If Libin was here, you would have answered this because this is kind of part of his daily job here. But he had to kind of step out for a personal emergency. So yeah, so I think from a developer's perspective, I think there are a few things, right? But at least within Razorpay, we rely on open source scanning tools like Dependabot and we also kind of, we also use gripe in multiple cases. So I mean, we have an S-bomb, which will basically tell you the list of all the dependencies you're using and also tells you which of them are vulnerable. Now, the problem with the current technology is to kind of, it's not very clear if you're using the particular vulnerable package in a vulnerable library. So sometimes it becomes hard to know whether you actually are vulnerable or not. But as hygiene, if you can actually make sure that you are aware of what open source software you're using and make sure that you are upgraded to the latest version, then that solves it. But that's much easier said. It's very easy for us to say it, but it's much harder to actually get it done. So for us, I mean, from a security perspective, how we help developers is at least make it very easy for them to know which of the repos have which vulnerabilities, like which open source packages have, and we know where the instances are. What would be really nice if you can somehow come up with technology or come up with ways of saying, hey, you know, you're using a particular library, which has a vulnerability in, say, function X. And since we are not calling the function, we don't have to worry. Or since we are calling it, you have to do. So then the signal to noise ratio becomes much better. But I don't know of a tool that does that very well. And I think doing it manually does not scale and there's a pain there. So yeah. So at this point, if developers are watching, first of all, thank you for all the help. But more than that, you know, if you can, if you can kind of, you know, make sure that, you know, if your security model has an S-bomb and an open source kind of use that, if not, there are plenty of open source tools available, like, you know, gripe, gripe from, from, I think I forget the name of the company, but also OWASP dependencies scanner from OWASP. There are a few open source tools which do it. So you can run a scan, get a list of all your vulnerable dependencies, and make sure it's updated. That's cool. If you can integrate that with your CICD pipeline, yeah, even that first stage to get that visibility, right, that itself is, can be a struggle, where you don't have this very much organized and stuff like that and having automation around dependency, I think these two things will make life, everyone's life much easier. So that's great message there. Thanks. Thanks, Sandesh. So thanks a lot to all our speakers for the sessions today. This marks the end of a three-part series on risk assessment and mitigation with raise of pay.


is the tree under which you are standing, thinking whether you want to breathe or not. It anyway gives. It's up to you whether you want to breathe or not. The tree doesn't make those choices, just gives. How much you want to breathe, it's up to you. So they may not receive it properly, so I will not give. Don't get into this kind of rubbish. It's your thing to give. If they have sense, they may receive it. If they know, don't need your rubbish, they may not receive it. They don't need it. They may be self-contained, they may not need it or they may not have the sense to receive it. It doesn't matter, that's not for you. You know the joy of constantly doing it, that's all. Guru, I'm having a hard time with devotion and I've been reading everything I can find about things you've said and driving everyone around here crazy, asking all of them, what's devotion, what's devotion, and I'm hoping that you can explain it to me in a way that I understand. You want to understand devotion or you want to know devotion? You want to know devotion. You want to know devotion, it's one thing. Understanding devotion is an academic thing. Devotion means that which is devoid of you. It's a different dimension of intelligence where your intelligence has flowered to a point you understand. If you're strived hard enough in your life, you understand this body, this brain, this one can do only this much. But there is something here which is much larger than this one. If you understand this, you will not make more and more out of yourself, you will make less and less out of yourself. When you become nothing, you are naturally devoid. Devotion means you allow the existence to flow through you. You allow the grace of the existence to flow through you. Intellect means you will divide everything into a million pieces and you believe you have understood. So don't go about trying to understand. Do you know that last leaf, that leaf which only came up two days ago? Do you understand this leaf? Do you? Do you? Why you're not a science graduate?  