ntially removing the circulation assistant. Some funding for community engagement and the aid of voices. These are the areas where I heard more than one person say that they were on board. I do agree with Jim about interpreters of the polls. Okay, great. So it sounds like the only removal that was proposed by more than one person is the circulation assistant. Okay, Angela, let me just, let's align on what we're looking at again. Okay, so can you start back at the top? Let's put pause equity director back to yes. Leave the housing director at no. Leave the youth interventionist as is. The circulation assistant eliminated. We're keeping the other things. St. Michael's amendment, we want that, right? Is that what shifts us from 47 to 9,000? Correct. Okay. Like, yeah. Yeah, oh, yeah, yeah. Just gonna do the math in my head, yeah. Yeah, we got the new revenues there. Okay, and then scrolling down. We have the mediated voices and. To interpreters. Take that one out, please. It's less than 5% that's increasing. Could we put the youth interventionists to the current hours? I went with the reduced hours because that was, you shared full, Bryn shared it at reduced. But tell us what you didn't specify. I went full. And I was actually advocating for pause. I am advocating for pause too, which is why I figured middle would be the reduced hours. Can we just see it though? We can see it. Yeah, 4.85, let's see it. At full 28 hours, that's projected right now, 5.2% increase, but it used to $409,000 more. Can we put it back the other way, Angela? Yeah. 5% And don't you need to put pause, youth interventionists back to yes? Or is that not how that works, that calculation? If I do that, you're actually gonna see a lovely little red thing. I see, okay. That's why they're in the box. You can't cut the same money once. And is there something? Like, the agency has raised her hand. Paul, did you bring her over? Hey, I just wanted to say because I know somebody zeroed in on the technical circulation of this and the library. I'm gonna speak up about that one because when that position came on, I noticed there was a significant difference in the programming of the library. And so I would just caution you once you make that change or consider making it, then the impact that that has on the number of people who come through the library, not only the number of people that impact, but also the quality of services in our library, when someone has to balance being at the desk or being in the back, actually working hand-on with kids, it's an incredible impact. I would be really, really sad to see that position made. Thanks, Daisy. Michelle, is this still with Arvid 409? Yes, it is. Could we reduce that back to the 363 or whatever? Do you wanna bring it to 5% tax range? Please see what that number is. Yeah, let's see that too. It's gonna be Angela guessing for a minute. Yeah. Triangulating. Almost. More than 400,000, I'll get you to 5% with that second services and remaining cut. So, based on what we each put forward, this is where we find alignment. But now is an opportunity for any additional debate. Can we just have a minute so I can? By all means, yeah. I just wanna scroll through the thing again. I don't know if I say something later, okay. We haven't talked about it, but I don't know how the rest of council feels about the potential of using ARPA funds to fund the equity director. Yeah, we can discuss that. I think it's, we've already gotten ourselves in a less than ideal place from using grant money to fund positions ongoing. And I still believe that we are doing, with this proposal, we are doing a lot of foundational groundwork that's necessary that's gonna better support that position in the future. But it's certainly not just up to me. The equity director that ended $17,797. I think the way I was thinking, I don't wanna speak for Aurora, but you can chime in. I believe, last time we talked about having 1.4 million left over after using the amount that we're already gonna use to buy down the tax rate. So, at like, sorry, Angelisa, like a hundred and something, that was it. Currently a hundred and seventeen, but remember that would inflate as well, every fifth of the year. So I think if we funded that position using ARPA for two to three years, we would still have just over a million dollars to use, which is a good chunk of money. It's not the biggest chunk of money, but I think it's still a good amount of ARPA funds to use to fund whatever we decide we wanna use ARPA on. I know it's maybe not exactly what we had thought of for ARPA, but again, this is a position that I think we need. A lot of members of the community think is really important, and it was grant funded in the beginning, ARPA's government money at the end of the day that we weren't expecting to ever have. I know that we could get in the position again, but I think that by having these conversations about how we are planning to fund this position and the need for that position to find their own grants, I would feel much more comfortable personally if in three years or in a similar position, when we can't fund it, we've weighed out the expectation of how this position gets funded. That does, that would mean that we're using 50% of ARPA to fund operations. Just be aware of that. No, it's definitely something, I don't think I would have eventually considered every town's using it differently. Sometimes I've just used it straight up for infrastructure, others are still waiting to figure out what to do with it. Each town's needs for ARPAs are different, and Wunerski is always a very different city than everybody else. Elaine, you want to? So I haven't had a chance to discuss with any of you, but staff recommendation on use of ARPA is to wait until the main street bits come in because there is the danger that they might be higher. I cannot guaranteeing that. And again, it's unfortunate that the timing is working out that you don't know before being able to make an informed decision about that proposal. But that is a possibility. I think we could wait for that and have this discussion again still. The proposal to use ARPA on the ED role doesn't have to be made at the same time as this. That's true. So there is the, just reflecting back on the memo, the, let me get there, the unfunded needs, those are not insignificant. And Angela, do you have like an estimated total for all those together at the top? Unfunded? I don't know that it came with one. I was 14 years old. I copied it out of the document. So it was 3.35 in general fund and then 15 in water, wastewater. Without the ones without estimates. That's just the ones where we have dollars assigned. Yeah.  There are in general the one and only sentences for projects rather than. So it's just, it's cautionary to use one time funds for operational needs. And so I just caution, have to caution us with, you know, it's unclear if we'll be able to access this same amount of money in the future where we don't have the same grant reporting needs. We know that's a burden on our staff. It's time intensive to apply for and trying to, you know, poke at projects and reducing those costs. We already have a number of different grants that we were chasing after for some of the larger projects, but it's just, you know, we got to, I just recommend looking at a cohesively a time resources capacity because we're hearing time and time again where that's one of the greatest struggles from, you know, looking at the community mediation, you know, $10,000 for that, but that's still being resource intensive. So I just have to caution about using one time funds for operations. Thank you for mentioning that, right? Because using the one time funding and reserves for operational costs actually against our existing fund balance reserve policy that was approved by council, that does really recommend that those types of monies be used for, you know, one time costs or operating costs that have an identified future source that's coming into the future and is known. I think given the uncertainties with the SRO position, what I don't know will happen with the school budget this year in that position and the likely of eight to higher percent increase on construction prices that we're seeing in other places. I think this is, I think it behooves us to wait until June to make these decisions about one time funds, at least. I don't. I agree. It would be, I won't be here in June to have any regrets, but I'll still be a resident. We'll be a regretful resident. I'll be a regretful resident when we can't do main street because we can't make the total cost because of the bond amount. So like I just don't want to see that happen. And if ARPA is a way to avoid that, I think that that's prudent to wait. And to the point of that decision about the equity director and using these one time funds for that purpose, whether or not we change our policies to allow it still does not need to be made tonight or next Monday. What can I ask? What council would think of including it as, including the equity director as a separate ballot item? I'd like to start on that, Oro, because we talked about this and initially I was interested in the idea of putting it to voters. But the more I've reflected on it, I don't think it's a good idea. I think it puts voters too in the weeds of operations. When we had Heather leave the CEDO role, leadership determined that that role wasn't meeting our needs anymore and pivoted it to this housing initiative director. I think having voters vote on individual staff takes away that flexibility and responsiveness. And it's also a bad precedent. Like, do we need to vote to retain a zoning administrator? Do we need to vote to add this housing initiative director? I think it's weird. I think it can be weird to say we need voters to tell us whether to have this ED role, but nothing else. Well, it is as Keith bringing up, a grant funded position that came out of community need and want. So it is slightly different in that way. I also feel like we have heard a lot of community feedback on it. And I don't know. I do want to clarify how this role came to be, actually. So we had the equity summit several years ago with city, school, and community members. There's a series of dialogues after that and what came out of those discussions from community members was the Inclusion and Belonging Commission, the city tours and the school liaison expansion of that. The equity director role came from the small working group within the grant saying we need someone to manage those initiatives. So it's not directly what community asked for. They asked for these other programs that we are starting to make progress on. I think having that role in the future to support them makes sense, but there is just not room in the budget right now for it in my opinion. Do you, I just, I don't see that ever changing that there is, if we are not going to prioritize it, there is never going to be the money for it, right? I guess I just to pose a slightly different perspective on that I've spent a great portion of my career working in state government and it's very common for the executive branch to get authorized from the legislative branch and FTE or a number of FTEs. And then because there's a requirement for leveled funding for whatever, this has happened within the last five years, five to 10 years for the executive branch where the budgets were imbalanced. The executive branch usually when they get authorized in FTE they want to retain it and they don't want to have to relinquish that back into the legislative general fund for it to be reallocated. So from the executive branch side of things it's really common for positions to be put on hold or to be frozen so that the budget can then be balanced so that the position can be refilled. So I guess I've just seen and experienced it from a different perspective. I would say we also add staff, we've added staff to previous budgets. We're kind of doing that here, right? We'll be adding staff next year. Next year could be when this position fits back in. I think to Bryn's point it's like it's a practice as we put things on pause and then we bring it back when we can. So I think it, I don't think overall and generally speaking it's a desire of any of us to pause this position. I think we're looking at an extremely challenging budget and I honestly was a little relieved to hear you say you haven't experienced this since you've been on council because I'm like, this is like nothing it was last year. Yeah, this is definitely a level of stress I didn't think that would be coming considering that we have had a significant amount of federal funding but we're looking at two forces coming, colliding. Yes, we are getting some increase in federal funding. However, that's not keeping up with inflation. It's not keeping up with so many of our other obligations for to meet our salaries and benefits and to try and also maintain the valuable services that the community wants at the same time. It's, it's not, it's extremely challenging. I also think I mean we are hiding the true cost of this investment and I think that should be part of our budget presentation. I mean this is a 12% increased budget but we're keeping the tax rate to 5% or I don't know what the right proportion is but like we also gotta be honest about that and say we're gonna grow our government 12% this year. And just gonna show us. If I remove Orpa, your budget is an 11.46% increase. Tax rate increase and that's not even budget increase. So we're, I think we gotta be clear that like, oh we didn't, we're dithering over 5.1 versus 5.5. This is a 12% or 11.5% budget increase and that's we're addressing inflation and we're trying to keep the burden off of taxpayers using one-time funds, bridging to development funds. I think that's, I think we've done a good balance there. I think we gotta be thinking about what we're expanding and I think communicating that we're making, where we're making, choosing to make an increased investment over inflation is in community services and the asset fund of positions and making those permanent. And I still think making good on some