So I want to preface this talk with the idea that everybody wants a website. You're working with a company that's like, I need a website and I need the Facebook and I need this and I need that and I need an email marketing program. Everybody wants that but a few companies actually know what that means. So by going through this talk I'm hopefully going to put you in a better position to be able to help them connect the dots, right? Because everything that you do on your website is going to touch everything digital. So let me provide you with a little bit of experience. I've gained through redesigning websites. Let's get forward a little bit. I've worked with two companies that have been through web redesigns. They went through two web overholes. Right now the company that I work for is going through a web redesign with a company, a local company called Think. So I'm hopefully going to share some of the insights from that web redesign with you today. Because I've learned a tremendous amount through going through that process. So to get started I want to kind of touch on in-bell marketing. How many people have heard of in-bell marketing? Okay, so hopefully you know a little bit about it. And I want to talk a little bit about how an in-bell marketing program can impact some of the essential parts of your WordPress site. But I want to talk about some basic ideas first. If you're unfamiliar with in-bell marketing and how that differs from traditional marketing, let's just say that your focus is more on attracting customers than just selling. It means that customers have a need or a desire that needs to be filled, and they seek you out through digital channels, right? So if somebody is on Facebook and is like, help, I'm going to be in Charleston and I need a recommendation on a good hotel, you're like, dude, I was just in Charleston and this is where I stayed. And Facebook programmatically pulls in a Google Map restaurant and you put one of your specials on Instagram. Somebody is right around the corner. They go up to your profile and they click through to your website. That's in-bell marketing. Traditional marketing along the lines of display advertising. So when you open the newspaper or you open a magazine, that's display advertising, billboards, rate advertising. It's more of a one to many. When you're talking about digital marketing, it's more of a one to many. Okay, you think of it as a one to many. I also want to preface this talk with the terms of design thinking and customer sentiment, okay? And when I say design thinking in reference to talking about is that the design is solution based and it focuses on being human centered, okay? You're putting the user and the user's problems at the very center of what you're designing, okay? I say that building strategy is customer centric. I mean that you want to sell goods and services, that's how we make our money. But you also want to keep in mind how those goods and services fit into the lives of your customers, right? If you're a company that makes products for women, how does that fit into women's lives? You know, we're not just one flavor, we have many flavors. Some of us have children, some of us don't, some of us are married, some of us aren't. So how does your woman centric product fit into our lives, okay? As a user, I can tell you that every time I go to a website, the design and the content, I can go to, when I go to that, I can tell how the company feels about me just in the way that they're interacting with me through their design, right? If I go to a website and I'm immediately bombarded with interstitial ads or interstitial pop-ups, or I'm looking for more information and I'm just given a phone number, I'm gonna bounce, right? That is not a company that I want to deal with. And let me tell you why. If I go to your website and I see the product that I want but I'm not given any more information that I'm given a phone number but I'm not ready to buy, that tells me that you're willing to sell to me before I'm willing to buy. And you don't really have a grasp on how the funnel works in the digital space, okay? So just something to keep in mind. So as a starting point here, I told you guys, I told you guys I was gonna lose track of my slides and I totally did. So the starting point here is your customer. And when you look at designing your digital program, whether it's a website or a social strategy or a campaign, you need to understand your customers. And the best way I've seen to handle this as a starting point is to ask questions your users seek to answer as they travel through your website, right? What are they seeking to answer?  What solution do they hope to find on your website? Metrics like your bounce rate and your dwell time will tell you how well you're answering these questions, right? If they go to your site and they're there for 30 seconds and they bounce, that means it's something in search that they found in search that they thought they would find on your website. And what they found on your website are not aligned, right? And Google takes those metrics and ranks you based on those things. It's important for users to not only feel like they're understood, that you empathize with them, but that you're consistent. Designed elements in messaging are important from touch point to touch point. So their journey needs to make sense. If they start on Facebook and go to your website and are jarred by that experience, there's something that you need to kind of take a look at, right? And how many people have been on Facebook and you've clicked through and you're like, whoa, this is not what I asked for, right? That is a problem, right? I won't click on stuff. I see a company come up and I see something doesn't make sense to me, or I've clicked through and something doesn't make sense. That company's off the table, okay? There's something about you I don't trust, okay? So as a developer, you're working with people who are trying to guide people through to their destination. And it's important for you to see through how your website is touching all of these digital points. Like for you to understand the content strategy that's available. Everybody wants a content marketing program that's huge and you've got one writer. We're kind of dealing with that right now. And it's important for you to understand your site so that people can find you in search. All of these signals for users are promises that you can provide solutions and that's why they're gonna stay on your site. Through to find something and then they find something else and then they find something else. You form the connection with them and they'll probably be back, right? All about brand, all about the feeling. Your strategies from social media content strategy SEO and through building your website should align with your business goals, okay? In creating business goals and helping your customers, you're aligning these two things. To do all of this, you need to craft business goals that state exactly what you want to accomplish, okay? Companies don't really, I want to make money. Well, okay, well how does that translate to the website? If you're an e-commerce site, what key performance indicators do you need to show that you're actually making some progress? You need to be able to measure the effectiveness of your efforts. Okay, it's important for you to understand and have drafted your business goals before building your inbound marketing program. So your inbound marketing program is gonna look something like this and for companies it's gonna look a little bit different. For our company, it fits under the marketing strategy umbrella, okay? It might look different for smaller companies. It's gonna include social media strategy, content strategy, search strategy, and measurement strategy. That measurement strategy is really important because you're gonna have stakeholders who are like, I'm gonna need you to put this up on the website. And you're like two people who visited that in the last six months. And that's how you can tell them that that's not a really good piece of content because you know what Google does when it realizes that people are not liking the content on your site?  All of this would be a great inbound marketing program that should increase traffic, helping people to find you because the more people find you, the more people like you, the higher in the rankings you go. And if they like what you do, they're gonna pass that along. And that's ultimately what you want, right?  You wanna move people from being customers to being evangelists. Like you've gotta eat at this restaurant. Like I have never had anything like this hamburger ever. This is the best, you've never seen pictures of hamburgers in Instagram, have you? Like it's always like fluffy salads. I don't wanna eat that, I want a good hamburger. So if you guys find me on Instagram with a good picture of a burger, tag me because I wanna see this, I wanna see this happen. In addition to writing your goals and measuring your measurement strategy, you should consider the templates that best suit your purpose. And we're getting back to the word press, okay, I'm bringing you back. The templates which best suit your purpose, site architecture, that helps users easily accomplish what they need to do. Easily accomplish, okay? And functionality that serves only what the customer journey, to make the customer journey easier, okay? We don't wanna make it harder for them. You know what happens when you make websites hard? They go away and they never come back. So let's talk through some of these things on your word press site and what that means for your, I'm gonna catch up with my PowerPoint. What does this mean for development? You wanna pick a template that's customizable to your brand, okay? I've seen some templates out there that are locked down. You can't adjust the color palette, you can't adjust the typography. You need to be able to do this. If you're a company and when I was talking to somebody before the talk about this, you should have brand guidelines. What is the color palette for your brand? What is the typography? What is the look and feel, okay? We're sitting in a meeting and my mark somewhat conservative financial company. So using a template like Apple, you might wanna rethink that life decision. You need to go for something that's consistent with your brand identity and what users expect, okay? It's a jarring experience when they come in from Facebook and they don't find something that they think they should expect, okay? Keep in mind also as you're picking the template, what does that funnel look like, okay? The layout will help customers to meet their goals. Ultimately, we're concerned about customers meeting their goals. So along with the questions that you think the user would ask, you wanna know what you want them to do. So if they're asking, well, I wanna learn more about this, I want more information, what do you want them to do? Do you want them to fill out a contact form? Do you want them to go to an additional page? What is the action on the page that you want them to take, okay?  