Success. OK, great. Oh, thank you. OK, sorry for the delay. We're going to get right into it. So today we're talking about TCP, right? So up until this point, we've talked about how to do port scanning with TCP, right? And we saw there's all these different ways we can try to extract some useful information about another machine's TCP port, right? Try to determine, is there a service running and listening on that port? So we saw connect scanning, SIN scanning, FIN scanning, Christmas tree scanning, all kinds of crazy scanning. We saw idle scanning, where we could see that we could actually use another machine to actually try to scan our victim, right? Which is a very cool security technique. So some of the other things we can learn. So from that, right? So Christmas tree scans, FIN scans, right? They all depend on the behavior of the specific, did I shut it off? I spent so long trying to turn it off. I found the button that's here, which is impossible to see when it's off, which seems like a terrible design. OK, so we saw that with all these kinds of scanning, right, they take advantage of certain peculiarities of certain types of TCP IP implementations, right? Specifically, what happens if I send a TCP IP packet with all ones as the flags, or all zeros as the flags, right? And so what we can actually use, and some techniques that have been used, one of the things we want to discover, right, we're trying to, or a hacker would like to discover, is what operating system is that machine running, right? Oftentimes you just have an IP address, so you don't know if it's Windows, or if it's Linux, or VSD, or an iPhone, or any of these other things. So what people have found is you can actually use these weird bits of the difference between the different TCP IP implementations, and you can try to fingerprint the operating system to try to say, is it a Windows machine? Is it a Linux machine? What kind of machine is it? So the idea is you can craft packets to the host to try to determine what kind of operating system it's actually running. This is actually a very, very cool technique. So you could say what happens if I send a thin packet? What happens, what does it do? Or what if I respond to a thin packet by sending more data, right? Does it send a request packet? What if I know that it's the wrong thing? All these kinds of things. So if I, yeah, so some like weird combinations of flags in certain operating systems will drop the packet in certain operating systems, it'll send a reset packet. So you can use that determination to try to fingerprint the version number. You can use the, sometimes the initial sequence numbers will be different. The window size will be different on different devices, different operating systems, different, yeah, devices operating systems. What happens when I send ICMP messages, right? Does it block the ICMP messages? Does it have some kind of an error rate? How much of the ascending datagram, so if there's a bad packet, how much of that packet does it include in the reply to help you debug certain implementations do it differently? What happens with TCP options? Does it respect certain TCP options or not? So it's actually very cool. So you can do this in a passive manner with a program like TOF, which will actually just look at all the network traffic and be able to determine or try to determine, hey, this looks like a Windows 7 machine or this looks like a Linux machine. Other things, Nmap has a configuration for this where you can say, hey, try to determine what operating system it is. I think it's the dash big O sign. And so it has essentially, you think about it, a tree, right? All these different, if I send this packet, if I get this response, it means it's in this half and if I get this other response, it means it's in this other half and it can refine all the way down to try to determine exactly what operating system is running. Where's something to have to be careful of here? So what does it tell us when it says, I think this IP address is this operating system? Maybe, right? It tells us that this tool thinks that it is that operating system. Does it mean that it absolutely is? Not necessarily. What are some cases where it might not be? So yeah, maybe before you, in the time between you made the scan versus the time you actually launched an attack, maybe the OS got upgraded. All this tells us is that I think this IP is this operating system based on the packets that I sent to it and its responses, right? So if that IP is actually a load balancer for two different machines, who knows where those packets actually went if they went to the behind the load balancer machine, if it went to one of those two machines or if it went to the load balancer itself, right? Or what about, think about ASU, right? Or your home, right? You're probably not connected directly to the internet, right? You have a router in between you and the internet that's doing natting so that it appears that all of your traffic is coming from one IP address, right? So then who's it scanning really, right? All your packets are gonna be dropped from the router. And so it's just gonna say I couldn't really determine the operating system. But even if it could, it's probably wrong, right? Because it's not actually getting through. So these are just some things to keep in mind, right? So this is more about, okay, I can use this tool, right? To run, it'll give me some output. But really to trust that, I need to know how it's working. Right, so I need to understand more about the operating system. Okay. So now we're gonna go back to our old friend, Spoofing. So what is Spoofing again? What was it? Yeah, we wanna impersonate, we wanna pretend to be some other IP address, right? That we're not for some other host. All right. So the idea is we wanna try to impersonate a host, impersonate another machine when establishing a TCP connection. It was discussed in this paper, which is a really interesting read if you wanna do it. Anybody recognize the name there? RTM, the Morrisworm guy. This was like two years before, or a year, I think two years, three years before the worm. So it's just showing that he was very interested in security and knew what he was talking about and probably had the knowledge to build the worm. It was also used by Kevin Nittnick and is attacked against the San Diego Supercomputing Center. But now we actually have enough background knowledge where we can understand this attack and kind of how it worked. So why do we wanna do this? Why do we wanna spoof another host? Get some confidential data. How? Why? Moving all the TCP packets and if it's unexpected, then you can get the data from it. This isn't snooping, right? We're not trying to listen to the packets. We wanna spoof, so what is that? What are we trying to do? We're trying to get the wrong information. We can send the wrong information? Yeah, what was that? If you spoof a trusted host. Right, so yeah, we're taking advantage of the fact that this machine trusts some other machine that trusts it only based on the IP address. So we can pretend to be that IP address. Now we can take advantage of this trust relationship, which is how the Morrisworm propagated and it's how we'll see how Nittnick got into the San Diego Supercomputing Center. So for instance, if host A trusts host B, to log in with no password, basically so it's a configuration that says, hey, if you're coming from host B, then you don't have to type in your password because I trust you, I trust this IP address. So we wanna impersonate node B to get this trusted relationship, right? Because host A does not trust us, right? Host A only trusts host B. We're some third thing. So what do we wanna do at a high level? Have to do to be able, let's think about like, to be successful, how are we gonna spoof this connection? It's TCP, what do we know we have to do? Handshake, that we have to do three way handshake with C as if it's coming from B, right? So let's walk through that process, right? So what's the first thing we're gonna wanna send? A send to B from who? From C, right, exactly. Or from B, so we're gonna send it to A from B, but actually from us, right? So then node A, then what are they gonna send? A SINAC back to host B from host A, and then we have to reply with what? An AC from host B to host A that has the correct sequence and acknowledgement numbers from that other host, right? Well, what's one problem? So let's say we try to do this, right? We send a packet to host A, a SIN packet to host A from host B. What are they gonna do? A SINAC to B, and then what's B going to do? Reset. Yeah, reset and be like, what are you talking about? We haven't made this connection, right? Reset. So our very first step is we need to somehow kill A or kill B or have it not respond to these SIN requests. Because if it responds and resets our connection, then the whole game is up. It's not that difficult. We could probably take out B pretty easily. And we only need to really be successful once, right? So we could just make a lot of traffic and keep trying this over and over. And maybe one time that packet, that reset packet gets dropped and then our attack is successful, right? So as an attacker, we have time on our side because we only need it to work once, right? We first have to kill B, then just like we said, right? That's trivial quote, quote from a high level, right? Because all we have to do, all we have to do, so is this part difficult? Is sending a TCP SIN packet with a spoof IP a spoof source IP difficult, right? We saw that in the IP layer, right? We can just spoof ICMP messages, we can spoof UDP packets, all that. So when A replies back with its SIN ACK, right? So B, we're counting on B ignoring this packet, right? Because we denial of service that we've taken it off the network, it's not gonna respond. So do we get that packet, that SIN ACK packet? So is this a bad thing? Yeah, it makes things a lot harder, right? Why is it making things harder? We don't know the sequence number. Yes, the sequence, we have to reply back with a valid sequence number, right? A is going to generate this server-side sequence number, right, and we have to acknowledge that with, in this case, SS plus one, right? To establish the connection. So we don't get that, but we have to reply with that plus one. So how can we do this? Let's think attack mode. Is all hope lost? Can we never do this? Yeah. What happens when BU receives a bad ACK back from the SIN ACK? So it sends a SIN ACK, what does BU do? Can I send multiple ACKs with the current? I really don't know off the top of my head. I would just blast it with every, you know. Yeah, so you could guess. I mean, that'd be a good board. I think it would drop the connection or it would send a reset or something and say, okay, something messed up is off the top of my head. But either way, you could just brute force in the sense that you just keep doing it two to 32 times, right? You don't have to send two to 32 packets, ACK packets, right? You can do a SIN, they send a SIN ACK and then you send an ACK with one thing, then you send a reset and then just keep doing that again. You know how I'm generating it. It just wouldn't be very safe to get caught and you can make your connection and see where the sequence is and then make sure it's also connected. Yeah, so one way would be if we can guess what that sequence number is, right? And we can be reasonably certain we actually know what if that is. What's another way though? Maybe I accidentally put it out of scope, yeah. Yeah, right? If we even drop that packet, if we see that packet somehow, then it's great, then we're good, right? If that node is on our Wi-Fi network and we're sniffing packets because it's an unencrypted Wi-Fi, when we see that packet and we can use that sequence number, we can just use it, right? Or we have to somehow guess it, right? And somehow we guess correctly the sequence number, right? Then we do SIN plus one and everything's good. So let's see how this looks like. So we first, what's the very first thing we wanna do? Kill B, we first need to kill B, right? Make sure it does not send any packets. Then we're gonna send a packet to A as if it was from B, right? And so we send the SIN and then they're gonna send the SIN act to host B, which we don't see. And then we have to somehow try to reply with, right? So we need to make sure that this act here is this sequence number plus one.  