Okay, hi. I'm Miles Long from Cult of the Dead Cow, and I just wanted to introduce Mr. Steve Toplitz, a.k.a. Arrakis here from our Hacktivismo branch, who has some nice things to tell you folks about this evening. Oh, yeah! Who are you kidding?  It's okay, you don't have to.  Now, I was pretty reticent going into it, and when the whole process was said and done, I was blind. And my girlfriend took me home, and I was there sitting in bed, totally blind, listening to music, thinking about my situation. I've got bandages covered over my eyes, some amount of blood, I'm sure. I'm thinking, how did I get into this situation? What if I can't ever see again? And I thought, privacy must be a lot like this for people who don't understand it. You're blind, you're in a situation that's more complex than you can handle. It's a little scary, and it's better handled by people who know more about it than you do. It's typically one of those things that you don't do it yourself if you're average Joe consumer. So, you have to wonder, while you're there, what's going to happen to be the outcome? And a nurse told me there's something called expectation management, and when she told me about it, I kind of thought I knew what it meant. She said, you can only get as good a vision as possible if you're the perfect candidate. So, you can't expect a perfect outcome. And so, when I was sitting in bed thinking about privacy that translated to, you can never have perfect privacy unless you're just in the perfect situation. And even then, there will be new exploits that come up, new threats. So, it's unreasonable to expect perfect privacy. So, that leads me to my next question. What is a reasonable expectation of privacy? Well, there is a legal stance on this, and there's two points to it. It's actually a test. The first one is... All right, hold on a second. I want to speak a little bit more about the privacy issue just for a second. Does this privacy end at your fingertips?  So, what would constitute an inappropriate invasion of privacy? So, back to the two-part test. The first half of the test is what to have a reasonable expectation, what is the reasonable expectation, and the second half is if society will uphold that expectation. It's reasonable to expect that a whispered conversation between lovers is private. And it's reasonable to expect what goes on in your own home is private. It's reasonable to expect that your email and your documents are private. And prior to 2005, it would have been reasonable to expect that your phone conversations and financial transactions are private, and perhaps it's still reasonable to expect those sort of things. While it's reasonable, those expectations are faulty, because society increases in its failures to uphold what we find acceptable in an expectation of privacy. I'm not here to tell you that privacy is dead, but I'm here to point out where the bedrock of privacy lies, so you don't build your house on sand. So, I'll state it pretty clearly. You have no rights except those which you can forcibly exercise. Let me to clarify that. According to the United Nations Declaration of Human Rights, you have the right to life, liberty, and the security of your person. You have the right to freedom of opinion and the expression thereof. You have the right to be free from arbitrary interference with your privacy. And I'll say it again. You have no rights except those which you can forcibly assert. This is the difference between a right and a law. A law only gives you consent to exercise a right you must already be able to assert. While I can't advise you about the assertion of those other rights I mentioned above, exercising your right to privacy will definitely go a long way to ensuring you don't have to. So, how do you enforce your rights? First, we have to determine the framework that we're working under. We're a very mobile and interconnected society. Most of us has traveled here a long distance, and I don't think any of us have stopped communicating, talking, paying for things, going around, except, well, considering our present company, we may be doing so a lot more guardedly. Okay. In fact, I would say that we've probably increased in all those transactions for interconnectivity, and it's important to have the tools which properly match our behavior. Our behavior dictates that we need portable privacy. Portable privacy is that privacy space that surrounds you. It surrounds your home, it's with you at work, at the ATM, at a restaurant, and it's with you when you sleep. It's that zone which your own personal space has, and it expands and contracts depending on your environment. It's the area that we have a strong expectation of privacy and that it's totally reasonable. But we must be willing to assert over it. Don't make any mistake, there is a war being waged for your privacy. And it's regardless of politics, and it's regardless of the legitimacy of the intrusion. So, this discussion is about maintaining that real estate. Some interesting devices have been created to help you enforce your personal privacy space. Recently, cultivated cow member Lady Ata released the Wave Bubble. Now, the Wave Bubble is a portable, self-tuning, frequency jamming device. It essentially allows you to block out all frequencies, be it Wi-Fi, Bluetooth, GPS, what not, within a 20-foot radius of yourself. Pretty cool. Now, undoubtedly it's a portable privacy device and a pretty cool one. One of the problems with it is that the FCC doesn't like it very much, and that's totally reasonable, but let's think about it for a second. The FCC declares that devices have more rights to intrude and permeate our systems than we have to deny those from entering our personal privacy space and blocking them out if we choose. So, in essence, the FCC is saying these little electronic devices have more rights in that regard than we do. I happen to disagree.  One of the main investors to portable privacy is the same things you'll find in regular computing. It's going to be communications, your data storage, your transactions, and some of your computing environment. And there's solutions for each of these vectors, however, they're uniquely different. They have to respect the principles of portable privacy, which are portability, elegance, and trustworthiness. Now, portability recognizes that the program itself has to reside locally on the portable media or be accessible remotely and executable remotely. This is not applicable to simply having a program that can be stored on a USB drive and can install, unless the program itself can uninstall when the program's closed and pretty much leaves no tracks behind. The second issue is trustworthiness. Now, we have to think about who are the people that are using these programs. They aren't going to have the same idea of trustworthiness that we will. Trustworthiness is a lot different than trust. Trust is something that you may have explicit in somebody else. Trustworthiness is a property that you can evaluate. So, trustworthiness is the principle of the program and privacy in the data handling it that can be trusted to some extent. And that degree has to be clearly stated by the program. Admittedly, trustworthiness is subjective to the user. If one has near theological beliefs about the software or the person who wrote it, then instead they've imbued it with trust instead of trustworthiness, and it completely bypasses the need for trustworthiness. Okay, for a program to be trustworthy, it should at least be source-viewable, if not entirely open source. For a program to be trustworthy and open source isn't just enough. Just because it's open source doesn't mean that anybody's gone through it and audited the code. It could still have all kinds of things inside it. Take, for example, JAP. It still has a piece of code in it that allows people to track you if they wanted to turn it on. The importance of source-viewability is not to prove that the program doesn't have malicious code, but to avoid the impropriety of appearing to have something to hide. If a program is closed source in the firm that's produced software doesn't have a built-up trust in the mind of the consumer, then it creates a disincentive for the consumer to actually use it. And, incidentally, it also creates a target for the infoset community. The license of a program can also be important. It may impart additional security to the program if one has assurity in the reputation of the author. For example, GPL provides a totally free software, but there are some other license out there that are pretty interesting as well. Take, for example, the Hesla license. It's put out by Hack to Vismo. And what the Hesla license does is it allows you to put out a program and state that this program is pretty much open source except for you can't modify it to contain spyware, viruses, malware, whatever, or use it to insert code that could compromise somebody's identity. So in order to be trustworthy, another property is the program has to fail securely. Bouchnier succinctly described the issue as a system defaulting to insecure. That means if the system failed, we would have to knowingly or unknowingly revert to a less secure system. For example, if you're running VPN that uses point-to-point tunneling protocol, does the bitstream leak if the connection is suddenly dropped? The practical application of failing securely would be typically to have an all-or-nothing situation. Either you get your connectivity, you get to where you're going, or it fails and it lets you know that it fails. So the upshot is when you open the browser, you used it. Did it get to Google or did it fail securely and did it break and you didn't see anything and it told you that the proxy was refusing the connections? So another important piece of trustworthiness is, and it's perhaps the most important, it's knowing the level of privacy that's imputed by the program that you're using. If it communicates securely, is it anonymity? Is it privacy? Is it just plain encryption or is it a warm fuzzy feeling? Okay, so, and other than the privacy aspect of it, you still have to be fully aware of who their client is and if they have a very high political or legal risk in the environment that it's running in due to being incorporated in the US or somewhere else. So, some commercial services such as Find Not have design flaws in their anonymity systems. Relying on leaky protocols like SOCs without forcing remote DNS lookups and it makes you think of, well, you should really be using another program like FreeCap or SoxCap or something else. The result is that while you're surfing anonymously, the websites that you're requesting are getting transmitted in plain text and that totally compromises your anonymity. That's even worse than if you hadn't been using an anonymous program at all because you've got this false sense of security that you have some sort of privacy going on and you may be more apt to do things that you wouldn't normally do and you'd be exposing yourself that much further. On the other end of the spectrum is the Tor network. Alright, this is a system based on Onion Routing. Onion Routing is an anonymization method where a datagram is wrapped up in three layers of encryption and it's hopscotched across the internet and then where it goes out in plain text and then it's wrapped back up in three levels of encryption and hopscotch back to you. Alright, so when the final layer of this three hop is done, you get it back and it's pretty secure. You know that it hasn't been tampered with unless the exit node was playing around with the data. So, I expect we're going to see some more rising of commercial routing networks in the future. From what I've heard about, there's actually three or four commercial Onion Routing networks, but only one of them has actually been released to the public yet. There are a few more coming. Okay, regarding elegance, never before has aesthetics and technology been so important. We recently saw one manufacturer start to really take it seriously. They religiously embrace the concept of elegance. So, take for example