Rhaid fawr, rhaid fawr. I'm a member of Derby Makers, which is an eclectic group of people who turn up at our host where we live, in Verticomers, at the Radio Communications Museum of Great Britain, which you won't have heard of, because it's not yet open in Derby.  And there's another room somewhere else with the same amount. So it's got quite a lot of exhibits. We've moved in because our normal home has been heritage, lottery-funded, upgraded, trashed, rebuilt, everything. So we needed a temporary home. High-altitude balloons, to give them their normal name or HABS, are a hobby. They are a fun thing to do. They're aimed at getting youngsters and non-technical people involved in technology. They're based around Raspberry Pi's, correction. The ones we do are based around Raspberry Pi's, but if your hardware preferences for something else, that's fine, you can do what you like. We have Exhibit A, which is a bakewell pudding, because you always send these things up with a Raspberry Pi camera, wide-angle lens, taking nice pictures of the curvature of the earth, and a friend of mine sent one up with a Raspberry pudding on it because someone else sent one up with a model of a US astronaut recently. So there was a little bit of who can do what, and it went up, and the electronics failed. He has no idea where it went. All the telemetry failed, no latitude, longitude, no height, no receiving real-time telemetry, which is what we all depend on. It's gone somewhere. So if you find a box about that big that says, please ring this number 10-pound reward, please do. He'll be very interested. It did make the local BBC news with Radio Derby, and because of that it actually made the real BBC news, the six o'clock news one evening, I'm told. The school is overjoyed at the amount of publicity they've got out of it. He's miffed because he's lost a payload, but at the same time the children involved enjoyed it. The 10 milliwatts comes from the Civil Aviation Authority and OFCOM, not allowed to broadcast anything that might upset commercial aviation. This is a straight lift off the internet. The Laura Wann spec is for low power. Yeah, I think we meet that one. Wirelessly, yep. Battery, yes. There's only one make of lithium batteries that works, because you'll see in the later slide that the temperatures that these things go up to is minus 50, minus 60, minus 70, depending on what the weather's doing. Yes, it's an internet of things, and it does move. And there's a collection of Laura Wann gateways around the country, which feed back to a central website, which in real time displays the telemetry that various balloons are transmitting. 10,000 metres gates, which is roughly 30-something thousand feet, is civil airliner territory. Balloons go up higher, spy aircraft go up higher, but not as high as balloons. Technically, this is not outer space, but if you were to pop out at that altitude without space, you'd die very quickly. We live right down the bottom, and 100,000 feet is approximately 30 kilometres, or 30,000 metres. Though the dates are on the next slide. Felix Baumgartner, 2012, I think it was 2013, something like that, got sponsored by Red Bull to go up as high as he possibly could. This is a generated image. I don't think there was a photographer up that sort of altitude, sadly. And jump. So he got up to 40 kilometres in 2012. Someone since has got up a bit higher, just because they wanted to. And the stratosphere is at about 30 kilometres. Blackbird, the US retired reconnaissance aircraft, gets up to about 25 kilometres. Temperature is minus 70-ish at the altitude, beginning to come back up a bit, but the pressure is almost zero at that altitude. So here you see exhibit A. That's what a high altitude balloon looks like. They're about that big at ground level. They go up to six to eight metres full altitude before they burst. And then you hope that the payload and parachute and telemetry all work, and you can track it and recover it and do it again. Helium bottle. And you can see the telemetry is telling us that it's somewhere between 150 and 200 metres up. And that's the latitude and longitude of Dave's back garden. Typical configuration is a helium balloon with a parachute, either 18 inches, two foot or three foot, depending on how heavy your payload is. The one we're going to launch is going to be about 500 grams. So it's a two foot diameter parachute. Mostly you have one payload, but if you want a second payload, they're in series. That distance is five metres. That distance is 10 metres. There's no legislation around that. It's just a pragmatic rule of thumb, and it seems to work. It's wonderful what you can find on Google. Someone was incredibly lucky and got a few seconds or so after burst. And that's what your balloon looks like after it's gone pop. Obviously there's bits all over the place. Now that, and I don't know how well that's visible at the back. If it's not, sorry. That's Google Maps. The central website had Hub. Imaginative names we use. Various people have their own trackers, and you can see one there. You can see ours in Derby. Someone else there. Plust around London. One over in the Movens. I helped at a launch that was launched from the Movens show ground. It went up, and because of various factors which weren't obvious at the time, but became obvious afterwards, the balloon did not go up as fast as we had expected it to, and instead of it going up in a trajectory sort of like that, parachute, and then down, it took a much greater time to get up to burst altitude. It burst, but it burst the far side, a bazing stoke from here, which is about down there, and the parachute, we watched the payload disappearing out over the English Channel. Oh, we were overjoyed at that one. But there was some slight hope, because everybody always puts, if you find this, there's a £10 reward. Please ring this phone number on it. And a school did a launch about two years ago, and recently the payload turned up on a beach in Denmark. I have no idea why it took that long. I'm not a climate, a tides person. So this is what the telemetry things. There's a nice little icon that tells you you're under balloon flight. This is 1900 metres, latitude, longitude, time of clock in system, and that's the view as you're going up. There are two techniques used to transmit Laura Wann and RTTY. RTTY only sends bits in sense of altitude, longitude, latitude. It doesn't send slow scan television pictures that Laura Wann enables you to send one every four minutes. It does mean that whatever happens to your payload, you do get a view of what's going on, and you can see much more clearly. The images are all written to the SD card, which is one of the reasons why you want to recover your payload. Same flight, 42,000 metres, going well up, nice curvature of space, well above the clouds, and you can see the picture is beginning to drop packets. The telemetry is beginning to hit its limits, and that's when it was recovered some hours later. The person who was doing the flight, he was going for the height record, that's the parachute, that's the fence, the road is here and that's the recovery vehicle. My understanding is that is an uncommon occurrence to be that neat. They land on people's garages, they land on the roofs of multi-storey buildings, they land in military ranges, they have a mind of their own because they are at the whim of the weather on the day.  It's accurate on a sample of one launch that I've been involved with, accurate to within half a kilometre. One of my colleagues is busy putting a SMS unit, a single chip unit in our payload, so that at about 1,800 or 3,000 feet, whatever it is, when it's got a cell, I love his optimism when it's got a cell. I live in Derbyshire. Up in the Peat District, there are places where you go, ooh, my phone's got a signal, isn't that unusual? But that's part of the fun-ish. The central website, as I said, is called Hab Hub. It is an absolute font of all knowledge. It's been created by the community. It is absolutely wonderful. You will lose if you start getting interested several evenings, just reading it, understanding the jargon, and beginning to understand how it all hangs together. This is one of the diagrams that says, this is what you will have to build, this is what you need, and these are the key dependencies. So for someone like me who was an aerospace apprentice, that's great because it means that we can start generating free-flight checklists, which my cell likes, because that's what we used to do. What all it says is microcontroller, it doesn't matter which one you use. Some people prefer arduinos, some people prefer raspberry pies. If you're feeling slightly rich and very lazy, we are for Flight One. I insisted I wanted flight-tested stuff because the unknown is us as a project team, not the electronics. We bought a commercial unit called PITS, Pi in the Sky, and that simply does all of the stuff that you need. It is proprietary, but the software is available for free, and you can muck around with it to your heart's content. It comes with a Pi Zero, so the weight of the payload is usually made up with Haribos, because they're a nice pack of people like them, and if you've got lots of youngsters involved, the idea of eating a sweet that's been into space is something that they rather like, I'm told. Those are the batteries that work. There's a gotcha around UPS chips. The U-blocks one, and they're quite a sensible firm because of the different project I was involved in, they don't block the functioning of the GPS chip when it gets above a certain altitude. That used to be part of the arm's munitions rules so that you couldn't buy a chip and build your own ICBM. You can have as much open source stuff as you want, or as little as you want. One of my colleagues is building one of... There's an add-on board for the Raspberry Pi that only has a Loroan chip, so that's about £20 or something, and he's trying to make that work, and he's obviously at a needed GPS and a radio unit and a couple of other bits, but his goal is to see how cheap he can make it. I can't emphasise it enough. If you are interested, be prepared to lose some serious time reading that website. It really is good. Right, now the slide I didn't put up because I was only doing it in the hotel room yesterday is you can't just launch a balloon because you feel like it. You actually have to ask the Civil Aviation Authority for a permission to launch. There is a form, of course. It turns out I discovered yesterday there are two forms. I have no idea why there are two forms that you can use. Both have seemed to ask the same thing almost. One says, have you talked to the police? Yesterday I kept trying our local police station on the phone. It was always engaged and I gave up after ten times. It's free, but then it generates what is in the trade called a NOTAM, notification of air traffic movement. There is a wonderful website that pulls all of these off, drops them on Google Maps and shows you where they all are.  The ICO do it, the CAA do it that way because most of their customers are the airlines, the MOD, and they've got all the processes set up. It's just hobbyists who don't. You have to submit the form one month before your flight and during the week before your flight you have to contact the department to check that you still have your assumption you've got permission to check that that assumption is still valid and that they're publishing a NOTAM because what they do is say this is a three kilometre exclusion zone. Be aware that there will be a balloon launch on this date between these times, you tell them the times. We've gone for 10am to 4pm. I know Bristol Balloon Festival has a big lift off at 5 or 6 in the morning because the air is nice and stable then. None of us ever think that anyone will get up that early for this sort of stuff so we don't do that, we do it during the day. I've also requested a day the next weekend in case the weather does its usual British thing or you get up and you discover it's too windy or it's raining or typical summer problem. Fingers crossed we'll be doing this in a month. I had hoped that our first launch would coincide with today that hasn't happened for all sorts of reasons basically including holidays because it's a community project. It's not like running being a project manager at work. I have to remind myself I am not a project manager, I'm a cat herder. It operates differently. The people involved suddenly go on holiday, get ill, change their minds all sorts of things that human beings do. Quite good fun really. But if you are interested, I'm running, at least I think I'm running a workshop tomorrow. That's me done, any questions?