They wanna buy something. What is the best template that will help you to help them achieve that goal, okay? Overall, your template needs to account for all of the reasons why users might be on your site and you can't account for everybody. But I'm here to tell you if you don't run user surveys on your site, if you don't collect data as you're testing, you need to. You need to consider the fact that people are willing to give you this information if it makes their life easier in the long run. If they like what you do, they will be willing to help you, okay? With little or no incentive. People are funny that way with brands that they like. Additional considerations which you guys know if your developers are responsiveness, load time, whether the template works well with your plugins, for all that's holy, just make sure you test your site. Like make sure those play well together. Site architecture is equally important. You wanna build a site that is usable for the user. It's great if it works for you. If you're sitting around with your development team and you can click through and find things, that's great. But is it okay for your user? Is it easy for them? Because ultimately, that's what your focus is on. Can they find what they need? Can they easily move around the website? Have you thrown up obstacles? How many people have been on the TurboTax website? Yeah, yeah, I got lost in a loop on that website last year and lost some money and then had to go through customer service and then got lost in another loop. It was horrible and I will never use TurboTax again. And not mentioning any names. Really, I gotta say that dead ends hurt my heart. They really do. I like when I get on a website and I don't know where I am, it angers me and it hurts me. Like I don't, why do you hate me? Why do you hate me? So make sure that you test your website. Make sure you take users and you test your website. Feedback helps you build a better product. Functionality, no problems. They had a CFO that was like no shiny bobbles. I know that everyone has their pet plugin. You have your thing that you want to do. And back in development aside, you want to make sure every plugin that you're using for functionality sake helps your customers to meet their goals. It helps them accomplish what they want to do. So if they're wanting to stay in touch with you by signing up for a newsletter, you have something that helps them do that, right? If they have to ask you a question, because they just can't find the answer on your website, you have something that helps them to accomplish that mission, right? There's nothing more frustrating than having a question that you can't get answered by somebody. So keep that in mind. Functionality should add to the ease of use for website users. And finally, customer management. Everything on your site should support your users in meeting their goals. Everything. Everything is set up for them. How do you feel when someone helps you? Let's loop back around to that question, right? The question that I asked at the very start of my talk. How do you feel when someone helps you, right? There's a warmth in that. There's a sentiment in that. There's an authentic human connection in helping people accomplish what they need to. Well, and you've reached back out in a measured strategic way to continue their relationship with your customers. They're going to think better of you, right? They're going to think fondly of you. You want to seek to understand their experiences and make them better. And that's how you will build a digital tribe. So that's all I've got. And do you have any questions?  Have you always had a Ford? OK. What's your connection to Ford? When you first bought a Ford, what was the thing that you thought about when you first bought it? Was it price? OK. It was free. Oh. Well, if all Fords were free, is there a look at the Ford look that you think? Like you're thinking. My first car was a Volkswagen. It was a Volkswagen Bug, 1972. And it was orange. My first memory of that car was seeing how many people we could fit inside it while it still ran. 15. It only went 30 on the highway, though. I'm just saying not a good idea. I've had a Volkswagen ever since because I love the brand. I love the feeling of Volkswagen, OK? When I see the Volkswagen symbol, I'm like, yo, how are the people? Volkswagen! You know? I would almost assume that Ford owners have a similar type of symbol, not a brand, that is provocative to people. When you see the colors and you see the logo and you see the messaging, you know that that brand is convenient. So in everything that you do on your website or your digital properties, need Ford, Chevy, all of the car companies under the hood are speaking for. Ford is putting out the Ford Tuck. What's it making to you, right? I can't remember Volkswagen's tagline. Probably drive fast, live dangerously, I don't know. No, I can swear it was. But that's over time. As people get to know your brand, as they see you around, they'll form that emotional connection. It's not something that happens overnight, you know? Google has slowly infiltrated our language. When you see it, people automatically know I'm going to be able to find what I'm looking for. Whether you like them or not is besides the point. It's the fact that they provide a service that a business support aside for Google began with just Google branding around its search. They can deliver search within five seconds. We should be able to do everything in five seconds. So offline, tangent, yeah, yes. OK, so there's a couple of things you can do. If you have a development site, you can have people go to your site, have them navigate it, and then maybe fill out a survey or provide you with open-ended answers on how they navigated the site. With Think Company, it's a little bit bigger. We have a little bit more complicated website at Janney. So we're doing decision trees, which were really confusing until we realized it was confusing because our navigation sucked. So we're like, oh, OK, well, we need to fix that. But for smaller sites, you have SurveyMonkey or Google, have free options for surveys. You probably have a client list. So there are people that you can reach out to and say, hey, we're getting ready to reboot our website. Can you help us out? We would really love if you could help us out with our new website and our new look and give us feedback. And people who love your brand will absolutely participate. Oh, in the back, in the dwell time. Well, I think there's a lot of things. So one example from our work is that we, all of our digital properties are on different CMSs. One of them is Blogger. Responsiveness, OK, we needed a responsive site. The content on that site is really popular, right, because of them to go. Going back up the page, the bottom of the page I'd be able to do is take a look at the time. If there's a minute or two, they like the content, but there's nothing for them to do on the bottom. They're like, oh, well, see, you don't know. My last one was to make sure some of them are really long. So they get down, and sometimes they click on the footer, but usually they just leave. Whatever dentists read about. And they had to take some time to really consume that. I love the, maybe, I don't know. No, that's scary. I am not going to go to the dentist now after that. And are they going to get this? And then the back will do something about how the project is constructed. There's a lot of different reasons why people get on-site and out. You're welcome. You mentioned, frankly, it could be as a point of view. Are they on WordPress? So all of the questions that would be, how would you achieve them on WordPress? OK, so my own websites are on WordPress. So I run a website called Gave Friendly Pennsylvania. It's a directory platform that allows people who are in the LGBT community in Pennsylvania to go and find companies who we love the gays. I maintain that through WordPress. And I chose WordPress because I'm familiar with it, because it's accessible. And because I know all of you guys. And if I have a problem, I can say, oh my god, Susan, what am I going to do? I just crashed my website. And she's like, just write the hosting company. I'm like, bingo. The decision-making process that went into Janney's websites were varied, because we're still in 1.0 at Janney. And by 1.0, I mean early 2000s. Their IAPS is our main CMS for our website. And that's a .NET. And it hasn't been updated in nine years. All of our infrastructure for Janney, and from what I understand, larger companies, is .NET. So in choosing the CMS for design, we went through. And WordPress did make the final cut, because I was pushing for it. But ultimately, we needed a cloud solution. And we have 30 issues that we need to be mindful of. And .NET provides 30. It was felt from my IT team. So an issue. So for me, WordPress is accessible, because the templates are free. And if I want to buy a template, I can. It's accessible in that way. But for larger companies, I think some of them probably get away from WordPress, because it's open source and cost isn't an issue. So does that make sense? Cool. Five minutes? OK. Oh, OK. One more? No? OK, one more. So how many in here know David Dill and Thomas from Content Strategy? OK. David Dill and Content Strategy have a developer who's working through the development aspect with us. And then we have a designer and a researcher. And so they're doing user research. They're doing industry research. They're doing, to end up the interviews with our company to find out what the company wants and needs and the direction that we want to go. And right now, we're in the process of design. So we're doing wireframes. So they're doing much everything, and they'll help with implementation. They're also doing our branding for us. So does that answer your question? Cool. Thank you guys. I appreciate it. Remember to connect with me. If you have any questions, I'm always happy to help out.