of the recommendations from the years of equity work, which is language access, all resident voting, we've done things that we need to follow through on as well. I think that's where we need to prioritize money. So I haven't heard anyone really change positions. Again, what we have here is moving the housing initiative director up to 40, retaining the reduced youth interventionist, retaining community services admin and rec assistant and the children family program manager, including the mediated voices community engagement and interpretation funding and then removing the second circulation assistant and including ARPA to reach five. Could we bring, try bringing the ARPA back to the 490 and bring the, yeah, four. Yes, sorry. And put the circulation assistant back. Do we have some consensus around this? Yeah, I don't think, we never said the increase has to be 5%, right? It doesn't have to be. 5.06 could be it. Yeah, the 5% number was as a result of the finance and municipal infrastructure commission meeting where they indicated 5% could be something that they would see as agreeable, but this is marginally different than a 5% increase. So $300,000 home, it's an increase of $180 and 60 cents a year versus one set of $880. So it's $2.10 difference per year to your average taxpayer. I'm using 10 grand of reserves. That's what that was the difference between these two was $3.99 and $4.09. Is it just Jim and I who were on board with removing one position? Can I play with the round of it one more time? To what ends, what are you trying to add? Thinking about bringing again the youth interventionist back up. So one of the things that I'm holding is that I went to, I was very graciously allowed to kind of sit in and listen to a community circle that had happened six or probably a month or so ago in which some of our staff were engaging with the budget as originally presented. And one of the things I took away from that was that for our library staff, the youth interventionist position is hugely important to them and making sure that they feel like they're doing what they need to really help our community. So again, I'm considering their teeny tiny space and that it's, you know, only two full-time people who are paid a whole lot. Thinking about, you know, making sure that they have the resources they need to use that's kind of what they, their resources to the best of their ability. So balancing the circulation assistant which as we heard from the community member is a huge support towards freeing up kind of their time to do work, like look for other funds and present programming versus a youth interventionist which also is very important to them and important to other aspects of the community and our equity work. So just seeing if it's a similar small percentage over or portion of a percentage over 5% between the two. So turn back on the eliminating of the second-circuit assistant and we're keeping the youth interventionist as it is. Yeah. Yeah. How much more is that then? Sorry. It's just, it's $4.80 more than youth interventionist was reduced and we kept the second-circuit assistant roughly for an average. So $2 versus $6. It's $6 on top of that $2. Okay. So $2 versus $8. I just wonder which of those two positions is more consequential to library operations. That's what we're trying to have. Yeah. I think our, I don't know. Ray. We're trying to have it. Hello. So yeah, it's, they, as I said, I think both really important in very different ways, right? So to Daisy's point earlier, I think having that second-circuit assistant has really freed Nate and Kirsten up from spending time sitting at that desk, checking out books and doing administrative tasks and kind of open them up to doing more resource seeking program development, program delivery, community outreach. Kirsten actually does a lot of time out in the community as well. She goes to daycare centers, thrive, et cetera. So I think some of those programmatic pieces would have to scale back realistically if a circus assistant were not added. You know, I will say too, I think the youth interventionist position and I've said this in my presentation, it's hard for me to imagine a 10 to 12 hour position in that role being successful candidly. And not because there's a lack of need, but I think recruitment for a 10 to 12 hour position of that nature would be really tough. And I think realistically the caseload, the volume of folks you could support. I think I've mentioned in my presentation it's probably one to two clients at a time versus right now four to five. So I think if the youth interventionists were to be retained, I don't wanna say there's no value in having that shortened staff time, but I think the preference from an operational standpoint would be to have the full 28 hour youth interventionist and forego some of those programmatic components in the library. Again, that's an impossible and icky decision for me to have to sit here in real time and like make. But I think, I guess what I would say is I can see ways for us to supplement what's lost with a second circulation assistant more so than I can see ways for us to, we can't get a volunteer to be a youth interventionist for instance. Potentially we could look at youth training programs or volunteer programs to bring in some extra support. So I think if I had to choose operationally one or the other I think the 28 hours of youth interventionists would be preferable to the circuit assistant. That's right. For whatever that's worth. Can I ask another question related to Esther? Just on the related supplies, how would you balance that operationally? The Esther related supplies line. Say that again. How would you balance the Esther related supplies line cutting that compared to like the rec assistant and the. Angela, can you remind me how much, I don't remember how much is carried in that. 10,000. I believe it's 10,000. 10 is what's listed there for Esther related supplies. It's a hard one in real time without a spreadsheet in front of me to answer. I think could we figure out ways to trim that back? Probably yes. I think one of the things that it would limit our ability to do is to bring in new programs. You know, we'd be kind of stuck working with the equipment and materials that we have by and large. And so it does, I think, hamper flexibility and creativity for staff, but is the department gonna implode if that number shrinks down? No, but I think it would definitely require us to think differently about how we're bringing new programs in and if we're bringing new programs in. So in similar to previous discussions, if we're to keep the rec assistant but cut the supplies, you can pop this whole slate of programming as long as it's exactly the same as what we've done before and nothing breaks. Yeah, yeah. And I think, I mean, generally I think the people are the more critical limiting factor than the stuff. I think there's always, you know, there's ways to figure out the stuff. Again, not advocating for that cut, but I think if push came to shove, that would be, I think the human capacity is more important. I mean, I would propose reducing that. Again, it's like a pause, right? Like, we don't bring new programming on this year, next year we can. I mean, if we cut the Cirque Assistant M4K from the S-related supplies, that's the difference between a 28 and a 12 hour youth interventionist, according to this tool. So it's 21 savings for reducing to 12 and it's 38 for cutting entirely. So the delta for the meters, 17,000. Cirque Assistant is 13, there's 10K and S are related. So if you were to produce S or to six, have the Cirque Assistant, you keep your youth interventionist at 28 hours and that sounds like that combination has the most operational bang for the buck. From what I'm hearing, I don't know. Again, you have the same spreadsheet I had ago. Now that's not a fair way to do this, but that's what I'm seeing in this right now. So I think if you make that negative 4,000 instead of negative six, that's what I was proposing. Oh, that's an increase, nevermind. Oh, the change in there. Would council be amenable to that change? We reduce S or supplies in the circulation assistant and then we retain the youth interventionist at the full 28. Do you wanna go with that? Yeah. Yeah. Okay. We're pausing the Cirque Assistant, reducing the S or supplies, moving the housing initiative director to 40, retaining youth interventionist at 28, retaining the additional S or positions, adding interpretation support and mediated voices. Does someone want to? Do you wanna add something, Elaine? Let's just wait until she's done. Yeah, I was wondering if you wanted to take like a three minute break for Angela to check her. Oh, that's a good idea. Okay, yeah, let's pause. It's 9.17. We also don't need to vote on this tonight. Well, I feel like we should vote so that what you bring back to us at the next meeting. Is it? And moves forward. So one other proposal that we could consider reducing based off of capacity is the mediated community voice program. It made it sound earlier that 10,000 was potentially higher than what staff would even have capacity for. Potentially, yeah. So would reducing that to 8,000 feel like it's still gives you enough room? I would say so. Like if you did it in half, that's assuming I'm meeting a week, which is still kind of a lot, frankly. It doesn't sound like much, but first absorb the input. January feels like, if it feels like January, then I can understand. There you go, yeah. When Elaine and I had discussed this program and said that was going to be a lot of meetings, but if we didn't have as many meetings, it would free up the ability to provide translation, interpretation, or accessibility, or whoever is coming in to provide their voice to the program, to be able to access to us and so that we understand them fully. I mean, Angela, would you disagree? Like cutting it by two or two and a half feels like it's a pilot anyway. So. Yeah, it may not be. There might not be that many people and I couldn't talk to them. Right, but that's like a shaving vomit. I don't think that's an unreasonable question. So, Angela, can you just show us what 8,000 would look like for that line item? Well, the second-circuit assistant being paused, keeping the preventionist at 28, and reducing S-related supplies by 4,000. Given that it's a pilot, feel like that may just be a little bit reasonable, and then. Yeah, I remember that. Yeah. I hear some agreement. Okay. Did we put this on for voting? No, just for discussion, but let's take a vote anyway. Now, this is the budget we would like to see come back to us next week. Does anyone want to make a motion? You're going to have a public hearing next week. Yes. Yeah. So moved. Second. Motion by Thomas, second by Brynn. All those in favor, please say aye. Aye. Any opposed? No. Okay, motion carries. And then we don't, we call the public hearing next week, right? Or do you need a vote on that tonight? That I believe is far- We already did that. Yeah. Okay, sorry. Okay. Double check that. I'm definitely jumping these days when it comes to hearings and when there were more. If you wanted a vote on it, I don't think it would hurt. Great. Thank you. All right, someone motion to hold a public hearing on the budget on January 23rd. So moved. Motion by Brynn, second by Thomas. All those in favor, please say aye. Aye. Motion carries. Okay. Just for safety's sake. Why not? We are onto item D. This is our strategic vision area goal update for all areas. Yes. And I just want to appreciate the hard work that council just went through. Obviously staff had a lot to go on to, but I recognize this is a hard budget year. I did not like recommending the budget. I recommended. But I do feel like you've exercised a lot of responsibility and diligence. So we appreciate that. So the goal update for all in short, we're either underway on almost all items or have a plan to make some progress in this fiscal year. The one exception is the IT services bid, which we're now planning to bid in winter 2023, but we will still be with that timeline in compliance with our policies. Do you have any questions? Elaine, you have a note in here about potentially asking the Regional Planning Commission for support around housing policy. I was just going to make a suggestion that if there's some sort of gap fill here, while we don't have that position filled, we could look to housing or planning to suggest things. Unless staff already has a list going. Yeah, I have a substantial list that's based on what I've heard, but certainly welcome to more input on that. I think there is, if that's a viable path, there is a case to be made. Any work that they did is beneficial to the whole county and not just us. Yeah, actually I ran my list by Charlie a few months ago and there were some things I said, oh yeah, this is fine. And some things, probably not anyway. Yeah, there's some dialogue. Okay, I was excited to see that maybe there's some capacity there while we have. Yeah, and I'll give John Audie for that idea. Oh, excellent. Oh, and can you remind me that IT services, but is that for remote IT services? It does include remote services. It's all of, we call it managed services or they call it managed services in the industry. It's basically making sure that all of our stuff stays patched up to date. All of our networking is solid. Any tech support that happens with any networking, but also our computers and make sure individual workstations are working and are some printer support of all. It's also our cloud server. All of our documents are housed through that. Email service, outlook, or office, rather. Thank you. Does anyone else have questions on any items on here? Progress? Thoughts, but they wouldn't be coherent. So I'll save this for later. Why not? I'll save them. No worries. Any questions from the public? You're probably not looking at the document. Okay, so this was only on for discussion. We have reached the end of this evening's agenda. Do I have a motion to adjourn? So moved. Second. Motion by Bryn, second by Thomas. All those in favor, please say aye. Aye. Meeting adjourned.