the Apple iPhone. Why is such a device so captivating? I mean sure it's marketing, it's branding and Apple fanboys have a lot to do with it, but none of the technologies in it are new or unique. A few people have mentioned that they combined all of these wonderful things into a single device, creating a multi-function device that's never been done before. Well, multi-function devices are the bastion of the uncreative. Convergence technologies have been the hype of marketing departments and the bane of sales ever since the advent of the radio alarm clock. You only have to look at monumental failure, the billion dollar monumental failure of AOL Time Warner to see that they can't combine these different things that don't necessarily fit together. We dilute ourselves into thinking that if we have two devices and we put them together that they're somehow new, even if they don't complement each other. Well, the iPhone combines complementary devices by the fact that everybody wants to carry a cell phone or an MP3 player and a PDA and a camera all in their pocket at the same time, you just don't have room. So what they've gotten common is that they all work together in a single device and they occupy the same amount of space. This was an excellent idea of elegance. So it seems that they have to have really great human-computer interface. It exhibits the characteristics of being intuitive, easy to use and self-contained. The technology employed within it is relatively transparent. You can't tell when you're switching between it being an MP3 player or a phone or anything else. It goes on pretty seamlessly. You don't have to wait 20 seconds for it to load up. Another great thing about it is it's got a single interface which can be used intuitively. And it's highly aesthetic with its intuitive touchscreen. Portable privacy product design should also follow suit and when they do their success is amazing. The largest impediment to wide acceptance and employment in privacy tools is that they're spartan and crude in design. The most important principle for acceptance in the portable privacy tool, sad to say, is elegance. So having cluttered and mysterious or non-existent interfaces limits the employment of the privacy tool to those who are either very privacy conscious or very technically inclined. So while that fits the definition of most of us here that is not going to fit everybody else because products live and die by the whim of the masses. So think about all those projects that you've seen that have gone nowhere. The information superhighway is littered with the carcasses of dead projects that died because they were in elegant or difficult to use. So while you may have a great idea for your project or you may love something that's coming out, unless it can gain wide acceptance and it's very easy to use and it's intuitive, it's going to fail. That brings me down to survival of the fittest. Most of these road kills were pretty incoherent and unrefined. And with survival of the fittest we're aware that if you're more aware of the plight of the panda rather than the Sega antelope it should be more aptly named survival of the most beautiful. Due to the high level of integration required for portable privacy, the tools for enforcing your privacy have to be user-friendly as user-friendly as possible in order to get you to try them for the first time and keep using them. This means that they must not only be portable and trustworthy but they have to observe the principle of elegance. So elegance contains qualities that are appealing, intuitive and easy to use, self-contained, transparent and informative. So things have to be appealing, they have to be aesthetically attractive. And to be intuitive the use of the product and its interface has to either be obvious by design or by previous familiarity. For example Torpark here, it looks exactly like Firefox except it's got a few extra buttons added to it and Missila did a great job designing Firefox. Alright, to be easy to use it has to rely on little or no user input or configuration. Einstein perfectly understood the idea of easy to use. Make everything as simple as possible but no simpler. So that means you can't oversimplify your controls. You have to know exactly what the user wants and meet exactly that or as close as you can. Now there's other areas where you may want to jump back in and add more configuration in the back and that's fine but make it so only the more technically inclined access that area and the regular user doesn't jump into that area. Okay, it has to be self-contained meaning the program should be standalone. It shouldn't require any additional downloading or component relying on pre-existing installations of certain connectivity software. Now this isn't to say the operating system because obviously you have to have that. Okay, to be informative the software has to not only let you know that it's running but it also has to provide a status indicator of the privacy behind it. So it has to be a color coded icon in a system tray or a notification bar or something that lets you know that it is working and I'll show you some software programs out there that are really great in their design ideas but in their implementation and their HCI they're absolute nightmares. Okay, to be transparent is the greatest accomplishment of all. Transparency means that when you're using the product it's nearly the same as not using the product at all except that you've got the conveyed benefits of the product. So with perfect transparency you notice no degradation in your performance you don't notice it getting any slower. The reason you would worry about it getting slower is let's say you've got an anonymous browser product out there and suddenly it's difficult to use or it doesn't always work all the time. You're more likely to switch it off and go without a condom and get yourself into a lot of trouble that way simply because well it was easier, it was faster, well sorry you just messed yourself up and whose fault is that? Is that the user's fault? No, it's more of a design issue or the user has to know what to expect or at least have options. Alright, to exemplify it let's take a look at the Zero Bank browser that I wrote. Alright, in the past year this was known as Torpac. I released it last November. Since November we've had over 4 million downloads of it. I'd say that's pretty successful. It was published in 120 some odd publications. Alright, so we're getting about 700,000 downloads of this a month. It's nothing novel, it's nothing unique, but what did we do? We took some pre-existing technologies that were already out there, capitalized on them, wrapped them up together and made it super easy to use. There was nothing novel or new about Torpac and we didn't go with a different network. There was Provoxie out there which allowed you to take the socks and wrap it and send it through Torpac. Well, we found out that Firefox is capable of doing this right on its own and we also integrated Putty into it pretty seamlessly as well so you don't have to deal with it or any windows and I certainly doubt most consumers would want to deal with a Putty shell window. Okay, so we have our framework for the ideas and we know about our environment. Let's get to the current arsenal of digital armaments that we can use in this privacy war that's being waged against us. First there's the field of secure communications and let's break that down into popular groups. Alright, you got general communications, web browsing, email, chat, messaging and voice over IP. Regarding your general communications, you have a couple of really great programs. The first is the Janus VM. That means virtual machine. Okay, essentially it's a virtual router on your system and allows you to capture all your communications and by VPN it forces it through the virtual machine and the virtual machine routes it through the Tor network. Okay, so the advantage of this is it's extremely transparent and allows you to view rich media like Flash and Java and JavaScript without necessarily compromising your anonymity out there because such programs can bypass your proxy settings and phone home normally. But when you're employing it by VPN in the environment, that typically just doesn't happen unless they have some sort of special breakout. So that'd be an open VPN attack if they were going to make one. Okay, next we've got the ZeroBanks XB VPN. This is a portable version of open VPN and you can load it up on your client's software and typically you have to connect to a server somewhere else. So if you have a server, that's great. If you don't, maybe you need to set one up at work or wherever you're working on.  Okay, so the way that it works essentially is that it allows you to push all your connections through a TLS encrypted pipe. So you get 128, 192 encryption and it's pretty seamless and transparent. So suddenly you were worried about your Skype program, you were worried about your browser and everything but now you don't have to do any additional configuration and it's all wrapped up, captured and pushed through the VPN. Of course this doesn't exactly solve all your problems. You could still have a program that could be on your system and gather informative information about your local network and send that back through the VPN tunnel. But for the most part this isn't a real threat because I can't imagine a whole lot of attackers finding use in finding out that my internal network IP is <IP_ADDRESS>. Okay, we've got the Anonymizer's Anonymous Serping and that's the leading product in the field due to its excellent branding and maintaining a spectacular program design. There's a portable version of Anonymizer that can fit on a U3 drive and it runs on both XP and 2000. This product nails both portability and elegance. The design is extremely transparent because it appears to use DLL injection to capture your outgoing traffic and force it through port 80. That means that you don't have to change your browser, you don't have to pick between Firefox or Internet Explorer or Opera, whatever you're using. It inserts itself between the browser and the network transmission and reroutes all of those HTTP and HTTP requests through Anonymizer. I've tried routing requests through it before that weren't necessarily the right traffic that should be going through and it still worked. This could be useful to you or not. I don't know exactly what speeds Anonymizer is pulling down. When I checked out their network I was able to get somewhere between 200 and 400 kbps. Okay, now Anonymizer is great on the elegance issue, it's great on the design, it's great on the portability, but it absolutely fails at trustworthiness. The service doesn't give any indication of the privacy offered, neither in their tools or their website. Additionally, when you're using the service, the default settings make sure that you fail insecurely. In the default settings, alarmingly I found out that when you download it and you run the program that it doesn't even encrypt your outgoing traffic unless you explicitly tell it you want it to. I just couldn't believe what Anonymizer was doing considering the role of responsibility that they had placed themselves in as market leader. Okay, so another aspect of Anonymizer is that it's closed source. That means that we don't know anything about the program and instead we have to rely on the author's own reputation. And it's not to say that the author doesn't have a great reputation, but we have no idea of what's going on in the program or the privacy level it implies. Another problem is that Anonymizer is formed in the US. Now let's think about that for a second. What does it mean for an anonymity corporation to be formed in the US? They're commercial enterprise and they're a single hub that exists. We don't know very much about their network at all and that also means anytime they're exposed to a national security letter that they have to turn over the information. There's no question of, oh, should we or shouldn't we?  