From theCUBE Studios in Palo Alto in Boston, bringing you data-driven insights from theCUBE and ETR. This is Breaking Analysis with Dave Vellante. New data suggests the tech spending will be higher than we previously thought for 2021. COVID learnings, a faster than expected vaccine rollout, productivity gains in the last 10 months and broad based cloud leverage lead us to raise our outlook for next year. We now expect a three to 5% increase in 2021 technology spending, roughly double our previously forecasted growth rate of 2%. Hello, everyone and welcome to this week's Wikibon Cube Insights, powered by ETR. In this Breaking Analysis, we're going to share new spending data from ETR partners and take a preliminary look at which sectors and which companies are showing momentum heading into next year. Let's get right into it. The data is pointing to a strong 2021 rebound. The latest survey from ETR and the information from theCUBE community suggests that the accelerated pace of the vaccine rollout, pent up demand for normalcy and learnings from COVID, will boost 2021 tech spending higher than previously anticipated. Now a key factor we've cited is that the forced march to digital transformation due to the pandemic created a massive proof of concept for what works and what doesn't in a digital business. CIOs are planning to bet on those sure things to drive continued productivity improvements and new business opportunities. Now speaking of productivity, nearly 80% of respondents in the latest ETR survey indicate that productivity either stayed the same or improved over the past three months. Now of those, the vast majority, more than 80% cited improvements in productivity. This has been a common theme throughout the year. As well, the expectation among CIOs is that many workers will return to the office in the second half of the year, which we expect will drive new spending in the infrastructure needs of company HQs, which have been neglected over the past 10 months. Now despite the expectation that many workers will return to the office, 2020 has shown us that working remotely, hey, it's here to stay. And a much larger number of employees are going to be permanently remote working than pre-pandemic. ETR survey data shows that that number is going to be approximately double over the long term. We'll look at some of that specific data. In addition, cloud computing, it became the staple of business viability in 2020. Those that were up the cloud adoption ramp, well, they benefited greatly. Those that weren't, well, they had to learn fast. Now, along with remote work, cloud necessitated new thinking around network security. And as we reported, identity access management, endpoint security and cloud security were the beneficiaries. Companies like Okta, CrowdStrike, Zscaler and a number of others continue to ride this wave. Larger established security companies like Cisco, Palo Alto Networks, F5, Fortinet and others, they have major portions of their business that are benefiting from the tailwinds in the shift in network traffic as a result of cloud and remote work. Now, despite all the momentum in the market and the expected improvements in 2021, these tailwinds are not expected to be evenly distributed, far from it. We think Q4 is going to remain soft relative to last year and Q1 2021 is going to be flat, maybe up slightly. Remember, the COVID impact was definitely felt in March of this year. So based on the earnings that we saw, there may be some upside in Q1 given that organizations are still being cautious in Q4. And really there's still some uncertainty in Q1. So let's look at some of the survey responses and you'll see why we're more optimistic than we've previously reported. This chart shows the responses to key questions around spending trajectories from the March, June, September and December surveys of this year. Now it's no surprise that there's been little change in remote workers and limiting business travel, but look at the other categories. We've seen a dramatic reduction in hiring freezes. The percentage of companies freezing new IT deployments continues to drop throughout the year. And then conversely, the percentage of companies accelerating new IT deployments, that's sharply up to 34% from the March low of 12%. And look at the headcount trends. The percentage of companies instituting layoffs, it continues its downward trajectory while accelerated hiring is now up to 17%. So there's a lot to be excited about in these results. Now let's look at the remote worker trend. How do CIOs see that shaping up in the near to midterm? This chart shows the work from home data and it's amazingly consistent from the September survey drill down. You can see CIOs indicate that on average, 15 to 16% of workers were remote prior to the pandemic and that jumped up to 72 to 73% currently and is expected to stay in the high 50s until the summer of 2021. Thereafter, organizations expect that the number of employees that work remotely on a permanent basis is gonna more than double to 34% long-term. By the way, I've talked to a number of executives, CEOs, CIOs and CFOs that expect that number to be higher. These especially are in the technology sector. They expect more than half of their workers to be remote and are looking to consolidate facilities costs to save money. Now, as we've said, cloud computing has been the most significant contributor to business resilience and digital transformation this year. So let's look at cloud strategies and see how CIOs expect those to evolve. This chart shows responses to how organizations see multi-cloud evolving. It's interesting to note the ETR call out, which concludes that the narrative around multi-cloud is real and it is. But you know, I want to talk to you about a flip side to this notion in that as many customers have or are planning to increasingly concentrate workloads in the cloud. Now, this actually makes some sense. Sure, virtually every major company uses multiple clouds, but more often than not, they concentrate work on a primary cloud. CIO strategies, they're not generally evenly distributed across clouds. The data shows that this is the case for less than 20% of the respondents. Rather, organizations are typically going to apply an 80-20 or a 70-30 rule for their multi-cloud approach, meaning they pick a primary cloud on which most work is done, and then they use alternative clouds as either a hedge or maybe for specific workloads or maybe even data protection purposes. Now, if you think about it, optimizing on a primary cloud allows organizations to simplify their security and governance and consolidate their skills. Now, at this point in the cloud evolution, it seems CIOs feel there's more value that is going to come from leveraging the cloud to change their operating models and maybe broadly spreading the wealth to reduce risk or maybe cut cost or maybe even to tap specialized capabilities. What's more, in thinking about AWS and Microsoft, respectively, each can make a very strong case from monocloud. AWS has more features than any other cloud and as such can handle most workloads. Microsoft can make a similar argument for its customers that have an affinity in a large estate of Microsoft software. The key for multi-cloud, in our view, will be the degree to which technology vendors can abstract the underlying cloud complexity and create a layer that floats above the clouds and adds incremental value. Snowflake's data cloud is one of the best examples of this and we've covered that pretty extensively. Now, clearly VMware and Red Hat have aspirations at the infrastructure layer in a similar fashion. Pure storage and NetApp are a couple of larger storage players with similar visions and then Cumulo and Clumio are two other examples with promising technologies but they have a much smaller install base. And take a look at Cisco, Dell, IBM and HPE. They have a lot to gain and a lot to lose in this cloud game. So multi-cloud is an imperative for these leaders but for them it's much more complicated because of the complexity and vastness of their portfolios. Notably, Dell has VMware and IBM of course has Red Hat which are key assets that can be leveraged for this multi-cloud game. HPE has a channel and a large install base but all of these firms, they have to spread R&D much more thinly than some of these other companies that we mentioned, for example. The bottom line is that multi-cloud has to be more than just plugging into and operating well on any of the clouds. It requires, by the way, this is mostly where we are today. It requires an incremental value proposition that solves a clear problem and at the same time runs efficiently, meaning it takes advantage of cloud native services at scale. So what sectors are showing momentum heading into 2021 and who are some of the names that are looking strong? We've reported a lot that cloud containers and container orchestration, machine intelligence and automation are by far the hottest sectors, the biggest areas of investment with the greatest spending momentum. Now we measure this in ETR parlance, remember by net score. But here's the good news. Almost every other sector in the ETR taxonomy with a notable exception of IT outsourcing and IT consulting is showing positive spending momentum relative to previous surveys this year. You know, maybe that's not a shock but it appears that the tech spending recovery will be broad based. It's also worth noting that there are several vendors that stand out and we show a number of them here. CrowdStrike, Microsoft has had consistent performance in the dataset throughout this year. Akta, we called out those guys last year and they've clearly performed, as you can see in their earnings reports. Pure storage, interestingly, big acceleration and a turnaround from last quarter in the dataset and of course Snowflake has been off the charts as we reported many, many times. These guys are all seeing highly accelerated momentum. UiPath just announced its intent to IPO. AWS, Google, Zscaler, SailPoint, ServiceNow and Elastic. These all continue to trend up and so there are some real positives that we're looking for. Remember the ETR surveys, they're forward looking. So we'll see as we catch up next quarter. Now before we wrap, I want to say a few words on security. Maybe it's a bit of a non-sequitur here but I think it's relevant to the trends that we've been discussing, especially as we talk about moving to the cloud. And as you know, we've reported many times on the security space, basically updating you quarterly with our scenarios and the spending and the technology trends and highlighting our four star companies. Four star companies in security are those with both momentum and significant market presence. And last year we put CrowdStrike, Akta and Zscaler and some others on the radar and we've closely tracked the cyber business of larger companies with a security portfolio like Palo Alto and Cisco and more recently VMware was made some acquisitions. Now the government hack that became news this week, it really underscores the importance of security. It remains the most challenging area for organizations because, well, failure's not an option, right? Skills are short, tools are abundant, the adversaries are very well funded and extremely capable yet failure is common as we saw this week. And there's a misconception that cloud solves the security problem and it's important to point out that it does not. Cloud is a shared responsibility model, meaning the cloud provider is going to secure the infrastructure, for example, but it's up to you as the customer to configure things properly and deal with application security. It's ultimately on you. And the example of S3 is instructive because we've seen a number of S3 breaches over the years where the customer didn't properly configure the S3 bucket. We're talking about companies like Honda and Capital One, not just small businesses that don't have the SecOps resources. And generally it was because a non-security person was configuring things. You know, maybe they were developers who were not focused on security. And perhaps permissions were set too broadly and access was given to far too many people. Whatever the issue, it took some breaches and subsequent education to increase awareness of this problem and tighten it up. We see some similar trends occurring with new workloads, especially in cloud databases. It's