This is Kevin Sheldrake. I've seen Kevin speak a bunch of times. An interesting guy has a lot of interesting security knowledge and practices and he's decided to apply that to some more accessible technology here and he's going to talk to you about taking over the world with scratch. So please welcome Kevin. Thank you very much. Wow, that's loud. Thank you very much. I have my slides appeared on the screen. It looks very blue from here. If it says taking over the world with scratch then we're good. Okay, that's almost. See, when they said draw first on I thought this is a great idea because I can't be drunk at this point of the day and therefore this talk will go... Excellent. Okay, so I am Kev and I'm talking about taking over the world with scratch. I've been asked if I can do this quickly so that they can gather some time back during the day so I'll talk fast but don't worry, come and ask me questions afterwards if you like. I work as a hacker for a company. I hack into things and I research hacking tools. That's my kind of job and in my spare time I build Lego. This is scratch and what I was interested in was can we connect it to say MIDI instruments or make it talk out loud or connect it to Lego or possibly even use it as a hacking tool so that we can hack into other people's computers on a network. What could you actually do with scratch was my kind of thought. So I got to work on the hacking bit because I thought that was the fun bit and managed to get it published in this article, Pockwell GTFO issue OX18. You can find my fun memory corruption exploits for kids with scratch actually made it into the journal. So I'm very proud and that gives it some validity but we'll talk about the other stuff first. So let's talk about scratch. This is scratchy or scratchcat. I'm sure a few views scratchy will be aware of the scratchcat or scratchy. He's going to peer all the way through. Scratch is developed by MIT. There's a couple of different versions so version 1.4 is still around and supported. Version 2 is the one that I use and you can get an offline version of that which is written in a different technology and version 3 is on the way. The last time I looked it still wasn't operational but when it comes it will be written in HTML5 and JavaScript and it will probably be more whiz banging and much better. It's taken a good 10 years to get from the first version to the second given some leeway to get to the next one but it's been around for a long time scratch. Normally you do it online so you use your web browser to go to the scratch website and then you can just start typing scratch. You can start scratching as the terminology is but when my son wanted a computer he wanted to upgrade from scratch junior on the iPad to scratch on a computer I decided that the internet wasn't quite ready for him and I should protect the world from my son so I didn't give him internet access but in order to give him scratch I found there's an offline version which will run on your computer and that has experimental HTTP extensions which always sounds anything experimental sounds exciting so I thought this has got to be something worth investigating. We'll talk a bit about what scratch looks like so I haven't got a laser pointer or anything so I'll describe things but on the left of the screen you've got the stage which is where your game or your application is kind of running down the middle you've got all your tools all your blocks organised into 10 categories here we're looking at motion blocks so you can move a sprite turn it around point it in particular directions etc etc and then on the right you've got the code behind that particular sprite so the sprite that's selected there is the turtle this is the code behind the turtle that makes the turtle work it's kind of object-orientated in the fact that every sprite and the stage itself all runs code concurrently and it's kind of event driven so you can see each section of code starts with an event most of those events are when I receive a particular message and so there's a message driven kind of system where different objects can send messages and different ones can receive them to know that stuff's happened. If we look at another look at the data section of that sprite you can see that there's blocks essentially for all the different variables defined for that sprite now two of them are ticked that means that they're visible on the screen on the stage so apple count and coin count are actually the two zeros underneath the star and the apple on the left and those variables can be local to the sprite or global to the whole application so if we move on to a different sprite the maze you can see that some of the variables stay the same if I flip between you can see only the apple count and coin count are common between them that's because they're global variables not because they're ticked tick just means that they're visible but they're global so every sprite can access them reading right to them otherwise your variables are local to the particular sprite or the stage and you can see that they have different code each sprite has its own set of code so what we can say about scratch is that we have variables which are either global to the entire app or they're local to a particular sprite and we have blocks which are basically procedures so they don't have any return values so everything you do is buy side effects so your modifying variables that are like global to the sprite or your modifying variables that are global to the whole application there's no kind of like I want to call something and get back an answer you kind of have to set a variable as a side effect and then read the read the variable which makes it a bit weird so I mentioned experimental HTTP extensions so don't worry about the word experimental it does actually work the way you get access to that on the offline version normally you would click file to get to the file menu if you shift click it you get this super secret file menu which includes among other things import experimental HTTP extension now it's not a widely documented API but it is documented you can get to it the way it works is you end up running a web server on your local machine on a particular port it has to be on your local machine it can't be across the network and that will generate a s2e a scratch to extension file which describes the extension and that's the thing we're going to load when we import the experimental extension and then when you that will give you extra blocks in the more blocks section when you use those blocks it will make an HTTP request to that local host web server to say I want you to run this block with these parameters in order to access the variables that the extension offers up it polls it 30 times a second over this HTTP interface which is mad but it that's kind of the way it does it there's no other way of getting there because everything's a procedure there's no return value so it kind of just keeps on polling um the so it kind of like pictorial it kind of works like this um you could make scratch run a procedure that's in your extension that could modify a variable as a side effect and then it will poll those variables 30 times a second so the variable will have changed almost instantaneously in your scratch environment and then you can act upon the value that got changed you might have to have some state variables in order to know when something has changed in order to know to read the answer for example now the sort of thing this is useful for is robot arms I think that's what all scratch extension frameworks are kind of designed for and the idea there is that you're you're either moving the arm moving the motors that makes the arm move which have no return values it's just turn motor on turn motor off change speed et cetera change angle and then we have things like limit switches which are the reported variables and again you want to know when you hit a limit switch pretty soon hence the idea of polling 30 times a second so you can sort of see that that's what this is sort of built for but I thought what if I kind of plug in a MIDI instrument and I create blocks that turn on notes or turn off notes or send change events would that could you do that well we did and it's and it works and it's not the best sequencer in the world but you can write a sequencer in scratch and more interestingly if you're writing games in scratch you could plug in something like an MU 50 or some other kind of outboard module you can pick up on eBay and you can have really great sound effects for your games you might not be wanting to like program music but you might want a few bangs and zaps and helicopter noises and stuff equally could you make it talk that is another thing my laptop can talk why can't we have scratch actually speaking out loud another one was Lego so we have a lot of Lego me and my son and we have motors and infrared controllers and that was kind of one of the places where we started which was could we get scratch to control those motors because that would be like quite a lot of fun getting outside of scratch and actually making something in the real world happen and finally can we turn scratch into a hacking tool and break into somebody else's computer because why not you know if technology is there to be abused let's let's abuse it you know I mean of course the fun thing for that is that if you're writing data to a socket that could be a procedure if you're reading data from a socket you kind of do it as a procedure which means read from this socket and put the answer in a variable and then set a state variable to say you've done it and then check the state variable to see that your answer is in the buffer and then read the buffer to see what you got back pulse 30 times a second it's a perfectly sane framework so now writing these extensions is actually quite easy because someone wrote a Python module called block x and you can get that from a github it's the best way to install it I wouldn't install it from any operating system packages I would literally go to the github download that or clone that repository and run the setup.py and it will install and it's and it works perfectly any other way I've found doesn't work so well but and it says on the on their github that this is a band and where like no one is supporting this anymore but it actually works so honestly it's useful and they linked to a tutorial which will explain how to do everything which I'm going to touch on briefly as we go so this is kind of how an extension looks in python um so what at the top we're importing that extension block x the green bit is our class that we're going to define which is going to be all of our extensions program program essentially so variables that we're going to expose procedures that we're going to let scratch call the yellow line the descriptor that it describes the extension to scratch over the api and then the next bit of the bottom links the descriptor to the object and then runs it so that it appears as a web service so scratch can talk to it so I'll give you an example of why of how easy that actually is so that all looks a bit complicated but it's actually pretty straightforward and I'm going to use say so if you have a mac you'll know that if you type say and then a message it will speak it out loud if you don't know that you should definitely do it especially if you log into somebody else's mac remotely over a network when you're not physically there and you make their mac talk to them and whisper is one of the voices which is especially creepy um so the example my object my say object only has one procedure which is say because that's the only thing I'm going to do and it takes two basic arguments the statement you want it to say and the voice you want it to say with and if you haven't set the voice it will set it to Alex which is one of the default voices and then it literally calls out to the operating system and runs the say command minus v selects the voice and it literally says whatever you are to get to say so that's the whole of the object the descriptor is slightly longer the descriptor tells scratch what it's called what port it's running on what blocks it's offering which is essentially there's one block per procedure in your object um or exposed procedures in your object and then the dictionary it lets you create drop down boxes in your scratch command so in the