So, hi. This talk is going to be about monitoring converging infrastructure containing and running together containers and virtual machines together. The main focus here will be about metric collection because I can't cover all of it. So, let's start. My name is Yannir Quinn. I'm working in Red Hat since 2016 and I'm a part of the Acuber team. So, we'll briefly talk about Kubernetes and metrics collection in Kubernetes. The main sources, the key sources for metrics collection. We'll see how it comes together with Formiteus to provide us a full monitoring pipeline solution. Having covered that, we want to throw in virtual machines into the mix. So, we'll briefly look what Qvert is that brings virtual machines on top of Kubernetes. See from past experience what we have collected for virtual machine and matrixes and see how it all comes together eventually. So, we have Kubernetes as a start as our container-centric platform orchestrator that orchestrates computational nodes and pods, network, storage database, all of components that you would like to monitor in your system. And the second building block here is Prometheus. Prometheus was originated in SoundCloud in 2012. Now, it's an open-source community. It's a monitoring and alert team system. It's a multi-dimensional and label-based model. It's based on a time series data which is comprised of key value pairs. It has a very strong query language, PROMQL, that analyzes that time series data. And you can see it really integrates in a natively almost way with Kubernetes. Some of the Kubernetes components already have integrated with Formiteus. A quick view on the model. So, in the middle, we have the Prometheus server that scrapes and pulls data through HTTP endpoints into its server, collects and aggregates that data. On that data, you can perform a PROMQL series in order to analyze it and move it on, aggregate the data, and even create the alert team. Alert team are pushed to the alert manager and to its clients. And you can also use Grafana or other API clients to visualize that data. But again, our main focus here is metrics collection. So, because Prometheus needs as much as auto-discovery as it can get, it needs to scrape data, pull data from metrics endpoints, HTTP endpoints. For that, it's very easy to integrate with Kubernetes since it exposes these endpoints on APIs, on HTTP. As I said, some of the metrics are already exposed through the metrics endpoint, and some will need to be added and collected. So, I'll go over two or three sources of metrics in Kubernetes and the Kubernetes architecture. The first one of them is the host metrics, Kubernetes nodes. So, Kubernetes nodes didn't have natively exposing metrics endpoints. For that, they had to write an exporter. An exporter is Prometheus exporter is a service that collects all of your data from your node, for example, or any other data you need to expose from your application, et cetera, exposes them on the Prometheus endpoint. So, Prometheus can come, discover it, and scrape them out. So, node metrics are scraped from Proc, and you get all your familiar host statistics such as Node CPU. Node CPU, for example, has like 15 dimensions of metrics type for CPU, like idle, IO8, but if you want to analyze, for example, how much time the CPU has spent on a node or per CPU core, you can perform a Promet QL query and remove these and get your Node CPU statistics. There are, of course, memory, memory available. You can also perform queries against the total memory left. There are more advanced metrics than only Node statistic. If you look at it in a Kubernetes kind of way, for that, we have another component called CubeStateMetrics, which looks at it from the Kubernetes way and also takes into account memory limits and CPU limits. Moving on. So, in our host, we have containers, and containers' metrics are exposed through Cadvisor. Cadvisor provides you data about containers' runtimes such as Docker or Cryo. It is embedded in the Cubelet. So, Cubelet natively exposes an endpoint to slash metrics, which is a port for Prometheus, so we don't need to add additional exporters to collect that data. So, you analyze these metrics and resource users' usage and expose them on the metrics. These are what you also call core metrics for each container.  Actually, this matrix is very advanced. In the nano-signal, it gives you actually the exact memory usage. You have left, taken into consideration all other metrics you have under your container. And, of course, memory transmission. Another part, let's look a bit on the orchestration parts. So, I'll talk about only API server here. So, because the API server is the front-end for Kubernetes cluster and gets all the calls and relays them to ETCD and controller, it's an important component to monitor. For example, you want to create a pod or run a deployment. You want to see, and it's all done through REST API calls. So, you want to see the request rates and latency. How long did it take for me to complete a request to create such a deployment, for example, or how long did it take, even counting the amount of that. And let's say you want to create a thousand deployments on your cluster. When you create a deployment, it goes on to work use for controllers. It accumulates in cache the request for creating objects or deployments.  So, it's a very important aspect to monitor. Because Kubernetes is based on goals, so you get out of the box, goal and statistics, garbage collection, memories, threads, et cetera. And you also monitor the server's process itself. So, that was only one component. Of course, you have metrics collection for scheduler, the Kubernetes controller, ETCD, but I won't get into those. Now, there's an add-on called kubestate metrics. This add-on you need to deploy as an instance, only one instance in your Kubernetes cluster and it relates more to not health or utilization. It focuses on counts and status. So, for example, you want to check what status is your pod in in terms of scheduling or health, not health, the phase it's in. You have the concept of CPU limits or memory limits. We won't allow a pod to run containers without any boundaries. We don't want to exhaust all of them. So, I want to check statistics, how much memory you have been according to your limits or provide even more advanced queries on these statistics. There are a thousand of examples in kubestate metrics. I'll talk about, for example, replica sets. You have defined a replica set. You want to run a number of deployments on your cluster and you want to make sure that these number of deployments are running in your cluster. So, you want to see if they are not available, how many are there in the cluster and so on. So, that was very briefly about Kubernetes components and sources for metrics collection. And now, we want to add virtual machines into the mix. So, kubert. kubert comes to close the gap between virtual machines and containers under the same hood, under Conveld's infrastructure. We want to run also virtual machines, also containers in the same platform. And we ask ourselves, why? So, this is a great allegory. Containers are considered to be lightweight. They're fast to bring up. They have native performance. But virtual machines, with their bulky, heavy utility, how well built, are not going to disappear. We will have them in the next 5 or 10 years at least and we'll still want to maintain them. You can look at an example for mainframes. It's taken a long time to phase out mainframes. They still even exist. So, what can I do with it? First of all, we want to bring the legacy. We want to run it under the same hood. We don't want to maintain two infrastructures. So, we're going to mix and match and add virtualization on top of Kubernetes, thus also getting all the Kubernetes advantages, such as scheduling, the storage, networking. We have some addition and fixes to manage to do that. We also, in the use of Kubert and running virtual machines on the Kubernetes cluster, we can also enable, and run any OS we want to run on top of Kubernetes. So, this is Kubernetes and we added to the mix some virtual machine components. Again, I won't go too deep into the components. So, on the left, you can see the node. In the node, we have a pod which runs a VM. Virtual machines run on pods and you have also side containers on that pod to enable virtual machines such as LiveVirt. You also have key components, very resembling Kubernetes components, like VIRT API, same as API Server to create your virtual machine CRDs, pass them on to UTCD, having the VIRT controller identifying that, creating a pod, running a virtual machine on a pod and also scheduling it to a node. Once it's scheduled to a node, the virtual machine gets the node assigned and then all the handling of the VM life cycles moves to the virtual handler. Again, on top of the fork. So, of course, I added something new. I have monitoring on Kubernetes. I want to also monitor virtual machines. So, I want to figure out first what to collect. So, a quick example from pure virtualization, Overt. Overt uses the virtual machine to collect it to make tricks. It has powerful plugins, a lot of plugins you can add to it and run it. It gets you host statistics, database statistics, engine stats and more important for us right now it's virtual machine statistics. So, for virtual machine statistics, we have a VIRT plugin. VIRT plugin communicates with LiveVirt and LiveVirt gives us the information about the virtual machine. So, of course, you will introduce on here some new aspects, not necessarily all will be monitored and adapted to Kubernetes, but virtual CPU, how much time my guest was running on a CPU. Memory, some specific related memory matrix like ballooning or overcommitment, memory management matrix, disk reads and writes, flashes for disk, and also network aspects. Some of them might merge from the benefit of Kubernetes but we might want to adjust them to virtual machines but some will need to add. One strong example I can give you that Kubernetes has a scheduler, a very strong scheduler but it doesn't have 80 scheduling policies we have in virtualization and we'll probably add these policies also to the scheduler. So, we want to see why our cluster behaves in such scheduling matter like let's say high availability, HA reservation and we also want to monitor that. Maybe we'll decide in the future to change the scheduling policy. So, it's a very important aspect. So, we're consisting of similarities and adding virtual machine statistics. So, coming back again to Prometheus and Kubernetes, we had our collection, node exporters, cube components, cube set metrics and of course, we're missing the collection for virtual machine. Virtual machines and Kubernetes just came in so we need to write a custom exporter very much like node exporter. So, for that we need Prometheus exporters. Writing an exporter could be done in Prometheus client library. For us it was very easy, it's mainly in Go, so it's very native to write it. So, that exporter will collect your data from the app matrix. It will expose it on matrix endpoint from Kubernetes, slash metrics and it will be available to scraped by Prometheus server. So, we'll add custom exporters for our virtual machines and we'll now start pooling other components. So, we have the Kubernetes components and now we talked about virtual machine matrix. We talked about components for orchestrating the virtual machine such as the VIRT API, the VIRT controller. We have also processes that running inside a pod as I said, for enabling virtualization such as library and QMU. I want to complete the picture in a small note about the whole cluster. In order to deploy Prometheus servers on a Kubernetes cluster, we can use very easily Prometheus operator. It has two main functionalities. It's first of all to deploy and manage the Prometheus server. You get also alert manager. You can get also node exporters or other sponsors you may define and also important to watch your components on the cluster. So, we added virtual machine and in order to watch them, we have a