So this is tricky. So there's, you know, the spec said that the sequence number should be random, right? Don't really specify how to actually do this. So there's been some updates of how to improve that. But oftentimes implementations don't actually generate random numbers in a real random sense. So there's a great paper called Strange Detractors and TCTIP sequence number analysis where basically they look at the distribution of sequence numbers in like a graph space. And so you can see how it looks like. So you can see based on, I believe it's calculating the X value of the difference between sequence, like the past two sequence. You take n minus one, n minus two, n minus three is the last three sequence numbers. And you can take basically the delta between two and three and the delta between one and two and graph that delta. So what is this kind of gonna show you? I guess this does actually in three dimensions. Yes. All right. So what's this gonna show you then? So there are some things back in generative in two dimension which says it's not exactly random and exact random ones and it's very, very different. Right, so if it's random, how should it look in this 3D space? A complete sphere with equally uniform distributed Yeah, right, so it should be disperse or some kind of a good kind of like a cloud in some sense, right, very disperse is how we want it to look, right? Because if it's not, then that means we can predict what the sequence numbers are going to be here. And if we can predict the sequence numbers, then this three-way handshake thing we can completely spoof trivially, even if we're not able to eavesdrop on that syntax package.  So this is for Windows 2000 XP, which is pretty good, right? I mean, it's fairly distributed. There is like a concentration here, right? This is Windows 95 and 98. Probably not very one of these, right? This is pretty insecure. So this is Linux, the Linux distribution, right? So this is kind of what you'd want it to be, kind of this distributed cloud. Here's like the free BSD one, which is actually even more disperse. So we talked about, I believe, the Cisco operating system on the routers, right? It's called iOS, heavily confusing. So they had a problem, it was they called before the cure. So after they did this fix, they could see that it was followed this very even distribution pattern that was very easy to predict. And then after they fixed it, it disperses. Like this is actually very well dispersed. I don't know if it's coming through on all the, okay, kind of shows up there a little bit, but it's very dispersed. On the Mac, the Mac was also fairly dispersed. HP, I actually don't know what to say. Is it HP Unix? Is that what the UX says for? Okay, you can see that it's definitely not, not really distributed how you want it, right? And you can see that after the cure, it actually, when it did get fixed, it has like less of this core. This one, I don't know if you can tell, but there's just like a few dots right here. Like this is before, yeah. So you can see that it's really hard to get this right. And so TCP, right? And it's interesting to think about, like this is just something, think about, this is some networking detail, right? Like how do you generate these sequence numbers? So the fact that, when they were writing this TCP specification doesn't, they didn't specify how to create random numbers or what it would mean to be a random number. And possibly, why did they think about that? Are they horrible people? What do you think? Could we shame the spec writers?  It was not meant for security purpose when it was disarmed. Yeah, right. So they probably weren't thinking about, is this really a problem? Because it's kind of the administrator who has established this trust relationship between these two hosts, right? And so the fact that the security in essence relies on correctly choosing this one random number that nobody has ever said up to this point that hey, maybe it's a security problem that this number is not absolutely crazy random. So yeah, so it's kind of, in one sense, you can defend them by saying like, well, the spec, and say that it's secure or anything, they're just designing a network protocol. On the other hand, you'd be like, Gabby, you're designing a network protocol that the internet uses, so maybe you should think of security. The flip side of that, right? They weren't really thinking, nobody was thinking about security back then. And it wasn't until applications built on top of that rate that it actually became a problem, right? If nobody trusted IP addresses, then this wouldn't be really as near a problem. So the fact that there's trust relationship exists really does cause a problem. Okay, so we talked about spoofing. So what's the difference between spoofing and hijacking? I think so. The control of the session. What was that? Taking control of the entire session. Yeah, or taking control, or just even injecting data into a virtual circuit, right, a TCP circuit between two hosts, right? So it's essentially, it is in some sense spoofing, because you need to spoof data from one side to the other side. But in this case, we're not establishing a whole connection. We're trying to inject into an already established connection. So the idea, so what are we gonna do? So we wanna do this, what do we have to do? So do we need to do like a SIN, SINAC, and MAC? No, what do we have to do? Route the packets towards us. Route the packets towards us? What do we can? I mean, at high level, what do we have to do? Maybe mirror all the traffic. Mirror all the traffic, maybe. That could be a technique. These are all techniques we can use to do this. Kill the bee and dig the session.  Yeah, we'll see that we may need to do that, or it may happen automatically. Man in the middle? Man in the middle. Essentially, that's what we're doing, right? We wanna try to inject some traffic into the middle there. What do we do? Like so. Switching up, switching up, switching up, it's becoming a little bit. The route. We're making it up. Not quite. Hubs, these are all techniques, right? Change entry in the ARP table. Change entry in the ARP table, that's gonna be how we want to actually do it. Or kill a bee session at bee site, but just and connect that session to us. Almost. Close. How many packets do we, let's say we just wanna inject some data into the conversation. How many packets do we have to send? So before we need to send two of the three-way handshake, how many packets do we need to send? Just one if we have to send. Just one. If our data can fit into that one. Make the system accept that it is valid data. So how do we make the system accept that it's valid data from this communication? How does it know? How does the host know that it's a valid data? Yes, the sequence number is what it's expecting, right? Is inside the window. What else? Source IP. Source IP. What else? Source port. And what else? Source IP. Destination IP. Destination port. Yeah, exactly, right? So this is where all that studying all those crazy details of this would be protocol, right? So it knows it's the connection because source IP, source port, destination IP, destination port, right? And it knows where that data goes because it's inside the TCP window, right? That sequence number is inside that. So that's essentially all we have to do is throw a packet out and make sure that it's in that window, right? How we actually do that, we can use all of these techniques that everyone's saying about how to actually eavesdrop on this communication channel or how to maybe take control and do kind of a man in the middle thing. So the idea is, yeah, we're gonna try to insert most often, and the most interesting case is when we wanna insert some data in there, right? But we could also, if we wanna do like a manual service, we could just send a reset packet, right? To make it close the string, which could have important security ramifications, right? If you can stop the backup process after you've broken into a server, now maybe your actions aren't backed up anywhere and so you're less likely to get popped. So, but we have to do the, we have to have the correct sequence and acknowledge the numbers, right? So that way, we know that everything's in the border. So we talked about that, right? You all actually have incredibly good suggestions based on what we've learned so far, right? So we can eavesdrop the traffic, right? We can see if we could eavesdrop the traffic by doing art poisoning, right? And getting everyone to send their packets to us, right? In front of the local network. We can also eavesdrop if we were to turn the switch into a hub, or if we were on a hub and could see all the traffic on there. We can also guess the correct sequence and act numbers. And so there's a good paper to read if you wanna learn more about that, about how to do this. So, one problem is if we wanna inject data to the two sides or continually exchanging information, what's gonna happen to that, the TCP window that we want to inject into? Yeah, that's gonna be slightly, it's gonna be constantly changing, right? As they continue changing data. So it's like, how am I trying to hit a moving target? Right, it's gonna be harder to try to land in there if it's constantly moving, right? So the first thing is we kinda wanna try to wait until the connection is quiet, right? And nobody's really sending any data. So, both end points, I've acknowledged all the traffic, now we just need to somehow get in there. So, then we inject our data in the stream, right? Let's say we're able to do this, we correctly guess or whatever. What's gonna happen now to both of our end points and their view of this TCP connection? Just to be clear, I'm aware we're having a change. On which, on both of them? Yes, on one of them, right? And that's, is that a problem? Yeah, right? They're never gonna be able to talk to each other because one side's gonna say, hey, here's, if I inject, let's say sequence number 10, right? And the side that I injected acknowledges that. The next time the other side tries to talk, it's gonna send that at sequence 10. It sends, hey, here's sequence 10. And the other side goes, I already got this, I'm expecting 20, what are you doing? And so they can never, so we've essentially, if you think about it, right? You think about kind of the state that the TCP connection on both sides being the current sequence and acknowledgment numbers, right? That they've seen on both sides. And we've desynchronized this process. So what's gonna happen after we successfully do this? So let's think about this, right? So we have this connection, let's go with 10, right? We're starting at sequence number 10, then both quiet, not talking. Nobody's terminated the connection. We inject a packet 10, right? Here's 10 bytes of data, starting at sequence number 10 to host A. Then what, coming from host B, right? So what's host A gonna do whenever C is that packet? Drop the packet, because it has already gone to packet. No, no, from our packet. So we're gonna roll back again and start from the beginning, right? So they're not talking, A is expecting