block description it says say percent s with voice percent m dot voices so percent s means put a string in there so there'll be a box where someone can type in words which will be the message percent m dot voices means we'll have a drop down menu and it'll be called voices and the in the bit the bottom of the dictionary voices runs this crazy command which will go and collect me all the voices that say can say that are English so we'll have a drop down menu of voices and so that is the whole of the code for the say extension right and the white bits are pretty common to every extension we all have done is created an object and created a descriptor and join them together that's that's literally it so when you run it up you can then browse to the port it's running on so port 5000 in this case and it will give you the option to download the extension i don't know what a snap block is i don't really care but this scratch to extension file is one one that's the s2e file that's what we'll load into scratch under the experiment extension so let's do a demo here is scratch there is my scratchy scratch cat no from my mouse so in here if i run my extension which is that one there it's listing on port 5000 in scratch we can shift click file and import experimental ht3 extension and it's going to be that one there the s2e file i've already extracted it from the web server and now i'll just close him up a little bit in the more block section we've now got one extra block which is say a message with voice and then a voice so let's make that term and then we'll make an event when the space bar is pressed say that message with voice alex and so i can hit it oh i don't have any why don't i have any audio oh no since they plugged in the hgmi i've lost my audio right one second this is clearly um clearly a well tested setup as you can tell i guess you can still see the scratch stuff yeah okay i'm sure how we go for do that and go back to here how does this make you feel which is a joke obviously thank you very much if we change voice how does this make you feel how does this make you feel and we can select a different how does this make you feel so and there you go so from scratch we can now make my mac speak and on linux we can install speak libraries and we can do the same thing on linux on windows you can do the same thing if you install something that will make windows speak but as you can see the python extension was pretty trivial the actual amount of scratch we need really trivial but now you've got an extra element to your game or your application scratch is now talking to you so we cut back to the slides um i say we cut back to the slides right so now how do you lego lego power functions work lego power functions are the things with infrared controllers so there we've got a simple controller and a speed controller so a simple controller has forwards and backwards for the red channel and the blue channel the speed controller has rotary dials where you can dial up the speed or dial down the speed evening to reverse for the two different channels and they talk to that infrared receiver and that controls motors for example could be lights i believe there are other things that you might be able to control we want to control this from scratch so i'll try and go through this a bit faster than i have done so far because i'm probably running behind time now um i wanted to listen into that infrared communication between the controllers and lego in order to work out how it works so i could do it myself so i used this thing called an ir toy from dangerous prototypes it costs about 20 quid it's a kind of simple little tool you can use for listening into infrared um their software doesn't work very well on linux it's written for windows and it uses code blocks which is a horrible kind of environment to compile in but if you just write some python you can talk to the ir toy directly from linux so here the yellow bit is set in a basil report the green bit is initialising the ir toy and the red bit is just reading data that it's seeing and then point your control around it push a button and see what happens and what happens is you get a load of hex which on first view doesn't seem to make a lot of sense but i noticed that it's a lot of 32 bit words in fact it's a lot of 16 bit words but all of them in pairs so the upper byte of these 16 bit words being zero right so there's clearly timing dates of some sort and if you looked at the last byte of each four byte sort of like word that was the only byte that was really changing and you can see it changes from about zero e to about one b and so clearly that's going to be ones and zeros so i knocked up a bit of python to turn that into ones and zeros and you get this at which point we then do what we call byte staring or in this case bit staring um so here i've got red up channel one and red off channel one but in actual fact i would have had every different button combination i could think of so that i could see the binary and compare them and work out how it worked i won't go into the process of how it worked out how it works but i did work it out and we'll describe it very quickly so first of all it's there's four nibbles and you can see only a few of them changed depending on what you're doing the first nibble tells you the channel number and if a button is being pushed or if no button is being pushed or multiple buttons are being pushed if you push two buttons at once you get a zero zero who knows why but you do um and the channel number is 0 to 3 represents channel number one to four on the actual devices the second nibble didn't change the third nibble tells you the button state this is for the simple controller i might add where you've only got up down so each so you could theoretically send a message where the blue was up and down at the same time i don't know what would happen i haven't even tried it to find out but essentially it's a button mask that's pretty straightforward and the fourth nibble is just to check some so we xaw together the first three nibbles and invert it that gives us the fourth nibble and all that's doing is making sure that the data arrived correctly it's got some integrity so we know that there hasn't been a mistake in transmisional reception um so if we had the red off one you can sort of see that that fits that protocol the speed controller slightly different so so you've twisted around and you get these kind of patterns notice that for increasing we've got two different kind of patterns the first bit changes and i'll explain that um the first bit of the first nibble is a change indicator and so only when that change indicator changes does the message get processed by the receiver which means you can send the same message multiple times and only one of them will be um acted upon by the receiver so you've got message reliability that way so every time you click one of those rotary dials it sends the same message three or four times and the receiver only receives it once and then when you click it again it sends roughly the same message but the change indicator will flip from one to a zero or from a zero to a one it's quite clever i quite like it and then within there you've also got the channel number uh second nibble tells you if it's a speed message like you've changed the speed or or if it's a stop message as in you've pushed the red stop button and the fourth bit tells you which channel red or blue uh the third nibble again tells you if it's a speed change or a stop message i don't know why they doubled that up but they did um and the fourth bit tells you which direction that control is going in clockwise around the clockwise and then the last nibble is a checksum exactly the same as before so um so that's just kind of to clarify just to show it off so once we've got that can we transmit messages well i tried transmitting with the ir toy and it kept crashing i don't know if it is the way i was talking to it i don't know if i was talking too fast if i wasn't quite talking the right protocol um or whether the ir toy just didn't really like me or something was wrong with the code but ultimately i needed to find some other way of transmitting so i banged together um a circuit on an Arduino um and it's simply a high power infrared led with a transistor circuit to drive it coming off pin d3 which is important because i was using the serial control uh the the ir remote library sorry to actually transmit the um data and that always uses pin three on a nano or or pro mini um and i implemented a single byte protocol so their protocol was two bytes 16 bits and there's problems with multi byte protocols because you have to know whether you've got the start of yeah the right bytes you know any multi byte message system you need to have some kind of infrastructure around it to know when the messages start and end and and check that you've actually got a proper message and all those sort of things with a single byte protocol you get a byte at a time you can check if that byte makes sense and you can act upon it um now i could have and i've since been introduced to blue chip serial control library which if you're writing anything to do with arduino it lets you do multi byte messages in a really human readable form and uh lets you control your thing like it's a router or something it's much better protocol um you can get it uh it's a plug for his github um it's really good and it works and and it makes everything really simple but i didn't know about this at the time so i didn't use it um if you are thinking about implementing these kind of protocols here's a simple lookup chart to work out which kind of way you should be implementing your serial protocol to your arduino's clearly don't make a multi byte protocol yourself other than that either works fine so my single byte protocol kind of looks like this i actually only use seven bits out of an eight bit byte um bit six tells you which color which channel we're using red or blue uh the green bits four and five tell you which channel it is nought three essentially one to four on natural equipment um bits two and three tell you if it's the simple protocol that the button's being pushed up or down otherwise it's one one meaning it must be the speed protocol and the blue bits bits zero one tell you in the speed protocol whether it's going clockwise or anti-clockwise or it's one one to say that it's a simple protocol so basically i've squeezed the simple protocol and the speed protocol all into a single byte which i'll just send to my arduino then my arduino makes the right lego messages and sends them out so i have a demo i didn't bring any lego with me because all of our motors and infrared receivers are involved in a very complicated uh radio a remote control car at the moment that's not quite finished my son would have probably killed me if i'd brought the the lego with me so um but i do have some demos videos so this is um tom's um sea monster ride for a fairground using lego motors and um linear actuators to to make the thing go up and down we're programmed and running from scratch in fact there is the arduino and a serial converter and this one is there's a i've got multiple videos showing the same thing this is um tom's automatic crossbow so i particularly like this one because um when we first you know what happened was tom said can you make something so we can control our models and i was like yes and then six months later i finally did it and then he was too busy in minecraft at the time and it but some months after that he was like dad have you got that thing that should we control the motors and i was like yeah yeah yeah i think i was really excited took it round what have you built and it's like i've built a motorized crossbow and so he's put all this together by himself he's using the linear actuators again it's an amazing thing so from scratch it will elevate to a random elevation and then fire the bolt um that's kind of cool um so but i'm particularly proud of that we all like the fact it says police on the side like this is a this is the future of law enforcement you know robocop style but it's quite powerful and it's quite a good fun so these are the sort of crazy things we've actually made a lot of other weird wonderful things with lego but that's some examples so hacking with scratch we'll quickly talk about hacking with scratch i made a object an extension that lets