I am Andrew Haley. I am one of the large community members of the governing board along with Doug Lee who is watching online over to you Doug. So I can barely hear you can you talk into something that the the the laptop mic in here. Oh okay is that better? That's much better. Okay for enough. Okay well I was just saying that I'm Andrew Haley. I am one of the two community at large governing board members along with you and this is your cue to introduce yourself. I don't know what Mark is doing to me right now. Okay hi I'm Doug Lee. Did you ask me to say anything? Yeah I just just just say your name. I think we're done. Okay right this is always a little bit on I'm the light entertainment of this panel because I can barely hear you and you can barely see me. Oh well. We can see you quite well Doug actually. I could even that'd be scary. Hi my name is Mark Reinhold. I'm not going to blather. I'm Steve Wallin IBM. I'm replacing John Dumevich who's unfortunately ill today. So I'm the silent partner from IBM on the open JDK but obviously I've got a voice today. So this is a Q&A. Hey George. George is here too. I'm here too. Yeah I'm the the chairperson of this this illustrious group and really wish I could be there with you.  Okay George you're the chair run the meeting. Awesome. So I'd like to as the first point delegate to Mark. Good thing you're not actually my boss. Okay so this is as I was saying this is a Q&A. Any questions. Mr. Marvel. I can't bring in the mic the mic is an incredibly delicate beast.  Sorry Tom. So Tom Tom is is very sad that he cannot troll George as he annually has for many years about the closed components of the JDK. And I'm so sad not to be trolled. Did you actually have a question that was that was a comment. All right anybody have an actual question. All right if we want to get past that I think I'll try to start with something that is something I wanted to make sure I talked about before it ends might as well start with it. When we formed the the governing board a few of us had a laundry list of major major initiatives that needed to get done.  We have some sort of mechanism for for all of the things that were proprietary oracle processes. Some of them are just barely going like the like the test repo. Some of them have been going on for years. The last year we created the CCC replacements CSR which is really boring but important. The vulnerability group is finally out of legal and might actually happen sometime soon. Yeah I'm right. All of these though were our big you know my bullet points whenever we had discussions about where should we be going. And you know I'm actually okay with being designated into boring sustainability mode for the GB. But I would like to make sure other people we are that agree that we are in the boring sustainability mode for GB. So if people have ideas of things that they think we should be focusing on and debating and and annoying the oracle folks until they comply let me know. Gee thanks Doug. Can I make a suggestion if this I think it would this would be much more authentic if people did come down and actually use your own voice to ask your question because when we repeat it we inevitably miss things. But of course if I have to repeat it I can edit as I go. So I have a suggestion. Can we perhaps enter in the first demo 12 times a year that would be really great because like in the weeks before first time there's always so much so many so much happening if we could have that to 12 times a year that would be really great. So do you remember what I was saying earlier about the six month release model and how the rate of innovation doesn't change. It's just the rate of innovation delivery. I don't think your suggestion would have the effect that you want. OK. So some concrete examples. So for example publishing the government board minutes. This always happens like months before first time for the whole year. So that's actually not a good thing. I think they should really be published in a timely manner like weeks after the after your meetings and not months or half a year later. That's one point. So we have been working through that through that backlog. I think there are only a handful of meetings left to get through. So we'll get there. And I agree. They should be more timely. And I suspect everyone agrees they should be more timely. Yes. That's right. Apart from anything else. We can't remember what it was. We actually said when it comes to signing them off. Oh did I really say that two years ago. Maybe. Submission for us are a great first step. But it's actually not submission for us. It's test for us. So we really need a way for external committers to push hotspot state changes which is still not possible. Actually it is possible because the member I said earlier that that internally at Oracle we replace JPRT with Mach 5. Mach 5 doesn't do pushes either. So Oracle engineers can't even do it that way. But now that now that we have the submission for us. You know consult with your local hotspot gatekeeper Jesper or whomever. But now we have that. If you if you are working on shared code you run it through the submission repo test repo. Maybe we should rename it and all tests pass. You should be clear to push it. But yeah Jesper and I were chatting about this a couple of weeks ago. He plans to communicate this so that people understand. Let the record show Volker Volker only had two items on his list this year. I'll take that as progress. I'm James Hunt. I have two questions. One is what about opening the TCK up to general usage. And two I'd like to understand what the what the thoughts are going forward between the JCP and the Open JDK but Governing Board. How that that relationship is going to move forward. George you want to take the TCK one. Second one. My goal is to preserve the distance between the Governing Board and and and ACP to be as maximum as possible. Okay I'm stepping further away from Heather. The laptop is starting to glow with heat. I'll try to answer both of these and hopefully you can hear me and if anyone want to add they're certainly welcome to. On the access to the TCK I would point out that it is possible today for you to get access to the TCK through an agreement called the OCTLA and are many people who have that in order to use the get access to the TCK and test your own builds of Open JDK. Now I realize that's not the same thing as having the TCK in open source and in a place where everyone can easily contribute to it. Although we do have some very good examples of exactly that happening. For instance with 310, 8-time JSR and so I think you know this is an area that probably will continue to evolve and we'll see what we get to on that. But you know I hope that that solution is as somewhat provisional as it is. You know meets most people's needs for anything that is urgent. The second thing regarding the JCP, hi Heather, you're right in the middle of the screen. I would say that there's been a lot of very good work in the last year to basically find places where the JSR lifecycle and the JCP process had some impedance mismatches with the notion of doing six month releases. And the JCP EC has been very cooperative in agreeing that we share the same goal of making sure that the specification side of Java remains strong and that we find ways of making the process fit with today's more rapid evolution cycles. And so there have been a bunch of changes that have reduced the amount of time and overhead in the process which was initially described long before the code base for OpenJDK and thus the reference implementation was open source. And where the initial goal was really to force all those evil vendors doing closed source stuff to be more transparent in the design and implementation process. And of course, purely being open source helps to a great extent with that. And it was kind of high time that the JCP process be evolved to a point where it wasn't something that was holding, sewing everything down. So I think that cooperation is great and we'll see how that continues to evolve as we go forward. We're really, with the first six month releases now, trying to experience how that's working. And I think if we find places where there are issues, we're going to have cooperative partners in the JCP to continue to remove those impacts. Hey, George, I don't know if you've dropped or if you've finished. Just to kind of amplify George's comments, I think there's two examples there. So for the first question, we've certainly been working with the adopt project, the London Java community to get TCK'd Open JDK builds available to the community. And so as that project evolves, we have a TCK available to that project. And we are now at the point, I think, where we have clean builds ready to be consumed. So that's kind of the first example of George's comment that TCKs are available to community projects and people that need them. I think the second thing, I'm actually IBM's executive committee rep on the JCP. And certainly we have been working extremely hard to make sure that the processes and practices that we have at the JCP fit the new rapid cadence that we have on SE and the requirements that we have from the Open JDK project in terms of getting the specifications through the pipeline reviewed and commentary and the feedback cycle with the Open JDK team title. So it's been great to have George and Brian and others come to the JCP and explain what's happening in Open JDK and how the JCP process can really help with getting those specifications through. So I think there's good communication with all these things that can be better. But I think actually we're off to a good start there. And looking forward to seeing 10 come through in quick succession, 11 and 12 so I think we've started that improvement and I think there's always more we can do. I'm sorry, I couldn't even understand it and I'm in the room. Could you make a publishing the, so remember the results of the TCK run are a bit. It's a bit. You either pass or you don't. Yes, so from adoption, if we're publishing a binary and it says that it passes the TCK then it would have passed and so we won't publish anything because everything passed okay. When it fails, there's an internal team that have access to that repository because it is kept obviously sensitive to a certain subset of the community. And so those people would be going through the failures and fixing any issues and resolving those until it passes and at which time then no one needs to see the results. But yeah, anyone who signs the agreement in that project can get access to that subset community that has access to the TCK in the result. Why is the TCK code sensitive? There are multiple fairly deep answers to that question. Maybe one of the easiest ones to relate to. You don't want to know. Sorry?  