With the same ladies and gentlemen with a huge round of applause, allow me to welcome our panelists. Please welcome Ms. Hema Malik, Chief Investment Officer, Media Brands India. Let's welcome Mr. Puneet Bekel, Director of Marketing Mastercard, Sameer Sethi, Vice President and Head of Brand Marketing, PolicyBazaar.com and Mr. Ujwal Sinha, Director of Marketing, Cast 24. And let's welcome our moderator for this session. Please welcome Mr. Lloyd Matias, Business Strategist and Angel Investor. Good afternoon everyone and thank you for your attention. With the last session I understand between you and lunch, so I promise we won't keep you long despite a little delay. What we're here to discuss is really the impact and you know what sports means as a media property for various brands and specifically in the context of cricket given the fact that cricket overrides most sports in the country. And we have a very interesting panel. So starting from the extreme left, there's Hema from IPG Media Brands. She buys media for a range of clients ranging from Samsung, Tata Motors, you know Emirates, Aramco, so we'll get a great perspective from her. Then we've got Puneet from MasterCard and MasterCard have been, shall we say, long time sponsors of sport, specifically cricket in the context of India besides what they do with FIFA and soccer worldwide. So I think that's interesting. We have Sameer from PolicyBazaar and they again have been huge, you know, kind of sponsors of cricket and sports on television in general, given the category and the huge growth that PolicyBazaar has seen. And of course to my immediate left is Ujjwal from Cast24, another big user of sport marketing in general and cricket and specifically the IPL in particular. Before we get down to the discussion, just a couple of contextual points. I think you have to recognize that, you know, India as a country has about 950 million television homes, linear television, people with some form of television. I think that's a big number. And as per data, about 720 million in the last one year have watched some sport on television. So predominantly, I would think cricket would be the dominant part. So in a sense, linear television is still, shall we say, the dominant reach medium when it comes to sports in the country. And that's one critical part. Obviously, one is seeing growth in properties, cricket, various levels, right, from bilateral cricket to tri-series to international cricket to the ICC World Cups, various formats, the ODI, the T20, various formats. And one is also seeing the huge growth of IPL. That's been another significant growth. So even in the context of something like the IPL, we're talking about 420 million odd users, right? So that's remarkably large. And even as other categories of live sport grows OTT, I think linear television or television in general is too big to ignore. And what I'm hoping to do in this in the next 35-40 minutes is get a sense from each of our colleagues here in terms of how they use this medium and how critical is it to their marketing plans. So maybe I'll start with Puneet and try and get a sense of MasterCard. I know that you guys have been taking a deep position on cricket for I think at least the last decade. And you also sponsor all the in-home bilateral series, any country that comes to play in India, MasterCard is the title sponsor. But besides a tie-up with the BCCI, I also understand that you guys have a very strong position on television sponsorship to leverage your sponsorship. So we want to understand from you. One is why the deep interest in cricket, how does it meet your brand objectives? And two, what are the interesting things you do to leverage MasterCard's association? Check, check. So it's been four years that we've been associated with cricket since we signed on legendary ambassador Dhoni. We've been sponsoring cricket across sponsorship both on ground and on on air, okay? And what do you realize, just to add to your point, Lloyd, out of the 700 million consumers who consume sport in India, approximately 630 million consume cricket. And there was a recent survey done by I don't know the name of the institute, but 80% of people would prefer to watch or consume cricket on large screen. The reason is because one is it's fun to watch an experienced cricket on a large screen. Mobile screens are too there's a lot of distraction when you watch live cricket on mobile because it's screen on screen, notification, and this is one sport where, you know, it's where you form a rare occasion within the family where you watch the end, this sport together with your friends and family. So hence the attention, which you get while your consuming cricket is much higher and hence TV is a preferred medium from that perspective. To add to a few more points on this, TV still today considered as the most trusted medium. In fact, TV ads is still the number one choice across brands to build a positive impression and possibly the weightage is given by the consumer when he or she sees a TV ad is similar to the weightage given to a recommendation by a friend or a family. So it's a brand safe environment plus the scale which cricket brings to the table and higher attention span all put together, I think is a great place for any brand to be part of the cricket ecosystem. So I think we are deeply committed to sports in general and cricket obviously there on. Thanks, Puneet. That makes good sense. I'll just come across to Sameer and Sameer in your category, which is insurance and policy bizarre. You all have pretty dramatic seasonality, so to speak, right? So the Jan Feb March quarter is obviously a peak quarter as they are ending and obviously April onwards is when the low starts and builds up. But you guys have also been very very big actively involved with cricket as a television sponsor. I understand that you've been one of the prime sponsors of the IPL as far as television goes. So why don't you talk us through a little bit of how policy bizarre leverages cricket for maximum impact? Sure. Thanks, Mohit. So I think fundamentally everybody is aware of the basic facts about cricket as a medium. It is a single largest aggregator of audiences in India. Everybody knows about that. It is also the biggest accumulator of male audiences if certain categories want to advertise to those audiences. There's unlike, you know, it's unlike anything else available on television. What's a slightly less talked about fact is that, you know, cricket could possibly be for a whole range of brands irrespective of how big or small their marketing budgets are, whether or not they operate in one corner of the country or nationwide. I'll give you a small example.  If you're a player operating predominantly in let's say Tamil Nadu, you can just pick up the Tamil feed which is not just you know another feed in terms of just commenting. I believe the entire regions broadcast is packaged separately. So those viewers are equally engaged as much as Hindi or English viewers are. If on the other hand you're a very niche premium player, you can choose to pick up either the English feed or you can pick up, let's say only the high definition feed. So there is something in it for all sorts of advertisers. I'll give you an example from policy bizarre's point of view. So currently we operate at a relatively larger scale than we did, let's say seven eight years ago. So I remember 2015 World Cup, I was still with policy bizarre then and I was you know, we were discussing whether or not to invest in the World Cup. This if we did would be back then the biggest bet we would have taken on cricket. The budgets were relatively limited compared to right now and we thought you know the the tournament is is potentially too big and engaged to miss. So instead of you know having little presence across the entire breadth of the tournament, we decided to have a relatively more prominent presence just on the high definition feed so that you don't get lost in the clutter of multiple brands advertising at the same time. But you also reach out to a very quality audience and you engage them in a way that no other tournament can offer that chance to engage you to engage them in. So yeah, I think it's a it's it's a myth that you can't really do customized targeting on linear TV. You just have to find ways around it. Thanks, Samir. I think that's a great perspective that you know as much as one talks about the advantages of personalization in the context of digital. I think plain old-fashioned linear TV in its own way gives you the opportunity to pinpoint your targets by language feeds by HD various formats, and I think that's that's a great point. I'm going to come back to some of the other points you made which is about saturating a medium taking let's say one feed and you know ensuring you have quality presence as opposed to spring you know relatively thin around and we'll certainly come back to that. But I want to go across to Hema now because she buys cricket for a multiplicity of brands a company does and what I understand a little bit of the thinking and the process that that you go through when you're recommending a relatively mass but also a high-outlay property like cricket right and in the context of say Samsung or Tata Motors or some of the large players and I noticed that you know a lot of a lot of the brands that in IPG media brands portfolio have used cricket extensively over the last few years. So maybe Hema you can talk us through some of the experiences and how it's worked. Thanks. So first I think I just want to add very interesting. So Punit spoke about how we want to watch sports on large screens. Can you hear me? Yeah. So just before I answer is it okay? Can you hear me? Okay. So Punit you spoke about that sports people love to watch sports on large screen and very interesting for one of our clients who are into color television as a category and they were always blips in the sale when there used to be large sporting events be it World Cup or be it IPL. That's when the sales picked up because that's when people want to you know invest in a good experience to watch sports. So that's very true and that's one of the added reasons why TV makes a lot of sense and adding to some of these point of course it's the largest aggregator and therefore all clients are experience, you know my personal experience on different categories at different life stages. So when I talk about categories, I'm talking about established large beverage category, which is like highly penetrated categories to categories which are tech categories, but large large players and established players to new age categories which are maybe you know digital payment or other such categories. Cricket has a role to play for each one of them in different ways. So it is not typically seen as a quick reach and a build brand of the rest building brand awareness platform but I think its role is much beyond that. When cricket happens, when IPL happens, there is no escape. If you if you're advertising I mean all data points especially if you're talking to certain set of audiences and if you're not talking to people who are non-primetime viewers absolutely there is no escape that you can miss IPL and that clearly builds a very strong case for IPL or for any other sports for cricket especially. The numbers are huge. The numbers, I mean your top 50 programs during IPL will be only IPL matches. I mean maybe somewhere in a 51st or a 52nd program could be a regional program. So that's the power of cricket and the combined power of the combined reach of any high impact shows which also comes at a premium you know comes close to what IPL can get you. So clearly the number is a big reason for all our clients to believe in the power of cricket on television and as I said that various categories, I think what is very critical for us what we see is that you need to be very clear on why you're getting into IPL or why you're taking into investing that level of monies because if you're clear on your role whether you want to talk about a new news you want to build brand awareness or you want to have regional focus or engagements because I feel Disney Star has done a fantastic job of grooming the platform, the kind of investments that they have made behind making it multi-lingual. I mean the power of it's a national, it's the only platform which is national and there is no other platform or content that can you know get the entire country together. So but within that national platform, how have they figured out geographical solutions by giving language feeds, by giving local brand ambassadors or local assets in terms of commentary. I think that allows a lot of brands especially which are into a portfolio. I mean I don't want to name my clients but they are clients and the entire portfolio can leverage the solutions so beautifully by you know looking at specific brands being played in certain