An ant which is crawling right now in front of here. Do you understand this? Ant? Do you understand this ant fully? No. Do you understand a single atom in this existence?  So when you realize everything is here, is beyond you. An ant, the way it is made, the mechanics of the ant, just see those eight legs, how efficiently they are walking without getting tangled up. Just the mechanical part of it, you're not able to understand, leave the other aspects of it. So if you see everything is beyond your understanding here, from a leaf to an atom to an ant to an atom to a subatomic particle, everything is just beyond your understanding. Would it be not natural for you to bow down to everything that you see? You think you've got it. So now you have to try to understand devotion. You cannot understand anything, but you can experience everything. If you're willing and open, devotion means you're an absolutely open doorway to life.    In India, it's become synonymous by a bhakti. That means they're uttering the word bhaiya means fear. Bhakti means devotion. They're uttering these two words as if they are same. If you are in fear, obviously there is no devotion in here. If you're in devotion, there just cannot be any fear in you. There simply cannot be any fear in you if you're in a state of devotion. But now people understand these two things which are diametrically opposite to each other as one thing because it's convenient for them.  Stupidity is not devotion. Devotion is a different dimension of intelligence which has understood that intellect is a limited instrument.  Stretch this intellect to its limit. You will clearly realize with this you can survive. With this you can look smart in a tea party. With this you can make money. With this you can find a job.  It doesn't take long to understand this.  It's not an act. It is absence of your rubbish. That's devotion. When your rubbish stops, devotion is. Devotion is not an act that if you go and do puja in a temple or pray in a church or stand upside down, that's not devotion. They're trying to be trying to work up their devotion. Devotion means you have seen the limitations of who you are and you have seen the boundlessness of what it is. Compared to this and this, it looks too small, too miniscule. So naturally you will be devotee. There is no other way to be.   When you are devoid of yourself, you are a devotee. There is no other way.


In today's video, I spent $1,000 in Japan? What's up guys, we're back with another epic video. In this video, I have $1,000 worth of cards from Japan. And you might ask, when did you go to Japan, Ruxen? I didn't go to Japan. So then you didn't really spend money in Japan. Whoa, I did. My money was spent in Japan because my sister went to Japan. What's up guys? We're here in Sakiyo. We started going on about right after I got off the plane, so I'm sorry. We went to Sky Tree and tomorrow's my birthday. So I got a cute sticker. We are on the mission to find some Yu-Gi-Oh! card. And neither of us know anything about Yu-Gi-Oh! So. Before we actually get into it, I have a giveaway. Since we're doing a Japanese OCG opening, I have two Ultimate Rares that we pulled in the Duelist Nexus video the other day. Go check that one out. All you have to do is like the video, be subscribed, turn on notifications. Let me know what you think about all the cards that we got here and what my sister should have bought for me. This video was sponsored by HelloFresh. Do you ever want high quality food for cheaper than takeout? So do I. Well, if I got good news for you. HelloFresh is cheaper than grocery shopping and 25% cheaper than takeout. And not only is it cheaper, HelloFresh has 40 recipes and 100 seasonal and convenience items each and every week. Now it's gotta be hard to prepare if it's that good and that cheap, right? Actually, no. HelloFresh delivers pre-porsed ingredients and easy to prepare recipes right to your front door or back door. I don't know where you get your stuff delivered. Don't look at me. So not only are you gonna be saving time actually ordering the ingredients