Michelle, can you tell us where you're from? I was born in Korea, raised in California, lived in Hawaii, and now I'm here. So I was born and raised in a household where both very devoted Buddhist family was. My parents were both Buddhist. So I was raised going to the Buddhist temple, but my mom's side came to Christ with my aunt who shared. So I grew up going to Buddhist temple and Golden Church. And honestly, as a kid, the Buddhist temple had a retreat things like that too. But every night I would be so scared when we're sleeping in the Buddhist temple where the monk had to hold on to me till I'm falling asleep because I was just so terrified of the night, which is so funny because I wasn't scared of the dark. When I was eight years old, I was going to the Buddhist temple when I'd been to church and then I remember asking my grandmother, what's the difference between Jesus and Buddha? And this was my dad's side grandma who is a Buddhist. So she was like, oh, they're friends. So, you know, you're young. So you're like, okay, they're in the sky, kind of shaking hands together. From my belief from there, God really wanted to show me that he's one true living God. Because after that, a lot of things in my life happened that was out of my control. I did come to America and by that time my parents did divorce. But then the first household that my father who's devoted Buddhist entrusted me and my brother with was a third generational pastor's house. So from there, I was going to church like it's home or I was going there to learn English and have fun. It was fun. And from there on, I was going to church. It wasn't personal to me. It was just like religion. Fast forward to my high school year. I was very depressed. I was chasing after education, after money, after friends, after just wrong things of the world. I had this face mask on, right? Like, oh, like I'm all good, but I came home and I felt so empty.  What's the point of like living? And I just felt so empty. And I remember one day I was like, why am I living? So I was super depressed. For me, everything happened at school. One of my friend, she came back like very, just something was different about her. And then so after math class, I went up to her and I was like, what is wrong with you? And she was telling me like, Michelle, God is alive. I think because I kind of grew up in church, no one really asked me this question, but she asked me, are you Christian? And I said, I'm half Christian and half Buddhist. And she was like, there's no such a thing. And so she asked me, do you have five minutes after school? And I said, yeah, I mean, I have nothing to lose. And we went to the park and we're having a conversation. I just felt this warmth, that five minute conversation turned into like three hour conversation. And I was just like crying because I was broken. Like my family's broken. Like my parents got divorced and when they got divorced, my mom left our house. So I never like met my mom since when I was eight years old till all the way to high school. And then so she invited me to Friday night service. I went to church and similar to Hungry Jen, everyone just like on fire for the Lord. And I was like, okay, this is different. But I went because there was something. You know, maybe Jesus dying on the cross is real. I was like, maybe there is something more about his love. Like what is this love? From there on, I was just devoted to church. I was keep going. And I remember after work, I was sitting on the couch and I was like, is this it? Like going to church and then doing like, you know, homeless outreach and then like going to like reading the Bible. Is this it? Is this it? And that's when my leader called and she was like, Michelle, like, can you come to the retreat? And I said, oh, I have work.  And that was a retreat day. I was like, okay. So I called her back. I'm like, okay, I could go. And she's like, well, you're gonna help me in the room. So you need to come to like the prayer meeting and we're gonna fast. I wasn't fasting. I was starving because I didn't know what I was doing. I was just curious. I was like, this love that people are talking about I want to know because everyone at the end of it wants to love, right? We want to be loved. And then I went to the retreat and as soon as I got there I just felt, I felt on my knees and my life went in like a film. And he was saying, I was always there with you. Come on, let's give Jesus a clap offering. He is so real. He is so real. Got baptized with the Holy Spirit. Showed me a vision and I was wearing a wedding dress but it was very dirty and I felt shame and guilt. And all of a sudden he took the wedding dress off and he put a new one on. But it wasn't even white. I was wearing the light. And here's the crazy part. My name in Korean means light. Little did I know. Cause that, little did I know, little did I know. And 2017, 14 years later me and my mom met for the first time and my mom came to Christ in 2007. She got baptized with the Holy Spirit. She didn't know anything about the Bible. She was just like, she just heard Holy Spirit saying go to the seminar. So she went to seminar without knowing who Peter, Paul, nothing, she just went. And so when we met there was a spiritual connection and then she was always praying for me. And then she showed me a scrapbook of when I was young and it's so crazy because in one of the little sticky notes she saved was a prayer from my like a preschool teacher. And it said, let she be the light of the world. Who knew there was someone praying for me? Who knew there was a prayer invested in me? When I was depressed and I was angry, you know, and I got into fighting school. I got kicked out of the school, okay? I was chasing after education. But let me just tell you when Christ came into my life, everything shifted. He opened the doors, but now the intention motive was completely different. I went to UCLA. Let me tell you, if you are chasing after education, you guys, that's not the answer. I've been to the high known school of UCLA. There's kids who are depressed. There are suicidal thoughts. So it's not the answer. If you're chasing after career, it's not the answer. If you're chasing after relationship, it's not the answer. But Jesus is the answer. And his love is so real, the man, so real. His love is so real. Amen, amen. Never underestimate what one conversation can provoke in someone's life. Whenever you have that feeling or whenever the Holy Spirit's telling you, hey, initiate that conversation, do it. Because it can transform someone's life forever. So Michelle, what would be some advice that you would give to someone who was maybe in a similar situation? There's one true living God and that's Jesus. Grace is what makes Christian so different from any other religion. Because every other religion is a give and take. Even Buddhists, they're like, oh, live a good life, then you will be born into a better life or a reincarnation.   You just come as you are and I'll wash you. I'll wash you. And my grace, God's reckless love always changes everything. He changes everything.   Just surrender and just ask for his love and he will answer.


QuickBooks Online 2023 Payroll and Employee Reports Get ready to start moving on up with QuickBooks Online We're going to be using the free QuickBooks Online Test Drives Searching in our Online Search Engine for QuickBooks Online Test Drives Selecting the option that has Intuit.com and the URL Intuit being the owner of QuickBooks Support Accounting Instruction by clicking the link below giving you a free month membership to all of the content on our website broken out by category further broken out by course Each course then organized in a logical reasonable fashion making it much more easy to find what you need than can be done on a YouTube page We also include added resources such as Excel practice problems PDF files and more like QuickBooks backup files when applicable So once again click the link below for a free month membership to our website and all the content on it Selecting the United States version of the software and verifying that we're not a robot Zooming in a bit by holding down control up on the scroll wheel we're currently at the 125% on the zoom in and the cog drop down just to note that we're in the account view as opposed to the business view we'll try to toggle back and forth between the two views so you can see where stuff is under both of them We're going to go to the tab up top to right click on the tab Duplicate it as we do every time going to be putting our reports in the duplicated tabs Right click in the duplicated tab to duplicate again back to the tab to the middle as the tab to the right as thinking reports on the left You want to open up the balance sheet as that's thinking tab to the right reports on the left this time open up the P & L profit and loss Income statement close the hamburger and then change that range from O-10122 tab, 12-3122 tab Run it to Refresh it back to the middle tab closing the buggy scrollin' up in those ranges they are changing from O-10122 tab 1232 tab, 1231 222 tab and run it to refresh it. That's the setup process that we do every time. These are the major two financial statement reports. Most other reports given more information on one or multiple line items of these major two financial statement reports. We're now gonna be looking at payroll reports and payroll reports can get quite complex due to the rules and regulations around human resources, employees and payroll taxes. There's also limited information in the sample company file I believe do impart to the fact that entering payroll into a sample company is a little difficult because it's one of those things that you kind of have to run real time. So in a future section or course, we'll be looking at payroll, hopefully being able to turn payroll on as we enter some of our data into the practice file and we can discuss it further at that time. However, our practice problem will be somewhat limited with payroll as well because it's such a big topic. We do have other courses focusing in specifically on payroll if you would like to dive into it in more detail. The first thing we gotta note with payroll every time we point out payroll is that you really wanna get it right the first time. You would like to set up the payroll in the way that you want to be able to expand with it and grow with it and move forward with it as time passes because correcting errors in payroll and switching payroll can be somewhat of a painful process. The main two ways that you can process payroll is gonna be within QuickBooks, turning QuickBooks payroll on, which is an add on feature. So you'd have to pay more to process the payroll within QuickBooks or have a third party help you to process the payroll on the third party software or the third party company doing it for you and then you just need to pull in the information necessary to get your financial reporting correct. I would recommend when trying to get advice on which route to take with payroll, you discuss it with like an accountant, a CPA who you're not planning on hiring to do the payroll because clearly if you're talking to someone that you're planning on hiring to do the payroll, you're talking kind of to a salesperson that wants to pick up the work. If you pay someone to give you advice on where to go to hire someone, then you're paying someone just strictly for advice and the advice might be a bit more reliable in that case. Now, when you process the payroll, let's just go through the flow chart and think about what kind of reports would be necessary when we process the payroll. So it would look something like this, we'd have to first set up the payroll and then we gotta track the time if we have hourly workers. We don't necessarily need to track the time within QuickBooks, but we're gonna have to track the time somewhere to put it in the system when we pay people and process the checks. And then we're gonna process the checks, which would be the paying of the employees. These are gonna be the payroll checks. It might be electronic transfers that you're going to be setting up.  