markets. So there is a certain way we look at clients which have a single product and to advertise on there is a certain way that we look at clients which have a huge portfolio and how entire portfolio can have focus, customize solutions for each geography which is an offer that IPL gives us. So yes, absolutely I'm in our experience and we've measured it very clearly. We have I think very important for all clients to ensure that there is a measurement matrix either you know they should do their own or be in partnership with star but clearly go in with an objective, what is the needle that you want to move and do measure the effect of that and we have seen good results. As I said different categories, different life stages of category, but there is a needle that moves provided your problem identification and your solution is in line. Great. So short point cricket moves the needle. It has reach, it has impact, it has scale and also I think what you're calling out is the fact that there are relatively customized solutions. So if you want to reach a distinctive geography or a distinctive set of audiences you can get there. So I think point well taken. Coming to you Ujwal and you know I know cast 24 has you know grown phenomenally in the last seven years and I think cricket has been your primary property, a brand property both on air as to some extent on ground as well. Yes. So why don't you talk us through your experience of you know how you guys have leveraged cricket and you know some of the unique instances when it's possibly helped you all get an edge over your other competitors. Sure. Thanks Lloyd. You know I think Puneet and Sameer spoke about the reach of television and the viewership that cricket gets there, right? So around 80% of people who are on TV do get in touch with cricket and you know when you look at the car market today, auto market, I think roughly one out of 12 households have a car. So the headroom to grow is huge, you know, and that is where you want to reach out to the masses, right? And that is where you feel cricket is your best bet considering, you know, the TG of automobile has a very good overlap with cricket. Little but thankfully we are seeing positive signs of that interest coming back the last two tournaments including the ICC T20 and the bilateral before that both of these tournaments rated very well. This also gives us a chance to, you know, also reach out to a lot of these audiences throughout the year. We are not just dependent on the IPL period being the sole cricket tournament happening, which is a great thing for us because we're not a seasonal advertiser.  Because two of our core categories are term insurance and health insurance. Both of these are relatively low-demand categories. So a lot of advertising we do is to create new demand. And while obviously the efforts are more fruitful during the season, but you have to still keep on doing it the rest of the year as well because you need to create that demand. It's a very, very low penetration category. I'd also like to add one point to what Puneet mentioned about, you know, owning the entire tournament, looking at on-ground, looking at on-air, etc. So what Policy Bazaar has done very consistently is broadcast advertising. We've done a lot of FCT advertising and there is a very fundamental objective behind it. See, we are operating in a very low-demand category. We're trying to convince people that hey, you need health insurance. You should buy it. You need term insurance for your family. You should buy it. We're trying to convince people to enter the category. We're trying to convey the relevance of the category to them. To be able to do that, the audio-visual format works best for us. Storytelling is not possible on a static logo print. Thankfully for us, we are also not operating in a very heavily competitive category. If we were, we would also be advertising a lot on-ground to be able to build a higher recall versus the competitor. To gain an edge over there. But, you know, thankfully we're not. So we're just advertising a lot on FCT. We're doing a lot of storytelling and that happens throughout the year because we've clearly seen if we stop advertising, the demand sort of, you know, in a very immediate manner, it starts to go down. So overall advertising, yes. And cricket, I think, is like a cherry on the cake. It adds a significant chunk to the overall GRPs that you were getting in the plan anyway. So yeah, IPL is important, will continue to be important while it's slightly off the season. But I'm sure all the other relatively smaller cricket tournaments are equally important. Great answer, Sabir. Thank you. The kind of elephant in the room and, you know, one must address it, we are in peak FIFA season, right? And lots of people are taking fair amount of football and one expects that this very niche audience grows through the course of this tournament, especially when the knockouts happen, right? So, of course, a lot of the timings match in Indian time being in Qatar, you know, there's a 930 game, there's a 1230 game. Want to get across to both Puneet, you and Henhema. Understanding, is there a belief that other sports are really an option to cricket, right? One has seen in the last, say, decade or so, growth of other leagues, right? India Soccer League, there's the PKL, the Premier Cavaldy League. You've got badminton now, you even got a chess league going, various formats. To what extent are other sports a viable property for brands, right? Maybe brands that can't afford big-ticket cricket spends. Do you see brands building sizeable, you know, recall, sizeable impact by taking a deep position into other sports? Maybe you want to start Puneet and then I'll have Henhema. Yeah, so we've been doing and listening, doing a social listening exercise for almost 12 months. And the key to the tool is to figure out and pick up conversations which are consistent with volumes. And the reason why we're doing this is to understand in our target audience, which are the factors which is the most talked about and which the audience are more passionate about. And over the past 12 months, there are three buckets which we have found. The first bucket is women empowerment. There's a lot of conversations about women empowerment. The second bucket is Pride of India. And this is where sports come in, you know. The entire point of Indians representing India on a global stage, which is Olympic sports, which is sports like badminton, that is when you see a lot of conversations and a lot of affinity from the audience and support towards these sports person. The Nira Chopra phenomena. The Nira Chopra, the Lakshasen, for example, is the world number five now as we speak. And the Himadas and, you know, the entire non-cricketing world, if I may say so. From that point of view, we have a lot of associations and we will, you will see a lot of associations from MasterCard supporting sports outside of cricket. Purely because it is data proofs that there is a sense of cultural homecoming, if I may say so. You know, that's a, that's, especially the younger millennials feel this vibe, which we today see, which was not the case possibly four years back. Great. Himad, just a, yeah, your perspective on this, other sports. Yes, there is definitely a role that other sports, emerging sports play. Depending on what your requirement is and what are you chasing, if you're chasing reach, may not be, the answer may not be yes. But, you know, if you're looking for a passionate set of audiences, if you're looking for a specific set of audiences, definitely, whether it's football or kabaddi are talking to quite a different audiences. But yes, they both have a huge potential to, for brands to, and in the long run, I think this is the right time because they are emerging as we call them. It makes immense sense to associate with them right now before they get crowded like cricket and be associated with it. Like we always used to say, you know, there was a time in our media strategy presentation, we used to tell our clients own cricket and be dominant. I don't think so anybody can own cricket and be dominant because it's so huge and it's so expensive. But I think that opportunity lies in the other sports, which if you're targeting youth, while the IPL may give you numbers, but yes, at the same time, the audience that you will get in FIFA will be a different and a focused set of audiences and they see your brand also in a different line when they see your brand in that environment versus when they see it in a mass environment. So, yes, there is scope provided you're not reaching, chasing reach numbers. So I think key takeaway we're seeing there is that you're saying there is scope for it, Nish, for other sports as well. And I would say the other thing is, you know, in my experience in the marketing space is also that brands want to be in a positive environment and sports. Cricket, of course, because of your scale, but sports in general is a much more positive place to be as opposed to be, shall we say, relatively more toxic environments and one is, you know, and that begates the next last question, if I may, in the context of Twitter and toxicity, and I want to get your thoughts, Samir, briefly on the fact that sports provides a very safe, positive environment, right? When people are, shall we say, not really the controversial family sitting around enjoying sport, having fun, you know, snacking and doing the good things. There have been properties sometimes that peak, but many brands don't feel very comfortable, right? News is once a genre sometimes that, you know, I know the big spikes have been involved myself in the past during counting days of election, but there are brands that stay off it, saying that this is not the best environment. How do you guys see, you know, other spikes that come in, which are outside of cricket and the sporting genre, and even though they might give you a huge amount of eyeballs? I completely agree. I couldn't agree more. I think when a brand scales beyond a certain point, the ability to take risks decreases from a media point of view, which is why we obviously like to operate purely in a brand safe environment. Cricket is largely and I think almost entirely a very brand safe environment. We have, you know, seen globally very, very few controversies around football, et cetera, here and there. Not very commonplace, very isolated, but we've seen those. With cricket, it's been fairly consistent. It's a very positive sentiment around cricket. I think brands generally would like to be associated with very positive sentiments because it drops off. And, you know, also with leader brands in their respective categories, it is expected for them to, you know, operate in a lot of very big tournaments because a lot of times when you do it very, very consistently, the audience also start expecting you to be there. And if you do it over a period of time, you form a bond because these are repeat audiences. Day in, day out, you'll be able to build a recall that somebody who's off cricket won't be able to because, you know, like we said, it's happening throughout the year. Great. And this is that last point just to bring you in which well is that the context of, you know, cricket being a good brand safe environment. I think the other exposure that brands take is with ambassadors. You guys have, I think, MS Dhoni for quite a while right now. And is that also a concern that now and then if the ambassador gets into a controversy, what happens to us? Do you all kind of have a little watch out on that front? Yeah, of course, you know, that can be a deterrent at times. Goes with the tough. Yes, it does.  And that's why I think, you know, MS is, is I think the safest bet that we can have. And and of course, you know, it's it's not only that they get some real good stuff also with them. Right. You have a cricketer for a brand ambassador. You know, he's got a national appeal. You don't have to go for regional stars. So I think that also plays in the favor. Fantastic. Thank you. That's been a wonderful discussion. Thanks, Pima, Puneet, Sabir and Ujwal. I don't have time for questions. So I believe you to the paucity of time. Well, we won't be able to take any questions as of now, but feel free to contact our panelist of the record, maybe for the same. And with the same, I'd like to thank you all and offer my sincerest apologies for the slight technical issues with the same. Can we please have you all in the front for a group picture? And I'd like to request Mr. Shalini Shankar, National Head, Business Development, Luxure Media Group and Mr. Atul Bhalla, Vice President, Luxure Media Group to kindly join us on the stage to present a small token of appreciation to the moderator and our panelists. Thank you so very much for a rather interesting session and for a lively discussion. Thank you. Thank you so very much. Thank you.