becoming so easy to spin up new data warehouses, for example, and we believe there are exposures out there due to the lack of awareness or inconsistent corporate governance being applied to these new data stores as well. Even though important areas like threat intelligence and database security are important, SecOps budgets are stretched thin. And when you ask companies where the priorities are, these fall lower down the list. These areas specifically have taken a back seat to endpoint identity and cloud security. And we bring this up because it's a potential blind spot as we saw this week with the US government hack. It was stealthy, it wasn't detected for many, many months. Who knows, maybe even years. And not to be a buzzkill, but the point is cloud enthusiasm has to be concomitant with security vigilant. Okay, enough preaching, let's wrap up here. As we entered 2020, we said, as we entered 2020 this year, we said the cloud was going to be the force that drove innovation along with data and AI. And as we look in the rear view mirror and put 2020 behind us, I know many of you want to do that. It was the cloud that enabled businesses to not only continue to operate, but to actually increase productivity. Nonetheless, we still see IT spending declines of four to 5% this year with an expectation of a tepid Q4 relative to last year. We see Q1 slowly rebounding and kind of a swoosh. Let me try that again. Recovery in the subsequent quarters with tech spending rebounding in 2021 to a positive three to 5%, let's call it 4%. Now supporting our scenario, the pandemic forced a giant Petri dish for digital. And we see some real successes and learnings that organizations will apply in 2021 to bet on sure things. These are cloud, containers, AI, ML, machine intelligence pieces and automation. For sure, along with upticks for virtually every other sector of technology because spending has been so depressed. Two exceptions are outsourcing and IT consulting and related services, which continue to be a drag on overall spending. Priorities must be focused on security and governance and further improvements in applying corporate edicts in a cloud world. We also see new data architectures emerging where domain knowledge becomes central to data platforms. We'll be covering this in more detail on top of the work that we've already done in this area. Now automation is not only an opportunity, it's become a mandate, yes, RPA, but also broader automation agendas beyond point tools. And importantly, we're not talking about paving the cow path here by automating existing processes, rather we're talking about rethinking processes across the entire organization for a new digital reality where many of these processes are being invented. You know, the work of Eric Brynjolfsson and Andrew McAfee on the second machine age, it was prescient back in 2014 and the conclusions they drew, they're becoming increasingly important in the 2020s. Meaning that, look, machines have always replaced humans throughout time. But for the first time in history, it's happening for cognitive functions and a huge base of workers is going to be or is being marginalized unless they're retrained. Education and public policy that supports this transition is critical and I for one would like to see a much more productive discussion that goes beyond the call to break up big tech, rather I'd like to see governments partner with big tech to truly do good and help drive the reskilling of workers for the digital age. Now cloud remains the underpinning of the digital business mandate, but the path forward isn't really always crystal clear. This is evidenced by the virtual dead heat between those organizations that are consolidating workloads in a cloud workloads versus those that are hedging bets on a multi-cloud strategy. One thing is clear, cloud is the linchpin for our growth scenarios and will continue to be the substrate for innovation in the coming decade. Okay, well remember these episodes, they're all available as podcasts wherever you listen, all you got to do is search breaking analysis podcast and please subscribe to the series, appreciate that. Check out ETR's website at ETR.plus. We also publish full report every week on wikibon.com and siliconanglebot.com, you can get in touch with me at David.Valante at siliconangle.com, you can DM me at Dvalante. And please by all means comment on our LinkedIn posts. This is Dave Valante for theCUBE, insights powered by ETR. Have a great week everybody, Merry Christmas, happy Hanukkah, happy Kwanzaar, happy whatever holiday you celebrate, stay safe, be well, and we'll see you next time.


Hey, hey there dudes! What's up, it's me back again with another beautiful video and today, we're gonna be reacting to the alphabet! No, really, we're gonna be learning the alphabet with kpop idols, okay guys? That's legit what we're doing, right? The alphabet A to B square 5 9 T, AQ, AQ, Q? Is Q even a number in the alphabet? What? We need the kpop idols! We need them! We need them to help us learn the alphabet! Yeah, this is how you spell Pepsi. G-R-E-A-T-N-E-S-S. Got ya! Huh? How do you feel all you Coca-Cola lovers? I just attacked Coca-Cola because Pepsi is the greatest! It is great mess! Ha ha ha ha ha! And that's when I realised I was crazy! But I've noticed that this meme has been going around a lot and a lot of people have been making them and I've been seeing them on Twitter, but I have not seen this one! I've seen one for SF9, seen one for BDS, seen one for... what was the girl group? Ring Velvet? So yeah, I have seen a few of these videos and I find them pretty good. I usually enjoy them quite a lot. They're pretty short though, so that's why I'm talking a bit. Because usually I try to be ready and entertained during my relations, but sometimes it's 2 minutes 42 seconds. I feel like there's not enough time for you guys to be INDETAINED! So we'll get into this in a few seconds, okay? The reason why we'll get into this in a few seconds is because I, Logan, this guy, I'm LJL, I want to kind of make a series where once a week you guys send me memes. It's like meme review, but with K-pop. It's K-pop meme review. Oh no! K-pop meme review. Yeah! We'll do it for each set of all. K-pop meme review. So 5. K-pop meme review. How about meme day? But really, I do want to kind of make a thing where I just look at K-pop memes because they're fun. They're real fun. So every Monday, today is Tuesday though, but every Monday we're going to be having a meme day. That is the day of the Monday meme day, because they both start with M. So that's why it's going to be on a Monday meme day.  It's so hot! Yeah! Let's get straight up to this. I'm freaking excited! Oh, it's doodies! Oh! That was a good episode. Oh! I've watched this episode! It was good! That was such a flash.  I'm learning! I'm going to say it again. Niko, Niko, Nii. Niko, Niko, Nii. I love it, man. Felt painless. Um, um, um, yeah, um, um, um. Well done, Nikkei. Oh, Shishi is playing some Chinese, right? Sleeping? Oh, I need to learn my alphabet more. What's this? Sleeping? Sleeping? Subscribe! Guys, we have learned the alphabet. We now know how to 1, 2, 3, ABC. No, but really, thank you to all these idols who have helped me a lot. I was learning the alphabet. I know how to do it now. But you guys, for the people that probably skipped the reaction and then you've probably already clicked off the video, thank you for the view, but for the people that didn't, don't forget, don't forget to, don't forget to, how do I even say this? Don't forget to send me the memes, okay? Don't forget to send me the memes. Oh wait, I've got to continue now. Don't forget to send me the memes by sending me the memes, okay? So if you want to send me the memes, send me the memes. I'll find a way for you to send me the memes. Maybe through Twitter, maybe you can just give me a notification and then be like, yo, this is a meme, I want you to meme to do. So yeah, we'll do that. Let's go back to drunken greatness.  Yeah, how much did you learn? Did you learn how to A to Z? Or did you learn how to A to G? I don't know. But subscribe for meme days, because that'll be pretty good. That'll be fun. We'll be looking at Kpop memes, which will just be a whole song. And uh, yeah, other than that, I hope you guys have a great day. And just keep on sniting. And I'll be yours, dude. Squaw.


What's up y'all, it's W and I'm back to give y'all a tip that's going to take your man game to the next level and that's how to always make a defender miss in the open field. Now I learned this tip early in the year and it's taking my flat passings into huge gains and make people not be able to blitz and just leave a couple people on in covers because I will make the first person miss every time. And to do this juke, what you want to do is use no triggers, no precision, no speed, nothing like that. All you want to use is just the right stick. So you put it on an angle away from where the defender's coming and you will make them miss every single time. I want y'all to add this to your game and it will take your running back swing passes, your screen passes, your drag routes, everything that's short and it will take it from 5, 10 yard games to 20 to 30 to touchdown plays with the right player. And don't think that just because he doesn't have a high juke, this player can't do it. Tight ends can do this, wide receivers, even quarterbacks. This juke is really effective and will really change your game. So y'all need to go ahead and let me know how this juke made you better. If you like this video, want more like this, please hit the like and please hit the sub button. We're trying to grow, learn how to do this. In this play, I actually make two people miss with the same juke. It's going to change the game.


Exercise Don Blitz 2011 wraps up as the first Marine Expeditionary Brigade and sailors of Expeditionary Strike Group 3 train together for a large-scale amphibious assault on beaches of Southern California. This exercise is important simply because this amphibious capability is important. It provides our government, our leaders, operational flexibility. It's also important because there's only so much simulation that we can do. At some point we have to get on these ships and conduct the exercises from the ship. There's absolutely no substitute. These exercises keep Marines prepared to deploy quickly by sea on short notice to any place in the world for a wide range of contingencies from humanitarian aid and disaster relief to conflicts. With the focus over the past 10 years on the global war on terror, some of this training has given way to preparedness for ground combat. These skills have atrophied. We haven't been doing this for at least a decade. So in that regard we're again revitalizing capabilities that really are core to the Marine Corps but we haven't had a chance to work on because of the sustained ground combat operations on shore. So it really is making sure that we can do what we advertise we can do. We can meet the expectations that have been leveled around the Marine Corps and we can respond in the event of the crisis and not have to do a whole lot of discovery learning while we're mobilizing and getting out the door and moving into an objective area. Don Blitz tested the Corps on multiple levels. The most visible part was the actual assault, where Marines conducted amphibious assault vehicle and landing craft air cushion landings. Back on the U.S.'s bottom of shard, senior staff from the 1st Marine Expeditionary Brigade and Expeditionary Strike Group 3 learned how to coordinate their efforts to make the entire exercise a success. Well, I'll tell you, if you could have sat inside and saw the relationship, the workings between the MEV and ESG-3, you can see that it moves us closer to the single team. This is by far the best relationship, the best personal relationship, the best functioning relationship I've seen in my career with the Navy staff. We've been working at this hard for a long time, something that hasn't happened overnight, but this is another progressive step as we really work to become an integrated, fully capable team. As the Marine Corps continues to evolve to meet the new challenges of the 21st century, it is exercises like Don Blitz that will keep them prepared for any mission, threat, and operating environment. Reporting from the U.S.'s bottom of shard, I'm Corporal Benjamin.