And this would be the major kind of component of the payroll because it results in the actual payroll transactions, the lowering of the checking account. And it also is gonna deal with all those kind of withholdings that we have to take into consideration. The federal withholdings being federal income tax, social security, Medicare. And then we also have our side of social security and Medicare on the employer side. And then we have federal unemployment tax on our side, the employer side. And then the state taxes may be applicable depending on the state that you're in as well. So that becomes a quite complex transaction even if you have only like a few employees. Now, when you record that transaction and process the check, you can't still just give them the check or give them the money in their account. You also have to provide them with a pay stub in some way, shape or form. You have to inform them, this is your gross pay and this is what we took from you. And that's why your net pay is not equal to your gross pay. Here's what you got, here's what we took out. You have to do that on a employee by employee basis as well as on a year to date basis and paycheck by paycheck basis. So you can start to see that as you compile that information, that's kind of a lot of data that you're gonna need to be able to properly report that and you wanna be able to support that data with reports within the QuickBooks system which will look kind of like you can format them like a paycheck stub, right? It's gonna have all the employees and then all of the withholdings, the gross pay, the withholdings, the net pay and so on. Then after you pay them, the money that you took from them out of their wages in order to pay their taxes as well as any benefits, you're gonna have to actually pay to the government and that's when you process the liabilities forms here. So we could also have reports that would be tied out with the liabilities that we owe. Then on top of that, we've got the reporting that we need to do to the government. So on the federal side, we've got the quarterly reporting, the Form 940, we've got then the year in, I'm sorry, the quarterly's of the 941s and then at year end, we've got the 940, the W2s and the W3s. So we need reports that will help us to populate the Form 940, 941s, W2s and W3s. Now note that if you do this internally, that means you're gonna need a lot of reports.  Now, so that means that you're gonna have a lot of data if you're processing payroll within QuickBooks. So I'm gonna go to the tab to the right, right-click, duplicate it and then we'll go down to our reports on the left. And so I'm gonna close up the hamburger and just scroll down. And so we have somewhat limited reports in this sample file, but we've got a whole section down here which would be the payroll reports here and we've got the employee reports. They just have the contact list, the recent edit time, the time activities by employee detail. So we would also have like a register that would have to give us that information on a paycheck that you'd see in a paycheck year-to-date information as well as the paycheck by paycheck information and that's similar information that you would need in order to do the 941 quarterly reports. You'd also need a report that's gonna track our side of things so that you can fill out the federal unemployment tax reports. So if you process it within QuickBooks, you're paying for those added reports that will give you a lot more detail in here and you're gonna have help and support to populate those financial statements. If you were to export or have this reporting done by someone else like a third party, then you wouldn't need all the detail, right? In that case, what they would do is process the paychecks which would still come out of your checking account.  You can basically think of all of your employees kind of like as one employee and enter the transactions necessary to get your financial statements correct. So there's a couple of ways you could do that as well. So that would mean that the payroll company would be taking care of the paycheck stubs and hopefully possibly some of the human resources stuff and whatnot and then you would be entering a summary of the data into your system in some way, shape or form so that you have the correct financial statement or reporting and what would be the accounts that would have to be supported on the balance sheet? Well, clearly the checking account's gonna go down when you pay the employees. So we're gonna have to enter the data into the system so that we have the paychecks going down. We're also gonna have to have a decrease in the checking account when we pay off the liabilities for the taxes and then we might have payroll liabilities down here and the payroll liabilities will typically be when you process the paychecks, everything that you withheld will be a payroll liability. That's the money that you kept from your employees that is now a liability that you're gonna have to pay to the government. So until you pay the withholdings after the pay period, you're gonna have basically a liabilities that you'll need to be recording here until you make those payments. And then on the income statement side of things, you're gonna have a couple accounts within here, one is gonna be your payroll, I mean, your payroll expense type of form, expenses, and then you might have another account that would be the payroll taxes. So that's what you would have to be recording on the financial statements just to get your financial statements in essence recorded properly. But if you weren't doing it within QuickBooks, you might not need all that other detail, the detailed breakout on a per employee, per paycheck basis that you would need in order to comply with all the other kind of reporting needs for the quarterly reports, the pay stubs, and the year end reporting. So if you had another company doing that, then you can run it in that system. Also note that you might even be able to be kind of more in a cash based system.  How are you gonna try to get together clients that fit into a system that you might be able to increase, scale up the system? Do you want a system in which you're processing the payrolls in the system or possibly you get a network with other people? Possibly you try to run your bookkeeping on basically a cash based basis as much as you can based on the bank feeds and then possibly working with another payroll company that can help to specialize in the payroll information and then possibly working with a CPA firm that can help you in the year end, year end tax preparations and any financial statement kind of reporting needs. So on the simplest method, if you were to do something like that, you can actually wait till the checks clear the bank and just record them as payroll expense, right? As they clear the bank, you're gonna have a timing issue because really there was a withholding. So instead of recording the liabilities on the books, you're just gonna wait till you make the payments on the liability side of things for the payroll taxes and then you'll record those as in essence payroll expense in basically one account and that way you can basically be on a cash based system, you can basically use the bank feeds and you can have the other payroll company doing all the payroll reporting needs. And then there's usually a timing difference when you do that because now you're, because at the end of the year, you're gonna need to be able to report any liabilities at that point and you might need to be breaking out the payroll taxes on the expense side of things, on the income statement versus the payroll expense and you can then have your CPA or tax preparer if they are working with you in a standardized system to be able to do that journal entry as of the date that you have to prepare the taxes and or do your financial statements by taking the payroll information and then using it to determine what the payroll liability should be as of the end of the year, December 31st most likely and possibly breaking out the payroll expense account into payroll taxes and payroll expense if necessary based on the payroll reports and the end of the year reporting, the 941s, the 940s and the W2s and W3s that they get from the payroll company. So those are a couple of different ways that you can deal with it. Notice that the payroll should be basically nothing more than like a vendor section type of thing. You pay an employee, cash goes down and you have an expense form but because of the laws and regulations related to it, we have way more complexity with the payroll. And so now we've got all these reporting needs as withholding needs, there's human resources kind of needs. So then the question is, well, how can you deal without those reporting needs as efficiently as possible? Either you're gonna have to pay for it one way or the other either you pay for it within QuickBooks to process it within QuickBooks or you create a network with an external payroll provider. Try to automate your QuickBooks as much as possible and then possibly, of course, you wanna also have a CPA firm or tax firm in the mix as well. If you're mixing up the jobs properly or allocating the jobs properly, then you can create a pretty efficient system depending on what you choose to do from there.


Welcome once again to Issues and Answers. On our program today we have Luna Williams, she's the president of the Senusia Association of St. Croix. Welcome Ms. Williams, certainly happy to have you with us today. We are going to speak on matters pertaining to your organization. Good morning and thanks for having me. Okay, certainly welcome. First of all, tell us about your association and how long it has been in existence. You know me well over 40 years. Yes, the association has been in existence for about 40 plus years but I moved to St. Croix in 1990 so that's when I joined the association. From the time I've been here we're mostly a cultural group where we take part in cultural events happening on St. Croix. We also dance quadrille and we do take part in the culture of St. Croix. Okay, what actually brings you to St. Croix at this time? I'm here on vacation. And I'm sure you're taking the opportunity as well to maybe really promote the work of your association. What are you actually doing? We like I say we're a cultural group, we're really into the culture but we also help in like for example we have adopted the Souffre Infant School and so we have been sending stuff for them, we raise funds and we send stuff for them. The last thing we did was we gave them a new playground at the time. We also help with if there's a disaster in St. Croix, we raise funds and we do send trailers and stuff like that. How big in terms of numbers of members that you have in your association? At present we were about 50 but it used to be a bigger group but the members are getting a little older so it's dwindling down. Right now I am recruiting young members because we have to carry on the work that the older members started. How do you plan to do that recruitment? Are you using some of the older folks that you do not see around that often? What's the strategy? We are using the older people and when we have events like the celebration of independence, we also celebrate La Rose and we use that opportunity to speak to the younger generation that are on St. Croix asking them to see what we do and come into our meetings, we have meetings every first Sunday of the month so we invite them to the meetings and ask them to come see what we do. What is the new person that you're targeting? How much interaction or how much relation would they have had with St. Lucia in the first place? If you're going to look to recruit them, were they in positions maybe to have visited St. Lucia sometime in the past or are you trying to attract them by letting them know there's an opportunity to know about St. Lucia and how you can help to actually keep the association strong and vibrant? Actually we're targeting the St. Lucia who are on St. Croix. Most of the young people are just coming over so we let them know that there's a group that you can join you know and we let them know what we do and if they're interested like we say you know they they join us. Okay well you mentioned the cultural aspect of it. It's one of the earliest things you mentioned when you spoke about some of your activities and what times of the year do you actually most prominently show what St. Lucia is over in St. Croix and how has that been received by persons who might not be of St. Lucia descent? Okay we have three major events that we celebrate. St. Lucia's Independence anniversary, the La Rose Festival and also Junique Guillaume. For the Independence celebrations we usually get an ambassador or a member of parliament from St. Lucia. So we