Prometheus operator, we have an entity called a service monitor. You define the port, you define the objects you want to monitor. You add the corresponding labels for that matter and if you now create new CRDs, it detects that and starts scraping these metrics also for virtual machines in our case. So, QVIT metrics. So, I'm taking you back. So, we looked at metrics we collect for Kubernetes. Some came from the Qubelet. Some came from node and components. ETCD, scheduler and controllers. And now adding to our mix. We add the VR controller and we have the VRT API and the VRT handler. And I told you it's very resembling the Kubernetes components. So, if we look back at the API server, we talked about it's communicating with controller walk use and performance. It has native statistic about Golang and it also handles the REST API requests and measures them. So, very similar. We have the VRT, VRT controller walk use. We want to go over that and get statistics about that. We have Q latencies, work duration, number of time, also the caches that comes from Gol, REST API calls. Again, very similar to the API server. And now I want to focus specifically on virtual machine statistics. So, the previous were general components in a Kubernetes cluster. Here you drill down into the virtual machine statistics and matrixes. So, two major parts. Virtual machine matrix, which we saw how and what we collect in OVIRT, in a pure virtualization environment. And processes. So, for process service, I'll say it's more for the point, the developer utility less for real cluster management and observability. And these processes, for example, are also scraped from PROC like another exporter and we get metrics about them. So, some important information about VM metrics. We can see the four pillars of metrics we collected in OVIRT. And usually these pillars are repeating themselves in all of the metrics. These are not the only metrics we'll collect, but these are the most prominent examples. So, for example, VM CPU or CPU time. I want to see my guest CPU how much time they use. Memory, for example, you want to create a metric that is composed for several matrixes. How much memory we have on set. How much actual ballooning was left for the VM itself. RSS, the amount of it. All compiling and coming down to completing a collect matrix. And also about network. On the bottom, you can see the pod info matrix, which I talked about processes themselves. And you can see a full form of metric, how it looks in a Prometheus exposed format. You have the name of the metric himself, itself, which domain or for our matter, what VM does it monitor. You can add a host or other labels. For that matter also, we added the process name and the type of matrix. This applies to all metrics time, all metrics time, time series, format we want to show here. So this is an example of how it will look on a Grafana dashboard. Of course, you can also use SkiBana for that matter or other tools for a very simple example for a VM running on a pod is CPU usage and memory usage. Okay, so in conclusion, that was a very fast talk about some concepts, but the main take here is that we have Kubernetes and Prometheus. We have this whole platform and framework and solution existing. We have very easy extensibility for that. So for us, by adding a new add-on, Kuvert and virtualization into the mix, monitoring that was kind of native and very supportable. And for us, we got a complete monitoring solution and it's continuing to grow as we speak for a convergent infrastructure. But it shouldn't be just only for virtual machine. Everybody can take it for himself and if he adds new components on top of Kubernetes or add-ons or side application, we can monitor that using the concepts of Prometheus exporters and other many notions.


So our next speaker is from NYU Tandon School of Engineering from the Digital Future Lab. His focus for this talk will be using engineering and AI to build the next gen of smart scopes capable of diagnostic support and fun little fat on the spare time. He does 3D print graffiti artists in the style of green army men.  Here is Luba Gusti.  My name is Luba August I work at NYU Tandon School of Engineering in their future labs so it's really I'm an entrepreneur residents there they incubate my company been running it there for three years now and we work on solving this problem. So just a little bit before we get started we won some awards over the last couple of years we won the ASME Award for best hardware prototype in 2015. Last year we were nominated for science start of the year by this competition out in Germany called Falling Walls. We won the Indian government's endowment for science research last year and this year we're finalists for Qualcomm's prize designed in India. I apologize my methods in the British Medical Journal in 2015 on how to make use smartphones to create whole slot images and did a preclinical validation study of that information in 2016 which I presented at USCAP which is United States and Canada anatomical pathologist society and this year we received IRB approval to do our clinical validation study which I'm writing up right now.  If you look at this microscope here it's such a dinosaur that it's not even connected to the internet. Basically the problem is microscopes are dependent on the operator and who's operating that microscope and the problem that we're facing is as we look out at more and more in the healthcare landscape in the world we find that there are things called healthcare deserts. These are places in America developing world where options for healthcare don't exist and it's not that they don't have microscopes they have microscopes they don't have anyone that could help them do diagnosis. So this is very true as I said in Kentucky as just as true as it is in Haiti just as true as it is in India. So before we go forward I wanted to give a shout out to my boy Anton von Leeuwenuch. He's like the G of microscopes so basically he was born in the 1500s and 40 years before he was born they had created the compound microscope. Leeuwenuch was a tradesman and he was actually into glass working. He didn't have any advanced degrees he didn't have a PhD so he was eliminated from a lot of the science community but what he did was he created with his knowledge of glass blowing or glass making he created this microscope here and this microscope had a magnification of over 200 times magnification. Up to that point they had already invented the compound microscope which is very similar to what we see today in any laboratory but that only had a magnification of 20 to 30 times magnification. So von Leeuwenuch was definitely one of the first disruptors and he's also considered the father of microbiology because of what he was able to see through his microscope that he created and in fact it wasn't really until the 1800s that they made any advancements past what he made with this microscope here. So also humans are stupid because when we're given the task we get humans get tired and they miss things and diagnosis itself depends on memory so you probably can't see this right here because the screen's a little bit contrasty but if you were looking for cancer on this thing there's actually a monkey in the upper right hand corner of the lung that most people miss when they're looking for cancer so I'm not sure if you could see that here but that's usually a good example of how people miss things that are obvious when they're doing something that's repetitive. So a little history on telepathology which is sort of what we do. So this is 1986 this was the first demonstration of a robotic microscope and you can only imagine the satisfaction that this man felt collection those keys and hearing those sweet clicking sounds as he moved the microscope around and really the history of telepathology is sort of a history of the internet in many ways as well because as things improved with the internet we were able to do more and more in terms of sharing slides and then virtually moving on to creating virtual slides and sharing those slides over the cloud and now with things like TensorFlow we're actually getting to the point where we can deploy AI locally on the device and that's a big step I think that's happening right now in the telepathology industry. So really the work I've done over the last four years has been focused on helping health outcomes in the developing world and solving the problems that they're facing and so one of the biggest problems we look at is this real simple equation lost time equals lost lives. So there's a worldwide shortage of pathologists or doctors able to make diagnosis and because of that people can't get diagnosed and so people can't get diagnosed they can't begin treatment and the later you wait to begin treatment the worser health outcome is going to be. So a lot of research we've done is creating just simple ratios when we look and see how many specialists there are in a country versus how many people there are and so you can see that in the US you've got a ratio of basically 1 to 17,000 but then if you look at a country like China you've got 1 to 58,000 and then if you look at a country like Haiti you've got 1 to 1,375,000 so you could see that there's just not enough doctors to make diagnosis for all these people and there's also things that happen when you're in one of these countries that has a small number of doctors you could actually fix your price as one of those doctors and your price can be a lot higher than it would be in another country and so not only are those people not able to get access but they have to pay a lot more money for access to diagnosis. So the College of American Pathologist states that between 70 well 60% and 70% of all diseases need a diagnosis using some sort of cellular biology and that includes cancer, things like malaria, a lot of diseases that we know today. Anyway so another thing we've studied is this travel burden and a lot of people have done studies here in America and so we have three studies here, one from Kentucky, one from Illinois and one from Georgia and basically all these studies stated that people that lived at a far distance away from the primary diagnosis center they would get stage for cancer much later and so that's a big thing that we're facing so like I said if it takes you a long time to get a diagnosis you're probably going to get diagnosed much later when it's going to be much more difficult to cure. So to give you an example of one of the patients that I saw when I was down in Haiti so we had this woman come about three years ago and present herself and she had a breast mass and so we had a surgeon at the hospital who was able to do a biopsy for her but there was no one available that could look at her specimen once we had it. So we gave her her specimen in a jar and we gave her instructions on how to get to the nearest laboratory and so that laboratory is about six seven hours away and she never made that visit. So a couple years later she came back in and this time the mass had grown so large that it actually had ulcerated out of her breast. So now you see we definitely can say okay well this you know this was without a doubt it was going to be breast cancer right here but when we first saw her when she first presented herself when she only had a small mass we could have used diagnostic testing to prove that it was breast cancer at that point and consequently we could have started shooting much earlier and that's sort of an example of what happens. Also it's important to note that the cost of testing diagnostic testing in Haiti is fifty dollars per test so that's like a really important number to kind of remember. So the previous solutions were like to travel to Port-au-Prince, find a lab, wait a few months and hopefully get a diagnosis. What we were doing before a long time ago was collecting all the samples, flying them to America, getting a lab to process them in the United States, sending all the results back and praying that we could find all the people that we had tested while we were down there. Another