Personal finance practice problem using OneNote. Estimated stock ROI rate of return, assuming constant dividends and growth. Prepare to get financially fit by practicing personal finance. You're not required to, but if you have access to OneNote, would like to follow along. We're in the icon left-hand side, practice problems tab in the 12, 240, estimated stock ROI, assuming constant dividends and growth tab. Also, take a look at the immersive reader tool, practice problems typically in the text area too with the same name, same number, but with transcripts. Transcripts can be translated into multiple languages and either listened to or read in them. We're thinking about investments in stocks, stocks representing ownership interest in a corporation. Corporations being separate legal entities breaking out their ownership into fixed or standardized units of shares or stocks. We are also typically thinking about publicly traded companies, those trading on public exchanges, making them more transparent and accessible to individuals. And so we can see things such as their financial statements, for example, to make investment decisions upon. Also note that your investment strategies may differ when using tools such as mutual funds and ETFs, as opposed to say investing in individual stocks. We're considering individual stocks here when you're thinking about them, you're often drilling down on the trend analysis and the financial statements of the individual company as opposed to possibly sectors or sections of a market, for example. So the assumption here, we've got the dividends at your end are $7. The stock price is gonna be $80. Now the stock price will be determined by supply and demand because other stocks are trading for that amount. That's how we can determine what the current price is. We're gonna be assuming the constant growth rate of 5% and we're also gonna assume that the dividends are going out into the future at a constant rate. So we're using a method similar to what we use when we basically value the bonds, for example. So remember when you're kind of valuing the bonds, figure out the price of the bonds, you're typically looking at the cash flows that are happening into the future, discounting them back to the current timeframe, the cash flows representing a standardized, fixed income flow of interest in the future and annuity in essence, and then the payment at maturity. When we're talking about stocks, it's a little bit more complex because we've got two things that we're kind of looking at. One, we might get dividends, cash payments, cash flow, the company taking the earnings of their company and distributing them to the owners in the form of dividends. And we also might get an increase in the value of the stocks, possibly by the company taking those earnings, putting them back into the company and buying machinery and equipment, increasing the value of the company, hopefully being reflected in the stock price. We also do not have any maturity date in order to kind of figure out the future cash flow because the investments could go out indefinite, right? So we're kind of considering dividends, for example, in this assumption and a cash flow assumption as if they're gonna basically go out indefinitely into the future. We could make other assumptions, we could assume they're gonna go up periodically or something like that, but we're gonna assume that in this particular company, the dividends are going out into the future and that we have constant growth, meaning the value of the stock is gonna be going up in the future. And we know the stock price, therefore we wanna consider what the rate of return is. Okay, so we can use the ROI, just if there was just dividends, for example, would be the $7 of dividends and the stock price, meaning if we just have the dividends as our return and we're not basically considering the fact that the stock's gonna go up in value, we're just looking at what we're receiving in terms of dividends. We would be comparing the dividends, usually on a yearly basis to then the stock price, what's being traded at that current timeframe. And if we divide those two out, pulling out the trustee calculator, we've got the seven divided by the 80, which is gonna be moving the decimal two places over 8.75. So that's the ROI if it were just dividends. And then we're just gonna tack on that constant growth rate. Now that constant growth rate, the strategy is more and more effective when we're thinking about stocks that are kind of peeking out in their business cycle. So it's like utility companies, for example, that don't need to basically invest much anymore and they're just tracking along and they're just gonna be making money and giving out dividends, right? Or things that are closer to a standard growth rate, those are easier to use as cash flow kind of model with because when you think about the constant growth rate of 5%, for example, you'd like that to be, that's a pretty big assumption, right? If the growth rate was a lot higher than that, that would be a big assumption to basically make. So we're gonna say, so you gotta be kind of knowing which kind of companies you're gonna apply this model to when you're trying to look at the valuation through future cash flows. So if we assume that there's a 5% constant growth rate meaning the value of the stock's gonna go up by 5% and that means our stock price goes up by 5% and we can sell it and realize it if we wanted to, that would mean then that we'd have the return of, rate of return of 13% to 8.75 plus the 5%. Now to kind of get an idea of what we're doing here, remember we're taking, if I took an annuity calculation and I calculated an annuity based on this present value calculation in a similar way to get back to the stock price, we've done this in prior presentations, so this would be similar to kind of like a bond calculation. If I had my rate of return here was the 13.75, but I assume a constant growth rate of 5%, that means the rate of return for like just the dividends would be the 8.75. If I tried to present value that stream of dividends at the 8.75 for example, we do a present value of the rate, that would be the 8.75, the number of periods, I'm using a very large number, a thousand, because we don't know, there is no maturity, it could go on forever. So you could try to get a better idea or a feel for what's going on by making this number not so high out into the future and see if it has an impact on your price calculation. If you take it out like a thousand years into the future because it could indefinitely go out in forever, then you know, you get closer to basically this number here, the 80. So comma and then the payment is going to be the seven and that's gonna give us our $80 just to see that. If you took the present, the annuity ROI with the dividend and growth rate, so now I use the same calculation using this 13.75 based on just the dividends. So I took the rate, which is going to be this 13.75, the number of periods is 100 this time. I'm just picking up fairly large number, comma and then the payment is gonna be the seven. Again, you'd get to that 50.91. And we're gonna try to use that number here as we kind of think about it in terms of mapping out all the payments into the future. So we could do a similar calculation, try to map everything out into the future. You can actually do this a little bit more complex method if you're thinking the dividends are gonna go up not at a standard rate, for example. So then you can actually map out on the years into the future what's gonna happen and do a kind of a more complex model. So we'd have the dividends are seven all the way across. So if we went out 100 years, $7 dividends, that would total up to $700, but that's expanded over a long timeframe. If I was to discount each one of these dividends on a year by year basis, this is doing it year by year is what allows me to increase the dividends. If I wanted to use a model and assume that the dividends are gonna go up, say every five years or something like that. But then we're gonna say, if I took that $7 and discounted it back using the rate of just this 8.75% that would give us to the 6.43. And if I did that all the way across, of course it would get smaller and smaller as we discount, for example, $7 back using the 8.75% for four years, it's now at five. If I go all the way out to 100 years, I'm still getting that $7 because we're assuming that that is constant, but it's very small. It's a very small number once we go way out into the future. And that's why it's kind of indefinite, but they're becoming a lot less significant out there. And we get to something close to the $80, not quite 80. That's why we used a thousand up here. So you can see the impact on how far out you go when you actually map it out this way, which I think is kind of useful. If we did the same thing, but now we use the $7 dividend and we use the 13.75 rate of return, $7 discounted back at the 13.75, would give us the 6.15. And if I did that all the way across, then we can add all those up and we get to that 50.91, which is this 50.91 we got to here. And that's gonna be used because we could try to think about, okay, what's gonna be happening with this constant growth kind of idea? If I use that 50.91 as our starting point, and I assume that we're gonna increase by 5% constant growth, what does that mean from a cash flow? Now note, this isn't actually cash flow now because we're not getting the dividends. We're saying that the value of the stock is gonna increase by 5% each year, which means I could then have the option of selling it, but I may not, you know, if I sell it, then the constant growth stops at that point in time, right? So it's the potential for us to have it. It's unrealized gains until we sell the stock. But if it went up 6% or 5%, then I'd have 50.91 times the 0.05, that would be an increase of 2.54 plus the 50.91, which would be 53.45, or we can think about it this way. If I take one or 100% plus 0.05, that would be the 1.05 or 105% times the 50.91, that would get us to 53.  That's what we're assuming is gonna happen. But notice what happens to our return then that we're getting, it's not an even return like the dividends were, the return is actually going up. So if this rate is fairly high, it's gonna have a kind of confusing impact on our calculation, because it's not gonna be the same all the way across, meaning if I, for example, if I compare that to the dividends, which are right here, I'm just pulling down the dividends that we did up top, $7 even that we're assuming all the way across 100 years out, the increase in the stock price starts to get significant, right? So now you're looking at the difference here, if you had a stock price, if my investment was at the 6, 3, 7, 5.8 times the 0.05, we've got the 318, that's a significant increase in dollar amount, but it's still 100 years out into the future. So it's still a fairly, fairly small once we kind of present value it back to the current timeframe. So that's the two values that we're gonna get, if we add them together, then we've got the, just these two, the 2.55 and the seven, not the 53. So we've got the 2.67 and the seven, that's gonna be the amount of value we're getting into the future in terms of dividends and the increase in the stock price. And then if we discount that all the way across using the 13.75 now, so now we're gonna take period one, we're discounting this 9.55 that we're assuming we're gonna get back one year using the 13.75, a formula like this would be the rate, it'd be the 13.75, we'd say then the number of periods is gonna be this one and then comma, comma, because it's not an annuity, future value would then be that 9.55, bringing it back to the current timeframe, getting us to the 8.39 about, and then of course it goes down and down as we go into the future and as we go into the future all the way out, it still gets relatively small, not as small as the dividends, which are almost non-existent, they growth in them, because again this percent increase still has an impact out into the future. So it's kind of, if that rate of growth is high, then this calculation gets a little bit distorted, right? So in any case, so if I add all that up, that's where we're getting about that $80. So we're kind of recalculating the $80. And the reason I do these kind of present value things is to try to, this concept up here is a little bit abstract, people probably just kind of memorize this, but don't have any real understanding of what's going on and you can't get to more complex calculations by breaking out more complex assumptions unless you break it out on a year by year basis, it's also just really good for your time value of money calculations. So it's really good practice, Judy's in Excel highly recommended.