me do things i open sockets read from sockets write to sockets bind to sockets um so that i can talk to the network from scratch which you not can't normally do and i'll build a descriptor that describes all those blocks so that we can talk to scratch and you get blocks that look kind of like this so you can sort of create a tcp connection to a particular host on a particular port for example and then send it some data um these are the where the more blocks these are the more blocks where they appear in scratch um you've got procedures predicates and values so values obviously give you back a a string or a number predicates for a true false value and they have different shapes so obviously fit into the right places in scratch and the procedures are the things we're instruct scratch to do stuff like create a socket or write to a socket or something and so the way i've got it set up is the web server on localhost running block ext is the extension exactly the same as that say demo or the lego demo it's literally plug in the python and run the thing up and then you've got these extra blocks you can use and then that's going to connect onwards to a virtual machine running tiny sploit which is produced by sawmill char of net square um under the exploit lab um workshops and uh i've got sawmill's permission to use it for the for these kind of demos and so on there is a vulnerable web server um which we could possibly attack so i did now should we quickly do the demo because why not um so if we kill off the say extension and we run up the socket extension becoming here um now i won't go through the entire work of how you find a bug and then start exploiting it but if you read the paper in poc or gtfo it's all in there to explain how to do this sort of stuff um but what i'll quickly do is load in some stuff so scratch demo we need to do that as you can see um it's quite a bit of scratch in in this particular one what i'm doing is sending a uh a buffer of changing values to a web server to see where it crashes when it crashes i'll be able to find it um in gdb so there's my there's my actual machine hello right we'll quickly connect to the web server with a debugger and then we'll quickly send this so we need to fill in the oh have i got an ip address that was a good point if i don't have an ip address we might have to skip this ah okay tell you what because i want to speed things up i'll skip that and we'll go back to the um so what you're seeing on the screen here is the exploit itself um as i say i'll can do a demo and if you come and hassle me later if you want to see it i'll can show you it live how to do this but from scratch we did all the work of crashing the service on that virtual machine and then crashing the service with a pattern buffer so that we can see where it crashed what the instruction point was pointing out at the time what was on the stack at the time take those values and plug them into an exploit and got shell code simply off exploit db and chucked it into a variable in scratch had to modify the shell code because all the shell code and exploit db expects bash to be or shell and in my virtual machine it was busybox that needs to ever so slightly different type of shell code but you know bung it all together and put in the right values and um before we run it you can see this is the virtual machines um network services um so we can see that we've got two services echo one and echo two and we've got a web server on port 80 and an ssh dm on port 22 nothing else running when we run it this is all the um exploit going through the python uh that bit is a whole load of knobs to fill up the buffer to get to the point where we can overflow the buffer um that bit there is the return address and a whole load of shell code and underneath it's a you know a load more knobs just to sort of make sure the thing definitely crashes um and then we go back and look at the network services listening on the box again there's one extra service there on port 1337 which is the elite port clearly this is my exploit running and that's the shell code running so of course then what you would do as a hacker is you'd connect to that port using netcat or telnet or something and interact with it but of course we're in the world of scratch you know we don't have netcat because we're not touching the operating system so we write our own netcat and that and that is the whole of the scratch you need in order to transmit and receive from sockets all right so that that runs in a loop you type a command it brings back the resultant spits in so if I just make this screen a bit bigger so you can see this is me logged into tiny exploit over port 1337 um you can see what kind of linux it's running you can see it's got busybox you i've catted the password file and so that is actually an exploit running from scratch in uh in tiny split so um to wrap up basically scratch is really interesting as a language it's really interesting because you don't think it can do very much until you start playing with it and then you realise that if you extend it you can make it do pretty much anything that you can make python do so there's actually quite a lot of cool stuff you could do with scratch but the fact it doesn't have any functions means it's a really bad programming language it's like learning basic on a spectrum back in the day you know you learn a lot of bad practices because you're not thinking functionally but being you know it just makes it quirky and interesting obviously we will use bad programming languages i guess um you write the extensions in python but really trivial python like you saw in that say example not a lot of python to actually write which can be a gateway for kids getting from scratch into other programming languages because once you start writing extensions you get used to writing python maybe you'll start writing stuff in python perhaps add gtk to it you can write philapse and if you want to do the whole hacking thing maybe you start learning some x86 machine code i mean i went from basic on a spectrum straight to z80 machine code as a kid and then to 8086 machine code i don't see why anyone couldn't go from scratch to machine code why why not so it's a lot of fun and i definitely recommend that you have a look um my github has uh the scratch code on there and the slides and that's my email address i'll be around all weekend come and find me if you want more of a demo thank you very much thanks so much kev for such a fascinating talk and i've been using scratch with kids and yeah the possibilities are obviously endless right so um unfortunately i don't think we're gonna have time for questions right away because we need to get to our next talk but if you want to come and talk to kev where can we find you uh around and about just look for me all right in the bar straight after this okay that sounds like a good place all right thank you so much please give another round of applause to kev


Hey, good. In what ways are you seeing progress? The numbers, you know, say nice things about what you guys, what have you seen in the last time? I think really just as we've gotten more reps and time together, we're more confident and comfortable with each other, making calls, knowing what to do and being on the same page. And you keep building those little things up, then the big things start coming together. And I feel like that's been the biggest thing. We've had the same mindset to improve and work hard and just it's been coming together, but still a lot more to improve on. But you're earlier in this process, especially in the first couple weeks when things are still getting worked out. How do you look at your role as a leader on this team and how do you try to guide this group up to a better plan? Yeah, I'm the oldest guy in the room now, which still shocks me sometimes. But, you know, I've got experience in things that I can help pass on to other guys and take a lot of pride in that and helping each other. And it's just that team mindset, man, that it's mundane and born, but never gets old and it always works. You know, I want to help the guys around me to improve and if I do that, we'll be a better team, we'll get better results. So we've been focusing on that. And yeah, just like where our mentality is and how we've had that growth and improvement mindset. I was talking to Chris and he was saying that no matter what's happening in your life on or off the field, do you always try to give your best that day? Is that a mantra for you? Is that something that you really take pride in no matter what else is happening on this day they will get your best? Yeah, I think the biggest part of that is just being a professional. This is your job, you're expected to come in and do that. If you can't, they'll find someone else who can. And that's the priority.  It's hard to come in every day and work hard and not be complacent, but that's what it takes to improve. And, you know, as a group up front, we're trying to push each other in that way. Where would you say that you learn like would it come from a football family, would it come from your dad? A little bit of everything.   So we have a very, you know, big mindset about, hey, let's keep pushing it. We're never, we've never arrived. So that's the mindset we keep doing that like we're going to be. I know, again, the stats don't tell the whole story, especially about what you do, but the numbers are really, really good. Do you feel like you're playing as well as you have in a while, as well as you ever have? Um, yeah, I mean, I have my eighth year now for like, I'm learning more and more every year. And just like what we're doing offensively and there's still room for improvement though. And the same thing I've been talking about. So, yeah, like there's a long, it's a long season. So you've got to keep working on it. Yeah, it looks like, uh, it's like, you know, from where y'all started, where y'all are, it looks like it's going to enrich you all with the first. You're sensing that? You've seen the growth in the unit as a whole? Definitely, um, especially just playing next to Jaylen, him being a rookie, having six starts now. Um, it's been really cool to see, you know, how much more vocal he's getting and understanding what we're trying to accomplish on each play and, um, it's across the line too. So, um, I can't emphasize enough. We have, you know, just a growth mindset. Everything is, it's not good enough. What can we do to improve it? And, um, it's not easy to think like that, but that's how you improve. Hey man, they talked about your leadership style. How would you describe your own leadership style? Um, I'm not the guy who's going to call everyone up and give some roaring speech, but more so maybe leading by example and, uh, working hard and, um, you know, I'm vocal in the line room with all those guys and how we want to do things, but, um, yeah, probably more so by example. Then, um, last week, um, the run game, the run number, looks like, uh, you know, there's some room for work there. How do you all see that trying to get the run game started? Yeah, we want to run the ball. We want to be balanced. You know, it helps you win and as an offensive lineman and as a group, we take a lot of pride in that. Running the ball is, like I said, something that no line can take a ton of pride in and, um, we want to do and that's our focus, so, um, gotta keep trending up with that. Speaking of that, your running backs seem to have pretty unique personalities and mesh pretty well. What are those two like in the locker room? Just in terms of, you know, they seem like they're always yapping at each other. Yeah, no, it's kind of like what I was talking about earlier with that. They're pushing each other and competing with each other to see who can get the best out of one another. When you do that, you know, guys get a lot better and, uh, both great teammates, both guys you want on your side of the ball and, yeah, they're both doing a really, really good job. They both seem to have unique, we don't see much of it, but unique personalities to fair? Sure, yeah.  If they make us look good, they can say whatever they want. But, no, I think the biggest thing is, yeah, they got personality, let them do what they want as long as they're playing well and competing the way they are, so I got nothing but good things to say. Thank you. All right, thanks, guys. Appreciate your time.