Now we have a commercial anonymity network that we run out of a few different countries and we've got one in a really high privacy jurisdiction, you know, Germany, and we take things very seriously there. We get somewhere about 50 to 100 requests per year from courts and subpoenas and whatnot and we get rated. Now not one of our users has ever been compromised in that way and we've been doing this for about six years and we can show all our documents in the last 12 months of those attempted raids. You have to wonder about the claims that an anonymity service makes when they say, oh, in the last 12 years we've been operating, we haven't had a single user ever be compromised and that's an ambiguous statement at best. What do they possibly mean by compromised? I was thinking that they would have to be operating under the assumption that they never provided any privacy or security at all in order to somehow convince themselves that that was the case. Okay. So the service doesn't give any indication of level privacy offered and neither did the tools in their website. One of the previous administrators of Anonymizer had summed up their author as being privacy for soccer moms. It's also thought that whatever privacy it offers can be bypassed by leaky plugins such as Adobe Flash and Adobe PDF viewer which phone home. I haven't subjected it to tests yet but I'm sure Stephen Jay Murdock if he's out there can tell you what happens. Alright. The program itself is both portable and it's elegant but the service that it uses crippled by the product relying solely on the reputation of the developer Lance Cottrell. That's because it's closed source and as I said we don't know what's going on with the network and they're incorporated in the USA so how seriously can you possibly take them? They say that there's not any risk and it gives no indication of the privacy that implies but you're still banking on Lance Cottrell's reputation and that's not to say that there's nothing going on there. Lance Cottrell has a great reputation. Some time about ten years ago he created Mixmaster, the anonymous remailing program and that's pretty awesome. Alright but luckily for Anonymizer these problems can be remedied by simply being more forthcoming about what's going on in their software what's going on in their network and perhaps telling the truth about what's going on with those national security letters and if they've been honey potting this whole time. So the question is are they going to do that? Probably not. There's a specific financial disincentive to do something like that and considering that they've been around since 1996 we can say that the disincentive is substantial if the case is that they've had a national security letter on their desk every day saying operate as a honey pot or else. And there is a disincentive for them to keep going. It's something to the effect of well they get to keep the reputation in business and they get to keep collecting a hell of a lot of money. Okay so the next portable privacy app that we've got for browsing is XB Browser from Zero Bank. It goes under many names and it went as Torpark and Democracy Browser and it was designed by me. And it was originally based on the portable Firefox code. I designed it from the bare bones of the program after being exposed to a sharp and treacherous learning curve of setting up a tour client and a tour server if you have no exposure to it at all. XB Browser is available for windows. It goes all the way from 95 all the way up to Vista. It should run on most versions of 95. What it does is it not only runs on 95 but we've also gotten it running under Wine and I think there are some copies that are running under Mac OS 10. But no guarantees there. So XB Browser typically runs on the tour network and it's upgradable to the high speed Zero Bank A non-immunity network and I'll tell you a little bit more about that in a second. So the degree of elegance in XB Browser is pretty high. It's a suite of programs that's Firefox, Tour and Putty but it transparently operates through a single program. It's just a wrapper. So the program is intuitive since it's designed and behaves mostly like Firefox and as I said Mazzilla did a really great job with that. The program is easy to use, it's preconfigured for direct internet connections but if you're operating behind a firewall or a proxy it'll pop up a notification saying hey we had some trouble connecting do you want us to try and auto-detect your proxy situation or do you want to enter in your credentials right now. Okay so that's pretty good. The product's informative because when you're using the tour network it tells you the user status. It tells you if tour is on, if tour is off, it tells you what's going on and it also fails securely meaning that if for some reason you can't connect it to you because the tour network is slow or a server is unresponsive or alternatively you did something wrong and it messed up and you broke it which is a good thing. You don't want it to keep going. Okay so we had a lot of users complaining, I mean we had, we suddenly opened up shop and overnight we had 500,000 Chinese download the program another 500,000 US and Europeans download the program and a lot of them complained oh my gosh what is going on? Suddenly the network is unusable and that's not to say anything bad about tour but when you suddenly get an exponential increase in people suddenly using the network and you have a limited amount of resources that didn't scale up with the network use you're going to see some loss of connectivity there. So about the 10,000 request I had for what can we do to speed it up I thought well you know there's probably some tweaks I can do, I can distribute maybe a directory of long lived nodes within the set itself but I don't know that probably wouldn't work. So after they asked me I thought well there is something that we can do. We could create a private anonymity network out there that was specifically made for to be broadband speed. Now regarding the zero bank network it allows you to surf anonymously at those broadband speeds we talked about and I say anonymously because we've blinded ourselves from the identity of who our client is. When somebody signs up and they pay us even if they pay by credit card we have absolutely no idea who they are. All that we get is a transaction ID that's what the user gets and it's a sign for the payment. Once the payment goes through that transaction ID which is totally not associated with any customer information which we don't have by the way that transaction ID corresponds to an account and we flip on the account and it depletes for the certain amount of time that the person bought the account for. Okay, so what we've got are a couple of different networks out there. We have an SSH network that will give you between 200 kvps and about a half a megabit. We've also got a VPN out there and that will give you anywhere between one and a half megabits all the way up to about six megabits and most of the servers are located in Germany and Austria some are located in Southeast Asia, some are located in South America. I can't specifically say where but we'll get to that too. Okay, the amount of programming that had to go through it was pretty horrible. I wrote the program originally in INSIS because that's what the portable Firefox was written in and it was terribly easy to use I admit and I should have probably rewritten it in Python. We've got this program out there that was written in INSIS which is just an installer language from Nullsoft and it was never meant to do the things that it does but luckily it does them and it still works and it's probably leaking memory somewhere. We'll see, we'll find out. But inherently that's going to be a problem with Windows because let's take for example we can turn off Firefox and tell it don't keep a cache, keep your memory small and whatever the day if we get memory and it fills up more than the memory it's supposed to allocate or Windows feels like it, it'll suddenly take that memory and write it down to the cache so you've still got it somewhere existing on the hard disk. So unless your system is so great that you're wiping out all your free space and you're clearing your cache file at shutdown you're not going to be totally in the clear and it's not as though the program can withstand forensic analysis. If you're running on a computer somebody's going to know that Tor Parker, XP browser was actually run on that computer but that's not an attack we're trying to defend against.  Okay so we have the network services that the XP browser uses. First let's take a look at Tor. Tor is a distributed trust model and advanced algorithms for routing and balancing. It's totally open source and licensed under the three-class BSD license so by default Tor servers don't create logs and thanks to the fact that it's run on donated bandwidth anybody can participate. And it's physically distributed across multiple jurisdictions so it has a low legal risk and it has practically no financial risk at all because it's just people running it from donated bandwidth. Alright, another great thing about Tor and this probably isn't stressed enough as they have extremely close ties to the pro privacy and extremely litigious EFF so that helps them out a lot. One of the inherent problems with Tor is that you're trusting all of the exit nodes and all the plain text traffic that you pass through the exit nodes get to see and they can modify it or change it if they wish. Now let's think about that for a second. What does that mean? That means that you're using it, you're using XP browser and it's going through the Tor network. You're putting your trust in the very last person who's running that exit node. They can see everything that you do and everywhere you go online and it's possible unless you're running end-to-end encryption that they could turn around and insert some bit of malicious code in there. I've heard of other types of SSL certificate attacks but that's really not what the talk is about. This is a little bit more high level than that. One of the problems is that Joe Nobody decides to be a malicious guy and suddenly he could be sniffing your traffic for logins. It's a great place to hang out if you want to sniff people's traffic for logins and credentials and financial information if they were just they didn't know what they were doing. An unfortunate part of that is XP browser makes it really easy for somebody to accidentally use it and not entirely understand the environment that they're operating in. There are inherent risks with making software really easy to use because you're creating a powerful tool and putting it in the hands of somebody that doesn't necessarily know how to use it. While the Tor network is an excellent project with low political and legal risk and it's extremely trustworthy, nothing can overcome the fact that it's often excruciatingly slow. Eventually this will change over time and it will definitely speed up as designers concentrate on efficiency of the bandwidth usage. But regarding portable privacy and the aspects that it's got to address, it fails in this regard and it's not by any fault of the Tor network itself but the specific failing of it is the transparency. The transparency issue is that if it becomes too slow or the circuit becomes faulty, somebody's likely to stop using it entirely and that's just not a situation that you want to have. Okay so because of this problem, the SBI browser is upgradable to the ZeroBank network. Alright the ZeroBank anonymity lets evaluate the trustworthiness of it for a second. I personally think ZeroBank is the greatest thing since sliced bread but I'm biased because I'm an administrator at ZeroBank. Okay so the software that ZeroBank uses for their network is open source since mostly GPL and it includes an SSH interface and a TLS VP interface. The ZeroBank network doesn't log user activity unless the user has specifically violated our terms of service and in most cases we'll just take that account and we'll shut it off. ZeroBank networks are all their machines are running on encrypted disks in