Record 585 scholarships issued by LTC Foundation. New housing project has a name, The Oscar. Wisconsin receives its first national bike route. These and other local stories are coming up on this edition of Community News Review. This is Community News Review. Service WSES TV News content provided by WHBL. I'm Maddie Fister and this is Community News Review for Friday, August 28th, 2020. The number of confirmed cases of COVID-19 experienced within Sheboygan County since the beginning of the pandemic began here in March, has topped 1,000. Thursday's update from the Sheboygan County Division of Public Health shows that 17 more persons received positive test results since Wednesday, upping the total so far to 1,005. 392 tests were returned in all, yielding a positive rate of 4.3%. More, nine more persons recovered, putting that active case number at 85, four of those are hospitalized. Statewide 10,791 tests returned in the last 24 hours and 878 or 8.1% were positive. The seven day average added up to about 8.2%. 11 more fatalities due to the disease were recorded, raising the death toll to 1,111 persons. 33 more persons were hospitalized since Wednesday. Of the 344 patients, 107 are in the ICU and 133 persons are hospitalized for symptoms, but still waiting test results for the confirmed 372 persons are being ventilated. Back in Sheboygan County, 13 facilities are being investigated currently.  The only facilities identify are skilled nursing long-term facilities where six investigations are underway. Those are Pinehaven, Drive Campus, Sheboygan Senior Community, Progressive Health Services, Sunny Ridge, Rocky Knoll and Sheboygan Health Services. One investigation is being conducted at a healthcare facility for a workplace related and one is an other setting investigation such as adult center, restaurant, event space or religious setting. And for the first time, an education setting is hosting an investigation. The County DPH on Thursday issued information concerning the process for publishing a list of schools with open facility wide public health investigations. And this list will be shared each Thursday, beginning September 10th and weekly updated. The release will include a list of the schools with open suggestions such as investigations last until two maximum incubation periods have passed since the last possible exposure to a COVID-19 case in the facility without any new cases. For COVID-19, this two period span is 28 days. What will not be included in the weekly update will be any differentiation between the age and or grade level of an active case and the number of cases within a facility. The full release can be found on LinkedIn in the County DPH's daily COVID-19 update at sheboygancounty.com. Beginning on Monday, the intersection of Taylor Drive and Union's Avenue on Sheboygan West side will be completely closed sending Taylor Drive traffic to South Business Drive via Indiana Avenue on the North side and Washington Avenue on the South side. The actions is needed for the sanitary sewer and other utility installations and improvements needed for the new advocate. Aurora Medicals Facility now under construction. DPH director David Bebel says that once utilities are completed, probably in mid-November, the road construction will be completed and the intersection will reopen in 2021. The next time you feel like bicycling across the state of Wisconsin, you can do it on the officially designated US bike route, US BR 30. The destination was conferred by the American Association of State Highway and Transportation Officials and crosses the state from east to west. The 269 mile route begins at Milwaukee and ends in Bluff Siding on the Mississippi River. No new construction was required at the route uses multiple times of existing local, country, and stake bike paths and trails. The alternate US BR 230 is used when the Merrimack Ferry across the Wisconsin River is not an operation. The US Bicycle Route system currently has over 14,000 miles in 29 states and Washington states, Washington DC and you can find a map and turn by turn direction for the US BR 30 on the Wisconsin DOT website. Two people are now confirmed dead and the other injured in Kenosha after an overnight shooting amid protests in Kenosha. A video circulating online shows a man with a AR-15 type gun running away from a group of protesters who were facing off with him and the police. The man falls to the ground and shots fire into the crowd dropping two people in the group. Another video shows a man bleeding with bystanders yelling that he had been shot, that he had been hit in the head and protesters have been ongoing in this city since Sunday when police shot Jacob Black in a 29 year old Black man several times in the back. Blake survived and was unfortunately paralyzed. Meanwhile, Republican lawmakers in Wisconsin say Governor Evers could have stopped some of the violence in Kenosha by simply accepting help from the White House yesterday. The White House yesterday says the governor refused an offer for more National Guard troops than Evers. Administration confirms that they refused an offer of the agents from the Homeland Security. State Representative Jim Stanky said on Twitter Tuesday night that Kenosha was burning while the governor was fiddling. The largest known housing department or development so far planned in Sheboygan now has been a great mission-based green screen development group. LLC had announced its plans to develop an apartment complex on the existing Van Deer Vart property on South 16th Street 11 months ago. And on the Thursday campaign, announced that it had been purchased and the property development name will be the Oscar. The name pays homage to Oscar Zimball who established his brick company on the site in 1888. The 17 acre site will be a fixture on a high density mixed use development of 240, one, two, and three bedroom apartments economically priced for the workforce segment and a new quick trip and a one and a one half acre for the use still being determined by that first phase and when it will happen. And this is planned to open up in September of next year. And finally, the needs of adult students trying to earn their degree in the midst of a pandemic and this related employment slowdowns have prompted the Lakeshore Technical College Foundation to award a record of 585 scholarships for the upcoming fall semester. And in a normal year, that would mean being closer to 150 Vice President of Advancement at TLC said Kristen Liphart said, thanks are allowed to donors in the community who has said she has really stepped up to the spring and summer to make sure all of us are helped and major gifts were received from the West Foundation Incorporation. The Bratz Family Foundation as well as numerous individuals and companies in order to keep the scholarship funds funding the LTC Foundation is conducting the Save the Seat campaign that hopes to raise about $100,000. About a quarter of that goal remains to be raised. And that is our report for today. Join me again next week for more local news and information on community news review. News content for this program provided by WHBL in cooperation, WSCSTV.


America's supermarket shelves, they've been called a tower of babble piled high with foods carrying confusing and misleading nutrition information. But that's changed. Recently the Department of Health and Human Services and USDA ushered in a new era in food labeling. And the new food label represents nothing less than a major victory for the consumer and for the public health. The biggest change is in the nutrition information panel. These panels generally contain information about a product's calorie, protein, carbohydrate, fat, sodium, vitamin, and mineral content. The revised panels are called nutrition facts. As part of the changes the serving sizes are much more realistic. Calories per serving are listed and now so are calories from fat.  Cholesterol, sodium, and total carbohydrates including fiber and sugars are accounted for. Protein is listed, along with vitamins and minerals, most important to today's American diet. But the biggest change is here in a column known as the percent daily value. It demonstrates how a food fits into the overall daily diet. In other words, if a food contains three grams of fat consumers will immediately know that's five percent of their total daily intake based on a daily diet of 2,000 calories. When you're given a percentage and you see that this is 50% or this is 10% of your expected daily total then you know very quickly that this food either contributes a lot of fat or a little bit of fat and how to plan the rest of your diet around this particular food. Some food labels will include a more detailed explanation of the percent daily value based on daily diets of either 2,000 calories or 2,500 calories. These footnotes will allow consumers to determine their intake of nutrients accordingly. Although many people consume more or fewer calories, these values can be used as a reference point and as a way to compare foods. By 1994, every food product in American supermarkets will have redefined labels. For raw meat, fish, and poultry nutrition information will be voluntary and expanded to include additional nutrients. Previously meat and poultry product labels could include the terms lean and extra lean based on the amount of fat that the product contained. Under the new regulations, the criteria for allowing those terms will be based not only on the amount of fat but on the amount of saturated fat and cholesterol as well. For fresh fruits and vegetables, nutrition information will also be voluntary. Many stores already provide it on signs and placards. The new recommendations do not apply to food served in restaurants. This food label, which will be on virtually all foods, will be a benchmark for nutrition information well into the 21st century. According to the Food and Drug Administration, these changes in food labels represent an important shift in the way Americans view nutrition and health. In the past, there was a lot of concern about vitamin and mineral deficiencies, but in the last 20 years, you're looking more at diseases such as heart disease and cancer, where sometimes nutrient excesses are much more of a problem. And the new label that's coming out reflects these changes. The revisions in food labels include standard definitions for words like reduced, free, and low. Words that have been pretty light on meaning. Also, for the first time, the new food label will explain how certain nutrients can prevent or promote disease. Make them at us from all directions. It's impossible to walk into a grocery store without being bombarded by sayings, slogans, words, and phrases that entice us to buy. They're called descriptors, but what exactly do they describe? People would look at a bottle of olive oil that said light and assume it was lowering calories or fat or some nutrients, and it turned out the company put that label on there because it was a lighter color or had a lighter taste. Now, as part of the revamping of food labels, all food descriptors will have standardized meanings, their definition set by the FDA. For meat, fish, and poultry, the same descriptors will be used along with new definitions for lean and extra lean. To be very simple, lean will mean a product that has about 10 percent fat in it, and extra lean will mean a product that has about five percent fat in it. For ages, certain foods have been thought to contribute to good health. Now, the FDA has determined the scientific link between nutrients and certain diseases, and for the first time these relationships may be indicated on the front and back of many food products. This product indicates that diets low and saturated fat and cholesterol may reduce the risk of heart disease. Others may indicate that calcium can prevent osteoporosis, or that low sodium foods may reduce high blood pressure. Diets low in fat and high in fiber can boast of reducing the risk of some cancers and heart disease, while fruits and vegetables high in vitamins A and C may also reduce the risk of some cancers. The health claims will only be allowed on those foods that meet very strict criteria. Foods which when added to the total diet and substituted for other foods will make it very easy for consumers to reach dietary goals for a healthy diet. The connection between diet and health has never been so well-defined. We've all been told, for example, not to get more than 30 percent of our calories from fat. But to make the link even clearer, the federal government has designed this food pyramid. It's built around five food groups. At its base are foods like breads and pastas that should be eaten in greatest quantity. Foods that should be eaten sparingly, like those containing fats, oils and sugar, are at the top. The new food labels will greatly enhance consumers' ability to build this pyramid each and every day.