chance is like the doctor operates based on symptoms and then really what mostly ends up happening is people die of unknown diseases. So that's pretty heavy so I'm going to chill out for a second. But we're like we're working to solve this problem because we know we can and we know we can use technology to solve this problem. And so what we've done is we've been focusing on building human machine teams. So the vision really is and it's something that WHO sort of shares with us as well is to create more health care workers because the paradigm of having a hospital, having a doctor that we know and well love here in America or other developed nations, it's just not going to work in a lot of these countries. So we have to take people that are willing to go to school for maybe six months to a year, train them at a skill, that could be a skill like becoming a lab tech and then give them the technology they need in order to share those slides so that they could make more diagnosis. And so that's something we've been working on. This is the team that I go down to Haiti with from time to time to do that. So another big thing we've been looking at is okay so once we can build the capacity for doctors or for health care workers to prepare specimens to upload those specimens to the internet, well who are they going to share those specimens with? So normally what we did in the past was we shared them with doctors here in America. But doctors in America are really busy. They don't have enough time to look at cases from another hospital, especially if it's not helping them on the bottom line, it's not helping them make more money or do whatever. So what we've actually done is we're working with this team of doctors here in Tanzania. And so these are all doctors, these are all pathologists, the women that you're seeing here. And that's our friend Mumbeck, he's also a doctor in Tanzania. And what we've been working is in this hospital, Mullabili in Darslam, we're setting them up with the technology that they need. So remember when I said it was important, remember that it costs $50 to get a slide diagnosed in Haiti. While in Tanzania the cost of reading a slide is only $12. So already we're saving money for the people that are in Haiti by giving them this option. And the doctors in Tanzania are only making about $700 per month. So they are actually interested in supplementing their income. And they also have an unused capacity because they're sitting in traffic and most of them have drivers. So when they're sitting in traffic, there's time for them, if they're on their tablet or smartphone device, to actually be reviewing cases. So our solution is really to actually send our cases from Haiti to Tanzania to decrease the cost of testing so the people in Haiti can afford to pay for testing and they can get a diagnosis quickly. And then hopefully what we'll do is export the lab training program that we're developing in Haiti, export that over to Tanzania and then create more lab techs and more health workers that can work with what we're building. So that's sort of where we're at. And how we've been accomplishing this right now is we've been developing a system we call SmartScope. So this system basically has two components. It attaches to a regular microscope and over the eyepiece we have a camera that just fits on the eyepiece. And so that'll fit up to an outer diameter of 44 millimeters. So that'll cover most most eyepieces that are out there. And then we built this robotic slide holder and it just attaches with two screws to the side of the stage of the microscope. So basically with these two pretty simple pieces of technology we've developed over the last three years, we can take a standard microscope and then we can turn it into an IoT device. And so what this is is something that we can deploy at a cost of about $1,000 to $2,000. And on the other side, the companies that were previously building whole slide imaging machines and dynamic microscopes, they were normally charging between $30,000 and $100,000 for one of these standalone devices. And if you've worked in the developing world, you'll know that any sort of standalone device that they have, there's a good likelihood that it's going to be broken by the time you get back there the next time you come down. And there's no one that's going to service these devices. So we've actually created this technology really mimicking what we saw in 3D printers. And we've created technology that you can actually repair yourself. So I think that's a big change right now. And then you can share it on your, it runs on the cloud. So you can share it on your desktop, you can share it on your tablet, or you can even look at it on your smartphone. So how we built it up to this point was we used the Intel Edison. We thought that was a really good solution for us to start with because it gave us a lot of versatility. We could run a whole bunch of programs on it. But the one drawback of working with the Edison was that it required us to have a computer to run everything with. So we couldn't sort of do things, everything on the device. And that was sort of where we're at. And we're actually deploying these units into the field, having sort of more and more use cases for it. So we have hospitals in Indiana that are using it for immunohistochemistry stains. They're just making sure they're just using it for Q&A for that kind of stuff. But it's been good. And so now we're looking at the next, the next, what's next for us? What's next in the future? And so I mean, I think this quote from Freeman Dyson is really good. New directions in science are launched by new tools more than they are by new concepts. The effect of concept of revolution, explain old things in new ways. The effect of tool driven revolutions is to discover new things that have to be explained. So I think in a lot of ways, when Lee Winhook went on and developed a microscope that could see at 200 times magnification, then he could explain microbiology. For us, what we see in the vision is not only are we sort of working with this concept of people that are going to be providing healthcare workers, we're also giving them the tools they need. And we think these tools are powerful enough and cheap enough that they can be deployed at every single laboratory anywhere in the world. And we can create a whole global network, something that we like to call Skype for microscopes. And this is how we're going to be able to track new diseases as new diseases are emerging to the world. We're going to need to have these capabilities. We can't just send an expert there right away. There's time that takes to transfer someone there. But having a sort of a network that's really light, we can create people around the world that could share this information with a centralized location. And so I think that's sort of where we're at. So I'll give you a little bit of a demo of how everything works. Let me see, just press the play button there. So this is our new website. It's launching later this month. Basically, once you sign in, you can access any devices that you have permissions to access. And so the devices are there. And then these are invitations. So you can receive invitations to join a session by someone else that has a device. And then once we have everything sort of running, we have this interface here. And you'll see the slide come up in a second. And so what we're able to do is we're able to control the movement of the slide. But we can also do things like add comments. So right now we're adding a comment into this box here. That could be sort of like anything you're seeing on the slide. You can submit that comment and that's recorded. We can invite people into the session. Really simple. So we're going to invite Carlos right now. He's going to come in. We're going to invite him. You can see we have all the information available there. That's running on the local host. So we have all the information of the slide there. And then we could slide that away. And then you give you the whole slide. And so that's this is just a feed from a regular microscope, just from the IP. So the microscope. So obviously I mean there's some imperfections you're seeing dirt and stuff like that. But this is what you would be seeing if you were looking through that IP anyway. So it's a lot of I mean it's clinical quality. It's getting the job done. And it really requires very little IT infrastructure to work in any way. So yeah I mean now you're viewing the slide. And this is sort of an example of how we can look at different parts of the slide in order to determine a diagnosis. And then if we see something we like, we can take an image of that. We can add a comment to that image. And then once we have the comment to the image, we'll save that as well. And that just downloads to your computer. So you have a copy of it. And the idea basically is once you close out of the session, what you'll be able to do is create a report. And that report would just act as a single lab report. Very similar to any sort of lab report you've got from any hospital. It would tell you who is in the session, who started the session, what hospital the session took it to place at. And it would tell you any sort of diagnosis was made. And then it would give thumbnails of any images. Okay cool. So I've got about five minutes left. So just finish with this guy. And then we'll move on to the next slide. So that's sort of where we're at in terms of how we see connecting laboratories around the world together. So let me talk to you a little bit about something that's called flock mind. Which I think is pretty interesting. So this was a study that was done. The doctor is like that did it. Some people don't like her. She's like sort of one of those figures. But she did this study basically where she took pigeons. And she trained the pigeons in order to make diagnosis on breast cancer using images from slides. So the pigeons themselves had an 85% diagnostic accuracy when determining cancer. But when they took the whole flock of pigeons and then they actually took the result of the flock, they found that it actually raised up to 98%. So it was actually pretty good. But the thing they weren't telling you when I read the article was that they only used a training set. So they trained the pigeons on these images and they just gave them the same training images again. They never gave them a testing set. So they sort of tried to hide that data. So I'm going to tell you that one. But it's still really interesting that with a training set they could have the pigeons make their diagnosis. So that's essentially what we're trying to do right now with AI. So we're using TensorFlow and we're basically creating our own methods of detecting cancer. So this is one in particulars for cervical cancer and we're doing screening programs where we can determine what level of cervical cancer that people are facing. And we're actually, it's actually going really well. We're really happy. And we're able to build a lot of data because we have our own slide scanners which is a big thing that holds a lot of people in life. And right now we're working with Qualcomm as I mentioned before. And the reason why we're really excited about that is because we're trying to actually create a new device all together. This would be a standalone device that wouldn't need a computer or anything like that. And we really see this as the future of microscopy in a lot of ways. We can do everything that we were talking about before on this device. We could control our motors. We could do everything we want there. We could run our CV based image stitching programs and we use TensorFlow and AI. And a lot of people are getting at us right now because they have been developing AI and they've been looking for platforms to run it on that are so cheap that they can be deployed into the developing world. And on the conclusion that's what I'm going to say. Like it's all going to be good. We're all going to be RA because we're working on solving this problem. Thanks very much for your time today.