What comes in nursing school explained in this video on compartment syndrome. To understand what happens in compartment syndrome we have to first understand the fascia that surrounds the different compartments of a limb. So if we look at this cross section here so there's bone if I for example cut my lower leg the cross section I look at it from that perspective I would have my tibia my fibula as the bones in there but I also have muscle tissue as well as blood vessels and nerves and all these structures are surrounded by fascia and what the fascia it surrounds these compartments and when there's compartment syndrome that means there is increased pressure to any of these structures because of edema or hemorrhage whatever the the cause might be and we look at those later and then because there is this increased pressure the fascia gets compressed so it puts pressure on the muscle on the nerves on the blood vessels as well as the bones because there's only so much space available and when it becomes compressed when it compresses the blood vessels that feed these different compartments they become ischemic because now we have decreased blood flow that leads to hypoxia whenever hypoxia occurs the body sends extra inflammatory markers there to try and help resolve this and increases the capillary permeability then we have increased fluid there and now in an already compressed space now increased fluid means increased pressure and we are back here in this vicious cycle so then again we have hemidema compression of the fascia ischemia so it kind of gets worse and worse and worse that's the pressure bill so there is no real good way out so risk factors to developing compartment syndrome are fractures any kind of fracture mostly of the long bones but think about it when a bone gets fractured there is some severe bleeding and edema that occurs and that puts pressure on these compartments so bad hematomas and contusion so not even fractures but just like a really bad crush injury let's say to the thigh or to an arm can cause some bleeding and a contusion and the bleeding causes pressure on these different compartments casts and splints if we apply those and we don't account for the swelling that might occur after the injury the splint and the cast can act as a constraining factor so the tissue can't expand as it would usually when it swells up and so then it causes compression of these compartments burn injuries certainly because of the the factor of the tissue injury also causing edema and pressure DVT usually causes edema can it can get so severe that there is now this edema causing pressure on these compartments and then heavy exercise so if you keep using your muscles over and over you pound your muscles they will get inflamed they will get swollen they will come edematous and they can lead to compartment syndrome so early signs and symptoms include pain and then maybe normal or decreased peripheral pulses because if we have pressure on these blood vessels then the blood going through well the blood flow going through will be diminished and we can it can be evident in the distal part of the body by diminished pulses if we don't catch this early the patient later will get cyanotic because there's no blood flow coming through there will be peristusia so numbness and tingling because the nerves get compressed there will be weakness or paralysis because now the muscle has impaired movement and impaired blood flow absent peripheral pulses are now not no blood flow is coming through it because the blood vessels here are so compressed that we're not perfusing the distal part of the extremity and then certainly severe pain because now we're talking about ischemia and hypoxia and we always know that that causes pain as for a treatment a fasciotomy is the only way to treat it and what that means is that the muscle the the extremity has to be cut open to relieve that pressure let that a demon at that fluid that blood come out and relieve that pressure on these compartments so the circulation and the nervous system can work again diagnostic tests are x-ray CT scans to look at the different compartments of the severity or whatever the underlying causes and then we can measure the compartment pressure there's a certain tool that the orthopedist carry with them and the surgeons and they can actually put that inside the muscle tissue and it'll give them the reading of the compartment pressure and then depending on how high that reading is they'll determine if the patient needs a fasciotomy or if we maybe can wait and see maybe with elevation ice and those things and then the other thing too for treatment fasciotomy not only but think about it if it is because of a cast or a splint we just need to remove that external factor that castle that splint so that extremity can can swell and these compartments are relieved of the pressure nursing care the five piece of the neuromuscular assessment because think about it what gets compressed here are blood vessels nerves and muscle so we already said that the patient might have decreased blood flow so cyanotic absent or diminished peripheral pulses they might have peristusia by pressure of these nerves and then they might be paralyzed because the muscle now can't move their ischemic so the five piece check for pain pallor paralysis peristusia and pulse so make sure that you review my physical assessment video if you have in trouble with these five piece and of course we always want to check vital signs identify patients at risk and what I didn't mention here is if this is the patient after a fasciotomy we want to do meticulous wound care and dressing changes as order to make sure that that fascia that is many times left open for weeks of at a time doesn't get infected because that can pose a whole other problem list here so thank you for watching this video on compartment syndrome as always the most important thing is staying on top of your patient especially if they come back from surgery which is also why we check their distal five piece so frequently in the post-op period sometimes every 15 minutes for a couple hours and every 30 minutes depending on whatever the mechanism of injury was to make sure that we detect the signs and symptoms early rather than later and the patient might have a bad outcome so thanks for watching please give me the thumbs up if you have enjoyed the video thanks for watching nursing school explain see you soon


We have played a ton of old Dragon Ball games here on the channel, and one that a lot of people loved was Dragon Ball Z Raging Blast 2. Again, though, this is another series that never got an update after all of the new Dragon Ball stuff came out, so what would Raging Blast 2 look like if it had modern Dragon Ball characters? Well, it would probably look exactly like these Dragon Ball Super inspired mods, which of course, once I saw, I knew I had to try out within the actual game itself. Yo, let me finish. Let me finish this. Oh, come on, man. I'm gonna finish it. Bro, you ain't finishing anything, bro. Yo, the video is starting, Nano. Where you at, bro? Oh, no. Here we are with the 25th annual Budak... Well, they're not annual. They're like quad annual. What's the quadratic annual? They're like every four years, right?  Anyway, guess which one I powered up into? Raging Blast 3 is here, bro. Bro, yeah, we are. Woo! Damn, I just... Okay. Why'd you like sail away on my screen? I don't know, actually. That's a really good question. I don't know why that made me laugh so bad. It's just like Vegeta... Oh, Super Saiyan God? A nice choice, a nice choice. A damn shame it doesn't matter, I guess, man. Can you stop? Oh, you're using tournament of power logic. I get you. Yeah, I'm faster this way, Nano. Wait, Meteor Impact. Come on, man. I'm just teasing you. I would never hit you with a full Meteor Impact. Oh, I didn't know you could block that. Why you flipped me around like that, bro? I can't guard like that.  Oh, flip him around. Flip him around. Oh, you're lucky I hit the wrong button. But I flipped him around again. What is this? I was blocking that. I'm just kidding. I would never hit you with the full Meteor Impact, bro. I would never hit you with the full Meteor Impact. Bro, I'm serious. I would never hit you with that. Whoa, what are you possibly going into now? You've never seen this before. Evolution? You got Blue Evolution? I'm just kidding. I saw your video, bro. We all saw the video on youtube.com.nano.genics. But, oh my God, look at how cool he looks. Raging Blast is a beautiful looking game. So beautiful. In fact, I got to run that back. Some might say it looks better than... Don't say it, Nino. Don't say it, bro. Don't say it, Nino. Don't say it. Don't say it, bro. Dragon Ball's universe 2. Oh, and you've done it. And you've done it. Look at those dislikes going up, bro. Oh, my God. Everyone agrees this is the better game, bro. Oh, my God. Stop. Nino, cut, cut, cut, bro. No, I didn't say Dragon Ball Fighters. We all know that's the best game. Come on, man. Cut back. Cut back in to hear that. Oh, never mind. What are you going to now? The classic. God again? You know what? Let me meet you at... Oh, sorry. Sorry.  If you want to be God, let's be gods together. Y'all are looking kind of nice. Not to spoil the manga, but do you remember that one time? Why are you spoiling manga, bro? Why, bro?  Sometimes you got to take it from the back, bro. What are you talking about? What are we talking about? You know, it's just best if you save it there. There you go, bro. That's how I like my fighting. Nice and vanilla. Come here. Oh, did you see that?   No, so sick.  You ruined it. I didn't ruin anything. Come here. Sit down. Just a hot manga cannon, bro. I've never seen Goku do that in my life. Oh, meteor smash? Wait, that's different than... Is that not possible in the same move we already saw? Again, bro? Bro, I'm out here. OK, I'm here to win. What are you doing? Nothing. What are you doing? I'm literally already behind you. Embarrassing. Oh, my God. That was so much reading. You know, any buttons I had to click do this?  