and having them sent to your door, but you're also gonna save time in the kitchen with HelloFresh's quick and easy meals. One example is their fast and fresh pineapple chicken tacos which are ready in 15 minutes or less. Chelsea X being prepared, the jalapeno bacon mac and cheese. And I gotta tell you, I think this is my favorite thing I've had from HelloFresh yet. This massive dish only took her about 45 minutes to prepare and it tasted like it took several hours. If you guys wanna try some for yourself, check out my link down below and use code PogRuxinMay16 to get 16 free meals plus free shipping. Thanks again to HelloFresh for sponsoring this video. So let me explain the story. My sister was going to visit Japan because she had a friend that lives there. I heard about this and I said, hey, if I sent you a thousand bucks, could you go spend it for me on Yu-Gi-Oh cards in Japan? She was glad to do it. So that was awesome. We're gonna have some clips of her, you know, going through some stuff. I don't know, I don't know what she did. She just told me, don't watch them. I was like, okay, I won't watch them. Did she get the right stuff? Let me know in the comments. Did she buy good stuff or did it suck? We gotta know. Okay, guys.  This is what we're working with. They have a lot of different kinds of cards that have Pokemon. They have Magic the Gathering and Yu-Gi-Oh. Okay, we found the boxes. There's only three. This is all we have. We're thinking we gotta go for the most expensive one because, okay, I'm sorry, basic, basic. That's calling my name right there. That's $300. Okay, so we did the exchange rate. We have basically $135,000 yet. So after we get the $35,000 box, we have $100,000 left to spend on individual cards, so. Let's find some. All right, let's start with the Rarity Collection. I really love opening these up. They're like a really fun product. If we ever got this in the U.S., I think this would absolutely crush. So we got Rarity Collection Arc V. So I'm guessing this is not the blue eyes one, since it's Arc V, but I could be wrong. Inside, we can pull holographic rare, extra secret rare, ultimate rare, ultra rare, super rare, secret rare, collector rare, all inside this one pack. So let's see if we can pull some of those. Is there a pull tab on this? There is, okay. Pull tab, OCG openings. You guys know how we roll. Japanese, a thousand bucks spent. Let's see if it was worth it. So we're starting off, I mean, Instifusion Hollow. That's a pretty nice super rare. We have a Coach Soldier Wolf Bark. That is a, is that a Naturia card? I think it is. Then we have a Crimson Blader, I think his name is? Super rare, so it's, oh, that's an ultra rare. Yeah, that's an ultra rare. So ultra rare to start it off. That's our first Rarity. I mean, I guess super rare counts, but there I think everything's super, other than the foils. Second pack, so ultra rare in the first one, not bad. I didn't know all those cards, which is pretty nice. I mean, I'm priding myself on learning the cards, guys, because remember back in the day when we would do these, I would know none of the cards if they weren't like old school. So I'm getting better at that. Let's see, we have an Allure of Darkness, very nice. We have, this is like a Sacred Crane or something like that. No, Sacred Crane is the IOC. I think this is a different name. We have Vanity's Emptiness, Crazy Card, and we have a Compulsory Evacuation Device, ultra rare. Another nice one, that's looking good. So a couple of great cards so far, I only haven't known one card, I've known pretty good. I think there's 15 total packs in here. So this is the fluff of the video, you know, because the other rest, I mean, if it's singles, this isn't gonna be too much. Let's see what else we can get. And by fluff, I don't mean like bad stuff, I just mean like the majority of the video, uh-oh. Is that a collector rare that's bent? I think it might be. Mizuki, let's find out. Naturia Barkion, we have a Rescue Rabbit, nice hollow. These supers look so nice. And then we have a Torguide collector rare, but it's bent straight from Japan. Oh, it's such a nice card, it still is, but oh, that is unfortunate. Check that out. It's not a little bend either. That thing is, it's dinged. I saw it right away. It sounds like I think that's a bent corner. Such a nice collector. I think you usually get like two of these though in here. So hopefully our next one is not dented, that would be good. Okay, unfortunate bend on the corner there for the Torguide, but still, I