Hi, I'm Steve Cavallo and I'm going to talk about cross plane and promises. Promise theory is a way we can think about interactions between agents within a system. In promise theory, we say get into the state instead of do this. We're familiar with working the promise theory way, maybe from using chef and puppet and other big management tools, or most likely from using Kubernetes. In Kubernetes, we define and think in terms of end state. In Kubernetes, you don't write a stateful set script, you define and apply a stateful set manifest in Kubernetes promises to attempt to get into your desired state. Kubernetes uses a very literal implementation of promise theory, and many benefits can be realized at scale when promise theory is applied. We can test if we can break things up into small sets of primitives which can be applied independently. How does it all stack up, and how can we apply promise theory to some existing tools. In Terraform, we define our model in HDL, but the challenge in terms of promise theory is, we don't know exactly what our model is until we run a plan or apply to generate it. Until then it's not a true promise. For example, we're creating a spot instance, but we don't know what it will evaluate to until runtime. And in fact, we don't know what it will evaluate to in multiple different environments until runtime. In our second example, we didn't know that this Terraform apply would destroy our resource. Any human invention required makes it difficult to support at scale. With Terraform, there's also no control plane. So there's no guarantee of system state, and we have no way of knowing whether our existing promises are being kept. Where Terraform is great though is determining what changes to enact to bring a system into the desired state. However, at scale. We don't think anything is procedural. And when Terraform must be run in a specific order, or has specific dependencies, it gets very difficult to manage. Taking my previous examples, if a human has to intervene to see if any resources will be changed as part of a deploy, it gets very difficult to, to maintain its scale. CloudFormation allows definition and JSON YAML with very low interpolation. It is much closer to a promise. CloudFormation also has a control plane, so control theory can be applied. We have much better idea of what the state of our system is. So at scale with CloudFormation, we get high predictability of outcome. We have a better model of our end states. We have a control plane that can maintain drift and state. We still have the challenge though when we have many CloudFormation stacks with dependencies and specific orders that it becomes imperative. Crossplane allows definition in JSON YAML. And by nature must be aligned with promise theory because it's a Kubernetes operator. It can be very close to literal interpretation of promise theory. Because it has a controller, it can maintain our state. So as you can see my example, we have controllability, observability, and the controller ensures that we're in our expected state. So at scale, crossplane gives us high predictability of outcomes. In fact, all of its dependencies are promises. You can see in my example, IAM role policy attachment. Policy arm ref is a promise. A role ref is a promise. We no longer have to worry about order. Crossplane will keep retrying until those promises are satisfied. And versioning will allow us to verify which promises are deployed. Now in this screenshot, I have all of my crossplane IAM roles, IAM versions, and visibilities into various environments. So using your favorite flavor of CD, you can get visibility into what versions of the promises exist and whether they're in the promise state or not. In the promise theory, we can think of many, many resources each maintaining a promise state and trusting all the other actors in cooperation and harmony. At scale, we can see crossplane is maintaining all of its promises across multiple systems and much larger systems. So in conclusion, crossplane keeps its promises.


Welcome to the Hindu news analysis by Shankar Ayes Academy. These are the news articles chosen for today's discussion. They are given along with the page number of different traditions. Link for the handwritten notes in PDF format and the time-stamping for the discussed articles are given in the description box as well as the comment section for the benefit of the mobile viewers. Now let us start with the first article. Now let us take up this article. See this article says that even five years after the establishment of Real Estate Act 2016, failures and shortcomings outweigh its benefits. So in this context, let us discuss some of the key provisions of Real Estate Act 2016. The syllabus for reference is displayed on the screen. Interested aspirants can go through it. See the Indian real estate sector was largely unregulated till 2016. This led to many anomalies resulting in various unfair practices which ultimately affected the home buyers. So in order to bring transparency and accountability to the real estate sector, an act was passed. The name of the act is Real Estate Regulation and Development Act 2016. Its short form is RERA. Through this act we got the country's first real estate regulator. See RERA marked the beginning of a new era in the Indian real estate sector. It was a step towards reforming the sector, encouraging greater transparency, citizen simplicity, accountability and financial discipline. This act also established the Real Estate Regulatory Authority. In addition to it, this act also established an Appliate Tribunal. The name of the tribunal is Real Estate Appliate Tribunal. Now let us discuss about the core objective of this act. See the core objective of this act is to ensure regulation and promotion of the real estate sector in an efficient and transparent manner. This act also aims to protect the interest of the home buyers. So these are the core objectives of RERA Act. Now let us discuss the key provisions of RERA. See according to RERA, the states shall establish the Real Estate Regulatory Authority to exercise the powers conferred on it. In some cases, two or more states or union territories may establish one single authority. In some other cases, a government may establish more than one authority in a single state or union territory. As per the latest data, 31 states and union territories have notified rules under RERA. Also, 30 states and union territories have set up Real Estate Regulatory Authority and 24 states and union territories have set up Real Estate Appliate Tribunal. So these are the numbers from the latest data. You can use this data as a value addition in your answers. Now let us discuss the composition of Real Estate Regulatory Authority. See according to the act, the Real Estate Regulatory Authority shall consist of a chairperson and not less than two full-time members to be appointed by the respective state. The members of the authority are appointed based on the recommendation of a selection committee. The selection committee will consist of chief justice of the court or are nominated by the chief justice of the court. The selection committee will also have the secretary of the department dealing with housing and the law secretary. So these are the members of selection committee. Based on the recommendation of the selection committee, the chairperson and the members of the authority will be appointed. So these are the points regarding the composition of Real Estate Regulatory Authority. Now let us discuss about the removal of the members. See the chairperson and members of the Real Estate Authority can be removed only through an order made by the state after an inquiry made by a judge of the court. So first the judge of the court conducts the inquiry and based on the inquiry, the state passes the removal order. This is the removal process. Now let us discuss about the grounds for removal. What are the grounds for removal? If they are adjudged as an insolvent or has been convicted of an offense or if the person is involved in moral torpitude or if the person has become physically or mentally incapable. So these are the grounds based on which a person can be removed as a member from the Real Estate Authority. Insolvent, convicted of an offense, moral torpitude, physically or mentally incapable. So far we saw the key provisions of RERA, composition of the Real Estate Authority. We also discussed about the process of removal. Now let us discuss about the important functions of the authority. What are the important functions of Real Estate Regulatory Authority? See the Real Estate Authority registers and regulates real estate projects and real estate agents. It also publishes and maintains a website. This website acts as a record of all real estate projects for which registration has been given. This website can be viewed by the public. So it increases accountability and transparency. The complete list of functions of authority is displayed on the screen. Interested aspirants can go through it. Now coming back to RERA. See RERA establishes and tribunal called Real Estate Applied Tribunal. So if any person is not satisfied with an order made by the authority, he can appeal before this Applied Tribunal. So in short, RERA establishes an Applied Tribunal as well as a Real Estate Regulatory Authority. Finally, let us discuss some pros and cons of the Act. What are the pros of the Act? See the pros include timely delivery of apartments to buyers, online availability of accurate details of a project, mandatory clearance and after-sales services. These are the important benefits of this Act. Now let us discuss some of the cons with the Act. What are the main issues with this Act? See many projects are still outside the ambit of the RERA. This Act also lacked transparency and there is also a lot of issues with the RERA website. So these are the main issues with the Real Estate Act 2016. With this we have come to the end of the discussion. In this discussion we saw about Real Estate Act 2016. We also discussed about Real Estate Regulatory Authority. We discussed about Real Estate Applied Tribunal and finally we discussed about the pros and cons with the Real Estate Act 2016. Now let us move on to the next discussion. Now look at this article. See according to this article IGNCA has been relocated recently. It is expected to be open next month. This is the gist of this article. So in this context let us learn about IGNCA from preliminary perspective. First what is IGNCA? See IGNCA stands for Indira Gandhi National Center for the Arts. It was established in 1987. It was established in memory of a late Prime Minister Srimati Indira Gandhi. It was established as an autonomous institution under the Ministry of Culture. This is the most important point. The keywords are autonomous Ministry of Culture. So if UPS is focusing on this topic they will usually go for these keywords. See IGNCA is the implementing agency of Project Mausam. Project Mausam works at two levels. One is at macro level another is at micro level. First let us discuss about the macro level. See at the macro level Project Mausam aims to reconnect and re-establish cultural communication between countries of the Indian Ocean. This reconnection would lead to an enhanced understanding of cultural values and concerns between the countries in the Indian Ocean region. So this is the working of Project Mausam at the macro level. Now let us discuss about Project