Don't do it, Nino. Don't do it. Don't do it, Nino. Don't do it. Now you feel free to do it. Yeah.  I know.  No, no. Oh, my God. No, I'm a Super Saiyan. Oh, no. Dotto, watch this, bro. Can you do this? No, I'm raging now. Can you do this, bro? Huh? No, I can't. Whatever you're doing, it doesn't matter. I'm literally raging. Does it not? Can you take this one, Dotto? Dang it. It's called Skill, Nino. I'll simply not get hit by it. Whoa! Damn, I gave him the old... I gave him the old... Why are you... You just tried to run away. You know, I thought I was pressing the block button and I guess I wasn't. No, you weren't. And now you're dealing with a real Super Saiyan.  Goku just saying it like it is. Nino, can we do one more match? But can I go all out? Is that OK with you? Oh, did you see that? Did you see that, Nino? Yeah, that was sick.  Yes, it is, bro. We're mid... Are we recording a YouTube video?  First of all, you're also placing products in my video. This is... My bad. You're sponsoring yourself, bro. The video is not even sponsored. I'm making $0.00 and 0 cents. And you know what? You get what you deserve. Oh, wait. Nino, you told me you hadn't put a... What's up? Nothing, it just seems I'm struggling to find... I can't find UI.  The ground broke. It's because you haven't unlocked that ability yet, Nino. You must pay me $9.99 in order to be able to do that. $9.99? $9.99, Nino. Goddamn, bro. I didn't know you... Oh, I have no respect for whoever made this field because I am just destroying it. The hitbox! Ruff! What hitbox? What hitbox? That's what I'm saying. Oh, oh, my piece. I swear I'm pressing the block button and it just doesn't do anything, you know? You might want to look into that. You know, I'm just...  Guess what? Here's a fist instead. Where you are getting... Ha-ha! Fight a mag! Ha-ha! We're having a little fisticus match in there. We are, dude. We are, I'm pretty over it.  You're alive? Hold on, I got something for you. Do you? Yeah. What do you got for me? What do you got for me? Let's see. What do you mean, what? Neto, don't be... Don't sound too excited to... First of all... Whoa, whoa, whoa! I almost... I'm a super saiyan again... Oh, follow me. Wildsense? I saw you activate that. What's up? I saw you activate Wildsense. Does that not... Ha-ha-ha-ha-ha! You wild... Ha-ha-ha-ha-ha! You Wildsense thing I hit. Neto, here, bro, take my credit card, bro. Give me $9.99. Just drop some G Fuel on my mouse. Ha-ha-ha-ha! G Fuel TM. Code, Neto. All right, um... If you're going to use the ultimate being... So will I. Hotchie, who is that? How are you going to put costume to... I don't know if it matters. Neto, you don't have it. Did you put a secret mod in the game? You're doing a Neto bit right now. If I see another character, I'm pissed. Ha-ha-ha-ha-ha! You're about to wit-wit. You're about to wit-wit this is my ultimate form. Look at me! Bro, this is spoilers for Superhero. That's what Cell's going to look like. Whoa! I'm sorry. Daryl, you're really making a name for yourself, and it's not a good one. Well, Neto, I didn't want to admit it, Neto, but you're the guy that hacked Toei. Are you not? Toei, get him. Whoa, hey, hey, hey. Ha-ha-ha-ha! It's not done, you know. You know they take that serious, too. Yeah, yeah, yeah, that's what I'm saying. I'm glad you think that is so funny, bro. Bro, it is funny. You know what else is funny?  You're not dealing with the app. What are you doing? I'm not actually sure. Ha-ha-ha-ha! Did you hit me there? Yeah, of course I could have hit you there. You were stating still. Hey, wait, is this character to Cell? It's time. Let's see it. You are. What is that? All right, maybe you guys not enough for Hachi-ek. Oh my god, he headbutt me, bro. This is going to be Cell when he's like, he's going to come out of the little pod, but he's not going to be like all the way done, so he won't have his intelligence, and this is going to be him. He's going to be like an enraged monster, spoilers. Ugh! Donna read the documents, bro. Well, of course, you shared them with me. Now, my god. Oh my god. Ha-ha-ha! Super coming out. Oh my god, look at this. Nato, you're not winning. Give up now. Am I not? Give up now. Don't embarrass yourself, man. What do you think? Are we going to clash this? That's what you... Nato, you should have never done this. Oh, that looks so sick. Bro, he's literally not even trying. Woo! What? Even though it was a tie, Nato? The truth is, you're just not as good as Ultra Instinct. Now, let me end this for you. Did I just... Did I really just rush to my death? Bind you. Bind you again. Ooh. That's it. You're done. Did I just come into this video to get bodied? Like, what is happening? Why are you only playing Goku? You literally have like... All right, Nato. I'll play somebody other than Goku. We could do that match, the Forbidden Match, and it loads fast. Your PS3 is crazy good, man. Thank you, bro. The Forbidden Match? Yeah, bro. Okay. No, no, no, not this one. You got the wrong guy? You got the wrong guy? Huh? You want to go to Vegeta? Oh, you're right! Yeah, yeah, yeah. Vegeta! You see the confusion there, though? Chiyo to Vegeta, you get it? Uh, yeah, I could probably see that. Anyway, you're selecting the map and honestly, whatever map you want, Nato. Ah, I don't know about that one. Ah, I don't know about that one. I don't know if random, like, really Nato is that what you're doing with your map selection? Oh, hey, the World Tournament stage. That's a great choice. Good job. That's probably what I would have picked. I hate it. Yo, bro, if I'm not here to defeat you, then why does this video have 20,000 likes on it right now, Nato? 20,000. That's it. I would think it leads 30. I just kept dodging it. You just kept swinging like it didn't matter, bro. Anyway, go blue. Why am I fighting you like this? Yeah, bro. You have it, right? I don't even need blue. What are you talking about? OK, maybe you're right. Maybe you're right, bro. Maybe you're right. Everyone knows gojita is the inferior fusion, all right? Is that what you're saying right now? That's yes. That's what they're saying right now in the comments section. They're like, dude, yeah, gojita is the inferior fusion. The gojito doesn't even need blue. Why did I kick flip over your head, then? Yeah, take your time getting over here, man. Just any slow. Woo! Oh, I'm going around and around. You can't even see.  I'm embarrassing him. Oh my god. I'm using his head as a stepping stool.  All right, fine.  What's wrong about this, Gatto? Come on, man. We're talking about it right now. Not like this, bro. Wait, wait, wait. Final flash. Sorry, I didn't know that was my move. I know what you're thinking, man. What are we thinking here, dawg? I know exactly what you're thinking. So go ahead, bro. You know what? You finish side.  Why'd you do that? Oh, because you had plenty of time to dodge. Yeah, bro.  You're getting the key last three miles down the road. I could never hit you a key last from over here. But over here, I mean. What was that, Gatto? What was that, Nano? What was that, Gatto? What? I'm sorry, Gatto. How did you live? I lived. Backflip, bro. You didn't even touch me. What do you mean I lived? Oh, step into him. Oh, so we're having a little fisticust match to settle this. Oh, you broke my stamina. Oh, kickflip. Damn. Fight back. Come on, get me out of there, Fugito.  Anyway, what? That's cheating. You almost died to a key last.  Nano, what? Hold on, Nano. Wait, how much health do I have? Oh, I still have a whole bar. I'm good. Nano, what are you doing here, man? I knew there wasn't enough time for you to fight back, bro. I'll give you one more rematch, Nano. But that's all I can do, bro. Then the video's got to end. The video has to end at some point, Nano. The world tournament stage, Vegeta Blue versus Gojita Blue. Who would have thought in this day and age? Not me. Definitely not me as well. You know, I think I want to experience the combo system this game has to offer. Oh, how did you do that? What was that? Nothing, nothing, nothing, nothing, nothing, nothing, bro. Whoa, whoa, whoa, whoa, whoa, whoa, whoa, whoa. What was that, Nano? Damn. You got a hole in there, Nano. It's fine. I can recover. That's no big deal. Hey, speak in a hole. Oh, nope. Right in it all. Yoink, wink, pop, mink. Enjoy your trip, bro. Hold on. Where you going? Mink, mink, mink. Go ahead, bro. Enjoy your trip, man. Nano, been waiting for you. Mink, mink, mink. Go ahead, bro. Nano, just the man I've been waiting for. I'll recover and get out of there before you do that. Mink, mink, mink. Go ahead, Nano. Stop this. No. Mink, mink, mink. And Nano, Nano, it's really, really getting synthetic in the foot. Nano, just the guy I wanted to see. No, no, no, Nano, please. It was just a joke, Nano, a little bit, Nano. It was just a joke, bro. Can't you take a joke, man? Come on, man. Wait, finish line. Nano, I didn't think it was very funny, Nano. Well, I thought it was pretty funny, bro. You still have a lot of health. Must be nice having instant transmission like that. It is pretty nice. I'm not going to lie. What? Why did I instant transmission in front of you? That was a very smart gojita. What are you thinking over there? What are we doing? I don't know. You're scaring me. You're scaring me, bro. You thought that would work, man? It's kind of awkward, dude. Of course, I'm not going to let that work. Oh, no. Oh, yeah. You thought she was sweet, Nano. You thought I wouldn't just give you the hands. What?  There's got to be a counter system, bro. There has to be. Bro, you can't just wake up with a super. You can't do that. Man. Man, that's crazy. What's so crazy about it? The video's over. Get out of here. Come on. You can't kick me out of my own video.