different jurisdictions. We've separated the user information such as the account information from the actual machines that are running the communication servers. Alright additionally those systems are also segregated from each other and they get audited on a regular basis. The only people that have access to those they've got access by key login only and the people that have access are the administrator for that server the CSO and the auditor and after the auditor comes in and checks everything the keys get changed and what the auditors do is they report back to the CSO and say okay our admins of those communication servers aren't doing anything malicious. So what that does is essentially solve the exit node problem. The problem being how do we know that people aren't monitoring our exit node traffic? Well we know that we're not logging and we even check our administrators to make sure that they haven't bugged the communication servers to monitor all the outgoing traffic. Okay all of our servers are distributed across multiple jurisdictions and they don't log any personally identifying information and they're pretty secure. So legal risks are relatively low because ZeroBank is owned by Tourify LLC which is incorporated offshore in the sovereign and post privacy state of NEVIS. A NEVIS LLC is relatively difficult to assail and conquer because it doesn't recognize judgments from the US or the EU. On top of all of this is the crown jewel of the ZeroBank client secrecy guarantee. The CSG states that ZeroBank has a contractual obligation to protect the privacy and identity of users against illegitimate demands for information. So because ZeroBank is an international business it has to decide for itself what the standard of a legitimate claim is. That standard is the United Nations Declaration of Human Rights. Thank you Hack DeVismo for giving us that great piece of information. Okay so what that means is if suddenly we get a subpoena from a jurisdiction like it's China and they say we would like you to turn over the information of the user XYZ for purpose whatever. We first look at that and think to ourselves okay we don't even have this guy's information and we don't have his traffic. And second that's going to be a pretty tall order because then we'd have to reverse our own systems go back and try and find out who it is that's connecting through what account. And even then we don't have the payment information to figure out who paid for this account. If they paid for it by EGOLD or some other anonymous method we would have to implement a live trace and somebody would probably have to be holding a gun to our heads to do it. So when we get an order from the US stating listen this is a matter of national security. We want to know if he was at the yogurt shop Friday night. Sorry guys that's just not going to cut it. Now there's a few other things that we have to take into consideration here. There's some other browsers that we should mention and I don't have a whole lot of time to continue this talk so they decided to give me 45 minutes so let's go with it. Alright there's the Maxthon browser for Windows and that runs on U3 drives. It's pretty great and it's extremely popular in China and supposedly they have 90 million downloads and it's totally possible for them to start using this. Unfortunately it doesn't have any privacy settings yet and doesn't have any anonymity but if somebody was really inclined to make a project out there you could sure get a lot of users real quick. Alright another program out there is Ghostzilla and this program gets an honorable mention. Alright Ghostzilla is portable and when you move your mouse away from it suddenly the screen you are working on disappears and you have to move your mouse back and forth to make the window reappear. Well it's pretty cool and it's entirely trustworthy but it's got an inelegant design and an inelegant interface because it's just a portable version of an old Mozilla browser that's honestly not that great. Okay another web surfing program out there is Browsar. Browsar gets a dishonorable mention. Browsar the website purports to be the fastest download out there for anonymous browsing and it's secure and what not but to be honest they tiptoe around using the word secure.  Wow that's not exactly what they told us. Okay next on our list are the email clients. Alright there's a portable Thunderbird which is just a copy of Thunderbird that runs on your USB key. It's really great because Thunderbird it has LDAP for your servers in case you have an address book stored elsewhere and you don't want to store your address book on your local machine so if your machine's compromised people don't know who you know. It also supports TLS and SSL. It supports IMAP so if you want to have an offshore server where you keep your mail like we do at ZeroBank then suddenly anybody who gets your browser and doesn't have your master password they can't get any of your messages. Okay let's go on to Mobility Mail. For Mobility Mail it's just another version of Thunderbird except it's got a NIG mail which is a plugin that allows you to have GPG encryption and decryption in the program. So suddenly somebody can send you a message with PGP encryption and with a single click and a password later your message is decoded. What does this protect against? Well when you send an email out over the internet most of you all know it's like writing something on the back of a post card you don't have any reasonable expectation of privacy so what you do is you employ this encryption on there and suddenly you've got something pretty high level that if anybody is a casual observer they can't figure out what it is you've said except if you put it in the title of the email itself. Okay now we've got the instant messaging. Alright what we've got instant messaging currently consists of IRC which involves discussion channels and one-on-one messaging which most of us know as instant messaging but IRC anonymity is dead for the most part. Okay what took the place of that is SILC and there's a wonderful new program that we're going to get at that runs SILC and a host of other programs, sorry protocols.  Alright Off the Record allows people to have AES encryption in their chats it supports a gazillion protocols out there and it's also got perfect forward secrecy thanks to using Diffie-Hellman key exchanges. Okay. Some of the main risk vectors to portable privacy are what we've discussed but another bit that we need to talk about for just a little bit are cash. Now in the coming age of digital privacy we're going to have to be spending a lot more money online and there's systems out there that we need to be aware of. There's regular normal digital currencies, there's somewhat like PayPal where they know exactly who you are, there's numerous currencies where there's somewhat blinded about who you are and that's like eGold where you could have a number of account that it doesn't necessarily correspond to you where they don't exactly know who you are or eBullion and then there's upcoming currencies like Loom and eCash which are totally anonymous and they both use slightly different methods. I know eCash uses Xiaomi and tokens that they've blinded themselves from and they've currently got a central operation that they run inside the tour cloud. Okay, that gets us back to computing environments. Alright, we've got the Rocket Live CD, Anonymity Anywhere Incognito and the new XB machine which we've just released yesterday. Now, I don't have much time so I won't even cover those other ones at all. I'll move right to XB machine. The current winner though I think is the Incognito Live CD. That means that you can boot from it and suddenly you're anonymous and all of your connections and software are anonymous. So we're introducing today the XB machine and that's available from the Zero Bank website. It'll run on QMU and it'll also run on VMware and it's got a private network information only meaning that it's going to have a really hard time trying to compromise your anonymity even if it wanted to. The interfaces are all firewalled on it and it's a hardened version of Gintu. The clients that it runs for the anonymity network are Tor, the Zero Bank SSH connection, the TLS we talked about. Oh, and I see we've mentioned the Zero Bank onion routing network. Okay, this is more of what the structure of the program looks like. As you can see we've got all the programs in one area and the anonymity hardware are running on one instance and then on an encrypted partition running loop AES that also has a self-destruct key that you can put in. It's where all of your private data is kept and once you enter in that self-destruct key all of your settings are suddenly wiped out obliterated and unrecoverable and for your own appreciation you could do that if you wanted to reset the system and it'll recognize that. So it's got all of those wonderful programs that you wanted in it. It's got Firefox, it's got Thunderbird, it's got Pigeon with off the record and all the wonderful things that we discussed and eventually it's going to have anonymous wallets on there for anonymous digital currency. So suddenly you're going to be James Bond loading up this CD or this virtual machine anywhere you are and suddenly you're totally anonymous and the great thing about this is it follows all of the principles of portable privacy. It's totally transparent and easy to use it's really fast, it's upgradable to the Zero Bank network as y'all are about to see and it's got fantastic security. We spent about 400 hours hardening the system. Now we're not done entirely, it's still got its own flaws but let's take a look at what it looks like. This thing is pretty easy to use. It looks so simple that even a Windows user could directly plug in and start using it. That means that we're going to get a high amount of people who are willing to use it entirely.  Good for you. Alright, now XB machine isn't perfect, it's got its own risks and some of those risks we'll get to but this is just a pre-release that we've released now and you can download it from the Zero Bank website and I'll give you the address for it now.  Eventually we're going to put it into a live CD to allow you to boot from it as well. So what that does is it not only addresses the software problems that you had to deal with before but now it will address almost all of the operating system and computing environment problems that you would have dealt with. Your risks now other than those listed are going to be somebody looking over your shoulder or somebody's got a hardware key locker and there's probably something else we're going to add as a software keyboard to the login mechanism just in case. Okay, so you can download this address or you can surf over to Zero Bank and click on the drop-down menu and go to the Zero Bank. The XB machine drop-down. So once you get that it's about a 370 megabyte download and you can run it from VMWare or QEMew or whatever you like. Okay, some of the other things that Hack2Vismo asked me to mention before we pass out the free accounts are we're starting two new programs. One of them is Googleog and Google is about to find out about that the same way that Microsoft found out about back orifice. I had to talk with a Google security person yesterday and let him know that there's a new dragon coming. Okay, another thing that we wanted to make you all aware of and just let y'all know before I'm cut off here real quick is y'all heard about Yahoo probably and about a year ago they shut somebody off and had they had the guy, they took the guy out and he got in prison for 10 years for saying something the government didn't like. Well, we're coming up with something else for that. So if y'all know anybody out there or know anybody who knows anybody out there that's been affected by Yahoo or Cisco or Google or anything like that, I urge you to contact Hack2Vismo because we would definitely like to know. We're coming up with a documentation paper on it and we'll be having a project following up on it. Okay, and that ends our discussion.