Innovation Day, brought to you by Comcast. Hey, welcome back everybody. Jeff Frick here with theCUBE. We're at the Comcast Silicon Valley Innovation Center here in Sunnyvale. It's a very cool space. I think it's grown up over a number of years as it originally I think was some acquired companies and now they got a huge setup here. And we had a big day today talking about customer experience. And really, if you look at the Comcast voice remote and there's a lot of stuff going on that's maybe under the coverage. You don't really give Comcast credit for it but they're actually doing a lot. And we're excited to kind of dive into it a little bit deeper with our next guest. She's Annie Weckesser. She's the CMO of Unifor. Annie, welcome. Yeah, thank you for having me here today. Absolutely. So what is Unifor for people that aren't familiar with the company? So Unifor is a global leader in conversational service automation. And our vision is to bridge the gap between human and machine through voice, AI and automation. It's a mouthful. Yes. Conversational. Service. Service. Yes. So people talking. You guys are heavily involved in voice. So what are the applications where people are using your voice? Yep. Well, primarily our focus is call centers. So large enterprises who have massive call centers where we want to go in and help them with AI and automation to help better listen to their customers, help better listen to the customer's voice and solve the problems in a faster manner. So I don't have to repeat my account number of six different times to six different agents. Right. You've gotten an IVR cycle or perhaps the chat that you were talking to doesn't, the person on the phone who picks it up, you have to repeat your story. This is something where the AI and automation will actually assist the agent to become a superhero. So it's pretty interesting because there's a lot of conversation about AI and ML but really where it's going to have its impact is applied AI. And you said the company started out really more just on a pure voice but now you're applying more and more kind of AI in the back end. What kind of opportunities do you have now beyond just simply being able to do voice conversion? Yep. Well to the first part of your question, the company started at IAT Madras back in 2008 and originally the focus of the company was really centered on voice. Voice being the lowest common denominator in India where the languages are 260 potential languages to understand and maybe 25 at the top. We set out really to focus on voice and then realized that customer service was a large market and somewhere we could have a big impact. Right, right. So you recognize you said 100 different languages? 100 different languages through our platform which is pretty incredible when you think about it. All of the different people calling in to customer service potentially or maybe through a chat bot or a voice bot to get their issue solved. And then you integrate in with whatever the core system is that the customer service agents are using. Yes. So what are the types of tips and tricks that the call center agent gets by using your guy's service? Yeah. So think about it as a platform where the customer can help their agents be more effective agents. So one of the things that call centers struggle with is something called after call work where agents may spend two to three minutes after a call summarizing the call. One of the things that our technology does and this is primarily for one of our customers who's a healthcare client, they said would it be great if we could automate that completely? So we've taken the after call work for one customer or client taken that two to three minutes down to 10 seconds where that work that the agent would have done is completely summarized and the agent validates it can correct it if needed and it's completely done. So that not only saves the agent time to either pick up more of calls and help other customers or it can get them off the phone in a quicker manner to save the call center more money. So that's doing more than just simply providing a transcript of the call which is something a different track than actually listening in to provide suggestions. It's actually taking it to the next level in terms of what category is categorizing, what type of call, the outcomes, et cetera. It's actually quite interesting because oftentimes less than 1% of calls are listened to somewhere between one and 10% of calls are listened to in call center. So we can listen to 100% of those calls. In addition, we offer something called that's more along the lines of like a live agent coach to where the agent can concentrate on the conversation with the customer which is the primary thing listening to the customer and our technology will serve you up coaching mechanisms in terms of getting to faster resolution for the customer and getting them better insights to be almost a superhero of an agent. Right, and I would imagine the accuracy in terms of recording what happened in the call to go back in and do the analytics and have a text-based search so you can do all types of analysis on those calls which was data that was probably just lost before right into the ether. You're exactly right. I think the accuracy is clearly a lot lower than if you were to have the AI and automation and machine learning technology there. So the other conversation in the sit down that we had earlier today was really about driving a customer-centric culture in your own company. Not only just enabling it, but really building it inside. I wonder if you could share some of the things that you guys have done to help make sure that everybody stays focused on the objective which is the customer. Yep, I think it really starts at the top, right? It starts with the leader of the organization. So we have a CEO who's extremely focused on customer centricity and in fact, it's our number one core value within the organization. So you see everyone from the CEO down to the rest of the organization completely focused on the customer and their needs. What about when the customer doesn't know what they need? What about when you're bringing a new technology and you're inviting a slightly different process or a slightly different change and you're saying, hey, this is actually a better way to keep texting transactions and we actually have a really cool coach that can help kind of guide the people. How do you help move customers to a place that they don't necessarily know they want to go? Yeah, I mean, you find that a lot, right? It's not necessarily the technology that we're providing for today, but it's having the innovation and having the foresight to create a platform that will be future-proof. So that's critical. I think that there are a lot of customers who might not know what they need today, but that's our job to help them innovate and push the envelope on all things AI and automation. Right. I'm just curious too, in terms of the impact of your technology on kind of the tracking software for those call center agents, right? So this is a group of people that have to process a lot of calls. Everything is tracked to the minute and it's funny they had a demo with Westworld and Westworld's funny because we started treating machines like, or treating machines like machines and they wanted to be treated like people. And sometimes I wonder on some of these technologies, is it enabling them to have more time to be more thoughtful? Is it enabling them to have more time to get to better outcomes or is it sometimes perceived as, oh my gosh, you're just trying to jam four more calls in my hour by taking care of my two minutes that I used to spend wrapping up the call. Do you think about those things in the end customer? The time is really the premium, right? So the number one focus is giving people time back and whether that's the customer who's calling in and you want to solve an issue and get them faster resolution or whether that's the agent that wants to free up more time in having the conversation with the customer, solving their problem and then getting off the phone. I think that's the most effective way of doing it. Just final question in terms of voice and the evolution of voice because I don't think people are really completely tuned in. Certainly not people old like we are. What are some of the conversations when people finally get kind of the enabler that voice communications opens up that's not necessarily available with text or not necessarily available with other types of channels? Yeah, I mean, I see it most easily in my children. They expect everything to be voice enabled and so everything from the Comcast remote that they pick up in our living room, they everywhere we go where they see a remote they expect everything to be voice enabled. So I mean, that's really the future and I think a lot of customer service will be listening to your customer's voice, however they want to communicate with you, whatever channel they want to communicate on. Right, really cool story, Annie and thanks for taking a few minutes and sharing it with us. Yeah, thanks for inviting me. All right, she's Annie. I'm Jeff, you're watching theCUBE with the Comcast CX Experience Innovation Day here at the Silicon Valley Innovation Center. Thanks for watching, we'll see you next time.