Mausam at the micro level. At the micro level the project focuses on understanding national cultures in their regional maritime context. So we can see Project Mausam acts as a soft power tool in our diplomatic policy and IGNCA is an implementing agency of Project Mausam. Now coming back to IGNCA let us discuss the aims and objective of this institution to serve as a major resource center for the arts to undertake research and publication programs of reference works, glossaries, dictionaries and encyclopedia concerning the arts and humanities to establish a tribal and folk arts division to provide a forum for a creative and critical dialogue to foster dialogue between arts and current ideas in philosophy science and technology to evolve models of research programs and art administration to promote a network with national and international institution to conduct research in arts humanities and culture. So these are the important objectives of IGNCA institution. Please have a rough glance from preliminary perspective. With this we have come to the end of the discussion. In this discussion we saw about Indira Gandhi National Center for Arts. We also discussed about Project Mausam and we discussed about the aims and objective of IGNCA. Now let us move on to the next discussion. Now our next news discussion is going to be based on this editorial article. See in recent times you would have seen AIT coming constantly in the news. This is due to the political crisis caused by the assassination of AIT President Javinal Moise and as per the latest update a group of 28 foreign mercenaries including retired colombian soldiers were found to be involved in this assassination. This editorial has been written in this backdrop. So in this light we are going to have a comprehensive discussion about AIT on different perspectives. The syllabus covered by this article is highlighted below for your reference. Interested as Prince can go through it. Come let us move on to this article. See AIT is a country in the Caribbean Sea with port of prince as its capital. Now look at this map for better understanding. In this map you can see an island. The name of the island is Espanola. AIT lies in the western part of this island. It almost occupies one third of this island. The eastern part of the island is Dominican Republic. From the map we can see that the island is between the Caribbean Sea in the south and North Atlantic Ocean in the north. So AIT is bordered by Caribbean Sea in the south and North Atlantic Ocean in the north. It is bordered by Dominican Republic in the east. These are the boundaries of the country. Now let us discuss about history of AIT in brief. See the history of AIT can be traced back to the time when Christopher Columbus landed on this island. He landed on this island in 1492. Later this country was occupied by the Spanish. It became a Spanish colony. See when the Spanish occupied this country they killed most of the natives. After killing the natives they imported African slaves to work in this colony. So most of the population of AIT are descendants of this African slaves. After Spain, French took over this colony in 1600s. French used this colony to produce many crops such as coffee, cotton and sugarcane. The French also increased their aggressive domination over this country. So the slaves revolted against the French rule and gained independence from France in January 1804. And this made AIT the second country in the Americas after the United States to free itself from the colonial rule. See Americas consist of both North America and South America. So in Americas United States got the independence first from the England. Next came AIT. It got independence from the French in 1804. This is the history of AIT in brief. Now let us learn about its geography. I will look at this map in order to understand the geography better. As you can see AIT is shaped like an osu on its side. It has got two main peninsulas. One is in the north and another is in the south. From the map we can see between the peninsula there is an island. This island belongs to AIT. The name of the island is Ghanav Island. Also from the map we can see that to the northwest of the northern peninsula lies the Vinward Passage. See Vinward Passage is a strip of water that separates AIT from Cuba. It also connects Caribbean Sea with the Atlantic Ocean. So Vinward Passage is an important water body surrounding this country. Now coming to the mainland of AIT it has got three regions. They are the northern region which includes the northern peninsula. Next comes the central region and third comes the southern region which includes the southern peninsula. So these are the three regions of this country. In addition to this AIT also controls several nearby islands. This country also has numerous rivers and streams. It has lot of mountains. Speaking of the rivers RT Bonight River is the largest drainage system in the country. So make note of it. So far we have discussed about the geography and history of AIT. Now let us discuss about its climate. See coming to its climate AIT has generally hot and humid tropical climate. It experiences dry seasons from November to January and from February through May the weather is very wet. The rainfall in AIT is unevenly distributed. When we are talking about the rainfall, heavy rainfall occurs in the southern peninsula. Also rainfall decreases from east to west across the northern peninsula and these are the important points regarding the rainfall in this country. Now coming to the flora and fauna. See before talking about the flora and fauna we should discuss the soil of this country. See the soils in the mountains are thin and loose fertility quickly when cultivated. Compared to the mountain soil, alluvial soils of the plains are fertile but they are over cultivated because of the high population density. So most of the soil in this country has lost its fertility and now only few cash crops have grown in this country. For example a mild arabica coffee is grown as a major cash crop. Next sugarcane is grown as the second major cash crop. So these are the two main cash crops of this country. See when we are talking about AIT 70% of the island is mountainous. It also experiences tropical climate. So most of the vegetation in this island is mainly scrub, coniferous and leafy mangroves. So most of the vegetation cover in this country is scrub, conifers and leafy mangroves. Also from the 17th to 19th century much of the natural vegetation was destroyed through agriculture, grazing and logging. So most of the natural vegetation is destroyed in this country. Some examples of remaining flora found in AIT includes tall pines, evergreen forest, giant ferns, orchids, cacti and acacia. So these are the natural vegetation remaining in this country. Most of the natural vegetation was destroyed by overgracing, agriculture and logging. Also with the retreat of natural vegetation, wildlife has lost its habitat and shelter. See this country used to have a lot of wild boars, guinea fowls and wild ducks. But because of lack of vegetation, most of these animals are no longer present. Currently some caimans are found in southern peninsula, some flamingoes are found in Gona vailan. But most of the natural vegetation were destroyed and because of this, many animals were destroyed during that process. In addition to all this, the government found in this country also did not take any major step to conserve the flora and fauna. They established few national parks or regional parks but they didn't take any major steps and because of this lack of steps, most of the flora and fauna in the country has been destroyed. See AIT is known for its corals but because of lack of conservation measures, most of the corals are damaged with this country. So we can see the flora and fauna of this country are in poor state. So far we have discussed about the flora and fauna. Now let us discuss about the people of AIT. See most of the people in AIT so they don't have a steady wage. Most of them work in informal sectors like street vending, odd jobs, working abroad and a lot of them are engaged in illegal activities. This country is experiencing widespread poverty. It is also experiencing a lot of ecological degradation. So this makes this country highly susceptible to climate change impacts. It is also important to note that AIT is a major transshipment point for illegal drugs between South America and United States. See as we have already discussed AIT lies between the North America and South America so it occupies a strategic position. So this place act as a hub for drug transport between North and South America. So this country is plagued with a lot of illegal activities. It has also experienced a lot of political violence throughout its history. Also one of the main environmental concern is the rapid deforestation. Due to the rapid deforestation the forests that once covered the entire country have been reduced to a tiny portion of the total land area and because of the lack of forest this country experienced a lot of soil erosion. So almost nearly one third of the land has been eroded beyond recovery. Also as we have observed in the map AIT occupies a position between Caribbean Sea and Atlantic Ocean. So it experiences a lot of cyclones, storms and tropical depressions. In the last few years AIT has experienced a lot of floods, landslides, tidal waves, epidemics, loss of cattle and destruction of infrastructure and habitats. So this country is suffering a lot. Now coming to the people's way of life. See AIT is densely populated particularly on the Alluvial Plains. It is still a rural country with the rural population density still remaining high. Most of the population in this country live in the countryside. When we are talking about the urban life in AIT it is limited to the capital and to five or six large towns in the country. Most of the population in this country live in the countryside. It is still a rural country and the rural population still remains high. So these are the important points regarding the people's way of life. See when we are talking about the religion AIT has got no official religion. The constitution of the country allows for religious freedom. See the country has no official religion but however more than half of the population practices Roman Catholicism. In addition to this religion they also practice Udu religion. See Udu is a religion whose gods are derived from western African religions. So these are the important points regarding the religion of AIT. With this we have come to the end of the discussion. In this discussion we saw important facts regarding AIT. We saw about AIT location, geography, history, climate, flora, fauna, economy, environmental concerns and we also discussed about its people. With these details in mind now let us move on to the next news article. Now let us take up this article. See according to this article the National Research Centre on YAK has tied up with the National Insurance Company Limited for ensuring YAKs. Now let us discuss about it. See the last few years the YAK population in India has declined drastically. For example between 2012 and 2019 YAK population in India declined by 24.7%. So we lost almost quarter of our YAK population. So ensuring our YAK population seems to be the right move. It will protect the YAK farmers from the losses. See at present total YAK population in India is about 58,000. This 58,000 