My name is Alicia Laramie and I'm the program manager of New Farms for New Americans and right now we are at one of our two farming locations where we have 10 households who are farming and our other location is we have 60 families farming. New Farms for New Americans is a project of AALV which is a non-profit organization that works with refugees who have been resettled in Chittenden County and the work the AALV is focused on is primarily long-term integration into the Vermont communities. We focus our work on employment, employment training, citizenship applications. We have a lawyer on staff. We do a lot of work with helping people access different kinds of benefits and navigating systems that are in different language in English and which is not the primary language of most of the communities we work with. So we have full-time staff who speak, I think we have at least seven or eight languages that are spoken regularly in the office and clients from all over the world who have been resettled here. So from New Farms for New Americans perspective our focus is really on the communities that we serve and meeting the needs that they have in their new home in Vermont. And so we found out a long time ago almost 20 years ago that farming was an important piece to people's long-term integration and livelihood here in the United States. Farming is a way of life for people. It was many people were subsistence farmers before they arrived in the United States. They want to continue that. They want to continue their agrarian traditions and livelihoods. It brings purpose and meeting. It's a way of getting exercise, a way of eating the foods that are culturally significant and important to them. In addition to regular things that people recognize on dinner plates, tomatoes, potatoes, onions, all of that, but there's a lot of other crops that people are growing that are not really being grown outside of maybe a few other places here in Vermont. And so it's a space and a place that is so much more than food security, which it is a big part of people's lives. People have learned how to grow food here in Vermont and save that food and preserve that food for the winter, which is a fairly dire time for folks. But it's a place where people come to see other members of their community to speak their language. It's a place where they feel home. It's a place where they feel like they have something that is theirs to tend. It's so much more than just a place of food security. I don't know how else to say it, like they come here every day. Yohani, who's farming right now, I've been here 11 years, and every day I come here, he's here from morning till night.  And yeah, so I don't have to give elevator speeches to the farmers because it's in their blood and they have a whole community of people who out there when people are resettled, oh, do you farm? Oh, you're going to want to register for new farms for new Americans or maybe one of the other community garden spaces. But what's different about ours is we have really large gardens and we recognize that people want and need and can grow on larger tracts of land. So our program is centered on responding to what their needs are. And that's one of the things we've learned over the years is that people need a lot of land. Great. And I think if you touched on it a little bit, but obviously there's a really big value of community here with the farmers being able to speak their language together and just seeing each other, familiar faces, day in, day out here at all hours of the day tending to something that's their own. How do you think that, I know this program's been around I believe 15 years, how over those 15 years has the program grown, but also how has the community grown? Well, refugee resettlement really shifts and changes depending on who the refugees are that are being resettled. And so we've kind of transitioned over the years from one group being a larger demographic to another group. When I first started there were a lot more Bhutanese-Napali. Now we are seeing a lot more of the Congolese community being resettled here in Chittenden County. So there's those kinds of shifts which are natural. There's been a lot of changes in terms of people doing out migration from Vermont. Well people love Vermont and for like the Bhutanese-Napali community it's a very peaceful place. It reminds them of Bhutan. It's very expensive to live here and there are a lot more housing options in other states. And so we see shifts sometimes and people do with outward migration. The program itself it started, you know the program was like a lot of programs, refugee agriculture programs throughout the United States started as a program to help people become self-sufficient through farming and there was a commercial focus to it. And these programs were sponsored by the Office of Refugee Resettlement and sometimes the U.S. Department of Agriculture and the sort of general perception was that if you were farming it was for profit or commercial or if you're farming you would want to learn these things and that these were happening in the rural areas. One of the big shifts that I've seen nationally is that people have started to recognize that there's a lot of food being grown in urban areas and it's not just rural which has been a huge plus for an organization like ours because now we can say yes we are here we exist in an urban area which is often where refugees are resettled they're not resettled in rural areas because employment is a huge part of the resettlement process. So we have people being recognized as farmers in urban areas but also that farming for your household to feed your household is as important as the commercial farming that's happening and so there's been more kinds of grant funding out there that recognized the community garden aspect and community garden has this I think this notion of small hobby sort of plots and that it's a lot of people coming together but this is all the land that people have access to it's this is these these communities are slightly different in that they want larger tracts of land if they can this is not hobby this is not to supplement this is the produce coming in for their family and they will be able to save for they'll buy three freezers and save all of their tomatoes or all of their African eggplant and for the entire year so it's community garden I think sometimes has this quaint element to it and what we're seeing here is not this is these are people working hard every single day many families going working full-time jobs eight-hour jobs and then coming here and spending an additional six hours at our at the farm to grow food for their family for the for the whole year so those are some of the shifts and changes we've seen both nationally and then sort of locally great and so earlier in July Vermont had some really bad flooding some of the worst they'd seen in years and as a result of that flooding which was just rainfall that you know these farms were underwater and I think in the weak sense you know the Vermont has had a lot of you know community coming together community help rebuilding and I think there's been you know especially you know Montpelier was completely flooded a lot of focus has been there but I think a lot of people aren't talking about farms like this where it's just you know a lot all this rebuilding that has to happen and people aren't you know people recognize you know oh yeah some of the farms are underwater and they're going to rebuild but it's not a temporary thing it's not oh you know just replant the crops right that's it for the season for some of these crops they're done and this will also impact years to come so I think part of you know why we're chatting is you know to bring awareness to these other farming programs that have been impacted that aren't being talked about as much compared to maybe some of the farms that it's people's hobbies or passion project you know they go and they sell at the farmer's market on the weekend and it's their thing and you know they're raising hundreds of thousands of dollars to help support themselves because they have just more you know I don't know community you know they have different platform I guess and so people really aren't talking about other farms like this that have been impacted where you know people are back out here and trying to rebuild and you know I mean you can still see where you know the water was so can you talk a little bit about that first I would say that if you lose a loved one whether you're a commercial farmer a community gardener or a gardener with new farms for new Americans we're not comparing the pain that someone nobody's pain is more than anyone else's pain and that everyone's experiencing this in the ways that they come to farming and so there's no comparison it's mostly just recognizing that there are differences and you know for a program like ours and for the 170 community gardener gardeners who are here with Burlington area community gardens which is just down the road from which is also on this land you know no these those people are not being talked about either but there is community at those the area the community gardens there is there are Vermont garden network provides education every week there's there's a lot of good things happening on this land outside of the commercial farming as well but it's not I don't mean or ever want it to be considered that's a comparison just differences in how we come to this land and for us we are not a commercial program or farm so we don't have access to some of the the federal funding that will be out there that is just the way it is so and and that's important to understand because it does change how we recover but we also are grant funded for the program piece of it to help us exist to help us be on this land to provide the infrastructure for the irrigation to provide all of the supports that need to happen behind the scenes for a program and that's so we haven't put in like an investment into our commercial farm the way some of the other farms but what has been invested is farmers individual their individual inputs which is both financial they've they've gone out they've bought starts at the you know starts for their plants they have been supporting the local economy in all of these other ways by buying fences buying compost buying seeds buying tools those things have been lost for 75 households people have had to go you know they see their their money just like their money was taken away by the floods all of that time not to say their time and energy which is also incredibly important so we rely on you know I'm some of the private donations that have been coming in and the foundation money and some grants our hope is to put