No, seriously, one very pragmatic point is we're talking about millions of lines of code that we would have to inspect and audit just to get it out there. So this is not, this is not, not something that, you know, I could just go to my laptop and do and, you know, stick it on, stick it on the web and anybody can use it. There are a bunch of long standing in some cases, decades, business relationships, you know, initially established by some that have all kinds of confidentiality agreements that bear on what can be done by anybody with the TCK. So it's just, it's just hideously complex. Is this a problem that, that ought to be solved Sunday? Yeah, personally, I think so, but, you know, not speaking for Oracle. Is it something that we look at periodically as, as the situation changes? Yes, it absolutely is. But it's not open source today and I can guarantee it will not be open source tomorrow. Sorry. I do think, you know, the, the, the specifications are standard and we want to make sure that that standard remains consistent. And so there are all sorts of elements that, you know, we don't want an open source project that then gets forked and then all sorts of complications that occur. So keeping it under some level of control is actually useful for maintaining the stability of the Java platform. I think there are all sorts of implications like that, that run along. We're aware of alpha counter examples, really. Okay. I'm, I'm not sure it's, it's useful to spend more time on this. To give a more proactive answer, to give a more proactive answer, you all can contribute open source TCKs. We're the poster child for that in Java Util concurrent. All of our TCK tests are open source. They are imported straight into the, the Oracle TCK. You can and should do the same with anything you do. Steven, Steven Colbert did the same with JSR310. There's a couple of people's problems, but you can do that. No more about the TCK. Go on. It's probably not the right way to ask the question, but I, I personally, as an entity, I have access to the TCK. And so I'm on the mailing list when I see the communication between Red Hat and Oracle and IBM. So usually the way it goes is Red Hat says, oh, this test fails on Chady K X. And then the answer from an Oracle engineer is usually, oh yes, we forgot to exclude that one. Like literally 99.9% of the cases. So can we trust the results really if you just exclude everything that doesn't work?  So excluding tests is a very routine thing that we do in TCK development. Excluding a dozen, you know, several dozen tests during a future release lifecycle is, well, sorry, in a traditional multi-year feature release release lifecycle is no big deal because in that release life cycle we probably added at least a half a million new ones.  And results show up. And if you're a couple of months away from shipping the release, remember the release per the JCP is the reference implementation and the spec and the TCK, you know, the TCK is an engineered artifact just like the JDK itself. We have to be careful about it. We don't have time to go rewrite tests and then revalidate them. So what do you do? You exclude it because the TCK has an exclude list for this very purpose. And one of the regular things that the developers of the TCK do routinely after every future release is go look at that exclude list and try to whittle it down, figure out okay, are that were those tests invalid, were they valid, do they need to be rewritten and so forth. So it's a constant, it's like a sign way that goes up and down with the release cycle. I do think we have a good testbed though looking at, you know, I know this is predominantly a Java SE conversation, but if we look at what's happening in the EE space with, you know, the movement of Java EE to eclipse, all of the RI, the TCKs and the movement of that project, I think if we can see how successful that is, then it gives us kind of a testbed for, okay, well what would happen if we open source the large TCK test set? But I think Christian addressed a valid point because we had this with Java 9, Oracle released Java 9, GA and nobody else could really certify it because there was some tests which didn't pass. And because there is no public communication possible, you always have to, every single licensee has to go back to Oracle and ask what happens and it would be easier if it would be possible to communicate publicly about these problems. Yes, I agree, it would be easier. Come down here. The question about the TCK is how is it updated? Is there a special team inside Oracle that reads the CHAPs and updates it or how is it working? Are there also the open source committers of open JDK involved or is it a completely separate team? So Oracle has an entire internal team that develops the TCK. They don't write all of the tests, as Doug mentioned, some incoming projects have chosen to establish a tradition of providing their own. So all the Java utility concurrent stuff, those tests are maintained by Doug and his collaborators outside. They're all marked, I think they're public domain. Right, Doug? Right. We just throw it over a wall. They throw it over a wall and then somebody in the Oracle TCK team takes them and regularly updates that portion of the TCK test suite. We also do a tweak. We took in the JSR 310 tests from Stephen Colborn. I'm not sure if they're still an open copy out there that's maintained, but I don't think they've evolved much. They have evolved much in the meantime anyway. But anyway, the Oracle engineers who do this, this is their job. They're not also doing open JDK or VM work or whatever. And it's a fairly specialized kind of field. You need a fairly perverse mindset to go.  But it's really good for quality control. The other set of tests that are regularly done are the so-called JT-RAG tests. And they can be, they're allowed to be a complete overlap with the TCK tests for all that matters. And those are, that process is a little more straightforward because every bug report has some tests. And that test eventually gets itself into JT-RAG maybe by modifying another. Somehow or another makes it in. And so many of the tests that aren't in, that are in TCK are redundant with ones you run anyway that anyone I think can run. It's painful. You need, if you ever want to do it, grab our Antscript from WTIL concurrent and it will guide you through it. It's a little weird. You have to get the right jar files corresponding to any particular addition. But you can run those yourself. And you can get all the, everything you need to do it. Yeah, just for those who don't know, the JT-RAG tests are open. They're in the repo along with all the code. So there's nothing closed there. There's a small number of internal JT-RAG tests that Oracle's going through and either throwing away or putting out into the open one. Yeah, if there's no very strong objection, I'd love to move this on because we have the change to the release cadence which is the most important thing that's happened this year and probably the most important thing that's happened for several years are in, I'm JDKLand, and the people here would love to get a little bit of feedback from you about how you think it's going. My take on it, the last few weeks have been pretty bumpy, particularly with JDK9 and the way that the release happened and the way that it broke a couple of important targets and so on. And all of this is a consequence of the pace of change being a little bit frantic in my opinion. And I think that we can do better next time and we'll probably figure out how to do better next time. I was personally very supportive of the change to release cadence when it was first mentioned to me and I just thought great let's do it. The situation before was that if you were a student and you were doing something for Java for your final year on the graduate project you could probably have your PhD pretty much done by the time it actually appeared in Java. And clearly this wasn't any way to encourage people to contribute to it in JDK. And this I think is much better. It's kind of hair-raising at the moment. I mean no sooner do you think you're ready to put something in and they say oh well it's frozen now from it. Well I only started a couple of weeks ago. But I think we'll all get used to it. I would love to hear any comments from anybody in the audience who's been affected by this this change. Do you like it? Do you think it's better? Do you think it's worse? All comments welcome. Including. I can say a little bit about it. So at Twitter we use obviously the JDK and and we have the M team and we build our own JDK so it affects us a lot. Our biggest discussion point is what are we doing? Are we going? It's mostly about security right? Are we doing every six months the release or are we going with LTS and then what happens if between the LTS releases a very important feature comes out that maybe our scholar developers want. What are we doing then? Are we taking that feature and backporting into the LTS or are we then jumping forward to do the six? So these are the problems we have. So far it looks like nobody wants to do the six months releases because it's it's too fast for our users. Let's call it this way. So we still don't know what to do. You have a choice now. You didn't have before. This is a new choice. Nothing has been lost. You've got something extra. Exactly. Yeah and my take on that is that I think once we get the the vulnerability group up and running it'll feel quite different. At the moment the prospect of having to do urgent security backports to several live short term releases is quite terrifying and I I don't think we could do it but I think given the vulnerability group we'll all have a bit more bandwidth to look at how many of these things are still out there and particularly for Dora which has a slightly longer support lifecycle than the short term Java releases but not much and we'll probably be able to keep those going I think if we have enough time to do it. At the moment it's a matter of we only have a couple of weeks really to get everything backported and merged and clearly we're not going to be able to do that with all the releases. Just to comment that it's a new choice and nothing's lost. I think people have got used to a pattern of behaviour where there is a publicly available free Java version in Java 8 case four and a half five years that's available for download with regular security updates that they can rely on. I think in the new model I think you described this morning a six month minimum in terms of source code security updates in OpenJDK and binaries that are available for these new releases. I think until we see who's going to step up in the community to have longer releases on the LTS then I think there is still confusion and uncertainty about the guarantees for source code security updates and binary availability and that's why we've invested in the ADOPT project to be able to describe our roadmap and plans of at least a four year LTS to get people from one beginning of an LTS to the next with security updates. Yeah my feeling is that it's very likely that something like that model will become more widespread generally and that there will be backports for security updates for longer than three years but these are early days we're just dipping our toes in the water right now. Yeah and as I was saying this morning these are all these are all lower bounds right. What happens in OpenJDK nobody can nobody can predict and it's not please it's not just up to Oracle. So to exactly that point we were talking Twitter we are talking to Google and Alibaba and SAP as well and I think what we should do is I don't know about Redhead the six months releases that are not LTS releases you know sometimes