invite them to our dinner dance, we have a dinner dance and we usually invite them to be our guest speaker. This year it was Ambassador Fletcher and Minister Flood Bobre. For La Rose we have the festival, we do our services. It's not like here where you know we can really go out and do everything it's different so we use Friday nights or Saturday nights where we do our services at a St. Lucia bar and for Junique Guillaume also it's at a St. Lucia he's a St. Lucia and so we use his place to do our Junique Guillaume. Okay I want to look at all of them individually and to look much more into detail as to some of the activities that you actually have on. So maybe first of all you can start with independence. What do you do? Do you just in a national way? Do you teach people more about signature, culture, history, geography? What about independence that you really look to make stand out and what do you mainly do between independence? For the Independence celebrations we usually have a week of activities where we tell the people about our St. Lucia culture. We portray our national way, our cultural way. We also have an independence mass where there's a choir so we have that mass on the Sunday. We make the announcement that the mass is on whatever day we dress it our national way. We have a St. Lucia choir. We come out every independence. We sing for the mass and then after the mass we have an aftermath branch where we invite the St. Lucians and also the Crucians to join with us where we do our local foods and our dressing and also our local music. So what's been the response like over the years by the Crucians who come and participate with you? Do you find that their numbers are improving or do you find it more difficult to get more the Crucians to come out and actually witness some of the St. Lucia experience during Independence Day? The numbers are increasing. The month of May is usually senior citizens month so because of what they have seen us doing on St. Croix they have always invited us to the scene. There's the senior cultural day where they come out and they have the different islands portray the culture so we're always the biggest group over there apart from the Crucian cultural group. So we usually go and we portray our St. Lucia wares. We dress it our national way. We do some of our local foods where we give them a taste of the St. Lucia foods. So I'm sure it makes you happy that especially when the Crucians actually respond to that activity how do you feel when you get them participating at that level? Proud St. Lucia. I feel really good. Okay so you actually feel that all your efforts are worth it? Yes. And does it inspire you to keep going on every year? Yes it does. Okay we're coming up close to our first break on the program but we'll be back in just a moment. We have with us in studio Luna Williams she's the president of the St. Lucia Association of St. Croix. We'll take our first break but we'll be right back. What is money laundering? Money laundering is the concealment of the origins of illegally obtained money typically by means of transfers involving financial institutions or legitimate businesses. There are three steps in the process of money laundering. One, placement. This is the movement of illegitimately obtained cash from its source into circulation through financial institutions. Two, layering. This is the act of concealing the source of that money using a series of complex transactions and bookkeeping tricks. Three, integration. This is the movement of previously laundered money into the economy mainly through the financial institutions and thus such monies appear to be normal business earnings. What is terrorist financing? Terrorist financing provides funds for terrorist activity. It may involve funds raised from legitimate sources such as donations, profits from businesses and charitable organizations as well as from criminal sources such as the drug tree, the smuggling of weapons, fraud, kidnapping and extortion. There is an interrelation between terrorist financing and proliferation financing which is the act of providing funds or financial services used in the acquisition, manufacture or transport of weapons of mass destruction. How does money laundering and terrorist financing affect St. Lucia? St. Lucia can lose its reputation and international credibility, more violent and organized crimes and corruption, penalties for the financial sector and loss of correspondent banking. St. Lucia will be evaluated in 2019 with respect to its money laundering and terrorist financing regimes. How can you help? Get involved, learn about the threat that money laundering and terrorist financing pose to St. Lucia and cooperate with financial and non-financial institutions when information is requested. Money laundering and terrorist financing are crimes with penalties of up to $1 million and imprisonment of up to 10 years or both. A message brought to you by the National Anti-Money Laundering Oversight Committee and the Attorney General's Chambers. Thanks for staying with us. We continue with issues and answers and reminding you that we have in studio our guest Miss Luna William, President of the St. Lucia Association of St. Croix. Miss William before we go next to our more in-depth look at what you actually do over in St. Croix during the Lowell's Festival, you did mention the fact that you had the foreign minister and you know an ambassador visiting during your last independence observation. That would have been a highlight of it, but was there anything else in particular that they did while they were up there during that time or was it more specifically just to participate in your observance of St. Lucia's independence? They were there to participate and we also had a town hall meeting where they spoke to the St. Lucia's especially Ambassador Fletcher. She's the ambassador for the diaspora so she spoke in-depth to the St. Lucia's about the diaspora affairs, what they do, what her office does. How useful was that in terms of getting that information to your members and how were they able to make use of that sort of information in terms of what follow-up they could have done in terms of strengthening the organization and even being more active? Yes we have had people asking questions, more questions about our group and more questions about the diaspora in St. Croix and so when they came they really especially like I said Dr. Fletcher she really outlined what the diaspora is like, what is her job as the ambassador for the diaspora and it was well received. We had over 200 people at that gathering and so they asked questions that she answered so it was a really good session. Well since you and Dr. Fletcher and that aspect of it is probably a good time now for me to ask you since she's in charge of diaspora affairs, your association do you have that level of cooperation with other associations of other countries with similar objectives? Yes we do. Her program manager, Janik, she's very instrumental in giving us all the information that we want. Everything that is happening with the diaspora right now and in government, we get all that information. But do you have collaborations with other countries that have similar associations like yours in terms of projects, maybe exchanges, coming together for meetings, looking at how you can strengthen your ties? Yes we do. We have a convention every two years, the St. Croix Overseas Association. We meet every two years in a different place. Last year it was London. This year it's going to be in sorry next year it's going to be in Calgary. It was supposed to be on St. Croix but because of the hurricane last year or the year before we could not host it so it went over to Calgary. So in 2022 we will be hosting it on St. Croix. Interesting. Well recently we had the president here Mr. Kadas. So it's quite interesting that you, how active does your organization, the Association of St. Croix participate in the levels of the umbrella body? Okay we have the biggest membership so we do participate. We participate at all the meetings. We give our feedback during those meetings and especially for the diaspora first before Dr. Fletcher just needs to be a whole bunch of talk about the diaspora, the diaspora but since she was appointed we have been seeing results. She is very instrumental in bringing all the associations together. So right now we have all the information that we need. Everything that is happening in St. Croix we know. Okay interesting. So we had quite a gap but we're now going to get back at the La Rose Festival. Tell us about that experience where your group shows Senutia's culture while we are putting on a semblance of a La Rose celebration. Yes we're actually getting ready for that right now. I am the La Rose Queen so when we do have our sayances we have a lot of the Senutians participating and we usually do it the last Sunday of August. La Rose celebrated August 30th but since we're not in St. Lucia we usually celebrated the last Sunday of August and last year we had a mass. We went to church and from church we had a procession from the church to where we kept the event. So we have all everything like here. We have the Queen, the King, the Prince and the Princess, the nurses everything. So we try to do everything that St. Lucia has. We try to portray that too and we get questions like what's the festival all about and we do explain to them what the festival is about. All of the Senutians in your group not putting on the pressure for asking why there's not a margarit as well. We have been asked the question why there's not a margarit. What has been your response? My response has been that for all these years we've always celebrated La Rose. Nobody has ever come up with the idea to celebrate margarit because it's a Senutia association doing all those you know cultural events but nobody seemed to want to do the margarit. Okay maybe those questions in this program I pressure you into doing so if not this year but next year but and you still have a couple months to go so who knows it could well happen this year. We just due to take our second break on the program but when we come back we will look at also the unicorn which must also be something big that you celebrate over in St. Croix and other matters that relate to your association of St. Croix. We'll be back with Miss Luna William. Hey look at your breastfeeding I give him both just now but I don't think I can breastfeed. Why won't you breastfeed? The thing is my breasts are so small I don't think I will have enough milk for my baby.   Eventually all breasts will fall once you wear supportive bra it will help maintain the muscles of your breast while you breastfeed. Breast milk is very important for your baby's health it is complete nutrition for your baby with the right nutrients. I did a lot of reading while I was pregnant and found out a lot of good things about breastfeeding. Really like what? You will lose the baby far much easier when you breastfeed.  