Dear students, in this series of two modules, I will talk about the security and performance issues of web database applications. I will cover four security aspects in this module, two in the next modules along with the performance issues. Now, what is the point over here? The point over here is that there are many security loop holes in web-based database applications. The reason being that the TCP IP protocol has securities issues in it. It was not built and designed for e-commerce applications or banking transactions. So when the traffic is moving over the internet, anybody with a certain little amount of skill can intercept that traffic and do many malicious things on that traffic which is passing. With a little bit of background, so I will talk about the security issues. I will list the security issues in more detail. Then I will talk about the proxy servers and firewalls which can be used to enhance the security, digital signatures and digital certificates and secured socket layer and the security which is built in Java and ActiveX. ActiveX is for the internet explorer. What are the security issues? Here we have listed some of the, about six of the security issues which deal with the data that is being passed is not intercepted. It's private, the data that is passed is passed as it is. Integrity is ensured, it is not changed. We know that who is sending the data, we know who is the recipient of the data and the person who receives the data cannot say that he or she has not received the data and then is the unauthorized and malicious actions that the client cannot perform at the server end and the server cannot perform at the client end. Right? So of course I cannot go into more detail because this is not a security course but I give you an idea. So what is a proxy server and firewall? A proxy server is something which is between the web server and the browser. And when I make a request to the web server, my request first goes to the proxy server and looks for what I am looking for at the proxy server. If it is there, it is retrieved from the proxy server instead of going to the web server so that adds a level of buffer. So in this way the proxy server defends the web server doesn't directly go to the web server. What is a firewall? The firewall is that if I am on the intranet and of course I am on the intranet and I have to expose my web server to my clients also. So I put a machine which is a firewall in between which monitors the traffic which goes from the internet to my internal servers and of course what goes from the internal server to the internet. So that is done with the firewall, prevents unauthorized access. So what is a firewall? A firewall can be hardware, it can be software, it can be a combination of both. And of course a proxy server can also act as a firewall. Why? Because it is like a buffer. It is between the internet and the intranet. It acts as a buffer. It can be acting as a firewall. So we have to ensure the control. So digital signatures and digital certificates, what a digital signature? A digital signature generates a piece of code corresponding to the contents of the message along with a certain key. And what is the properties of the digital signature? Authentication is through a public key. Private key is kept secret. Right? If you remember in one or two slides back I told you about authenticity and integrity. That's what is happening over here. And this is unique for the data which has been signed. So if the data is changed, then that string over here, that is also changed. It will not match. So signed data cannot be changed, can't be changed. If it's changed, then it will be known. So the integrity is ensured. So digital certificate is an attachment. Unlike generating a string of text is an attachment. And what it does, it verifies the authenticity of the sender, of the sender. So what it involves a CA is a certification authority. A certification authority is an authority reputable which ensures, which says that yes, this person A is the actual person A and has a public key with the CA also. And use that public key use for decoding. Details are in the notes. The concept over here is a digital signature is a string and a digital certificate is a file which comes along and they're encrypted. And they ensure authenticity and the integrity. So then we have SSL, the Secured Socket Layer, and we have the secure HTTP also. SSL what it does, it is an encryption protocol, right? And SSL secures the connection, while SHTP secures individual messages. So it is the message versus the connection. You see a difference, message, but remember without trustworthy digital certificates from a certification authority, these protocols are insecure. So either I use SSL or I use SHTP, what I need in both cases, I need a certification authority and it should be a trustworthy certification authority. That will ensure the security and the integrity. So that's the message I want you to take today. Thank you very much.


an audacious social investment program to the tune of 500 billion Naira, the largest pro-poor program in our nation's history, and the largest social safety net, at least in sub-Saharan Africa. This was just by the fact that by 2015, all prices fell by over 50 percent, and our production also fell from over 2 million barrels a day to less than 700,000 barrels a day, sometimes even 500,000 barrels in 2016. We have seen today the empirical evidence of the successes of the program, 200 jobs for undergraduates employed under the MPAR program, 300,000 more waiting to be employed, they've been pre-selected, 7 million children being fed daily in 22 states so far. Beneficiaries of micro-credit loans going to about 300,000, almost 700,000 households benefiting from conditional cash transfers.


In this step then, we are now going to build our lighting which is going to give us some beautiful sexy shadows So Unreal Engine has lots of different types of lights. So if we just click on one of the lights Let's go with this one. It gives us some options for every type of light and it calls that mobility So stationary Kind of is the best of both worlds in that it can have Elements of static and movable what a static light is it's a light that you place and It will never move in the engine You'll only have to cast shadows once and those shadows will never move because the light source will never move if it's a movable light It needs to be dynamic Which means that that light could move at all times that could be like a torch that which means your shadows are always going to Be changing which means you can't bake your shadows You can't create shadow maps of that it won't work Stationary is pretty clever because it will allow you to do both So it can bake your shadows, but if a character runs past the light will also like create Dynamic shadows from that character as well And by default everything starts on stationary if you're really struggling for performance You can change them all to static and you'll probably get a bit more performance back But what we want to do is build our lighting So if I just turn on show stats and say it's been angry at me all this time Lighting needs to be rebuilt and it's just saying it in capital letters build your lighting chain So let's do it the way we do that is we go into build but we're not going to build everything We want to go the drop-down arrow here And we can go to build lighting owner, which we'll do in a sec. But first of all, let's go to the lighting quality Building lighting can take ages. So don't do it on anything other than preview until you're 100% happy with it That's my advice So I'm going to leave it on preview and then we're going to build lighting owner. This can take anything from 30 seconds to 10 minutes I think on this project. It should take something in the region of about two minutes So I'm going to click on this and then I will edit out me You know pick your my nose for two minutes and we'll have a look at the result when it gets finished So I will see you when we all have some beautiful built lighting Okay, so my lighting build is pretty much finished. We're just encoding textures so when this is done it will update my level and the Static the baked shadows will kind of pop in so let's see what that looks like. Oh, it's exciting Okay, that builders done you'll get a lot of like advisory warnings as you can see I've got here basically There are some issues with my the way that I've done my UV maps in that I want a tyling So there's some overlapping them, but it's not really an issue for what we're doing So we can even know all these none of these are going to break anything The engines just warning us So now we've got these beautiful shadows that are baked in So, you know some areas may not look a so we've got this little bit here. Oh, hello It doesn't look brilliant So we need to think about what how we fill in these really harsh shadows. So let's just have a look what this looks like when we play it. Oh We have an error. Okay, let's have a look at this over here. So Now that we've added some extra information In the form of light maps to our terrain Part of it's refusing to render. We've gone back to the world grid material This is not what we're going for And this is something that we need to fix before we move on so How do we do that? Well, we need to go into our landscape material and there's a change that we need to make so There's apparently So my research tells me there's a direct x11 limitation. I think or a direct x10 limitation where you can only have 13 texture samples and Light maps count towards that seeing see we've got 12 here light maps are being added to our material as well And now it's refusing to render because we've given it too many samples So we need to fix that and we do that in the material and the way we do it It's just select all of the samples you've got so I'm just going to click on all of these whilst holding control look on all 12 and this sampler source is from texture asset and On meal engine has got away a workaround and To do that we change it from there to shared wrap and that changes the way the shader works We're in terms of samples and you can have like up to 128 samples in one material Which is loads will never need all those so We'll save that and That should force that material to recompile which is happening now. It's compiling shaders I'm not going to go back over and look at it until that compile is complete because it keeps crashing So I'll wait till it's done and then we'll have a look and see if that's fixed itself Okay, it's finished compiling. Nothing's crashed. So let's move over to our level tab The materials back so We fixed that little issue But our issue now is these overly black shadows Obviously in real life. You don't tend to get shadows that dark. It looks kind of cool But we sort of need those to fill in a little bit So we need