we might have to pick up one just because and it would be good if all non Oracle companies who are heavily involved would pick that up and share the burden of backporting security patches and things like this. That's what the group is for. Join us. That's what the group is for join us. That's what the vulnerability group is to share the information on the fixes and give them out there and then there's the work of actually doing doing the updates and I think you know some of the rough edges that Andrew mentioned that we're you know we'll no doubt iron out over time will allow for appropriate delegation within the JDK updates project so you don't have to wait for some Oracle person to to bless something anymore. Well we want to be part of it but it's not there yet you know we're talking to you and you know I think Volcker has something to say about this. Well I mean that's exactly the point I understand that Oracle doesn't want to commit to this but at least it should make it possible for others to work on this and it's currently not easy the days one one JDK updates project it's not really specific anymore Oracle is leading this project and I don't see from the how this is supposed to work like when you don't want to support Java 9 anymore but there is no Java 9 updates project it's not easy for others to step in so how is this supposed to work is there a process change in in do you work on a process change or what plans do you have here. I think that's still up for discussion. Yes I the co-maintainer of Java 2.concurrent truly believes that we should have some 9 update process for things that are too important not to do I believe the current status is that nobody's opposed to doing it and nobody wants to take control of it. Okay so this morning I put up a slide and the last item on the slide was Oracle commits to ensuring smooth transitions. What does that mean exactly? Well this is the thing that we're still trying to figure out the thing that we didn't do so well a few months ago so we'll do better next time. The fact that there's one JDK updates project that was meant to be a feature so that we don't have to spin up a whole another project every six months which would be a bunch of process overhead that well maybe a few people want but I certainly don't. The JDK the earlier number JDK updates projects eight and seven was there one for six I don't remember those projects established within themselves simple rules for the project lead to delegate for a certain line to some other person in the project there is absolutely no reason that cannot happen with the JDK the general JDK updates project and I expect its project lead to propose something in due course along exactly those lines we don't need a process change we don't need a new updates project every six months this is this is all pretty straightforward I think. No I think that's right and the JDK 9 update tree has not been made read only until we figure out exactly how to do it which we should be able to do fairly quickly I think and possibly in a way that requires me to volunteer to be the project lead or something then we'll be able to put changes back I think but it just doesn't have to be a project there only has to be a tree it doesn't matter well I love working on JDK but all this process stuff drives me completely crazy we will make the patches we will fix. Yeah this this this isn't hard this is not a hard problem to solve so a comment on that it's just an additional choice nothing went the way for us what was impact us is that the short overlap of support period between 8 and 11 we have regulatory requirements that we counter on end of life software previously we had like one day to migrate in production now we have four months it's going to be tight from whom do you get your binaries from Oracle and how much do you pay for them we look at licensing from Oracle but the way Oracle licensing works with VMs there are there are there are other vendors and this is the free Java room so we should probably not talk anymore about Oracle contract practices this is where I would say we've been working with the adult project London Java community plenty of other partners on producing open JDK with hotspot and open JDK with Eclipse J9 binaries and we're going to continue to provide security updates in those code streams so certainly from a Java 8 perspective we're looking for the next few years of having Java 8 binaries that people can rely on and we'll do the same with 11 and we'll do the same with the LTS releases so that that's going to be our plan is look at the adopt project and then you can consider that as a free source of Java binaries that's a great thing to have that in adopt open JDK but what I want to avoid is to have security updates done in adopt open JDK project there should be done upstream and there should be a possibility to do that no no no so yeah so what I'm saying is you know for for Java 6 I know Azul is taking on that burden today of back porting for Java 7 I believe you know Red Hat have got that responsibility Java 8 I guess that that code base won't come to the community until at least January 2019 sorry sorry Oracle is part of the community okay Oracle won't look for the community to do the back Oracle will not look for other contributors in the community to take on the burden of 8 updates until at least January 2019 if not later unfortunately we are out of time sorry thank you for your questions and your comments


What is up YouTube welcome back to the channel today is the day guys? I know y'all been so excited, but we're finally watching Logan Am I supposed to say something now? What do you like guys? I am so excited for this. I brought my tissues Hey guys, I'm so excited for this. I brought my tissues Guys, I am so excited for this. I brought my tissues I'm so ready to go if you're new here like comment subscribe It is up on patreon for the full uncut reaction. It really helps the channel guys. I'm ready to go Yo, this is rated R. By the way, so we're about to see a rated R X-Men movie. I'm excited to see a more I guess mature adaptation of this film. Let's go.    How many shots has Logan taken somebody knows? Is that a middle finger when it just didn't come out all the way Let's go Logan Oh that hit his car Why are they still engaging him? Yeah run away the world.  Dang, so he's a limo chauffeur. Hmm. He's probably worried about getting fired Yeah, cuz I guess he's not getting paid to be Wolverine, huh? He's in Texas He's making me feel sore Like I'm getting older something. Yeah, I would say I don't love his beard, but I don't want my lesson Love it guys. It was great I'm in the car. Yeah, it was a good trip Yeehaw filled it up and down the fence That's a normal no chance on here. Whatever they wrote on it right now. I've never seen it. Oh border patrol How depressing Logan.  What the heck? See no never mind. I was about to say Am I supposed to know this dude?  She found you. Yeah, Gabriella.  Hey that lady that was yelling.  Yeah, get out, bro. What the heck? I know what you're hiding. What do you want a little cooperation? Was he implying cocaine?  He's having a bad day. They're all bad days That's the stuff you got This is not enough. You know about a rough night. Poor you So that's medicine for someone. Mm-hmm. Tell me last night. He's communicating with someone. I'm talking to anybody You're not listening. He's been asking questions again. That's why we're here. I think he's gonna read my mind. That's what these are for. Oh Read his mind. I can guess but I'm not sure. Oh Sick Charles Charles Xavier friends. I have good news for you today. It's not about what you do It's not about your deeds. You can't live up to God's rules That you can't it's okay. We're in perfect make way sure Er, big way the new case a little bow from Jack. Oh, man. This hurts to see Is he just like residing TV? It's the next big thing. I mean he's obviously just preaching to no one. No, he's going crazy Who puts me to sleep? Oh Isn't it crazy to see Logan taking care of him? Is Charles doing that.  Remember who I am now. I always know who you are. It's just sometimes I don't recognize you I don't even know what that's like. Like I can't even right. I am relate to that He doesn't listen to me. I know a damn speciation when I see what what Speciation new mutants a young one. There are forces trying to It's a long time man. I know I found you you were pursuing a career as a cage fighter assassin hooked on barbiturates You were I gave you a family so honest Charles. Thank God This is so much darker than I could have even like imagine like I would never imagine Charles It's a beard there. I don't like this new timeline pretty bleak Whoo heavy She's a rag bro. He's like you're so dramatic Man just bought his first band-aid recently Yeah, so his stuff is obviously like not good anymore is his powers He still has a little bit though because he got shot. Yeah, but it looks like they're a lot slower Like it's just slowing down. So he's finally like aging I'm assuming those are all bullet holes or something, right? Maybe I don't know. I don't know what those are. Why are there so many holes in a guy's Logan's been alive for a long time though I almost died this morning. That's usually a minute. It felt a lot longer than a minute I couldn't breathe you're less affected. You know, he needs a higher dose And I know you've got more money squirreled away. He doesn't always seem to care that much doesn't us you and him You're saving to buy a Sunseeker found this in your pocket Adam Antion He's just been a roommate annoying. He had an anemone and bullet. He's like in a very nihilistic place right now I hear you at night. You're not sleeping. You don't want to talk about that Well, they get here or the blood I wash from your clothes or the fresh wounds in your chest the ones that aren't healing Logan these glasses Something's happening to you Logan on the inside. You're sick. I can smell it Man, this is so dark guys. Jeez. It's so sad Why they're if the goal was to make this extremely depressing like good job. Oh That's the yellow lady right not available. Call a cab. My name is Gabriel. I want to know your name lady There are men after us. We need to get out of here go north cross to Canada. Anyone can do that job I'll give you $50,000 Mm-hmm.   Yes I mean, that's a tough circumstance to come across but but he like needs the money, right? He really needs it. Yeah Their relationship is breaking my heart. Yeah, this is just not the future I imagined at all You think after all the good they tried to do there would be something positive out of it It's pretty dark.  Logan Something go wrong Logan what? Who does this belong to? Oh, that's her ball. Who's that?  This ain't good track mutants. Don't sign keep Charles quiet Don't sign now. So they're like the last mutants right there. Yeah That's the bottom getting I need the girl. There's no girl here. There's no girl It's just a woman. You saw Gabrielle, but you didn't call me I asked you first. I'm like you're not the only one. It's been enhanced. Oh Does she throw it or does she do it telepathically, I don't know how did he do it lore? This is who I've been telling you about this is lore. It's okay. Come Dang okay, it's okay Is she mad because he didn't do more to protect her mom or something? I guess so He ain't dead.   