mean, a pretty awesome pull. I mean, I love Torguide. I throwback card for sure. We have a debris dragon, nice super rare right there. We have a summoner's art. Hey, this is like, this is a prize card. I think this is a Dark Lord card. I don't remember what it's called. And then a secret rare, Naturia Barkion, very nice. The cool part about this set is you already saw Naturia Barkion in super, but you could also see it in secret. So basically Naturia Barkion could be super, it could be secret, it could be, I don't know if it could be ghost, but I think it could be collector rare, it could be like ultra, it could be all that different stuff. So it's really cool because you don't know what cards you're getting and any card you like could be a high rarity card. So if there's petite moth in here, in theory, we could get it like a really high rarity card. Let me know in the comments. I think I know the answer, but how would you feel about a US version of rarity collection? I think that could absolutely blow up. I think that would be one of the best sets ever, especially if you put some iconic cards, then you could throw in some nice meta cards as well. It could be insane. That is a Dragoonity card. We have a, there's Tour Guide, that's just super, very cool. The, ooh, the Leviar, the Sea Dragon, there we go. And then we got a Formula Synchron, ultra rare, very nice ultra. Can't believe our collector rare was bent. It's crazy because Japan has the craziest quality control. So I'm guessing that happened like after it was in the pack or something. I don't know, because almost every time they have such really nice quality control for their cards. We got our Cowboy, we have Arch Lord Christia, that's a crazy Edison card, Fiendish Chain, and we got a Lavalval Chain, I think is the name of that one, another ultra.  I think ultra is a minimum, right? It feels like we've gotten, oh, gotta be careful there. I feel like we've gotten at least an ultra every time. So that might be like four supers and ultras the worst you can get. Now, can we get a Ghostrair? I mean, Ghostrairs are definitely not guaranteed out of here, so if we pulled one it'd be pretty nice. Elements of Hero Prisma, this is a very expensive card in common, in these days. Anti-Spell Fragrance, who loves a good mini floodgate there? We have a Smorg the Dark Smorg, I think Dark Smorg, and Ultimate Rare Monster Reborn. Oh, and like, this is old school Ultimate. So this must be an old, this must be the first rarity collection. Maybe that's why it was so expensive. In Ultimate Rare, oh no, the corner. The corner has a little thing to it. What's up with these corners? I mean, that one's not nearly as bad, but wow, that looks good. It's got slight corner issue, but it's not bad, a little bit of a, man, that's a pretty card. We got this in Lost Art, but I mean, Ultimate Rare, old school Ultimate Rare too, it's not the new version. So I wonder when this came out? I guess we'll have this pop up on the screen at some point, but Ultimate Rare Monster Reborn, that's an amazing pull. You guys can see how fun this would be to open. I mean, this would be insane. And then it would keep the values up too, because when every card can be every rarity, it's really hard to pull the one you want. So it wouldn't be like crushing values or anything either. I think it'd be the best of both worlds. Book of Moon. That was another Dark Lord card before that. Summoner Monk and... Oh, a Collector Rare Tricula. Man, this box is so good. Feels like every card is insane right now. Tricula Collector Rare. Wow. My sister killed it. Oh my goodness. She got a really nice box for sure. Man, these are really good pulls. Okay, Arch, Arch V, not Arch V, Arch, Arch V. Okay, let's see. Can we get a Ghost rare? If we get a Ghost rare, I'm gonna freak out. That would be insane. We've got Noah's Ark over here. I think it's called the... What is it called? The Selection? We have a... That is an Infernity card. A Fire... That's a Fire Fist card and a... Ooh, a Prismatic Secret Red Eyes Darkness Metal Dragon. Wow, these are insane. We're getting some crazy high rarity cards. Like we could have some boring ones and we're pulling a lot of great awesome ones. This is insane. There's still a lot of packs left. Wow, this is a crazy opening. We haven't even gotten to the singles she bought, which I think will be the best part. There's a Chameleon guy. Instifusion. Coach Soja Wolfbark and a T.G. Hyper Librarian. Librarian, Librarian. I cannot say that. That's a difficult word to