sequence number 10. B hasn't sent it yet. We send 10 byte packet starting at sequence number 10 to host A, coming from host B, right? What happens when A gets that packet? It'll acknowledge the packet, right? So it's gonna send us zero byte packet. It's gonna acknowledge, it's acknowledgement number's gonna be 20. Say I've read up to sequence byte 19, the next byte I'm expecting is byte 20. It's gonna send that back. So what's the other side gonna do? Send a reset. Yeah, actually it's one of these things. Well, it's kind of weird, right? Now we're acknowledging data that we actually never sent. So we're gonna inject in there, right? And when the receiver of that data we inject, they're gonna acknowledge just like we said and say, hey, great, I've seen up to 20. When the person we just moved gets that, they're actually not gonna reset. They're gonna say, actually I've only sent you up to 10. Like here's an acknowledgement. I'm for sequence number 10. Like I've only sent you up to a 10. And because the receiver gets that and it thinks, well, okay, I'm getting an act for like an earlier packet. So I should send back that, hey, I'm actually at 20, this is what I've received. And then the recipient's gonna get that and this whole cycle's going to keep repeating where they continue to acknowledge each other. Until what happens? Yeah, one packet gets dropped. Right, so it's kind of like one side goes, hey, great, I'm expecting 20. And then the guy goes, I'm only expecting, I only sent 10. And the guy's, no, no, no, I'm expecting 20. No, no, no, I'm expecting 10. Right, so one packet gets dropped and then they're like, that's what I thought. Good. Until they try to send more data or try to do anything else, right, then there'll be a problem. Right, so the problem as we get this is called an act storm where these hosts just continue to act in the cycle of work. Yeah. Okay, you know as the attacker sends something to the other box at the same time, you know, that would get them back in. So send the right message to get them back in sync so it thinks that it's, I think you could. Is there some way to do that? Yes, I think it becomes more difficult. Well, it all depends on how you're getting those sequence numbers. If you're getting it because you're e-straping the conversation, then yeah, you can do that, right. But if it's because you can guess one way is sequence number, you may not be able to guess the other way. So you're never gonna be able to act like you came from the other direction. But yeah, it's possible, it just makes it more difficult in a sense. But it's kind of funny to think about this act storm where you cause this like weird confusion. And so yeah, so anytime they try to send data, they're gonna have this problem. And it's just gonna go into a package problem. And so yeah, so yeah, we could do this as an attacker by, if we're actually man in the middle lane, we can change the sequence numbers as they come across us, right. So that we maintain this fiction that one side thinks it's on 10, the other side thinks it's on 20, and we just change that as it comes back and forth. Or like Eric said, we could fix this by telling one side, oh, that's totally fine. Like don't worry about it. So we can see this, right. So we have the client and the server here. So we're our attacker. So they've already established a connection, right. But it's a quiet connection, nothing's happening. So we're gonna send a TCP packet with sequence number, whatever the client's current sequence number is, with 30 bytes of data. And so then they're gonna act back with that, the sequence number plus 30, and they're gonna act back, hey, I've actually only sent up to sequence number, right, and this key's happening until packets are dropped. And so we can actually use this, like kind of like Eric was alluding to, right. We can use this, not just on one way of the conversation, but we use it on both ways. So that way we can hijack the entire conversation to do what we want. Or, and I think actually somebody mentioned this, right. We could actually try to reset both packets and then make a new connection between them, right, coming through us. Or we could basically impersonate both sides of the connection here, which is very cool. So we can actually see an act storm in action. So here we see two hosts that are DC grant us. We have .10 and .20 to port 23. And so we can see that, let's see. Here's, okay, here's 101, 15, 112, and it's acknowledging that it's received up to that. So that with 21 bytes. So it's expecting 101, 515, 33.10 response back. Actually, I've only sent you up to 112, right. So this first packet is 21 bytes of injected HTTP, I'm sorry, HTTP, injected TCP traffic. And so this continues where they go, no, no, I've seen up to 23, like well, I've sent up to 112 and it just keeps going until finally somebody stops and then it doesn't become a problem anymore. Okay, questions on this? Yeah. Doesn't the act storm extend the attacker's window to as long as he wants until something breaks? He can go on talking to the seller, I mean. Yes, absolutely. So yeah, the part of this, right, so all this relies on is being able to get that sequence number, right. If you can guess the client's sequence number, you can inject data. And once you've done that, now you own that connection, right, and they can never send any data to each other. So you're going to keep sending data, exactly. I don't know if I'd say it elongates the window, but yeah, in a sense, basically as soon as you've done this desync, it's fine for the rest of like, you can continually inject data into the street. When and how does the client and server decide they don't drop the packet? They don't actually decide, it's just, and yeah, at some point the router will get overflowed over, not overrun, but there'll be too much in the router or the link level or something, or there'll be something else going on and it'll just stop. I mean, otherwise it'll just continue. Should be bad, yeah. So does this mean that even if this, because these things are still processes that might be able to do the same demo? Oh yeah, it will process all these packets, right, and respond to them, but it can't actually send any more data because it thinks they're different. Acknowledgment and sequence numbers. It'll try to send out new packets, but when it does, it'll be sending like, no, no, no, I'm expecting different bytes and so they'll be desynced like this. Okay, let's look very briefly before we quick today. I wanna talk about some denial of service attacks in the TCP level and then we'll be able to wrap this up. So a SYN flooding attack is a very common and, or it used to be, I think, more common, but it's a way to do a denial of service attack against the TCP implementation. So what happens, so you're a server, right? You get a SYN packet that comes in. So what do you have to do? What do you reply with first? This is a SYN act and then what are you waiting for? An act back, right? So as the server, where does that state of this maybe half open socket live, right? Because that takes some memory, right? Because you need to remember, okay, on this IP, this port, I got a connection on this port from the four-tubble, right? Source IP, source port, destination IP, destination port. I got a SYN and I sent back a SYN back, a SYN act back and what else do you have to store? You have to store that for, right? You need to know who it is. The sequence number? The sequence number, yeah, you have to send that sequence number that you sent so you know when you get it back if it was the right response. But, so, if we think about it from the attacker's perspective, so the attacker can send one packet, right? How much, when the attacker sends a SYN packet, how much memory do they have to create? They don't have to store anything, right? They can just send a SYN. They wait for that response back, right? But in the meantime, the server doesn't matter. Omega, right, Omega isn't clearly too much, but we've caused the server to generate some memory when we have to generate none for ourselves. All right, so this is what a SYN flooding attack is. You just flood with SYN packets to the server and for each of those SYN packets, the server creates, you know, stores some memory in the kernel in the TCP IP stack, right? And then at some point, and so they respond with a SYN act and we just never say anything, right? We don't close that because what in the TCP stack sends how long they should wait for the act to a SYN act. It says all of a sudden, like I should send a SYN and then you send a SYN act and then I send an act back, right? But the fact of what that timeout is in between, right? How long do you stay waiting? Because it could be the network is busy, right? So for this attack, we overload the memory of the server and cause it to crash just by sending SYN packet. So can we spoof the idea in the SYN? We don't care about those response packets so we can make them come from anywhere, right? Which makes this attack even more tricky. And even if we can't cause it to crash, right? What happens if the TCP IP stack can't allocate any more of these connections, these SYN SYN act? What happens when somebody else tries to connect? Yeah, it'll drop, right? It can't, it can't, if it has a limit and then it's gonna say I can't open this, I'm out of memory or whatever. And so in this way we can cause it to not have a service so that nobody else can talk to this machine, right? So now we're taking this machine off the network. So there's a couple different ways to deal with this. One way is like filtering. So we can try to somehow filter these either by the source IP. Sometimes the source IP will be constant so it's trivial to filter. We can use more memory, right? We can just say increase the length here. We can reduce the timeout, right? And say that, okay, let's time out our connections. We can cause like a, some sort of queuing system for our half open connections. So when we get new ones and we're at a limit we can drop old ones out, right? So we have this, so they're not staying open for a long time. We can limit half open connections coming from a certain, you know, we can put per IP, source IP limits. The other one we can do is we can use SYN cookies, which are actually super cool, which we're gonna go over very briefly. So the idea of a SYN cookie is instead of me allocating memory on the server about what connection was, what the sequence number was, I can actually code that information in the sequence number that I send to you. So that way when I did it back, I can verify that this actually came from me at an earlier time and it's a valid sequence number. So it's really cool. So the idea is, and we won't go into the details, but the idea is we're gonna have a counter that increases, right, that's gonna change so we'll get different sequence numbers here. And then we're gonna encode the, the specifics aren't really important. But the idea is we're gonna use a hash of our counter and the source destination IP addresses and ports, right? So this is the four top, right? The source IP, source port, destination IP, destination port, we're gonna use that in the sequence number along with this counter so that that way when we get an ACK back, right? We don't know anything about this connection, right? We have not stored any state about this SYN SYN ACK. But I can use this sequence number, I can use the source IP, the source port, the destination IP, the destination port, plus this counter T, which is random and the, or random in that the attacker can't guess it, right? I can use that, I can hash all these to see if this actually came from me at an earlier time without knowing or storing any state. So if you enable this, you send back a SYN ACK as if you