All right. So welcome everybody and thank you for taking the time to see our talk. We are happy to be here at the DEF CON Red Team Village. And we are very excited to share with you some of the findings that we've been doing from, since we did a talk in a previous Red Team Village Summit where we try to showcase and expose basically how dangerous is the leakage of credentials on the internet. And today me and Jose Hernandez, my colleague, are going to be presenting how my key is being pound API edition. So let's get going. So most of you know who we are. I'm a principal security research engineer in Splunk. I work with Jose at Prolexic, which is now Akamai. I work at Akamai for a while. Then I went to Caspita and came back at one point in Splunk. I co-founded Hack Miami and Pacific Hacker Meetups and Conferences and I wrote my own CDFs. Some of you may have Bladen, which is the command and control and of course CDF. Jose, can you tell us a little bit about yourself? Yeah, I'm also a principal security researcher at Splunk. I have an old long-time friend of mine from our Prolexic days, which got pretty much like Akamai. I co-founded a company called Xenich, which is now Oracle's web application firewall and lead-off services. And we turned to Splunk to do research, security research. This is one of the things that we've been working on that I'm super excited about. Awesome. So let's move on. So just before we get into basically what we're going to show you today, it is important that we recap a little bit or how we got to this point. And in order to recap to a point where we can understand how bad and how we got to this very bad situation, we need to understand or take a look at what is DevOps. So as we have approached it before and explained it, DevOps is a set of practices that basically is within software development and team operations. It has become very popular. It's not really new, but it has become very popular and it has been widely adopted as most companies are starting to somehow get a foot in cloud platforms. Some of them have radically moved most of their operations to the cloud. And when we're talking about developing software and producing software, building, coding it, planning it, testing it, releasing it, the first thing that comes to your mind is DevOps. And DevOps is a set of practices usually guided by some software development principles. And the most popular currently is Agile. And some of you might be familiar with Agile. If you have worked in a software development company, I work for now for three software development companies and then all of them were using Agile. And this is how I was exposed to not only the infrastructure, but the risks that are associated with this. So next slide, please. So one of the things that I noticed throughout the years, and me and Jose had been researching on, is that when you use these set of principles and divide it in things that are called tool chains, that go in the DevOps process, there's a number of products and a number of tools that are constantly used, reused, shared and repurposed. One of the characteristics of the, to say in a certain way, the platform that is used for development, software development is at times his ephemeral character, meaning, for example, that you can create containers, destroy them, and then simply recreate them again. So in order for us to give this a little more structure into what we can look at when we're trying to gauge the exposure and risks associated with DevOps, we had to look at DevOps tool chains. And DevOps tool chains basically are a combination of tools that aid in the delivery, development, management of software, and applications for the entire cycle. As you saw previously, there is an actual cycle where you code, you build your plan, release, you test it, and then you go back again. And if you are, for example, in specific methodologies, for example, agile, usually there are sprints and sprints are sets of times that you have to produce a number of features or bug fixes. And all of this is based in a flow that goes through what they call the tool chains. So in the tool chains, you can see there are things that are used for planning such as GIT or JIRA. There are things that are used for coding that involve coding, code repositories. There are things used for testing that implicate things such as Selenium or Bakern or Docker containers, for example. There are tools that are made for software build such as Ansible or Terraform or Chaff. And then, of course, there are things that are within the tool chains that they call deployment, which imply things such as Kubernetes. In Docker, for example, most of these things, like Kubernetes, at times are throughout the entire process. And depending on your cloud provider, you may be very familiar with some orchestration automation languages such as Ansible or Terraform. And then finally, part of this tool chain is the monitoring part. And then we have things usually the main two monitoring tools are either based on EOK, which is Elastic Search, and of course, Blank. Next, please. So once we have seen the picture of the tool chains that are associated with the software development plus the cycle throughout the flow of planning it, coding it, building it, testing it, releasing it, and then coming back, there's one thing that we're focusing today, and that is credentials. Credentials are part of the entire process. Credentials are needed for many reasons. And here's a little bit of some of the highlights of what happens in this process with credentials. So developers, for example, usually have high privilege credentials. Why? Because they had to be able to test things that would run with low privileges. They are supposed to develop things that may be kernel libraries, sockets that need to be created with services or connections. These environments at times are usually ephemeral, like I said, and as a result of that, many times they're dismissed and poorly monitored. We're seeing cases of developers downloading anything from Dock and Hub or who knows what have you, a container repository on the internet and simply putting them in their DevOps tool chains without any checking, without any scanning. And now you may have implanted containers, vulnerable libraries, vulnerable operating systems that will eventually affect and be published into your production environment. Obviously, this is related as well. There's a disconnection between development and security operations. I've been part of this problem many times that I have interacted with developers. Developers usually don't like when you tell them that their code has bugs or vulnerabilities. Most of the times there's not a straight link in between what they're developing. So I'll give you an example. You have a development department and they download, for example, all these containers or libraries or code. Many times there are no tools to verify this. Many times they're not inventory or what is it that they're downloading? What is it that they're using? What libraries they're putting into the software packages? So this by itself is at risk. And as well, this is also very popular and this is part of the nature of the DevOps process. There's just spread use of open source tools. And code. So basically many times I notice in this environment that this code is trusted by itself by the fall. Meaning they just go, oh, I know this developer. Oh, I know this group. I'm just going to download this and use it in my application. And again, this goes back to the disconnection. But it is, there is some sort of a honor code between the open source community where do no harm is always the driver of software development. But it does not mean that we have seen this in supply chain attacks that malicious actors, nation states, criminals in general, may target these repositories, these open source communities and embed by stuff in it. Also, embedded credentials usually end up in public repositories. And that's pretty much what we're going to show you today. How even big companies, how individuals that unfortunately there is no mechanisms. All in all, we don't blame them for what you're about to see. We don't think that they're purposely leaking this credentials. However, it is important that we point this out in order to bring awareness that there has to be mechanisms created in order to avoid the rampant. Because there's no other name for it. This rampant leakage of credentials and we will show today how bad it can get. So when we have also the development departments and DevOps processes where most of these developers have high privilege credentials or permissions, there is obviously a higher risk of insider because it takes less of an effort to cause harm to embed malicious stuff in it or to even destroy it. Like we had seen in some cases before where a person that was part of a development department has come back or a system has come back and do harm to an employer. And another couple of points is that due to the CSD nature, the continuous delivery, basically that cycle that goes around building, testing, developing and coming back to planning and on software, these things get published immediately. That's one of the nature of the DevOps process. The DevOps process has shortened the time where you plan, code build, test, release, basically becomes something almost immediate that goes into production. And this by itself represents a risk because when you, like I told somebody, when you have vulnerabilities in environments that are driven by CICD and things like, for example, an implanted container and you have very large environments, the risk and the opportunity of exploitation increases in orders of magnitude. So finally, and just to put this, to make this even worse, unfortunately, the cloud environments that make this risk even higher. Why? Because basically you are connected to the internet, you publish right away, you stage right away, and if there are attackers that are knowledgeable and are able to pretty much footprint your process, they can do a lot of harm. Next slide, please. So here's a little bit for you to have a reference of how the cloud providers manage credentials. We're going to focus mostly on cloud-related environments. So here's, for example, AWS, they have their own AIM credential service, which usually has things such as passwords, access keys, key pairs, or SSH keys. And also, they do have a number of temporary security credentials that can be created on the go and that sometimes have a feature, whereas you can give a specific user access to, temporary access to a resource that otherwise that user does not have access for. So next slide. Most of the providers have sort of similar systems for managing credentials. However, I had to get putters through Microsoft because they are trying actually to tackle this problem. And as you can see here, they do have, this is an example of how they manage credentials. They use the Azure. There's a framework within Azure Active Directory where it tries to avoid the embedding of credits and they use a different mechanism. We're not going to focus on this feature of Azure in this talk, but it's important for you to consider and look at it because they definitely seem to be aware of the issue. Next slide, please. And then here's, we wanted to give you a little sample of basically what's happening with the three main cloud providers, which is AWS, GCP, and Azure. In the case of GCP or Google Cloud, most of the stuff is based on OAuth, which is a protocol that's used for identity federation and single sign-on. And for the most part, because of the constant interaction and services that are present in cloud environments, obviously, these providers have to come up with a way to allow the interaction of either devices, users and services, dividing and trying to establish boundaries between these entities. And then as we will see soon, this is very challenging. Next slide. So here's a general, when you're looking at credentials, things that you need to consider that are usually used and as such potentially exposed when you have developers that are publishing or storing code in public repositories. So things as an email and password, username and password. Remember, there's a difference between your local, for example, A active directory or LDAP and a cloud identity access management. Sometimes