Hello everyone, this is Amit Dan of AmitDan.com You're watching one of my Australia travel videos in the Great Ocean Road playlist and today I'm taking you to the Grotto The Grotto is nature made sinkhole made from the limestone formation by gradual process of erosion by wave and nature from the Great Southern Ocean It's like a part blowhole part archway part cave In the next few videos, I'll share my experiences in Australia with you Experience the beautiful Australia with me. Thank you for watching Forget about subscribing this channel forget about liking this video. I'll see you shortly


Hi, I'm Mike Murphy and welcome to the short, the news roundup from IBM Research. First up, the future of semiconductor research comes to UAlbany. IBM, the University of Albany, recently announced that a cluster of prototype IBM Artificial Intelligence units, or AIUs, is being installed on campus. The new cluster will allow students, researchers and faculty to run complex AI models that will push the boundary of what's possible in generative AI. These were built from the ground up for AI, and early tests have shown them to be more efficient than traditional CPU chips when it comes to AI inferencing. Next, a new way to protect AI models from attacks. We've all heard the horror stories about a self-driving car's AI model being tricked by hackers with stickers to run through stop signs at the car misinterprets, and it turns out there are all sorts of AI inferencing tools susceptible to attacks right now. And as part of a four-year program with DARPA, IBM has been working on tools to detect and secure AI models against attacks. The adversarial robustness toolkit originally designed by IBM now supports popular hugging-faced AI models, meeting AI practitioners where they are. So if autonomous vehicles ever do show up, at least we know that they should be safe. From hackers. Next, coupling magnets the size of a single molecule. Just in time for Valentine's Day, this is one of those stories that starts out small and will end up building to something massive. IBM researchers in Zurich recently had their work published in Nature Chemistry, where they reported they were able to synthesize a polycyclic conjugated hydrocarbon known as a deniflorine. I suspect it's even harder to have done that than it is just to pronounce it. The work was done under a combined scanning tunneling and atomic force microscope, operating at a cool minus 268 degrees Celsius, which is not much warmer than the vacuum of space. This was the first time that these tiny molecules' magnetism was actually controlled, and this could be super useful for future advanced sensors and a myriad of other applications. And in case you missed it, the AI Alliance is growing. The AI Alliance, the cross-industry group that believes open innovation is essential to develop and achieve safe and responsible AI, is expanding. The new members include the likes of Hitachi, University of Pennsylvania, Uber, and Snowflake. And they join others working to build inclusive AI, such as AMD, Meta, Intel, and, oh yeah, IBM. The Alliance is also starting two working groups focused on AI safety and policy advocacy in the field. For more on the latest innovations from IBM, make sure you subscribe to our newsletter, Future Forward. Till next time.


On December 4th, 2008, the library achieved a milestone that had been 15 years in the making. The library's archival staff released to the public a final collection of tape recordings capturing President Johnson's telephone conversations during his time in office. These recordings, made by LBJ across his five years as president, are a truly stunning collection of historical sources, almost 850 hours of tape that provide unique access to LBJ's decision-making, his personal style, and his personality. Thanks to the tapes, we can, for example, listen in on LBJ speaking with Martin Luther King just a few days after Johnson became president. Well, I'm going to sport them all, and you can count on that. And I'm going to do my best to get other men to do likewise, and I'll have to have y'all's help. I never needed more than I do now. Well, you know you have it, and just feel free to call on us for anything. Thank you so much, Martin. All right. Call me when you're done. I sure will. Call me when you're down here next time. I certainly will. We can also hear LBJ anguishing about the war in Vietnam, as in this revealing conversation from May 1964 with his National Security Advisor, Mick George Bundy. I'll tell you the more I just did work last night, think about this thing, the more I think of it. I don't know what in the hell we're looking at me, we're getting into another career.  I don't see what we can ever hope to get out of there with once we're committed. Historians now know that six presidents, Roosevelt, Truman, Eisenhower, Kennedy, Johnson, and Nixon, made recordings of their meetings and conversations during their time in the White House. But LBJ was the only one to make recordings stretching across his entire presidency, and the LBJ recordings surely rank among the very most revealing. One person who's carefully worked with the recordings is Melody Barnes. In 2020, Melody helped make an award-winning podcast called LBJ in the Great Society. Melody, what did the recordings reveal about LBJ that we might not otherwise know? I found when working with the recordings and sharing them with audiences that they are a treasure trove and a particularly poignant and powerful way to communicate about LBJ using his own voice, letting President Johnson reveal himself to audiences in a way that the written word just doesn't quite do. So it gives us a 360-degree view of Lyndon Johnson as a strategic master, and what he was really feeling as he was launching and driving the Great Society. Gradual release of the recordings between 1993 and 2008 reflects the extraordinary dedication and skill of the LBJ Library's archivists, who found the right technology to process this material, catalogued it, and made it available to the public. The recordings are now a valuable asset for anyone trying to gain a deeper appreciation of the Johnson presidency or the 1960s more generally.


Okay.  I'll go first. Just smile. It's not a bad laugh, just a bad day. Spoiler alert, it didn't make me happier. We can look at people and tell a fake smile from a real one.  Research shows fake smiles don't. Fake it till you make it definitely doesn't apply here. If you're sitting at home in a neutral mindset and smile, this may still trigger that neurotransmitter release and cause you to feel happy because nothing else was happening. Now, if you're really pissed that your youngest sibling just totaled your car, smiling may not do the trick. Your brain is already firing other neurotransmitters like norepinephrine to fuel the fire, so to speak. You can't go from one extreme to another with just a smile. Next time you're having a bad day, don't fake a smile. Take a moment to breathe it in and slowly exhale. The good times and real smiles will always come.