It is also cheaper and practical since you wouldn't have to buy artificial milk or boil bottles. Breastfeeding does all that. Now you make me want to breastfeed. I want my baby to be healthy and smart. There's more. In addition I save a lot of money from not having to buy formula. Do you know how expensive formula is? No formula? How is that possible? The baby will go hungry? No. The breast is adequate for the baby's need from both to six months. The baby needs no other foods or liquids during that period. Is that so? My sister had a baby last year and my granny insisted she give the baby to Oloma and she was only three months. Nothing before six months. The nutritionist will guide you on how to introduce foods to the baby. Wow. I learnt a lot. I had no idea breastfeeding was that important. Yes it is. Breastfeeding is the best thing you can do for your baby. Do it and you will see. You will also bond with your baby. I will, my girl. Nice talking to you. I'm happy to hear that. Also encourage your friends and family too. You're watching issues and answers. Reminding you with me Luna William, the president of the St Lucia Association of St Croix. In St Lucia, Juniquial has really grown to be a big thing and I think certainly in St Croix the feeling is almost the same in terms of the observance, the way solutions come out. Tell us about your experience in St Croix around the time of Juniquial. Juniquial is very big on St Croix too. It gets bigger every year. We have the foods, the local foods just like here. We also have our exhibition booth or Tikai like we say. In that booth we have the old-time port, the like we say the vase. We have the vase and you know all those long-time things, the curtain with the bed, the little bed behind it. So we have that as an exhibition booth and we have all the local foods, the 3-3, the aqua 3-3, the tablet, you know and all those little things that we do in St Lucia. We have most of the same foods on St Croix too. And the dressing which is a big part of it. Oh yes, we dress in our national way because we are very patriotic. I think it means even more to us when we're away from St Lucia so that there you see everybody in the madras, in the colors of the flag and it's really big. But apart from St Lucia, are there other nationalities on St Croix with a similar association that you know do things to reflect their own culture or is it St Lucia that's prominent in terms of having an association overseas? St Lucia is prominent but they also have the Dominica Association but around that same time is the independent celebration and the Creole Festival. So you find most of them go over to that and those who remain on St Croix, they join with us, you know with Junior Creole. And there are a few Haitians also who participate, you know they come around and they participate in the event. How diversified is the population on St Croix in terms of various nationalities and what segment of it is St Lucia? Does St Lucia really have a high number compared to the other nationalities that are presently living on St Croix? Yes, St Lucia has one of the highest populations on St Croix. They also have a lot of people from Santo Domingo, Dominica too but mostly St Lucia. A lot of people from Miquud side, Denri side, Sufra side, yes. And they keep constant check with the families back in St Lucia because you know the traditional things like burials, remittances and stuff like that it is something that is very common as well amongst the group. Yes it is. And one of the things that I can see about St Lucia is living on St Croix. When there's a death in your family, they're all there for you. Whether they know the person or not, as long as it's a St Lucia, they're there. Everybody donates food, whatever it is, like the day of the repass. Sometimes the family may not have to do anything. Everybody brings something for the repass. So that's one of one of the things that the other islands admire about us as St Lucia. Okay, you're empty in numbers. Yes. Just before we go though, you did mention some of the main areas. We looked at independence, we looked at Laos, we looked at Junica and you also said that there were some other social activities that you engage in. You mentioned a bit but I'm sure that there are others that you would like to mention before we leave. Yes, one of the things that the St Lucia Association of St Croix does, we donate to, there's a home for the age, so we make a monthly contribution. The members at our monthly meetings, we donate whatever we have and the association matches it and we give it to the home. During Christmas time, we go to Caroline. We also take part in St Croix's cultural events that we dance quadril, different places. There's a group called II Dancers, we combine with them sometimes. Like the Independence celebration this year, they danced with us and sometimes when they have an occasion, we dance with them also. So we have that exchange with the II Dancers. Okay, so if a St Lucia is planning to visit St Croix and they like to get in contact with your group, what would be the best and easiest way to make that sort of contact when they arrive in St Croix? When they arrive in St Croix, they just ask anybody about the St Lucia Association and they can get in touch with me. I provide my number and they get in touch with me. Okay, any final closing comments, Ms. William, as we are just about to wrap up on the program today? Yes, I would like to thank you for having me and also Ambassador Fletcher. I cannot stop thanking her because she has been very instrumental in bringing us all together. Before it used to be a lot of talk about the diaspora, talk talk talk, but she has been appointed and she is working really hard to get us all together. I also want to say that there's also another St Lucia group on St Croix. When the ambassador came in February, we joined together and I mentioned also in 2022 the convention is going to be on St Croix, the two groups will be working together for the convention. Lovely. Ms. Luna William will certainly pleasure having you with us to speak about the activities of St Lucia over in St Croix and the events that your group really participated and the fact that they are actually two groups and that you're keeping the name, the flavor and the culture of St Lucia very much alive in St Croix. Thank you. I also want to pick up a member of the other association. Her name is Chris Centrose. It's her birthday today. Happy birthday, Mrs. Centrose. Thank you. Well, this has been issues and answers. I'd like to thank Ms. Luna William, the president of the St Lucia Association of St Croix. You can join us when we have another edition of issues and answers.


So, wow, this is like my 60th year doing this stuff. We got more toys to show off. All right, who years is the first time to one of my talks? Awesome, thanks for coming guys. So, I don't know if anyone else does this, I sure do. I like good questions, I like insightful thoughts, I like people who mess with my head and I reward such behavior with cool alcoholic beverage. So, if you've got an idea of something going on, think of it after the talk. There's a mic, come up, ask question if it's good, good things will happen. For now, let's talk about some pattern recognition. So who am I, some guy? What are we here to do today? Oh, there are talks where I talk about one thing and just go really in depth. This isn't that talk. We only do like six or seven things and we're gonna go pretty quick because there's just not enough time to do everything but that's never stopped me before. So, we are going to show off some mechanisms that enforce network neutrality. The telcos are up to some damn creepy stuff and well, what can I say, I like messing with them. We are going to, I have me a nice little box that I can send packets faster, I cannot send packets faster than this network can route them. So, I can send lots of traffic and I do on a regular basis. So I looked at some SSL servers. I also looked at online banking. This is so embarrassing that someone has to do this work but oh well, I'll fix it too. I kind of put a bug in OpenSSH a few years ago. Let's fix it. New with pattern recognition and just entropy and of course, pretty, pretty pictures. Now, I have a habit of showing off really cool, pretty pictures that well, aren't necessarily useful. This time around, we are going to do, wow, that needs a little bit more light but whatever, we are going to compare two files visually at a size of 16,000 pixels by 13,000 pixels and the similarities will be completely visually identifiable. But first off, let's talk about network neutrality. Telcos, Telcos have basically said, you know, we've been looking at this network traffic. That's some pretty cool stuff you're saying on our networks. We should charge you more for that. It gets a little creepy. When you actually filter it all down, it devolves down to an old thing that we have in the crypto world. Alice and Bob are in prison and are attempting to communicate without the warden interfering. How do they do that? Now, I've never actually looked at my ISP as my prison warden but hey, it's an interesting thought experiment. Don't believe me. Check out this quote from Comcast. This is great to accommodate the needs of our customers who do choose to operate VPN. Comcast offers the Comcast at home professional product. At Home Pro is designed to meet the needs of the ever-growing population, the small office, blah, blah, $95 a month if you wanna check your email from home. No one actually thought like, we here's had a minimum wage job. Funny thing guys, so you guys were making a couple bucks an hour. YouTube's losing a million bucks a month. You guys made more than YouTube. Network Neutrality has nothing to do with YouTube. Those guys just shovel cash into a firing hole. No, no, no, no, no. It's all about freaking VPNs. It's all about $1,100 a year per telecometer.  The price of oil is tripled. Pretty soon we're gonna see a heck of a lot more telecometing. They want their $45 billion a year and they're gonna break my network to do it. I don't like that. So what am I gonna do about it? TCP bandwidth estimation.  Oh no, no, no, no. I just get to keep playing with this stuff forever. So TCP bandwidth estimation. An elegant weapon for a more civilized age. TCP standard protocol for doing communication between points on the internet is very flexible, very well tuned, very auto tuning to the capabilities of a network. It is able to automatically determine the amount of available bandwidth between any two points. Now if you have two different clients that are using the exact same network, they actually do manage to figure out how much traffic they can split. But these boxes do not talk directly to one another. The entire process of figuring out how much speed to put on the wire, how many packets is done by just looking for dropped packets. Oh wow, a packet dropped. I better slow the hell down. That's pretty much how TCP works. Now what this means is that dropped packets are an information channel. They're a source of useful entropy on the net. Well, we're trying to figure out, TCP traditionally figures out that packets have dropped. Can we figure out why? So here's what we're gonna do. TCP has told us that you can only send packets at 5K a second. And if you send them faster than 5K a second, something bad's gonna happen.  So what do you do?  You send it one hop. So you have your stream going. It's 5K a second. It's working. It's going. And you start putting on more traffic than the network has told you it can do. But you only let it go one hop in the network. What happens most likely nothing. It's only gone one hop. It's probably just on your local LAN. You let it go two hops. You let it go three hops. You let it go far, oh.  Now you go ahead and get packets dropping. Now you're able to identify the specific hop and thus the specific internet service provider that has its limitations. Now you say, that's kind of a neat little trick. And of course it's not difficult. You can do this with HPeng. I didn't even need to write any code to do this. You like run HPeng with a couple of straight up obvious commands and it goes. As long as we're injecting interference, you know, we can control exactly what that interference is. So you say, huh, if I send more traffic, packets get dropped. What if Viacom sent that traffic? What if NBC sent that traffic? What if my workplace sent that traffic? You can change the source IP. They go, oh, but Dan, how will you ever see any replies? We're not looking for replies from your spoofed source IP. You don't care about the actual interference. You're just injecting interference. And the back channel is in the TCP session that's been going at 5K a second and suddenly dropped down to zero.  You drop it. You change the source IP. You can also go ahead and mess with the content. Say, I'm gonna put in some encrypted packets and see if this causes any particular deviation of behavior. Now you say, well, why would an ISP ever do anything to implement, to effect encrypted traffic? Well, they did it, right? I mean, Comcast a couple of years back actually did go ahead and start blocking VPN and Washington state. Washington needed to go ahead and actually buy DSL connections for some ungodly number of users because the cable modem stopped working. Great. We know that they wanna make a lot of money doing this. We know whenever you put firewalls in front of a lot of people for some strange reason they start running tunnels. Possibly over DNS. But you see now, that's theft of service. And profit capture. Let's look at who actually legitimately uses encryption. From their perspective. A, workplaces who have people who are checking their email from home. And B, e-commerce sites that make money from consumers at home. In both of these scenarios there is a direct profit motive in keeping the encrypted link alive. The telcos really can take a look at encryption as, hey, if we shut that down we can go ahead and get people to pay a lot of money to bring it back. And I really do not wanna see that happen.  