made a new connection, right? You don't actually make any new connection. You don't actually store any new state on your server. So when you receive an ACK, right? That's to start a new connection. You check that function and you see, hey, did this come from me? Is this from one of the Ts that I originally used this counter? Then it rebuilds this, rebuilds the original SYN packet from that, but, well, that's, I don't really think. Yeah, so it's kind of, it can be a pain. I think some websites actually do use this. It's a setting that you can enable in like your kernel. But it goes to kind of a general class of like state attacks, right? So if it can be the case, so if to cause you, your kernel to store one megabyte of memory, if it costs me a megabyte of memory, it's not really a denial of service attack, right? Because you have to have as much memory as me, which maybe in a distributed botnet setting is a problem, but in this case for like Amazon or big company, right? They can buy a lot of memory. But if it takes zero memory for you to cause me to store one meg, now that's where you have that leverage, right? Where you can just force me to create and allocate all this memory and then run out of memory. So this is what, there's a bunch of other denial of service types of attacks that take advantage of this. So they can do, you know, they can do the SYN SYN act and then not say anything, right? And just have these dummy connections that just store state in the kernel. They can try to overload the process, like how the process limit or the thread limit of your operating system or of your web server. They can send you, yeah, so this is a tricky one. So if you, right, so if they are sending you data, but you're not acknowledging it, they have to still buffer that data in case they have to retransmit it to you. So I can make your kernel store a lot more data that it's normally used to by never acknowledging all the data that it sends and continually making these connections. So I drop all the data on the floor, but you still have to keep it in your buffer listening. So there's a lot of these kinds of attacks. So network insecurity, because I really don't want to do this today. So the idea is, right, the network is important because this is how we get into the computers, right? I mean, the nodes, the systems are talking to each other, right? This is how, as an attacker, we're able to influence and get into the systems on the computer. And I think it's really important. One of the things I've tried to harp on, I really want you to get to think about is to understand what's trusted and what's not trusted, right? So by studying the IP stack, we saw, hey, the source IP isn't validated or trusted, you know, is not validated by anyone. So anyone should send an IP packet with a source of anybody else's IP address, right? So we can't trust that because an attacker can control that, right? And that's kind of one of the key ideas here. By looking at networking, you can see what an impact that has this really small thing in this networking protocol, how big of an impact that has for security. We saw how we can, we're building up, building blocks to attacks, right? So we looked at snipping, like how we can see things on the network, spoofing, how we can pretend to be other people, hijacking, taking advantage of a connection. We saw some denial of service attacks, right? So we can, which are attacks in their own right and also help us do some of these other attacks, right? So these denial of service attacks are important because we can leverage them to do other types of attack. We saw we could probably brute force some of the sequence numbers pretty easily if it's not very randomly generated. And then we looked at some tools and we talked about some countermeasures, so. Thanks for being patient today, I appreciate that.


As a result of the shooting in Allen, June 30th, which resulted in the death of three officers, the Foley County Sheriff's Department also lost several cruisers and much of their equipment. Surrounding counties and state agencies immediately stepped in to aid the department and keep residents safe. Immediately what happened was the night that Thursday night, the Association of Police Chiefs, Association of the Kentucky Sheriff's Association, they pretty much took over our work schedules and they provided manpower from agencies and sheriff's offices across the Commonwealth to fill in. Now, immediately we had neighboring counties, Pike County, Knot County, the Knot County Sheriff reached out. Johnson County Sheriff came on the scene, Knot County Sheriff came on the scene and they brought their deputies with them and they started doing the role of me of what I normally would be doing. Their deputies started doing the roles of what our deputies were doing. So the people in Floyd County were never unprotected even though tragedy had hit us hard. There was ongoing law enforcement, it never quit and it has not quit even up to this day and it never will. It's all in our hands, this life of time that's given to us all. It is all in our hands, it is all in our hands. Experienced heart specialist and subspecialist collaborating for the benefit of your care. Top 10% national hospital rankings for patient safety and heart attack and heart failure treatment. The technology is skilled to perform extraordinary complex, minimally invasive cardiac, electrophysiology, interventional and structural heart surgeries. This is a heart and vascular institute at Pikeville Medical Center. It is all in our hands, it is all in our hands. When it comes to your heart, place your care in our hands. It is all in our hands, it is all in our hands. The department has also received an outpouring of support, not only from the community and the state, but the entire country. The greatest support of all is their love and they have been tremendous this country has. Not just Eastern Kentucky or not just Floyd County people, but man this country has reached out to our guys and to our community and offered their support and their uplifting, their love, their prayers, their thoughts, their comments. Just everything said and that goes a long way with the families of a loved one to know that they were honored and respected as much as they were and for the ones who were injured and even not injured, but just involved. They need to hear that, they need to hear that the community is behind them and we hear and see so much negativity toward police across the nation but thank God here in Eastern Kentucky we don't experience that. We have a lot of love for our first responders, our police, our fire and it's shown here that even across the country they do. Floyd County Crisis Fund is accepting donations which will be used to help officers and their families as well as the affected departments. To donate, go to Appalachianky.org. For Mountain Top News, I'm Brianna Robinson.


Hello students, I am Ganesh Biyaglavi working as an assistant professor in department of mechanical engineering, Walsh and Institute of Technology, Salafor. In this third session, we will see infinitely long fin. So, the learning outcome is at the end of this session students will be able to derive equation for infinitely long fin, general heat conduction equation for rectangular fin. Now, there are three cases of fins, first one is infinitely long fin. So, case first infinitely long fin, suppose this is the base of the fin, we are going to use the same notations, so this is the fin. The base temperature of the fin is T naught, the surrounding fluid temperature is T infinity. The length of fin is infinity, as we know the general heat conduction equation that is theta is equal to c 1 e raise to m x plus c 2 e raise to minus m x. In the last session, we have derived this general heat conduction equation. Now, for infinitely long fin, the boundary conditions, first boundary condition is at x is equal to 0, at x is equal to 0 theta is equal to theta naught. And second boundary condition at x is equal to infinity, now why this theta is equal to 0, for infinite long fin, the end temperature would become equal to surrounding temperature, so T infinity minus T infinity will become 0. Now, using first boundary condition, so we require to substitute these values in the general heat conduction equation, at x is equal to 0 theta is equal to theta 0. So, this becomes theta 0 is equal to c 1 e raise to 0 plus c 2 e raise to 0, so this becomes theta 0 is equal to c 1 plus c 2. Now, we will try to find the constant values. Using second boundary condition at x is equal to infinity, theta becomes 0, so I can write 0 is equal to c 1 e raise to m infinity plus c 2 e raise to minus m infinity, this is 0, this is 0. Now, here this cannot become 0, so c 1 will become 0, c 1 is the constant. If I substitute now c 1 is equal to 0 in the equation second, I will get theta naught is equal to c 2. Now these are the equations of constant c 1 and c 2, substituting these in equation number 1, if I substitute these constants in the first equation, then theta will become equal to c 2 is theta naught e raise to minus m x. I can take the ratio of theta that is theta by theta naught is equal to e raise to minus m x, which is nothing but t minus t infinity, this theta is nothing but t minus t infinity divided by theta naught is a t naught minus t infinity. This becomes temperature distribution equation, this is known as temperature distribution equation, means what? At any known length at any known length of the x at any x, suppose x 1, x 2 etcetera, we can find the unknown temperature at that location as t naught t infinity are easily measurable. Now after this for the same case, we will try to derive the rate of heat transfer rate of heat transfer. Here we can use the Fourier's law of heat conduction that is q is equal to minus k a d theta by d x, as we know in the fin heat enters from the base from the base, that is why this temperature gradient should be at x is equal to 0. Now here as we derived as we derived equation third, so I can differentiate equation third with respect to d x at x is equal to 0. So, this becomes equal to theta naught minus m e raise to 0 is 1, so this becomes equal to minus m theta naught. I can substitute now the equation for d theta by d x at x is equal to 0 in this equation. So, q will be equal to minus k a minus m theta naught minus minus plus, so this is k a into m into theta naught. Now please recall the m equation as we know m is nothing but square root of h p by k a into theta naught. This I can write as 2 times k a into k a into square root of h p by k a into theta naught. So, the one will get cancelled and this q will become equal to I can rearrange and can write h p k into a into theta naught, which is also equal to h p k a theta naught is, so it is theta naught minus t infinity. So, this becomes rate of heat transfer for infinitely long fin. Here I will introduce one new term known as efficiency of fin, which is equal to rate of heat transfer from the fin to the maximum possible heat transfer. Now this q max q max is nothing but h a theta h a theta naught, why? So, maximum possible heat transfer would be in the case in which the fin temperature would be at t naught. So, the rate of heat transfer would be by means of the convection from the fin surface to the surrounding that is why this becomes q convection becomes h a theta naught. So, this is h a theta naught and this q is as it is derived in this equation. So, I can write now the rate of heat transfer from actual q to the q max.  So, this will be the fin efficiency. We can substitute this equation here and we can find the efficiency of fin. For further reference, you can have fundamentals of heat transfer, heat and mass transfer by Incoropera David. Thank you.