This time on Partners, it's an adventure underground with the Soil Explorers. From bioremediation efforts to improved sediments of New Jersey's industrial metalands to probing experimental gadgets that offer California wine growers a competitive edge in growing grapes to microbial observatories offering insight into the use of streptomycin in Wisconsin apple orchards. These bold explorers are reshaping the way we think about our most fundamental natural resource, Soil. Welcome to Partners. In the next half hour, we'll travel the nation and see breakthrough work in research, education and extension. That's what CSREES is all about, helping universities generate valuable knowledge for those who need it and educating our next generation of Americans. And now it's time for Partners. Soil. Perhaps no other substance in our natural world is as important as it is unappreciated. Most people understand the importance of Soil in the growing of food, but beyond that, it is frequently viewed as something that we merely tread upon. Others see it as a convenient dumping ground. If neglected, it can discreetly wash away a lost treasure to the local ecosystem. This underappreciated resource comes in many forms, and because of that diversity serves many functions. Soil provides homes for animals, material for constructing buildings, foundations for our grand structures. It acts as a filter for the planet's precious water, an anchor for our majestic forests, and a storehouse for Earth's basic elements. For instance, carbon may be stored deep in the soil for thousands, even tens of thousands of years. The largest terrestrial stock of carbon is in the soil. But when soil is disturbed, much of its carbon may be released into the atmosphere. This is causing concern as increased carbon dioxide has been linked to global warming. As a result, scientists are now studying the mechanisms of carbon sequestration, how carbon remains underground. They are among a group of modern-day explorers, those dedicated to unlocking the secrets of Earth's living skin. In the next half hour, we'll follow three intrepid scientists in their quest to learn more about this amazing natural wonder, one that is vital to us all. And now, the Cooperative State Research Education and Extension Service of USDA presents The Soil Explorers. We have a legacy of contamination in the district. Organic pollution is very prevalent. We are coming out of a cycle of 60, 70 years. I could go even further back in industrialization. I mean, this is the quintessential post-industrial landscape in New Jersey. Lowlands, you know, people just dumped here. Francisco Artigas is talking about the Carney Marsh, located in the meadowlands of northern New Jersey. Once a saltwater marsh, it was drained and used as a landfill. Later, a freshwater marsh was established on top of a dump. And while wildlife still remains here today, Carney Marsh faces other threats than those from below. During rainy periods, sewage overflows into the swamp. Runoff from nearby landfills is also a problem. The result is a marsh laden with toxins. For Donna Fennell, this is a perfect place, for she is a soil explorer. A lot of people have heard about PCBs. That's polychlorinated biphenyls. These are compounds that were produced as industrial chemicals and used for electrical insulators. They were used in carbonless copy paper. Their production was banned in the late 70s after it became apparent that these things were an environmental problem. PCBs are very hydrophobic, so they like to stick to soil particles. Those soil particles are the recipients of many types of pollutants. Some of these soil particles get washed into aquatic systems and form the basis of the sediment that forms in the bottoms of rivers, lakes, harbors, and coastal areas. Organic matter contained in soil is sort of an attractant for some of these more problematic pollutants, like PCBs and dioxins. Today, Fennell and assistant Val Crumins are going against convention. The standard method for eliminating such toxins is to dredge, physically remove the polluted sediments from the aquatic environment. This is not only costly, but the muck collected then needs to find a safe home so that the toxins don't spread further. But Donna and her Rutgers colleagues believe they have a better idea. Our techniques are intended to work naturally within the sediment. We're focused on really treating the pollutants where they are. We're looking at microorganisms that occur naturally in the sediment or which we may introduce to the sediment to transform and detoxify these compounds. That way we can detoxify the sediment in place and then the excavation or dredging if it occurs later as a normal course of management of aquatic sediments would not result in redistribution of those pollutants. The microbes that the Rutgers staff inject into the polluted sediments are tiny bacteria, ones that, in order to live, absorb chlorine from toxins like PCBs. What these microorganisms do is they use the chlorinated compound as their oxygen. They're breathing chlorine, so to speak. The Marsh experiment has several steps. First, a barrel is set down into the sediment to isolate it from the rest of the bottom. The dechlorinating microbes are then injected into the sediment. Then a second blue barrel is fitted into the first. This allows the scientists to funnel in materials from the boat. The last step is to cap off the embedded barrel with a gel-like clay seal. This capping idea is something that has been used for some time for treating sediment. What we want to do is study how the microbial process under the cap could be stimulated and how it can work in conjunction with capping. Back on shore, the Rutgers team examines the sample just brought in from the boat. CSR EES helped fund this research, along with a grant from the Department of Defense. With the samples safely preserved in liquid hydrogen, the serious sediment is transferred back to Rutgers, where the rigorous lab work begins. It is here that Fennell is discovering the intricacies of the dechlorinating microbes used at Carni Marsh. Only by using molecular DNA technologies can we have a hope of detecting those microorganisms. Extracting the DNA and using molecular markers that are specific for the bacteria that we're interested in, we can pinpoint members that make up only a small percentage of that population. Right now I have a three-year-old in my house, and I'm very concerned about the impact that pollutants have. We're really starting to break down these barriers. What happens in sediments? What can degrade these pollutants? We're developing technologies to deal with these legacy pollutants, and we can sort of right the wrongs that have been done in the past. It's recovering our environmental legacy and our heritage, and making that a resource for future generations. In 2001, homeowners applied over 40% of garden chemicals used in the U.S. Land Grant University studied the impact of chemical runoff on soils and supply urbanites with guidelines for responsible care of city landscapes. It is autumn in the Napa Valley of California, and the rush is on to harvest this year's bounty of grapes. Time is of the essence. When you're growing grapes for wines, especially for reds, you're very much on the edge in terms of too much stress and too little stress, and so the push is always to do more stress. But if the weather is adverse in terms that it's too hot or it's too dry, you can go overboard. And so the risk really is, because you're always on that knife edge, you can go too far. Daniel Bosch knows the risk in the high-stakes business of vineyard production. He is the senior vina-culturalist for Robert Mondavi Wines, making crucial decisions for this 1500-acre operation, one of Napa's largest. But he also understands that water is the key. Guessing wrongly about moisture beneath the surface can lead to a bad harvest.   What Bosch wants is the optimum amount of H2O to reduce tiny grapes bursting with flavor. Deep blue jewels that offer the most delicious wine. Soil really determines an awful lot in quality in growing grapes, and the water relations in the soil is really the primary way that soil is involved in wine quality. But to date, determining soil moisture leaves much to be desired. Growers sometimes dig test holes to see below. This is spotty information at best. They also check the moisture inside the plant. Our current methods are all point measurements, so it's single vines or a few vines. But at the University of California, Berkeley, soil explorer Yoram Rubin thought he might have a better method. He contacted Daniel Bosch with a novel way to see below the surface. GPR stands for Ground Penetrating Radar. GPR is a system that sends an electronic signal into the ground and record it after it travels in the ground for a certain while. And we then take the recorded signals back to the lab and we interpret them. We had the instrumentation, but it had to be modified for use in vineyards and more importantly, we had to develop the methodology for interpreting of the signal. It's high-risk research. This technology was unproven when we started. It's on the interface between basic research and applied research. What we found in CSREES is openness and willingness to take the risk. They, in fact, allowed us to do it. There was no other way. Back in Napa, a prototype GPR device is put to the test. Assembling the maze of cables, connections and computers is left to the deft hands of another soil explorer, Catherine Grote. I was the primary data collector and processor here, so I would come out on a typical day and collect data. The great thing about radar is that you get really high-density data. As the unit is dragged across the surface, it sends a high-frequency electromagnetic pulse down into the soil. The signal is then reflected back to a receiver and recorded into a laptop computer. The speed of the transmitted and reflected signals varies with the soil's water content. Pulses move slower through wetter soils, faster and drier ones. Here, very quickly, we actually monitor a very large area and get a three-dimensional image of the soil, and with that, get a comprehensive image of soil moisture and control the stress irrigation process. The second advantage is related to harvesting. When they get an image or information about the soil moisture content, with that, they can control irrigation. They can control the maturation of the fruit such that the fruit from the entire block matures at around the same time. They can send the crew just one time with the strong competition, the California wine coming from the New World wine, Australia, Chile, Argentina. There's no choice. First of all, that really helps in understanding how deep the roots are, where the water is, how fast it's starting to run out, and that makes farming easier. And the ground penetrating radar, the GPR, measures multiple points, and so we can get sort of a 3D look of what's going on rather than just one point. Having that picture allows us to be more efficient in designing it so that we don't, after the fact, have to make adjustments to how we plant it. The ability to better plan new vineyards is a huge advantage for Bosch. Napa is known for its rolling hills and varied earth that rapidly change from loam to sand to gravel. Over 30 types of soil have been identified in the valley. GPR will allow viniculturalists to efficiently match their plantings to variations in the subsurface terrain. And there are environmental advantages for California, a state that uses more water than any other. The larger the pressure on water resources, there will be a growing pressure to control irrigation. And this is not just because we need to save water, but because water can actually percolate below the root zone and carry the pesticide deeper into the ground. So you really want to irrigate as much as is needed and not to drop more. And this you can do with our technology. I'm just very excited about