application security. Note that it's not demystifying web applications as security, it's not demystifying JavaScript security, it's application security in general. So today's agenda, we'll cover XSS, cross-site scripting, CSRF, cross-site request forgery, JSON attacks, click jacking, click baiting, PTSD, RSS, one of the reasons why it's very hard to start with security and especially web security is the fact that there are so many security exploits.  So we won't do that. Instead let's change the topic and really talk about security in general and how to think about security in a different manner. So we won't be talking about a laundry list of X, Y, Z, this is how you secure this particular attack, this is how you worry about XSRF, CSRF but instead let's talk about how security has evolved and really try to understand where the real threats are and the aim of this talk is to really give you a thought framework on how you can think about security in your application that will allow you to at least be aware of the threats and then decide on a case-by-case basis of which ones you want to tackle and how do you want to tackle them. So really if anything I would call this talk how to think about security right and we'll focus on what we call attack vectors, what are the various ways that you could make your application insecure. Warning or caveat, this will have stuff not necessarily related to JavaScript, it's more of a holistic approach to security but that's really what is needed when you start working with security. So very quickly about me worked at quite a few different places started my career at Google, worked at Amazon where I was also a security reviewer reviewing different applications and also headed the engineering at hopscotch, written a few books again and again and again on Angular, first version, second version so on and so forth and currently I run two different startups one focusing on consulting basically rent a CTO for startups and things like that and run my own product startup providing a B2B solution for FMCG companies. Now in all of this security has been something that I have been a part of or a lead for at various organizations and that's kind of where this thought process comes in from. So Amazon I was reviewing applications that were going out for production and this thought framework really helps us ensure we get a good coverage across our application. So before we go deeper into that right life in this Stone Age or life before internet security was easy you had to physically lock down things provide access cards and that was about it no internet nothing life was easy then came web 1.0 and this was the era where I kind of grew up where suddenly things were available on the internet people sitting anywhere could access anything thankfully this was still the day and age of your server rendered HTML browsers were dumb useless and annoying but you still had the first set of attack vectors you had things like XSS and CSRF which were still dealing with today and that was it browsers were dumb there weren't that many attack vectors you did the bare minimum security was okay and data wasn't fundamentally online not enough data was so it is still okay by the time we started figuring these out web 2.0 happened browsers became better JavaScript engines became better and like this comic puts instead of pearl or regex I now have JavaScript and that's just increase the number of problems I have I love JavaScript but it is a pain sometimes right what happened basically we started saying everything that we could do on the server there everything that we used to do on the server let's put it on the client it's faster he doesn't have to make a server call I can do validation there I can start doing business logic there I can start doing access control there right and that's the path towards hell you start doing everything that was the domain of the server on the client fair enough maybe it's still faster a better experience for the user but when we start doing these things solely on the client that's where the problem really starts of course it wasn't enough that we just had this JavaScript explosion of things that you could do on the client you also had this explosion of frameworks I remember JS for a few years back where everyone I talked to was either an angular developer a react developer a backbone developer and there were really very few people who were JavaScript developers or front-end developers back-end developers are not around anymore God knows what happened to them right and you had people who spend time using getting used to frameworks and over time suddenly this responsibility of security who was responsible for security kind of disappeared front-end developers were focused on getting their features their UI things shipped back-end developers were focused on giving the API's and no one really was talking or thinking about security of course unless and until something blew up unless and until something was so critical that it was boiled in from day one but otherwise security is the last consideration we have if it is a consideration at all right so let's take a step back let's take a very standard client server architecture as basic as it can be you have clients web Android iOS making server calls multiple servers running you have a database very very simplistic right where are all the threats where do you consider yourself to be at threat in a setup like this if you talk to a security developer you say every single line every single box everything is a threat which is true anything could potentially could be under attack but I would put to you that the real threat is when we start copy pasting code really stop understanding what's happening really start focusing on getting features out rather than understanding how it works rather than understanding the true setup underneath right and that's where we start going wrong so going back to possible security exploits right it's very easy to say okay let's look at the OWAPS top 10 let's look at this list of security holes that were exploited in the last one year but I would put to you that this is a non scalable model it's very hard to keep on top of every single security exploit especially considering the fact that there's a new security exploit every other day so how do you deal with this how do you build an application that is secure while still allowing yourself to be set up for success while you do the bare minimum threat assessment and it all starts with trust if there is one thing you can take away from this talk is that you need to keep thinking about trust all the time when you're building your application when you're updating your application when you're adding a new feature if you can think about trust you'll go a long way to securing your application trust is a tricky thing so let's do a quick exercise how many here show of hands would trust a guy that looks like this no one really trust shady character okay good for you guys but what about Batman how many here would trust Batman all right quite a few comic book folks Batman is trustworthy you can always trust Batman right but what if Batman was really Superman and it's happened in the comics right even the most trustworthy character even the most trustworthy user in your system may not be trustworthy right if there is one thing you can do as a security developer or as a JS developer who thinks about security be like Madhai Moody constant vigilance don't trust anyone don't trust anything because if you don't trust anything it's hard to go wrong it's very hard to be betrayed lose data have a security exploit how does that work in real life right it's easy to go about being paranoid I'm pretty sure I could get a fake eye and attach it and walk around like Madhai Moody but does that really work so instead I say don't look at security exploits look at attack vectors trust of course being the most critical one and this goes across all the attack vectors you'll see that in some way or the other most of the attack vectors come back to trust but then with that context with that hat of trust or a tin foil if you will think about transmission when data is being transmitted is it secured when and where data is being stored is that secure are you hashing signing cryptographically hashing data correctly and we'll talk about each one of these as we go along what about the credentials and notice here we're not in the domain of JavaScript as such some of it is part of JavaScript some of it is outside but to be a complete developer you need to think about all these things libraries it's in this day and age there's a library getting created every six seconds probably not a true fact but close enough and audit log so we'll talk about each one of these but again the fundamental rule of security don't trust especially your user especially the guy you're building your application for don't trust him because that's where most security exploits start and when he gives you data trust that even less question every single data element where is it coming from who's the originator is it somebody from my company some external user how is that transmitted has it been transmitted securely where all has it been stored and how has it been stored when in doubt don't trust it and at the end of the day while you can do all these things on the client and we'll talk about some of these on the server it is as critical that the server trusts the client even less than you do so role-based authorization user-based authorization access control is a must again not trusting anything that the client sends the flip side of that is convenience and who here hasn't actually shipped something for the sake of getting a timeline agile programming we all know it somewhere agile programming has become let's ship things every quickly every week every day God knows what happens to security it rarely happens that that bug that you said that nobody will ever use that code pad that no one will ever touch that fix that you added for just one week till you ship the next thing it rarely disappears and it'll rarely be the case that it'll save mankind so don't rely on that either so let's talk about trust right and there are a lot of talks today and tomorrow which cover different aspects of this talk specifically going into security authentication identity my role here is to be an MBA talk about everything without actually going into details of anything right so let's talk about trust the source of the data right where is it coming from has it been mutated or is it pristine has somebody changed it where all has it been stored and most importantly even if you don't know any of that right what is the impact of trusting it what could happen because of trusting that if you think about these things you'll end up with what we call trust boundaries supremely trustworthy data I've never seen anything that is supremely trustworthy somewhat trustworthy data and completely untrustworthy user input completely untrustworthy so you'll do everything in your application to secure it make sure that it can't go out of its zone to access data identity in the web apps relying on the client on the user to tell you who is is like accepting this ID card who here would accept this ID card just out of curiosity right login is fundamentally the only time we ever asked the user who is if you're relying on the user or the client or the browser to tell you who they are by themselves you're doing it from post log in you're relying on the servers own hash something that the server only knows to reliably identify the user and even after that right it's very easy to forget when the user says perform this action check out add this item to card place an order or view the order details you need to make sure that one the user is who he says he is to the user has access to that resource that he wants to act on and three he can actually do the action on that resource that he's wanting to act on and if any one of these three are missing God save you again don't believe the client when he says I want to check out this order that's where most security holds start so don't trust again going back to that same philosophy do not trust the user then we come to transmission secure transmission in web apps I've seen quite a few web apps while I'm auditing while I'm browsing which do this crazy thing of saying I'm gonna make my application so secure that I'm gonna encrypt the JSON payload do some cryptographic hashing send it to the server the server will then decrypt it and it's so secure really what you're doing is just reinventing HTTPS and probably in a really really bad way just use HTTPS don't reinvent the wheel or use secure