includes both wild as well as domesticated YAKs. This is the important point. These YAKs are found in union territories of Ladakh and German Kashmir. They are also found in the states of Arnachal Pradesh, Sikkim, Imachal Pradesh, West Bengal and Uttarakhand. Now let us discuss about National Research Centre on YAK. See National Research Centre on YAK is a premier research institute. It is exclusively engaged in research and development of YAKs in India. It was established in 1989. It was established by Indian Council of Agriculture Research. This is the important point. It was established at Dirang, it is in Arnachal Pradesh. So these are the important points regarding National Research Centre on YAK. Now let us discuss about wild YAKs. YAKs which are found in wild. See these animals are large herbivorous species. They feed on plants. They are herbivorous. They are usually found in high elevation places like Alpine Tundra and cold deserts of Tivertin Platives. See previously wild population of YAKs were found in Bhutan, Nepal, India and China. But currently the native population of wild YAK in Bhutan and Nepal are believed to be extinct. So now they are mainly confined in China and India. So the wild YAKs are mostly confined to India and China. They are extinct in Bhutan and Nepal. Now look at this beautiful picture. This is a picture of wild YAK. As we can see from the picture, these YAKs have a dense woolly fur. This dense woolly fur coat helps the YAK to adjust to harsh weather conditions. So they can live even in negative winter temperatures. See when we are talking about YAKs, we have a lot of domestic YAKs in the world. But we have fewer than 15,000 wild YAKs in the world. So the number of wild YAKs in the world are very less compared to the domesticated YAKs. Have a look at this map for their range. As we can see from the map, most of the YAKs are found extensively on the Plateau of Western China. The name of the Plateau is Kingai Tiberton Plateau. This Plateau has a lot of mountain ranges and most of the YAKs of the world are found in this region. Even in this region, the YAKs are usually found in the alpine and sub-alpine region at an altitude of 2000 to 5000 meters. So these are the important points regarding the YAKs. Now let us discuss the important threats faced by them. The first important threat is poaching. They are hunted for their meat and wool. Now the major threat is wild YAKs are integrated with the domestic YAKs. See the interbreeding of wild YAKs with the domestic YAKs as weakened the species. So this is a major threat faced by them. Other threats include expansion of agriculture, expansion of aqua culture, livestock farming and trancing, construction of transportation, service corridors, construction of railroads, construction of roads. These are all the major threats faced by the YAK population. In addition to that, they also suffer from diseases like ailment infections, foot and mouth diseases. These diseases affect them and they have reduced their population drastically. Now let us come to the most important part of this discussion. YAK's IUCN status. Their status is vulnerable. They come under the vulnerable category. They also come under appendix 1 of both CMS and SITES. In the context of India, YAKs come under the Schedule 1 of the Wild YAK Protection Act 1972. So these are the important points regarding the conservation status of YAKs. They come under the vulnerable category of the IUCN Red List. They come under appendix 1 of both CMS and SITES. They are under Schedule 1 of Wild YAK Protection Act 1972. With this, we have come to the end of the discussion. In this discussion, we saw some points regarding wild YAKs. We also discussed about National Research Center on YAK in brief. We also discussed about the important threats faced by the YAKs. And finally, we discussed about the conservation status of wild YAKs. Now let us move on to the next article. Now let us take up this news article. This news article is regarding Jammu and Kashmir delimitation commission. So in this context, let us learn about delimitation commission. Before discussing about delimitation commission, first let us discuss about delimitation. What is delimitation? See, delimitation refers to the process of redrawing of boundaries of an assembly or Lok Sabha constituency. Why is delimitation done? It is done to reflect the demographic changes. See, delimitation is also responsible for reserving a designated number of seats for Scheduled Caste and Scheduled Tribes in State Assembly or Lok Sabha. So this is why delimitation is done. See, it is important to know that delimitation is a bureaucratic process. According to article 82 of the constitution, Parliament enacts a delimitation act after each census. See, we all know that census is carried out every 10 years. So after the census, Parliament enacts a delimitation act and based on the delimitation act, Union Government constitutes a delimitation commission. This is the official process. So first, a census is conducted. After the census, Parliament enacts a delimitation act. Based on the delimitation act, the Union Government constitutes a delimitation commission. This is the official bureaucratic process. It is based on article 82 of the constitution. Now let us discuss about delimitation commission. What is a delimitation commission? See, delimitation commission is a panel set up with a legislative backup. It is based on delimitation act. It has legislative backing. See, this commission functions independent of government and political parties. It is an independent commission. Usually, a retired judge of the Supreme Court etched a delimitation commission. A delimitation commission draws its members from election commission of India and state election commissions. This commission examines population data, existing constituencies and also the number of seats. After analyzing these data, it holds meeting with all the stakeholders. After this meeting, the commission submits its recommendation to the government. Later, the draft report of the delimitation commission is published in the Gasset of India. It is also published in the official Gassets of the state's consent. It is also published in at least two vernacular publications. The public can read the draft report from these vernacular publications. Then the public send the feedback. And once the feedback has been received, it is studied. And if needed, changes are made in the final report. The final report is published in the Gasset of India and the state Gassets. And finally, from the notified date, it is implemented. This becomes the basis for all future elections until the next delimitation. This is how the delimitation commission works. Now let us discuss some additional information regarding delimitation commission. See, at the national level, so far, four delimitation commissions have been constituted till date. And the last delimitation exercise at the national level was finished in 2008. It was based on 2001 census. Based on this delimitation exercise, the boundaries of Lok Sabha and assembly constituencies were readjusted. So these are the additional information regarding delimitation commissions. With this, we have come to the end of the discussion. In this discussion, we saw about the delimitation process. And we also discussed about delimitation commission in detail. Now let us move on to the practice-prilims question. Practice-prilims question. Fast question. Consider the following statements. First statement. Regulation and promotion of real estate sector. Second statement. Ensure transparency and efficiency in selling real estate. Third statement. Protect the interest of consumers. Fourth statement. Publish a website with records of registered real estate projects and agents for public viewing. Which of the above are functions of real estate regulatory authority? Option A, 1 and 2 only. Option B, 1, 2 and 3 only. Option C, 1 only. Option D, 1, 2, 3 and 4. See the answer is option D. 1, 2, 3 and 4. All the four statements are functions of real estate regulatory authority. It is responsible for regulation and promotion of real estate sector. It ensures transparency and efficiency in selling real estate. It protects the interest of consumers. It also publishes a website with records of registered real estate projects and agents for public viewing. All four are the functions of real estate regulatory authority. Answer is D. 1, 2, 3 and 4. Now let us move on to the second question. Consider the following. First statement. According to article 82 of the constitution, parliament enacts a delimitation act after a census that is held every 10 years. Second statement. D limitation commission draws its member from election commission of India and state election commissions. Which of the statements given above are correct? A, 1 only. B, 2 only. C, both 1 and 2. D, neither one nor 2. See delimitation is a bureaucratic process. And according to article 82 of the constitution, parliament enacts a delimitation act after a census that is held every 10 years. Following the delimitation act, the union government constitutes a delimitation commission. So the first statement is correct. According to article 82 of the constitution, parliament enacts a delimitation act after a census that is held every 10 years. This statement is correct. Now let us move on to the second statement. See usually a retired judge of the supreme court etched a delimitation commission. It also draws its member from election commission of India and state election commission. So the second statement is also correct. And since the question want us to identify the right statements, the correct answer is option C, both 1 and 2. Both the statements are correct. Now let us move on to the third question. It is a large herbivore species currently confined to India and China only. In India it is found in Arnachal Pradesh, Sikkim, Imachal Pradesh and West Bengal. It is listed as vulnerable in the IUCN Red List. The above paragraph best describes option A, snow leopard, option B, Himalayan tar, option C, wild yak, option D, goral. See the answer is option C, wild yak. When we take the first option, option A, snow leopard, it is found in 12 countries. It is not only confined to India and China. So this option is wrong. Next option B, Himalayan tar. The IUCN status of Himalayan tar is near threatened. It is not vulnerable. Since the question mentioned is not available, this option is also wrong. When we take the fourth option, option D, goral. See goral are small goat like mammals. They are found in India, Myanmar and they are also found in Russia. It is not confined to India and China only. So this option is also wrong. So option A is wrong, option B is wrong, option D is wrong. And from the discussion we know that option C is correct. Wild yak is the large herbivore species currently confined to India and China. It is found in Arnachal Pradesh, Sikkim, Imachal Pradesh and West Bengal. It is also found in Union territories of Jammu, Kashmir and Ladakh. It is listed as vulnerable in the IUCN Red List. It is also found in Shadyr one of wildlife protection act 1972. It is also in the Appendix one of CMS and sites. The answer is C, Wild Yak. Main's practice questions are displayed here. You can write your answer and post in the comment section below. With this we have come to the end of the news analysis. If you like the video, click like, comment and subscribe. Thank you.