What if he wakes up before I get there? Why is Charles so amazed at her? Because they've been gone for 25 years Yeah She's strong So she's telepathic or he he is It's not safe here anymore, and you can't have an attack out there. You understand communications a two-way street though Mutant yes, she is once a gift Charles eating throwing That ain't good. Oh my god. Look at all those people. Oh my god.  Charles is so out of it. You know, he's so serious all the time and now he's being so like Logan doesn't even believe she's a beautiful Powered one more time stop Where's Calamity? I mean that's on Logan. Why would you leave that dude alone with him? All right, Laura? Let's see what you got Good choice on that cereal to We go she seemed un-worried. No, it doesn't sound like a little girl screaming Oh Baby Wolverine So Wolverine just hooked up with some lady and has a daughter. It's kind of nuts, right? I don't know Oh Their daughter dance This is like a How does Charles I'm we're since some Logan right now? Yeah, she reminds me of me Yo, he's alive. Yeah, they're gonna torture information out of him probably I don't think she's an experiment. I think she's just Logan's daughter But they're obviously just trying to get rid of all the mutants And she's just young and powerful so she's like a threat I think oh wow, so it is his daughter kind of she escaped maybe Wow It always circles back Come on bro get a charger Now he's gonna feel responsible Still So phone charges In a cigar for the road Great we can finish the video now. Yeah, she's all got them caged up. They got to be kids Many children as we can I read about a place up north a place for mutants. They call it Eden.  Yeah, that's a safe house for them, right? So there's a lot of mutants left. Well, not a lot, but yeah, but they're like created I don't know how this man ain't been pulled over to you. I feel like they can't stop It's like a bullet riddle to them oh So they disguised it as a pediatric cancer research thing right maybe to get funding and stuff Or just so people weren't suspicious about what the heck they've gone on there She she had the adamantium implant James Howlett. Isn't that him? His real name is Jimmy. Whoa He's in a comic in this that's kind of cool more cops because I told the other guys Everything Bro, that is not good He he like pulled up to them though like he knows something Wait, these dudes are blocking them right or dad misread that I'm not sure. Oh, he was shoving him. He wasn't taking his medicine Well, you still need new tires man, they're bald How long would that take? That was nice ever though. Mm-hmm So does he think the eating thing might not be true or something because it's in the comic Yeah, maybe like it's just like I see what you're saying. Whoa Because there's like coordinates for it and everything He's gonna think that they got that junk from a comic book Right, but what if it's like the comic that they put out was for all the mutants to go there Charles Yeah, but why is he doing this? Do you think he's like trying to get his powers to work or something? Yeah, he's just got his own plans. Yeah taking that medicine That's the only thing I can think of for why he went take his medicine because it's like obviously affecting a lot of people It must be that like high pitch then, huh?   He's always the backbone right He's the one that like causes all the mutin like when there's mutin problems Now he's like kind of the cause of Injured I'll get off Man that is Charles They're taking his character and just making it. Oh, no, wasn't it? No, I don't know if that's the timeline I was about to say wasn't it the phoenix that did all that No, that incident was like off camera different timeline I can't I can remember exactly his skills from last maybe Look and talk to animals so Charles did it even medicated Thanks so much for your help. That's your daughter. Uh, yeah, that's Laura. That's my dad chuck Come on, Laura. Let's go. Well, can we show our appreciation treats three of you to a decent meal? We don't live far from you. That would be lovely Charles I know he's just doing too much back there. Isn't the whole steak of the world You know what I'm saying on his shoulders now he wants to stop for lunch He's like, I haven't been out in a while. I'm letting my hair down.  The girl is rather small price I still need someone to point us in the right direction. No, I can't help you. Yeah, don't trust them, bro I like their style of living though. Thank you god for this food and for our new friends the howlids Amen, I hope they'll be in there doesn't get them killed though because that's just the vibe. I'm right Poor thing has no table has no table manners Well, there's plenty more if she wants she's fine Thank you. This is delicious. Thank you so good vacation. Yes. I'd love to travel someday And I bet you will I can drop out of school. Okay. Let's not go that far carefully speaking to a Man who ran a school. There was a kind of special needs school. Yeah, that's a good description I got kicked out a few times. I wish I could say you were a good pupil, but the words would choke me That was just wholesome. That's not good. I know because it's always so brutal It's always wholesome. It's always wholesome and something bad happens We have a perfectly fine room upstairs for your father and your daughter And you can sleep in a living room on the convertible. It's very very nice of you, but we should go We can leave early in the morning break of dawn. Is it worth? That was awkward Oh, no, what's going on? The pump station that supplies us is a mile and a half from here. Sometimes it gets herself shut off If I ask him hey, don't I saw is happy to go with you. All right. I'll go just uh, let me get my dad settled You know Logan, this is what life looks like a home people love each other safe place. That's why y'all gotta go Right feeling yeah Yeah, you already know this movie's setting you up for it. Logan you still have time It is for Laura It's some rest. I feel like this is like their goodbye adventure.  What the heck? But I don't deserve it Do I? I think I finally understand you Whoa, why is he bald? That's not Logan. Yeah, it is Logan Logan's with that guy though, right? The first time I was thinking this is a dream Oh, did you see how quick he healed? He's fantastic. You said you only needed the girl. I told you I was forced to bring a new tool to bear Nate?  Oh, like uh, they created him in a lab That might have been that weapon x 24 or whatever Because it looked like a man, right? I hate to be like this, but bro, they should have never went to this house Logan told them yeah, but Logan's in charge. Why are you letting the old man boss you around say no He kind of looks like comes out to my head Where did they end up finding themselves at like You know what I'm saying there? This is walked up into freaking chaos. No the wild west I'm the law out here That was crazy.  Yeah, that's what it is No Dang dude. He died just like that. I feel like this unseeker was where they were going to go end it all Like they were just going to go out there until they died because that's why he talked about it right then He just sacrificed himself Here we go. Logan versus Logan. Oh the dad at the farm Good job, buddy.   Let the doctor.  This feels very last of us to me right here So his name is dr. Rice We haven't encountered a dr. Rice yet. Normally we encounter the same doctors We don't leave her Where's he at? You need to check yourself in somewhere. No, you're not. I know that you're different But that doesn't change the fact that something inside you is poisoning you find out what it is Bro, you can't they're gonna get him. You don't want to go to a hospital. Maybe I can help you Maybe I can run some tests stuck. She look a nice guy.  Who's that? Who is that? Who is that? That's where she believes they are Right, you notice she read too many stories. You understand this all here. No, there's no no exist. Oh, okay You understand me this Eden does not exist. No.  Eden and most things that I've ever like played or encountered it means like heaven Well, it references the garden of Eden Oh, that's them right there And that the coordinates to Eden were there. No, they're called Reaver.  Charles told me What else do you tell him?  She's never even like left a lab and here she is out here driving. She's a quick learner though. Yeah Man, where the heck does she take them south to North Dakota, right? Is that them heads on the thing not rush more? Nope, I'm tripping. Yeah, I thought so what are you talking about? I thought I saw heads in the stones Hey It's like a hacksaw ridge Swing him toward me Bro, that's so scary. They all made it there. Yeah, but Eden doesn't look near as nice as it did in them in the uh comic Yeah, well, it's tough He was like What's helping you heal? He doesn't want to heal though The bullet He's just waiting until he gets weak enough. That's why I can kill us. I'm not sure Probably what's killing me now. I kept it as a reminder. I was thinking of shooting myself for that I told him A drone? Are they shaving them off? Let's go Don't tell me they're good at it. They said we read about you in the comics. It wasn't like this Yeah, they're about to get stabbed in the stomach.  Is it the one in canada gabriello is talking about? So that's not Eden right there. I don't think so. You see the woods It's an eight mile hike you there You see that pass That's the border. That's where we will be safe. She was lucky to have you Take it. She says it's yours. Thanks little boy I know right? I don't need it. You do okay He has stakes in the game now You're his barber for starters Hey, I got you here.   Jeez A refuge, I mean That's not good Oh, they're following the kids, ain't they? Yeah, they're going to eight mile walk.  Yeah That seemed like that would slow them down, but oh they're pursuing them right now already Well, I would you know, it's easy to be like why wouldn't the kids fight? But remember the doctor said they didn't want to so they just wouldn't because they're kids It's game time.  They gotta go. They gotta go He said confiscated and all these soldiers who just have like no emotion. No fear. They don't No anxiety. They're just like they're going up against this. He knows exactly what he's getting into and he's like They still just walk right into it and get it's worth it My guess Let's go, Logan I wonder why her though There's like all these other ones Richter's the one in charge, but they want her Maybe it's her self-hilling. It's weird to say that's adorable, you know Yes, it's really not adorable at all. It's very like dark. You know, what are you supposed to like microdose it? If they unleash that weapon he I don't know what they're gonna do. It's over Go to the front Laura Please stop Mr. Hallett. You can see the effects of the serum are wearing off You will not survive further wounds. It's under right. I believe you knew my father on the Weapon X program He's here. So we'll put this poison in me Okay, I see And then you might have killed him. I think you're right Why don't you show some respect from you? Do you looking at the man at white? That's your kind The girl was not to end mutant kind But to control it isn't always I realized we needn't stop perfecting what we eat and drink that we could use those products to perfect our Random, you can see what the way of polio embarked on our next to death growing mutants of your own precisely dangerous times james You know that guy was that doctor's co-signer like what was he doing that right? Here we go now we can heal that one's probably pumped with that. So Still not as good as the og though.   