When the narcissist sells you a dream, the narcissist will give you what if scenarios? They will give you false hope They will paint a detailed picture of the future for you This is how they keep you under their control because they give you these false promises That things are going to get better They will tell you whatever they think you want to hear Because you've already told them what you want and need You've already told them what you're looking for So it's easy for them to present this image of the future to you and then they will use it to pretend As though they're really about it as though they want the same thing as you But they're just using it to prevent you from leaving them It doesn't mean that they're really going to go forward with it The future faking was a part of the love bombing when they first targeted you and Then they use it throughout the relationship to keep you stuck To keep you holding on for something better or greater To keep you thinking that maybe one day things will change They will tell you that they're going to do something They will tell you that they have all these plans for the future They just need time But they never take the steps to make it a reality Which is how you may waste years of your life for something to happen Because you don't realize it's all fake and even if you try to leave They will just use the future faking again They will make you think you're throwing away your future They will make you think you're the one who is giving up And then they will tell you they're going to give your future to someone else Someone who will stand by them Someone who would do anything for them Someone who's not going to give up They're good at using that imagination To give you a vision of the future So even if you leave It will make you come back It will make you wait for this possible future Until you realize nothing has changed Because they're just saying they're going to do something for you in the future So that they can get what they want now Which is very damaging to you It's very hurtful And it's humiliating Because you're being taken for a fool They're deceiving you about their true intentions But it's not hard for them to make you believe it Because it's something you want to believe You want to believe they're good people You want to believe they care about you But if you didn't believe it It wouldn't work They already know what you want to hear Because you've already told them And sometimes they may actually mean what they're saying to you Because whatever they feel becomes the truth Which means the truth can change depending on their feelings But their feelings can change from one moment to the next So the truth can change at any moment Their false promises can change They can't keep their promises Because they're a different person from one day to the next All the narcissist really cares about Is what they can get from you And they will agree to anything If it means that they can get something from you in that moment They may not think about the consequences of that agreement Or whether or not they actually want to do it But they will go along with it If it means they can get what they want So it doesn't really matter if they're lying or not If it's not going to happen now It's never going to happen Because they will change their mind at any moment There is no future with a narcissist There's only the same problems and lies That never get resolved Narcissists are good at selling people a dream They're good at future faking Because they're fake people They're used to deceiving people And they do it just to make themselves feel important Just to make themselves feel like they're worth something The false promises they give to you Are not really for you They're for the narcissist So that they can get what they want from you Or because it makes them feel good They don't want the responsibility of keeping these promises And they haven't even thought about how they're going to make it a reality They just say it because it makes them feel good It makes them feel important So despite all of the abuse Despite all of the problems and difficulties that you went through There is nothing in the future The narcissist just wanted you to believe that there was So that they could get what they want Thank you for watching I hope this video resonated with you Please like, comment, share and subscribe If you would like to donate My PayPal link is in the video description Coaching inquiries You can email me at coachinganarchsurvivor.uk Thank you for watching and I'll talk to you soon


Russia sends BMP-3s to Ukraine for winter fighting. Kergan-Mashzavod, part of high-precision systems holding company within the state tech corporation Rostec of Russia, has delivered a new batch of BMP-3 infantry fighting vehicles to Russian troops, the company's press office announced. Kergan-Mashzavod sent a new batch of BMP-3s to the Russian Defence Ministry in late October under the Defence Procurement Plan. The enterprise monthly delivers the required amount of infantry fighting vehicles, consistently ramping up output, the press office said in a statement. BMP-3 infantry fighting vehicles are well suited for operation in low temperatures, which is important considering the approaching winter. The vehicles are easy to get started in any weather, including in temperatures of minus 40 degrees Celsius, it said. The vehicle has proven its worth. The new batch is going to the troops. The enterprise is successfully fulfilling the Defence Procurement Plan. I want to thank the entire enterprise for that, the press office quoted Chief of the Defence Ministry's main automotive and armour department, Alexander Shestakov, has said. The BMP-3 infantry combat vehicle was developed by the Special Engineering Design Bureau in the second half of the 1980s and is produced by Kergan-Mashzavod. The vehicle can carry a crew of three and seven assault personnel. The amphibious vehicle features a 100-millimeter gun capable of firing missiles and three 7.62-millimeter machine guns. The BMP-3 weighs 18.7 metric tons and can accelerate to 70 kilometers an hour on the road. The combat vehicle has been operational in the Russian army since 1987.


Thank you. As said, I'm really passionate about accessibility and search and I'm not talking about either of those. Little more about me, like why are you here? Why are you listening to me? I grew up in Ohio, which was really boring. So I went someplace totally different, which was Illinois. And I got my computer science degree from the University of Illinois. And then I was like, man, this is still actually really boring. So I ran away and joined the Peace Corps and taught people how to use computers in Cameroon with the Peace Corps for two and a half years. And then I came back and I joined Eventbrite, where I'm a senior software engineer. But none of that actually matters.  Why I know something about not knowing anything is because at each of those points I didn't know anything. So why should you learn? Why is it important? To which you say, what sort of programmer are you, Allison? Don't you know that our field is always changing and there's so many cool things you can do? It's like, yeah, yeah, yeah. But why does your company want you to learn? You always want to, but maybe you're doing that at night secretly. But this is why you should be doing it on company time. First of all, there's the bus factor. If you haven't heard of it, it's the rather morbid term for how many people can get hit by a bus and have your company still function. It's also the term unicorns, which are, they're very rare people who do exactly what your company needs to happen. They're called unicorns because they're almost impossible to find. So I say you should start as a horse, like start working on growing your horn. So this is kind of my history of when I've learned different things. In school I did Java and C++ and Visual Basic and MIPS. And since then I've used none of those. Surprise, surprise. I don't use OCaml at Eventbrite. My first job, I started learning HTML and CSS and C-Sharp and I have not used C-Sharp since then. And then at Eventbrite I started with JavaScript and Python and surprise, you actually need more than just those things to do your job. So you start learning a couple other things. I started working on our search team and learned solar. And then really you need also some Cassandra and some Redis and you pick them up one by one. But it's not just the technologies, it's not just the languages. It's also all the other tools you need to do your job. It's Vagrant, it's Docker, it's your text editor. All these other things take time to learn and you can't just do it instantaneously. I also think learning at a company is actually really awesome. So for one, you have people to talk to. There's probably somebody there who knows what you're trying to learn. And it makes a lot of sense to be able to go and talk to them. Instead of finding somebody randomly online, like be on IRC and be like, are they going to hate me if I ask them this really beginner question? There's also a framework already in place. It might be great, it might be bad, but the last time I did a side project I took three days setting up my environment and all the technologies I needed. So now I was knowing how to do all those things. So just skipping past all of that, land in an environment that's already set up, it's really useful. You can figure out the other things later. You're doing something that's useful. If your company's successful or if you're not, then you're trying to make them successful. It's something that's a product that's going to get used. It's probably live. And probably the most important thing, you can't give up. If you're working on something as your side project, you can't, you can just be like, oh, I have these other things to do. I guess I won't work on it today. If you're making something for your company, you have to continue making it.  