Hello everybody, E here. Welcome back to another book review. Today we are continuing along with Dean Kunze's back catalogue. Another thing I need to note is we were me and Dealey who I'm doing my reread of Kunze's books with. We were tooling right along. We were about to go into House of Thunder when I realized looking back at his bibliography that I had not read Demon Seed. If I ever did read it, I don't remember a thing about it. It is also a movie. It also has a 1977 edition. This one is a 1997 rewrite. From what I understand is they are two completely different books. He says in the afterward back here that the original version of Demon Seed was made into a good film starring Julie Christie which is funny because he usually doesn't like movies based on his work. But the book itself was more of a clever idea than a novel, which I would say that's that about most of his books. Reading it recently, I winced so much that I began to develop the squinty-eyed look of Clint Eastwood in a spaghetti Western. I feel ya, Dean Kunze. I understand. Here is an entirely new version which I hope comes closer to fulfilling the promise of the novel's premise. Revisiting Demon Seed, I discovered that in addition to being a scary story, it was a rather scathing satire of a panoply of male attitudes. He uses panoply three times in the book also. It's just a weird word that he just keeps using over and over again. Although much else has changed, although much else has changed in this version, I've kept that satirical edge. Guys, I don't let us off any easier this time around than I did the first. And I'm going to cover that in the review because I've made some notes back here. First off, in the book, I don't know if these are slight spoilers. This book's been around forever, so if you have problems with spoilers, maybe you don't watch this review. I'm not going to just straight out tell you any plot points, but I am going to cover some themes and stuff that he talks about in the book. I just finished this book, so it's all fresh in my mind. Only took me two days to read it. It's only 150 pages, that's why. So as far as the theme, the there's one thing that he says early on in the book on page 42, I believe I made a note of it, is that the the computer system is obviously male. The computer in the book is obviously male because it was created by males.  It's always female. I mean, there's a whole it's not a joke.  There's a whole that's that whole thing. Whenever you see a guy talking about his truck, it's old girl or, you know, animals, even if they're not girls as old girl, it's they feminize everything. Dudes feminize everything. So I'm not entirely sure why the computer, other than to fit the purpose of the plot, it didn't fit. Now, before I go any farther into this, you may think, oh, God, this is another one that you didn't like. Why does it keep on reviewing books from Dane Concher? He doesn't like. I love this book. There's only certain elements that I did not like or that I thought were funny when they shouldn't have been. But I pretty much love this book. This book is brutal. It is pretty much well written pretty much because I'm going to point out some things as far as the writing is concerned. Also, if you're a writer, hang around for that. We're going to discuss some things that he does in this book that you should never do or that you should try not to do. And it's also funny that he left these things in in a rewrite. That that also struck me odd because usually this is the kind of stuff that you take out of future editions if you're going to be taking anything out. But it could also be said that he rewrote the entire book. So it was probably a it's not even really a rewrite as much as it's a reimagining of his idea. Another thing is let me bring let me look for my notes. Seventy two page 72. Let me go through here. Let me see. I think it's just a quote that I was talking about. Yeah. So that quote, we will go ahead and go into the stuff that I want to talk about with the writing, the bad writing or the overwriting. I hear a lot about how Coons never uses a superfluous words and how good he is in that regard. Coons is one of the biggest overwriters of all time. It may not seem that way, but a lot of the stuff that he puts in his books is filler. And in here, there's filler words, like, for instance, the very first line. Listen, there's no spoiler here. The very first line of chapter 22 is outside. Remember that word outside? The moon, the midnight moon floated high and silver in the cold black sea of space above. OK, two words there that have absolutely no use in the sentences outside and above. First off, of course, it's outside. You're talking about the moon. We're not talking about inside. We're talking about outside. Second thing is above. The sky is over you. The sky is always above, especially when you're talking about, you know, you're inside looking outside kind of deal. So two words right there could have been completely just erased from from the sentence and it would have been fine. The midnight moon floated high and silver in the cold black sea of space. So all you have to say, people know what you're talking about. Next, we have page 140 in my edition. And this is just this is just terrible, terrible writing period. Remember, I like this book, but with every good book, there's always criticism to be had or made or have you want to play. I even mentioned that it even has that word again, the penoply, the penoply of summer stars swelled brighter with the passing of the lunar disk. It's the moon. Just called the moon, the moon, never, never use, you know, stuff like that, the lunar disk. First off, lunar disk doesn't make any sense because the moon's not a disk. I mean, it may look two dimensional in the sky, but it's not. And it's just too many words to be used. It's just bad writing. Now, if you don't care about the writing at all, there's nothing, there's actually nothing wrong with this book. This book is fun. It's an engaging narrative. You're inside, I guess, not really the head. The point of view is from the computer program, the rogue AI in the story. And oddly enough, I just got through watching Upgrade, which kind of had the same plot to it. Not really, but it especially, I mean, one of the it's like a spoiler for Upgrade, so which was a pretty good movie, by the way. But the plot is great. It's a little bit predictable. I loved the character of Inos Schenck, which is, I thought, Kroence comes up with some, he's like Charles Dickens.  But Inos Schenck, that character, I thought, was fantastic, brutal, terrific, a balancing between a not supernatural, but a intangible villain and a tangible villain. I always appreciate that, like in it, you have Pennywise and you have Henry Valorys, that kind of deal. Sorry, excuse me, that kind of deal. I've always, a long bit of fan of if you're going to have something supernatural or otherworldly or whatever it may be, always have a human villain along with it. And that's what they do well here. That's what he did well here. Also, another thing I actually loved was how left, that there is a complete ending. But there is certain elements of the final terror left to the reader's imagination. Now, it's not as 100 percent as like a bird box kind of deal where he doesn't explain anything. Even though I do, I have heard rumors that the sequel will actually talk about the monsters in bird box. I think it's called Mallory. But in this one, it's he hints at certain things. And it's some it's one of those things where it's not a cheat. It doesn't feel like a cheat that he's only hinting at it. And the reason why I say that is because there are certain elements that he has built up throughout with the title, with just discussing, you know, the AI, all that stuff that he has built up throughout. It gives you enough information that the reader can build their own hypothesis on what this final terror looks like. And I appreciated that quite a bit. I also liked that the I can't remember the guy's name. Maybe Henry, something like that. But Susan, the main character, and there's, I guess, one of her assistants or one of the people who work at the house. Their relationship is kind of it's not mentioned at all. What their relationship is, you only see her reaction. And that's when something clicked for me. I was I was bothered by the lack of character development for Susan and the lack of character development for everybody that, you know, it comes up in the book. But then I realized whose point of view we're in in this book. We're in this computer who wants to be human. We're not any human being's mind. So it fit that the character development would be so on the short end that we wouldn't get much character development because you're dealing with something that is as sociopathic as it can be, which is a computer program. It gives absolutely no fucks for anybody else. Other than some missteps with the writing, I really enjoyed this book. In fact, I would go as far as I would probably put it on my top 10 Dean Coons books. One of the main reasons for that is it's only 150 pages. And I've long said that Dean Coons at a certain length of novel is extremely good. And this is that length. Like if you took any number of his books, any of them and took away all the filler, all of the superfluous information, if you took all that away, you'd be left with a really good 150, 200 page book. I said the same thing about Shattered in my review for that one. I think Dean Coons, people say that he never overuses words or whatever. I strongly disagree. I feel that he has the most filler of any quick writer. So I'm not saying that he uses filler the most, but if we look at people like James Patterson, James Patterson has almost zero, zero filler. That's why his chapters are only one or two pages long because he just gets in, says what he has to say. Well, someone else does because someone else writes his books. But with Dean Coons, he tends to linger and to explain all the Boganville clients and all the Boganville, whatever they're called. And, you know, the weather and the structure of the house and what the architect's name was back in 1937 when the house was built or what style. He has a lot of that BS in his books and his books are not literary enough, unlike Stephen King's level, to get away with that because Stephen King has the narrative voice to get away with that BS information because it's like you're sitting there listening to a old friend or a father figure tell you a story. Whereas with Coons, you know you're reading a writer's work. It feels like a novel. It always, with Dean Coons, it always feels like writing. Sometimes it feels like great writing. Sometimes it feels like a chore, but it always feels like writing with Dean Coons. At least that's my opinion. I'm sure several of you would disagree with me down there in the doobly-doo. But have you read Demon Seed? If so, let me know what you thought of it down there in the doobly-doo. Up next for the retro reviews, we're going with the key to almost of the eyes of darkness. I already did that one. The key to midnight is the one we're doing next and me and Dealey will be reading the House of Thunder next month. So expect a new review for that one and we will continue on with the retro reviews also. But let me know what you thought of Demon Seed. If you have read it, whether you liked it, didn't like it, if you didn't like it, let me know why down there in the doobly-doo. But until next time, I have been E, you have been U. This has been another Dean Coons review. I'll talk to you guys later. Bye-bye.