In this lesson, we're going to be changing our role around a little bit in this course. Up until now, we've been focusing primarily on learning about different types of ciphers and then using those ciphers to either encrypt or decrypt a message. But today, we're going to be looking at how can we decrypt a secret message without knowing the key? This process is called crypt analysis. The three main ways that we can attack a message by trying to get back to the plain text without having the key. We're going to look at all three of them a little bit today and we'll dig in deeper to some of these in the next couple of lessons. First off, we're going to look at brute force, a method where we try all the possible keys for a given system and see what comes out of them. The second method is using mathematics to try and reverse engineer a key perhaps from having a ciphertext or a plain text available for us to practice with. That's often called a known plain text attack, but often we'll see that we can a little bit later on in the course when a different type of cryptosystem called a public key cryptosystem, we can actually take one part of a key to reverse engineer the other part of the key. But that's a little bit beyond the scope of this lesson, but I promise you will come back to it later on in the course. And then lastly, we're going to look at using statistical analysis. It turns out there's a lot of hidden patterns and text both encrypted and decrypted that we can use to our advantage to make some really good guesses at what the key must have been to create a given ciphertext. Let's start by taking a look at brute force. When we consider the Caesar cipher, recall that there's only 26 valid keys that could be used to make a secret message. So for the given ciphertext we see on the screen, while it's not easily readable, it also wouldn't be too difficult for us to try deciphering it with all the 26 valid keys and just visually inspecting them to see what they look like. And that's what this code is going to do. We can see we set up a for loop that's going to iterate over the range from zero to 26, meaning it'll try all of the numbers from zero, one, two, three, all the way up to 25. Store them temporarily to the variable called test key. And then for each one of those values of test key, it's going to print out to the screen the word key, the value of the test key, and then what the plain text would be using the Caesar cipher when provided the given ciphertext, the current value of the test key. And we set in cipher equal to false, meaning we would like to decipher this message using the function. And when we do that, we can start just taking a look at what we've got. So key zero, P M O L O, I'm not seeing any words there. Same thing with key one, just a bunch of random characters it looks like. Same thing with key two, and we'll keep going. Nothing promising for key three, four or five. And we go a little bit further, key six, nothing. And key seven we can actually see here has some English words.  So we could spot this out of the list. And lucky for us, there's only 26 items on those lists. It doesn't take very long. We can see that because of modern computing power, the Caesar cipher from back in 300 BC is not really secure anymore. It probably wasn't even very secure for that long back in the day. Let's take a moment and learn about another cipher that's called the affine cipher. This was kind of a first attempt to mix up two different ciphers. So it's a combination of the Caesar cipher and the multiplicative cipher, each of which have pretty small amounts of keys. Caesar 26, multiplicative cipher, assuming 26 character alphabet, only 12 valid multiplicative keys. But what you can see is happening here is that the affine cipher is going to take our plain text value, multiply it by a key, a multiplicative key, and then add to that a valid additive key or a Caesar key. So to see how this would work, here's our plain text alphabet and some numerical correspondences. Let's just say our multiplicative key was three. We'll do that first, just following normal of operations, order of operations. So we can get our first round of cipher text, but we're not quite done. Now we're gonna add on an additive key. We'll just use five for an example here. And you can see that we can get the plain text letter A goes to cipher text letter F, plain text letter B goes to cipher text letter I, and so on. And what's interesting about this mapping from plain text to cipher text is that it would never have been able to be obtained by just Caesar, or just the multiplicative cipher alone, it required this combination of the two. Which means that this Caesar, and combined with the multiplicative, must be creating more potential cipher text to plain text mappings. Let's actually compute how many they would be. So if you look at this algorithm as defined, we would have 12 choices for our multiplicative key. Again, we're assuming just a 26 character alphabet, but if we were to extend this out, we could recalculate these numbers. We've got 26 choices for our additive or our Caesar key.  To get the total number of combinations, we can just multiply those numbers together and see that we have 312 valid key pairs for this affine cipher. That's a lot, it's a lot more than multiplicative or individualized, combining them gives us a lot more choices. So is this now secure? Is 312 enough that we could avoid a brute force attack? Let's take a look. Here we've got a similar idea. We've got our cipher text message, and we have two for loops. The first for loop for Ka for our additive cipher, it's gonna try all of the values between zero and 26. But for each of those 26 additive keys, we're now gonna do another for loop where it's gonna try each of the multiplicative keys. So if you look underneath at the output of the code, you can see it's gonna try, first the additive key is zero, and then it's gonna try all of the multiplicative keys, first one, then three, then five, and so on. And you can see none of those seem to be really helping us out. And we'll keep going through all of the additive keys. You have a little selection here. You can see additive keys at 13, and then there's some multiplicative keys of nine, seven, and 11. And then the last couple we would try maybe would be the additive keys of 25. And then just a small selection, a little snippet there, with the multiplicative keys of 21, 23, and 25. So we'd try all 312 of those. We have 312 rows to look for, and it might take a little bit longer to scroll. But believe me, your brain is again really good at finding English out of the gibberish, and you probably already saw this, but it was the additive key of 13, and the multiplicative key of nine, that got us this recognizable phrase four score and seven years ago. So while it might have taken a little bit longer for the computer, maybe only, I don't know, one second, as opposed to 0.1 seconds, our brain still does not take that much longer to parse through all the possible plaintext and pick out the correct one. So sorry, Affine Cipher, 312 value keys, still not enough to avoid a brute force attack. So are there any substitution ciphers that might be avoidable from a brute force attack? Turns out there is. If you think about our random mapping substitution ciphers, so remember, for any substitution cipher, there are 26 factorial different ways that you can map the 26 plaintext characters to 26 ciphertext characters. It's about four times 10 to the 26 valid keys, essentially, if you think about each mapping as a potential key. Now, that's a lot. That is much more than 26 or 12, certainly more than 312. And let's just kind of pretend for a second we wrote some code to do this. I'm not going to show you the exact code, just a little bit beyond what we know how to do right now. But here's our short five letter ciphertext letter, our characters, easy, w, w, a. And let's say we get the computer to actually run through all four times 10 to the 26 valid keys, our mappings. So we can see mapping one, two, and three, we get like r, i, r, d, d, n, that's not a word, w, o, z, z, q, that's not. And then maybe we're like, wow, we got lucky. Mapping number three, jello, that's gotta be the word. But the computer keeps running, it keeps going, and we got some other selections here from later mappings. Turns out that mapping there, three, three, two, four, two, three, two, four. Oh, that's hello. That's another English word I recognize. And so is the one right after that pizza. And later on down the line, there's penny. It looks like all four of those could potentially be the plain text. There's no way for us to know. And it turns out that might make sense, actually, because of every possible of map, we're going to try every single possible mapping of letters. Not just the possible ones for Caesar or affine or multiplicative, which is like this very specific algorithm. But we're literally going to try every possible mapping for a substitution cypher. Then we're going to get essentially every possible plain text word that follows the construction of our cypher text. Which means that we're going to have a lot of equally likely plain text lying around here. And there's no way for us to know which one is which. Setting aside the fact that to try four times 10 to the 26 valid keys, even if you you assume that you can try a million of them per second, would take you 930 times the age of the universe. So I don't think we're going to sit around and do that. This is a substitution cypher that can sustain a brute force attack. Just by trying all the possible ones. There's two things that are going to be working against you. One is it's going to take way too long for it to be feasible. And two, even if it were feasible, you're going to have a lot of potential plain text that you're never going to be able to figure out, which is the correct one. So we're quickly going to see that as our cryptography systems grow in complexity, the idea of using a brute force algorithm to crack those messages is going to become less and less helpful for us. Time and the possible number of plain text are going to pop out that seem reasonable are always going to be battling against us. So we're going to resort to usually more elegant techniques to help us crack a cipher text message. Let's take a look at using some of those mathematical approaches to do just that. So here we have the cipher text from earlier in this lesson that was obtained from the Caesar cipher. And let's suppose we knew just a little bit about this plain text message that that was encrypted to get it this cipher text. This is where the espionage or perhaps some lucky guesses about what the message is about can really go a long way to help you crack the code. So suppose we knew that this phrase in cipher text actually starts with the word if or if in the plain text message. Let's think about how that could help us figure out the key. Remembering our algorithm for the Caesar cipher. We take the plain text value add on the key mod by twenty six or whatever the length of your alphabet is to obtain the corresponding cipher text value numerically. We can convert that back. So taking the fact that we know that the first letter in the plain text is P which has a value of 15 and the first letter in the plain text is I with a value of eight. We could