the potentials of this technique. If you read the manuals on how to measure water content, GPR isn't even really mentioned yet. But as we develop this, say, in three to five years, I think it has very far-reaching potential for both precision agriculture and more traditional farming techniques. The future for the technology looks bright. Catherine Grote now uses GPR in Wisconsin to determine nitrate content through electric conductivity. This CSR EES-funded research helps Midwest farmers determine optimum fertilizer applications for their fields. Yoram Rubin is exploring ways to use the radar for monitoring moisture below highways with hopes of better predicting road maintenance needs. And for Dan Bosch, he remains on the land. The French have a concept of what they call terroir, and it's really the concept of the place, of the environment, of the soil, of the people, of the history. It's really all of those. A lot of it is experience. And we're hoping that with the techniques like GPR that we can make some jumps ahead. And I think we're starting to see some of the same advantages that took other people hundreds of years. With GPR, I can imagine at some point you could attach it to a tractor and go down every few rows and have a good understanding of what your various parts of the vineyards are doing. CSR EES funds soil conservation projects that improve farm tillage and cultivation to reduce soil erosion. An added benefit? Cleaner air for better human health by reducing dust particulate. Looking at this Wisconsin countryside, it's hard to imagine that much could go wrong in such a pastoral landscape. But trouble arrived here just a few years ago when a bacterial pathogen re-invaded the area, causing widespread destruction. Firelight is a disease that affects apples and pears and related crab apples, related ornamental trees. It's caused by a bacterium or winium alabra. And although it's sporadic disease, it can be really devastating taking out branches, flowers, fruit, entire trees sometimes. The most noticeable signs are that when you look at the tree it looks like a branch will be scorched by fire, so it's brown or black and the leaves are dried up and the branch might be crooked over at the end so it resembles a shepherd's crook. It's a pretty big problem. Patty McManus advised Wisconsin farmers on how best to combat the disease. One of those was Vern Forrest of Eppelgarten Farms. Very scary. I thought that the way it suddenly hit and the fact that we had it for two years in a row, I thought we might lose the orchard. The total of 200 or 300 trees maybe we've lost and then of course we've cut back on some of the infected trees. Production was lost for quite a while.  One such control method that Vern and others use is the spraying of Streptomycin. Streptomycin comes from the bacterium Streptomyces grisius that's found in soil. It's proven to be a formidable foe against fire blight. But historically Streptomycin has been used as an antibiotic in the medical world. It was here in this building at Rutgers University that Albert Schatz and Selman Waxman first discovered the bacterium that produces Streptomycin. Streptomycin proved to be instrumental in checking the spread of tuberculosis. Today it is still used to fight TB of other diseases including bubonic plague. And herein lies the problem. Some in the medical community are alarmed by the spraying of Streptomycin for agriculture. They fear its overuse will lead to a biological weakening of the medicine. If true, this could have serious health implications. What Streptomycin does is it inhibits the making of the protein from the RNA. So basically it shuts down almost all metabolism in the bacteria. If Streptomycin is used extensively in their high concentrations then I think bugs which are in soil which will be exposed to high concentrations will become resistant. So yes it will have human implications. At least at this point in time one of the diseases that we really need to curb is TB and if for any reason mycobacterium tuberculosis becomes resistant to Streptomycin which it is becoming I think it would be a problem because we will lose what people consider a second line drug for TB. We should be very careful with how we use our antimicrobials. They spray with Streptomycin during bloom to prevent infections and growers are under scrutiny from people who don't understand why they're using it but there's really no data to help us figure out what the effects are. Microbiologist Jo Handelsman and her team are trying to get answers to this pressing question. With CSREES funding they are exploring the soils in orchards and other places for clues establishing what she calls a microbial observatory. We all think of observatories as being places that we look at the very very largest parts of our universe and microbial observatories are places where we look at the tiniest parts of our universe, the microorganisms that live around us. It is in this world of microbes that Handelsman believes the answers may lie. No question about it, microbes rule, they run all of the major chemical cycles on the earth, they make most of the oxygen that's available to us, they clean the systems that we live in, they clean the soil, they clean the waters but perhaps the most important use of the microbes is their production of antibiotics that are used in medicine. In fact, most of the antibiotics we use today in medicine are derived from microorganisms that live in the soil. It's in this vast new frontier of uncultured bacteria where Handelsman and her soil explorers work. Back at the lab the samples are sifted. The hard part comes when we try to extract the DNA from all of the microorganisms in the soil. This is the technology that we now know as metagenomics which involves studying all of the genomes of the organisms in an entire community. But Handelsman's microbial observatory extends far beyond the borders of Wisconsin. This is the Tanana River of the Alaskan interior. Today, researcher Roger Rousse guides his boat down these wild waters toward a remote island in the stream. His destination? The Bonanza Creek Experimental Forest, one of the more biologically pristine environments in the world. This is a braided river channel. It's a large river. It's one of the largest rivers in Alaska. The landscape is a mosaic of islands interrupted by back slews and the vegetation represents stages of development in response to disturbances, principally fire and flood dynamics. It's incredibly pristine relative to the lower 48. These forests are undisturbed by humans essentially. The very foundation of this laboratory under the sky is why Roger Rousse has traveled here. He is in search of soil, samples that may offer clues to the streptomycin issue back in Wisconsin. Roger has a fantastic ecological understanding of the whole ecosystem. The Alaskan soils are very interesting because of their geologic history, because of the climate and the vegetation in the islands that we study. But they also provide a very unusual habitat that has been exposed to very little human effects. That gives us a baseline of antibiotic resistance in an environment that has not been perturbed by humans and provides a nice contrast to the site in Wisconsin that has been managed by humans for quite a long time. It offers her an unusual set of conditions in the soils. The soils are characterized by extremely cold adapted organisms that are capable of dealing with very recalcitrant organic matter. Ultimately, we hope that by comparing the two soils we'll have a sense of what antibiotic resistance genes are present even when humans have not intervened. And that will give us some perspective on the apple orchard because we won't know in the apple orchard if any of those genes would have been discoverable in the absence of antibiotic use. Over 3,000 miles to the south the work continues at the University of Wisconsin's Microbial Observatory. Perhaps the answer to the streptomycin issue will be found in one of the Alaska samples sent by Roger Ruse. We simply don't know if streptomycin is going to have an effect on streptomycin resistance in the orchard. That's exactly what we want to find out. Now, as land-grant scientists meet the challenge of fueling America that's next time on Partners. Or on the Soil Explorers or other episodes of Partners' Video Magazine log on to this website.


Welkom back to Ceciano. It's Max from MaxCationTV. We are looking at the latest updates and we are looking at what is aspiring around the Gulf countries. That is exactly what we are talking about. What is new about the Gulf countries now? We are looking at the free visa. Oman announces what you call a free visa entry for GCC residents. This is something very interesting for those people that can have the opportunity. It is always the time for us to use the opportunity anyway. What does it mean that if you are working in any of these GCC nations? When you are talking about the GCC nations, it doesn't matter if you are a resident. It doesn't matter if you are a citizen or so long as you are a resident that has what you call a valid residence permit of that country. You can be able to visit or go to Oman on the free visa and return without being asked or without being asked anything. That is the latest development. So, meaning that if you are living in Qatar or if you are working in Qatar and you feel you have a valid residence permit, you have a valid visa which should be at least 3 months, you are free to visit Oman. That is according to the information we have. And still something that I need to let you know about the latest development is that you don't need to go back to your home country. You can still move from Qatar, go get a visa, then you can go to Oman. That is the latest information. So, meaning that this is a very great opportunity for people who are living in this Gulf country. If you are living in Dubai, if you are living in Kuwait, you are living in Bahrain, you are living in Qatar, you are living in Saudi Arabia and this is the opportunity for you to travel to Oman either for vacation or to go to see something or to do anything that you feel is in between. It is a great opportunity because you do not need any visa or it is visa free. All you need is the requirement is that you need that to show you are being paid. When you look at commercial professions, the meaning of commercial professions, we are looking at a profession where you are being paid salary. Which means that everyone that is either working in Qatar, you are being paid salary, right? Everyone working in Dubai, you are being paid salary, right? If you came from your own country. So, if you are paid salary by either your company or anyone, it is enough for you to move to Oman, your visa Oman and your come back. You should have what you call a valid visa. It should be valid. Then also something that you should understand, you should have what you call a valid visa. But remember in Qatar, if you have a residence permit that is valid, then that means your visa is also valid. So definitely this is the only opportunity, the great opportunity for us to have to visit some of these countries and to enjoy the visit or to enjoy the services of this country. Hope I try to share something. So for anyone that is planning to visit Oman, anyone who has had a dream before to go to Oman, it is a great opportunity, you do not need a visa to go to Oman. You need your residence permit. You need to show that you are receiving salary or also you need to know to show that you have what you call a valid visa. Then you can go and visit Oman. Thank you so much for coming back to the channel. Remember, it's Meks from the Meks situation. If it's your first time to come across the channel, please support this channel by subscribing. By the way, don't forget to hit the subscribe button because you will always be updated when we upload a new video. Thank you so much. See you again in the next video. It's Meks from the Meks situation TV.