this brings up a lot of confusion. And depending on the integration that you have with your cloud environment, this may or may not plan your favor, meaning if you're not very integrated, losing, for example, the username and password from a specific cloud service will not allow the attacker to access your internal environment. Also, multiple factor authentication is something that's been coming. And at times it can be bypassed by certain frameworks. We've done some work before with Evil Jinx, which basically is able to capture the authentication or the TLTP, whatever interface is presented to the user and bypass MFA. Access keys, we talked about it. Key pairs that we talked about it. Specific account identifiers. And at times they use extra 509 certificates. Next slide. So what are the primary source of leaked credentials? Well, as you will see soon, GitHub is probably the most popular code repository on the internet. GitHub is now used for many other things, the storing files, even hosting web pages, which is kind of cool. So GitHub is like the reference when it comes to the leading internet code repository, not only publicly, but many companies use it. And then we also have GitLab and we also have Amazon S3 bucket storages because the reason why I put this here is because you can definitely search for Amazon S3 buckets that are open or have writing or read privileges. And there's not only data stored in it, but tons of code with possibly embedded keys are usually found in this environment. Next slide. Next up. All right. So as I was explaining with GitHub and GitLab and even S3 buckets, they're not just the only source of leaked credentials. As you can see right now, I basically Google, Google dork aka, which is usually how Amazon Permanent Keys start. And I was able to find this snippet. Fortunately, the person that posted this sanitized his keys. But that doesn't mean this happens all the time. And with this, I just wanted to show you an example that it's not just code repositories. It can be anything. I actually had a friend that lost his username and password for his Gmail and he turned into an absolute nightmare. The attackers actually reset everything he had. And it took him like a week and even him being part of the community to get a hold of Google in order to reset this. So please be very careful with these things. And that was a, my friend was working for a very large company, but there are other examples that we're going to show you where the attacker may not be so obvious yet cause even more damage. So let's go on the next one. So before we can continue on this presentation, it is important for you to understand that when we look at the context and nomenclature of attacks on the internet, on the cloud or inside the perimeter, we always look in a minor cloud attack matrix in this case. Like I said before, we were going to focus on cloud related type of environments. So in this case, we're talking about basically unsecured credentials, unsecured credentials. But for example, if you leave a credential in an Amazon street pocket or just embedded in some code and GitHub can lead to things such as what is called ballot accounts and ballot accounts can be used for initial access, persistence, lateral movement and privilege escalation. And I'm going to give you a, an example of it as we move on in this, in this, this presentation. So just keep this in mind. So let's move on. One of the things that we, we're looking at here is a technique which is T1078.004, which is valid account, cloud accounts. So we're, you're obtaining cloud accounts that basically in one of the scenarios that we're going to propose, we're able to, to find access keys and then allow you to not only access the provider but move laterally and escalate privileges. This, this attack vectors are real. And many times they get dismissed because the company and being honest to you, they do not have an awareness of the reach of the cloud within their perimeters. As we move on in the cloud adoption, there is many hybrid environments and it is hybrid environments. Parts of your cloud infrastructure would allow access to your perimeter either because of the developers do it or because you are in IT operations and there are some servers that have some access to S3 buckets. For example, you have a WAN or you have a cloud VPN. So these are scenarios that are important to consider that are real. There is the line between the perimeter and the internet gets blurred or even disappear with the adoption of cloud technologies. And here's an example, something that you should read on. I know this is an evolving framework and we may be giving you a number that will change tomorrow or even the definition of it. But it's important to understand that there is some work associated with this attack vectors and these vulnerabilities. And this is what we're trying to showcase today. Next, please. So here, as I said this stage, I wanted to give you a little bit of an example and something that we are actually working right now and we will be presenting more research in the future, which is lateral movement and escalation of privilege by simply obtaining keys. You can obtain keys. Jose and I did a presentation, which was called Red Teaming Develops in the Mayan Summit of Red Team Village where we explained ways of either fishing or finding these credentials, which we're going to show part of it today. But for example, if you were able to get, sure if you remember, how I was able to Google for a permanent keys and AWS, which is our AKIA, you can do things as depending on the actual user, you can even create new trust roll policies. You can add yourself to roll trust policies. So for example, let's say there was a trust policy that allows you to access certain buckets where there is sensitive data. You will be able to basically access that data by simply starting from the compromise of these keys or you can create temporary keys by either STS Zoom roll or get session token. It will depend on the policies that are in place and the privilege of the users. However, the boundaries are not that strict and because this is an evolving and new technology, it's not that difficult or far-fetched to say that if you're able to get a permanent keys that have been leaked on the internet, you might be able to basically go around in a specific environment. So here's an example how you can abuse tokens specifically in AWS by either obtaining permanent keys or compromising a session where they're already using temporary keys which usually start by ASIA. And then from there, you can abuse temporary tokens using things such as a Zoom roll. A Zoom roll is a cross-account feature given by AWS to, for example, provide temporary access to a user to a resource that he may not have access to or things like get session token which are temporary tokens that can be used for specific features. So please be on the lookup for these things because this has not really exploited as publicly available but it's definitely something that is happening right now. Next, please. And with that, I'm going to pass it to Jose and we're going to see another demo. Hey, so give me two seconds here. I'm going to go ahead and share my terminal as well as the sites. Let me know when... Can you confirm you can see both the terminal and the sites? Perfect. Okay. So I want to do a demo live today if everybody's okay with that. I don't usually do this but I'm so confident that, again, I'm so confident about how comfortable this tool runs and finds leaks. I want to do it live. And what I'm going to show you in the demo today are basically three basic steps of how you would use the tool that we built to find liquid ventures in L. The first step is going to be installing it and deploying it. The second step is going to be searching for leaked AWS credentials and then the third step, we're going to just really quickly dig into that data that it gets generated from one of our searches for hunts. So the tool... I already have the tab here prepared. The tool is on GitHub. Unsurprisingly, we're searching GitHub for leaks and we're also using GitHub to host our code. Under DB is one. So I'm just going to go ahead and just clone the project really quickly here. And that's going to bring our project down. I'm just going to flip back to our slides. So just a few notes. Again, going back to just... Well, this is coding down. To Rod's point, this leaking credentials is totally... I've actually made these mistakes before. I've been in incident responses where colleagues have made these mistakes. It happens. And there's very few mechanisms today out of the box to protect it, but they're good mitigation mechanisms. Out there is just, again, to Rod's point, it hasn't exploded yet. So it's not actively being mitigated for either. So here we go. We've cloned down, gave a hunt. And the first step to install it is... I'm going to go prepare a virtual environment. And I'd use virtual AMP for this. So we're creating a virtual environment in Python 3 and this is just more for us to install over our dependencies separated from our system Python. And so the next step here is I'm going to activate and then install my required dependencies for the project. The project is pretty lightweight. There's not a whole lot of dependencies in use or it should complete pretty fast. And now I have a... Yeah, the tool should execute just perfectly fine. The tool is pretty straightforward. There's a config file that you really don't have to do much with it besides configuring the actual GitHub API token. So now that we've configured our token in there, we should be ready to go. And what I'm going to do here in this case is I'm going to use one of the example switches that the tool already has out of the box. By the way, the tool actually, before I jump into running it really quickly, I didn't walk you through really how the tool kind of functions. The first function of it is you pass it a search parameter and this is the equivalent of a GitHub advanced search. And we have a few examples in here, like how to find GCP JWT tokens, AWS API secrets, Azure JWT tokens, so on and so forth. And then what it does is it's going to go ahead and search GitHub for files that match these patterns. And then it reads every single file that returns in the results and it checks whether that file has a valid credential from a set of regexes. And by the way, huge kudos and credits to Trafalgar, which is the project we're actually borrowing a lot of these regexes from. But it's a two-step function tool, right? First, it searches for leaked, potentially leaked files, and then it verifies that inside those files we actually have credentials in them. In this case again, let's try to run an example for pulling back AWS secrets. And so once we've run it, the first thing we're going to get back is the total results that we found in GitHub for files that match this. And then the tool is going to go ahead and process every single result. And it's printing out here the actual URLs, checking whether there's actual credentials in them. And here we have a first kind of hit from Bill Rosie, where he actually committed a AWS secret. And if we actually go into this URI, should be able to see his AWA access key. I'm just going to open it here in my browser. And yeah, there you go. That's literally his secret key and it's out of the EU central region. So as I explained earlier with this key, we literally have the exact same permissions that Bill Rosie had in managing AWS. And so the tool, again, the tool runs and it's going to take a few minutes because there's 200, some of the results, right? We're about, you know, lead number 595. And it collects all this data and saves it into a JSON file essentially. Now, while the tool is running, I want to go ahead and show you a bit of... So we grabbed the data on this JSON file. I'll show you at the end of the execution what it looks like. But we grabbed all that data. We've been collecting this leaks for about seven days now. And I pulled some quick reports on what we've collected so far in the past seven days. And for example, for top leaks or top leaks by technology, we have by far a whole lot of AWS API keys out there that we've collected that happened. And second to that is GCP actually service accounts. I couldn't say I wasn't... This did not surprise me. I don't know, Rod, if