also do the same thing with the second letters M and F for cipher text and plain text correspondingly. And we can set up either one of these equations. We could say that 15s can grow into 8 plus K or in this case and 12 is congruent to 5 plus K both of which yield the same value for K 7 which if you go back in the lesson you actually see was the correct key. So this little bit of information allowed us to reverse engineer our cipher text with the plain text to get the key value. Now Caesar's as you've seen is not a very complicated algorithm. So let's see if this holds true for something slightly more complex the affine cipher that we just learned about. So again here's the same 15 characters that we had from our cipher text earlier in the lesson that were generated from an affine cipher. This is the one that started four score and seven years ago and let's pretend that we were able to make a guess that it was about that message and maybe we thought the first four letters were the word for F O U R. We can now set up the same type of equations using the affine algorithm. So in this case your cipher text letter is congruent to the multiplicative key times the plain text plus the additive key and then this case mod 26. So we can set up these two equations if we were right with our guests about the plain text word for we would know that six is congruent to the multiplicative key times five plus the additive key the six and the five come from the cipher text letters G and the plain text letter F and then the second equation we have nine congruent to the multiplicative key plus 14 plus the additive key and again nine and 14 come from the cipher text letters J and the plain text letter O respectively. So what are we going to do with these two equations these look a little bit harder to solve they're not just nice linear equations that we could subtract things from both sides we actually have a system of equations with two unknowns that we have to figure out how to solve. So let's take those two equations and set them up as a system just kind of rearrange them and tidy them up but the same two equations are here on the screen and we're going to use the what's known as the elimination method to solve for just one of these variables first and then use that information to solve for the other and by stacking these equations this way the first thing I notice is that we have these additive keys being added to both of the equations right there at the end and kind of similar to what we've seen with the Euclidean algorithm I'm starting to think maybe I could like subtract off one of these from the other and in fact let's let's do just that let's subtract the second equation from the first and when we do that we get nine minus six which is three on the left-hand side of the congruence 14 km minus 5 km gives us 9 km and the k a minus the k a they subtract out to zero or think about that is canceling out and now we're left with this congruent statement that has only one variable left to solve you know that three is congruent to nine times the multiplicative key so to solve for that multiplicative key remember we can't divide by nine or working in these modular arithmetic systems because we might end up getting a non integer which is not really helpful for us when we're trying to deal with numerical values that correspond the numbers and letters so let's instead of dividing by nine to solve for the multiplicative key let's multiply by the inverse of nine and in mod 26 remember the inverse of nine is just three so on the left-hand side we really get three times three and on the right-hand side we've got nine inverse times nine those two are multiplicative inverses remember the whole point of that is that just product is one so we're left with one km on the right and we can carry out the multiplication on the left to get our first part of our affine key we now know the multiplicative key used was nine and if you go back and rewind a little bit in the lesson you can verify yes that is in fact the correct multiplicative key but let's try and use that now let's go back to that first equation and let's plug that value in or evaluate this congruency when when the multiplicative key is nine to get this congruency statement nine is congruent to 14 times nine plus the additive key which means that nines congruent to 126 plus the additive key which means that negative 111 is congruent to the additive key remember we're talking about mod 26 so we can take that negative 111 mod by 26 and find out the additive key is congruent to 13 and again if you were around just a few moments ago you know that is the correct additive key for that ciphertext provided we worked with an affine system so we were able to reverse engineer that little bit of known plaintext pair it up with the ciphertext to get these two parts of the key that we needed and now that we know these two parts we can undo the rest of the message so there's a lot of power and just getting one or in this case two letters correct you can use that to get everything you need to unlock the keys and get the rest of your message in the last part of crypt analysis that we're going to introduce today is called statistical analysis and this one has been going on for a long time this idea of statistical analysis really starts with the idea of letter frequency which a lot of you I think you've probably already picked up in this course is that some English language letters show up a lot more than others which means that our ciphertext are going to have some letters that show up a lot more than others when we do those one-to-one mappings that we've been looking at so far and this idea has really been around since about 800 AD by this era of philosopher Abu al-Kindi who's been credited really for the first person to formalize this idea of looking at character frequency and counting it up and then using that to break ciphers of the day. So as I mentioned some of you might have already picked up on this or maybe you've heard about how the letter E is the most commonly used English language letter in fact the letter E makes up about 12.7% of all written characters in English whereas letter M makes up only like 2.4 so the full the full chart is over there on the right hand side of the screen will be using these frequencies in this course to help us make some good guesses about what are some plausible mappings of plain text to cypher text since we know we can't try all of the mappings we're going to be using some statistics and probability to help us narrow down the set of all of the possible mappings to just the most likely ones and single letter frequencies are a great way to start but we'll see that we can use two letter frequencies also known as diagram frequencies to do an even better job and we can continue to refine our statistical analysis so that we can really do a great job about figuring out what is the most likely key and that would lead us to the most likely plain text using all the patterns and statistics of the English language it's really powerful more than we can fit into this lesson so that's what we're going to start covering in the next sequence of lessons is how can we unlock the secrets of the English language combined with the power of Python to help us start cracking some more complicated cyphers


Hey, thank you so much for all your hard work in setting this up. Can the fine lady with the tiara stand up? Liora. Hey, Liora, everyone give Liora a round of applause for setting this up. She is the queen of details. Well, let's get this party started, everyone. Let me switch PowerPoints here. You know, I've been working with technology and code and software engineering my whole life and now I'm an expert in PowerPoint. That's really, wow, that's where my life is going. So I want to talk to you, this is a key note, I'm going to talk about a general overview of application security in some way.  It's something that's very happy because this is, in my mind, the ultimate puzzle in information security. And I look at traditional security and everything is quickly running to app sec because it's all about code these days, even infrastructure is code. So all of you in this room who are committed to application security, who care about this topic, in my mind, this is what information security is about. Let's give us all each other a round of applause for being here, yeah. So let's talk about the very unabridged history of application security, right? The point I want to make here is that things are getting extraordinarily better in the world of secure coding and application security, and nobody wants to say this, I don't hear this from anybody, but I want to give you some evidence and a debate and some speaking points of why things are dramatically getting better, we're moving in the right direction and we're going to see great improvements over the next decade in this area. Now the thing, and by the way, my name is Jim Annicole, I'll be your presenter today. I'm a former board member of the OWAS Foundation, I wrote a book on secure coding for the Java ecosystem, I invest heavily in the application security space and I'm based in Hawaii, D.C., whatever hotel I happen to be in, so I'm a traveler and I love the lifestyle of traveling and teaching, it's something that's very satisfying, it sates my wanderlust, it's a great life I have because of application security. I see several of my customers in the room, thank you all for being here and for working with me as well. Let's redact some of this and redact it, yeah there we go, let's move on. I want to start back in the beginning of application security or the beginning of information security in a lot of ways. This really all started back in October 1967, this is a task force that was organized by the Advanced Research Projects Agency, this is before DARPA, what led to DARPA eventually and this was a study to recommend appropriate computer security safeguards to protect classified information and this report was actually only written so well, RAN picked it up around 1970, published and eventually declassified this very famous report, February 1970, R609, the first really high end comprehensive report on information security from any major government that was declassified and sent out to the world to review. Anybody want to give me a guess or anybody want to take a guess, what was the summary of this report about the state of information security in 1970 in the U.S. government? Anybody have an idea here, bleep is messed up, it was bad, it was literally like every aspect of protecting information was fundamentally wrong and so, you know what, a lot of us today who are experts in application security, when you take a close look at what you're working on today, the code you're reviewing today, the organization you're assessing today, it looks bad and that's an interesting note about our industry in application security, the people that I know who are working on this problem, especially those who are really passionate about it, they're fatigued, they're a little downtrodden, they're beat up, why? Why is this app sec world that we're in, why does it weigh so heavily on so many of us? Anybody? It's rare where folks write secure code. How often did developers listen exactly what you say about security? Almost never. And so it almost seems like as we move down this path that it feels like we're taking two steps forward and sometimes five steps backwards and it's frustrating, it is emotional drain, there's a high rate of depression and even suicide in our industry, not even joking around, this is hard work that drains people but I want to take a look at all of this from a different perspective. Let's pull back everyone, let's take a look like at 1939 where bomb came out, the first professional pen testing tool. Anybody know what this is? Back in 1939, what is it, go ahead. It's a crypto breaking device, World War II, who is the lead of this project? He's on the currency for you Brits. Is it Turing? This pen test tool is made to crack German ciphers of the era, access ciphers of the era. And how do they build this with software? No, with hammer and nail and wire and cable and electricity, it was a large physical device that helped defend the free world and give us the liberty we may have to, let's just raise that idea for this, we'll get back to that later on. So jumping ahead, we have 1972, we have the Anderson report and Anderson made a lot of contributions to information security but for the purpose of this, I want to highlight two of them. In 1972, he pushed out the Anderson report which followed the 1968 defense science board's wear report in which Anderson also participated. But this report in 1972 came out after Rand. This really set information security research across the world for a decade and finally brought out some of the advanced principles of security defense for the first time, really changed the game around this era. 74, the Air Force starts testing on Amutix, right? 