I don't need to hear, yeah, but the telco's gonna block us. So, let's mess with them. What's up Toby? Ah, so what Toby was asking me is if I'm expecting to see silent dropping versus getting an alert. The problem with an out and out ban is that it's really obvious that your cable modem is broken. What they would rather do is they would rather make the traffic really bad. That way instead of blaming the cable modem, you blame your provider. And you blame your company. And you say, you know, my company should be spending more on giving me a high speed link. With more being defined as giving my telco money. Telco's like things that give them money. So what I was asked is if I'd seen any redirection. I don't really have time to tell this story, but I'm totally gonna do it anyway. Check this out. So, the porn world has weird issues like you would not believe. It's almost like there's not much legal enforcement in that land. So, there's this spyware that the porn guys have that hits them. And it's got a eula. Who here loves eulas? Hey, oh, they're just wonderful things. Yeah, so the eula actually said, somehow this spyware, how do you love? And the eula said, we reserve the right to deem certain sites as unsafe. And to silently redirect you to sites we consider safe. So what's happening is that people would spend 30 bucks a month on a porn site. It would move their money to a different site.  Well, here's porn. And there's your money. And it just kind of went somewhere else. So that's the most I've seen in terms of a redirection. Speaking of secure solutions, let's talk a little bit of SSL for a moment. SSL, probably the standard way to do secure communication on networks. It's got a couple of basic rules for deployment. Don't put anything secret into an SSL search. It's called a public key for a reason. You'll see in a future slide just how embarrassing this can be. And for the love of God, do not put the same key on two different boxes because if you do an SSL, each box can read, each other boxes traffic. So I went ahead and scanned the world for SSL servers. Found lots and lots and lots of search. What kind of stuff did I find? Okay, if you are the sort of site and you know who you are that does not want people knowing all your internal DNS names, be very careful what SSL search you let the public scan for. And quite specifically, if you have a honey pot, and the purpose of this honey pot is to trick people into attacking, you might not want to call it honeypot.yourcompany.com. And if you do, you might not want to get an SSL search for it.  Puts the pot in honey pot. So what did I actually see when I did the scan? Good times, 90% of keys are actually deployed correctly. We're only seeing on one box, about 10% of keys were seen on multiple boxes a lot, a hell of a lot. Only about one in three SSL servers I saw actually had a unique key because of this. You know, wouldn't it be depressing if there were a couple of companies that made an SSL search, put it in the device, shipped it to 10,000 people? That'd be just horribly depressing, yes, everywhere. Wouldn't it be even more depressing if a group that really should know better and has people in this room said, you know, we need to monitor SSL on our network. We better go ahead and take all 61,586 servers and give them the same SSL search. Yeah, any of those boxes can read the traffic from any other of those boxes. I'm sure that's going to be real secure. So, but there is actually a bigger SSL flaw that we have to deal with in everyday behavior and that is the world's most depressing Google search. If you search for the phrase, why is this secure? You will get a lot of online banks that are very happy to say they take security seriously. They're very worried about phishing. They want to protect your money. Yeah, so they give you this form over HTTP which is totally hackable. That's real nice.  You know, there would never be a bad guy. It's almost like this whole form's existence is to protect against bad guys. But you know, it's okay because they have pictures of locks. Did you know if you put a picture of a lock on your site is 83.2% more secure? I read it somewhere. 26% of the top 50 banks do this. This isn't like a little tiny problem. This is like multi-billion dollar sites completely ignoring the threat model of SSL. Now why would they do this? You know, it's actually interesting if you go ahead and you think about what's going on. We basically got three groups, right?  Our site will melt down. The only online bank that actually has this setup as well as Fargo. You go there, actually it's not the only one. They're the most prominent one. They're about five of the top 50.  It's just done.  The UI guys say, if we don't show someone a username and login form on every single page that they see when they come to our site, they might not use online banking. And if they don't use online banking, they're gonna call us on the phone or come in person.  I never wanna see them. I never wanna hear from them.  I don't care if it's insecure. I don't wanna speak to that bastard again. So yeah, what ends up happening is you end up with, why is this secure? I mean, look at this. Social security number or tax ID. Could there be a bigger hack me button? This question, is it possible for you to actually get all three groups for you to get perf and UI and security to actually be happy? All right, check this out guys. So what pages aren't static? We got JavaScript. We got a little bit of an execution environment. What you do is when the user goes to start typing in their username, you go, oh crap, things are happening. I bet they're putting in their username now. I think they're gonna log in. Shocking, I know. And so what you do is you have an iframe open up.  So while you're typing the username, a process that takes a couple of seconds, in the background, the SSL page is opening up. You go to type in your password and it goes, oh, hang on, this would be horribly insecure if you gave me the password here. Let me move you over somewhere where it'll be safe. The screen flashes, the toolbar changes color. Everything looks good and you go, oh, but the UI guys will never accept this. You know how you make the UI guys accept it?  You turn them into animated gifs and you let the lock close. Welcome to security in the weird world. So code is simple, this is how you do it. Bug me later and I'll show you the demo site. And it ends up just looking like username, you type in the username, the iframe shows up, yahoo, come on, yahoo should know better. And you get the redirect. Now as long as we're talking about bugs and crypto systems, I did one. This is a slide from my first talk here ever. Was anyone here actually at my SSH talk like five years ago?  Yeah, so that dynamic forwarding stunt I did had a bit of a problem. Well, you know how later on I started researching DNS? Well, I kinda looked at this stuff through the DNS lens and I'm like, ooh, you'd be PN over there but your DNS is from here. So I SSH'd somewhere and I'm using dynamic forwarding from a malicious network DEF CON. And yeah, I may, all my connections may be going out over this encrypted link but they're going to places that some jackass here is controlling and that's not good. Now, I got this partially addressed a little while ago. I went ahead and got what they called SOX5 support put into open SSH so that applications could go ahead and say, hey, I want you SSH to handle my traffic and here's the DNS name and you do the look up because this network's fucked. But you know what, there's a couple of clients out there that no matter how much I try, Internet Explorer are just not gonna go ahead and support SOX5. Can I still bring them on board into the 21st century? Okay, guys, this is gonna be horrible. Why can't SSH move DNS? Well, DNS is a UDP protocol and SSH doesn't do the whole UDP thing, that's just not its gig. It's really a TCP only thing. TCP being a nice consistent stream of data, UDP being individual messages. Now, I could put a huge translation layer into SSH that actually spoke all sorts of DNS and did all this work and moved it back and forth and had a custom server and we'll put in thousands and thousands of lines of code and Theodorat will kill me. Or, so it turns out DNS, if you just tell it, yeah, I know how you gave me that request over UDP but my response is just way too big for UDP. Why don't you retry that in TCP? DNS will go, yeah, there's a truncation bit. I better retry that in TCP. Works like a freaking charm, it's great. This is totally the way to do that. But it does lead to a problem.  See, I had DNS over SSH working. I got SSH over DNS working. Which means DNS, SSH, DNS. Yes, guys, I finally did write DNS over DNS. Malkovich, Malkovich, Malkovich, Malkovich, Malkovich. See what I go through for you guys. Another bug with SSH. SSH, Danup Law, the authenticity of <IP_ADDRESS> can't be established, RSA key fingerprint is 09A9B1998. Am I supposed to do something with that? Oh yeah, crypto people will look you very solemnly in the eye and go, yes, you're supposed to recognize that key. You should see that and go, oh yeah, yeah, that's totally blah, I see that all the time, no problem. No. So there's a group out there called ADM that basically has a great attack. It's called generate 2 billion SSH keys and see the one that looks the closest and host that one. Works like a charm, it's almost like the human brain wasn't built to look at strings of hex. I don't know. So kind of new field that I'm spawning, naming called crypto mnemonics.  I like saying that. So there are three classes, oh wait, guys, who are you still in college? Who are you that are still in college or taking comp side classes? Okay guys, take some side classes too. Just trust me. Side classes are awesome and they will mess with other people's heads, which is even more awesome. Yes, it's computer engineering for girls.  I can either confirm or deny that last comment, but please come up here and grab a beer. All right, so check this out crew. We got three useful things we can pull out of the human brain for crypto use. We've got rejection, what the hell is that? I have never seen that before in my life. We got recognition, it's that one. And we got recollection. Here, I'm gonna tell you exactly what it is. That last one, recollection is all about passwords, you know, recollect your password.  People's ability to recognize stuff, I pick it out of a lineup, is a bit more.  It turns out the less you ask the human brain to do, the better it does. That's all right, okay, we can use that, we can use that. So what else can we, since hex is a clear and utter failure, what else can we use? Well, there have been some other attempts. They go ahead, instead of doing recollection for passwords, they try to do recognition, where you recognize something vaguely to find is artwork, or you recognize human faces that are automatically generated.  Wow, that's not even 16 bits of entropy in that password, or past face. And so what Toby just said is, and humans have the documented tendency to pick the most beautiful face in a series, which is why past faces doesn't let you choose which face to authenticate against, just says, you're gonna recognize this one, this one, this one, this one, and this one. Precisely to get around that bug. But the bottom line is past faces can only get about 16 bits of entropy. Now this isn't a problem, interesting point though by the way, grab a beer if you want. So past faces can only do so much, that works for online, right? Like if past faces isn't noticing a brute force attempt that's going through 59,000 tries, they're not doing something right. But we don't have online when it comes to SSH keys. You're just handed something and told here's your hash, you recognize it. And for that we're gonna need something else.  