What's wrong with me? Like why am I so lost if I can help all these people? Why can't I help myself? Why am I still depressed? Why am I all these things? I look at my channel and I'm like, oh the more I'm helping people, the worse I'm getting. Yes. Yes. Yes. Yes. There's so much that we can all take from that clip from the new Shane Dawson video, the dark side of Jake Paul. What is up everybody? This is Chris from the Rewired Soul where we talk about the problem, but focus on the solution.  And if you're somebody who is also a fixer, then you're definitely going to want to subscribe and ring that notification bell. So I just finished recording another video about the dark side of Jake Paul. But when this ending happened, I'm like, I got to record another video. All right. So there's going to be some spoilers. Okay, but Shane Dawson sits down with Katie Morton. Katie Morton is a licensed marriage and family therapist here on YouTube. She's awesome. I check out her channel a lot to get a little bit more information on different disorders that I talk about here on my channel. And I'm trying to collaborate with Katie Morton. So if you want to tweet at her, help a brother out. I would love to collaborate with Katie. But anyways, towards the end, he starts realizing that he is somebody who's trying to fix people. Like I'll say this, when I was watching most of this video, like most people, so my last video was about like, don't run around trying to diagnose people or diagnose itself as a sociopath. But as she was talking, and like Shane did show some Tana clips, I was like, Oh my God, like this sounds like a Tana clip, right? But like what you just saw right there between Shane and Katie is how therapy helps. It helps you realize things that you maybe didn't realize like Shane is very empathic, right? He feels for other people, he feels bad for other people. When people see somebody as a villain, Shane can empathize with them. Like empathy is a freaking amazing trait. And I wish I wish more people had empathy and just cared about everyone else. But there's a point where it goes overboard and we become codependent maybe or we get into bad relationships. But like Shane realizes is that when he's trying to help others is hurting himself. So I can definitely relate to what Shane was talking about as a child. So like his mom, she was going through some different struggles, but my mom was an alcoholic and drug addict. Okay. Actually, not not so much a drug addict, mainly alcohol. So I don't know why I said that anyways. So like my my life as a kid was so so hectic. And my mom's actually clean and sober now she's about to celebrate 13 years sober. I'm also sober six years. But as a child, like seeing her like my mom was two different ways when she got drug homicidal or suicidal. Like I remember my mom threatening suicide and everything like that. And when it's when it's your mom, like it's such a difficult spot for any child of an alcoholic or an addict, you know exactly what I'm talking about. Like I loved her and I cared about her, but I hated her at the same time. But I wanted to help her. I wanted to fix her. And then I would look at myself like why can't I fix her? You know what I mean? So as I got older, and my mom and I had this rocky relationship, I started getting into relationships with people in my life who were like my mom. Okay. And this could be friends. This could be girlfriends. Okay, because that was our comfort zone. Like what we learn as a child carries on into our adulthood. So what Shane talks about with Katie for even that brief, little bit, he taught they talk about how he's been doing this since he was a kid. He wants to run around just saving people and fixing people. I think that is like, when I was a kid, you know, my mom was going through a lot. And I felt like I had to be strong because she was like having trouble. So it was always like, Oh, Shane's my rock. He's my support system. Oh, he's always strong. Now it's very interesting that he tried to save and fix the worst of the worst. You know what I mean? And that's subjective. Some people love Tana. Some people love Jake Paul and all that kind of stuff. But Shane is drawn to those people. He has this amazing ability to look past all of the bad and find the good in people. But something that Shane's realizing as he started to learn more about sociopaths and stuff like that is that he might be getting manipulated. He might be getting manipulated by these people. And now he needs to sit down and reflect. He has to reflect.  Therapy is a great option, a great, great, great option to start looking at this stuff or watching these videos. Like I make so many videos about YouTubers and things like that to try to get you to relate to it and say, Oh, am I doing that? Okay, because we watch YouTube and other media platforms in such a passive way. Like we got to look and say, Okay, how can I relate to this? How, how can I get help? What, what relationships in my life are doing this? So I think that a lot of people watching this, not only are they going to start looking for sociopaths in their life, but I really hope that you guys are starting to see what Shane does. And I'm glad Shane talked about therapy. Now, the second half of this video, I'm going to talk about how I really hope this happens. And like, so he says, like jokingly, like, you know, we need to do a series about me fixing myself, go to therapy myself. Instead of trying to give therapy to YouTubers, like I've been doing. There is hope. Yeah, I might have to do a series just about you fixing me. Maybe that isn't serious. Geez. Some like an actual therapist fixing me because like, yeah, that, that, wow, that'll be 500. Like, absolutely. I would love that. And I think that would be his best series overall, like I do my channel and I am so grateful and fortunate for every single subscriber. But I the only reason I care about subscriber numbers is because I want to get a message out there so I can help as many people as possible. And if Shane Dawson, if Shane Dawson did a series about him working through the therapeutic process with a therapist, oh my God, like I can only imagine how many other people would seek out therapy, seek out help, find support groups and things like that. Like it would inspire so, so, so many people. Like it would just be like because I'm all about mental health and trying to help people. Like that would just be the best series to me. Now here's the thing though. I've been watching Shane for a while. I've watched each one of his docu series. And whenever he does a documentary series, he like kind of like talks about this, right? In some way, shape or form. So like, for example, when he was doing the series with Jeff, Jeffrey Starr, he talked about, he's like, you know what, I should make a makeup line, you know, and we should document the entire thing. Now, I don't know if he's going to do it, but like, when they just throw things out there. So I really hope, I really, really hope that Shane does this. But not only that, but like Shane is such an amazing person. And here's the thing that I try to teach the clients I work with. I had to learn this myself is it's the old airplane analogy. Okay. You got to put your oxygen mask on before you can help anybody else. So something I mentioned in a different Jake Paul and Shane Dawson video was like, is Shane enabling people? Like, is Shane enabling people's behaviors? Like, whether Shane likes it or not, he's giving exposure to these people, right? And if Shane's being manipulated, then they're just trying to meet their needs. You know what I mean? And in turn, Shane's suffering from this. And so he's going around. He's constantly trying to help people. He's trying to constantly trying to fix people constantly trying to fix situations. Like, for example, with TanaCon, a lot of people notice and talked about how like, why Tana was out like partying the night of TanaCon, like Shane was like on Twitter, trying to answer questions. He was trying to he was meeting up with fans. He was meeting up with fans who were stuck outside and stuff like that. So like Shane's mental health is deteriorating because he keeps trying to clean up other people's messes. You know what I mean? So I hope to see in the rest of this journey, like, I don't care about Jake Paul. I don't care. But Shane is such a good guy. And if he can learn to put his oxygen mask on by working through some of his issues, like he's going to be able to help so, so many more people. Like you guys think Shane helps people now, if he can improve his mental health, face the things that he faced in childhood and process them and work through them with a licensed professional, he is going to be such an amazing man. Like right now, like, I know a lot of people think he's at a 10. If Shane goes through this therapeutic process, you're going to realize Shane was actually like at a seven and now he's at a 10 once he goes through that process. So I really, really hope that he meets up with Katie Morton and I hope it inspires other people. And if all this talk about therapy, if you're interested in therapy, like, listen, my channel is supported by BetterHelp Online Therapy. There's a link down in the description below. But literally, like, do any type of therapy, if you have insurance and want to go to someone in your area, cool. But with BetterHelp, it's all online. They have a sliding scale. So if you don't make that much, it doesn't cost that much. And basically the way it works is you fill out this entire questionnaire Shane talked about in his video and they match you up with a licensed therapist. So if you struggle with depression and anxiety or PTSD, or borderline personality disorder, or sociopath or narcissistic, you know, tendencies or anything like that, like they will match you up with somebody. If you're LGBTQ, if you are an addict in recovery and things like that, like give BetterHelp a try. Like just go in, fill out the questionnaire. What they do is they match you up with a licensed therapist. I've had some people tell me like they're, you know, they see BetterHelp popping up on all these YouTube channels and stuff like that. And they're kind of like reluctant to trying BetterHelp. But as a mental health advocate, I would never support something that I didn't believe in. My girlfriend uses BetterHelp online therapy and like she was already amazing, but just seeing her growth and changes and tools that she has now, just working with a therapist from BetterHelp for just a few months. Like it is amazing. She like texts with a therapist. They have calls, they have video calls. Her therapist is actually based here in Las Vegas. So they've met up a few times. So like seeing that right there, like I absolutely 1000% vouch for BetterHelp. So if you're interested in trying out BetterHelp, make sure you use the link down in the description below. It helps support the channel, helps me continue to make these amazing videos for you. All right.  Okay. But anyways, I want to hear from all of you down in the comments below. Can you relate to Shane Dawson about how he tries to help people, maybe even bad people and how it kind of messes up his mental health? If you're going to relate to that, let's have a conversation down below and try to support each other. Okay. But that's all I got for you with this video. If you liked this video, please give it a thumbs up. Again, if you are new, I'm always making videos to help you out with your mental and emotional wellbeing. Make sure you subscribe and ring that notification bell and a huge thank you to everybody supporting the channel over on Patreon. And if you want to check out the Rewired Soul Merch Shop, click or tap on that icon right there. All right. Thanks so much for watching. Fix yourself before you fix others and I'll see you next time.


Hello, this is Laptop Media, and today, we will show you how to open the Acer Predator Triton 32020 and what's inside of it. 11 Philips head screws are keeping you away from the internals of the new Predator Triton 300. After you undo them, just pry the bottom panel away with a plastic tool or a guitar pick. First, let's take a look at the cooling. It consists of 3 heat pipes, one of which is common for both the CPU and the GPU. However, despite the low amount of heat pipes, you can see a total of 4 heat sinks. This, combined with the huge fans and the pretty sizable metal plates placed over the VRMs and the video memory, should deliver a more than decent cooling capacity. In terms of storage, there are 3 M.2 slots. Not bad for a budget offering. As of the memory, the device supports up to 32GB of DDR4 RAM in dual channel. Very wise, there is a 58.75 watt hours unit, which isn't the largest one out there, but it's not too small, as well. If you'd like to see more disassembly videos of the latest notebooks we would highly appreciate if you hit the like button and subscribe to the channel.