79, Lint early static analysis tools released, holy cow, this tool is still out there and some people are still using it. So we got Lint out there doing some, the original static analysis tool of the industry. We see the security administration tool for analyzing networks in 95. Anybody ever use this? How did this change things when this tool came out? I barely remember that. Wow. Okay, you're not helping. Who else? Who remembers 95 when this tool, when the state didn't first came out? This changed network assessment, one of the first really automated tools to take even lay folk and give them the ability to start doing assessment technology. And 1998, this is Jeff Forstall, right? On Christmas Day at a USNIC meeting is the first one to ever coin the term SQL injection. This is only 98 when SQL injection was first discovered. In 1999, we see cross-site scripting first described by Microsoft engineers. 2001, OWAS WebGoat is released. Why is WebGoat so significant to application security today, everybody? Why does WebGoat matter? Why did WebGoat matter back in 2001? Because for the first time, this very small application security community had a common tool to hack together. And we could suddenly talk about specific kinds of SQL injection, cross-site scripting, test control bypass on a common platform, and it became like the main tool that almost every security tester I know went through in some way. So it helped take all this scattered ideas about application security and give us a common thought piece to talk about. So I think WebGoat was extremely important. Who here has beat up WebGoat sometime in their career? So half the room here, it's a broken web app on purpose. Metasploit only came out in 2003. 2008, 2006, the first OWAS testing guide came out. I think this is, if you look at it as a book, it's not written very well. A lot of different authors. But the content within it is top of the game even now. So we have literally dozens of testers helping write this book around how to test security applications and web applications. Very important guide. 2010, we have Firesheet coming out. We'll come back. And OWAS Zap came out. 2013 is the beginning of the DevOps era. Only a couple of years ago. And what do we have today in 2019? Most major development shops now have some kind of automated pipeline that's doing some form of security testing every time developers touch code. So let's go back to 39, hammer and nail, making a testing tool to like keep the free world running at the time to today where most mature development shops are running static and dynamic and third party analysis tools every time someone tries to check someone in, something in. So pull back and look at this. Are we getting better? Oh, yes, we are in a dramatic way if you look at the history of software engineering. If you look at this moment in time and what you're doing, it is rough. We got to pull back and look at the big picture and let's do some more of that. Let's look at HTTPS. How important is this technology to the secure web today, everyone? What do you think? If there was a major break in HTTPS, what would happen to the web? It's done. So whether you like or do not like HTTPS, it is a fundamental foundational technology that keeps the web secure. It's gotten a lot better in the last 10 years. 1994, Netscape creates the initial version of HTTPS. Moxie Marlin Spike, who's like an activist in the area of transport security in my opinion, he went and called this original engineer and asked him about the creation process of HTTPS. He specifically asked him about the certificate authority system. You know what the original engineer who wrote that said? He said, oh, yeah, I forgot about the CA system. Yeah, we realized at the end we needed someone to sign our keys. So we kind of just kind of threw that in at the end in the last minute. And that is how the CA, I'm not kidding, that is exactly how the CA system was created. Some engineer with a hand wave threw it in there in the last minute and it's now foundational to transport security. 1999, TLS 1.0, something you should now disable. We're in the era where TLS 1 is dead pretty much now. If you look at SSL Labs, another evaluation engines, they dink you for using TLS 1.0. The only lowest level legit TLS 1.1 was pushed down in 2006, right? 2009, this is a big moment in time. SSL Labs releases their free tool from Qualls. I'm not particularly pointing at any vendors, but this tool, who uses SSL Labs in their work in some way? This is, I don't think it's just a tool. This is the standard for evaluating public websites. And when they push this out, and now some of you who know me, at times I'm a bit of a troll, just a little bit. I try to be a happy troll. But I went out and tweeted the URL to every single security company on the planet and their grade, like Symantec D.  And so, and I'm like doing the LOLs and oh, you got an F and could be in a little showboat about it. I had a lot of senior people from different companies say, please stop this, Jim, you're causing trouble. Ivan Ristick, who wrote this tool, showed up and said, I have a suggestion everybody, how about you leave Jim alone and go fix your freaking web server? Thank you, Ivan, wherever you are. Ivan Ristick is the author of SSL Labs. Still, I think one of the most foundational, fundamental evaluation tools for TLS today. 2010, Chrome starts to preload sites. It happened early, where in 2010, Chrome was hard coding their own properties and you can't use Chrome to visit Google properties and HTTP as early as 2010, right? And then, yeah baby, Firesheep comes out. Who had a little bit of fun with Firesheep? That's illegal, what do you talk? You shouldn't do that, that's illegal, sorry, whatever. Back in this era, back in the Firesheep era, which is, yeah, right around 2010, most major sites would log you in over TLS and then drop back to HTTP for performance reasons and Firesheep came out on OSX, you run it, run on a wireless network and you'll just see other cookies light up, click and you're that person and this really forced an entire industry to standardize on what we see today. You're doing HTTPS everywhere, well configured, or you're not doing security. Is there any excuse to use HTTP anywhere, anybody? Anybody wanna play that game with me? Is there, maybe to redirect HTTPS only, but there's no good excuse to use it anymore. Maybe to download updates that are properly signed. All right, let's move on, let's move on. 2011, we see the introduction of forward secrecy in modern ciphers, so even if someone steals your private key, they can't use that to break confidentiality of your connection. 2013, we see TLS12 go live, 2018, Let's Encrypt shows up and they take such a major stance in giving out free certs that we see some of the big commercial players start to sue them and go after them and that's a sign that Let's Encrypt is doing the right thing. It would be rude of me to point that vendor out who is suing them Komodo, that would be rude. I'm not gonna do that. 2000, 2016, half the web is now HTTPS. Chrome 51 now defaults to HTTP too. How can you do HTTP and HTTP version two in a modern browser? The answer is no. So this is a new protocol coming out where plain text communication and bad ciphers are not even possible as early as 2016, that's standard in the browser. In 2017, certificate authority authentication or authorization becomes mandatory so if rogue authorities start minting certs in your name, you're gonna know about it fast. And in 2018, Let's Encrypt offers wildcard. TLS13 goes live, published 8446 and almost immediately we see that live in several browsers and now certificate transparency is required for all new certs. These are extraordinarily high level esoteric ways to augment TLS, they're now standard in the browser. So let's go back, 94, what's the CA system? I kinda threw it in at the end. And what do we have today? Some of the most astute, detailed and effective protocols to lock down TLS are now standard in the world's most popular browser. That's where we've gone. We have come a long way in a very short amount of time and we're only getting better. And there's SSL labs, that's what your grade should be. Right, let's move on, let's move on. Let's talk about password history for a second. So let's start in 1961, one of the biggest password bugs, one of the earliest password bugs in history I could find. This is an old like a time sharing MIT device at an academic university. And you know what MOTD is? Anybody old like me, what's a MOTD? Message of the day. So when you log in, the administrator pops in the midst of the day. So they had a flaw within the system that the message of the day would walk through the messages and then walk through everybody's password. And so the message of the day as you log in and log out would be someone else's username and password. And this is, in my mind, how would you rate that bug? Would you go green?  You go red, he's going red. I'm going red too, it's pretty critical. But this is where we start around password security. 61, really early use of passwords and bleep is bleeped up, right? So let's move on though. 