to look at how we go about doing that And the way that we're going to look at doing that is in our details panel There's another panel there or there should be a panel there called world settings if you can't see it You should be able to get it from window up here There it is world settings and what we're going to do is change the environment color from black which it currently is to Something light in that so I've gone for kind of a light gray And when we rebuild our lighting that should make the black bits not as black So let's build lighting again and see how we feel about the result Okay, so the light and build is completed and we can now see that we've got much lighter shadows I actually think I've probably gone a little bit too far and now my shadows are a bit too light So I am just going to bring those back down Something like that. So a darker gray And I'll build my lighting again And but that will do it for this step. We've now set up our lighting. We have built the lighting and We now moving towards getting finished on on this tutorial, which Which is good. I'm happy about that What we're going to start on next are some of the post-processing effects So in the next step, we're going to look at adding some atmospheric fog Which is really going to help with giving this level a feeling that it's at kind of a early morning late evening sort of time of day So what I'm going to do is build my lighting again So I get a slightly darker shadows and then I'm going to Mosey on to the next step where we'll start looking at some fog. So I'll see you there Thanks for watching If you really want to take your learning further than I can cover in this series Then I highly recommend checking out plural site They have loads of really detailed video courses covering game art and game development using Unreal Engine 4 When I learned how to use Unreal a couple of years ago This is where I went and I look in regularly to take a new course and improve my skills I recommend checking out the introduction to Unreal Engine 4 course by Joshua Kinney This is really good and offers a good overview of what you can do in Unreal You can get a free 10-day trial by using my link in the video description And you get full access to all of their courses for that time at the end of your 10 days You can either subscribe for more or cancel totally up to you. It's got to be worth a free trial though, right? I'd like to say a massive. Thank you to my patrons Your support helps me to keep making videos like this one and I really appreciate each and every one of you It really blows my mind that people will support my channel and my work by pledging their money through patreon So again, thank you all so so much If you aren't already a patron and you'd like to offer your support then please go to patreon.com forward slash Shane Whittington


Please join me for a few moments of centering silence. Please remain seated as we sing our in-gathering hymn, which appears in your order of service. There are only a couple of lines, so we'll sing it through twice. Good morning. Welcome to the First Unitarian Society of Madison. This is a community where curious seekers gather to explore spiritual, ethical, and social issues in an accepting and nurturing environment. Unitarian universalism supports the freedom of conscience of each individual. As together we seek to be a force for good in the world. My name is Karen Rose Gredler, and on behalf of the entire congregation, I would like to extend a special welcome to any visitors who are with us this morning.  Newcomers are encouraged to stay for our fellowship hour after the service and to visit the library, which is directly across from the center doors of this auditorium. Bring your beverages and your questions, and members of our staff and lay ministry will be on hand to welcome you and answer those questions. You may also look for persons holding teal-colored stoneware coffee mugs. These are FUS members, knowledgeable about our faith community, who would be glad to visit with you. An experienced guide is sometimes available to give a building tour, but I'm not aware of there being one with us this morning.  What we would usually do is meet over in that corner to your left, so if you would like a tour and we have someone, they will meet you over there after the service, and if not, and you have questions or want some more information about the building and our architecture, then see one of us in the library and hopefully we can give you some additional information even if there's not a guide. We welcome children, babies, everyone to stay for the duration of our service. However, because it's difficult for some in attendance to hear in this lively, acoustical environment, we also have alternatives. If your children would like to sing and dance and run around, and those are the little glass room in the your back left corner and the entire commons where you can still see and hear the services. One thing we would like to make sure you do is turn off any devices that might cause a disturbance, such as cell phone ringers primarily, and please then pick that back up after the service. Excuse me. I'd now like to acknowledge the individuals who are helping our service run smoothly this morning. Mary Manning is taking care of sound. Tom Boykoff is our lay minister. Patty Witte is the greeter. And our ushers are Nancy and Pete Daly. Tom Dolmage and I think maybe Brian Chanis as well. Hospitality, people making coffee and water for hot cocoa are Becky Hustad and Sandy Plisch. Thanks to all of you folks. Please note the announcements, many of them. In your red floors, insert to the order of service, talking about things that are going on today and in upcoming weeks, please check those out. And Steve Goldberg has asked me to say, and I'm sure you'll all be shocked, Friday, May 12th is cabaret, and that means what? 89 days till cabaret. Yay, and thank you, Steve. He's hiding there. I asked him if he wanted to shout out the message and he said no, he'd deferred. So he's deferred. Again, welcome. We hope today's service will stimulate your mind, touch your heart and stir your spirit. Let it shine indeed. Thank you to our choir. Good morning. It is my pleasure to welcome to our pulpit today the Reverend Scott Rudolph from the UU Church north of Pittsburgh. Thank you. Pittsburgh. This morning, I'd like to begin our time together with these words by Nancy Shaper. She writes, witness to that place before words know how to save themselves or thoughts even have an inkling of how they will be born, to that quiet place where the holy dwells, that place before knowing, stillness before form, where tears cannot stop, can find no ending, and crying out, fills the sky, and also to that place where the earth first turns and turning turns to bounty, we stumble upon hope out of love, out of longing, and calm. And indeed, we all come here in this place this morning to do this thing we call, worship together, gathering on a Sunday morning to share life. And so let us share together. If you want these rise and body or in spirit and join in the words of our chalice lighting, may the lighting of this flame renew in us our endless for all that is right and true, our abiding love of life and all who share it with us and our unending dedication to following paths of peace and justice. And I invite you to share some of that abiding love with those around you. If we could have the kids and the young and the young at heart come forth for a time for all ages. I know there's a lot of you. Fantastic. They just keep coming. All right. The kids here. Fantastic. So how are y'all doing this morning? Everybody doing pretty good? Did you notice the sun is shining? Does it make you happy? It makes me happy. So I'm going to tell you a story. Sometimes stories start out with once upon a time long, long ago. This story starts out like this. Once upon a time, very, very, very near to right now, a man woke up. This man was a minister. And he woke up on a Sunday morning of all days. And he woke up in this very soft bed. He was such a soft bed and he thought to himself, oh, this bed is so comfortable. I'm so lucky to be sleeping in this bed. And he got out and he was in a hotel. And he was on the fifth floor. And he looked at his window at the day and he thought, what a magnificent thing to see this day. And he went downstairs because he wanted a cup of coffee. And he got in an elevator. Have you ever ridden an elevator before? They're quite amazing, aren't they? You get in, the door's shut. They push a button. They open and you're somewhere else completely. It's amazing. He loves elevators. And so he got downstairs. He got a cup of coffee with some of his new friends. And they talked about how wonderful coffee is. And coffee comes from little beans. They make coffee, a liquid out of beans. Isn't that just kind of crazy and amazing? And so he drank his coffee and he got in a car and he drove to a church. Because remember, he was a minister. And so he drove to a church. And here I think about how amazing cars are. I mean, he only came about three miles, but if he had had to walk, it would have had to take him a lot longer. And cars, they're pretty incredible when you start thinking about them, aren't they? And so he showed up at the church. And he looked at it and it was, let me tell you, it was an amazing church. He had never seen a church like it. It had all these angles on it. What is at the church? Fantastic question. So he walked into the church and no one was here yet. And it was kind of quiet and quiet, kind of dark. And he walked in and it was a beautiful room. And he just looked around and he looked around and the room was amazing. And then what's in the room? That was the most amazing thing. Soon, people started coming in the room and filling it up. And that was the most amazing thing at all. The church started filling with people. And then at a certain time, I think it was roughly around nine o'clock, something magical happened. It started. This thing started where they were singing and they were talking and the minister was a part of it. And he got up and he started speaking and he had a little hard time with the microphone. But microphones, when you think about it, they're amazing too. You turn them on and they make your voice really loud. I'm using one really loud, right? If I was, you can't even hear me anymore. But now look at that. Microphones are amazing. And then something else happened. These children sang a song and that was incredible. And then everyone sang a song together. It was so amazing. And then something really cool happened. The minister said something like, if the young and young at heart would like to come forward and the children were going to have a time for all ages. And then all these children came right up front and they sat on a carpet and they listened to that minister tell a story about how his day had started. Isn't that amazing? I'm telling that story. You think that's me? That's my story from this morning. That's what happened to me. And I tell you, I've had an amazing morning. Do you know why? Because I've been paying attention to what's amazing in my morning. You ever do that? You ever just pay attention to what's going on in your life and what's amazing about it? Sometimes you have to remember to pay attention to that kind of stuff. So let me ask you, what do you all think is amazing in life? What do you think? What? When I get to go to the Wilderness Hotel. Fantastic. What else is amazing? What? That sounds amazing. The Children's Museum There are kinds of amazing things there, isn't there? Who have we heard from? What's amazing in the world? Anybody have anything amazing? Somebody in the back there. What's amazing? That's it.  