I guess I'll stop working on this now. So how do you do it? And I guess in the schedule, the title of this was actually how I learned Jango at Eventbrite. And the talk is actually more about how anyone learns anything at any company. But this is kind of my strategy of how I did it. And there's definitely lots of different ways. People might have different strategies, but hopefully it's useful for someone. So what I always have to do, and I always have to remind myself to do, is do one thing at a time. That giant list of things to learn, don't try to do them all at once. Do one of them. But similarly, if you know Jango really, really well, and you keep getting projects at work that are doing Jango over and over, maybe expand your horizons. Maybe try and work on something where you don't know anything. Really try and work on something where you're learning one new thing. But you can talk to your manager. You can talk to different people and say, do you need help on that? Do you need help with your Go project? Do you need help integrating Postgres into Jango? And you can learn new things that way. I'm not sure if anyone in here is a manager, or a tech lead, or a senior engineer, or really anyone who is making schedules and telling other people what they should be doing. This is actually your job. Ideally, people are going to be coming and saying, I would love to learn more about JavaScript. But they might be quiet. So if you're telling them what they should be working on, maybe see what they're interested in. Try to introduce them new projects. Maybe there's a perfect bug that's a great introduction to something new. And it needs to get done. And only one person knows how to do it. Don't give it to that one person. Give it to somebody else. So when I was in the Peace Corps, my title was teacher. I had classrooms of 80 students, which is not efficient at all. But we did a lot of classes on pedagogy and how to teach and how to learn. And there's a lot of different strategies. But a lot of people talk about visual, auditory, and kinesthetic, which isn't actually true, but humans love categorizing. So we're going to go with it. And you might recognize one of these is how you learn. You might say, oh, yeah, I'm definitely an auditory learner. I can stare at something for days and have no idea. But if you're a visual learner, some different ways that are really good to learn are pair programming. Maybe it's as an observer. You should also participate as well, but figuring out how somebody else is doing it. You could read books. You could read the documentation. You can read source code. Something I've noticed that more junior engineers have trouble with is diving into the source code, because it seems complicated. But that's one of the best ways to figure out what's going on. Especially if there's some behind-the-scenes magic. You could Google it. You could ask around. But the fastest way and the best way is probably to go and look at the source code. You can also watch seminars online. There's Udemy and Cotton Academy in so many different awesome ways. So I have stacks of textbooks. They're fantastic. They hold up my desk. I read them very rarely. I think once my internet went down, and I was actually trying to do something with an A-star algorithm, so I looked it up, but that was really weird. My roommate on the other hand will order basically a new textbook once a month and actually read it. I don't know how he does it, but that's not me. Auditory learners. They come to conferences. They do online classes. Most importantly, talk to people, ask questions. And kinesthetic learners. If you don't remember hearing about auditory visual kinesthetic, kinesthetic means touching things, like actually physically doing things with your hands. So if you're a kinesthetic learner, which is most people, hack on projects. Maybe follow some tutorials online. The things that I always do are post-it notes and whiteboarding. We have some giant whiteboards on our walls that I'll take over and scrawl all over them. It's kind of frustrating actually when I'm working with people in our Nashville office and they'll be like, wait, what's in that corner? The light's not hitting it. I also used to have two monitors, and my second monitor was only used as a place to put post-it notes, which really annoyed my coworkers, so they got me a whiteboard for behind my desk. But the most important thing to note here is that no one is only using one. Everyone needs a bit of all of these things. So start with what works best for you. Maybe start on that tutorial. And if you get stuck, maybe go and talk to somebody. So some tips for working with other people. The two dogs here, the brown one's my dog, the black one is Cleo. They're best frenemies. Sometimes they will curl up and sometimes they'll attack each other. Kind of who knows. We have to coordinate who comes into work. But they're kind of representative. So the best way is to find somebody who style compliments yours. Somebody who you're comfortable asking questions to. But maybe that person doesn't know everything. And so maybe there's that one person in the corner who you think is going to bite your head off if you talk to them. So how you go to that person? Because odds are they're actually not as scary as you think. Some really great ways are to schedule time on their calendar. Don't come and interrupt them in the middle of a problem. But be like, hey, I'm trying to figure this thing out. Can I talk to you at 3 o'clock? Because I see you don't have anything else to do with it. Don't say it like that. They probably have things to do. You can also talk about what you figured out on your own. If you come to them and you say, hey, what's a model in Django? They might be kind of annoyed. They shouldn't be. Everyone should be nice and ponies and blissful. But if you come to them and say, hey, I read the documentation about what a model does, and this is my problem right here. So I'm trying to figure out the best way to implement pass codes on the model. Do you think it would be better this way or this way? And it gives them a lot better foundation of how to help you and where to go. And there shouldn't be any resentment there. Another cool thing to do is if they're one of those people who, let's say they're the only one who knows anything about your payment system. And so therefore nobody wants to bother them. And they're always busy fixing bugs on the payment system. You can go and talk to them and say, hey, I see you're really busy. I see there's this bug. I could fix this bug. Could you help me? And then there's no way that they can really say, no, I don't wanna do that because you're helping them. So what should you work on? So yeah, it's your job. Sometimes you have things given to you. And sometimes you might want to work on something different. You might wanna learn something new. But the best things to do are to figure out what's really important and then talk to your manager and be like, hey, can I work on this thing for a while? And so those things that you could be working on are what's important to your company? It's a really easy sell to be like, hey, I really need to learn Elasticsearch because our search needs to get better and no one else knows how to do it. So can I work on it? They're a lot more likely to say yes than if you're like, hey, Elasticsearch is really interesting to me and I'm working on it on my side project and I'm starting a startup and hey, can I just like take a couple days to learn it? Which they're more likely to say no to. And another thing is what do people complain about? Are the admin tools really bad? Are the SQL queries really, really slow? Maybe you don't know anything about SQL but you know that every day your admin is complaining about this one query and it's really slow and everyone's way too busy and everyone's avoiding it. And it might be because there's tricky things that you don't know about but whatever, jump in. Take that query and say I wanna make this better and you'll make a lot of people happy and people will also be really willing to jump in and help you because it's something that's a pain point for a lot of people. So you have all these things you wanna learn. How do you do it? You have your job. How are you still being productive while you're doing it? Something that's really important is to time box. Don't spend a week reading a textbook about something. It might turn out that your textbook is about Cassandra and then you're like, oh wait, Redis would be better. And then all of your time is not wasted. Now you know about Cassandra but not relevant. You're not being productive. So give yourself some time. One of my favorite rules that somebody gave me early on is that if you work on something for an hour and you haven't gotten anywhere, then you should go and talk to somebody. You should try and tackle it first yourself because it helps you learn better but anything longer than an hour, go and get help. Prioritization is really important. Maybe Elasticsearch is more interesting to you but for your company making that SQL query faster is much more important. Prioritization is a really hard problem. It's not gonna be solved in one bullet point but try and think about it when you're working on different things. What's most important? You should be doing that. You should not be turning videos of your dog into gifts during work. I would never do that. Another trick that doesn't really fit into time management but that has really helped me is to leave comments in the code when you take a break. So it often takes me a long time to contact Switch. I'm working on some code.  You can be like, yeah, it's really nice outside. Let's go outside.  And then it takes you a really long time to figure it out. Or you might even have a file open. You're like, where in this file was I? So I always leave comments. And sometimes they're inane. Sometimes it's like I was turning the color of this line from blue to red. And you're like, no, I'll remember that. Pro tip, you won't. After you've learned everything, after you know everything in the world, as you're going to in the next month, how do you remember it? Write it down. So I'm constantly taking notes. And you can also be writing documentation. You could be writing bug reports. Maybe you are just getting your dev environment set up and it's taking you a really long time. And you think it's because you have no idea how Docker works.  