1970s we see Crip 3 released in UNIX and that's using an old M209 code from World War II Cypher devices. They literally took this really old piece of garbage cypher out of military grade hardware that was literally not used anymore and port that code directly to UNIX and that's how they're storing passwords. Password storage is important when your storage media is stolen. We can use supercomputing power to analyze that to crack a password. We see Hashcat as one of the big players in this area. In 1978, Crip 3 comes out. It's now DESP, DES-based. It's the first time we see a stretching part of a password storage algorithm. The first time we see salting and the first modern use of password policy. We're getting started now. But then in the 80s, the 80s were kind of like a dead area in security research. Very few advances from 80s to the 90s for some reason. But we do see UNIX access to the past WD database limited to only the root user. So they're starting to lock down authentication around UNIX for the first time in this era. 1991, MD5-based password storage. It's got some modern properties. We can do better than this. 94, MD5 is based on Crip 3 with 1,000 iterations and a 48-bit solve that can handle two to the 48th potential users. Now we're getting into modern password storage. We see 95, SHA-1's released and 99, we see Bcrypt release for the first time. And by the way, Bcrypt today is still an excellent choice for password storage. Anyone have an advice on how many rounds you should use on Bcrypt? 13 is the minimum that the hash cap pros have told me. Some people say 10. I think 13 is the right number of rounds to slow it down to stop even advanced attackers who've stolen your data. 2000, we see PBKDF2. This is good for military US applications, although it's the weakest of good password storage algorithms. 2001, SHA-2 comes out in 2007. PHP starts defaulting to Bcrypt, giving a whole generation of developers a great default in a common language to store passwords correctly. And Scrip comes out in 2009, which lets you even tune how much RAM each round uses to stop like custom hardware attacks. 2015, beginning of the modern era, we see Argon2 released. And now Argon2i, which allows you to have stretching, slow it down, consume memory, to even limit the number of threads operating on your ciphertext. Boom, we have a real modern algorithm that will last out the next decade. And in 2016, this is a really important date. This is Dr. Devdata Akue from Dropbox. He publishes an article on how Dropbox is storing their passwords. This is the first time a researcher actually describes the details of password storage from a programmer's point of view in a highly accurate and useful way. So this really begins the current era where you really gotta store a password using rigorous techniques, Argon2, salting, maybe even internal salting, good memory hardening usage, good thread hardening usage, and so on. This is the beginning of that era. And if you haven't read this article, I highly encourage you to do it. So now we're looking at OWAS, right? So around 2001, the OWAS Foundation began. This is, of course, the Open Web Application Security Project where a 501C3 charity, our mission is to make application security visible so that all of us, our customers, can all make good decisions on application security risk. I'm a board member of OWASP, I know the community. This is some of the happiest moments of my professional career, we're around OWASP. Some of the most miserable ones being a board member is not always the funnest thing to do, but that's a different story, but I'm really fond of the OWASP mission. I love it when people come in and try to organize us. I think half the brilliance of OWASP, it's not organized, it's chaotic, and people are doing whatever they want in terms of research in this area. So I'm a big fan of OWASP and the people within it. Around 2002, we see the first developers guide released from OWASP. 2003, the first OWASP Top 10 shows up. This is written by Jeff Williams and Dave Wickers in this era as a comment to the Sands Top 10, which was about infrastructure security and network security, and we did our own application security list as early as 2003. Unfortunately, PCI picked it up, right? And they said it was a standard. It's a top 10 list, but that's a difference. That's a different story. 2006, the OWASP testing guide work begins. OWASP reform and ASAPI come out. These are the first two libraries, really early era that help you stop cross-site scripting and are meant to be security libraries to solve some of these web security issues. At 2008, the first standard from OWASP comes out, the application security verification standard. I'm one of the members of that project. It's really meaningful to me. We just released version 4.0 recently, and I do believe it's one of the most rigorous standards for secure coding and for assessment professionals. I'm a big fan of the work of the team that puts it together. 2010, we see the start of ZAP, Mod Security Core Rule Set moves to OWASP. These are tools used in the ZAP. I mean, ZAP is a professional tool that goes head-to-head against BIRP in terms of its scanner capability. It's free and open source. Right on. That work started about nine years ago. 2013, we see a defect dojo. 2014, Juice Shop shows up from our friends in Germany. This is a full mean stack application, Angular, API, completely vulnerable as like a CTF to teach you how to hack. And it's frankly, it's a commercial product.  It's a commercial product. This is a Jordan Stimmits who just is obsessed about making this as high quality as he can. Understands his responsibility as an open source developer. Who's hacked a Juice Shop? Who's done Juice? Half the room again. You agree it's that sophisticated? I'm blown away by the detail in it. And as he publishes more and more, he drops all and puts these poppin' new labs into it too. So he takes it seriously. 2015, we get Jeremy Long showing up. Jeremy Long was working at Wells Fargo in this era. And he needed a third party library security solution. I won't mention the vendor. That would be rude. So they show up at Wells Fargo sonotype and ask him to buy their solution. And they're charging a lot. And he's like, I'm not going to pay for this.  And they walk out. That's what Jeremy started doing the next morning. Yes, sir. What did he do? He started building it himself. So he actually is the main author of the OWAS dependency check product. And this is literally another commercial product you can wire into your pipeline to check out if your third party libraries are up to date. I'm really proud of Jeremy. He wakes up at 5 a.m. to work on this to relax before he starts his day as a software engineering banker.  What else do we have here? 2018, the IoT top 10 shows up. That's how you know things have jumped the shark, where we have now like 20 top 10 lists on every topic there is. And 2019, just a matter of a couple of days ago, the OWAS cheat sheet series just made flagship status. And we have over 50 cheat sheets helping developers write secure code. So what do we start? We see OWAS founded in 2001 with like a one page web page and about 20 people who are just starting to get started. And then not too much later, what, like 18 years later, we have books, commercial products that compete with the public sector and a number of publications that are hit, literally tens of millions of times a year to help people write secure software. I know it's stressful. I know what we're doing is challenging. I know a lot of us who go home upset every day at the frustration of our jobs, you got to look back, got to pull it back and look at how things have changed in just 20 years and you'll see we're not just getting better, we're getting dramatically better. And take a look at the OWAS flagship projects that we have here. They are instrumental in application security work today, whether they're open source or not. So let's talk about one of my favorite topics, cross-site scripting, right? Cross-site scripting is, of course, content injection, JavaScript injection in the browser, in a mobile, in a web-based user interface. And this is a problem because there's been so many attempts to solve this problem. Anybody ever do an assessment with no cross-site scripting? One, tell me about this app. Was it a web app? Okay, it was a web app. Gotcha. Now, to do access to defense, you need to do contextual output encoding, you do HTML sensitization of untrusted HTML, you got to make sure using proper JavaScript functions, get your content security policy, embed JSON with serialization, make sure you do trusted types in your library. It is really tough. So to find an app that doesn't have it is extremely rare because of how complex the problem really is and how poor web standards are at addressing cross-site scripting. Cross-site scripting was first discussed in 1999 by Microsoft engineers. And in 2002, we see Microsoft rolling out HTTP only. Why is HTTP only important? What's that? It's not integrity. It's cookie confidentiality in the face of cross-site scripting. It's to stop JavaScript from accessing cookie data. And actually, you know, it's not even that important, I dare say, because if I get XSS in your app, I don't have to steal your cookie. I'll just force a request, which will automatically use your cookie anyways. I can do a stored request forgery. It's not that important. We still should use it. But as early as 2002, the first defenses at the standard level was coming out for cross-site scripting. 2005, go Sammy. Oh, yeah. Sammy, most of all, Sammy is my hero. This is the first time cross-site scripting was used to conduct a worm against a major social media site. This one little attack we're looking at right here took down all of MySpace. It blew screen the entire global cluster of MySpace because Sammy had forced someone else through cross-site scripting to do a forgery quest and make him a friend just by looking at his profile. And if you looked at his profile, you'd have a copy of his profile on your friend list, and if somebody looked at your profile, Sammy would be added to them as well. So you'd be added to Sammy's friend list as well. Within a few hours of releasing this attack against MySpace, Sammy had millions of followers, and that follower count was so high in loading from the database that the entire MySpace.net app at the time, problem, blew screened across the world and took days to recover from XSS. Oh boy. So let's go ahead here, 2005. Omicline releases a famous article about cross-site scripting DOM XSS. I don't even like the definition today. He says that it's a fragment that you can't see on the server. I don't agree. You can have a stored XSS that's DOM based and how it executes. So I think of DOM XSS is you got to write JavaScript code properly to stop the risk. Use Reactor, Angular, or low-level JavaScript correctly. 2006 reform comes out to stop XSS. The XSS prevention cheat sheet was first written in 2009. Again, Jeff Williams, the most heavily hit resource in the history of OWAS, that one guide. 2010, the goat love worm strikes Twitter. The second major XSS worm because of one malformed URL and how Twitter handled URLs. And even Apache's entire infrastructure was popped with XSS via 2010. A lot of people are like, I don't care about XSS. It's no big deal. That is not a good attitude. Sorry, folks. We've seen XSS do massive damage across the world many times in recent years. 2011, modern tooling comes out. We have Jeff Ikenowski, Professor Ikenowski, writing an encoder for Java, the only good encoder for the Java ecosystem. And around the same time, Michael Samuel from Google releases the Java HTML sanitizer through OWAS to do sanitization of untrusted HTML snippets. These are two of the most brilliant security engineers I know of and they open source their work. We had to twist their arm a little bit, but I'm Ceciline. We know how to do that. So 2011, the DOM XSS prevention cheat sheet comes out of Wells Fargo open sourced. 