you got surprised when you saw this data set, but this was kind of somewhat expected. AWS, by far, is the secret that gets leaked the most. Some surprising is still a lot of private keys where I say out there, which I was not expecting. Another thing that, again, just another curiosity is that AWS secrets, if you break this down by the last seven days, it doesn't variate a whole lot. It seems that by far, again, AWS seems to be the normal thing that gets leaked the most. A second to GCP, although what they call YouTube all tokens and the tool called YouTube all tokens are actually generic all tokens as well for Google. It just considers it like a specific YouTube one, but it's not. And so you can see that actually it variates every so often across days. And so for most of our people, they're leaking their Google Suite tokens, which is really what the YouTube all token are, or the GCP tokens, which is pretty bad. Again, now you have full access to whatever they can do with Google on their account. We did a breakdown as well by top companies. And mind you, where this data comes from is if the user, because we're searching GitHub and GitHub gives the users abilities to input things like what blog they have, what their Twitter handle is and the profile and what company they work for, we pull that information back when we have a match since that's open data. And this is just a very, very ugly pressure of what the most credentials by company that we collected were. XBioinch is by far the company that leaked the most or at least that was labeled the most, but we got some pretty big ones out here like Nordstrom, VMware. And again, these are at the top. Like you see here the other flag, it means that there's a bunch of credentials that were leaked, but not necessarily multiple of them. These are multiple credentials for some of these companies. Microsoft was in there. Yeah, pretty bad, at least to say. Yeah, so this is a very revealing because many times, and it's like what Jose was just saying, there doesn't seem to be awareness of how bad this is. And we're trying to show you a picture of we collected what, a week or so, and look all the stuff we have. And we actually, we basically did this for analytic purposes and to show awareness. We could have built even deeper into this data and who knows what we would have been able to get. And if we are doing it, bad guys are doing it too. So this is something that's very remarkable that you see some big names in there. I understand there is a number of mitigation issues like you can say, well, you can get my key, but if your IP is not in my security group, you will not be able to load the game. True, but we don't know that. And the fact that you put that or those keys are being leaked, it opens the possibility. It's almost like an open port. That's how I see it. It's almost like an open port of a vulnerable application. I wanted to say all this data also, and that's a really good point about this. Again, because this is what individuals have put in their company profile. We, there's some garbage in here, like this LinkedIn profile or ABC, which we necessarily haven't cleaned out of our data yet. But this is straight up, again, the users that we've collected or we've seen leaks for, what companies have put in their profile. And again, we also kind of wonder about this down by region. My favorite region so far that users have listed is in your heart. This is pretty sweet. But unsurprising, and actually, Rod, you made this point to me. Unsurprising, there is big cities that have a lot of development footprint. Like a lot of developers and a huge tech footprint are showing up here, right? New York, Mark, this is the March Club in New York, Santa Monica, San Francisco, Sweden, Russia, Pittsburgh. So again, cities that typically have huge companies that the development or a lot of developers in there. Again, the data, we haven't really cleaned up the data, hence what you have in your heart in here. But I just want to give you a really rough view of, like, if we were just trying to aggregate this really, really quickly, and we did it for seven days and what it looks like. Right. And if you were targeting a company, right, which is where you and I were talking yesterday, or we can hypothesize that by the number of leaks, and if we reduce that to the regions, because we know where most of the developers are working, even though that's changing a little bit because of the work from home, that sort of cuts off a little bit of the work that an adversary needs to do in order to try to infiltrate one of these big companies that by omission or willingly may have developers that are posting keys that are revealing too much. That's true, right? By the way, our tool finished here. I just want to give the viewers here a quick preview of what the results file gets written as. So if I just kind of pass this to JQ, since this is a valid JSON, you can see here the data we're collecting, right? So again, we're dumping every result that's getting matched into an array of JSONs here, or actually various JSON objects, and we collect the URL where we found the leak, the check that it actually matched, the different matches, right? So in the matches, purposely, when I'm away to not necessarily store the actual secret, but merely just the keys if possible, the owner, so who owns every repository that leaked that credential, the owner URL, the type. Again, if it's a company, it's going to get listed as a company. The name, email, again, if they listed the company in their GitHub profiles in their blog, the location if it got listed, and this is where this data is coming from over here, Twitter handle, so on and so forth, right? Some of these fields tend to be known if the users don't allow their profile in GitHub to show this data properly. That's the only way we can actually read it. But yeah, again, pretty telling. Pretty telling data set. And with that, actually, I kind of want to talk about one example that stood out to the CEO of a telecom. I'm going to say more than that. It was pretty wild that, again, because the CTO had listed on his GitHub profile, his Twitter handle, as well as his personal blog site, we were able to find his LinkedIn and essentially, for that matter. Pretty much everything. We found pretty much everything about this gentleman and we obviously, we have sanitized everything so you can't find it in yourself. But just like him, there's many, many cases of people that we found. Right, this is just an example. We've contacted them again to clean things up. Our intent is to make sure these things take clean up. Again, we want to bring awareness that this is a big issue. And again, I've made these mistakes in the past, but this is how bad things can get, essentially. It's amazing that you can go for a simple key to pretty much everything, from a lead key to opening the doors of your company, revealing your personal life, personal things. So please be careful with these things and try to implement some measures.


Hello everyone, myself Sanjay Uttgay, Assistant Professor, Department of Electronics Engineering, Valchand Institute of Technology, Solapur. Today, we are going to discuss on Ring counters, application of shift registers. Learning outcome. At the end of this session, students will be able to describe various types of shift registers and their applications. Outline. Introduction to shift register. Types of shift register. S.I.S.O. Serial in, serial out. S.I.P.O. P.I.S.O. P.I.P.O. Question. Answer. Ring counter. References. Group of flip-flops. Shift register. In the previous discussion, we discussed a one-bit memory cell that is a flip-flop. Flip-flop is a storage device used to store a one-bit of information. To increase the capacity of stirring, we can make a group of these flip-flops. So, the circuit is called as a shift register. Shift register is implemented using flip-flops and conventional logic circuit. Number of flip-flops required is equal to the number of bits in the binary world. This sequential device loads the data present on its input and then moves or shifts it to its output once every clock cycle. Hence the name shift register. It means that, as I told you, a shift register is a group of flip-flops. So, the binary information, binary bit can be shifted from one flip-flop to another, either from left towards right side or from right towards left side. Types of shift registers, they are classified upon the way in which data are entered and data to be retrieved. And they are serial in, serial out, S-I-S-O, serial in, parallel out, S-I-P-O, parallel in, serial out, P-I-S-O. And last one, parallel into, parallel out, P-I-P-O. Before going to the serial in into serial out, let us take an example. If we shift the data one bit towards left side, the binary number will get multiplied by two. And if we shift the data binary bit towards right side, the number will get divided by two. So, this is what the purpose of shifting the data, either towards left side, one bit left side, or number of bits on towards right side. The first one, serial into, serial out, the data is shifted serial in and out of the register. One bit at a time in either a left or right direction under clock control. To shift four bits, it requires four clock pulses. So, this is the circuit diagram for a four-bit serial in, serial out shift register. If you look at this FFA, where loading the data at the FFA input side called as serial data in. The clock pulse is given simultaneously to all field clock, FFA, FB, FFC and FFD. Output of first field clock is given to the, as an input to the next field clock. So, QA will be act as a DB, then QB is given to DC, then QC is given to DD as an input. So, data is retried at the FFD output QD, this is serial out. For example, if you will want to load the data 0101, here 0101, I must enter this one which is the LSB. This one is the LSB, the first bit information to be loaded while shifting from left to right side is the LSB. So, at the arrival of the clock, first clock pulse 1 will be loaded, so here it will 10000. In the next clock pulse 0 will be loaded, so QB will be 1, QA will be 0 and these two QC, QD will be 0. At the arrival of third clock pulse, this again FFA, QA will be 1, QB 0, QC 1, 0. At the arrival of the fourth clock pulse, QA will be 0, QB will be 1, QC will be 0 and QD will be 1. Hence, at the end of the fourth clock pulse, the information available will be QA 0, QB 1, QC 0, QD 1. It means that for serial in and serial out, it requires four clock pulses. This is a timing diagram, serial into serial out, SISO. First clock pulse, the first bit information is loaded. In the second clock pulse, this one is shifted to the next flip-flop output. This is the second bit information, this one is third and this one is the fourth. So, at the end of the clock pulse, the information available will be 0101. Serial into parallel out. The register is loaded with serial data one bit at a time with the stored data being available at the output in parallel form. The output is taken simultaneously across individual outputs of all flip-flops. So, here is the diagram. Here serial in means when loading the data in the serial form which requires four clock pulses and we are retrieving the data simultaneously, that is QA, QB, QC, QD. These outputs of all these four flip-flops are available at the same instant. But for loading the data in serial form, we must require four clock pulses. This serial into parallel out. So, at the arrival of every clock pulse, this T1, T2, T3, T4, we are loading the data as 1011. This is the serial in input 1011. So, at the arrival of the clock pulse, the data available at the QA, QB, QC, it will be 1011. Parallel into serial out. Here again, the input is the in parallel form. The output is taken in the serial manner. So, it's a really interesting diagram with a multicolor parallel in where loading the data, the shifting and the loading is distributed by this input, shift load. If this signal is zero, this load, it will become one. So, this one is given to AND gates B1, B2, B3. It means that if this signal is zero, B1, B2, B3, these three AND gates are enabled. These three AND gates are having another input as parallel inputs B1, B2, B3. It means that if this signal shift oblique load bar, if this is at zero, we can load the data in the parallel form. Now, look