Nice those like things Whoa, he was electric. You see that did he just use rock or did he did he lift the metal? That was hard to tell.  She had one shot and she didn't miss Yo, is wolverine dying right now?  Mm-hmm There's no living with the killing the thing. Charles said was a hundred years old Look at his wolverine toy Man, this is about to be a whole new era. Isn't it at least it's about water though Isn't that what you wanted for Charles? man I just can't believe that Logan came so far and now where he's just gone, dude Like I really didn't think he was ever gonna die No, but if you think about it like there's not like Charles and him or the last x-men left now. There's none Zero well, maybe they'll make a new one Maybe she will That was depressing Geez. Oh my gosh like all right guys, so man We started the journey obviously with x-man one and that just really felt like the end of an era man I can't believe logan's dead, babe. What do you think about this movie? I felt that one right here this whole time like everything about that was just Probably one of the saddest movies from start to finish or ever watch which Because every part was just like very like emotional. Yes, like even thinking about it was emotional because like We started with x-men one We kind of always seen logan is like, you know someone who like Was like kind of in the lead the strongest one kind of like always kind of just like well, we've seen him everywhere Yeah, we've been all over the place in general. So right um Seeing his finality is really tough seeing charles's was tough. Um, it hurts Eric to see that Yeah, man, awesome movie. Uh, really enjoyed it. It was sad that she got in the fields and I mean man that was logan that was a story so Really stuck seeing the character come and go but Uh Hugh Jackman did a really good job with this character, man So we should definitely celebrate what he left on film and what an iconic character. So that was logan It was kind of like a tony stark to me Like people were right when they said that Hugh Jackman is the tony stark of the x-men universe. They're not wrong guys So I know that we're coming to the end of x-man, but we have so much to get into still We got so much marvel we need to get into we just started wanda vision And I think we finished the first three episodes. It was it was honestly It was so mysterious and it was so bizarre and it made me feel so Anxious and confused and guys we just got a long journey ahead of us So I subscribe to discipline patreon if you guys want more uh content like this and we'll see you on the next one


Good morning everyone and welcome. This is Melissa Arma with a Stock Swoosh. It is 10.32 and anyone that was in the live trading room with me is done for the day as well as me. Basically it is 10.33 in the morning. I mean this is the reason that I love day trading gaps in my method with the 26-point reading system which tells me like it told me that GPRO was the best thing to short today. The stock rated 20 points. It was the only thing I even liked today to do the best of the things and it worked and it worked and set up perfectly and went right to the target. You can't ask for anything better than that. You really can't. Now it's still going even. I mean this is crazy but it really went to the target immediately. Show the stock open. Look at this. Here's the short. 85 by 2010 drops in here to the first number goes to the full on target here into the first reversal time and you're done. You're done either here or here. Could you still be in this? Yes it wouldn't make any sense to be in this for one hour to make 10 more cents but this is what I keep telling people. 80% of the move of the stocks are made in these gaps into the open in the morning but you've got to get the entry right and you have to know what the targets are and you have to know where to take the trade to short it and put the stop and size yourself right and you have to know what it's a real setup or a fake setup and when I say fake setup I mean when something doesn't really an actual setup and therefore you can't do it but this is a real setup today that happened and this is something I teach in the class in GPRO and it set up and it was perfect. It was an angel and it worked great and I will tell you that day training is challenging for people because even if they know what stocks to watch of the direction that it's going to go they have absolutely no idea where to enter the trade or get out so this is one of the things that I do extremely well and this is one of the reasons I make money as a day trader and why I have a successful business teaching people how to day trade because I'm great at taking entries I'm great at figuring out where they're supposed to hold where the targets are and picking the right stock which a 26 point rating system teaches you but even people that can pick actual stocks like GPRO and know that was a short and even though some people probably thought it was a long which it was not but even if you knew this was a short today which you have known to do that in there to get the huge risk to reward within five six seven ten minutes so it was a great call by me today and a good good solid day for the room so and it and it's it's 10 30 10 30 in the morning and you can go to the gym or go back to bed so this is Melissa Arma with the stocks whoosh if you're interested in the Golden Gat class this weekend is the last class before the end of earnings season it is November 21st and 22nd if you're interested in learning how to trade at this calendar year the classes this weekend and you can learn how to do these things how to take the entries I teach in the class how to find the targets how to find which gaps are the ones to short because you cannot short every down gap and you have to know how to take the trades and look this is still going oh my lanta the next number is 1875 I mean this could even go to $18 today but again you have to still be in it and why when you just made a dollar in five minutes just be out but this is really still going have a great day everyone if you're interested in signing up for the class email me and Melissa at the stocks which calm have great day everyone


All right. Let's go ahead and get started here. About me, my name is BitBang. I also go by Tim occasionally. I am a largely recovered software developer. I started my career doing a lot of safety critical aerospace and automotive and benefits systems. Came over to security about three years ago. And apparently, as you'll discover through this talk, I enjoy looking at bad situations and going, how can I make this worse? I work with a company called Grim. Grim does not take this view of making things worse all the time. We actually try to help people. We're a cybersecurity research development company located in Arlington, Virginia. As a company, we do most aspects of cybersecurity between our various teams. We're going to do a little bit of overview. We're going to talk about what is CANBUS. We're going to start with the basic high-level Wikipedia overview of how CANBUS works. And then we're going to dive into how CANBUS works at much greater detail than you typically get. Typically need to know because all the low level details are handled by an onboard CAN peripheral. And then we're going to talk about what we did this time. A little bit of history. CANBUS was developed by Bosch. It was released in 1983. The latest version, version 2.0 was released in 1991. It is a fairly old standard. And like many fairly old standards, when they developed it, they weren't really thinking about how to incorporate cybersecurity best practices because there was no such lane back then. The first production vehicle was in 1991. This here is patient zero. The 1991 Mercedes-Benz W140. ISO 11898 is the set of ISO specs that define CANBUS for automotive. So why do the car manufacturers love CANBUS so much and put it everywhere they possibly can? A lot of it, it's cheap. It's really cheap. Nearly any microcontroller you buy will have a CAN peripheral built into it because it's cheap, why not? It's reliable. If you don't ignore it, if you know all the people over there and what they like doing to cars, it's very reliable. It's designed from the ground up to be extremely reliable to environmental noise. It's used in a lot of situations like a building automation or some industrial applications where there's a lot of electromechanical noise going on. It's designed to be very reliable for that. And oh yeah, by the way, it's been mandated by law since 2008. Turns out a good way to get the OEMs to do something is to say you cannot sell your cars unless you do the thing. It's mandated by 40 CFR86, 1806-05. That mandates that all the cars have to follow the ISO spec 15765-4, road vehicle diagnostics on controller area network. This is required for your emissions related system. So any of you who live in a state that mandates that you do emissions tests, this is so that they can basically do those emissions tests more easily. They just have one tool, they plug in an OBD2 port, regardless of tool, and they can go in and make sure that all your emissions stuff is reporting that it is up to snuff. As I mentioned, CAN buses use quite extensively outside of automobiles. It's used a lot in some aviation areas, like I mentioned, billed automation, some industrial control type applications as well. Those often use a different physical layer. There's quite a few different physical layers that CAN bus will run on. We're going to focus on ISO 11898-2, which is the spec that the CAN bus uses in an automobile. So the way that ISO 11898-2, the physical layer works is you have this diagram here of a CAN bus. So we have bits going across the bus. CAN bus uses differential signaling. So anywhere you see that the voltages are the same on the two lines, that is an area that's transmitting a recessive bit, which is interpreted as a 1. And here where there are different voltages, that's a dominant bit, which is also interpreted as a 0. So this is the signaling across the lines on the car actual wires, the run through your car, this is what they carry. Those come into a CAN transceiver. And all the CAN transceiver really does is it takes this differential signaling and outputs your standard digital logic signal for your microcontroller to interface with. There's generally not really much in the way of smarts in a CAN transceiver. Some will do things like if you transmit a dominant state for 2-1, they'll shut off for you, but they don't really generally do a whole lot in terms of logic. If I'm sending a 1, it leaves the output of the recessive voltage I'm receiving. If I'm sending a 0, it puts the output at a dominant voltage and does the opposite for any signals that it receives. So that's how the physical layer works. And as we'll get to later, something that's