2012, CSP1. 2014, CSP2 in the original DOM Purify library. And 2015, we got CSP3 released. Take a look at the work of two Google engineers, Lucas Weischelbaum and Michael Michelle Spagnolo. They released a series of talks on how do you CSP3 with a very simple policy that you can roll out quickly and get a great defense across any browser and it degrades properly. And that's kind of the state of where we are today. Now, in the future, we see Chris Christoff who leads a Google Zero project. He just released trusted types in the browser. So as a programmer, you can programmatically set defaults on how the browser handles certain syncs in JavaScript. This is the solution to DOM XSS by far. So where do we start? We started with HTTP only and Microsoft engineers talking about this without good defense strategies to now standards being written that are effective in the browser to eliminate this risk altogether. I predict because of CSP3 and trusted types that XSS in under 10 years will be largely eliminated from our ecosystem of web applications. You can quote me on that. So trusted types, if you haven't looked at this yet, it is a key progressive future technology that we're going to see in our frameworks in the very near future. It's going to change the game in terms of browser security. Here's a few more important dates in AppSec history. Again, Netscape released HBS in 94. We see TLS in 99. Where am I going here? We did this already, didn't we? We're going to move on here. We're going to move on. We're going to move on. So now where are we today? AppSec is now global. I travel the world giving talks on this topic and you'd be surprised the countries and the people that still ask for these talks. It's everywhere in the world. AppSec matters. Small islands in the Pacific but small governments care about AppSec. The smallest companies now realize the code they're writing is their security and OWAS has 264 chapters of people just interested in this topics at a meet-up level all over the world. Again, 20 years ago this topic was not even discussed. Even five years ago very few folks were doing AppSec type of services and today is a global phenomena how much AppSec services, tools and professionals are needed. Are you with me on that folks? Who here is an AppSec professional? How many of you that are AppSec professionals are hurting to find work? Please raise your hand. One. That's a personal problem. No, so.  All right. Good to see you. Anyone know the unemployment in the AppSec industry right now? It's literally zero percent. Hey, Linda, are you looking to hire anybody in AppSec? Yeah, yeah. Get out of here. The mine. I get them first. If you do AppSec the world is your oyster right now and it should be because this is a hard topic. It takes years of ramp up to be effective and in my mind, AppSec is really where the rubber hits the road when it comes to information security. Yeah, you can go hack your pretty badge. I have fun doing that too. You can go parachute with your toaster and it's good. But my belief is those of us who are helping secure code who are working with developers, working with organizations to actually secure applications, in my mind that's really what information security is today. As we see the next 10 years progress as your infrastructure disappears and it becomes all cloud based your security becomes a YAML file. So code matters not just at the app level but at the end of the day. AppSec is not done and the work is extremely important as well. A few notes of how things have progressed. AppSec has become so important. One of our volunteers, John McCoy has led the charge to make sure OWASP does outreach at DEF CON. I'm really proud of the work John has done. He's been at DEF CON since the beginning. It means a lot to him and he wanted to make sure AppSec was here. Same with the folks who organized the AppSec Village here. We see OWASP doing that as well. I'm just really proud to see the passionate volunteers care to spread the word of AppSec in a community that's traditionally not very AppSec based. In 2018 OWASP gave out 35 scholarships. This is another amazing professional Zoe Baderman who runs Women in AppSec for the OWASP foundation. And we even allocated $25,000 just to diversity at our next big conference. I know this is kind of a diversity. Yeah, exactly. An inclusion. I know this is a politically charged topic just mentioning it upset some people but I think it's important to try to make a difference in this area because we've not done that good at this as an industry. The conferences I went to ten years, the things I saw are just not right. I like the idea of trying to clean up the mess to make our conferences and our community safe for everybody. Does that make a little bit less fun? I really don't care. I care about safety and I care about making places inclusive for everybody so we can learn together. And if you don't like that, go f yourself. Thank you. So let's talk about the future. What's going to happen in the next 20 years, right? So, yeah, aging. These are my like conspiratorial ideas and some reaching into the future. This is where I think we're going, right? So number one, all identity becomes tied to blockchain-like security architectures. It's hard to even say those words. I'm sorry. But seriously, I don't care about Bitcoin. It's all fake money anyway.  Come on, people. But the concept behind blockchain and the integrity behind it I think is really fundamental. It's tied to that so we have accountability at that area. What else do we have here? Hardware-based authentication and individual HSMs for every person on the planet will become the norm. And we already see that. We look at NIST Special Bulletin 863B, which is your homework. You got to read it. SP800-63B The Digital Media Authentication Guidelines for the U.S. Government written by Jim Fenton. Amazing piece of work to achieve AAL Level 3. This is authentication for critical infrastructure or you're handling billions of users' accounts in similar level of risk. You have no choice but to use hardware HSM. In fact, in European law with banking, you've got to use certificate-based authentication. So when I wrote this a year ago, it's now actually come to pass and it's already in the legal system. We're going to be forced down that path. I do believe like any other multi-factor technology that involves you typing in a number, it's vulnerable to phishing, it's garbage. We're at the era now where we've got to push to hardware like a Yubiqui type tech if we care about security. Bob Lord gave a keynote and he's like, look, I know we got ML and all this fancy stuff but I'm rolling out Yubiqui to everybody and I think that kind of back-to-basics thinking is going to make more of an impact than any MLBS we have out there on the market right now. Extremely secure frameworks in languages defaults are the norm. This is already happening. Anybody use React or Angular? Anybody assess React or Angular? How are your assessments? Is it easy? No problem? You're lighting it up? I'm saying when you see Angular, do you see an improvement? React. Do you see an improvement in security posture? Let me give you a quick hint though. Let's attack React six ways real quick, shall we? Real quick. Number one, dangerously set inner HTML. React prior to point one four, easy bypass. Embedding of JSON with string of phi, you can always bypass that with easy XSS. Anytime you're using props or types in a create element, boom, neither of those can escape. There's another easy vector. Five, let me see if I can pull this off. All the CSS stylers in React, they don't escape by default. You got to get in there, fix that code, CSS escape, native and JavaScript. Six. Let me see if I can do this. I said five or I said six? I said six. Sorry. Five. What was that? I'm going to come back to that. I got five. I'm going to go five. We got five. Five ways to pop React. Like I was saying, five. Cloud native serverless security functionality drives most software. That's not even that advanced. That's already coming to pass. What's the most important language in the cloud native world? If you're doing lambdas, what's the most important language today? JavaScript. Python. Oh, my God. Python. I'm a Java guy, so move to Python. Hurt me a lot. The most important language in the planet right now, by far, is JavaScript.  But we're stuck with it. No, I love you guys. I'm sorry. We're stuck with that now. Smart contracts. Whoa, whoa, whoa. Getting a little alien here. Smart contracts control most real world infrastructure. Interesting. Appset critical tasks augmented by AI type systems. Whoa, whoa, whoa. I'm getting, I'm getting, I'm going to put them all up here. What else do we have here? At the right key, Jim. Secure architecture design becomes common and mandatory. Why did I put that in there? Because it's happening in the world of insurance now where these these kinds of architectural views in the world of healthcare in the world of cyber insurance. It's now becoming the norm in certain industries where this is required and I think we'll see this trickle out to other industries as cyber insurance becomes more important and other industries realize, oh yeah, the security of our devices matter early on in the life cycle. We see an HTTPS will become the norm of the internet in all of our lifetimes. There will be a day within our lifetimes where none of the internet is playing text traffic. We're actually approaching that extremely quickly right now. We'll see that the current CA model needs to burn in a fire and we'll see more distributed CA systems that will take over the current centralized mafia style CA that we see now. Did my CA opinion, my opinions on the CA system come out in this talk? Yeah, I think they did. Automatic data sanitization and escaping is native in all major languages. We see that in technologies like Go. When you're using Go templates, it does extremely rigorous, astute contextual escaping by default. We see that in React. We see that in Angular and if we look ahead 10 years, it's going to be default and native in every UI type of framework out there. Because you know UI frameworks, any JavaScript developer is like, oh that's a nice framework but I could build it better. That's why we have 50,000 new frameworks published every five minutes. It's nuts.  