say. Okay, five packs to go. So we're only 10 packs in, by the way. Keeping that in mind. Do we get two Ultis? I hope we do because that Ulti was crazy looking. Maxi! Hey, Maxi is out there. We've got a Cyber Indragon Alternate Art. We've got a Ferris Lightsworn Archer, I think. And... Ooh, a Breakthrough skill. That's also a very good card, Ultra Rare. We'll take that. Man, this has been a crazy opening. This has been really nice. I mean, this has been fun. Let me know. If you guys liked this opening, I could probably acquire more Rarity Collection. I'm obviously not going to Japan. I probably won't have my sister there soon at any time. But I think I could acquire more if we want to. We have, maybe we can hit up our friends at Yu-Gi Market. We have Allure of Darkness. We have Vandy's Emptiness. And a Thunder Seahorse, another Ultra Rare. That's looking nice. Three packs to go. Rarity Collection. Give us another high Rarity card. Give us an Ulti. Give us a Ghost. We got two Collector Rare, so I don't think we'll get another one. But who knows? Naturia, Debris Dragon. We have Summoner's Art and a Tricyla. So there's Tricyla and Ultra and not in Collector. Very nice. We'll take that. Two packs to go. Will we get some big to end it off? Two packs left. I gotta, you gotta like kind of move the cards to the left so that you can actually do the pull tab right. There we go. We have Mizuki looking good right there. Naturia, Barkianne again. And Super Rescue Rabbit. That would be a pretty cool Collector Rare.  So we got that in Ultra and Prismatic Secret. I don't think we got it in Super yet. All right, our last Rarity Collection pack. They've been pretty good to us so far. So I'm hoping for one more high Rarity card in the last pack. Last pack magic, come on. Make it happen. We have another Dark Lord. We have a Dragoonity Guy. We have Torguid and an Ultra Rare, Divine Dragon Knight Felgrin. That's pretty cool. So one Ulti, but we got an amazing Monster Reborn with the original art. So that was pretty cool. Okay, the only one I know that Fel likes is Blue Eyes White Dragon. That's why I feel like we have to get one of those. Can you have too many of the same card? I feel like no. That's his favorite one. The most expensive one is 380,000 yen. And the cheapest one is 158,000. We can have one. So we have this right here. I don't know what she got, but I'm gonna go, I think it's in top floors. I'm gonna go one at a time. So first we have a, okay, we got our prices on here. So I don't even know how to read this. Is it 20,000? Is that what it was? I don't know. Let's just see. Oh, nice. We got a 20th anniversary Blue Eyes. Nice decision. Nice. This is a five year old card at this point. Prismatic Secret. It's like we have it at the 25th anniversary because they have like the 25th stamp. But this is the 20th. We didn't get any 20th over here. We didn't get any special stamps, but they did. That is a really nice Blue Eyes White Dragon. That's a good choice. A plus. So I guess that's a condition. I think she was telling me that was like, they're conditioning with like, you know, like letters instead of numbers. So that makes sense. So A plus means minty, I guess. So that card looks insane. We should grade it. I don't know. I got to like keeping it in this sleeve though, because you can see like the yen and the plus. I might keep that in the binder like that just to remember like where it came from and how much it was. Is this the one he recommended? I think we should get one of these the Stardust Dragon. She's cute. It's probably a boy, but. Next card we have a 25, is that? Oh yeah. So a little bit, a little bit more. It seems like 2,500, 25,000 I should say. And then we have a Stardust. Nice. Another 20th anniversary. This is a B plus. So let's see what a B plus looks like. Very nice looking card. Man, this is B plus. What's wrong with it? I don't know. Maybe there's like a corner I'm missing. Maybe right there a little bit. I don't know. Really nice. If that's what, if that's, I think it's talking about condition, but hey, that looks really good. We'll take that. That was 29,000 yet. I kind of like this one. It looks like a girl. It's enchanted fairy dragon. Enchanted fairy dragon? That sounds like my vibe. I think we should get one of those. I think there's only a couple more cards because she went quality over quantity which you guys know I like. Let's see what's next. Okay. It's, oh, 5,000. This one's less. Let's see. Oh, an ultimate rare. Ain't you fair? Wait, am I wrong about that? 