Sometimes I play this game. When I'm feeling down, I'm not sure what's amazing. Here's what I do.  This time I just looked at that A-V projector and when you think about that, it projects light on that and we can all read hymns and sing together and that's amazing and sometimes I do it like this and I open them and I see a harp. Harps are amazing and what I find is I can do this and anything I look at, really, if I think about it, that certainly is amazing, kids. So we play this with me. Where's our choir? Do they? There they are. So if everyone will turn, turn, if everyone will turn and put your hands over your eyes and close them and then open them. See? Amazing things happen. So we're going to listen to the choir sing and then you'll go to your religious education classes. Reading this morning comes to us from Clark, a 12-year-old tried to gain his parents' attention to a shining star. The parents were busy with time and schedules, the irritabilities of the day and other worthy preoccupations. Yes, yes, we see the star. Now, I'm busy. Don't bother me. On hearing this, the young one launched through the porch door, fixed a fiery gaze and said, You be glad at that star! I will not forget the incident or his perfect words. It was one of those rare moments when you get everything you need for the good of your soul, reprimand, disclosure and blessing. It was especially good for me. That's that surprising moment because I am one who responds automatically and negatively to the usual exhortations to, quote, pause and be more appreciative of life, unquote. Fortunately, I was caught grandly off guard. There is a notion with some truth to it that we cannot command joy, happiness, appreciation, fulfillment. We do not engineer the seasons of the soul or enjoy the quality of mood in one another. And yet I do believe there is right and wisdom in that imperative declaration. You be glad at that star. If we cannot impel ourselves into a stellar gladness, we can at least clean the dust from the lens of our perception. If we cannot dictate our own fulfillment, we can at least steer in the right direction. If we cannot exact a guarantee for a more appreciative awareness of our world for persons and stars and breathing and tastes and the incalculable gift of every day, we can at least prescribe some of the conditions through which an increased awareness is more likely to open up in the skies for us and for our children. It is not always the great evils that obstruct and waylaid our joy. It is our unnecessary and undignified surrender to the petty enemies. And I suggest it is our duty to scheme against them and make them subservient to human decree, time and schedules, our irritabilities of the day and other worldly preoccupations. Matters more subtle and humane should command our lives. You be glad at that star. I invite you to rise in body or in spirit for our next hymn, number 391. Deep inside all, this voice speaks to us in many different ways and brings many different messages. Sometimes it's a message of peace or comfort. Sometimes this voice might suggest some soft insight into our lives. And sometimes this voice just whispers, wow, or that. My dad does this thing when we're in a large crowd.  He just stands there kind of dumbstruck and says with wonder in his eye, would you look at all the people? He says it all the time.  And so he was always saying it and anytime there was a sea of humans you could just count on him using. The thing is, he meant it every single time. He was amazed by these people, not by what they were doing, but just the fact that they were there doing whatever it is that humans do. Would you look at all the people? I think in these moments what my dad was doing was being glad at that star. Just taking it in. Just appreciating. You be glad at that star. It's good advice from a three and a half year old and a three and a half year old is a great place to get good advice. The world around us is brilliant. And it's just that sometimes we forget to take notice. We shove it off to the side because we're busy, we have schedules to keep or we have worries on our mind and our days fill up. But for lucky sometimes we can remember to be glad at that star. Whatever it is that star might be in any given moment. Because at any given moment there is some star to be glad about. Like rotten logs or dirty puddles. The poet Hubbard wrote, Oh God, how wonderful are thy works. Thou makest the rotting log to nourish banks of violence. And from the stagnant pool at thy word springs forth the lotus that covers all with fragrance and beauty. From rotten logs and dirty puddles. And so I think there's a difference between awe and appreciation and gratitude. Although subtle, awe for me is that feeling that's great, that's before words, it's just kind of dumbfounded where it just hits you. You think, oh! And gratitude is something different. That's thankfulness that this event has occurred. So this is an concern about awe or gratefulness. It's something that happens right in between there. It's a moment of appreciation. That act and art of noticing, of seeing in life the good and the possible who you're caught up in a moment and you think to yourself, and I find myself, I don't know about you, that I'm in times that I need to ground myself in what is good and what is possible. As I think to what is going to be spiritually required as we look to do the work around culture and justice in our country and our world in the days to come. There is a bumper sticker. I tried to find out who said this but I don't know, no one knows. So sometimes you just have to say, there's a bumper sticker that says if you're not angry, you're not paying attention. And that's right. Absolutely. If you're not outraged at what's happening in the world, you're not paying attention. But very true. It would be another bumper sticker. You could put right on the same car that says if you're not astonished with the beauty in life, you're not paying attention. Both are true. Albert Einstein said there are only two ways to live your life. One is as though nothing is a miracle and the other is as though everything is a miracle. So I prefer the second. I choose the second. I try to choose the second. Okay, on a good day, if I'm really trying, I may be accomplished some of the second. Noticing life can be a miracle and it can be hard to notice these moments of the miraculous in the mundane and we just take life's blessings for granted until these blessings don't show up and then we scream at their absence, even the small things. Many of us drive cars every single day but it's only when we turn that key and it doesn't work that we think to ourselves how important that car is in our day and how we rely on it, how complex that system is inside that hood that makes that car work and I hope that it doesn't cost too much to get this fixed. And so now we get to the part in the sermon in the service where the minister says so you should just appreciate things more. It's that easy. Just make lemons out of lemonade. Oh wait, no, that would be hard. Just make lemonade out of lemons. And so this is one of the reasons I like the reading this morning. He addresses that. He gets it. It's not always easy and you can't just say this. You can't just automatically appreciate things in life or force it. He says we do not engineer the seasons of the soul or enjoying the quality of mood in another. And so if I'm in my car and it doesn't start I don't want to hear but isn't it great that it starts every other time? No, I want my car to start then. But really I want them both. I get it. This is life. And there's no way that we couldn't take life for granted because life is too large and too varied and too wonderful and too unbelievable to take in. And so I turn to the comic Louis C.K. who once spoke about this so very well. And this is adapted because if you use the comic Louis C.K. in church you have to adapt it. He says that I was on an airplane and there was high speed internet on the airplane and this is the newest thing and I didn't know it exists.  And I do and it's fast and I'm watching videos and I'm watching YouTube and it's amazing and I'm on an airplane and then it breaks down. And they apologize that the internet's not working and the guy next to me goes, this is ridiculous. Like how quickly the world owes him something that he didn't even knew existed 10 seconds ago.  First off we didn't board for 20 minutes and then we got on a plane and they made us sit there for 40 minutes. We had to sit there. Really? What happened next? Did you fly into the air incredibly like a bird? Did you partake in the miracle of human flight? I mean you're flying. It's amazing. Everyone on a plane to just the whole time be saying, oh my God, wow!  