You're like, wait, I just spent so long trying to redownload it and it's just failing. That's probably because the documentation's wrong. And so either you should go and fix it or you could write a bug report. Maybe there's actually an error somewhere that should get fixed. For lists, I basically always have at least two lists going on. One is what I've already learned. So as I'm going through the week, I really like to be like, today I did, I figured out how to turn videos into gifs. It was great. And then you'll be able to figure out in a week or two when you need to turn more videos of your dog into gifs, how to do it. You don't have to go through the same process of Googling because it's really easy to forget. You do something one time and you're like, I'm done. And then you need it again in a week. Something that I actually did when I joined Eventbrite is I had this secret Google doc where I wrote tips. I was like, this is how I run the server. This is how I index search. And I thought this was really embarrassing that I couldn't remember how to run the server or get my development environment up. So I didn't tell anyone about it and I had the secret document. And then I realized a couple months later that everyone has these secret documents. Ideally it would be shared. Or maybe it's just a reminder that it's not that embarrassing. Not every company has their dev environment set up the same way. So just because you don't remember RS, I know it's only two keystrokes. If you forget it, it's fine. Maybe that's not how you did it before. So it's great documentation for the next people. That secret document of mine helped when somebody else knew joined. Because they'd be like, wait, how do I get the server up? How do I make it stop threading? You'd be like, oh wait, I remember all these things because I have this not secret document anymore. I'm sharing it with all of you. It's documentation. It's also really great to be able to say, hey, look at all these things I've learned. Especially if you're in the process of learning lots of new things, it's really easy to get frustrated. You might be like, I've done nothing this week. I have all these tickets. I've accomplished nothing. But if you look at your list, you could say, oh, I figured out how to make SQL queries faster. And I figured out how to write in Cassandra. And I've done this tutorial and I've read this textbook. So yes, you still need to be closing tickets, but it's really good to be reflective and say, what have you done? What do you know now? And also to communicate that with people. It depends on how your company's structure is set up, but if the main record of progress is like how many tickets you've closed and you've been spending all your time learning, maybe your manager doesn't know what you've been doing. So communicate that to them. Say, hey, these are the things I've done. Look how awesome I am. It's also really great because when you're in that cycle of learning and figuring things out, you probably have your confidence being lowered. You'd be like, I don't know anything. Your imposter syndrome is gonna be hitting pretty hard if you have it. But when you look back, you can be like, oh, no, I definitely know Django. I have that going. Just because I don't know how to write go, that's fine. I know this other thing. My second list is what you wanna learn. So when you're trying to figuring things out, it's really easy to go down that rabbit hole. To go down that spiral and say, there's so many cool things here. I was reading this tutorial and it said how I could do multi-threading and I said how I could do like, make a chat program in line. You're like, I'm really gonna follow that. And it's like, oh wait, no. Like I really just need to be figuring out how to put words on the screen. But you do wanna do this eventually. So put that down as something you wanna do later. Let's say you're figuring out how to write SQL queries. And you're reading some Stack Overflow answer and it has a link. It says, yeah, that's a good enough solution. But if you wanna make it 100 times faster, you should do it this way. Then maybe you really wanna click on it and be like, ooh, how do I go down that rabbit hole? But you should probably put it aside. If it's not immediately relevant, I would put it on the second list. And be like, hey, this is what I need to go and do later. Generally I figure out how to go back to those when I have that problem again. Maybe I need to make a SQL query faster. It's like, oh yeah, that other time I needed to learn it too. So it's probably something that's really valuable and not just a trendy new topic. I also know that if I don't write it down, I'll get really angry at myself for not following it immediately. So it's kind of like a no, I've acknowledged it, it's there, I don't need to do it right now. I'll do it someday. And the best way to learn is actually to teach. So people often will think, I just learned this. I am not a good person to teach it. The people who are best to teach are the experts, the people who've been doing it forever. And that's a blatant lie. The people who are best at teaching, new people, is the people who have just learned it. And a lot of that is they just went through it. They remember what was frustrating. They remember what was hard. There's also the pro that sometimes that all the setup stuff around teaching is the complicated thing. And somebody who's dev environment has been set up for months is not going to remember. So there's lots of things that I've talked about. You should figure out what works for you. There's lots of different things. You should take the time to learn. It's really important. No one should ever be able to say, don't do that. Especially if it's not a priority for your company. I've been really fortunate that Eventbrite has been really flexible.  Have fun. Which I don't think is actually normal. But there's all these tricks that you can do. You can say, hey, this has been really hard for people. There's this one person who's the only one who knows this. And so if he got hit by a bus, it would be out of luck. But if I learned it, then I'd be able to help them. But most importantly, again, is to have fun with it. Learning should be fun. It's one of my favorite things about computer science is there's lots of different things. You could be doing anything. So don't get too caught up with frustration or by saying, I don't know anything to have fun. And that's it. This is kind of what's worked for me and what's worked for people who I've talked to. But if you have any other tricks, I wanna know them. I wanna add them. I wanna help people. So tell me, please. That's it. What was your first project at Eventbrite? Or your first Django project? Yeah, my first Django project was actually making our teams feature. And it was really interesting because I had been a front-end engineer and I was really good at JavaScript and CSS and they were like, ooh, we have to start this project. You're being paired with a senior engineer who knows everything about Django. So you'll do the front-end and he'll do the back-end. Like, cool, no problem. And then there were some critical bugs that he had to go and fix and I had nowhere to start. So he's like, hey, how about you just set up the models for this? It's like models, what does that mean? He sent me a document and I started writing them and he would review all my code but he was actually very busy on other things and I ended up writing most of that project. So that was really useful. Did it go into production? It did. It is live. It is used by Tough Mudder, which is one of our biggest clients. So if you've ever signed up for Tough Mudder, you've used my code. Also, do you have any advice for... This is more like a... Let's say that you're in a situation where your job isn't so flexible and besides get another job. But I mean, how you navigate that, like if you wanna work on something else and maybe your manager's not really amenable to that and you could always get another job. I've been in this position and I got another job. Yeah. But what's your advice there? Cause that could be tough. Right, it definitely can be tough and I don't wanna be like quit, like you said, but there's different things that you can do. You can try and talk to another team. If there's, maybe there's another team doing something that's really interesting to you and you can be like, hey, can I work with you? And maybe your structure, your direct manager probably wouldn't like that too much, but maybe it'd be okay to switch teams and do something more interesting and get a manager who's more flexible or just try and say, okay, there's this project we need to work on. Can I do this part of it? And just kind of like slowly shift. So something that I had initially done when I was really interested in search is I was doing the front end and I was like, oh, maybe I can just add this new field to the database and they're like, no, no, we're busy. And then they're like, wait, we're busy. So yeah, you should do that, go and do it. And so I did and it was great, but I just kind of had to poke at it for a long time.  Like, yes, it's yours now and threw it all on me. So some of it's like a slow progression and sometimes it's dumped on you and it's great. You mentioned that you had like your own secret notes file and then you discovered everybody had their own secret notes file. What's been your experience with having sort of like a company wiki or a team wiki just to collect all this knowledge as have you had like one person sort of in charge of that or is it just left up for everyone to sort of organize or does nobody actually contribute and it's just an empty wiki. Just what's been your experience? So we have engineering documentation and it's fantastic.  It would send this giant like blaring email to all of engineering being like the build failed, like the build failed. And so people were really intimidated and for some reason didn't want to modify the docs. So I think one of the best things we did there was actually just add a little edit link so you could directly edit it and then we removed that really horrible email and so it became a lot easier for people to go in and change it. In the past life, I used an IDE called Eclipse, you might have heard of it. It has one killer feature and anywhere you type in to do in all caps, the string that follows it is a caption and put into a list and another pane buried somewhere in the app.  I wonder is there anything like that that you've run into for Python? Cause it seems that that seems like that's, I would use that exactly for the situation of, okay, I'm walking away, I need to write a note. Yeah, that's one amazing and I don't do things that complex with my to-do, it's more like, this is the last thought I had, I'm shoving it in right there but I also use notes embarrassingly enough where I keep a lot of my lists. So that's kind of the equivalent, I'm not sure does anyone else have an answer to this that I could also benefit from? Okay, so you search, do like a global search for all your to-dos, okay. So your answer there is Sublime has a plug-in. Does PyCharm have anything? PyCharm looks for to-dos too. Thank you, any other questions? Any other questions? Thank you, Alison. Okay, thank you.