So I'm Sam Bound from City College, San Francisco, and our snake has agreed to join me, which is wonderful, because I had a talk that was only supposed to be 20 minutes, and they gave me an hour, and coincidentally, three weeks ago, he wrote a wonderful new tool called Slow Lorsch. At least that's when I became aware of it, and I said, we've got to just add you to this talk, and he agreed. So there's two things you're going to get today, and the stuff on the CD is completely out of date. Anyway, the two things I want to show you, and I'm planning to be really quick about this, because I want you to do it. Now, how many people here brought laptops? That's pretty good. Okay, how many of you already have a Linux laptop? Okay, now look, that's good. Now, what you really need for this is you need two machines, or you need a machine and a virtual machine, which is how I wrote the instructions. Anyway, a little bit more about that later. But that's why I call it hands-on training, because I model in this after my classes, and my students do it this way at City College. So that's me. If you want to reach me, that's how to get me. And here's the two attacks we're going to talk about today. SSL strip written by Moxie Marlin Spike, not the new one he just talked about today, or yesterday, which is great, but I'm not ready for that one, the one he talked about last year, which sits in the middle and turns secure connections into insecure connections. And we're going to do that, and I hopefully all of you will also do it, and you can walk out of here with the toy to play with. And then Slow Loris, which is unbelievable, that just shuts down an entire web server with no more bandwidth than just a ping. And it's not the ping of death, it's a steady chain of incomplete HTTP get requests, which fills up a queue, and with very low bandwidth you bring down just the one server you're targeting, instead of a sin flood that's like a flamethrower just blasting everything down between you and the victim. So SSL strip first, I just went on the web, got a list of the most popular web 2.0 sites, and most of them are either completely stupid and use plain text authentication and you'll see them on the wall of sheep, or they're intelligent and they use HTTPS, which is moderately secure, I must say after listening to the talks yesterday, I have less faith in its security than I used to have, but in any case it does go through the motions of encrypting stuff and doing some pretence at checking with a certificate authority, although by no means as well as I used to think it did.   And this has been known for a long time, but telling people it's a bad idea is not as powerful as showing them it's a bad idea, and having you show them right in front of them when your laptop, why it's a bad idea, is even better, so my only contribution to this is theater. I'm just here to make it fun to hijack these sessions. So Facebook, for example, Facebook is an HTTP page, but the button when you click login is HTTPS. My bank used to be this way, and I fought with them for years, and all I could get was lies, and when I got enough complaints, then I would get elevated to next level lies, and I couldn't get past people that would just lie to me. This is totally insecure for a lot of good reasons. But anyway, the particular reason that makes it insecure that we're going to use today is that I can't see that that button is secure. So if an attacker puts themselves in the middle and they proxy the traffic, if I try to go to Facebook, I get the outside HTTP page, and the attacker creates a secure connection to the Facebook server and hands it to me in HTTP. So the page looks the same, the button looks the same, there's no clue the browser will not pop up a warning saying this page is insecure or anything, and I'll log in. I'll never know what happened. Now there is one way to know what would happen, although it's ridiculous to think an end user would do this, which is to look at the source code of the web page and notice that the method that used to be HTTPS is now HTTP, but that's pretty lame. And by the way, in the real world, there are a variety of ways to get in the middle. Now, the simplest way and the way that I believe they use here to make the wall of sheep is they just get in the middle. Some place there's a main access point for all of us getting to the internet at the con, and they just intercept the traffic there or copy it. That's the simplest way to get in the middle, but it requires physical access to the network. The one we're going to use here is totally lame because I'm not actually making exactly an attack tool, although it's very close to it, I'm just making a demonstration so you can see it. So we're just going to set the proxy in the browser to go somewhere instead of directly to the internet, to go to a proxy server, and that'll be the attacker. But of course, if you really want to do this to other people in a wireless network, then you do it with ARP poisoning, and I imagine this is fairly familiar ground with people. If I want to find the gateway out of my network, I have an IP address, and I have to resolve that to a MAC address, so I use ARP. And ARP is a really stupid, simple-minded protocol, and you can just trick it with a lot of fake ARP replies, and it will believe that the gateway is not the real router out of the room, it's the attacker over here. It'll pass my traffic over to them, and it's not hard to detect if you're looking for it, but most machines, client machines will just fall for it and they'll reroute the traffic. So these ARP requests and ARP replies will be tricked into sending your data to the attacker, and if the attacker then forwards it onto the gateway, you will see everything just fine, but the attacker can read everything you do and indeed change it. And the result is you'll see your network slow down a little, but we're also used to that, especially on wireless networks that usually when it freaks out. So let me just show you this thing working, and it got really easy to do because I spent the last couple of days writing scripts to make this more fun. So let me see if this works. Now that is supposed to look like that, by the way. That is not a mistake, but you're going to do, and actually at this point it's probably time to start these instructions going around the room because I know a lot of people tap away on their laptops while they're watching talks because I do it too. And I'm trying to adapt to this instead of resisting it. And so I want you to start doing it. So I brought along printed instructions and I have a couple of students that are going to hand them out. So if you want to copy the printed instructions so you can do it on your laptop, just raise your hand and these guys will try to get them to you. And you can follow along. I'm not going to do it step by step here, but I'm going to give you instructions where you can all totally do this. And it shouldn't be hard, and that's what I want to use the breakout room for. After this talk, there's people that come there that want to do it and have some kind of problem and my students and I will help you really get it working because I want you to walk out of here with a laptop with these attacks running on it. I think that's more cool than watching a talk. A talk without a demo is one thing. A talk with a demo is better and a talk where I can go play with it is what I really want you to have. Anyway, so let me go here. And so what I've done is I've downloaded Moxi Marlin Stripes SSL strip tool here. I just unzipped it and his tool just includes a series of little script files and I've added a few things like these pictures of sheep.  And the end result of that is if you get to the right directory and then that directory. Okay, then all you have to do is sudo bash defcon. What's that? What password do you use? Well, it's your... Yeah, that's right. Well, I'm using a really simple password, old Microsoft one, pssw0rd because I got no security. There, the wall of strip sheep is running. Okay, and it should be... Yeah, that's good. Firefox has crashed on me. That's to be expected. In fact, you're warning me about that. So this thing actually exits cleanly now. And that took me hours to make it work. And now I can restart it. It should launch. Ah, life is good. The wall of strip sheep. Okay, now we'll just shove that over to the side. And let's set up our victim here. Now, I said you should put yourself in the middle with some cool sneaky technique like art poisoning. But since I'm in lame, I'm just going to do it right here. The Linux machine is 172. 16, 8, 64. Okay, okay. And now let's move this thing over to the side. Let's try Twitter. And my name is going to be Twitter. My password is going to be CompleteFool. And then I log in. And Twitter noticed I was wrong. And I was wrong more than they thought because it just caught it right there. And that was supposed to be a secure connection. And like I say, these four websites are all vulnerable. Facebook. Facebook has this jazz so I can be FaceMan. And over here I can be Secret and log in. And that's going to go to Facebook. The Facebook server will decide it's no good, but I stole it here. And so I just took that team list of top 15 websites and I found four of them that were apparently the top 15 destinations or not ones I use, and they all work. This attack completely finds the password. If you go to another site that might not work and you want to see it, this is a script I wrote that looks for the format of how they lay the password out. If they don't lay it out that way, you can always hit this button to see the raw data, which is the raw output of the SSL strip tool. And that is here. And that is probably more instructive but not as much fun. Whoops, whoops, whoops. I'm hitting the wrong buttons on my window. There we are. That's what it really looks like. It caught a secure post, which of course should never have been read, but it is read because the proxy in the middle is able to change the connection to the client to HTTP. So it gets it into clear. It's a really simple attack, but it works really well. So I hope you guys have fun with that. And I want to show you the other one and then he can talk about it, which is Slow Loris. And I believe we got it working right before the talk here. So Slow Loris is even more exciting. And I think I'm just going to demonstrate it and not even bother with any more of those PowerPoint slides. I've set up a web server on my Windows host machine and I went to the hosts file and named it example.com for no terribly good reason, but that's what I did. Example.com and I put a file in there called sam.htn. It's just a copy of my web page just so you'd see something kind of pretty. And if I have trouble with this demonstration, we have a backup plan, but it was working before. Let me just put the IP address in here. I think that works better. IP address of my Windows machine, 262. I am proxying, but that shouldn't have any effect from this direction because that's Firefox on the Windows machine. These are good points, good questions though. However, let me just go back here. This is Apache running on Windows and I got it right here and I can control the Apache server and I can just restart it. Let's just do that. This is Vista, by the way. Usually on Windows 7, but this machine had the beta of Windows 7, the RC, so it's starting to freak out on me. Let's see if that did it. One more thing, let's go here. All right. Well then, we'll go to plan B. Let me hand it off to him and I've got another machine here. I'll get this working on this one. He tells you about. Slowlo's on this one. Hi, everybody. Hi, Devgon. I'm kind of in pain here, so I'm moving a little slower than usual, but what's that? Yeah, anyone got a