29? Maybe that was 290. I don't know exactly. Okay. Ultimate rare. Ancient fairy dragon, A plus condition. That thing looks insane. Let's check this out. All right. Ultimate rare ancient fairy dragon. That is sick. I mean, does that have the Arata? Probably not. It doesn't, I don't think. I don't even know if they arotted it over there. I don't know how that works. Yeah. This card's really nice. So this one was, yeah, I don't think this was six bucks. This was probably 69 ish dollars. I don't know if it's, it's not one to one that way, like a hundred to one. So the Stardust, is that the most expensive card? I don't know. Okay, you guys, I took Japanese. I didn't learn like any kanji so I can't read all these. But whoever this guy is, I'm kind of feeling his vibe. Hope he chose right. We should accomplish. Hope he's okay with one box and four cards. We picked the cutest ones and they're anniversary and that feels special. All right. Final card in here. What was it? It was 19. Oh, Ultimate Rare Jinzo. This is hilarious because Simo actually gave me this card. So I know I have two of these. It seems like people just know that Jinzo is a card that I want.  I'll take this any day. This was the most expensive card it seems. Ultimate Rare, she did go for an old school Ultee which I was hoping she did and Jinzo was a great decision. The front looks incredible. Should I grade this? Back looks pretty good. I mean, it's A plus according to the store. That looks good. So we got four singles here and wow, talk about good choices. I mean, she doesn't really know much about Yu-Gi-Oh but hey, check out these decisions. I mean, like Angel Fairy, we love that. We love Blue Eyes. We love Stardust and we love Jinzo. Shout out to my sister in the comments for amazing choices and that, of course, that rarity collection was insane as well. By the way, that was five items for $1,000. So those OCG items can get expensive. If you guys enjoyed this video and you wanna see something like this again, maybe one day I'll take myself to Japan and we'll spend even more than $1,000 on some OCG cards. Let me know in the comments. Who knows? It might happen. And if you enjoyed the video, make sure to subscribe to the channel for more epic content like this. Shout out to To Info Show, Daxer, JT Show, Puffins of Doom, Ernesto D'Andre, Dizzy, Missy Colt, America, Deutcher, Supreme Stage 21 and then a Thai show, Ian Moosa, Junior Barting, Mehmet Gekko, and Thomas Plain. Thank you guys for supporting the channel and I'll see you guys in the next video. Peace.


So you mentioned field peas, that's one species that I've seen maybe some issues or concerns with as far as planting depth. Guys have split fields with like two planters and one is a little more shallow than the other one and we definitely get a lot more growth with the deeper planting. Do you have experience with what your target depth would be? Yeah, so with an oats field pea radish mix, we use the radish as the brassicas because radish can germinate from deeper than our canolas or turnips. So we're usually planting that mix a minimum of an inch up to an inch and a quarter deep even with the radish in there just to ensure our field peas and oats have a good establishment. Yeah, shallow planted field peas in my experience just don't do very well. Have you guys used any of that? Not field peas. I mean that is an issue with cover crops so so many of them of the smaller seed like you said the reed seed and they don't like to be planted very deep but what I mean one thing that you have to do is but like if you're planting behind wheat stubble that you have that layer that all that layer of residue that you have to get that seed you're better off planting that you know sometimes you have to set a little deeper you like but then just like take off the packing of the closing wheels so you don't push that seed down in there so you're still put it in fairly deep but leaving that loose soil instead of packing on top that helps sometimes with emergence on in that particular instance behind small grain. Well and the same line of that after small grain we have an older 750 no-till drill the firming wheels were quite wide and they don't get down in the furrow well so we've put a narrower firming wheel on that can actually get down into the furrow and firm that little seed down in there. We've seen a lot better emergence on that otherwise the wheel kind of sat there and never got to the seed. So yeah getting that seed actually in the dirt is probably helps the establishment.