go. Meaning Xavier talk a lot about cyber security. A whole lot. A whole lot. And we want to talk about some of the actionable the results of some of it. So as you know during today when we're not goofing off making YouTube videos and sharing how they got hack stories and all that fun stuff, he actually has his fingers on the keyboard well digging into and finding security vulnerabilities, assessing them, going through and auditing networks. And he's audited networks at a lot of big companies and we have to remain unnamed. But we have a treat for you. He has a report. And this is a report he made from one of those audits. Some names were changed protect the innocent. And honestly, this is what you want. You want an Xavier to break your applications, poke on your network, find out what you had at default passwords. Because there's one of those things where you go, Oh, I secured everything. Well, is it until you've audited until a third party, not the person that locked the door at it, someone came back and checked to make sure the lock was secure. That's a standard practice and well, maybe not so standard practice, but it should be standard practice. Yeah. And that's what he does. He goes through and assessment and we figured instead of talking about all the nuts and bolts, we'll talk a little bit about the tools he used to come up with assessment. But we want to show you the results and what an assessment looks like. And this can be very enlightening. And like I said, you really want someone like Xavier going through and doing it because trust me, this is the same thing. If someone gets in your network, they're going to do simulation. Yeah, they're simulating it on his side way better than them finding out and whoever them or they are, if they're in your network, they will do all these things. So he's this is why you kind of have to have a lot of real world kind of hacking experience, you kind of have to have that. No, I don't want to say foot in both worlds, but it's kind of running the edge. You have to understand how the hackers are doing it, what tools they're using. So we're using a lot of the same techniques, tools, to produce these reports.  They're going to start knocking things down and going through. But that's we're going to start and we're going to jump over here to the report and kind of walk you through what an assessment looks like in the end. And like I said, this is, this is all essentially we like so we changed names of application thing that so took a lot of editing to bring you this. But this is really what it looks like. This is not fake. So So this is an example of security penetration test for an HIE portal, HIE being health information exchange. So I would, you know, have my logo here enterprise offensive security, go check out enterprise offensive security.com if you want to actually download the sample report. And we would have your logo and who was prepared for the date in which it's prepared and who it's presented to. One thing you'll notice is it has a version number. And the reason why has a version number is because we actually will work with you over a period of time to come up with a multitude of versions of this report so that it's the most effective for you. Of course, we always leave every engagement off with let or the report off with letting the reader know and the amount of confidentiality that should be taken to account for this document. So you need to follow a certain need to know basis protocol when it comes to sharing these reports. And then it comes with a number of disclaimers. And this is important. When we come in here, we're going to find flaws. There's always something that's going to be found when this audit's done. And that's why you have to find something you can trust. You have to go, Hey, these guys are going to disclose this to the wrong people. And I don't just mean hackers. You're when you deal with some of the larger companies that we deal with. The concern is, are you going to share holders about this? Like they will be concerned or our venture capital. And this is why we have to understand all parties involved. And sometimes you get hired third party and sometimes even the investors may hire to do it. We have to figure out who the audience is, but these are real important is whoever hired us, that's who the confidentiality agreement is going to be with. And this is a important process in this. It's extremely important to get the confidentiality. We have to know. We have to know who we're working for and who gets this results and who can or cannot be told. And that's part of the pre engagement. Just letting you know that's a big piece of this. Yes, that's certainly. And then we'll get into the table of contents, right? And a part of the table of contents, you'll find the purpose, scope, summary of findings and a conclusion. And this is about as simple as it can get. So we lead off with the purpose. This, this is a fiction fictional ABC health company. ABC health company here. They've asked us enterprise office of security to go ahead and perform a detailed security examination. It's a custom implementation of a portal. We, we go ahead and let, let it be known at what time the actual testing took place. And then we get down into the scope where we talk about exactly which levels of access exist. What group membership should be associated with that access level. And then the actual application and the the URI for the application, and which we're doing a penetration test for. We'll put down important notes. If there's anything that we need to bring to the reader's attention, a lot of the time, you have to understand that as a tester, you're not the person that's actually going to go present the results most of the time, unless you're like me and you do a little bit of both, right, where you're in front of the client and you're behind the keyboard. The majority of the time your testers won't actually go see the client. So in the event that the tester wants to be able to get a complete thought through before or sort of a disclaimer that that's basically what we would do. And then we get directly into the summary of findings, right? We don't BS around. The idea is this is your only opportunity to be able to communicate effectively for your team exactly what it is that they need to be doing. So we we break out the summary of findings based on the risk rating, right? So this table down here is something that we will put together with our testing categories and the three levels of severity. Sometimes it could be up to five levels, but for simplicity sake, we like to use three. And you know, just a testing a bit of our categories for testing. One thing you'll notice is this is a web application pen test. So our network penetration test will be a little bit different. Our Wi-Fi penetration test will be a little bit different. These are things that we offer, but this is the the manner in which we communicate those deficiencies in your environment. So as you can see here, we have a couple of highs, a couple of mediums, and a low. Yeah, and bypassing client validation obviously is really big. And just to roll back a little bit, this is a engagement there. All the teams are involved and everybody knows this is not like a blind red team test where someone at the very highest level hired us covertly to go in. This is one of those. We get a lot of information. That's how we know levels of access. We don't have to try to fish it completely from the outside. So you're starting with the law, but that's that's type of test. That's the results of that. And this is the first one you want to do. Later after you've closed all these is when you want that blind red team test. Precisely. And I think it's super important to talk about compliance and the compliance regimes that be to keep compliance. You often will need to do one or one or two things of vulnerability assessment and a penetration test. What I'm displaying to you today is an actual penetration test. So we use manual techniques and procedures to actually go and execute out on these exploits and these vulnerabilities, whereas like a vulnerability scan would be more going to your network from the outside and or inside looking at all of the endpoints doing a fingerprint from the outside and actually seeing what services could be used and leverage for vulnerabilities as well as scanning your repositories and the libraries that you use for deficiencies and vulnerabilities and your packages that you're using. But the very first thing we found here was, you know, we went through website pilfering. And this is basically when we get into the meat of the report, we go through and we talk about the different type of attacks that we would do. And in this case, there was none found. Then we go over into, well, of course, we give a conclusion, which is basically letting us let letting the the this is our executive summary, so to speak. This is our too long, didn't read. What was the conclusion? Okay, they did full text searches and Carl's thoughts. Okay, cool, they didn't reveal anything. And this may be presented in two different levels. So we're going to talk to maybe an application development team, because they want to know the details. And then a management above them is going to go just look for the conclusions and summarize it. So this is going to be presented and pivoted in different ways, depending on the audience, that people at the top, they go, how bad is it? And the application people go, how do we fix it in detail? Precisely. And how do I actually replicate this inside of my own environment, so I can learn from it? Right. A lot of what we find is that developers will actually read these reports and start to learn how to think like a hacker. And that's that's literally ideal. That's what we want. So we went down and we did a little bit of file guessing attacks. We went through and did some modifying input choices parameter tapping, tampering, which is very, very fun to do and is prolific. The findings that you'll find often inside of web applications where you're tricking the application into thinking you're someone that you're not or by you know, changing a parameter to be able to move laterally throughout the application, elevate privileges, etc. And the tool we use for that is Burpsuite. Yeah. Burpsuite will really do some interesting things. It's so much in there. You can start just pushing so much and you can't what you're doing is you're getting in between and doing things that are completely unexpected to the application, sending it weird data, sending it things. And Burpsuite, there's plenty of videos you can find on it. We maybe we'll do a video on it one day and kind of show it in action as well. But but whatever we're just going to do is going to sit between the website and my browser and it kind of fits that little middle between more like send something random that was not expected to send. And that's what we're doing here really pushing the limit to see if the application will do that. And it's funny because you get pushed back from some devs. Well, I would never expect that input. Well, you didn't sanitize for it. And trust me, this someone who's wanted to poke at and find holes, they're doing this they're going to use this Burpsuite is pretty standard hacker tool. It's part of the Swiss Army kit for web application testing. Precisely. And then after we actually use that tool and we identify the issue, we go ahead and we'll use CVSS to map out the risk versus the complexity and explain that to our customer and then give them a summary of exactly what we did to do this test and how to actually retest for this particular use case, as well as any screenshots that will need to actually pass along. Yeah, because the goal of this is not to say how we broke your app at all. That's there's a misconception sometimes there's sometimes people will chip on a shoulder like that. Our goal is to go. This is how we do it. This is how we repeat the process. This is the string we sent to get this result.  So we go through the process to make sure it's repeatable. We do have to do that on beforehand and then the documentation is given to the app team because the goal is here's how you guys here's this parameters you use. Fix your code on the back end until that doesn't happen no more. It's it's the goal is all remediation here. Exactly. And so we also give our recommended resolution, which is always one of our favorite parts for us to be able to get in and put the put the blue team had on and think about how would we defend against this. What's the proper way that this functionality should be executed out or implemented in.  