that money back in the hands of the farmers to say rebuild here are some resources for you to rebuild your farms to get back to where you were and and we can't replace the the crops that were lost but we can help people have hope for next season one of our farms currently is completely devastated and that's where we have 60 of our households are this is our other site where people are able to access the floods they were just hit differently they're on different lands and yeah so these the farmers here are able to start coming back these 10 households that said a lot of the work that we've been doing post flood is first on safety people safety and if you it's hard to imagine when you speak and read and understand English it's hard to imagine what what it means to understand the research that's out there I mean I was just sitting on a meeting with the remote agency of agriculture and a bunch of the UVM faculty who and extension faculty who are helping us navigate these guidelines and people still have questions and people who have been doing this for 30 years still have questions people who have been through more than one flood here still have questions and now we're trying to take that information and say how can we help our farmers understand in the languages we're currently making educational videos in five different languages to help people understand that not all crops are affected the same we are not FDA we do not have to abide by FDA regulations because we're not selling our food but that doesn't mean that those things are not important to us I mean food safety is food safety and so we want people to be informed and have knowledge and if we're not here to help people understand what's salvageable what you can do what's absolutely off limits then who is nobody and yet there's an incredible amount of food if every farmer here harvests is 500 pounds of food at least 750 pounds per plat every household that's 750 pounds of produce that they need to understand what they can eat and what they can't eat and so we've gone into just like we've had to quickly reframe and transition some of our education which we do a lot of anyway to be all focused on flood recovery and flood safety and human safety human consumption of of flood exposed crops so well some farms because of FDA regulations and their commercial sales have to eliminate all the crops we have a little more flexibility but we are not in any way you know putting safety as on the back burner like that is also incredibly important to what we communicate but people have the power to with education empower themselves and but we have to be there to help them do that looking to the future how do you think the community can come together and support each other and you know help rebuild or just help spread awareness education what do you kind of see the next steps forward well i would say that a lot of the families are not unfamiliar with floods if you're a farmer you know you've been through floods before i think you know some of the reflection that i'm doing now is it i don't even know how many days it's been or i feel like maybe we're 10 days out 12 i don't even know but having like little glimmers of reflection some of what i've been thinking about is we're dealing with climate change we're dealing with we're dealing with the humanitarian crisis on this scale i mean humanitarian not just for refugees but for like the people throughout vermont and the country but if we're going to look at it on a micro scale like this is kind of what the world is talking about out there that is somewhere else but now here and we need to be talking about climate change and climate resiliency and for our farm focusing on climate change and climate resiliency is really important because how can we adapt our growing to to respond to climate change how can we be thinking about more resilient seeds and that's a big part i didn't mention this before but like a big part of what happens here is these seeds are all saved year to year everyone saves their seeds to so that you know some seeds because you can't go out and buy them and some seeds because why would you go out and buy seeds if you could save them they're free when you save them yourself it's just obvious so talking about crop varieties that are more resilient to climate change we're also really interested in conservation practices on a farm scale that will respond to flooding what could we be doing differently here that helps our our land not be so prone to floods now flooding can be really good if you don't have a lot of contaminants upstream it can also be very harmful um traditionally historically these are the best places to to be so how can we be here but also be doing plantings and that help our farms survive so i think as a community our next as we move into the next three years we're going to be thinking a lot about climate resiliency um in light of this flood and this isn't the first time this program has experienced flooding like everyone else Irene you know set the precedent for for this how we navigate this whole situation and um but now that it's happened twice unless in like basically a 10-year time frame we need to be doing more in partnership with conservation services natural resource conservation services with you know conservation programs organizations that say we're here to help help you you know navigate this and make your strong farmer farmer stronger hi you honey how about it how about it yeah it's a lot of work he here is again to do more work because he's putting up his fence again which he does by hand not by his fences he lost his whole fence was over there after the floods um and now he's rebuilding his fence by hand for the second time this season and it's a lot of work so um yeah and you know you honey's been farming with us for 15 years and he rides his bike down here every single day here all day so much admiration for him to keep coming back i don't i don't know how he does it yeah i think lastly uh you know is there anything that we didn't talk about that you want to you know talk a little bit more about i just wanted to add that i feel like it's we're so grateful for what the community locally and at large has done for this farm um that people know that we're here recognize us um see see us um and that um you know we've just been overwhelmed with all kinds of uh anonymous and donations businesses and it's all it's been a really emotional experience for me for the farmers both in terms of the support we've received but also for um just you know just the whole experience of navigating what to do when you see your investments washed away and and for refugees i feel like this is not unfamiliar trying times are not unfamiliar for people uh you know some of our communities have lived in refugee camps for 18 years and my heart and thoughts go out to what it must have been like to live in a situation in which people experienced food security and how much of this experience now reminds them of moments where they experienced food insecurity in a refugee camp where you don't feel in control of your your life and the farm gives people control of that a little bit and um so with the support of these donations and communities we were able to invest back in the farmers and just so thankful for that well thank you for meeting with us and for being here um we're here at the new farms for new americans at the intervail uh and you're watching time eating tv


Sorry for delaying. Okay, can I start? Anytime? Okay, sure. Hello everybody. Thanks for joining. My talk is AutoRF, a framework for automatic firmware reverse engineering. So I'm working as open source firmware developer at NineElements and we wrote this framework just for fun and not for profit. It's open source available on Github since yesterday. It's brilliant Golang and it allows to do black box testing of firmware. It does abstract zoom text tree generation and is then able to generate C code out of that. The whole thing is backed by MySQL database and I'm going to explain all the details in the next few slides. So what's bootfirmware? You all might know that's the most privileged code running on your machine. When you press the power button it does all the hardware initialization. For example that's core boot or UFI and it usually loads the bootloader from disk like grab and then the bootloader loads the operating system. And in this talk I'm going to focus on the firmware part only ignoring any later stages. If you look at core boot it's written in assembly and C code and divided into multiple stages and each stage loads the next stage and every stage has a specific hardware initialization and let me show you. If you press the power button and you see here overtime first of all is the boot block written in assembly which loads the ROM stage that does the DRUM in it and once the DRUM is available we can initialize other devices like PCI, PCI Express and so on. And after that the bootloader or in case of core boot it's called payload is loaded into memory and that loads operating system. And I only care for the first stages as shown here. So in a perfect world for example the core boot running on the syncpad X230 there are no blobs everything is open source it has basically been reverse engineered so some parts of it but that also means there's no register documentation on some parts that means you write magic numbers somewhere into the PCI space and then everything works which isn't that nice but at least it's open source and you can see what it's actually doing. There's microcode which is loaded as shown here the yellow bar it's loaded in an early boot block it's not directly code so I'm going to ignore it and claim it's 100% open source even though it loads microcodes and we have got another example here core boot on a super micro server X11 SSH it uses multiple blobs in this case it's the firmware support package fsp it occupies about 500KB of space in the spy flash and core boot itself so the open source part of the firmware only occupies 200KB and core boot jumps into the fsp and let the fsp do all the hardware installation as you can see here so one big part is the ROM stage is bringing up the DRAM and then in the ROM stage it does all the device initialization and sometimes coreboots need to undo what fsp does because some features cannot be disabled and then if to yeah and there's also microcode updates again it's loaded on the old boot block so but I'm only concentrate again on the blobs so what are blobs? Binary latch object there's no source code available for the blobs usually there's no documentation what it does and that's because of that it's difficult to integrate into open source firmware there might be security issues because you don't know