Hi, and welcome to another CUBE Conversation. I'm Peter Burris from our outstanding studio in Palo Alto, California. And today we're talking security, which is a specially important topic in today's digital business driven world. And specifically we've got Slavik Markovic, who is the CEO and founder of Demisto. Welcome to the CUBE. Thanks for having me here. So Slavik, there's so many directions we could take a conversation about security these days, but let's just start with a relatively simple one. Security operations is becoming increasingly important, but remains especially complex. How is the problem manifesting itself in business today? Yeah, so I would summarize it really simply as having too many with too few.  And so this is a huge problem in the sense that security is hurt by that. You have a lot of events that are just left on the table unhandled. And so that's what we're kind of trying to solve is helping the analysts basically have a much better life and process and handling those kind of issues much more efficiently.  Yeah, they're a lot happier. The more likely scenario is you see some people who are highly stressed and largely unhappy and counting the hours until they can retire. How, and partly that's a function of the fact that we got all these tools and we got all these higher increasing risks as more folks attack, but there's also some uncertainties associated with actually how processes work. So to what degree can a solution like D'Amisto bring some clarity to how security processes should operate within a sock? Yeah, it's a great question. So as you said, when you go and visit those analysts, they're very unhappy. They're unhappy because people have this concept of when you go into security, you're going to deal with the sophisticated stuff. You're going to deal with finding that, you know, nation state attacker and this malicious, super persistent hardware malware and so on. Oh, you're the top, you're going to be a hero. Yes, you're going to be the hero. And that's a very interesting perception, but then the end result is that most of your day is being, you know, handling the basic, you know, fade logins and VPN alerts and change password requests and phishing attempts, things that are very mundane. High-risk drudgery. Yes, high-risk drudgery. That's perfect.  And even when you're dealing with the more interesting stuff, that's, as you said, there's no consistent process of how to handle it. And there's might be like a document somewhere on your wiki or SharePoint that specifies what you should do, but there's no way to actually quality assure that and make sure that what they're doing is indeed matching the process. And so, yeah, the analysts are, you know, getting bogged down by those mundane alerts, don't have time to look at the interesting stuff. And when they do have time, it's very hard to follow the process. And what we at the MISTO are doing and trying to fix that problem is that we're trying to solve it by having a single platform handling all of the life of the SOC, meaning handling all the knowledge management, all the processes and the people assigning and all of that. And so, what we're doing is having a full kind of case management for incidents, including all the metrics and all the SLAs and assignments and, you know, evidence tracking and cryptographically assigning them and so on. But beyond that, we allow you to specify a consistent process that you do in a Visio chart. So you basically just drag and drop all the steps and we then allow you to take those steps and replace them with automations because we have integrations with hundreds of security tools and those hundreds of security tools provide thousands of actions that you can do across those security tools. And so, when you have a step that says, you know, check the prevalence of this file or detonate this in a sandbox or do any of those, you can actually replace that manual step with an automation and save the analyst the time of actually going ahead and doing that. And so, not only we're bringing consistency to the process, but you're also bringing a lot of efficiencies because you can just replace those manual tasks and then a lot of the kind of simple mundane incidents, you can just, you know, take away from the analyst completely. So we can focus on the really important stuff. And then beyond that, what we're offering is when you have to, you know, get off the predefined process. And so, you know, we're dealing with a smart adversary. Some of them are super smart. It's not all incident. Some of them are the smartest. Smartest, yeah. A lot of money to be made and messing up the companies up these days. Exactly, and not all incidents are cookie cutter. And so when you have to get off the predefined process, we allow the analysts actually to collaborate with other analysts, invite them to our virtual war room, and then also talk with our bot and do interactive stuff beyond the predefined. So you can go to our debot and say, hey, dear debot, retrieve this file from this endpoint, detonate it in this sandbox, bring me the result. Oh, it's malicious. Then isolate the endpoint and block this IP. And you can do all of that in one single place without going to 10 different tools to, and then copy-pacing it into your case management system. But so let me make sure I got the summary because you said a lot there. So trend, a lot more users, whether they're actually human beings or devices, much greater surface area from an attack standpoint. So a lot more events are being generated. Those events can now be trapped by an existing tool set that, again, corresponds to that degree of specialization. And then when they generate alert, you have a low code approach being able to through APIs, capture that information, simply describe automations, and then have the shop follow the processes and conventions and routines associated with the automations of the day design. Have I got that right? Exactly. And so it's not like we're saying we're going to replace your analysts with automation. That's usually not the case, but we do allow you to basically apply a process, a consistent process that has automations to make their analysts work much more efficient. And so, as you said, an incident comes in from, and it can be from various sources. It can be from a high-fidelity security tool, or from your SIM, or from your mailbox, somebody reporting abuse or something like that. We take that incident, automatically apply the process, run all the automations, and then allow the analysts to make the important decisions. So the analyst sees the data and then decides, oh, you know what, this is malicious, and then we can do the response. Or it's not malicious, and then we can close the ticket and so on. But we're not replacing the analysts, we're just elevating his level. A lot of these integrations out of the box? Yeah, we have over 200 integrations out of the box with your, I would say, usually the security tools, IT tools, Active Directory and your endpoint and your network and so on and so forth. And the second related question is obviously one of the biggest challenges that you face with any of these very powerful tools is that they can take a long time to configure, set up, and then roll out. Time to value associated with the minister, what is it? So just the installation and configuration of the integrations, it's a matter of an hour and you're up and running. But then when you take a use case and build a playbook and automation for that, this usually takes days. So per use case, it takes time to adjust it to the process of the enterprise. And so out of the box, we come with about 50 playbooks but then an enterprise will take those playbooks and adjust them to their own processes. That's great. So you've been around since 215, first ship, 2016. Where are you on the maturity? So we've been growing like crazy in a sense. We are now releasing our fourth version of the product. 4.0 is coming to Black Hat. And this is, you know, we have hundreds of customers, about over a hundred employees and been growing and hiring aggressively. So if you think about what the next two years is going to be, higher risk, more devices, more work to do, but tooling like D'Amisto is going to be able to better manage a lot of that and facilitate collaboration amongst the team. For example, I believe you have some pretty decent slack integration directly in the tool. That's true. So this becomes a way that you can actually, it's a tool for running your sock. Exactly. It's a tool to run your sock, but when we kind of look ahead of that, what we really focus on, what I'm excited about is the capability to enhance or add more efficiencies to the process by using machine learning and then trying to learn from the organization and feed that knowledge back into the organization. So if we see analysts interact with our bot and asking for certain actions, for certain types of incidents with certain indicators, we can learn from that and then a new incident comes in, we can then recommend it and say, hey, you know what? What we've seen in previous incidents, this is what worked, this is a sequence of actions that worked and we can feed that back into the analyst. And we can actually feed that back into building the playbooks and reaching them even more. So I think we can actually use machine learning across the entire kind of platform and even take it outside of the sock and into other use cases. So we already integrate with AWS, so we can actually help you with all the cloud securities if you detect something, we can take a snapshot, we can change IAM. You mean end to end. End to end. So they're going to do fine with their own security, but you mean end to end. Of course. So you're incorporating them into your security chain. Yeah, so we view ourselves as kind of the brain of the process, right? So we want to help you define what should happen and we'll actually invoke and execute that across your security tools. So part of it can be on AWS, part of it can be with your compliance team or with your vulnerability assessment team or up security team. Kind of expand even beyond the traditional use cases of the sock into anything in fact insecurity that has a process tied to it. Slavic, thanks very much for being on theCUBE and talking about security. An incredibly important topic that requires a lot more conversation but even more doing. Okay, thanks for having me. So once again, Slavic Markovic is the CEO and founder of D'Amisto and you've been watching another CUBE conversation. Until next time.