So a constant is always you know if we do find something we try and do a resolution and we always try and have a conclusion. So we went ahead and did a test for bypassing client side validation and we're able to find another issue for data birth validation for a patient patient patient search patient search. I'm a math guy not English guy. I love to read though. So yeah, I would love to read your code. Please let me know if you would like me to do a code review for you. Yeah. So yeah, we go ahead and now you'll start to see the pattern of our risk versus complexity. And you know your risk appetite in certain environments, maybe at different levels. And that's the reason why we break this down to a high medium low risk type of ways so that you're able to say, hey, this is a low. I'm not really looking at this right now as far as the risk or you're looking at complexity and going, hey, this is, you know, in this case, it's a risk high complexity low, which means you don't even need to, you know, be authenticated. You just need to be the man in the middle, right, which is, you know, often outside of the control of the operator of the web app. And that's something we're looking for is that in between because you started with an encrypted session, but is there a way to drop it back? That's one of the tests. It's one of those simply overlooked things we can figure web servers leaving for compatibility reasons, old ciphers in there and doing downgrade attacks as one of the tests. And sometimes you find that we, oh yeah, we authenticated what we realized we can get your users stuff because we can downgrade it after it's authenticated and get to the bypass. Precisely. Um, so yeah, this complimenting screenshots, um, examples excuse me, I moved a little bit too fast complimenting screenshots and examples, um, moving down to more screenshots and examples, more details and our recommended resolution. And again, you'll start to see the pattern. These are the ways that we do it, right? So we'll go through. We have a long list of checklists. When you work with us, um, we actually will have a base template in which we do these, uh, these penetration tests with. And then we work with you to find exactly what are your most important parts of your business. And then we tailor our attack and our and our tools and techniques around trying to be able to get to those, uh, those assets. Yeah, important assets that you hopefully are protected on that. Right. Um, also, like, uh, you know, there's often a time in which architecture has to find certain things for a reason, um, such as character limits. And this was something that we found here, even though it's a low risk level. Um, but there's a low complexity. So this allows for a potential attacker to come through and do a denial of service and consume all of your resources. Um, so we go ahead and do a summary details and recommend your resolution. Yeah, this is another side of it. Um, it says even though they may not get in denial of service, especially if you're some type of public facing, uh, portal that you know, you're either retail or B2B, people being able to shut down your portal by just filling up one form with some data and hitting send a couple times. That that's still bad. Yeah, it's bad. It's another aspect. I mean, competitors could be doing that now. Oh, they found this weakness. Um, you may be doing running some advertisement. They could be super both Sunday and now they've taken down your entire, you know, onboarding and, you know, you could have potential customers but you're going under the knowledge service and it's not biometric and it's application flow and you don't have a way to mitigate that immediately. And there's definitely some competitiveness in the market. Uh, precisely, spend a few minutes reading. I know they've improved but like uber, you know, they did certainly exploit anything they could find and lift to slow their system down. So yeah, that happens. It's a when it's competitive markets, but you want to do that testing before your Super Bowl Sunday. Exactly. And so one of the things that I love most about testing is sometimes you're running the things that just were done right. Um, and that's like my favorite. Yeah, especially on a retest. If I come through and I hit a few things and I retest you and you don't have any of that, I'm always excited. But even when I go the first time at any time, I can say, Hey, there was no way for us to be able to leverage hidden hidden fields. Right. That's always fun. Um, cookie abuse. This is really, really big. Yeah. Uh, you know, just being on a network network with someone and being able to be the man in the middle and grab those cookies that are flying over the wire. If you are invalidating, if you're using them for sessions, um, this basically can allow for an attacker to take over the identity of or the session of another user that has a legitimate credential and that credential could be a DevOps credential or a senior engineer credential, something that's overpowered that allows them to be able to, you know, give themselves unlimited of further unlimited powers. So, uh, cookie abuse is really, really big. One of the things I like to tell people to do is set the secure flags on their cookies. Um, and that's basically what you'll, you'll see right here. Yeah. It's, it's those little things, but a lot of times developers cause they're focusing on front end experience, uh, user flow and they may go, I'm just going to use this framework. Well, if they leave the default or they're not asking me with that framework, the default may not have secure flag and cookies. And that's all these little mistakes you're made. And that's why you need a third party because they're going, well, the default should have secure. Right. That's why you need these tests to make sure that's right. And another thing is, is even, uh, even, you know, sometimes if you handle cookies properly, there can still be session hijacking due to not enough entropy in the way that you actually issue those cookies so they could be guessed. Um, so this is one of those tests that we run using Burp and, uh, you know, we're often able to find, uh, ways for us to just generate the cookie that will allow us to not enough digits in you. And the, how that happens is you go, well, you know, we're B to B, we're a healthcare, uh, we'll never have more than, like, uh, 200 clients on this. Well, cool. So you think you, a thousand would be enough entropy. You know what I mean? Something goes small like that because they're not thinking like scalability, but that, of course, opens up to this type of attack. They're like, oh yeah, adding a couple of zeros, even though we're not going to be that. And luckily, this client actually stood up against this, this attack. So that's, that's always good. They passed it. They passed this one. So, even though sometimes you may see a lot of charts, big pictures, that could just be our way of proving to you and showing to you the effectiveness of our testing and giving you that validation of your hardening, even if you did pass. And we're happy when the conclusion is, you passed. Great job. Pat on the back. That's, that's great too. It's good to know. So, URL jumping, they also passed. Cross-site scripting, they also passed. And of course, directory browsing, this is one of the easier ones that people get, right? The proper HT access, proper file permission. They do now. It's, it's not as preliminary as it used to be. It was so much fun for so many years. I misspent youth. There you go. Reading files on directories that were not meant to be read. Like configuration files, right? A lot of web applications will have a config.php, a config.aspxn, will be, you know, or a war or a jar that sits on the route that's actually run by Toncat. And sometimes you're able to get your hands on those credentials or those packages and start to learn how to move further in the environment or get access to things that you otherwise wouldn't have had access. So directory browsing is always fun. Yeah. And sometimes people think because they hid the directory that there's like, oh, we hid it. But one of the examples is going to be WordPress. There's a couple of different WordPress backup plugins that create a common file naming structure. Now, even if you block access to it, if you know the URL, I was actually kind of surprised at some of these. I think that one is gone. It was one of the backup ones. But because they had a common naming structure, you could just guess if a company was using it and grab their WordPress backup and then have their passwords. There you go. So there's definitely things like that. And sometimes developers are busy or under the gun. They're pressured. And they go, I'm just going to back it up over here. It didn't work unless I put 777 on it. Right. Yeah. So those are those things we want to be tested for and some of the file guessing do it. So it's all a valid test even though it's not. It doesn't happen as often, well, at least with the application. Well, I mean, now it's all about open S3 buckets. Oh, yeah. It's basically they've moved the ball over to S3.  That's a whole different game. That's a different topic. That's another. That's cloud security from enterprise offensive security. Yeah. We'll do another report on that one. So a SQL injection is another fun one. This could lead to people being on a misuse of authentication. So being able to elevate privileges from unauthenticated to authenticated as well as dumping of files to actually dumping of database to actually get records for of your patients of your customers for competitive advantages for just defamation for anything. So SQL injection is always a big one that we test for. We test for multiple ways using the multitude of tools including SQL map and our favorite burp. This this client tested clean for it, which is which is always good. But they didn't test clean for some logical design issues. And this is what we were talking more about earlier with that code review. Sometimes if a client will give us access to their code before even testing it, we'll be able to see ways in which our entry and exit will be available. Right. And so one way one way that their logical design was incorrect was they didn't allow for a password. They didn't force passwords to be set when setting an email. Yeah, right. So you're basically allowing someone to be able to potentially take over a legitimate user's account because they're not validating the password that's associated with that account when they actually change the account. Right. So I'm already logged in and then I go to go change my account to your password. I mean to your email using no password at all. And now all of a sudden I become your user. You have to test for those types. It's part of the breaking it in unexpected ways. That's what we're going to do is, you know, the developers really focus on, all right, this is the way the user flows through. They're thinking about that. We're thinking of a way we can reverse it and, you know, swap an email and pull something over. And it's one of those little things we are trying to break that flow that the people created because this is that thinking like a hacker. Exactly. And so we give our recommended resolution and we give our conclusion, right. And then we talk about system and software vulnerabilities. This goes back to like that vulnerability scan topic. That kind of is inherently done during the penetration test because it's a part of our information and data that we gather for further exploitation. So anything that we run across any systems or softwares that are vulnerable, old, knee-patching, we always bring those up. In this case, it was a Yahoo library, YUI, which, yeah. That goes to show how old this test is. Yeah. It's been a while. So we also talk about secure attributes not being set on cookies. That's what I talked about earlier, passing the secure flag. And then we will wrap it up with the conclusion where we'll remind you exactly of the risk rating and the page reference where you can find the six issues that we have found. And we'll do a whole entire conclusion and let you know exactly what we found, what you guys did good, what you guys did bad, what we expect to see moving forward. And usually, we'll sit down with a CISO or development team sometimes. And we'll just have a couple of coffees, bring some snacks, work through everything, find where this stuff is happening in the co-base, or think about when this mistake was made, plan it out, and then set time for a retest. Once we retest, hopefully this stuff isn't present again and they get the bill of clean health. And in the event that we're there for a compliance reason, such as FedRAMP or HIPAA or PCI-DSS compliance, we'll see you in a year. And hopefully you're still clean. Yeah, and this is why the versions are important. You know, the first thing we're going to do is hit the same things again. Did you fix them? You can say you fixed them, but we're going to run and test them.  