which register is already locked or isn't locked and you should lock it in an open source firmware there's no link assembles that means you always have to use the whole blob even though you only need to single feature out of it there's no garbage collection and the size cannot be reduced also debugging is quite difficult usually there's no debug output that would make increase the size and I guess it would allow or give insights what the block actually does so what are we allowed to do? I'm from Germany and this is from law translated into English so I'm allowed to gain basic knowledge of the ideas and concepts by just loading, displaying, running the program and I don't need permission from the copyright owner that basically means I can do reverse engineering and even though then there's some sentence in the license that doesn't allow it the question is what is the implication of raising in the term of law? so the law isn't very precise okay there's another passage it talks about decompilation and it says it's only allowed for interoperability but it doesn't say what decompilation at all so it just mentioned this term and it also says if you decompile it you're not allowed to create a program that does basically the same so we cannot create a free and open source software out of it so the only thing we can legally do is black box testing we observe that's just shown here so black box testing we have the firmware that talks to the hardware and we can observe the I.O. and we can observe bias options like settings you usually do in the bias menu and if you observe both we can generate a model out of it and that model can be free and open source but there's some issues it only works on a single hardware it's very difficult to see branches inside the firmware and to catch corner cases there might be some fix up for specific devices and if we don't have that device we simply won't see that fix up when we observe the I.O. and our model is likely incomplete and there's lots of data we need to analyze and we cannot put the firmware in an emulator like QML because it doesn't emulate the hardware okay so what do we need to do we run it on real hardware and there are similar projects like CRIs and avatar too that put the firmware inside a patched QML but that's something we haven't done so we put the emulation inside the firmware and in this case it's a library called libx86mu and it allows to trace I.O. and send it over the CRI port and it also allows to upload BIOS option like change it to fake I.O. or skip I.O. and the whole thing is done in a client server model let me explain so this is an open source library you can find it on github it emulates x86 CPUs so AutoRef currently only works on x86 but in theory it runs on any architecture so the library allows to hook to specific instructions and in our case we only care for I.O. instructions it only does 32 bit it only does 32 bit yes that's right and what we do we never so we don't jump to ROM stage we continue running in ROM stage and instead load the library and the library emulates everything and so the ROM stage and the payload run in this emulated environment the stages doesn't even know that they're being emulated again here you can see the blobs what we are doing is we are tracing all the I.O. of the blobs in the ROM stage so this method works on any hardware there's a serial port with that we can observe memory access like read and write access to the PCI config space access to I.O. ports and machine specific registers and the CPU ID instruction and so that's the complete set of I.O. firmware talks to hardware and we can just observe it with this library you can see here it's not that readable but you get an impression what it does so in this case it's mostly PCI reads and the last two are memory accesses what we actually can do is convert it to something more readable like C code and you can compile it and run it on or replace the blob and put it into your firmware it actually won't work it only works on the single machine for the single configuration which is not what you likely want so what we can do is generate a syntax tree and that's the main feature of the framework it collects traces and put them into the database and then merges all the traces into a syntax tree as you can see it's a directed graph and if you have two runs on the first run the bias option one is set to true on the second it's set to false and you can see there's a slightly difference in the I.O. operations and we can then merge it into a graph and actually see which bias option triggers which pass and the merging is done with the LCS algorithm and it tries to generate a minimal graph that has some issues as it turned out and we then can convert the abstract syntax tree to a high level language again we only implemented this for C but in theory we could just generate anything like Go or Ada or whatever analyzing the mesh is quite time consuming right now we only tested this with QMO and a small example and it's in this case it's okay but on real hardware it's pretty slow you can see here that's the the abstract syntax tree converted to C code and this is another example to the framework ships a simple QMO code boot image that runs in QML as you can see that's the graph generated every node is a single I.O. instruction and if you generate C code out of it it doesn't look that pretty it's not even complete it just continues below the slide so that's only and that's something we need to work on and make pretty C code there are quite a few to do we would like to add plug-in support detect loops inside the firmware because right now we can't detect read modify write operations usually only one bit is set or cleared we can't detect that right now there's no dead code detection so if we run into a code pass we shouldn't and it just crashes we won't see that we have no sec-fold reboot detection we need to work on making pretty C code and optimize the abstract syntax tree even more then this usually the question can we reverse engineer like the complete FSP and have some stats so I assume you have four CPU sockets with four CPU each and four DIMMs for memory and do test for different DIMMs two piece cells bridges 16 USB ports quite a few piece express lanes which can be again equipped with different devices up to eight serial atta ports and FSP has quite a lot of options that can be configured and I only assume they can be true or false then we have two to the power of 588 times 15 minutes to collect a single trace and that's going to take quite a while and then after you collect all the traces you still have to analyze the C code so black box testing might give insights into the firmware into small parts of the firmware but it's likely not the correct approach to reverse engineer a complete hardware installation like the FSP and that's it already I think it was quite fast do you have any questions so far? yes so the question was if I recall timings right now I don't record timings and as you have seen we only trace IO in the RAM stage so DRAM training isn't or it isn't possible yet to capture DRAM training only everything that lives in the RAM stage so as we send everything over the serial the comport it takes a while and we might run into some timing issues that bits are already set because we wrote out a single line over the serial so yeah we could work on that maybe use a different approach of sending the traces did you observe any behaviors that were obviously in bugs so I only recorded one trace sorry so the question was if I observed any bugs in blobs so I only run a single trace on a FSP and as that's why I said it takes 50 minutes and I didn't have that much time to collect more traces I continued working on the QMO demonstration because it takes about 5 seconds to capture a complete trace but that's something we could do just let it run overnight and then analyze the C code do you explain emulator for running DFI option logs and there when you run x86 for option log code in an emulator you run it in lots of like no point of view references and other things that you don't see when you run the data so you run the emulator so that's why we are we are running blobs that are usually compiled into protected mode so we won't see any issues with running option runs that are usually compiled into 16-bit real mode I doubt that there will be lots of issues with it because we can see that those blobs are working quite well on modern computers and yeah yes please I know that on the other hand the definition of a trace is a metaphor interpretation if you write an emulator it's a trace for every instruction it carries out I would still consider this a trace others would consider it to be a debugging exercise but in this regard the way we formulate the law they work into your papers because I see it as a single instruction you just have branches that execute differently you don't know what's happening in between you don't have great timing even an idea how long it takes before two pieces of memory are being read or written so finding out the heuristics just to spot blobs will already be quite a bit of a challenge there may be shortcuts there I would suggest to consider some of that yeah I think it was the note the note was about the German law it turns out that we are likely on the safe side of the law because we really only capture the traces and don't use it as debugger to trace every single instruction so it could be quite challenging to detect branches and type loops on the target because everything is slowed down and we only really see I.O. and not the decision to send out the specific I.O. instruction any other questions okay thank you for attending