at this circuit. It's a combinational circuit with two AND gates, output of AND gates given to OR gate. So, output of keys were given to combinational circuit. Its output is given as D1 and similar for the remaining two. If it's one, if it's one, if this signal is equals to one, this A1, A1, A2, A3 AND gates are enabled. Due to this, data queues are loaded to D1. Similarly, Q1 is loaded to B2 and Q2 is loaded to B3. In other words, if shift is equal, if this signal shift oblique load bar, if it's one, the data can be shifted from left side towards right side. That is from ff0 to 1, 1, 2, 2, 2, 3. So, this is what the serial out. Parallel into parallel out. Parallel into parallel out. The parallel data is loaded simultaneously into the register and transferred together to their respective outputs by the same clock pulse. So, it's really interesting because the loading is done in parallel manner, whereas retrieving is also done in the parallel manner. Here, these are the parallel inputs Pd, Pc, Pb, Pa. The P stands for parallel in. So, in this manner, we can give the inputs as Pd, Pc, Pb, Pa to 4-bit PIPO triplock. Again, the clock is given simultaneously to all clock pulses. So, at the arrival of the first clock pulse, the data is loaded to ffA, ffB, ffC and ffD. And at the same time, the data is available at output of ffA, ffB, ffC, ffD simultaneously. It means that in parallel into parallel out, we need only one clock pulse to load the data and to retrieve the data. So, the time required for PIPO is very less as compared to other three types. Exercise assignment. What does it mean by parallel loading of a shape register? Options. All flip-flops are preset with data. Each flip-flop is loaded with data one at a time. Parallel shifting of data, none of the mentioned. The answer is all flip-flops are preset with data. Data is loaded simultaneously with the first clock pulse to all flip-flops. So, this is the answer. Ring counter. The most useful application of the shift register is the ring counter. This is basically a shift register shifting from left side towards right side. There is some modification in the basic circuit diagram of the shift register. In this, this Q0 output of the last flip-flop is given as an input to a first flip-flop. That means, Q0 is connected as a D0, D, this flip-flop. Again, the clock pulse connected is given simultaneously. Now, look carefully at the reset signal. This reset signal is given as a reset signal to this one, two and this three last three flip-flops. Whereas, this reset signal, this is not a reset signal to this flip-flop. But it will be a set signal. It means that when this signal is activated, one, two and these three flip-flops will give output as Q2, Q1, Q0 as zero. The only thing is, since this signal is connected as to the set signal, it means that at the arrival of the clock pulse due to setting of this, the Q3 will become one. This means that while giving the signal reset, clock is given, so output will be one, zero, zero, zero. At the arrival of the clock pulse, since this Q3 is one, so Q2 will become one. So, the status will be zero, one, zero, zero. Next clock pulse, it will be Q3, zero, Q2, zero, Q1, one, Q0. At the arrival of the next clock pulse, it will be Q3, zero, Q2, zero, Q1, zero, Q0, one. It means that a ring counter is a type of counter composed of flip-flops connected into a shift resistor. The pulse is injected by entering zero, zero, zero, one in the parallel form. In the earlier circuit diagram, we are using output Q0 given as a D input in the feedback manner, where we can inject the pulse by entering data in the parallel form. So, this is what ring counter, the injected pulse will go on circulating. This one, this will go on shifting towards left side. This is what we explained in the earlier diagram. So, these are the references. Thank you.


I'm in the KEM Ventures booth with Kirk Mills and he's going to tell us what this bright green object he has in his hand is. I've got big grips. It's called Big Grips Frame and Stand for iPad. It comes in five to seven different colors, depending on which model you need, but they're all bright colors and they're very great for kids. Kids of all ages, I like to say, but primarily young kids. So what problem does this solve? It's a breakage. It's a big foam frame, hence the name Big Grips. You can see that. It's got about an inch and a half of thick foam protection and I'm going to demonstrate for you. I'm going to drop it on the ground. I'm glad that's your iPad. Not many people like to throw iPads, but I do it all the time. Holy cow, he just threw that from about four feet in the air and he threw it down. He didn't just drop it. Now, why would you be using something like this at an accessibility expo? Well, for special needs, children and people of all ages actually, we hear about people who like to throw things. So we thought this would be a good place to show big grips. That's kind of interesting, but it might be useful also for those with motor control disabilities, where maybe they can't hold it correctly and they drop it kind of thing, right? Exactly, yes. It's a big foam frame that makes it very easy to grab. And the bright colors make it less likely to get lost. That's true. I put everything in black, I can't find anything. So how much do the Big Grips cost? It's range and price depending on your model of iPad. Like for the iPad Mini, it starts at $24.95 for the case. Wow, that's a great price. Yeah, and then up to $34.95 for the full size frame, the extra thick version. There's also a slim version. Price for those is $29.95, and those are all cases only. And they do come with stands that are available separately for an additional cost of $20 for the slim stand. And $19 for the full size big stand. So the slimmer one is for people who are only a little bit clumsy? That's right. We actually did it for schools with iPad carts. These fit in a lot more iPad charging carts than these do. Okay, but give you some protection. Would you be willing to throw your iPad on the ground in the slim case? I do it all the time, but sadly I don't have a functioning of working iPad in a slim case right now. Not because it broke when it was in a big grip though. Alright, thank you very much. How would people find the big grips? They can go to biggrips.com. Alright, thank you very much Kirk.


If you have an irritable bowel syndrome, IBS, should you undergo fecal microbiota transplant therapy or FMT? Hi, this is Dr. Rioscio and let's discuss this question. This is certainly something that patients, especially if they've tried a few different dietary changes or use probiotics, and still aren't seeing improvements in their IBS in their abdominal pain, in their constipation, or diarrhea, or gas, or bloating, are wondering, could FMT help? And what FMT is in case you have not heard of it, is essentially taking the stool from the healthy donor and then transplanting it into the colon, either through a colonic administration or sometimes through a tube down the nose or the throat, into the intestines. And the thinking here in the mechanism is that the tremendous amount of bacteria contained in the healthy donor stool functions like a super probiotic that contains a thousand-some odd bacteria and also fungus. And this can help to literally re-colonize the host, in this case a sick individual, with the healthy microbiota of a healthier donor. And there is great evidence for this being life-saving in a chronic infection clostridium difficile. And there's some emerging evidence that's hopeful and promising for inflammatory bowel disease, Crohn's and ulcerative colitis. So it begs the question, could this also be helpful for IBS? And the data here are unclear. There's some data that suggests that FMT can help IBS. There's other data showing that FMT cannot help IBS. And I'll share some of these juxtaposing opinions with you in a moment. Part of the reason this disagreement may occur is because there's not consensus on what is the best method of administration. Should we do this with fresh stool via an enema-like setup? Should we freeze this stool into these capsules that can be taken orally or use a tube that goes down the nose into the small intestines? How frequently should this be administered? Can it be done once? Does it need to be done serially? So because of this, even though there is some positive data, I think it's important to bridle the enthusiasm in how quickly IBS patients reach for FMT. And I have seen IBS patients here in the clinic that have gone off to do FMT. And some have been helped, but I would say it does appear, at least to my best recollection, that more patients seem to be not helped or only minimally helped from FMT who have IBS. Again, I think this is something that could be helpful, but we may have more to learn. But here are the conclusions from two high-level analyses, systematic reviews with meta-analysis, essentially saying opposing things. And I'll put the first abstract up here on the screen from the Journal of Elementary Pharmacology and Therapeutics, a systematic review. Essentially, they're concluding fresh or frozen donor delivered via colonoscopy or naso-digital tube may be beneficial in IBS, but larger, more rigorously controlled trials on FMT in IBS are needed. So this is suggested that IBS may be aided by FMT. However, going to abstract number two from the American Journal of Gastroenterology, ETs or randomized controlled trials does not suggest a benefit of FMT for global IBS symptoms. There remain questions regarding the efficacy of FMT and IBS, as well as the lack of clear explanations on the discrepant results among RCTs and subgroup analyses. So what we're seeing here is there may be benefit, there may not be benefit, and essentially more research is needed. So what did you do? What is my recommendation? My recommendation would be to exhaust all of the under available therapies before utilizing FMT. Now I should mention, oftentimes a patient will have tried a diet or two, tried some probiotics, potentially tried an antibiotic, antimicrobials, and seen a flicker of improvement. And what I've noticed is a common oversight for patients is they don't have an overarching process to organize how all these different therapies could be used in sequence and in conjunction with one another. And in many a case, the difference between success and failure is not just using a diet or a probiotic or an antibiotic or an antimicrobial, but rather having a process through which you work. And this is exactly what I lay out in Healthy Gut, Healthy You. There's essentially eight steps that can all be somewhat tweaked and personalized to the individual along each step that allows you to build a progressive supportive program for your gut and to cultivate the healthiest ecosystem and environment in the gut, thus allowing and favoring the health of healthy bacteria to grow. So I want to be careful to draw that clear distinction that if you've tried some of the stuff that's discussed in gut therapies, but you haven't done it with an overarching map and plan, then that very well may be the difference between success and failure. And I don't say that lightly. We've documented here on the website a number of patients who have been to other doctors, in some cases five other doctors, read other books and they only saw the results they were looking to obtain after going through the Healthy Gut, Healthy You protocol. And I think that's because I wrote the protocol not to be kind of an easy here's something that can help, which is all fine and good, but rather here is a real game plan and map to walk you through from A to Z a comprehensive approach for improving your gut health. I would start there or with a competent GI clinician far before you reach for FMT. Unfortunately, the new and the novel sometimes distract us from working through the tried and true. So I think there's a place for FMT and IBS potentially, but we're still very early. There are still some major discrepancies in the data like we just discussed. So again, I would start first with going through a well articulated plan for improving your gut health exhaust all the available options and then leave FMT as a last resort. And please, if you do FMT, work with the professional. Okay. This is Dr. Rishow and I hope this helps you get healthy and get back to your life.