Were they implemented? And this is usually, you're not the one hiring us if you're the developer. It's the C-levels that are hiring, but this is one of those things. And there's auditors, and compliance, or investors again that want to know, all right, this is the short summary of version one. How does version 1.1 look? Version 1.2, version 2.0, what app changes are made, and the assessment starts over. But this is an important aspect of it. And like I said, this is for an application testing that was for a medical client. A little bit older report, but you know, we're tight. Very, very relevant. Yeah, we're tight to the vest of, trust me, we do not, confidentiality is of the utmost. That's one of those things. Very important. When I do these, even when I do some of the implementation or IT assessments that we do, I can't talk about the clients. They're, it's just, I would not have those, some of those gigs if I talked. Right. And I mean, I'm doing pen test literally every single day. And it was even hard to find a report that I could even anonymize. So, Because they just become a blur. We take your privacy extremely seriously. Me and Tom have been working on this report for like four days. So, Just redact, redact, redact it all, right? Just to make sure that we didn't get ourselves any trouble. So this report, the sample report is actually up for download right now. If you go to enterprise, offensivesecurity.com We'll leave a link down below where you can get this and check out the services and things like that that Xavier offers. But this is, this is where all this knowledge we have. This is how we understand when we do these, how they got hacked videos and we like talking about it. We want to raise awareness for it. You know, that's a big piece of this is you can do a lot of yourself or use in birth suite. You can do some of this testing. And matter of fact, do that before you ever call for an audit. That's how you'll get past cleaning. You know, you'll scream through this article. Now this was a lot easier because you tested with Burp Seat. You tested with that. And there's some great YouTube channels out there. And I can leave a couple of links out there that show you how to use some of these tools. And there's been some questions about YouTube, whether or not they want us doing those videos about those tools. I mean, but I'll say there's a good in-map scan. Enumerate the network, figure out what's on it. Just knowing what's on the network is a really, really good start.  These things are open vast, they're extremely valuable before you ever even pick up the phone to give us a call. And we actually have a white paper that we're working on right now that actually goes into the differences between a vulnerability assessment and a penetration test because they are different. So you do have opportunities to do vulnerability assessments in a much lightweight and easier fashion than going through a full penetration test. And again, that penetration test is on the way to a full red team engagement. And the best part, if you're a new company starting out, start there. New company starting out, you don't have money to pay for not it. But if you start thinking about these things ahead of time and start testing this, and you have Kali Linux, you've got Parrot OS, I'm partial to the Parrot one because I think it comes a little bit more completely set up. He likes it as well. Open vast is in there. You can, this is no charge free. You can go download that software, start poking away at it. And then when you start building your app, you've started from the ground up. A lot of times when we're doing assessments or companies that didn't start from the ground up, they started running with an idea, maybe some investment money, and then they call us. Whichever way you're starting, that's the important part is start thinking more secure. These applications that are going to be public facing, you have to get that mentality out there. And that's a lot of what we're preaching here is. And this is trust, and this is your customers, and this is your digital relationship with your customers. And it's super important to keep your reputation, your digital reputation secure. You don't want to be in an episode of how they got hacked. Maybe as a guest, but certainly not as a victim. Not as a victim, not as a victim. So like I said, we'll leave a link to the security and all the stuff that we do and where to get a hold of Xavier and how you go through the process. And of course, the assessment will be on there. I'll leave it in the description below. And thanks. Thank you. All right. Peace. Thanks for watching. If you liked this video, give it a thumbs up. If you want to subscribe to this channel to see more content, hit that subscribe button and the bell icon and maybe YouTube will send you a notice when we post. If you want to hire us for a project that you've seen or discussed in this video, head over to LawrenceSystems.com where we offer both business IT services and consulting services and are excited to help you with whatever project you want to throw at us. Also, if you want to carry on the discussion further, head over to forums.lauranceystems.com where we can keep the conversation going. And if you want to help the channel out in other ways, we offer affiliate links below which offer discounts for you and a small cut for us that does help fund this channel. And once again, thanks again for watching this video and see you next time.


And an oil expert has called on the federal government, security agencies and other regulatory authorities to investigate oil sector and clamp down on all filling stations across the country, selling above the approved pump price. The persistent scarcity of petrol and increase in pump price is already taking its toll on the citizens. For weeks, motorways in Canada's data have been having a hectic time at fuel stations. They spend several hours on the queue to buy the product at 300 to 350 Naira per litre, while black marketers sell at 400 Naira to 500 Naira. And this oil expert and elder statesman engineer Mohamed Kailani blames saboteurs for what he calls an artificial fuel scarcity. He calls for a probe into the oil sector. NNPC has been importing fuel and PMS. And when they give it to the private depots, they sell it. Government has not increased PMS up to today. They give them at 148 Naira per litre. But what they do is say, the depots sell it at 260 something to the independent marketers. Then when they bring it to the station, they will be selling it at exorbitant prices. We are not helping us. We are calling on the security agents that are monitoring DPR. DPR must have to wake up. So we in Nigeria also must have to help ourselves. When you see a filling station selling, tell the authorities and you make sure you close that station. Don't burn it, but make sure you say the government has not increased the price. He laments the irregularities in the downstream sector while calling for immediate arrest and prosecution of oil thieves across the country. Tambolo came in yesterday, it was on the papers, that we don't know whether it is true that EFCC are shielding those thieves again. If that is true, I think the government should look into it to make sure that because we are operating a mono economy, we are dependent on oil. The agriculture which is supposed to be the mainstay is lagging behind, lagging behind. So we hope the government will do something as soon as possible to make sure that those that are involved shielding oil thieves should be brought to book. Hello, hope you enjoyed the news. Please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.


The 1964-65 World's Fair was a unique event in American history. It represented the promise of tomorrow to millions of people. The promise in technology, the promise in cutting-edge art and design, and the promise in terms of what America could provide to the world. Its official slogan was peace through understanding. The only problem was that there were people who were left out and there were issues that were left out that belied that image of peace through understanding. You can't understand what happened at the New York City World's Fair unless you understand the immediate backstory, which was that New York City, which seemed peaceful and prosperous, actually was riven with conflict. And it was mostly a conflict between the white majority and the African American and Puerto Rican minority. One of the main targets of protest was a man named Robert Moses. And he was one of the most powerful people in New York City and New York State at the time. He was the leader of urban development in the city and also what was called urban renewal, which was a policy that replaced deteriorating housing with good housing or with cultural institutions. And the problem was that a lot of the so-called bad housing that was replaced was the housing of working class people and particularly of non-white people. Robert Moses was also thought to be a racist, and that was because all the projects that he supported were created by virtually all white labor forces. In 1959, Robert Moses became the president of the World's Fair Corporation, so he was the top leader. In some ways, people saw what Robert Moses was doing at the World's Fair as just like the other projects that he had sponsored. They saw it just as a billion-dollar boondoggle, a huge public works project that was again going to hire only white people and was going to leave blacks and Latinos out of the picture. Robert Moses made things even worse by not listening when people asked him again and again to have some kind of a pavilion or an exhibit at the fair devoted to African American history and achievements. He was the dean or the captain of a huge project devoted to peace through understanding, and yet he wasn't willing to acknowledge the world-changing effect of the black civil rights movement. And that was a standing affront to millions of people, black, white, and Latino. People wanted to do something in response, especially some of the younger activists, so certain chapters of the Civil Rights Group core, the Congress of Racial Equality, decided that they were going to do a major action, what they called a stall-in instead of a sit-in, and they were going to stop cars on highways on the way to the fair and keep traffic from going to the fair on its opening day. The stall-in idea kind of fizzled out. It was controversial even among civil rights activists. The young activists were criticized, but many, many people decided instead that they would have a demonstration on the grounds of the fair on that same day, the opening day of the fair. So we see senior members of the civil rights movement like James Farmer, who was the president of core, coming to the fair protesting and being arrested, and there were 750 other people who protested at the fair that day. This was a major disruption of the opening day of the fair. There were opening ceremonies with dignitaries from around the country and around the world, even the president of the United States was there, and the activists shouted down President Johnson, saying, Jim Crow must go because they said that President Johnson wasn't doing enough to pass a national civil rights bill. And they protested at all the pavilions, protesting the southern states that still had segregation laws on the books, protesting northern states like New York, that they said also practiced segregation, protesting private employers, that they said didn't hire black people. They were everywhere. Robert Moses was furious, and he was prepared. He had already hired about a thousand private detectives and in essence his own private army to deal with any potential disruptions, and he had people summarily arrested by these private actors and dragged off the fair grounds and held in pens, the New York Times called pens, on the edges of the fair grounds. In some ways things at the fair returned to normal after this huge opening day protest, but it was never the same. People in New York didn't forget. There were smaller protests throughout the life of that fair. There was a major riot in New York City that summer, inspired in part by those protests, and the fair itself wound up being a colossal failure in financial terms and in terms of people's reactions and attitudes to it, and I think the protest had everything to do with that. The fair and the protests of the fair are a forgotten historical moment, but I think we should remember them. And one reason is that they marked the beginning of the end for this great New York City planner, Robert Moses. They revealed his tactics and I think they revealed his partiality, his discriminatory side. But there were other reasons why the fair was important too. It also led to the breakup of the Civil Rights Group core. The kind of bitterness that emerged between the activists who wanted to do a Stalin and B. militant and the ones who didn't want to do that and who pursued a different kind of strategy, those splits just get wider and wider in the course of the 1960s. And by about 1966, when some activists are declaring black power, they're really departing from the Civil Rights movement of the fathers, of people like James Farmer. The fair also shapes politics in New York City and even nationally. On a local level, it helps destroy the Democratic mayor who was in office at that time and leads the way to a whole new political configuration in New York City.  At a national level, these protests probably helped pass the Civil Rights Act because President Johnson did not like being shouted down and he did not like people saying that he wasn't fighting hard enough for that Civil Rights Act and this probably made a difference.


The Survivor Project is a collection of survivors' stories from the Kidney Cancer Association. Take some time to get to know these people. They can change your life.