Hi The Harriet has some technical issues. His machine keeps crashing. So I'm harrowing myself. My name is Falkon and I Work a lot at CCC and one of the things I work at is the members desk and Maintaining the data register So we of course want to communicate with our members With the encryption when we communicate and so I want to integrate PGP into That system and today I'm going to talk about how I do that with Python Or not Okay, so I gave you the context If you are interested How the member management actually is working and what problems there are Why don't you go to media CCD and Look for Falkon I have a couple of talks about how this entire system works Let's start at the beginning We have a member management application written in Python and as naive as I am I just Was want to use something like PGP to send encrypted emails So I'll start with pit what Python packages are there that support GPG and You get some results and you look at them and Some are better than others and some are outdated and and maybe there's something that everybody's using Then So at that point my mood got a bit worse So I'll take you along on a short tour on what things there are Let's start Let's start with Python new PG An author That was a Python binding that Was very popular But it's a really simple wrapper Around the GPG executable internally It simply runs GPG with a sub process be opened add the command line parameters and run it and I added the shell equals two because this is one of the big problems about this this package has a lot of Security issues with a shell exact injection. I I can't really tell you the exact Patterns, but you you you add a couple of interesting things to the data you want decrypted and Bingo, it's executed pipe GPG So what does the interface look likes? Is the calling the command line interface is super in stable because It changes all the time. So for example GPG Let's you use the command list public with with colons gives you a Machine readable version of the data and the colons here are the delimiters between the various fields Hopefully that you can use In your own program, it's the problem is it's your own format. It's a custom format. You have to write your own parser To read that data. That's only some are great Fun fact if you add a cold on to your username or for a comment they did cover that so it's properly escaped so So and if you use the escape character backslash x3a that is escaped Itself again, and so when you read that you have to take that into account But what happens when the format changes? for example in in GPG version 2010 the format changed That the time stamps were changed so the wrapper Completely fails because it cannot read the time stamps and if it doesn't check for this change explicitly So weird things happen so this module So this was the first module that the members administration worked There were interesting things in there. So for example if a key expired Only an empty return was given but no acceptance wrong and that meant that simply An empty email was sent and if you have been a member In many years ago, you might have seen exactly that happen and you Might have gotten an empty email and we get good responses Oh Why did you send me that empty email? So I got a template to reply to those. Hey, the problem is probably that your key has expired So Very bad Very bad detail at this. So this is not a completely empty email It just looks empty. It has some weird Weisberg's characters in it So you have to strip the white space you could have dealt with that and You could have tried to anticipate that problem by checking the keys or illidity before trying to use it But that's not a good Good program practice. I want that The entire system fails if something goes wrong in the encryption So there's a new package to new PG Which is kind of an update? No, it's not an update. It's it's a re-implementation of the implementation and The suppressors invocations were so horrible with Horribles with security issues and so on and this this is approved. This is Is Is not compatible to the old version to the old package The API the Python API is actually different But it still has the problem that it is a wrapper that calls the GPG command line tool with an unstable interface So what else do we have? Let's look into Outside of pi pi The Koya is a Is it's its own custom open PGP implementation? It's it's not a wrapper. It's a complete replacement for PGP or GPG and Sequoia is written in Rust, which is pretty cool Because rust helps you Avoid many of the common pitfalls like buffer for overflows and so on It helps you completely avoid that and So that's a pretty cool thing It's a pretty performant There is an attack on PGP keys called Signer signature flooding last year there were two keys of two of the GPG developers were spammed basically by Uploading 150,000 keys for each of the two people and That basically meant that you couldn't use with GPG anymore and New PG simply Didn't didn't work anymore. It slowed down so significantly That you couldn't use it anymore because it was trying to use all these 150,000 keys So Sequoia Managed to do the import of these hundred fifty thousand keys in only five seconds. So that sounds cool So let's guess what kind of keys we see in our membership database So would be very cool to use What the Python sequoia Python sequoia bindings status early prototype I looked at it Looks very nice, but there is a lot of stuff missing that we need in our membership management So let's continue looking though Let's look at the people financing sequoia The pretty easy privacy foundation and they have their own product called pet So they use GPG me and Provides their own Python bindings but It is open source But the installation is really hard To say it like that I had You have to Multiple dependencies you have to pre-compile multiple deep dependencies there's no ready-made packages for Debian or similar and Finding the instructions on how to actually do this is really hard to find on on on the website The link to the instructions gives you four four So I finally found the repositories and there's a read me and The read me doesn't tell you which brands the most recent branch and you have to use that other branch They cycle of dependencies With and you have to use the the right command invocation to get out of that and luckily I was I Know one of the developers personally so I could get around all that and I finally had the Python bindings ready to go And it looks very nice. I like the API There's identities you can create that have keys and then you can create a message to that identity and Whenever you make a mistake You immediately get an Ise assertion and the entire Python crashes and That I don't want I just want a regular exception And If the if if the Python crashes I cannot deal with that properly I Need to be able to tell like the user that the recipient. Oh your key has expired and And and to find out what has happened. I have to restart everything with a debugger and If I have to send out 20,000 emails that isn't really practical So maybe somebody can look into that and in and improve that software and So when you start sending that Emails with it. This is the my message. We get it's an email message that looks empty And not sure why that happens But so I decided pep looks very nice, but there are too many issues for me to deal with so GPG me pep is based on pgb and And and those are the official Python bindings of glue PG. Let's try that. So how do you do that? you create a project you create a requirements to exceed and That's where it starts So which GPG me do you use do you use the one from pi pi or pretty much every Linux distribution that Includes GPG also includes a package for the Python bindings Why are they doing that? That's because these Python bindings Have to match the version of a canoe PG. Otherwise it won't work So the problem is So you don't want the Python GPG the Python package from Pi Pi, but you do want to use the operating system installed package so you have to somehow manage to pick up the right package from your operating system into your virtual environment You can do that But this leads to Very Bad problem because I'm using Pippin and so I have to give you a short introduction to Pippin and Pippin is a small tool to create virtual environments In a separate directory Automatically finds it again when you use Pippin commands and you can directly run commands with Pippin in front And you can check with Pippin if one of the dependencies that you have in your list Have any security vulnerabilities and you can tell Pippin to automatically upgrade them So that's very good The only problem with that Pit and Has a bug where quite a number of those versions Cannot take over Is like use this the command line parameters for system side packages and that's where Pippin Pippin explodes So with Pippin you can't use packages Outside of virtual environments So I had to remove Pippin from the equation the bucket bucket fixed and eventually There will be a version of Pippin that can deal with the problem But it takes all a very long time So encrypting things is one thing But I also want to download keys So in the member management We only use a key ID that you can add to a user's record and The membership application actually has a field for the key ID And we use the classic key servers to search for the key downloaded and use that And that was wonderful working well until Hagrid happened Hagrid is a key server based on Sequoia Developed in Rust Deals very well with the signature flooding problem and Can survive the signature spamming and it does quite a few things very nicely for example if you look at the classic key servers they Built in a way that you can only add data so if Somebody gives me their key and I upload their key and It's being added to the server and nobody can remove it So the the owner of the key The only thing they can do is revoke the key But they cannot remove it from the key server and the email address Is publicly available on the key server forever? So Hagrid introduced a way where keys are only added If you confirm by email that you actually want your key added to the server additionally you have to Say that the classic key servers are written in a very obscure outcome dialect and software behind it is a Very clever algorithm to synchronize the key servers between the various instances a PhD thesis program But really hard to maintain because very few people can read the cane Can read the code and very few people actually can provide improvements and Hagrid of course is Well a lot better suited to this situation because of Using Rust and so on and so all the tools are Eventually switching over to The new Server so you can see here all the all the New machines and the new packages all switched over For deep as a default server to the new one so The problem is that we have a lot of people who are using the old key servers and New people are using the new key servers and don't even know that there is a different world with the old key servers So So you have to explain to them Why don't you upload your key to the old one and and they they don't want that because they don't get the confirmation and so there's a lot of trouble trying to get that working and So the easy solution here is we just try to find the key on both the new and the old instances So So that's not easy to do in PGP because There's a single conflict file and you can you can add a number of key servers and GPG only use one of them even if you have configured multiple servers. So if you want to query multiple key servers You have to edit the The conflict file for the agent and GPG and So you have to edit that and then So whenever you want to look up a new key You have to repeat editing the file and creating the key and that's