So, check this out crew. Bet you didn't think I could make a DNS reference, but you're gonna be totally wrong. So, humans do not remember arbitrary strings of characters effectively, that's just not how we work. What we remember are stories. Homer's epics are enormous. But you know, there's a funny little thing about stories I don't know if you noticed, they kind of change over time. You know, things get embellished, things get changed, things get dropped. But the only consistent thing in storytelling are names. And when it comes to names, those things stay stable. Homer's been Homer and Homer for a long time, Simpson. So, we seem to have hardware acceleration for names. So, what if we went ahead and took that huge string of hex and turned it into a series of names? So, well, we take US Census data for names available at the Census Gov. We know there are more unique female names than male names. We know that there are way more last names than either. We take 512 male names, that's nine bits. 1,024 female names, that's 10 bits. 8,192 last names, that's 13 bits. We try to get as different names as possible. We use something called the Levenstein algorithm to come up with an edit distance. The maximum, minimum number of changes from one thing to another to go ahead and turn the first into the second.  So, what we wanna do is we wanna make sure that two names don't look similar. And we can do that, because there's a fair amount of entropy around names. And we split our 160-bit big mess of hex into five married couples. I gotta say, it's kinda weird, but Julio and Epiphany at the Zootie is a hell of a lot more readable than A1321651. The crazy thing. Okay, so this is really interesting. I actually got to tell Phil Zimmerman about this and I got to guide his jaw to drop, which pretty much made my ear. And Phil Zimmerman's like, yeah, we hired this linguist and he went ahead and he studied and did all these genetic algorithms that determine words that wouldn't be confused for one another. You know what else we're not optimized to handle? Random frickin' words. We can handle arbitrary names. We're damn good at that. Random words, not so much. It's almost like we suck at learning new languages. Three years of French, remember nothing. It is, first of all, shocking that this actually works. That's kind of a surprising thing, but it does. It is critical you actually show the user the key every time they log in. Can't just be like, oh hey, I guess you should probably learn to authenticate this guy. Hey, you recognize this? Like, I've never seen it before. Sure. Now you actually need to show them for every legitimate use. Then when there's a challenge, the memories have been created. So, speaking of broken representations of entropy, you're looking at a file, new file, never seen it before, and you're like, oh, let's look at a hex dump of it. And what do we see? 6A, AC, 06, 2D, again. Am I actually supposed to do something with this? Now what OD tries to do, octal dump, is octal dump will actually go ahead and take, oh, here's a whole bunch of zeros. I'm just gonna shrink all these down. Well, gee, thanks, I appreciate that, but still, 6A, AC, 06, what the hell? People go, ah yes, for our hex dumper, we'll add ASCII. Okay, that's still not very helpful. We need a little better. Now why do we need better? Well, first of all, because if you're like me or, you know, Moskis, you like looking at random protocols and seeing what the heck they do. And second, fuzzing.  So I've been playing around with fuzzing stuff.  The files are just bits. I gotta figure out some way to find structure on it. How am I gonna do that? So we got two different ways of doing fuzzing right now.  I don't know what I'm doing, we're just gonna like flip a bunch of bits and see what happens, and that can be helpful.  It's a little depressing.  It's a huge amount of development and you can do it.   I don't wanna have to understand all the things I break. That's hard. Can't a computer do it for me? Isn't that kind of the point of our entire industry? Can't someone else do it? Can't a computer...  Well, the first thing we're gonna have to do for that is get me beer. Because nothing increases intelligence like beer. Yes, things get very fuzzed. Things get very fuzzy. So, there's a freaking cool tool. Check this out, guys. It's called the sequitur, right? Sequitur is a linear time pattern finder.  It just goes ahead and creates sequences and patterns out of it. Actually, the technical term are hierarchical context free grammars. Now what the heck is that? Here's a switch statement, right? Switch C, case one, value two. Case two, value three. Case three, value four. You know, a little bit of redundancy in there, right? You would pass that to sequitur and sequitur and say, oh, okay, we'll represent as switch C, A1, B2. A2, B3, B3, A4. So, it's actually a compression algorithm, but with a very nice trait of you can actually look under the covers and see how it's doing its work. That's kinda cool. This is a smart guy. He should end up somewhere like Google, okay, he's the chief research scientist. His thesis is awesome. I suggest you check it out. So, here's what we're gonna do, right? Oh, wow, that's totally not visible at all. Oh, well, you'll have to find me later to see the actual live version of this. But check this out, guys. In sequitur, sequitur goes ahead and creates a tree that you have to traverse to get back each byte because, you know, it's like, for example, everything in case, you have to go down one level in the grammar to reconstruct the word case. So, what we're gonna do is we're gonna take each byte and we are gonna render each byte by how deep in the tree we had to go to recover that particular byte.  Probably not. But what you end up seeing is you end up seeing this. Oh, yeah, there we go. Sweet. All right, check this out, guys. Look, instead of this just being a random string of bytes with no idea what's going on, what's this huge blob right here? Why are these basic offset white lines right here? We ended up getting full-on visual identification of segments and sections. I have no, okay, actually this is the Windows NT kernel.  So we have significant improvement on analysis. Ah, now we start up a new tool. We can bring lights back up now. I'll tell you later when we can shut them back. Oh, we can keep on and off, it doesn't matter.  He shows off one of the things that make his stuff cool is now that you go ahead and you have this symbol level view of our data, we can go ahead and we can generate graphs out of it. The symbol switch leads to A1, B2, A2, B3. Switch leads to case, case leads to one or two or three or four which always goes to value. This batching up is actually kind of meaningful. Now you go, but Dan, I can read this, I can CC, I can manage to handle it. Yeah, that's because C is designed for the human brain.  So you can just take arbitrary stuff and it will find structure that you can run through this process. It will create symbols that you can manipulate and link together. And anytime we have a symbolic level view, we can fuzz at that view. So I'm creating a new tool called the CFG9000, context free grammar, 9,000 ways to fuzz. We reduce our input stream data to a stream of symbols. We fuzz the data at the symbol level rather than pure bytes. We do shuffling, we do dropping, we do repeating. Now, sequitur is not necessarily the best algorithm to go ahead and generate our sequence of symbols. We got a kid. Wait, is this the newest spot to fed? I mean, are we starting a little young here? What's up? Wait, is this a lost and found? Cause that's gonna be really depressing. It wouldn't be a Dan Kamitsky talk if I didn't have to come in here and lecture you again on keeping the aisles clear. If you're in the aisles right now and sitting down, you need to get up and get either find a seat, move to an area where you're not in aisle or you need to leave. Okay, there's some space right up here in front of the stage. Some of you can come up here. Everyone from over here, guys, come on in. Actually, all you over here, why don't you shift over to this side cause there's a huge amount of free space and we can let all the people out from there. Exactly. Like along this wall over here, there's a lot of free space if you all can open it. And note, no exit, very visible to get us kicked the hell out. Yeah, please. Sorry about, sorry to interrupt again. It wouldn't be a Dan Kamitsky talk if I didn't do a spot to fed. I had to interrupt to get a lecture. All right, it's all cool, man. But it's my son, by the way. Oh, very cool. Can I give him a beer? But it's stuff gone. All right, guys, we don't have a huge amount of time but we still have lots of toys to play with. So, what does CFG's output look like? This is just very, very basic, basic fuzzing that I'm doing on the symbol layer. I'm not even fuzzing like the internal graph of how things all align, but still. So I went ahead and I threw sequitur through its own, actual code for sequitur through the fuzzer. What you end up seeing is, wow, this thing straight up identified, calculate rule usage, calculate rule usage, calculate rule usage. This thing has identified a basic, what's it called? Stack depth attack. They might say, yeah, but syntactically, you know, it's missing the closing braces, but hey, with literally no work, this algorithm figured out interesting sections to repeat. So it's kind of cool. And yes, things blow up. Things to do, create recorder, which is a sequitur implementation optimized for fuzzing use. Need to generate larger symbols. Need to eliminate redundant symbols using work by a guy's named Kyfer and Yang. Yeah, if you have two symbols that reduce down to the same message, how about we merge them? Sequitur is linear time.  So you can get about 150 megs through before your memory usage is about 900 megs, which is okay, but, you know, hey, what can I say? I wanna take the entire contents of my hard drive and run it through sequitur. I'm gonna need something out of memory. And add the ability to compare files against foreign grammars. Now, sequitur's really cool, but it's not where we need it yet. But there's another approach that I remembered. And it was called dot plots. There's this paper called visualizing music and audio using self-similarity. It's a very brute force solution.  There's a tool called Disassociated Audio that'll make graphs like this for you. It's actually a Beatles track. Actually, why don't we drop the lights again? So this went ahead and this identified individual sections of this track, and they're very visually distinct. Now I said, could we do this possibly with something that we might wanna fuzz? Like the pirate baby MPEG at the beginning of this video. Go ahead and you run this exact process on something on your hard drive where you take it, you split it into chunks and you do analysis. I'll do a deeper and out description in a sec. You get really distinct and useful visual patterns.  Let me tell you. Jonathan Hellman wrote this thing called dot-pot patterns, a literal look at pattern languages. And if you look at this in an example from Shakespeare, to be or not to be, we get this big diagonal line of similarity. Two equals two, B equals B, or equals R, et cetera. We also get a second diagonal line from the repeat of this to be and that to be. So instead of having individual words with a single bit, whether it's the same word or different words, we use a similarity metric. Well, we have a similarity metric. Oh yeah, we had one when we were identifying how names were different. Well, instead of doing names, we're going to do chunks of individual files, 32-bit chunks. We're going to arrange them in the X dimension. We're going to arrange them in the Y dimension and we're going to do a self-similar comparison. So what does this end up looking like? Java class files, .NET assemblies, CNN's homepage. Of course, HTML being far more self-referential, far smaller tags that repeat and thus the density is much higher. Packets, SMB torture packets. Kernel32.dll, the human chromosome 22. The legend of freaking Zelda. I don't know crap about 6502, but I can take a look. So why is this useful? Because if I'm doing, imagine if I had a big old packet trace and I could not separate my packet, you know, the file into individual packets. How would I go ahead and identify what was going on? Well, what this is doing, this is at least saying with no prior knowledge, this is a different section than this, this is a different section than this, and I can fuzz them one at a time. Can I potentially do more? Well, what are my actual messages here? Well, from the paper, we do actually see this is a full, a diagonal is a full on repeat, squares are sections that are self-referential when you change from one section to another. Kind of get an idea.  