You're out. Sorry, sorry. Data centric access control, native at the data level or not the kernel level in all major databases and OSs. One of the biggest failings of our industry is we have not done a good job helping developers build complex access control. The entire industry helps us solve the easy problems of role-based access control but when you have access control problems like multi-tenancy, data contextual access control and other complex topics, our whole industry fails to solve that. Someone needs to solve that and even the best out there don't because of how hard the problem is. I actually teach developers, most of you should be building your own access control system from scratch because commercial products don't address the hard problems and that's what we need to solve. So I still think access control is one of my top 10 items near the top of that list. So before I wrap this up, we're closing up just a few minutes. Does anybody have any questions about anything in the world of application security before we wrap this up? Yes, sir. Where is the queen of detail? Queen, my queen because she was not involved, she got involved, she made it happen and we're done. DEF CON is really about glorifying the hacker. DEF CON is about glorifying the beauty of breaking things hopefully for good in some way and it's glorified here at the most magnanimous level of anywhere else I've seen. So those of us who are doing app sec we tend to be of a builder bent even though we do pen testing a lot, we're still working with developers, helping people fix software, that's the real, to my mind that's real app sec work. That's very that kind of thinking is kind of counterculture to DEF CON but the world of traditional security and application security have collided so hard in recent years the app sec is no longer a secondary thing. App sec is information security in the modern era and that push is going to happen only more and more in the future. That's my opinion on that. You had a question as well, sir? Yes, ma'am. Honestly, that's all I have to say about that. I don't know. I'm not trying to be rude in any way, sir but my answer is, what was it again? That's all I got. All right, you're up. I'm sorry, ma'am. Yes. In all the studies I've seen a lot of big shops have done studies on this. They've looked at all different languages, frameworks and similar. Do you know what makes a difference in terms of the number of vulnerabilities per framework? The team building that code. So it really doesn't matter what you're using but you need to have in my opinion, you need to have number one an app sec professional who knows how to write secure code, embed it with your team day in and day out and you need to have mastery over the framework you're using a priori before you get rolling. Without those two things the chance of you using that framework securely is zero. That's why even among relatively decent frameworks you still see insecurity. Because the expertise to use these well is still esoteric. And so I don't care if using one framework or using 20. And if these are important apps to you you need to have expertise about a configure, use and code to those frameworks in a secure fashion or your chance of releasing secure software goes to zero fast. And in my world, I'm an educator. I teach to write secure code. I go back a few years, there's Java things that was easy. Now today there's this proliferation of frameworks I've had to bring in many other instructors who have specific expertise in each area to make my customers happy. This is brutal. The research needed to be done to teach developers about secure coding is getting rapidly more difficult in a lot of areas because of this problem. So if you do have a company using every framework under the sun, that's usually not a good sign in your ability to write secure code across the organization. I'd recommend doing a long process to reduce the attack surface to standardize a couple common frameworks. Get rid of the esoteric ones you don't need. It's easy to say, hard to do. That's why we're here to help solve this problem, man. Thank you. Yes, sir. Well, if you're writing a vulnerability in a web app, it doesn't matter if you deploy it locally at your company or in the cloud, that is still there. SQL injection still lives in the cloud. So in my world, the cloud has only changed the world of secure coding so much where my bet was wrong on that concept is the whole idea of a YAML file. So much of your infrastructure is now code. And I did not see that coming. Did anyone see that? Did anybody see like four years ago, besides Jack Minino? Anybody see that? Hey, what's up, Jack? How you doing? Jack was telling me this four years ago and I was like, I'm nuts. He was right. He's like, all of infrastructure is changing to source code. And that's something I didn't see. And being able to lock down your cloud configuration, guess how many static analysis tools look at that well? None right now. It's a hard problem. No diss to the vendors. So, yeah, this is a rapid evolution. The cloud is going to dominate obviously. And it doesn't stop our responsibility for writing secure code at all and our infrastructure is moving to code as well. We have to assess that configuration as well, which is really difficult to do right now. Hey, that's why we're here. What's that? What about it? I personally think containers are dead and I think the real future is serverless technology. I do not want to maintain a container. I do not want to maintain a Kubernetes cluster unless I really hate myself. It's a complex style of BS I've ever seen. Even though it saves money, I don't want to have to tune infrastructure anymore. I want to go new lambda, drop code, have it run 50 million security tests and I'm live, baby. That's the future of computing. Not containerization, not Kubernetes BS, not OpenShift, but drop code and run serverless. That's the future, in my opinion. Jack? We'll drink about it. Web application firewall. Ooh. Ooh. I'm a founder of Web Application Firewall Company. I can't answer that question objectively, but I'm going to quote Jim Bird. Even though I've invested in one and I care about the space, I'm going to quote not Jim Bird, I'm going to quote, I forgot his name, but he's one of the largest executives who ran software security programs for the healthcare world. WAFs are for wimps.  That's really my take on it. And I founded a WAF company. Let's move on. Rust. Rust is the future, I think. Rust is such a brilliant language. One more question. How much time do we have? Where's the time, guy? Ten minutes? You like Q&A? More Q&A? What you got? IoT. Really low-power devices that can't do TLS and stuff like that. It's the same problem starting over. A lot of the IoT device comes from manufacturing. Anybody work in manufacturing? How good is manufacturing at doing software engineering? Exactly. I need to consult an expert in manufacturing software engineering. Ma'am, what's your name? Iris, how do you think the manufacturing industry does at software engineering? Really bad. It's horrific. What's the problem with IoT? So many IoT devices are coming out of an industry with zero software security culture. In fact, let's go back in time. Brazil 2015, ASUS Router was given away as part of your internet service to third of Brazil. And this router, if you're in Europe, router if you're American, right? This had two vulnerabilities. You can hit the Change Password feature without being logged in and the Change Password feature didn't require the original password. And this was given out to a third of Brazil. So five million people get C-surfed and have their DNS settings changed to an attacker-controlled DNS, which was trying to get banking fishing across every South American and Mexican bank they can get their hands on. This is heavy duty. I actually hunted down the product manager of that router as a research project, right? I found him on LinkedIn and he's retired. He's like, hey, can I talk to you about this ASUS browser? Oh, sure. I'll tell you anything you want. I'm retired. I don't care. All right, this is going to be great. How did that router with those vulnerabilities go? I remember them well. I saw the paper. How did that get out of security testing? And he starts laughing at me. Guess what the next comment was? What security testing? But I'm pumped. Next question. There's my IOT answer. Yes, sir. What's that? This is like the successor to FIDO for hardware authentication, right? I don't know the details of it, but those I know who research it and are astute, I think it's a huge improvement on FIDO. Remember, I'm suggesting hardware based authentication is the only possible secure future for identity and Web Authent is going to really make that a reality across web apps. Let's see what happens, right? Ubiqui rollout is pretty small. Who is maniacal using a hardware token for all authentication? Only like 5% of the room and we're security professionals. It's not easy to adopt. A couple more. What we got? Yes, sir. What's that? Mongo. Magno.  If you're a security professional and you want your career to continue to advance well, you need to learn the basics of how to code. And when I say this, a lot of people's feelings get hurt. I said this on Twitter and several pros block me out. And one of the guys that blocked me out from DC is a friend of mine and I'm like, why did I get blocked out? What happened was he just interviewed for a job a very big director position at a big software security company. This is a guy, no, he's super smart. He didn't get the job. Guess why? Because he didn't code. And I felt bad that I unintentionally rubbed out any block me and he will not speak to me to this day. I feel bad about that. But he should learn how to code. And I don't... I don't I don't mean this meanly. Learn a little bit about HTML. Take a few basic classes on secure coding. It's all just software engineering. It's all free on the net now if you want to learn. So honestly if you're an AppSec pro and you're not willing to take a little bit of time to learn about software, just a little bit to learn about code I think it's going to do harm to your career. You'll still be successful. You'll still get stuff done. But learning how to code augments your career in so many ways. And I'm going to bug Jack for a second. Here's what...  Am I right? Am I right? It's mutual. But there's one thing I've always respected about Menino over here. He's now like a CEO of a company with a lot to do. How often do you code in Jack? Every day. He's a CEO of a company and he's coding every day to keep sharp. That's what you want to do if you want to get ahead. Jack! So one more question up front. Set requirements. Go grab ASVS 4.0 Grab your lead developers, your lead architect and your lead security folks and set a definition of what AppSec is going to be for your company. I'd use ASVS 4. There's about 284 requirements to base that. Now, and pick which level? One, two or three. I don't care. But I have some requirement lists. So we all have a common definition of what secure software is going to be for organization. This is a little bit self-serving but I don't mean it to be. This is what a lot of the other SDLC say. I would also rigorously train your developers as early in the project life cycle as possible. If you're training them at the end, it's the worst place to do it. Early on, just some basic training. I don't care who you hire. So that all your devs understand the basic OASPY type of risks or whatever the risks are specific to that platform. Three, I would make sure early on in the project that whatever frameworks you pick, that you go out of your way to have someone be a massive SME, subject matter expert in how to secure that framework from a programming point of view. And everything will flow from there in my opinion. That's my take on the world. Not a very popular one, but it's my take on how to approach AppSec from a software engineering point of view. I'm John McCoy and Zope Raderman for helping with the research of this presentation. And I want to thank you in the room for helping the world be more secure, have a great DEF CON, and go forth and write secure code, and help your friends write secure code. That's how we lock this stuff down. Thank you very much, everybody. All right.