web sockets if you're using web sockets but use accepted standards rather than trying to reinvent the wheel for the sake of security secure not just the transmission but also the cookies also who can access that right so when you're talking about data being transmitted make sure that only the client or the server are the two parts that can access that information and no one in between every non-secure transmission is a leak waiting to happen you don't know where all your hops are from your router to your ISP to finally your server any one of them being compromised is your data being compromised so don't do it if you're not on HTTPS Rome would anyway cry so that's a mood point but use HTTPS then it comes to storage and storage you need to think about of course how what data is stored where is it stored is it stored on my database is it stored on my client and what parts of data are stored your standard thing you store it in the database make a call fetch it send it down to the client well what about on the client do you cash it you store it in local storage if so what data do you store what is the impact of someone else accessing that computer you need to be able to think about all these things when you start thinking about storing the data and it's not just your database if it's stored forever it's it stored for a particular time and here also just like trust boundaries you have different criticality levels of data highly critical data payment information user information versus maybe some cash on product listing and the like which might not be as critical and the way you deal with each kind of data is very different so you need to be able to think about these things you assume that this data is going to leak if it's stored there and then think about what would happen and if you're okay with that it's probably not critical data and if you're not okay with that you need to rethink how secure you're making that data of course in the end who has access to that data whether it's your database whether it's in your cash whether it's on the local machine or the phone who has access to how can they access it can somebody else some other browser some other client some other user some other website access the same data and what would be the implications of that so data is not as simple as get the data render it cash it and move on think about what you're caching where you're caching how long you're caching it for as well cryptography is the last thing as front-end developers we usually think about but if you're using it if you're abusing it don't reinvent the wheel just like HTTPS use accepted tested validated libraries use open SSL metal things like that rather saying I have figured out how to cryptographically hash I now I'm going to build my own RSA algorithm for doing public signing don't do it use secure tested libraries credentials and access if you're AWS credentials database credentials if you have access to them or if your code needs access to them think about where they're stored are they checked in are they in your code are they coming from configuration and who has access to the philosophy of credentials is that they're never checked in never available searchable it's need to know basis and nobody needs to know ever except for that one guy maybe so credentials rotate them keep them secure don't check them into your code base please don't check it into get libraries who here keeps their libraries that they're using up to date keeps updating their versions how often how does it monthly who does it every six weeks anybody do it once a year at least right two out of 700 not too bad maybe it's hard it's annoying and especially so if you keep waiting till you have to do it node if you're using node has come out with this nice way to check which libraries need to be updated because of security and PM audit but make it hygiene update your libraries especially if they're a minor version upgrade keep doing it don't wait for too long and keep an eye out for security disclosures which no one ever will so just keep updating assume that the libraries that you're using are updated with the latest and greatest smaller regular updates are always easier finally audit logs assuming you've done all of this which you won't assuming you've made your application super secure which you won't be able to you will need to be able to always later deep dive and see what happened post facto and that's where audit logs come in and you need to be able to know exactly what happened in your application who did what and by the time you need it if you don't have it it's too late so think about logging audit logging from day one and make sure it's comprehensive make sure that every action is taken care of whether it's client side calls whether it's server side actions whether it's database mutations so on and so forth make sure all of this you know what is happening with your system who is doing what and make sure it's trustworthy the worst kind of audit logs is someone who can go in and change it as well if a hacker gets access to your system they shouldn't be able to mutate your logs so think about immutable audit logs whenever you can so taking a step back right we covered a whole bunch of different attack vectors not all of them are applicable to each and every application but fundamentally think about these things if the only thing you keep asking after this talk is do I trust X do I trust why that's good enough right do I trust the data from the server from the client and remember you can't trust data just because it's coming from your database how did it get into the database who was the originator of that information if I'm Amazon Amazon marketplace data that were created by Amazon employees would be more trustworthy and third-party seller listings so the source of that data becomes important as well do I need the entire data the worst thing you can do is just say here's my database here's my entire data send it down to the client think about do you really need to send all parts of this information down to the client can that data be cached can that data be used should it be persisted and then is it secure in all aspects while transmission storing it and are you using the latest and greatest libraries if you can do all of that you'll be one step further in the fight against security exploits thank you any questions at this point so I'm interested in knowing what are the laws by government agencies like to nail down the people who might have attempted to break such securities would you just repeat that one more time I'm interested in doing the laws the audit logs yeah the security laws against the people like the attackers or hello yeah so security logs itself right so think of it there are no great out-of-the-box solutions for audit logs itself like at restock for our own product we created our own system which tracks all mutations at the database level we have a separate system to log all server calls to see who did what at what point and then we have a system running on top of that which is basically looking for deviations from the norm so we have a norm line saying these are the kinds of actions expected and any deviations from that gets flagged so we started with very basic logging manually checking and then we built a automated system on top of that to flag out deviations very very custom inbuilt I haven't found a great out-of-the-box solution for it anything else hello I'm Pradeep I have a question about most of the JavaScript code resides in the browser right so could you share some details about the browser the way it helps or something best practices we can use inside the browser to make it secure so the browser already does a lot to make your application secure so cross domain requests are blocked by default unless you enable course so you're kind of guaranteed that request to your domain are generally coming from your own domain other than that you still have the whole glut of XSS CSR of attacks that you will need to protect that you will need to do some frameworks if you use them automatically do that for you but what it really comes down to is knowing thinking about so XSS itself right you trust the data if you do trust the data XSS is not an issue if you don't you need to make sure you're using a framework to protect against that cross-site request for three again different domains should not be able to make the calls should not be able to embed things like that so browser does a lot it's doing a lot but it's upon us to make sure we know what other things can go right it will not protect you with identity or access control that's completely up to the developer to take care of in their own application so you need to be able to define that boundary of what is being taken care of by the browser and what in my application I need to take care of over and about anything else hello can you suggest your open source tool just to a one-stop solution kind of thing to test everything out I mean I know this is kind of quite like not I've not found a great free tool for that but let's discuss after this yeah sure I'm just trying to understand like as a developer like maybe things that identified are at a later stages by the queue or something especially on the security perspective so I'm just trying to understand if there is any tool which can cover maybe which is also updated on the security box that happens there are there are a few open source tools I can't remember the name for them but starting at the OS top 10 itself starting from there will give you a list of each one of them comes with a tool for testing it there are a few paid libraries and frameworks which give you complete testability and all that but usually paid I think we were primarily focusing on the web application so when we come to mobile applications say it is a different ballgame right so many things reside inside the mobile itself so what are the main things that you would look for in case of security in mobile applications it doesn't fundamentally change right so you still have just like when I this is an application security so you're still looking at what data can I store on the client whether the client is a browser or a mobile app doesn't change much so if I don't want to necessarily store my users credit card information on my mobile even if it is encrypted because I might be encrypting it down on the client itself access control the problem still don't change so a lot of these attack vectors still remain whether it's the browser or the Android or an iOS device yes each device has its own special technicalities of what can be accessed or not but going by the rule of thumb don't trust keep it minimal you won't so you said don't read when the wheel when it comes to cryptography when it comes to using so what are what is your thoughts about using that in conjunction with some of your own custom logic so the question is what are you trying to do with the custom logic right what additional benefit does it offer over the existing cryptographic libraries and the security that you get of transmitting it over HTTPS or WSS or something like that I'm specifically talking about the cryptography let's say you're using hash or something right or not not hash in general let's say using RSA or something but you know that RSA could have its own set of exploits that can be done on it so I think if you use some custom logic with that you might eliminate that possibility so the question is would you as one developer or 10 developers be able to do more than a framework that is being contributed by so many developers over so much time if it gives you peace of mind go for it when you say trust is the main point so trust is the main thing where we have to check and check the boundaries from the customer angle what is the specific domain related or product related thing we should include in terms of security and if you are including it at what point is it during the stage of requirement or how are you checking those so could you just repeat the first part I got most of the last part yeah first point is you said trust is the main point right so we have a lot of technical things where we can take it off but main thing is from a customer angle it may be specific domain related functionality related there can be some security that can be implemented so that kind of instances are something you have seen like that so again trust right when I say don't trust the client it's not that don't trust and don't take his input or don't deal with him at all it's take his input but do whatever you can in your application to validate and secure that data right so when you take input from the user and have to display product listings in HTML make sure you're secured against excesses attacks it's also how that data will be stored how will it be used when it comes to trust so it's scary that if you take data and directly display it later in some other part without securing it that's untrustworthy but for the most part taking the data from the user if you're not rendering it as HTML and things like that must be fine so trust boundaries really comes down to saying I can take data but it has to be treated in a certain way when someone uses it and anyone who is a user of that data later should be aware of where that data came from and how it can be used so that's really where the trust boundaries come in