Like, I am, what the hell is that? I am, what? But you know, this is good, right? It's nice to have a tool that's showing you better things than you can identify easily because that means there is, you know, hey, it was just a hex thumb to me before and random string of bytes, we're just random string of bytes. That's just how it was. This is showing me something different. Now, there is more research to do.  Create some interactive tools for dot plot evaluation. Do a little, you know, data microscopy. Color, different similarity metrics. We can have different colors. Better symbol selection.  I don't have clue what's going on in the x86 layer. My similarity metric is raw bytes. I could have so much better stuff if I had a clue. But you know what? Right now I've got pretty pictures and I'll take that too. You don't think I'm done? No, no, no, no. I've got one thing left. If autocorrelation is interesting, if it's cool to compare A to A, what if we didn't compare a file against itself? What if we compared it against a different file? Now, if it's a totally different file, you get this thing, it's called ass, it looks like it. But what if you compare a file to an older version of itself? Well, normally when it's the same, you get this hard diagonal line because of course a file is the same, the first 32 bytes are the same as the first 32 bytes. The second 32 bytes are the same as the second 32 bytes. And it works, whatever. But what if it's two different versions? Well, let's ditch the slides for a second because I like megapixels. Nothing says hacking like 16,000 by 13,000 pixels. Awesome. I can either confirm nor deny. All right, let's check this out. We're gonna open a little image here. It's gonna take a little while because it's a couple hundred megapixels. This should not actually be useful. So yeah, I re-implemented all my code in C just because it might be a little faster.  So I'm like, well, I'm going a lot faster here. I should go ahead and start trying to, come on, you can load any minute now. Oh, okay. Let's go ahead and just as a lark, see what happens if we allow two different files to compare against each other. Oh, well, check this out.  Oh look, new data over here, new data over here, back to normal, new data over here. Big, huge insertion of new code. We should probably look at this. Guys, it's a visual bendiff. I didn't think this would actually be useful, but you can just visually trace it out. Okay, you got one third of your brain dedicated to visual processing. Believe me, believe you me, I'm willing to use it. So yeah, you can basically just go through files, find the differences, figure out what is going on. In summary, your VPN's under threat. If you got one, you might want to tell your boss that the telcos are evil bastards. SEL's got some issues, especially online banking, especially those of you who are putting the same sort on 60,000 boxes, please stop. There's some fun DNS games you can play. Oh, please, we love a God. If you're writing code, fuzz your file formats.  And take a look at your data, you might be surprised at what you find. Now, I've talked too long, get the light on. I got some beers to give away.


Hey everybody, welcome back to Magic Orthodoxy. My name is David and this is a magic review. Hey, today we're going to look at the journey from Matt Johnson and Murphy's Magic. What is the journey? It is the any card to any number routine. Five different plots, five different versions that Matt Johnson has kind of crafted together for you in this one compendium. There's a lot of good information in here. Want to see the trailer? This is it. Hey guys, I'm Matt Johnson. I'm here at the world's biggest magic convention and I brought with me the Holy Grail of Magic. I attempted to fool professional magicians with any card at any number and I did it. And what was the card? Oh my god. And I did it with one of the easiest, most commercial, instantly reset versions of any card at any number you've ever seen. I need deck cards. You got deck cards? No, not anymore. Deck cards? Yeah. Board deck. It's important I do this with a board deck. Okay. We're going to try something and then we'll see if this works. So deck cards. Brandon, name a card? The four of hearts. Four of hearts. Now I'm curious. Wow, these are cool man. Is this a full deck? Yeah. It is a full deck. Okay. I did see the four of hearts that's in the deck, right? Now Brandon, I can tell you this. The four of hearts is nowhere near the top. I can also tell you that it's nowhere near the bottom which means it's somewhere in the deck but we're not sure exactly where, right? That's where you come in because you're going to tell us where it is. So I want you to think of a number between one and 52 where the four of hearts might be. 12. 12, okay. One, kind of blending with the table. It's kind of full, kind of retro but two, three, four, five, six, seven, eight, nine, ten, eleven, twelve. Not 13, not 14, not 15, not 16, not 17, not 18, not 19 but 12, yeah. And what was the card? Four of hearts. Oh my god. So it was the Jack of Spades and the number was 10. How cool would it be if the 10th card down in this deck, if it were the Jack of Spades, crazy, right? Yeah, yeah, yeah, okay. We're going to try this. You could have picked any card, you could have picked the Jack of Spades. I want you to hold the cards face down. What you're going to do is you're going to deal nine cards here face down, out loud, one, two, three, four, five, six, seven, eight, nine and then the 10th card here face down.  One, two, three, four, five, six, seven, eight, nine. You said ten, right? Put it right here. Okay, and the rest of the deck. Okay, so let me see. Ah, yeah, yeah, yeah, yeah, yeah, yeah. I think some of these cards start to get away. One, two, three, four, five, six, seven, eight, nine. Yeah, it's the 10th card and it's the Jack of Spades, so. You look great, man. In the journey, I'm going to teach you five versions of any card or any number, some with sleight of hand, some instantly reset, some with a spectator deal, some with a gimmick deck and some with a borrowed and shuffled deck. No matter your skill level or your expertise, beginner to professional, you're going to find something that you will use for sure. So join me as we go on the journey. All right, so that was the journey, Matt Johnson. Yeah, and a couple questions we always ask about all of our magic reviews and the first of which is what's in the box? What's in the box? You're going to get a DVD, okay? You're going to get the DVD and you're going to get the, I'll call them gimmicks, okay? You're going to get the gimmicks that is required to do some of the effects, some of the effects. Is it what I thought? It's not exactly what I thought. I've seen a couple of other different any card to any number routines, obviously, read some in books and so I think Matt has a very fresh approach to this plot. He does go on at the beginning about how this is one of his favorite plots. He gives tons of credit where credit is due, both for inspiration and where he's pulling some of these ideas from, but it just wasn't the any card to any number I was expecting. How are the angles? The angles on this are fairly clean, okay? There's five different versions, so it's going to be hard for me to answer questions that are typical to a review considering that each one of these tricks, each one of these approaches is a little different, but I would say the angles on this are really clean. Can it be inspected? For the most part, no. There is one routine that he teaches that is completely impromptu that you can do with a borrowed deck. Of course, that one can be completely inspected. The rest, I would say, you wouldn't want to hand the deck out and say, go through every single card. I wouldn't do that. What's the overall quality and production value of the video? The video shot from Murphy's Magic, so it's well cut, well edited. Shot in Blackpool, it's awesome looking. You got great cutaways, you got well done video editing, lighting, math the great teacher. I think it's a wonderful DVD to watch. Is the gimmick well made? The gimmick is really beautiful, actually, and it is very well made. You might not understand it when you pull it right out of the envelope, so I would say wait, watch the video, and then make up your mind. That said, there is some arts and crafts. Not the kind of arts and crafts that requires scissors and pencils and super glue and tape, not that kind of arts and crafts. More so deck assembly, okay? And a lot of that stuff you can purchase either from your local grocery store or probably even a couple of magic providers that will give you some of the special gas that you might need. So just know going into this, you're probably going to have to make some additional purchases to make a journey deck. What is taught on the DVD? Like I said, there's five different versions of the any card to any number, and they all range in setup. They all range in like what you carry on you, and they all range in skill from I'm a master level slight tradition to, hey, I just grabbed this and self-working. How much practice does this require? I'm going to go out and say this is going to require some practice. Even the self-working effect is going to take some time just to get your rhythm and your figuring out double thing, okay? I don't want to give away exactly what it's going to take from you, but I will say it's going to take practice. How much setup and reset is involved? There is a lot of setup, okay? And I think that goes part and partial with the arts and crafts. Like I said, it's not really arts and crafts. There's some setup though, and so I think whichever one of these versions you choose aside from the impromptu one, there's going to be some initial setup. Through the trick, each one that's taught, Matt does teach you how to get back to your get ready. He does teach you how to reset, and many times you can reset right in front of the spectator, so it's easy. Positives. All right, so what are the positives to the journey from Matt Johnson? Matt Johnson has created any card to any number that is both impromptu and a magician fooler. Who else can say that? Those proficient in card slides I think will love this approach. Negatives. All right, so what are the negatives? You know there's always negatives to something, and these are just the negatives that I see.  I'll say this. As far as the DVD goes, and as far as there being five different versions, just know that they're not five different completely different versions. They're more so variations on a theme. They're variations on a theme, variations on skill level. You won't do all five of these. You won't do all five of them. You're going to probably pick one that you like of the five. Maybe two, okay? So just know that. He's not teaching you five completely different out-of-the-box tricks. They're all variations on a thread, okay? So you could just call the one trick the journey, and just you're asking, okay, which version of the journey are you going to do? Is it worth your money? It's 40 bucks, 40 dollars, and you are getting gimmicks, okay? And you are getting a DVD that has a lot of teaching instruction on it. And so I would just say read a lot of reviews, okay? Read a lot of reviews on this one. This is kind of one of those DVDs I don't want to answer for you if it's worth your money. I think you should read some reviews. Read both positive and negative. Do a little bit of homework, especially on the any card to any number plot if you're already not familiar with it. I would say this isn't necessarily for beginners, okay? If you're a beginner both at skill or this is your first time doing an any card to any number, I wouldn't say this is a good DVD for a complete novice, both either with skill or you've never done an any card to any number before. I wouldn't say you probably want to be a borderline intermediate level magician. That's just my advice. All right, so who would like this? I think collectors of the any card to any number. I think skilled Kardashians would like this. You definitely kind of might need a table for this, so I would be thinking about that too. This is an any card to any number that you definitely would require a table or you're counting down and there's going to be things spread out. All right, so that's my review of The Journey from Matt Johnson and Murphy's Magic. As always, I want to thank Murphy's Magic for allowing me to have this trick so that I could do the review for you and if you would like to purchase this trick for yourself, you can find it from your favorite Murphy's Magic Dealer. Thanks. Bye.