And so yes, this is me and this is you and this is all of us. And so that's why it's good for me to fly with my young children sometimes because they can remind me how amazing it is to fly and what it means to stare out a plane window. We just don't do this all the time and that's because there is an obstacle in the way. It's not all our fault. Our brains do this for us. We tend to see the negative in life often instead of the positive. Negativity bias is the psychological phenomenon which points to the power of negativity and how we receive and how we process life. It would have us believe and understand that unpleasant memories are easier to recall than pleasant ones. The ideas can stick out stronger and be more instructive in how we form our impressions and our opinions. We behave in ways often that is just so that we don't replicate negative experiences of our past. And sometimes, strangely enough, negativity can just be more attractive. Like, who doesn't enjoy a good wallow every once in a while in your own misery? And who doesn't keep reading the news day after day after day? And I have bad days and I have good days. And on the good days that are great, if there's one bad thing that happens, sometimes that's the thing I'm thinking about as I go to bed. It's a strange thing how negativity can be so powerful in our lives. And this doesn't even talk about what's called hedonic adaptation. And this is the idea that humans find in equilibrium. We adapt and adapting is good, but that also means that there's a stasis in our life around happiness. Major events can come, but we return to normal. And as we find new happiness, that becomes the new normal. Over and over, we find new baselines of happiness and things kind of calm out and become as they were. Even things like flying through the sky or looking at a night sky. I know I see this at church sometimes as well. There's all these incredible things happening in a community. All these missions being fulfilled, all these justice works happening, all the little things like who takes care of the name tag holders. And all we can do sometimes is walk in and think, hmm, that corner's a little dirty. I wonder who missed that. And so it works at church too to remember all that goes in to make this place happen. We fail to recognize the miraculous because we expect the more the miraculous all the time. And we can't process the miraculous all the time. We couldn't even get through a meal if we truly understood how remarkable it is what had to happen to put food on our plate. And so sometimes we might offer a blessing before. That's a moment of acknowledgement and appreciation so that we can go on and eat our meal and get through it. It becomes a spiritual task to remember and to notice the goodness and the beauty in life. And so I'd like to pose the same question to you that I posed to the children this morning. What is it that you find amazing in life? What is it you find just miraculous? I'll ask you just to... the red cardinal outside her window that she saw. So red. Forgiveness. Absolutely amazing. The sun is out. Hmm. It's been like it's been in Pittsburgh here I see it as well. Medical technology, absolutely. That's amazing. What else? Cabaret. Cabaret! I'm beginning to learn things about this congregation quickly in your traditions. What else is amazing in life? Your children singing. Absolutely amazing for you and for all of us as well. Yeah. Well how about this? What's amazing in this church? For volunteers. Yes! There's two of them. Sense of community, right? The physical beauty of this church. Absolutely. The joy to be in. Music. Music. Music. Music. Absolutely. How about this? Which can sometimes be a little harder question. What is amazing and miraculous about you? Anyone brave enough to answer this one? The fact that you're here. Absolutely. Good health. Healing. Magic, right? I mean that's as good as magic.  I'll invite you to think to yourself. Something about yourself that you find incredible. Amazing. Be proud. Be proud. Lift those things up. They are truly amazing and they are you. Hold on to those. Remember those. It's important to appreciate amazing things about ourselves as well. And so it is good to look to what is amazing. And it's not all amazing. We know this. Constructive criticism is important. It's how we as individuals and institutions improve and grow and get better. This is inherent in our liberal religious philosophy. And we know that justice is deeply rooted in seeing hard truths of life and being dissatisfied with unfairness and inequity. And so this isn't anything about being Pollyannish, naive or blissfully blind or wishing away pain without growth. Some things in life are hard. Of course. Illness and death and grief and pain and depression and shame and failure. All this is a part of life. And so what the religious life asks us to do is to hold multiple things at one time. Because that's how life happens. All at once. E.B. White wrote, if the world were merely seductive, that would be easy. If it were merely challenging, that would be no problem. But I arise in the morning torn between a desire to improve or save the world and a desire to enjoy or savor the world. And this makes the day hard to plan. It does all happen at once. Life is difficult and joyous. And so it feeds our soul to remember the positive and the affirmational. And we can do things to help ourselves. Because life becomes so quickly routine and moves so fast. And so the field of positive psychology says that appreciation is something that we can cultivate. Thank goodness for that. We can cultivate it by putting in little reminders in our day. Maybe it's when you hear a bell or a gong, it reminds you to appreciate something. Maybe when you see the color red, you think to appreciate. Or maybe you have a bracelet that you can wear and appreciate something. But whenever somebody else's phone went off, you thought to yourself to appreciate something around you. You can practice mindfulness. You can practice smiling. You can practice being kind to others and lifting up their day as you lift up your own. And of course, one way to remind ourselves about beauty and what is good to appreciate in life is to come to church. Where we lift up ideas of love and peace and justice. Where we create a sense of religious community and sharing together. Where we have children who inspire us and we have music that lifts our heart and soul. Church is a place to come to appreciate and have our wells dipped into. And come up with life enriching waters.  People were throwing frisbee, having fun, cooking out. There were people everywhere. And I swear to you, without thinking it, I muttered to myself, Would you look at all the people? I kid you not. But it was a good thing. We can't make ourselves be glad for celestial bodies. We can't force appreciation or gratitude. It comes from within. But we can, by constantly noticing our blessings and being aware of the amazingness of life, sometimes rekindled that fire of gratitude within us. It's not always evil or hardship that gets in the way of experiencing joy, but sometimes it's just inertia. It's the willingness to concede, to grievances, it's the routine, it's schedules, it's deadlines, it's apathy, but it only takes a moment to look up at the sky and see a star twinkle and be filled with ineffable awe. And so that becomes our challenge. Simply to remember. To actively find moments and to claim them throughout each and every day. To be glad at that star. Whatever that star might be. Be glad at that star. This is the great end of all of the world's faith traditions. To bring the human being closer to the divine by acts of creation and compassion. We now take an offering that allows us to exercise that all-important generosity of spirit, an offering that will support this self-supporting church and its many ministries. The gifts of the congregation will be most gratefully received. Thank you, Linda, for such a gift. We gather each week a community of memory and hope. To this time and place we bring our whole and at times our broken selves. We carry with us the joys and sorrows of the recent past and seek a place where they might be received, celebrated, and shared. We take a moment now to share those joys and those concerns that are living here within our congregation. We hold Hathaway Hastler and her family in our hearts as they grieve the death of her daughter, Hathaway Happy Rokes. Hathaway passed away suddenly in her sleep on January 30th. The memorial service was held on February 4th. We send our love to the Hastler and Brooks families. We send our love and care to Kirsten Carlson and her family on the loss of Kirsten's father, John Carlson, after a bone marrow transplant. We send much love and strength to them. And for all those joys and sorrows that remain quiet in the silence of our hearts, let us join now for a moment of quiet and hope. May our coming together and sharing of lives lighten our sorrows and expand our joy. And I invite you to rise in body or in spirit for our closing hymn, number 128. I invite you to put your hymnal down. And if you're willing, I invite you to put your hands over your eyes and just look somewhere different in the room than you were just looking. And open your eyes again. Isn't that amazing? Go from this day with new eyes refreshed by the love and light of this place and the spirit that happens when good people come together. Amen.


Hello, my name is Harshad Rajakar. I am the Gastro-Intestinal Surgeon at Manipal Hospital, Kharadipur. We at Manipal Hospital are promoting a health awareness this month. And I would like to put ahead some facts regarding gut health that could be beneficial to everybody. Gut health is something that affects everybody. We all get affected by abdominal symptoms and discomfort and things like that. We tend to affect all our functioning every day. A common misconception that most people have is constipation. Constipation is not having stools every day. Having stools every day is not required. It is difficult to pass stools. Stools that are very hard to pass that need to be pushed is a symptom of constipation. Having motions every day is not required. It is just a matter of convenience that we have developed a style of passing motions every day. If there is no urge and we try to push our intestines to passing motions, we may in fact end up damaging the rectum and causing piles and things like that. Apart from that symptoms like bloating, loose motions, constipation, all of this is related to our lifestyles, the kind of food that we eat when we eat what we eat. Generally speaking diet that is rich in processed food, rich in carbohydrates tend to affect the gut health in a significant way. So we should always promote food that involves less processed food, less carbohydrates, less refined flour. Packaged food is always refined. Packaged food especially things like biscuits, bakeries, sweets, etc. have a lot of carbohydrates and that can be decremented to gut health. The things that are beneficial to gut health is a high fiber diet, a fiber that is rich in fruits and vegetables. Fruits contain fiber that absorbs toxins and promotes gut motility and probiotics are always important. A healthy diet containing probiotics including curds and yogurt, etc. will help maintain the gut flora and that will affect the gut health positively. Besides regular meal times, our bodies make hormones in the morning. So we have what is called as a circadian rhythm. So having food in the morning around sunrise is an important aspect of life. Food that we eat in the morning is food that the body can utilize. As the day progresses, our diet should reduce. Our last meal should not be later than sunset or around 7 o'clock. Leave a lot of time, leave around I would say 2 and a half to 3 hours between dinner and bedtime. That will help the body utilize the food that is consumed. Reduce your dinner times, reduce your dinner quantity, reduce the calorie intake at any given time. Reducing the portion size and chewing your food well is always helpful. Here is wishing all of you a good gut health.