Well, hello again, been a long time. I know you miss me Let's do some molarity molarity is one of the ways that scientists Quantify the concentration of a solution In our everyday life, we can use words like Concentrated or dilute whenever we're talking about things, you know, you go to the grocery store and you go to buy thing of laundry detergent it might say three x concentrated on it and Fantastic makes you buy it Might work might not who knows that that's daily life, you know, we run into things that might or might not work all the time In science, however, particularly in chemistry, we got to be very careful with the amount of stuff that we're dealing with so We need a better way to approach it We need a way to quantify it or put numbers on it and molarity is one of those things we can do I'm looking out the window here going wow, I've never seen this in your life So empty I could have driven to work today and got out on time Make sure all you seniors watch my molality video because I did teach today molarity abbreviated with a capital M equals the moles of solute over the leaders of Solution Again abbreviated with capital M That's important because the other one molality that I'll be doing the video for next is abbreviated with a lowercase m So they do mean two different things make sure you're aware of that not only when you write your measurements down But when you read test questions and things like that as well, make sure you know capital M from molarity And it's moles of solute on top solute is what is dissolved in the solution and its leaders of solution on the bottom This is a total There's nothing in here about the solvent and that's important because in the next equation there will be You got to read these things carefully and make sure you know what you're dealing with So it's the moles of the solute the substance that is dissolved divided by the leaders of solution or the total amount of mixture that you have So at its simplest You would have a problem That looks something This one question number one what is the molarity of of a solution that contains 4.53 moles of lithium nitrate in 2.85 liters of solution in This question we have moles and leaders and if we look back at our equation, that's exactly what we need moles of solute in this case lithium nitrate and leaders of solution So all we got to do is substitute and solve for this one molarity capital M Equals moles of solute divided by leaders of Solution so that would be the 4.53 on top and the 2.85 on the bottom Let me punch this in my calculator real quick 4.53 divided by 2.85 is 1.589 Around that 1. 5.9 fills up the calculator display So we're gonna round remember the test you're taking a multiple choice as long as you're close enough you'll get it Unit wise we just put that capital M there because that's how we abbreviate molarity And it's always good to write down the formula of your compound This is lithium Nitrate lithium is li Nitrate a te means polyatomic ion Ate and I te are the endings we put on polyatomic ions. So I look at my table of polyatomic ions. That's no three Now let the ends are group one. So it is a plus one oxidation number nitrates in that table of polyatomic ions This says it's negative one oxidation number plus one minus one those cancel out. So there are no subscripts And the formula is li no three Now that's the straightforward application That's one where you don't have to do too much thinking too much work to get it done as we know Chemistry is never that easy. There's always some kind of other work We have to do and that's where a problem like this comes into play There's plenty to do in this one like figure out formulas calculate formula masses do mole mass conversions Do metric conversions this single question here test at least five different concepts that we covered in chemistry So you've got to know all five concepts to get to the right answer You got to know all five concepts on a multiple-choice test to even get any credit This is the difference. It says grams here and because it says grams. I don't have what I need for my equation I need moles and liters. So I got to get that grams converted into moles And that's where most of the work in this problem comes in I'm doing osmium three fluoride Osmium is OS that's its symbol from the periodic table the Roman numeral three is its oxidation number Fluoride ends in IDE IDE tells me just a plain old non-metal. It's fluorine And fluorine isn't group 17 group 17 has a negative one oxidation number So the three comes over here and the one goes over there OS F3 Now that we have a formula we need to do a formula mass There is one osmium in this particular formula one ninety point two three and you know, you're doing multiple-choice tests here So really do you need the decimal place values on that? I'd say not You know, you get it close enough. You'll be able to pick what the right answer is and pretty much every question So we can just leave this as a whole number if we want to fluorine There's three of those and each one is 19 so three times 19 It's 57 Add them up and we get 247 grams That is the molar mass or formula mass of osmium three Fluoride if you have any issues with that go back look through my video history. You'll find a video on doing Formula masses watch that and go through to get Any problems with the formula go back and find the formulas for iota compounds thing and Watch it Now with this number we can write an equivalence one mole Osmium fluoride is equal to 247 Grams of osmium three fluoride Now we'll use that to convert these grams into moles So we always start our equation with the number that we're given times in a fraction bar and Then we're going to put grams on the bottom and the reason we're doing that is because we're starting off with grams Whatever you're starting off with here has to go on the bottom The other number the one mole goes on top Ignore the one because it doesn't do anything mathematically the 247 is on the bottom. So we'll divide by that 214.2 divided by 247 Calculator spits out a big old number point eight six seven two zero six four seven seven seven We're going to round that to point eight seven And that's the moles that we need to do our molarity calculation Now this one's got even more work in it because this one I haven't given you liters of solution. I've given you milliliters of solution So you're gonna have to convert that as well both numbers in this question have to be converted into the correct units for our equation Because our equation is very specific Our equation says I have to have moles of solute I gave you grams so we did that conversion And it says leaders of solution. So I gave you milliliters. We got to convert it to liters King Henry died by drinking chocolate milk kilo hectodeca base desi seni mille I gave you a milli We need base unit one two three places to the left so I take 67.3 One two three places over Fill the empty place value with a zero. So it is point zero six seven three liters Now to do the final calculation molarity equals mole solute Over liters Solution so moles of solute is that number zero point eight seven Leaders solution is that number zero point six seven three Divide them out point eight seven divided by point six seven three Is one point three There you have it We want to put that formula on there. So we know what we're talking about osf three You never want to put a solution up without the chemicals name or at least formula on it. So there you go Molarity one of the most important concepts in the unit. I'd see you can almost count on that having Some question one or two on the final exam


Hello everyone welcome back another iOS 17 tutorial. This is a quick one going to show you how to turn live photos into animated stickers in messages. It's very easy to do. First off I've opened up a message here to my brother Mike and I'm going to go ahead and you can already see I've been working on this so I've already got an example here. I'm going to go ahead and hit the plus on the left side there at the bottom left. Then I'm going to click stickers.  We want to hit that big plus button. When you do that you get three options. You get all types.  I'm going to click on live. Once you get to here you can select any of your live images. Now I'm very partial. Let's take the last one I made here of my dog Kingston with his big green ball at the park. Isn't he lovely? He's just the greatest dog you ever you can ever imagine. Anyways there's my dog Kingston. Now I can go ahead and click on add sticker and not only that you'll see here it's made the sticker I can go ahead and I can add an effect. If I do that it'll turn it into a regular sticker with an effect on it but if I click on him here and then I just move him I can drag him into the conversation. So I can drag him let's say drop him right there.  So there we go. I'll put another one on there and I'm adding stickers into the conversation just like that. That's all there's to it. Thanks for watching.


Cyberfire Marines. My name is Corporal Johnson. I'm a cyberspace warfare operator with Third Network Battalion, and this is your weekly cyber security tip. Fishing is a technique scammers use to steal money or personal information through vectors such as emails, robocalls, web advertisements, and more. Cybercriminals typically pretend to be someone reputable, such as a friend, coworker, or company. Cybercriminals like to use various techniques in order to trick you into complying, such as gaining your trust or creating a sense of urgency. Indicators of phishing emails can include generic greetings, bad spelling and grammar, or suspicious links and attachments. Up to a third of cyber security incidents happen due to phishing. The best thing you can do when receiving an email like this is forwarding as an attachment to these two emails. And remember, do not open attachments or click on links within emails that seem suspicious. I'm Corporal Johnson. Stay tuned for next week's Cyber Security Tip.


The objective of this study was to determine the effect of rotary file length on its resistance to cyclic fatigue. The study used artificial root canal systems made from stainless steel and tested for different rotary files with varying lengths. The results showed that longer rotary files had higher resistance to cyclic fatigue than shorter ones. This suggests that longer rotary files are more durable and can be used for longer periods without breaking or fracturing. This article was authored by Vicente Fosmodos' Vicente Foslaser, Celia Ruiz Sanchez, and others.