not something you want to do for two thousand males and Especially not in parallel that won't work So not very nice. We're not the only ones having these problems. So So for example this HKP for Pi HKP is the name of the protocol that is used to query keys from the servers and the small module Python module Can talk directly to the key servers and download the key server from the keys from the key servers HEP base protocol and and it's very simple as these servers and and as download the list of this this list of keys and Then you can import them directly into GPG So everything is fine but I Fell flat on my nose there because my GPG bindings doesn't have a key import function I like stable software. I have an old version of few want to and 1804 is Only two years old, but is completely out of date from the viewpoint of GPG and The import version the import function is all it has only been available for less than two years So another thing where we go back to the beginning do I want to upgrade my GPG? Is it really easier? So in july is probably the word in the time when you should switch LTS releases So then you can think about oh why don't I do a source in install of GPG very very simple. It's only about 30 steps and So I wanted to keep it simple and and not too many complex steps and keep it simple GPG me if you do it right You can do it. You can encrypt your emails But there's a lot of stumbling stones pitfalls that you have to get around You can do that you can download the keys You can decrypt emails So and and handle the private key So let's continue looking So we don't just want encrypted Contents we want the email to actually go out as a PGP mime message in the old standard PGP Would PGP GPG would simply attach the encrypted message as in the tension, but The new mime format is much better because email clients can work with that a lot more nicely So there's a lot of modules that you can use for on pi pi PGP mime is one of them you find Quickly So if I understood correctly Looking around at the documentation and the source code the as one protocol is what the GPG me bindings use to talk To GPG the problem is So They managed to remove many of the sub-process calls, but for some it is still necessary and The last commit was in 2012 and It's it's like one student who did that and nothing has happened since So email GPG a Very thin layer and that simply builds up mime messages And doesn't really do any of the GPG bindings So I can't remember the name who did this Rise up I think I Think the people behind rise up put this together It would it was created once 2018 there is no documentation and If you look at the source code In the standard configuration, it doesn't do anything with encryption and the only thing Anything everything you need to do is replace the know-of codec with the proper codec I think it could work well, but I haven't tried that yet It's on my to-do list for one of the next times I look at this then there is GPG mail encrypt It's it's the it's the kitchen sink it does everything It uses sub-process calls It integrates Integrates various scans and spam protection and has its own mail server built in And the idea is that this is a gateway Before your real mail server to do everything so way way too much for my purposes So GPG mine Uses Python glue PG the very old module that has all these problems and I don't actually want to use that so crypto mine the same basically GPG lip lip it becomes interesting here it can use Python glue PG or GPG me and GPG me is Is the Name that the official Python bindings for GPG had and it was renamed at the very last minute and They haven't followed the renaming and the last commit is 2017 and It doesn't look like it would work together with the current GPG At that point I decided that that's not something I will look into in detail So finally I Think I'll just build it myself. Mime is not that hard There's the email mime package from the standard library and Creating a mime email Let's look at how PGV mine is actually set put together You have a multi part mixed message the container So the very first line Defines that and the very last line ends it and in between there is a multi part alternative So with text plain and text HTML So you can send out different variants of the email And can put in an explanation for people who can only read the plain text and Then there is an attachment and we can add multiple attachments and This will always be shown because it's not in the alternative lock If somebody gets an email with Apple Mail With Apple Mail and We have to We have to look at the plain text and Since the attachment is part of the HTML part. It will not be shown So all of this is encrypted with open PGP And then Add that To another mime mail container That looks like this So you can see from Begin PGP message to end PGP mission which is put into a multi part encrypted container so far so good That's what you need to do You have to Use GPG you have to pick the version of GPT somehow get Python bindings up and running and then package it all up in mine and at the end I Recommend that if you Do all of that you should set up you have a test setup where you Basically create encrypted emails Into an email file which you can open for example with Thunderbird So to summarize Take the Python bindings from glue PG version 2012 or newer The official bindings Use the Python bindings Delivered by your operating system so it matches the GPG binary Use hkp4pi for the key server communication and Then somehow build some mime around it This can be really hard It it's really helpful to reread How PGP mime is actually to be implemented so reading the RFC is really helpful A really great ecosystem. It's a lot of fun to work with it And now I'm ready for your questions


Welcome to the NTN Nightly. I'm Nisha Charles with a special edition post-Tropical Storm Dorian. At 10 a.m. Tuesday 27th August, the National Emergency Management Organization, NEMO, gave the all-clear for the resumption of normal day-to-day activity as Tropical Storm Dorian moved away from St. Lucia. The all-clear followed the discontinuation of the Tropical Storm Warning for St. Lucia at 8 a.m. by the Met Services. St. Lucia began feeling the effects of Tropical Storm Dorian at approximately 2 a.m. Tuesday. Acting Director of NEMO, Doreen Gustave, explains the difference between the discontinuation of a Tropical Storm Warning and the all-clear. When a discontinuation is given, the country is not in an all-clear. As long as there is a shutdown, the discontinuation does not determine an all-clear. As soon as the discontinuation is given, the assessment teams, our first responders, are sent out there to ensure that conditions are right, that there are no hazards out there. Power lines, for instance, are not down, the roads are passable, and so on. This is what happens after the Tropical Watch or Tropical Storm Warning has been discontinued. Despite the national shutdown at 6 p.m. Monday, 26 August, and the many advisories urging members of the public to remain indoors, individuals still ventured out putting their lives at risk. Members of the Royal St. Lucia Police Force were out ensuring that the public heeded the advisories. When persons decide to go out there in spite of a shutdown noticed by the government, they are putting their lives at risk. And also, the first responders, the EMT, the police, you are putting all the person's lives, not just yours, all the person's lives at risk. So we're asking, as soon as a shutdown has been issued, we're asking persons to stay indoors. Stay indoors until the all-clear has been given. Better communication and enforcement of the law is needed in times of disaster. So says Deputy Chief Fire Officer George Victrin in the aftermath of Tropical Storm Dorian. Victrin says that while it is a work in progress, officials need to work more closely with the public to ensure that all are kept safe during such times. Most persons had head to the warning, but we saw that early this morning, after six minutes to seven, there were quite a few persons on the road, motorists, as well as persons walking in some of the towns and cities, which was not advisable at all. Because we were still on the shutdown, the all-clear had not been given, and those persons were putting themselves at unnecessary risk. The Deputy Chief Fire Officer also reported that there were no major reports as a result of Tropical Storm Dorian. No major reports relating to the storm. We had a fire at Vufot, which was a major fire, but that was not directly related to the storm. But all in all, it was very quiet, our normal ambulance responses. And as we speak, we are still very much on alert. All our staff are still on duty waiting to see how things develop. And the Saint Lucia Electricity Service's limited Lusilek says the electricity system held up extremely well during the passage of Tropical Storm Dorian. There was no damage to any of the major electricity infrastructure, such as the transmission lines, substations, or any of the generation plants. Although the period the country was under Tropical Storm Warning, there was only one call of a fault in the south, and two calls of area faults were received in the north Tuesday morning. In its statement, Lusilek reminded customers to trim trees on their properties, especially at the beginning of the annual hurricane season. This will not only reduce potential damage to customers' properties, but will also help to minimize damage to electricity infrastructure from falling trees and branches and prevent power outages in some instances. Prime Minister Hon. Alan Shastney says he's thankful that the island was spared from Tropical Storm Dorian. Speaking to NTN Nightly via telephone, Hon. Shastney highlighted the government's proactive approach to disaster preparedness. As a government, we have taken on the position that we are going to be in a constant state of preparedness. These storms will come. They are very unpredictable. So the fact is this storm could have easily strengthened, even from the time it left Barbados to San Lusio. We've seen videos of what took place in Margenique, so I'm just very, very grateful that we were spared. So I think that the attitude of deciding to be in a state of preparedness and then making those resources available is the right one, and we're seeing that it's paying off. I mean, so simple things like waiting for the hurricane season to try to check the radios of Nemo. Nemo's radios have not been working for so long, so for the whole year we've been fixing up the repeaters and getting that system fully operational. Satellite phones, and we now have three satellite phones, and every year we try to add one or two more satellite phones into the system. The