important to keep in mind is that any time that you were, one of the core fundamental principles of CAN bus is that if any node on the bus is sending a 0, sending this dominant voltage, then that will be the state of the bus. So if any node is sending a dominant, the bus will be in a dominant state. The only time the bus will be in a recessive state is if every node on the CAN bus is sending the recessive state, sending a 1 to the bus. So this is what a CAN message looks like a CAN frame. You have a start of frame, which is a 0, so CAN in an idle state is a 1 of the recessive state. As soon as somebody wants to start sending a message, you have the start of frame, so we'll start transmitting a 0. Then you have this arbitration field. This message is for an 11-bit arbitration field. This is generally more common in automotive. There's also a variation that has a 29-bit arbitration field, and the difference there is that this ID extended bit instead of a 0 is a 1, and then after that 1, you have the other 18 bits of the arbitration ID plus two reserved bits instead of just one. But for all of the purposes, they're very similar, and they can operate with each other. You can have both 29-bit and 11-bit identifiers on the same CAN bus because you can look at this ID extension bit and know which length identifier it is. They have a length field. They have four bits for a length field. The maximum length of a CAN frame is eight bytes, and we'll talk slightly about why that can be somewhat problematic for some security applications in a little bit. You then have your 1 to 8 bytes of data that you're sending. It computes a 15-bit CRC. It's sort of a weird CRC, but it was chosen. It will always detect any single bit error and is really good at detecting like two and three bit errors as well. This plays into why CAN is so reliable that it's very good at detecting if a bit was flipped at some point due to automatic noise or whatever the case may be. A CRC delimiter, just a recessive at the end of the CRC to indicate the end of the CRC. Then you have this acknowledgement slot. So the acknowledgement slot is used for is any time a note on the bus properly receives a message. So it's the right length, it has the right CRC, everything about it looks good. It will send a dominant here in the acknowledgement slot. And whoever transmitted the message listens to this acknowledgement slot to make sure that at least one node acknowledges and receives the message. Otherwise you'll get an acknowledgement error. If nobody acts the message, you'll get an acknowledgement error and we'll talk about CAN's error handling when we dive into CAN a little bit more deeply. Then you have the act delimiter. You have a seven-bit end of frame and at least three more recessive bits after the end of frame as an inner frame spacing. Then once all this is done, the bus will stay idle until another node decides it wants to transmit on the bus. So I mentioned the arbitration ID before. And the arbitration ID is how the CAN bus determines who's allowed to talk on the bus. So as I mentioned before, one of the core fundamental things that CAN believes about how the world works is that if any node on the bus is sending a dominant, then the bus state will be a dominant. So if you have node A and node B that start transmitting, they both send a start bit at the same time. So they're not going to know at that point that somebody else is transmitting because they're sending a dominant bit. They're seeing a dominant bit on the bus. So they assume that it's their dominant bit that's making the bus in the dominant state. And they'll continue while it sends the arbitration ID until one of the nodes sends a one when the other node is sending a zero. As soon as a node sees that, hey, I'm sending a one, but because somebody else is a certain dominant state on the bus, that node has the higher priority and will get access to the bus. So node B will drop out here and node A will continue with this arbitration ID. And what you'll actually see on the CAN bus if you're not node A or node B is the arbitration ID sent by node A. So that's how CAN ensures that people aren't stopping on each other on the bus, how it does its bus arbitration. So now to dive a little bit more deeply into how CAN bus does its error handling and et cetera. So CAN bus is designed to be resilient to transient errors. Like I mentioned, electromechanical noise, just stuff that happens because digital signaling is a lie we pretend to tell ourselves about how analog signaling works. CAN has five different error detection mechanisms. It can detect bit errors, stuff errors like CRC errors, form errors and acknowledgement errors. Bit errors are only detected by a transmitter. So if a transmitter has one arbitration, so it knows it has access to the bus, and it is sending a specific bit on the bus, but the state that it reads back from the bus is the opposite state. So sending a recessive, dominant or vice versa, that'll be a bit error. And that will cause the transmitter to send an error frame and go into CAN's error handling. This won't be detected by the transmitter, of course, because anybody receiving won't know what the state of the bus is supposed to be. Then you have stuff errors. Another feature that CAN bus uses to increase its resiliency is something called bit stuffing. And how bit stuffing works is that with a couple exceptions for a couple of the fields, if you send more than, if you're going to send more than five bits in a row that are the same, either dominant or recessive, after you send the fifth bit, you're supposed to send one bit of the opposite, one opposite bit, so recessive if you're saying dominance and vice versa. This indicates basically prevents the bus from going into a DC state where the receiver is going, am I actually still receiving something or did the other know just die and it's done now. So it does bits to make sure that it also helps keep clocks synchronized, clocks drift a little bit on different nodes. It does reclock on each edge that it receives. And so that also helps to make sure that your clocks don't drift too far apart from each other so you're still able to properly receive a message. So any time that a node sees that the bus has been in the same state for longer than five bits, that is a stuff error and it will then also go into CAN's error handling functionality. CRC errors, CRC doesn't check out and that will also cause an error to happen. Form error is what happens if some of the fixed form fuel, so these three bits, the CRC delimiter, the act delimiter or the act slot, if that isn't right, like if you end up seeing a zero in the act delimiter, that would be a form error because that's not how it's supposed to be. And the last error, like mentioned before is the acknowledgement error. If you send a message but nobody acts your message on the bus, then that will give you an acknowledgement error to occur. There are three other CAN frames besides the normal data frame. There's something called a remote frame and how a remote frame works is it's basically a node on the CAN bus saying, hey, whoever sends this arbitration ID, which is the arbitration ID that it tries to send on the bus, go ahead and send the data that you have. I've never actually seen a remote frame used in automotive, but it's a feature of the bus. There's also error frames and I'll get into more error frames and overload frames and how they work starting on the next slide. So there's two types of error frames and we'll get into how CAN gets into three error states in a couple of slides. But there's an active error and if a bus is in the active error state, that means it basically hasn't seen very many errors and it will, whenever it detects an error on the bus, will send out six dominant bits. But of course, six dominant bits, that violates bit stuffing because it has more than five bits in a row that are the same. So all the other nodes on the bus will also start sending out error frames because of the bit stuffing error. So you'll end up with between six and 12 dominant bits on the bus depending on exactly when, you know, what bits you were sending before the error frame and how long it takes for the other nodes on the bus to notice that there was a stuff error essentially. When you're in the passive error state, then you'll send six recessive bits on the bus and we'll talk about how that's used as part of CAN's error recovery as well. And then after you send out your error frame, the six to 12 dominant bits or the six recessive bits, you send out eight more recessive bits essentially to leave the bus in the idle state for a period of eight bits. Overload frames, I had some fun with overload frames on this. So the intention behind an overload frame is that if you have a slower microcontroller on the bus that needs a little bit more time to process a message, it can send an overload frame in order to just kind of delay processing of CAN messages for a short period of time. It's six dominant bits followed by eight recessive bits. It's during the intermission, which is the three recessive bits after the end of frame, that first three bit interframe spacing that you saw on the previous slide. That is where the overload frame is sent if a node is sending the overload frame. According to the spec, it says at most two overload frames may be generated. It doesn't say anything about what to do if you generate more than two overload frames. This is how CAN does its error recovery. It uses error counters to do fault confinement. There's two error counters, a transmit error counter, which is the error counter that your CAN peripheral will use if it's transmitting something and gets an error, and the receive error counter, which is the error counter that it will use if it was receiving something and saw an error. So there's three error states. There's error active, and error active is the default state. It's what you're in when your error counter is less than 128. So you haven't seen any errors, or you haven't seen very many errors, and that is the state where you'll send the active error frames if you do see an error. Once your error counter has gone over 128, then you'll move into the error passive state, and the error passive state is where you send the passive error frame. The idea here is that if you're a node on the CAN bus and you're seeing a lot of errors, it's possible that actually you're the problem, not somebody else. So in order to, so you'll stop stomping on the CAN bus every time you see an error and send that active error frame, and you'll go into error passive state where you'll check to see if, basically if you get, if you get recessive bits on the bus to tell you whether or not something else is happening on the bus. Once your error counter has gone to over 256, then you go into the bus off state, and in bus off state you're supposed to completely stop participating in the CAN bus entirely until you either reset or get 128 occurrences of 11 consecutive recessive bits. So you can recover that way if the bus stays quiet for a while, but CAN buses often don't, you know a vehicle, CAN buses are often very, very chatty. And the way that the error counters get incremented, there's a bunch of edge cases in the spec, and I'm not going to go over all of them, but in general, on a receive error you'll increment the counter by one for every time you get a receive error, and you also will decrement by one every time you successfully receive a message, that's how you can move from error passive back to error active if it seems to start working properly, then you'll go back into the error active state. On a transmit error though, you increase your error counter by eight for every time you receive a transmit error in order to kick a transmitter off the bus, because a transmitter that's behaving poorly is going to be more problematic than a receiver that's behaving poorly. And that's how CAN does its error handling and error recovering. One of my, another of my favorite parts of the CAN specification is this quote here, it is in the nature of the MAC sublayer that there is no freedom for modifications. Well, what if I want to modify some of these things? CAN is essentially based on the premise that every note on the bus, everything that's connected to the CAN bus will behave the way that it's supposed to behave all the time.  