beer? Yeah, come here. Wait, what is this? No. So, while he gets this set up, my name is R Snake. I run hackers.org and slackers.org. I also run a small consultancy in Austin called Sack Theory. So, I created this tool, I don't know, about a month ago maybe, and it got quite a bit of publicity for good and for bad, mostly bad. But I am not the first person to come up with this tool. Apparently it's been out there for, or the concept at least has been out there since like 2005, 2004 maybe even, which makes me look like I'm stealing other people's work, but I assure you I had no idea. It's mostly because I don't read every single page on the internet. I just don't have the time. But, so it was actually, I think it was Ivan Ristik who might have written in his book, and a couple other people mentioned it a long time ago. But anyway, one day I was in the shower, great mental image I'm sure, and I decided this, Patchy kind of does some weird stuff, and maybe it's vulnerable. So, a weekend later I actually had some code that actually seemed to work pretty well. So we shipped it off to Patchy, and Patchy had some very weird response. They said, this is expected behavior, go read this page. It's like, well, thanks. Go read the manual. Which is a fantastic way to kind of shove somebody off into the corner. Not a particularly good way to solve a problem. So if it's expected behavior, that's fine in everything. Cool. That's fine in everything, but it would be awfully nice if they'd fix it since I use a Patchy, and a lot of people I know use a Patchy. I'm going to switch mics here. So, let me start with a little bit of the background and what was actually going on at the time, sort of the ecology of the internet. So, Aran was having this election thing, and I consider myself fairly aware of what's going on in the world. You know, I listened to NPR, but I didn't know a whole lot about what was really going on. Well, it turns out there was this whole election thing going on, and people were pretty upset about it. Apparently there was some ballot stuffing of some sort, and something very close to Civil War, although I don't think it was ever called that, was breaking out. So I knew about this. This is something I was aware of, just because I listened to NPR in the mornings and the way to work. I didn't know about anything else beyond that, though. I probably should have done my homework.  The press reason I heard is up at the top there. Impossible tallies. There's actually more votes in certain regions than there are people. So that's a pretty good indicator. So, regardless of whether you believe all this is true or not, this is just the ecology of what was happening at the moment. Around that same time, a lot of people were using Twitter inside Aran to kind of message out what was going on, saying, oh, there's atrocities. People are getting shot or killed or incarcerated or whatever, and there's this guy named Austin Heap, or I'm not sure if that's really his name, but that's what he was going by, who is kind of leading the charge, helping people communicate out, creating proxies. And this is one screenshot where he's helping people create a VM where you can go and proxy through it. Incidentally, the username is root and the password is pound Iran, and the username is Iran, and the password is election. So if you install this, you might want to change that. Otherwise, people can own your network. So this is what was happening at the time before I released this. There was a bunch of people who were taking offense to all this and wanted to tell the Iranian government what they thought. So they were using this thing called page reboot. So you just type in the URL in JavaScript space, it makes a whole bunch of recurring requests, once every 30 seconds in this case, or once a second or whatever. So if you get a couple of thousand machines all at the same time doing this, it turns into a denial service tool that's distributed, which is pretty nice. So there was like hundreds and hundreds and hundreds of these posts all saying, go to page reboot, go hit this thing, and take it down. So meanwhile, I was, you know, totally unaware of all this stuff going on, and I was developing this really cute little tool that I thought was pretty neat it could take down websites. It was interesting because it was low bandwidth. It kept sockets alive, which has some interesting implications I'll talk about in a bit. It only affected certain web servers, so it's not the entire ecosystems of all web servers everywhere, but Apache is pretty big. So that was nice. It didn't work through load balancers, so I felt a little bit better about talking about it, so it's not going to take down like eBay PayPal, it's not going to take down Amazon. You know, it's kind of limited in what its usefulness is. It managed to work around what I thought was probably the best filter at the time, the HB accept filters, because accept filters only work with get and head. So I used post, pretty simple. So this is what the attack looks like. So you make a post request to some URL, carriage return new line. You don't have to put in the real host name. In fact, I didn't have to put in any host name, but this is nice if there's like segmentation of logging. You have logs go to one log file instead of the instead of the attacked one. So if there's virtual hosts, it doesn't look like you're attacking the target you're really going after. User agent, content length, which is just garbage information. And then some random header. So the very last thing should have been a carriage return new line, carriage return new line. Well, I don't put that second carriage return new line in there.  So it just, it's so slow that a patchy just sort of sits there and says, okay, well, I'm ready for the information. You know, whenever you're ready, any day now, I'm all ready. And IIS has the kind of opposite model, which is if you're coming to me and you're requesting data, that's great. If you're not, then you're going to have to step aside so there's somebody behind you in line. So that basically makes a patchy vulnerable. And incidentally, the reason why they are vulnerable is because they're trying to protect themselves from a different type of denial surface attack, which is creating a massive amount of load on the box. So the nice thing about this particular attack is that the load on the box is actually very, very low while this attack is performing. In fact, it's so low that if it's kind of a high traffic website, your load will actually go down in the process, which is kind of nice. So it's nice if you're the one who wants to use the website, right? So this is the secondary side benefit of this. If I have 256 sockets open or whatever the number is to the host, and that's configurable, if I have all those sockets open, why not use them? So if I want to be the only person on the website, why not just reuse one of the existing sockets and here's what it would look like. And then once I'm ready to actually start instantiating and actually performing requests, I'll just kind of use my own slow, lowest tool as a proxy and connect back. I never built that, but it would have been fairly trivial to do. There's a whole bunch of other side benefits to this particular variant of this attack, but ultimately it's pretty low bandwidth. It's about 4,000 packets to take down a web server for about five minutes. So pretty low bandwidth. So you saw Apache's response. Go read the documents on it if you want to. I did, and my team did, and we all went through it, and it really didn't cover this at all. It was pretty bad. Ultimately they are basically saying, we've known about this for years, accepted risk, we're willing to deal with it. So I sort of felt like it was time to go release it. I've done my due diligence, I've talked to Apache, they don't seem to care, it's been out there anyway, so let's go talk about it. Now mind you, I have maybe 20,000 people who visit my website, maybe 1,000 people on Twitter, so if I release it, a third of those people will actually read the post, a third of those people will maybe go download, a third of those people will actually care, a third of those people will actually do something with it. So it's kind of like, to me, it was sort of really not an issue to release this. So what was going on at the time, though, is Anonymous released this gigantic thing where they're manifesto about how they're going to go attack Iran and how they should be punished and so on. There's like a Twitter, I'm sorry, a YouTube video about it. And so the Iranian government was pretty much totally, all of their network was actually being totally saturated. You can kind of see one of their network connections there before and after. So it was pretty bad, it was taking down all of Iran, instead of just the websites that they were actually interested in taking down, the leadership websites. So they needed to be able to, the people inside the country needed to be able to contact outside of the country and because the entire Iranian infrastructure was going down, they weren't able to do that and so they're sort of pleading, please don't do this denial of service attack, you're hurting the people inside the country who actually need to be able to protest. Incidentally, the number of new tour nodes inside the IP space for Iran also shot up about 10,000% in a week. So in this ecosystem, me being unaware of all that junk, I released Solaris. Woohoo, isn't this neat? So I have one little thing, go check out my website, there it is, on Twitter and my own blog post and that's pretty much all it is. Things are pretty quiet for a little while, I would say a good half an hour hour, people were retweeting in here and there. Funny comments, sometimes some issues are face palm, egg on the face, we have accept filtering but not for post. People are kind of getting it, which I thought was kind of amusing. So at the same time, things are kind of flaring up inside Iran, right? And this is from Anonymous, Slow Loris, meet Fort Chan, Fort Chan, Slow Loris, Fort Chan, oh hi, Slow Loris, meet Scientology. Scientology, Scientology. So, yeah, good luck. So it also hit slash dot and this is kind of where it really exploded. I don't know who submitted it, so interestingly enough, I don't think the slash dot guys actually post very much anymore, but they did post on this one, they're like, please don't try it on us, but we think we're not vulnerable. So I think people, it's kind of a little fear factor, even though we weren't really advertising it as a horrible, horrible thing, it's just, hey, why don't we fix this issue? So then Anonymous on their own whyweprotest.net website started mentioning it, conventional DDoS attacks against Iranian targets, is this ways bandwidth needed for all Iranians, rather use something like Slow Loris, which can take down HP servers without using much bandwidth at all. This code just hit the wild and should be quite effective as slash dotted earlier today. Brand new technique, tool to bring down on a GDOD site without running bandwidth with Iranian rebels, blah, blah, blah. Great, okay. So then there starts, kind of gets another explosion on Twitter. Slow Loris is an interesting DDoS attack package, might be useful for Iranian elections without slowing traffic. Hey, our snake just started using Slow Loris to attack leader.ir. Great. And stuff I can't read. And 42 pages later, I think we have about 30,000 downloads from our webpage. Six, 7,000 downloads from Millworm. It's, I mean, I have no idea how many places have been attacked since then. So, yeah. So there's a lot of pages that, a lot of different web servers that are affected, some WAFs, some kind of interesting stuff, but really, I mean, Apache is the big boy, right? I mean, I think somebody was said, you know, it's great that WebSense, you can take down the block pages. I mean, I'm sure that people will find uses for a number of different stuff. And incidentally, this technique can be easily echoed into FTP and send mail and a bunch of other protocols that also have sort of similar issues. Internet StormCenter did three different posts on this and incidentally, they said the threat level was green. So everything's cool on the Internet, even though an entire country is going offline. It's like, okay, I have a feeling if that were happening in the United States, that would not be green, but that's just a wild guess.  