Everybody forced here ripping four boxes baseball boxes for Chad see here. Chad's got a 2021 Bowman chrome baseball hobby at 2021 from baseball each to a choice a 2022 Bowman baseball jumbo and a 2022 top tribute Yeah, we'll start with that jumbo just because it has the most cards. Hopefully hit something big and then we'll keep going from there Good luck Thanks again Chad. Let's get a super fracture No, it's all good. I like her pristine Everyone gets a bad rap. We just had We scheduled it poorly last week and it made us have to rush through it I like pristine the packs are meh, but I like the cards. All right, so no paper base will ship everything else ships here first auto in the first pack Edgar caro first Bowman base not numbered and as I Neal cruise rookie to your insert. You don't have to apologize for ordering personal. We haven't under-ripped it at all That's what we're here. That's a service we provide. That's what we're here for. Yeah, Mike. It did I think Thank Castro Light blue paper going to oh cj Abrams the 499 Drew yours is there's two more after this and then yours is to be the third after this drew but no no list and Victor Zach Vien nice Henry Mendez refractor first bowman auto to 499 solid hit there It's probably like 15 20 minutes or so Refractor Marcello Meyer to 499 nice numbered Meyer Martin Mitchell Come on big third auto here. Let's see it Purple paper Rockies color match Benny Montgomery to 199 on super God Not a super, but a nice color still there's a cow Raleigh Gold shimmer first bowman auto Anthony Rodriguez. Very nice 23 of 50 good stuff. What's in base there? Nice gold shimmer Purple chrome Darren Baker to 250. I did Chris. I did nah, dude sim pulled me to To not never medallions feel Watson and Victor. I did hit Amanda Lorentin 99. That's that's pretty cool But overall If there's if I wake up tomorrow, there's spots available and it's next to what I'm joining because it breaks tomorrow night They're spots available on a wake up. I'm joining blue paper. Okay, Brian. Hey is the 150. I will do a decent box of jumbo there Let's go to bowman chrome now bowman chrome hobby 2021 BC. I've been a while so I hope when a hobby box of this I'm all Christian Hernandez We used Rodriguez will Monday as a lot of pretty good names in this this product. Yeah, it feels definitely solid This price have come down a bit. You see striking out a bunch, but he's still so talented. It's still so young Asa Lacey insert so there is a shimmer non-number Jordan Groshans Groshans Groshans Peter Downs summer camp insert. I didn't get to watch most of the all-star game actually Jordan Walker 40 man futures insert It seems a little uneventful. I mean all the scoring happened fairly early and then it's pitchers locked it down Gabriel Rodriguez Speckle first moment of 299 Stanton hit a monster home run and that was pretty much it Been bucks in Homer too, I think Redemption misceller being a bowman chrome prospect auto That's a solid hit there That's still good right now All right, so on the rear on that redemption I think it's like two years here at Mitchell summer camp insert Yeah, dude, but I okay, I saw the bucks I remember the bucks and now do that thing was like six inches outside of the zone high and he just crushed it He's like the best high fastball hitter there is Gold Bobby with junior 26 at 50 nice That's pretty sweet right there That's a nice card good stuff from that Bobby. Let's see another big odd. Let's see a big auto here There's a Anthony Walters base auto Not the biggest but that gold Bobby is sweet few should chrome to 199 Josiah Gray and Howard Dawn of glory Let's see those choice hits now 21 bum a chrome choice. All right first bowman base auto Joshua and kowsky. It's been pretty decent this year for the Red Sox Signed a Sharpie though Atomic first bowman auto hell Chris a la bar as to 100 nice atomic and speckle auto and worky Fernandez to 299 solid box of choice the Fernandez on the back there and 22 tribute now here we go Chad Let's see a trout or no Tony Griffey poppy jeeter moe. Let's see one of those guys Giro base Auto it's Lars dude bar. That's a rookie out of the 199 you think wait can get to 90 RB eyes or you're saying hopefully he can Jeff McNeil on the jersey card to 199 the pinstripe there Xander Cold we got a solid gold grades. Carl you're Stremsky auto to 150 Nice hit. Nice. Yes. Love that design this year Bond soda to 99 the talk of the baseball world recently Derby winner possible trade acquisition for some team Then the coming weeks here Bronville Reyes Shane Bieber dual Jersey Jose L to the Alex Dragman number to 50 Yeah, we're past the halfway point of the season though. So he wouldn't be on pace for it Hard to envision anybody in the Royals getting 90 RB eyes to be fair Just a rookie Joe Carter to to 99 on the green auto here Soto base Got a triple jersey Miguel Cabrera game used to 199 for the future Hall of Famer Soto just really doesn't want to be in in Washington. That's what that means got Rendon and that's gonna do it Thanks again every not everybody. Thank you Chad Sorry, I'm still in group break mode. We appreciate it bud. We'll get those right out to you


What is going on guys? Rudlinal here and it is 6 o'clock at night. What is it? What is it today?   It's been a good month, I gotta say. Like, I've been doing a lot of stuff. As you guys can tell, there hasn't really been too many updates because I've been just been full of, I've been chock full of all these crazy stuff that I have to do. And next, we're going to move into the holiday month, the holiday season. And 2011 is eventually going to come to an end. Wow. Man, it feels like this year is just sort of like breezed by and I've been doing a lot of work with Null Show. Like, I started this website this year and I've been trying to like showcase what I've been doing this year. And looking back, it's almost, it's kind of cool. Just being able to look back and see everything that I've done over the last year. And even then, there's still a lot of stuff to come and I haven't actually posted everything that I've done. And that makes me feel sort of crappy. Like, it is incredibly embarrassing when I tell you guys I'm going to do something and then proceed to not do it. I almost feel like, I feel bad. And the thing is, I do really want to put in the effort to get things done for you guys. And I feel absolutely terrible because I'm like, I'm telling the world, yes, I'm going to get this done. I'm going to upload Hamlet's up on the Null Show. I'm going to write the post for it. I'm going to make it so you can download all the programs. Because the download section is down right now. I'm going to work on a PHP script that will modify the code section of the page. Just like the jQuery slide-down bar works for the navigation on the left-hand side.  Yeah, it's just like, I feel almost a little bit scatterbrained. But, boom. That's all. Let's talk code. Let's talk about what you're watching right now. This video is what I was telling you about in the last code commentary. This is some Python footage. And I wrote this script in my digital graphic design class like I was telling you. I wrote this actually in school. So there are a couple moments in this video where you're actually going to see me go into Photoshop, do a little image editing, and then just show my teacher. So if there's some idle screen for a few seconds, don't worry about it. It's just me showing my teacher. But, yeah. Other than that, this Python code is something I'd like to post up on Null Show. I really need to post almost everything that I'm doing and writing these days.  Okay, I'm losing my thought here. I'm losing my thought. No, no, no, no, no. Python, this code that you're watching right now, I wrote this for trying to organize some network shares. Like, I had found all these network shares with the NERSOFT.NET tool, the Net Resource Viewer, NetResView, or whatever they call it. Since the thing is with that, when you're scanning for, like, net shares, it's kind of hard to do so because if you're in an infrastructure where there's tons of computers, you don't know which of those computers is going to be on or off. And the thing is, like... Sorry, I'm clearing my throat here. You don't know if the computer is going to be on or off. And obviously, if the computer is off, you're not going to find that net share. So the thing is you would run the program at different times and then you would get different information. The thing is you'll eventually get the same information.  You have to sort through the file and see what net shares you've seen, which ones you haven't, and all that. So that's what I wrote this Python script for. It felt kind of good. It felt good to be actually playing with Python because I haven't done that in so long. And yeah, that was all it was. The way it works is that it imports the OS module. And that's good so I can use file manipulations and stuff. I think the open function is built into Python. The open function lets you actually open a file and read through it. But the OS is what lets you test for path directories and stuff. Because you see some work on my USB drive here. So I want to make sure the path exists before I actually open all the files in there. So yeah, we used the directory, the OS module, to test if the path exists. Sorry about these speech problems. And then it's going to go into that path. It's going to display all the contents of it. And it's going to look for the ones that are actual HTML files. That's why I think I do a little bit of an if statement there. I do like if the file ends with .html. If it's an HTML file, then go ahead and just open and save that. Create that into an array or something. It loops through every single one of them. And then it opens them up. And then when you've opened that file up, you're going to loop through that HTML file. And it's going to be, it's in a table, I think it was. It's in a table, each net share is in a table row. So it grabs that part out and it adds it to an array of the things that it's found. If it hasn't already found that line, then it'll add it to it. If it has found the line, it'll ignore it. Because we don't need to record the things that we've already seen.  So yeah, that's how the logic works in this. And I think I, did I comment through it? I might have. I don't remember too much of what I was writing in this. This was kind of a little bit ago. And that's the thing. I do feel bad that some of the work that I'm sending you guys is a little bit delayed. All right, all right. Enough dead air. Enough awkward silence. Let's move on to the next topic. This video, I don't know how it's, I don't know how well this video will come out. Because I'm actually trying to render. I don't know if render is the correct word for it. But I'm trying to export this video by using OpenShot, which is a new video editor for Ubuntu and Linux and distributions like that. I don't know if it's cross-platform or not. I don't know too much about the, I don't know too much about the program yet. But it was, it was like, it was one of the big highlights on the Ubuntu Software Center. So I'm like, okay, yeah, totally, I'll try this software. And then like, that's the fun of Linux is that you can try different things. You can try new things without having to have to like, use a crazy machine and stuff. But it feels good. So I'm playing with this new program. Hopefully it'll, it will take less time to render and everything like Kayden Live did. It won't be as slow. And I don't know, yeah, yeah. But I don't know where I was going with that last line. Forgive that. Don't even, don't even mention it. Just forget I said that. Pardon my cough, guys. But yeah, that's about it. There's Python code. There is this new, this new OpenShot video. OpenShot video editor. And right now that's all. The last, last night, I actually did have some free time because we had a long weekend for Thanksgiving and all that. At the last day of my break, I started pumping out some Linux distributions. Sorry, guys. I started. Wow, that's embarrassing.  I tried to make some live CDs for random Linux distributions. So Linux Mint 12 code named Lisa just came out very recently. And that's wicked cool. I'm not a big, like I'd never played with any other Linux distribution other than Ubuntu. So being able to do this was tons of fun. All I did was I would download the ISO.  So I've got a Linux Mint 12 code named Lisa. FreeBSD 8.2. I've never, ever played anything like played with FreeBSD whatsoever. So I feel like that's going to be wicked cool. OpenSUSA 12.1 running gnome.  OpenSUSA. I haven't played with that one too much either. I just booted into it and I thought it looks pretty and then proceeded to go to the next Linux distribution because I felt like I was kind of short on time. So I was just, I was trying to get the ISO, burn it to a disk and then move on to the next one. But yeah, I've got Linux Mint, FreeBSD, OpenSUSA. I tried Fedora 16. I tried Arch Linux. I've got Ubuntu 11.10 ready to rock. And, wow. That's all I see. Maybe I didn't do as much as I thought. But in all honesty, it was tons of fun. I could just try all these new Linux distributions, see what I liked, see what each distribution did, see what ones didn't do. And looking at gnome 3 and Unity and different desktop environments. I feel like I should learn a little bit more about FreeBSD just because it's a cool operating system. I don't know if it's all command line interface, but for my run, what I had ran from the installer. There we go. I think I finally got that sentence out. What from I had ran, holy crap, I'm not even going to try and attempt that. When I ran the installer, it was all command line. It was all text based and I don't know if anything else is like that. But, oh goodness, code commentary is almost over. Wow. I actually talked more than I thought I would in this one. Thank you guys for watching. I know I'm over my time limit now.  But, whoa, whoa, whoa. Oh yeah. It'd be cool if you could give me a like, maybe a comment, maybe a favorite, maybe subscribe. I don't know. Do what you do, people. Have a great day.