Sometimes you want them to do things they're not supposed to do. Wouldn't it just be so nice if somebody would make something like that? So existing research tools, like we have a tool we've opened source called the CANCAT, Eric Avanshek who's here somewhere has written tools, the CANTACT, a bunch of tools that are all written using a standard CAN peripheral. It's something that's baked into silicon on a microcontroller that will behave the way it's supposed to behave. Well, as far as, as far as like the error recovery, error detection, stopping transmitting when it's supposed to stop transmitting, all that stuff. But we've had conversations with several people in the industry that there's been a need for a tool that doesn't have those restrictions on what it can do on the CAN bus. The final kick in the pants from me about a year ago, ICS Alert 17-209-01 was published. This ICS Alert talked about essentially how you can do this sort of thing on the CAN bus. Now, I remember one of my coworkers told me that when he was in college, one of his classmates pointed out this was a problem on CAN bus. So this isn't exactly news to anybody who understands CAN bus, but now we have an actual ICS Alert begin point two and say, hey, CAN bus has some issues when it comes to security. I'm also tired of hearing that that can't happen. I got it more in aerospace, but that the mindset that people can have that people aren't going to actively do malicious things in order to bypass the assumptions you've made about the system is a mindset that really has been bothering me for a while. So a tool called CANT. CANT is purpose built to selectively target an individual ECU by abusing the CAN specification. It's based on an ST Micro Nucleo H743Zi dev board. It's like a 20, 21 dollar dev board that you can actually get now. I gave this talk the first time at Shmucon and they were back ordered on Mouser until April. So that was a little bit of a buzzkill. I just barely managed to get the two that I had before they were sold out. Currently supports five attacks. Denial of service attack where it just targets all messages, essentially sends an arbitration ID of zero every time a node starts to transmit so nobody else can actually talk on the bus because they will always lose arbitration. Replace data of selected messages. I can choose an arbitration ID and say, hey, instead of sending this data instead and just ignore the other guy yelling at you for sending the data that you shouldn't be sending. Transmitting multiple overload frames. Something that's interesting about the overload frames is that they're generally not reported up to your software. The CAN peripheral just, oh, it's an overload frame. I'm going to ignore that. But they don't actually check to see if they get more than two overload frames. So you can transmit overload frames. That doesn't even get reported up to the software that you're using. I also created a cyber paper clip mode and a knack attack that I'll talk about a little bit more in the demo videos that I have. So the advantages of CANT over a lot of the tools that we have right now is that we have complete control over signaling, including being able to force reassess a bit with the CANT shield that I made. We can follow the CANT spec as it suits us. Sniff messages as you would with a normal CANT peripheral. And then as soon as you want to start abusing the CANT spec, we can do that. If an ECU is giving you trouble, I've used CANT for this before. I'll just use CANT to knock a specific ECU offline so that it can stop interfering with what I'm trying to do. And it's more difficult to detect than packet injection. That's something they talked about in that the paper that led to the ICS alert is using this sort of technique to evade car IDS and IPS type systems. Because you're, as far as something resetting on the bus receiving is concerned, the bus is actually behaving properly. There's only the node that's transmitting knows that something is really going on often. I've got a demonstration that walks through the, walks through what we can do with with CANT. For this demo, I'm using three to demonstrate some of the CAN attacks that we can do with two of the open source. Is that picking up at all? No? All right. It has developed. One of these tools is CANCAT. CANCAT is a tool that GRIM has been developing for a few years now. It is, and Arduino Dewey is one of your common car hacking tool. We use it for doing CAN bus and packet injection, CAN bus sniffing. The one disadvantage that CANCAT has though is it is built on top of a standard CAN peripheral. So it's limited in how badly we can misbehave with that for demonstrating a little bit later. The other tool is the CANCAT tool that GRIM recently released. CANC is a Nucleo H743Zi development board with a CAN transceiver wired to it. And we use that to essentially bit bang CAN over GPIO. This gives us complete control over the CAN messaging at the electrical level and allows us much greater control over what is going out on the CAN bus. We're going to start the demo by showing how to use CANC to act as a bus killer. What this attack does is any time, any note on the bus tries to send a message, CANC will take over and send a message, a valid CAN message with an arbitration ID of zero. This limits, this effect of this, limits any other note from transmitting on the CAN bus. So we'll go ahead and set up that attack. We'll go ahead and set up the BOD reach, the bus killer attack, and we see that the very quickly the brake fluid light pops up, the instrument cluster starts shutting down. Currently nothing is able to transmit on this bus. We're going to come over here to the oscilloscope and see that we're shutting out. For this demo I'm using 3PO, our portable part hacking demo, to demonstrate some of the CAN attacks that we can do with two of the open source tools that GRIM has developed. One of these tools is CANCAT. CANCAT is a tool that GRIM has been developing for a few years now. It is an Arduino delay with a CAN shield. It is more of your common car hacking tool. We use it for doing CAN bus pack injection, CAN bus sniffing. One disadvantage that CANCAT has though is it is built on top of a standard CAN peripheral. So it's limited in how badly we can this behave with that for demonstrating a little bit later. The other tool is the CANCAT tool that GRIM recently released. CANCAT is a Nucleo H743Zi development board with a CAN transceiver wired to it, and we use that to essentially over GPIO. This gives us complete control over the CAN messaging at the electrical level, and allows us much greater control over what is going out on the CAN bus. We're going to start the demo to use CANCAT to act as a bus killer. What this attack does is any time, any node on the bus tries to send a message, CANCAT will take over and send a message, a valid CAN message with an arbitration ID of zero. This limits any other node from transmitting on the CAN bus. So we'll go ahead and set up that attack, set the BOD reach, the bus killer attack, and we see that the very quickly, the brake fluid light pops up, the electrical cluster starts shutting down on this bus. We come over here to the oscilloscope, always sending this message whenever any other bus tries to send its own message, effectively killing the CAN bus. That much different than you'd get from jamming a paper clip into the CAN bus, and shorting the two wires. The advantage of CANCAT approach is that it does that same, it has that same effect without both of the CAN bus. This is a perfectly valid, properly functioning CAN bus, just nobody else is allowed to transmit on it. Stop this attack from happening, the CAN bus goes back to normal on the oscilloscope. Next step is we're going to illustrate those differences I was talking about between how CANCAT works and how CANCAT works. So CANCAT is a tool we've been developing for a while, like I mentioned, it runs on the Arduino duet with a CAN shield on it using a standard CAN peripheral. So it allows us to do things like just send a CAN packet. What this CAN packet that I'm about to send does is it causes the brake fluid low light to come on, and we'll see that happen up in the instrument cluster. I'll send it, brake fluid low pops up, but only for a fraction of a second, and this is because the body control module is sending out the brake fluid status message about three times a second, and of course the brake fluid level is actually okay. So this message that we're injecting is being overridden by the body control module almost immediately once we send it. If we try to flood the bus with this message, just put this in a wild loop and keep pounding on it, we see that the brake fluid light will pop up and go away and pop up. This gives us very herky-jerky control over whatever it is we are trying to control. This is a problem that you run into quite frequently with CAN. You're trying to inject a message to do something malicious, but your message is getting overridden by a different ECU on the system. CANT has a very nice data replacement tool. We'll set the VOD rate to 125 for a bit per second. Place your attack. It's eight bytes long. If we go back we'll see the message is 8800106 000000 and as soon as we start doing this we see that our brake fluid level low light comes on in the instrument cluster and stays on. The reason for this is because this attack, since we're replacing the rules of the CAN bus from the perspective of the body control module, the body control module should be the one sending the message, the only one on the bus but we're taking the bus away from the body control module. So the body control module is going into an error state. We take a look at this one here. We'll see right here we see that the body control module is hitting out these longer pulses. These are error frames. The error frame that we were discussing earlier. We'll see there's quite a few of them. If you come along there should be 16 of them. Because the body control module is going into its bus off state resetting, sending an active error frame until it accumulates 128 send errors again. And once it's accumulated 128 send errors, it goes into the error passive and then eventually into bus off.  