start today's video off early 5.39 in the cave. I've been out here since 4.30 rigging up some stuff putting on fresh monofilament on the Twitch so we can do some toppy tops. I have not been out early morning on the water since top water started to get good. I want to see what's going on out there on the lake. Just first couple hours of the day and I am hoping that's some white bass erupt. Anyway, that's a long explanation. Let's do a quick check and check. Just getting my little bowl of cereal here. A little fruity bowl of cereal in in the cave. I already had my morning juice right there. Arrows are drying that I've stained over there. You know this is just what we get going on here folks. Chicks are growing by the minute. Growing by the minute. Isn't that right? Isn't that right little buddy? Little blue beller? By far the sweetest the sweetest chicks. These these little frizzle chickens man. They will actually let you usually yeah I'll let you pet them. This australorp here this black australorp he's for australop. She I should say pretty friendly as well. The the blue eggers not so much and little polish buddy he's he's just a little tidy man. He's trying to figure things out. Whoa dude where are you going? Where are you going? Don't leave the safety of the can.  Is the loudest thing ever and I have a parked back and it doesn't work. Oh city of Louisville.  Had to pay three times. Anyway got that out of my system. Alright got some boats in the parking lot. It's always good. Please Lord let there be just a little bit of top water supple today. Just want to hear it. I smell that shad and by the ramp saw the flickerings of the shad spot. So if you guys look really closely here you can see there are shad just getting all over these little bushes and they're spawning their eggs on these bushes. I'm missing out on good casting time here to document this so make sure you go ahead and smash that like button. Unfortunately I'm just not seeing the busters. Throwing a blooper right now. 15 pound tests fit our 15 pound mono should say. I've got a loop knot tied on the front of that to give it a little extra waggle up front. I mean just blooped by that lay down there. No response not seeing any pops. Shatter all up in here not seeing any pops so it's not what we want. We only have precious minutes till this thing is over. Getting out. Every top water known man right now. Buzz bait frog popper. How to fish. Look at this fish. This must be a white bass. Just had a white bass literally like nudge. Nudged my bait. Yeah I rated me. Where you been all my morning huh?   That's what you are. Maybe a freshly stocked one. Yeah they're going extra crazy. Letting go. They're extra feisty. Extra feisty fun. Movers and the shakers. You know the old bent rod. Pretty good eater. Actually need to keep a few of these little tasty boys for a new batter that we've got going on. But I need to try. Oh yeah bring in school with me. Bring in school. Live scope. Live scope. Live scope. Little boy. Little boy. Oh gosh. Oh man. Oh look at the globules that just came into the scene here. I like knowing exactly where these fish are using the live skin. That's pretty fun to watch them move. Oh two at a time. Two at a time. Get another one. Get another one. Now if I went down a size on this banger it would probably be every cast. I'm looking for some girth. Alright chill. I got either some tasty crops or some bass located on them. Little stick offshore. This is totally expected to do. I'm just randomly fishing what comes into the frame. We're darting around all either like active crappie or smaller bass. Alright those got to be crappie. See they didn't react. So need some crappie. Get a couple of tasty ones. Try out some batter. It's a good crappie. Oh man. That might have been the biggest one down there.  The thing came off my reel. Got it. That was a good one. Watched him come grab it. I thought you were bigger. You're not even gonna make the cut. Big one came up bouncing on the rocks down there. I have never fished this way for crappie. This is kind of interesting. Hanging on these isolated rocks. Only an eater. Something here. Put one of these swim heads on here. See what we can do with that. Hang on a second.  Tasty morsel right there. So one of my recent crappie videos I was throwing these little micro swim baits just on a sixteenth ounce up in the dirt. Now that these crappie on this lake are moving offshore. They usually they like a swinging type action. Right when they move off.  Maybe you know 20, 30 if they're it's a little clearer. But you pitch it out and let it swing into them and they're more active right after the spawn. When it gets really hot in the summer they'll kind of slow down off that. You got to get right on top of them. Gosh I've swallowed it bud. It's down his hatch. This is really interesting to me because I've never I've never approached crappie on rocks like this. It's either like up shallow or brush and this is this is something new for me. So fun little discovery. And these crappie are just kind of on these isolated chunk rocks and boulders. You can see some sitting just on that backside right there. I can't believe my GoPro wasn't recording for that bite. But this is a giant. Oh golly. That was one of those ones I missed right there. Just an absolute slap. Look at that. Toad crappie guys. I just got right on top of the boulder. Did the old straight dangle on them with that little bug. And it thumped it. It was so big I thought it was a bass. Okay. It is a flotilla out here.  You get on a big school of fish. Don't put that rod tip up in the air and start really getting that bend going. Okay. I'm not saying I've done this today. But it has had this obviously happened out on the water today. Some of its birds. People follow the birds. You start bending that rod. People they're peeping. They're peeping out there. They're looking and they say oh okay that's where they're at. They just come right on over. It's amazing. It's amazing. You'd be fishing a spot and you turn around you know and you've got one on and that that engine's fired up coming your way. So you know I don't know what's going on. The white bass aren't exploding at the top. They're under the surface. Normally they're exploded on top. Everybody knows to there. You just run over there. But they're being a little sneaky today. You get them going. You keep that you keep that rod just straight. Just straight till you get to the boat. Just kind of just kind of just flip it in real real subtle lack. Okay. There's hardly any secrets in fishing anymore. Gotta keep something sacred. My top water that I was looking for got up so early. Went all the way out there is expecting explosions, suction, bass, white bass. I don't care. What did I end up doing? Slightly offshore fishing for cropping. Because the tug is the drug and no matter how you get it, it's got to be done. Got the old raffle here. By the way, someone asked me. They sent me an email about because I did a video on the Bubba Blade filet knife that I used it and I was just cutting through a lot of the fish like cutting through the spine. It was just so so aggressive. It was like a chainsaw. And I went and I got a new blade for my Rapala. I gave that Bubba Blade away. It's a good knife. It's just like it was wasn't working for me. I got one of these non stick blades. He's like it was like eight bucks for replacement pair on this standard Rapala plug-in and I love it. I mean it's it's it's perfect for groppy white bass. You know normally I like to put these on ice, but I didn't even do that today. I came straight to the house. OSG is inside. She is cooking up a little kind of summery vegetable mix, like with some tomatoes, some cilantro, vegetable ingredients and we're actually going to cook these for lunch and try out some of the new the new batter. So we're going to go through a few different samples of the batter for Guggen. Something we're gonna come out with. This is a new spicy one that I haven't tried. So nice. Nice fillets. Put them in that ice-cold water. It's a female right here. She's still got eggs. That's crazy. She's still got eggs. You know normally my old chickens, they would lap this up. I have no idea if the new ones are gonna eat. I'll give it to them just a second. On these bigger ones you always want to make sure you get that extra little belly meat right there. Little ones, it's not very much. On the big ones that do a bunch of them, it makes a difference. Mr. Penny, you want to give it a shot? They're curious, but they don't know. I'm just not sure. Okay, I'm gonna throw it right there for you. Try that. Tell me what you think. Fresh fish eggs? Come on. Yeah. Give it a slurp. I'll just pick at it. Yeah, after it. There you go. Still looking at the names, but I'm leaning towards Colonel Sanders on this guy. OSG has made some fresh summery mixture. Tomatoes, cilantro, red onion. Hey, you got a new job in there. I'm supposed to keep these kids quiet while I'm filming. When I say quiet on the set, dad means business.  This is Santa Claus. This is kidding. We are gonna be doing a fry, but I'm doing something different that I haven't done before. I saw a friend's dad do this and it was awesome. I liked the way he did it. He'd split half butter, half oil when doing his fry, and it really turned out nice. Also, we've got a new flavor here that we're working on. This is spicy fish batter. This concoction right here, one of you guys sent me and this is cool. This is like a fish batter. Cook us a fish in a pan. Why are you pushing me? Why are you pushing daddy, huh? Why are you beating up on me? You like beating up on me? Is that fun? I think that's part of the job description. I think this is probably three quarters butter, quarter oil. This stuff's probably terrible for you. Canola.  I'm gonna put the fish right on top of the spice in this traction. You will see. Put the other filet just like that. Put our lid on top and the other side. Watch this. Excess. Then they turn out so beautiful like that. Alright, good job. I think you did a good one. Let's see what it looks like. Oh, yeah. That's a good one. Put some ice on it. Add a little piece break on me, but otherwise, taste your piece. Spicy. What kind of spice? More spicy, less salt. I'm all about it. We'll see what OSG thinks. You're putting a sticker on me? You just said butts? I thought you were supposed to say bum.  You said dad, you're supposed to say bum. I'm experiencing this first on camera. Daughter saying butt for the first time. Alright, I mean you got your golden crispy. I got ours. We'll pair it with OSG's beautiful summer veg mix over here with some avocado. I'm pretty sensitive to spice too, so we'll just sit here. You can smell the kitchen. It's like heavy cayenne. Yeah, that's a more paprika. It's light. It's not like a... Oh, it is a little spicy. Yeah, it is spicy on the tail in there. But it's soft. Put it... You know, that's a fresh crappie, so there's nothing better. Oh my gosh, that is good. Yeah. Put that with like a nice cold beer. Yeah. I wouldn't say it's too spicy. Okay, that's good. I'm pretty sensitive to spice. Well, I only had an end piece which was like concentrated and that thing that I use... I forget who gave us this. They sent it in. I think it encodes them really well, so it was a little extra than normal. That's good. So you like the flavor. Oh, okay. Frosty beverage recommendation that I've recently had and I was like, I got it in a variety pack and I was like, I don't know if I'm gonna like this. Shinerbok. Big fan of the Shiner brewery. Being a Texan and living in Central Texas for many years, but besides that, they make great beer. The Wison Easy. Was it a raspberry beer?  Whoa! Yeah, yeah, no I am. I am. What I thought was it'd be the perfect summer boat beer, you know? I think you originally got it from me and then you're like, wait a minute, I'm gonna take it back. Better than a white claw. Yeah. I was like, yeah, I'll give those a step. I ended up drinking them all. I think I have a one. So, sorry about it. Deserves a hard focus. Just perfectly crusted. Yummy, Dad. You like it? Try mac and cheese. We'll try your crappie. It's delicious. You don't get that very often. It's one of my favorite things in the world right here. Like this is not the best for you, but you just take one of these and then one of these. And it's pure America. I love it. Oh, God bless the crappies. That is gonna do it for today's log fishing freaks. That crappie was insane. I would rate that one of the best fried crappies I've ever had. It wasn't like a full fry. It was a pan fry, but pretty amazing. I mean, there's nothing better than fresh caught crappie. I'm still waiting for the white bass to get fully exited from the pockets and the creeks right now. They're still falling, the shad spawn, and the water's heating up. They're starting to go main lake. And when they go full blow, grouped up, I want to get Stephanie, well, Stephanie, but I want to get Emmy out there and let her experience that action. That's how I caught my first fish. I was three years old, white bass fishing with my dad. I mean, I was just on the boat.  I was able to catch one on a little shiny thing I had tied on. Amy's three years old. She'll be four at the end of summer and so I think it's time. It's time for her to experience that. She's gotten pretty good with her little Moana pole. So I'm really, I'm excited about making that video. It's coming up soon. Incredibly hot. These fish are going to be moving offshore like crazy this month. So matter of weeks. Thank you guys as always for joining me in the great outdoors and here at home at the treehouse. Godspeed. God bless you. I will see you on the next video.