Who are you?  And it turns out that it's low-large. I'm sorry about that. A friend of mine, like, oh, the CEO mentioned, slow, low or something was responsible for one of his attacks. You know, this guy said that IAS seemed to be vulnerable, which it's not in any of our tests that we did, so apparently other people getting hit by it. I have a whole bunch of other examples. I just need to kind of run through this. So Apache, someone issued a bug, I don't even know who it was, and said that was this is a problem, we should go fix it, but it was like immediately marked as resolved and invalid, so not a problem. We're writing this one off. And then, on their own private mailing lists, they're saying we all know our architecture is wrong and they have a wiki page for it now that says it has drawn attention on it to a significant weakness in Apache HVD. All right, so I don't see how those three things all line up with one another, but so there's website jerdab.ir which has a bunch of Iranian rebels on it with a bunch of circles over their faces saying if you have any information about them please contact us. So that's obviously a problem for people living there, so someone created an EXE version called Cyberware for Iran. It's a Q Solaris I don't know, I think someone just ported it over to EXE. If you feel like downloading an EXE and running it, and it's a denial of service tool, go right ahead. Good luck. So there's a Python version now. A PHP version. That questionable EXE version. I heard there's another one called SlugSend that's been out there for a while. And actually there's another Ruby version that just got released. Someone just mentioned it. And there might be more. I'm sure there's personal implementations as well. So Microsoft got in on the action. This is a must read if you use Apache to protect yourself against Solaris. From Michael Howard, there's CISO. I think IAS sales guys probably made quite a hit off of this, right? So mitigating it.  One, you could use a different web server, which is pretty scary because now you need to recode everything. You could use a proxy as a worker pool model, but that means you need to put something in line and trust that it also doesn't have its own issues. Or use a firewall, which could create other types of denial of service sending, you know, spoof, sin, flood or whatever. Now it's not taking down in a different way. You can use this mod anti-Laurus, mod no-Laurus, or user MPM. I've heard all of these things work. One of my favorite ones is that this guy is one of the developers and he said, oh, linear time search for each new connection on SHM signage will be modified in place by another process without locking. Awesome. What could possibly go wrong? Ship it. That's a race condition, everyone. That's bad. And then lastly, Apache can fix the problem because that seems like the most easy for me, right?  Seems good for me.  I'll start just a little bit more. You could add TOR into it, and normally putting it through a TOR node really wouldn't give you much lift, but in this case it does since it doesn't need a lot of bandwidth. Normally you don't want to do anything to slow down your DOS attack, but in this case it's not a very fast attack anyway. Proxy support, like I was mentioning earlier, so I can proxy through Slolaura, so I'm the only guy at a very, very large table. That's a great chicken, you know? The ubiquitous obvious next step is to turn it into distributed version, which I will never do. You can make it configurable, have it a user agent that's configurable and so on, which is, I mean, it's already open source so you can just modify it in place anyway, but it might make it easier for somebody. There's a web page I found that actually predates Slolauras with a whole bunch of different variants of attacks, so I could add a whole bunch of different attacks in there, but I'm probably never going to do any of these things simply because I think the point's been made. I think the real thing is that Empachi just needs to fix this, but ultimately I just hope Hezbollah doesn't kill me. Thanks everybody. Well, that's great. You know, I had no idea about any of that. Fabian Rodriguez came and took one of our classes and he told me this new Slolauras thing was great, so I decided to try it out. By the way, my demo didn't work earlier, right? That's because I forgot I left Slolauras on and it was killing my web server. Restarting it did no good. Duh. Anyway, so it's off right now. Okay, so I got a website here. I can refresh it. Blam. That website is on this. Windows Host. It's the Apache server. The Linux is attacking it. And if I attack it with Slolauras here, it's off. And, but what I thought is even cooler is if I stop attacking it with Slolauras, it's back. Now, this is not that this is beautiful and that's why I love this. I mean, I'm not really interested in taking out any websites or promoting any crime or anything. I'm trying to teach people how to do networking. I'm interested in all this hacking stuff because it's exciting. It makes students come to class and do their homework and stuff.   And I said that's what I want. I want my students to have that much desire to do their homework. So, um, so I try to teach them boring stuff like the OSI model, right? But now this is the point. You're one attack, right? You cut a cable. That's the most common problem. Right? Then you got Layer 4. Layer 4 is the old fashioned SIN flood, right? You're just going to flood the packet with the network with SIN packets. Every SIN that comes in forces a server to pump out a SIN act and then wait for an act that's coming and depending on which type of server software you're using it has different ways of remembering that there's one coming but anyway it has to do some extra work to wait for that. And so that's more effective than just sending in the same number of pings. But it takes a lot of packets to bring down a server because you're at Layer 4. Then I read about a company called Hactix doing a penetration test I think in Israel and they found that if you targeted your attacks at Layer 7 you could bring down a website with almost no bandwidth. Because instead of just flooding a network with useless traffic you hunt on their website and find what will really hurt them. Like you find their search engine and you make a sort search that has 10,000 results. Then you send that every second. And you have to send a little bit and they have to do a lot of work and they found they could bring down almost anything on their target with three laptops with DSL connections. You don't need a botnet but you have to customize the exploit to this website and that's a lot of work and this is the awesome tool. You don't have to customize it it works without any knowledge of the website and it works at Layer 7 so it wastes something they don't have much of at the server and you don't have to pump out any time. So with a 56k modem you can take down a real website. Anyway, so I thought that's cool that gets their attention. Anyway, so if you want to do it some people got printed handouts it's all on my website this is how you if you want to do exactly I've got instructions just step by step showing you exactly what to download what command to put in to do it my way which is on Ubuntu Linux, a virtual machine on Windows but if you have some other kind of Linux or indeed a Linux target as well as a Linux attacker that would be fine and since as I hoped we are finishing up early we will have time to help people do it and they're going to move me to a breakout room which is 103 in a few minutes here and if anybody wants to set this thing up or you want to help or you want to talk about anything you can come meet me there so we have plenty of time for questions you've got a microphone too, right? So I think we have like at least 10 minutes left for questions even like 20 minutes so yeah, go ahead Oh yeah, I did but it even dropped before that because everyone was trying I'm sorry, he said did I see the traffic drop after they stopped using the other tool and started using a slowloris? Well, slowloris doesn't send really that much traffic at all so there would have been really very very little of any sort of spike but it definitely dropped significantly after they stopped doing the other get request flood stuff There you go I'm sure they did I'm positive they did So why didn't they make it? Are you on IAS? I don't talk about my own security anymore The Iranian government did not contact me but I'm sure they will make contact any minute here You see a laser pointer at me just tell me to duck Well, I'm not seeing any more questions I guess we can end early That's alright


Storytellers were given the opportunity to share their words with the bigger audience thanks to the annual Northwoods Art and Book Festival. Lakeland News reporter Sherell Moore has that story. The 23rd annual Northwoods Art and Book Festival saw its biggest turnout yet with more artists and authors in attendance than ever before. Northwoods Arts Council is a small organization it's a nonprofit and we were able this year to get a five-wings grant which was just great to help with some of our publicity costs. Many vendors at the show have been coming since it began. Of course there are also some newbies a part of the fund this year. Organizers worked extra hard to recruit some of the most unique creatives to town. We want to expand it out and really help people know how great art can be and that it might not just be an oil painting you know art can be funny sculptures made of old junk you know art can be pieces of glass that are used as stir sticks. The authors in attendance also spanned a wide variety of genres. For example Jerry Hall was there to sign copies of his software and book about all the things he encountered during a bike ride from Alaska to Mexico called Downhills Don't Come Free. I pedaled out of Alaska solo and unsupported into the wilderness and I didn't train for this. The way I looked at it is yeah I haven't trained for it specifically but I have plenty time to get in shape along the way. More than 90 vendors were a part of this year's Northwoods Art and Book Festival and of course those vendors ranged from authors to artists themselves. A lot of the authors say it's a chance for them to meet their fans and even push their book out into the world a little more. For me it's wonderful to be with a group of people who are literate so interested in poetry fiction nonfiction they're readers they're great readers. For anyone hoping to be in the book festival one day registration opens up on January 1st. If you're just a book lover and want to attend the event is always held on the second Saturday in August. Having a book festival is maybe a little bit unique and especially since there's so many authors here that are taking their time they drive a lot a lot of them are from the Twin Cities. Reporting in Hackensack, Sheryl Moore, Lakeland News. About 50 to 100 volunteers from Hackensack also helped with this year's event. If you enjoyed this segment of Lakeland News please consider making a tax-deductible contribution to Lakeland PBS.