Last attack I want to demonstrate is an attack of the overload inserter attack. So the overload frame dumped out of me when I was reading the CAN specification. The CAN spec says that no device on the bus should send more than two overload frames. It doesn't say what should happen if somebody does send more than two overload frames. The only purpose of the overload frame is to allow slower nodes on the CAN bus to request a little bit of extra processing time after they receive a message. So they say now the overload frame this gives them just a little bit more time to process a message that they've received. Let's go ahead and set the body rate again and choose the overload inserter. Let's just send two overload frames. Just behave in a nice appropriate manner. And we see that things seem to be functioning quite well. If we don't re-hear it into the scope we can go ahead and we see we have one, two overload frames everything looks nice and kosher. Let's send more. Let's send five overload frames see what happens. If we go back over to the scope we see we have one, two, three, four, five overload frames and we also see that everything seems to be running properly. So apparently sending more than two overload frames doesn't immediately cause any issues. Let's try sending more. Let's try sending a stream of these overload frames. We'll send quite a few. Now we see that this has taken some effect. The brake fluid level low light comes on for some reason and that it's not a camera glitch that instrument cluster really is kind of dimming. You can still see it's still kind of running but it's definitely something weird is going on. And if we come over here to the scope we see as we expect there is something in a whole bunch of overload frames. We also see that the amount of time we're spending sending overload frames that's the more than we're sending sending actual messages. So we're actually seeing a significant increase in bus load here. Let's try sending a hundred of these things. A thousand. So a thousand of these things. And if this in the thousand causes the instrument cluster to completely shut off at this point. And if we come back here to the scope at the point that we see we're spending very little time actually sending messages and we're almost spending the entire bus time is spent in these overload frames. This is a demonstration of what can't allow you to do. Can't allow you to do things that you can't do and see what the effects of that is. So after since that demo I've added a couple new features which are also interesting and I have a demo for those as well maybe. You know I recorded these videos I didn't have to go through all the problems you get with a live demo. One thing that can't couldn't do at the time and I figure if I'm going to release a tool called can't I should probably make sure there's nothing that can't can't do. The thing that can't couldn't do at the time was can't couldn't assert a recessive state on the bus. This is how can handles all of its arbitration all of its error handling and error recovery is by assuming that a node cannot assert a recessive state on the bus that if any node on the bus is asserting a dominant state then the state of the bus will be in the dominant state. So in order to accomplish this I created this piece of hardware. It's a shield that plugs into the Nucleo STM 32H7ZI dev board that we've been using and it is a standard can't transceiver. It has a can't transceiver connector or passives on it the thing that I added that makes it special is this little device here at U2. It's an analog switch and what this analog switch allows me to do is it allows me to short can't high and can't low together and when can't high and can't low are shorted together it allows it will cause any node on the bus to read a recessive state because it will be in the same potential. So this allows me to violate that last enviable for the can't bus is by asserting a recessive state on the bus and this allows me to create two new attacks plus adding a enhancement to a third attack. So the first attack I'm going to demonstrate is the cyber paperclip mode. This just turns on the bus it does the same thing that plugging a paperclip into the can't bus would do. It just causes the bus to short together and nobody can communicate. We'll go ahead and start that attack, the bus short attack and we see that this purple line here on the scope is the state of the switch so we see that this went high turned the switch on and that now we don't really have any traffic on the can't bus. At some point we should be able to see some sort of message starting to come up we can see that the instrument cluster is dead. We see it's kind of trying to get a message here and there but it's not able to actually send anything because the bus is shorted together. We'll go ahead and reset our can't reset the car because recovering from this is difficult. I'll have to get the instrument cluster running again. The second attack I want to demonstrate is a knack attack. So what the knack attack does is it tries to essentially harbor the acknowledgement bit that the nodes on the bus are supposed to send back once they properly receive a message. So we'll go ahead and set our bot rate the knack attack. This should, as we see here this is where the knack slot should be here on the scope. We see that our switch goes high for one can't fray or one can't bit and it does all this because all this is crazy stuff to happen on the bus and it tries to happen. So as we can see our cluster is still running. It seems like it's still getting enough back that the car isn't too unhappy but we're able to generate a bunch of noise on the knack frame. The last attack I want to show is an improvement to the data replacer attack. Previously the data replacer attack would only work if we were wanting to send a dominant bit where a recessive bit was being sent. The brake fluid test that I showed and the previous video showed that the brake fluid level low is a dominant state so I was able to assert that dominant state on the bus and had the brake fluid level low show up on the bus. But what if we want to go the other way? So in this case I've actually used our control box to cause the body control module to actually be sending the brake fluid level low which is, it does by setting that bit to zero to the dominant state and now I want to overwrite that with the recessive state for that bit to cause the brake fluid level low light to turn off. I was unable to do that with the previous version of CANT but now I can do that. So we go ahead and set the arbitration ID choose the bottom right again data replacer attack bikes first bike will be 98 0000106 0000000 then I added this line here the force recessive bit now force recessive is not currently the default I'm going to go ahead and say yes to force recessive bit and we'll see here that the brake fluid low light goes away now we will see occasionally that the brake fluid low light will flash back on for just a second and it will flash back off I haven't been able to figure out why that is happening if we go and look at the actual state of the bus using the CANCAT tool that I have hooked up we can see that it's all of the brake fluid message lights are being set to what I said it to it's going to be sending 98s all the way across there's some other behavior and the instrument cluster is causing that message to pop back up occasionally but the attack works the values that we're targeting are now coming across the bus with the correct value and one thing I forgot to mention in the video is that another advantage of being able to force the recessive bit is that I can also clobber the error frame that the body control module or whatever ECU is sending the message is sending so that the only node on the bus that has any idea anything is wrong is the one that I'm specifically targeting like nobody else is an error frame nobody else does anything to his error counters it would continue to operate as if nothing was wrong and have no idea anything else was going on so there are some limitations and mitigations to this one limitation is that you need physical access to the car in order to do this maybe it's also possible to theoretically possible to find a way to get into the car remotely or wireless or cell modem or something program in ECU to be a can't essentially because there's nothing minus the analog switch to force the recessive which I'm guessing most OEMs don't actually stick on the can bus for you to play with minus that feature everything else you can do it's just a bog standard can peripheral that is shipped with every car every ECU that has a can bus so increase for the attacks of just increased can bus load those could be detected by something that's looking at can bus you wouldn't necessarily be able to tell why with the overload attack because like I mentioned those overload frames aren't actually brought up to software so you'd see your bus load increasing and that stuff couldn't make its timings that it's supposed to make but it would be difficult to determine why without hooking a scope or similar up to the car power fingerprinting is something that some companies are working on were they able to fingerprint the nodes on the can bus to see if there's anything out of the ordinary can't is definitely out of the ordinary I haven't actually used one of these to see what can't looks like but I'm sure it sticks out like a sore thumb because I am bit banning can or GPIO that's going to look a bit different of course and the question is then what so yay we're something's happening what do you do now with that car to make it work properly increased network segmentation can help limit the how this attack some sort of encryption or authentication could help mitigate some of this possibly although can makes a lot of this difficult because of how small its data size is and how low power a lot of the ECUs are and of course you can always switch away from can bus minus the self is mandated by law that will give you some more options as I'm further reading the can spec is available right up there and this is the paper that led to that ICS report ICS alert going out I've made a couple other improvements to can't backspace works now as of a week ago so that's really handy couple other usability improvements and I am pushing those up to get hub right now so that will all be available shortly up on get hub I also have about 20 of those can't shields available I don't have the dev boards just the shields but those dev boards they're about 20 bucks get them from Mauser arrow whoever you generally order from and anybody who wants one feel free to come up and get one and they won't have any questions I switch to this because I wanted to make sure that I would have enough this dev board is an Arm Cortex M7 at 400 MHz it's a pretty beefy board I wanted to make sure that I would have time to actually launch the attacks I wanted to be able to launch and have the flexibility to do more complex attacks without then not being able to make timings on the can bus alright thank you all very much like I said if you have any more questions for me feel free to come up I have a handful of those shields that I'm handing out