police now having their own communication system, all these things are helping to strengthen our ability to be able to handle and cope a fallout from a natural disaster. The Prime Minister also emphasized the importance of engaging the public as partners in disaster mitigation and management. Hon. Roshasne says Tropical Storm Dorian also presented lessons for the government. There was a video that was circulated of some homeless people, we think, in the CDC areas that were sleeping outside past the curfew time. I've asked the Ministry of Equity, Nemo themselves, the police, and the city council to look into this, because that should not happen. I mean, there are a lot of emergency sites that shelters that people could have gone to. I didn't hear one report of any shelter being over occupied, so the fact is it really comes down to a point of enforcement at this point. We've just spent a lot of money in helping fix up the facilities at Cornerstone, which is right there in VG. So again, there has not been a lack of facilities for these people to go to. It's just really different agencies must take ownership of it. From a communications perspective, this year we had NTN and GIS based at the Nemo facility. I'm preparing the information and sending it out to the different information channels, so the different TV stations and radio stations. Several radio stations were on all night, and one TV station did a really good job of staying on air. So we have to review whether, in fact, that worked. I know that there was an instance this morning where the net office indicated that we were no longer on a tropical storm watch. Some people, unfortunately, misinterpreted that as being as in all clear, but we were able to make some very quick phone calls. So the key is to continuously review our communication strategy to make sure that it's on point. And that was Prime Minister Alan Shastney. You're watching a special edition of the NTN Nightly Post-Tropical Storm Dorian. The world's climate is changing, and that affects all of us. Storms are becoming increasingly intense, periods of intense drought and heavy rain, to suppress farm animals and destroy our crops. Higher average ocean temperatures kill our coral reefs and change the migratory patterns of fish. St. Lucia contributes only 0.0015% of global greenhouse gas emissions, but is doing its part, along with countries around the world, to reduce the emissions that are warming our world and changing our climate. These efforts are called mitigation. But decades of emissions have already changed the climate, and the greenhouse gases in the atmosphere today will increase average global temperatures even more. We need to adapt, that is, do everything we can to prepare for and respond to the actual and expected negative effects of climate change, and everyone has a role to play. We need to protect our crops, build homes that withstand storms, keep our drains and waterways free of garbage to help us recover or bounce back from climatic events. Learn more about the Government of St. Lucia's National Adaptation Plan and the steps you can take to protect yourself and your fellow St. Lucia's. Welcome back. The St. Lucia Solid Waste Management Authority has informed that the garbage collection service will resume from Wednesday, August 28, 2019. The authority encourages the public to place waste out only on the scheduled collection day for their respective communities. The Glows Sanitary landfill and the Viewford Solid Waste Management Facility will, however, reopen to the public from 12.30pm until 6pm. Users of the disposal facilities are asked to exercise caution and to follow instructions given by site staff, given the wet conditions at this time. Residents who missed the Tuesday collection due to the passage of Tropical Storm Dorian are informed that the service will resume on the next collection day for the community. The authority urges affected residents to continue to store waste on their premises until then. The hotel sector, like the rest of Interest on Ireland, was spared any damage as a result of Tropical Storm Dorian. The Chief Executive Officer of the St. Lucia Hotel and Tourism Association, Nurani Aziz, gave us an overview earlier on. The hotels have got preparedness plans that came into full effect once we realized from the authorities that we were expecting the storm to pass over St. Lucia. And that protocol seeks to ensure more than anything else, the safety of our guests and our team members. We continue to dialogue and exchange information throughout the night. And this kept everyone in the loop as to the reports and what was happening, what was going on, not only in St. Lucia but in our neighboring territory in Barbados. And essentially there was really seamless exchange and communication and information back and forth. And we were really delighted this morning after the shutdown was lifted, scouting the properties realized that there was very little effect on property, on plant, on the welfare of guests and on the welfare of team members. And that was the Chief Executive Officer of the St. Lucia Hotel and Tourism Association, Nurani Aziz. And let's take a look now at the weather. Overcast to generally cloudy with moderate to heavy showers and scattered thunderstorms over the leeward and most of the Windward Islands. Residents and interests in St. Lucia and the Lesser Antilles are asked to continue to closely monitor the progress of Tropical Storm Dorian and remain vigilant. A tropical wave located over the Central Tropical Atlantic is moving westward near 12 miles per hour or 19 kilometers per hour. Tides for Castries Harbor high at 211 p.m. low at 633 p.m. Tides for Viewford Bay high at 318 p.m. low at 8 p.m. Seas moderate to locally rough with waves 5 to 8 feet or 1.5 to 2.4 meters. Small craft operators and sea bathers are advised to continue to exercise extreme caution due to rough seas, swells and gusty winds generated by Tropical Storm Dorian. The sun will rise Wednesday at 5.51 a.m. And that brings us to the end of our special edition of the NTN Nightly. Join us next time at 7 p.m. with a repeat at 7 a.m. You can also catch up with us anytime on the St. Lucia Government Facebook page or YouTube channel. I'm Nisha Tross.


I invite first the President of the World Bank, Mr. David Malkos. And I think we want you to speak from there. Thank you very much.  It's been an invaluable support from a development standpoint by focusing attention on financial inclusion. In Bangladesh, for example, your work coupled with development partners increased access to mobile money from 3% of the population to 20%. And it also led to digitalization of wage payments and other large volume systems, including for the mostly female population of the garment workers industry. I'm relatively new in my job, but I've seen the effects of it over and over again. I met with the presidents both of Kenya and of Ghana today. And both were talking about the, I get today and yesterday. And both were talking about the impact that mobile banking has had on their people, there are spikes in the number of transactions early in the morning as workers, often women workers are beginning to take money and buy goods and then sell them during the day. And that's causing a measurable impact on their lives because they can begin to transact and have money of their own. You've been an early supporter of better data on financial inclusion, which is so important for making progress with programs because we can see how they work. You are a leading champion of the global FINDEX database, which enabled us to document advances in financial inclusion. And across Africa, we work together to help the authorities enact reforms that will open the way for greater competition. The World Bank has been, we have the Women's Business and the Law Index, which has been so important in documenting and helping document the progress. My notes have many more achievements in bilateral remittance corridors, which are so important for many of the world's poor. The systems have enabled much greater volumes. And you've been an enthusiastic advocate in the global partnership for financial inclusion of the G20 where you're an honorary patron. So we, the World Bank, greatly look forward to continuing our strong partnership with the UNS GSA. And in particular, we can look forward to great work and improvements in financial literacy, especially for women, which is going to be so important in the next phase of reforms. And we think a lot of progress can be made on lowering transaction cost, which then brings into the radar screen, brings into range many more activities that women and men can do in their countries to improve their financial circumstances. So we need action on the ground. The World Bank is very much looking forward to working with your majesty and with all the other partners. And I thank you very much for your efforts in this regard and we look forward to continued collaboration. Thank you. Thank you very much, David.


So what, you know, why, why do men say this? Why do you hear this all the time? Why are people talking about this? So there are good men everywhere. And there are men who are jaded everywhere. And I'm kind of hesitant to not call them necessarily good men, cause there's a lot of good men that are jaded. And we live in a society right now where we have this thing called the hookup culture. And you have to realize that it's on both sides. It's not just on men looking to hook up. In fact, if you're in our community, you've probably seen recently a lot of women talking about how they're in these casual friend with benefits situations. And there was even a woman that asked how to get into one. If you can believe that. And so you have to realize that a lot of people are settling for these superficial relationships instead of getting into something that's deeper and more meaningful. And there's actually a study that was done not too long ago. And I'm not sure who all these dating nerds are that are doing all these studies. But there was a study that was done where they surveyed men and they found that around 86% of men out there actually want something real. They want a relationship, specifically what it said was they want a relationship that could lead to marriage and having kids. However, what they also said is that most of those men don't believe that they're actually gonna find it. And so one of the things that you have to realize is that if a guy is attracted to you, if he's physically attracted to you and he doesn't think that you're emotionally the one that he's looking for, then he'll settle with a casual friend with benefits situation ship. If you are willing to settle for a casual friend with benefits situation ship.