Yeah. I don't think it's the answer. They don't have it. No, they don't. They just, they're not dropped on the same place. You're saying they're, saying again. That's not a good thing. Not saying they're, not a good thing. They're going to go over again. Yeah. So guys, they look zero. They're like zero. You look like a good player. Go. Two spin-offs. Two spin-offs. Two spin-offs.


I really should learn how to use this gimbal. So I was out there in the waves and a lifeguard was yelling at me. I didn't even hear her. It must not have been very impressive because she came swimming out to check on me. Beautiful young woman, very fit. It's kind of nice having a beautiful young woman come check you out in the waves. Walking on the Santa Monica beach and this big Roe v. Wade procession came by like 150, like 80% women, 90% women protesting about Roe v. Wade. But I couldn't get my gimbal and my camera working. I tried to join them for a while. I was protesting religion, very fired up about Roe v. Wade. So I can't think of any ways that this doesn't help the Democrats, right? So I think it's just a question how much it helps the Democrats. So does it help them a little bit? Does it help them a lot? And it also raises the question like how much do you fight against the tide? I was once caught in a rip tide and the harder I swam to try to get back to shore. Like the more tired I got, the more desperate I got and like the worst position I got. And it's kind of like that in life, isn't it? Sometimes you don't want to be like fighting against the tide all the time. So when I eventually surrendered to the tide and started just going with the tide and swimming to the side, then everything got a lot better. Richard Spencer just talked about this in a recent phone call on his sub-stack that he got caught in a river and was trying to meet some people and the harder he swam, the further behind he got. So when he eventually surrendered to the tide and let it pull him around the corner, eventually got out and was able to walk to the place he wanted to go. So when I got caught in a rip tide in the ocean, I allowed it to take me out to sea and then I stopped fighting the tide directly but just swam to the side and eventually got out of the rip currents and was able to get back to shore. Maybe it's like that with a lot of social currents, right? How many social currents do you want to be fighting, right? Particularly in the workplace, you don't want to be fighting a lot of social currents and I think a lot of it depends upon your personality, right? Do you have an agreeable personality? The more agreeable your personality, then probably the fewer social currents you want to be fighting. Now, there are some extraordinary people who are highly disagreeable, right? So for them, they get a charge out of taking on everybody. They're always willing to disagree, they're always willing to fight. Not many people are highly disagreeable. So generally speaking, an agreeable personality is much more socially effective. So how much do you want to fight against the tides around you?  Like if everyone around you hates Donald Trump at work, you really want to be fighting everyone around you.  If you go to an Orthodox synagogue, but you're out of step with Orthodox Judaism in some ways, you really want to be fighting the people you doven with and eat with and dance with and pray with and socialize with and cross not. So Richard Spencer was talking about you just go with the tide in many things and just let society progress. And maybe you can help pick up the pieces and things fall apart. So one of my favorite sayings is that which cannot continue eventually won't. So if one feels hopeless about certain trends in society, there are say anti-nature that are against the way that people walk against human nature, against reality, then maybe you don't have to waste energy fighting these tides. Maybe instead just let them play out and eventually the tide will beat you in a good place. If your Jewish and everyone around you is anti-Semitic, maybe it's time to move. So I mean, how much energy do you have to fight the social currents around you? I love the approach of 12 step, which says we no longer fight, need to fight anyone or anything. And that's really helped me. So I'm very rarely in conflict with the people around me to the best of my knowledge. And for all I know, I'm just sewing chaos and discord everywhere I go. But I'd largely, to my knowledge, I'd largely stop fighting with the people around me and I just try to see things with a sense of humor. I just try to see things in a sense of just trying to understand reality, just trying to understand what's going on and just try to understand. To me, that's a lot more helpful than like constantly being at war. Like being at war, fighting the tide is absolutely exhausting, but an attitude of curiosity, I find a lot more helpful. And an attitude of like, what's the, where's the humor here? You know, what's funny about this? Because fighting just wears me out. And I'm in constant fight mode. I get tired and make bad judgments. Doesn't seem to really serve me. So these days, I just want to be curious, because many of the trends in society, not in alignment with my generally conservative outlook on life, particularly when I live in Los Angeles. But the other thing that helps me, the 12 step philosophy is that God grant me the courage to change the things I can change and to accept the things I can't and the wisdom to make a difference. But I actually find it much more useful to take the acceptance bit first. Like let me just accept everything and then out of that comes serenity, right? It's not so much me needing to find the wisdom to decide the things I need to fight, the things I need to accept. Let me just accept reality around me. Then I find serenity and then it becomes clear where I can appropriately take action. So, I think we underestimate how much influence we really can have as long as we don't go about it in a desperate or rabid fashion, as long as we don't demand that people pay attention to us. We don't pressure people, right? We don't undercut people's dignity. We don't insist as long as we don't expect them to change. But when we just share our perspective on things, or share the books we're reading or the podcast we're listening to, then it's kind of surprising the impact that you can have. So, I think we underestimate the impact we can have as long as we don't go about it in a needy, demanding, strident, unappealing way. Then we do make a little bit of a difference in the world. Have a realistic understanding. Yeah, we can affect people, but without demanding that people change or bend to our will. But how do you deal with the currents and the tides of one society, particularly when you feel like most of them are going against you? And you feel like most of them are opposed to what you stand for? How much do you fight them? How effective are you? How much does that weigh you down? Is that really in your best interests? Do we constantly at war with the world around you? So I guess Christians have the attitude be in the world, but not of the world. Maybe that's one perspective. Another perspective is to largely retreat into your in-group. Because if you have an in-group that you're largely in harmony with, then that's what I experienced with Orthodox Judaism. I've got an in-group that I feel in harmony with. And so I'm not fighting my in-group over anything of which I'm aware. And so it's not tiring for me to spend time with my in-group.  And that way I'm not at war with the world around me. Yeah, to be in the world, but not of the world. But that's helpful, but I think one has to find that in-group as well. Because we are in this world and going through this world largely on one's own, it's just debilitating. It's just so much weaker. And so it's fine to go work a job with a bunch of people who, say, have perspectives on life that are completely antithetical to one's own. If you can then get recharged by spending the evening with your in-group, or at least spending the morning going to synagogue, or going to a 12-step meeting, or going to a yoga class, or wherever your in-group is, you've got to get recharged, man. Yeah, my in-group is the people that have been with used to me since the chat, where we're in the world, but not of the world. And then I find we have a lot of effect on how other people relate to us and treat us, right? So if you treat other people with respect and with dignity, they, generally speaking, respond in kind, but when they don't, we can distance ourselves. Disrespectful, we can usually distance ourselves and spend more time with the people who are respectful. I think some people are cut out to be fighters much more than other people. Some people cut out to be great social campaigners. So Theodor Herzl established Zionism, modern Zionism, but at a tremendous personal cost. Like, his family life is absolutely horrible. So a lot of rabbis in their mission to teach Judaism, to often run, you know, rush out over their families.   And she said to him, well, when I called you Abba, when I called you father, you didn't respond. So she tried calling him father, he didn't respond. She only got his attention when she called him rabbi. I think that's an amazing story. Kind of shows where our attention's at. We tend to be most excited and attuned to those parts of our life where we feel most powerful. So in the family, I mean, I feel very powerful. In your family. So your attention is largely devoted to say your work. That's where you feel powerful. I think many men leave their wives and they're not getting a sense of appreciation with their wives who've been, you know, washing their dirty underwear for 20 years and then have the same sense of awe and respect and admiration that the guy's secretary has for him. So we orient ourselves towards those communities and those endeavors and those people make us feel important. We have to also use good judgment because if we're desperate for that feeling of importance, it makes us really easy to manipulate. So I was reading that biography of Jacob Talbus. He had an incredible ability to manipulate people. Maybe even played a role in several suicides. But Talbus didn't directly cause the suicides. But we're so desperate for that acknowledgement. That feeling of importance, we can go off course.