Hi, from Las Vegas, Nevada, it's theCUBE. Covering AWS re-invent 2016. Brought to you by AWS and its ecosystem partners. Now here's your host, Stu Miniman. Welcome back to theCUBE's broadcast of AWS re-invent 2016 here in Las Vegas. Getting towards the end of our, I guess it's day two. It was the keynote for day one. But happy to welcome to the program. First of all, we've got a practitioner on the program which I'm always super excited about, especially, near and dear to my heart, a networking guy. Keith Schaffer is a network architect with a redacted Fortune 500 national food distributor. Keith, thanks for joining us. Well, thank you for being here. And we've got Ramesh Prageran, who's VP of product management and marketing with Viptella, thanks for joining us. Absolutely, thanks for having us back. Keith, at start, I know you kind of talk about, too much about your company, but just tell us a little bit about kind of the scope of your role, what you do and how that cloud thing fits into your world. We've got sites all over the country. And as we try to get out of our data center and into the cloud, we had to struggle with how do we connect all of our sites to that without the single point of failure, without that choke point. With Viptella at a branch, we can then extend that into a Viptella router in the cloud and have that kind of connectivity, just like we would have with the data center. So we're definitely going to get into the Viptella stuff, but first of all, some of your statement there, are you talking about closing down data centers and moving more to the public cloud, or how does that work? It's new functionality. It's value add. It's new marketing, new sales, new markets that we're getting into. So it's increasing the role of the company, increasing the footprint. Yeah, so did you get to hear the keynote this morning? I did not.  So Amazon says, going forward, we're going to be having less data centers. We're going to putting less gear. Nobody wants to buy hardware anymore. You know, welcome embrace, welcome to AWS. You know, how does that resonate with your business? It's exactly the direction we're going. Yeah, we're going in that direction. We want to create the environment to scale. We want to be able to be agile, flexible. We want to be able to move wherever the market is. And we're not going to be able to do that with a data center. We need Amazon for that. All right, so Ramesh, I want to pull you into this. So, you know, we've had the opportunity to talk to Viptela a couple of times. That other show that was actually in Vegas this year, we can mention it was VMworld. So, you know, big ecosystem, but boy, this one's pretty impressive too.  Absolutely. So, if you look at the SD-WAN space itself, initially it was all about cost arbitrage. How can I take private circuits, public circuits, wireless, mix them together and have ubiquitous connectivity? Over the last year or so, we have seen a tremendous shift in that model. Cloud is becoming a centerpiece of that discussion, right? And especially with infrastructure as a service like AWS, as Keith was pointing, lots of customers moving in that direction. And so naturally, the question is, how do I extend my wide area into the cloud, right? Today, there are lots of sub-optimalities in how do you access from a user sitting inside a remote site or a branch. Traffic gets back all the way up to a data center and the cloud is a part of the data center. Now, customers have said, hey, that's very inefficient. Why is it that I need to go from San Jose to Virginia to access an AWS site? That's sitting right across the street from me. And so naturally, unless you make the cloud part of the wide area and extend the wide area into the cloud, you won't be able to solve those problems. And that's really where we see the opportunity. We were really thinking about what is it that we will talk about at AWS and every single customer that we spoke to said, hey guys, this is a huge play for AWS in particular. Sorry. So Keith, you were starting to talk a little bit about Viptela, but why don't you bring us back to kind of the problem statement? You know, what was it that led you to look? What was it SD-WAN? Was that, you know, did you know that you wanted SD-WAN or was there something specific that you were looking for? It was a combination of things. We had a bandwidth issue. We had a scalability and growth issue with applications. We wanted to get into the cloud and get out of our data center. It's more cost effective. We can be more agile in terms of capital planning and we could deploy more in terms of what we were giving to our customers. We needed a solution on the network side that allowed all of that to work at once. We didn't want to make this one investment more than once. Yeah, I guess I'm trying to focus in on it.  Maybe it's way in optimization. Maybe I could go to one of the big guys and they could solve it.  Security, ease of deployment. And the fact that we have a partner in terms of support and ongoing growth that we simply couldn't get anywhere else. All right, is that pretty typical you find, is security kind of one of the things that's differentiating you in this space? Yeah, the trigger points are multiple, right? Invariably, there is a high bandwidth application that's driving the need for somebody to look beyond their status quo, right? So that's invariably number one. The second one, the larger the customer, the more acute the pain point is with respect to security. And the third piece of it is really cloud. And cloud here being both AWS-like infrastructure as a service and at the same time Office 365. The number of times we have heard customers say, oh, 365 breaks my van. I mean, if I had to count, I would be a millionaire, seriously. So it's really a very interesting topic that multiple customers are looking at because they need to get that deployment right, right? And so the trigger points are multiple, but it all kind of hones in on bandwidth, security, cloud, right? That's kind of where it all comes together. It's a tricky time. I mean, I look back in my career and one of the challenges for, I'm doing anything mobile, doing anything remote, go back to the XSPs in the 90s through, all of these things that have led to cloud is like networking is one of those choke points. Just getting enough bandwidth, really having the responsiveness has been a challenge. Are we getting to the point that we can actually solve these networking issues? I mean, we haven't solved the physics problems of making light go any faster. So, you know, is network a problem for you or is network an enabler for you now? With Viptella and the ability to have different kinds of transport brought in, network really has stopped being a pain point for us. We're able to do Office 365, Salesforce, and extend into Amazon for development, internal applications, and customer-facing applications, and do so without having to worry so much about the network. That piece has now been taken care of. All right, speak a little bit about just kind of your experience with Amazon. Do you use more than one public cloud or, you know, how deep is adoption if you can share? It's multi-region, multi-availability zones. We go pretty deep in terms of the security groups. We're US-based, so obviously we're not looking to go into global regions, but being able to have something on both coasts for high availability, be able to scale and grow. We're at the point right now where we realize how much we can't do with the data center that we can with an Amazon cloud.  VPC, but with security, and the Viptella add-on to that allows us to have a common set of control and protocols and an understanding from a support environment and from a security standpoint as well. The security team is familiar with what Viptella brings and extending that into Amazon allows us to trust Amazon that much better. Yeah, so Ramesh, networking came up a bunch, you know, this week, Amazon, everything. I don't know if you saw the James Hamilton presentation last night, but it's like they're doing their own chips. They're 25 gig, they're doing all this. Still, I mean, I don't see it as overlapping with what your company's doing. What do you think about networking in the Amazon ecosystem these days? Absolutely, so I think that's kind of the last pole or the last problem to solve in the ecosystem of things, right? So compute storage and then followed by the network. Now, the certainly AWS has done a phenomenal job at automating quite a few pieces with respect to the network, bringing in security groups, having communication across multiple regions and whatnot, right? The part that multiple customers, such as Keith, are trying to solve is how do I come from my site into AWS, right? Because AWS has done a phenomenal job at optimizing connectivity across multiple availability zones and so forth, but if I have a geographically spread out footprint, how do I access it from my location into AWS? And AWS is not one location, it's geographically spread out, right? So now you have to really optimize for connectivity. It goes back to the direct connect argument that you just brought up, right? Customers are looking at, can I go over internet over a VPN technology? Can I use direct connect? Can I exit out locally at my branch or my site? Can do I need to go to my DMZ? Do I need to go to my carrier neutral facility? So the choices are actually evolving very well, but the underlying guts to connect everything together is really what we're providing. Keith, the last thing I want to cover with you is, you know, sometimes these changes can be difficult on kind of the organization. It's really encouraging to hear, I mean, networking team and cloud looked like they go hand in hand. You know, how do those fit together? What lessons have you learned going along? You know, what would you say to your peers about how they should address these kind of things? I would tell them, don't go too fast, take your time and understand the organization and the data flow that goes into that cloud and how you're going to use that, how you're going to bring that back into your environment and what are the things that you concern the most about? Is it security? Is it just connectivity, you know? But take your time, make sure you get it right. Yeah, I want you to clarify something because I used to give presentations talking about networking and I would talk about how the networking and enterprise moves by the decade. You know, it's like, oh, we ratified 10 gig in 2002 and by 2012 we had, you know, reasonable adoption. So you say move slowly, you're not talking way to decade to do something, right? No, I'm not talking about years, I'm talking about months, talking about take some time, figure out how this takes, because it's not just about moving into the cloud, it's connecting that cloud back into your organization.  This is a piece that allows us to bring this, Amazon and our company together in a way that I don't think we could do anywhere else. All right, Ramesh, I want to give you the final words, the kind of big takeaway from the show that I think you want to leave us with. Yeah, absolutely. So I think there are multiple solutions that AWS provides in order to optimally connect into AWS. And there are also complementary technologies that you need to use in order to connect from your site into AWS, right? And so in what I would leave people with is, you know, looking at that model, you kind of own need to own both of those endpoints, right, because it's not about just, do I have a pipe to get out there? If I have multiple paths, how do I choose the most optimal one, right? It could be based on loss, latency, trigger, a whole bunch of things. What we have done is actually we have moved the wide area into the cloud, which means we own an instance inside of a VPC that resides inside of AWS and we protect all the assets and all the applications residing inside of AWS, just like we would protect if it is inside a branch, right? And so we want customers to think like, hey, my AWS location is not an extension of my data center, it's actually an integral part of the wide area. And once that happens, then traffic starts to flow really, really freely and the possibilities are endless. Keith, really appreciate you sharing your journey of where you've gone and where you're going. Ramesh, thank you for giving the update and for bringing a great customer to talk with us and our audience. And stay with us. We'll be giving a few more interviews here as we have wall-to-wall coverage from AWS re-invent 2016 in Las Vegas. 32,000 people, you're watching theCUBE.