nd it allows me to live and work in the environment that I'm most efficient in, which is Windows target the Windows. Live and work in Linux target Windows and it worked but more importantly, my colleagues who are living and working in Windows are able to work with my code. We're able to collaborate and develop in parallel because for them go on Windows is no different than me go on Linux and we're targeting both Linux and Windows environments and it just works, you know? Well, Go definitely has capabilities that didn't exist traditionally in languages like Python and so on. The whole notion of go routines and how you connect things up with channels, I mean it is, I've oversimplified things for the person I talk. The fact is if you're gonna write a large tool in Go, you might wanna learn things like go routines and channels and once you learn how to do that stuff and you write code that uses go routines and channels, it makes your life so much easier but it's a different way of thinking.  It's functional programming languages are weird. Who here's a Haskell guy, anyone? Yeah, they're super powerful but you have to think differently when working in that world.  So yeah, there are things that you can take advantage of in Go that make your life easier but you first have to wrap your head around thinking that way. All right, thank you so much. I mean, yeah, I appreciate all of you sticking around. It's almost the end of the day. We've got one more talk to go. Everyone know what talk they're gonna see for the last session? Yeah? Not sure, not sure, all right. There's a JSON talk? Something JSON? It might be about JSON. Web tokens? Token, token is not the same as token. Anyway, thank you. This has been fun. Yeah, I'm going to get a beer. I'm gonna stay for the JSON talk and then I'm gonna get a beer. I am not getting beer for everybody at the talk. I'm with the C Libraries. When you do... Hi, wow, that's loud. It's 4.30, I'm gonna give people another couple of minutes just because things are, you know, it's the end of the day and I'm not gonna use up this whole talk slot. So a couple more minutes, we'll start going. If you're not here for the JSON web token talk, you're in the wrong room. Okay, let's get going. So hi, welcome to JSON web tokens. We'll improve your life. I'm John, go by Gene Hack, Most Places Online, Twitter, GitHub, IRC. And in my day job, I'm the vice president for technology at an IT consulting firm called Infinity Interactive. I used to do a lot of cool stuff and then I got promoted into management and now I basically go to meetings and occasionally cosplay Brian Lumberg from Office Space, the coffee cup, what's happening. But I do occasionally get to work on a coding project and this talk was born out of a coding project, a couple of projects that I got to work on that use JSON web tokens and I thought they were pretty cool so I decided right to talk about them. This is my dog, Sammy. Sammy works from this bed under my desk and she helps me out with my coding projects. So who's heard of JSON web tokens? Okay, like half the audience. Who's used JSON web tokens? About half the audience. Hopefully I'm not gonna say anything wrong that you'll feel the need to correct me on. So what is a JSON web token or a JOT which is the official pronunciation of the abbreviation? So you might try to Google JSON web tokens and if you do, you will end up on this website, jwt.io which is the official website for the project which will hopefully tell you that JSON web tokens are an open industry standard RFC 7519 method representing claims securely between two parties. Sammy didn't really get a whole lot out of that description. This is also when I should mention that Sammy suffers from an unfortunate disorder called RSF or resting stone to face. But I persevered. I went and looked up RFC 1719 which is titled JSON web token or JWT and this is where you will be told that the official pronunciation for JWT is JOT. Reading this the first time was kind of confusing because there's a bunch of stuff that it refers to that's not actually in the RFC and it took me a little bit and it turns out that you don't only need to read RFC 1719. You also need to read RFC 1715, 1617, 18 and my personal favorite RFC 7520 examples of protecting content using JSON object signing and encryption or Jose. Yes, way. Sammy found the RFC content to be a little bit dry. She kind of really just likes to focus on the code. But I persevered and I read through all this stuff and so I can tell you the JSON web tokens are kind of sort of a lightweight alternative to cookies that will also work with command line apps or mobile apps or even desktop apps. They can also be used as an authorization or access control mechanism, kind of like OAuth but without you losing the will to live as you try to implement it. And they're also cross domain friendly. They're made up out of stuff you probably already know and use. So they're just plain old JSON objects or pojos. I'm gonna say pojo a lot in this talk. And then those are stringified and coded and cryptographically signed and then transmitted back and forth over HTTP or HTTPS. So what does a JSON web token look like? It's a dot to limited string. It's got three parts, a header, a payload and a signature. And those three parts are just separated by dots. So down here at the bottom, you see XXX is the header, the Y's are the payload and the Z is a signature. So let's look at each one of these parts in a little bit more detail. So the header, like I said, it's just a plain old JSON object. It's stringified and then base 64 encoded. And it typically contains metadata such as the type of token. In this case, this is in the TYP key. This is a JSON web token. There are other kinds. I'm not gonna talk too much about. And it also includes the data about what algorithm is being used to sign the key. In this case, Hmax SHA-256. And the abbreviations for all of these different things are actually in 75.19 or on JWT.io. The payload is just another stringified base 64 encoded pojo and it contains what the JOT documentation calls claims. This is really just the key value data that's in the pojo. A claim is just a key and a value. There are three different types of keys that are used, reserved, public and private. Reserved keys are those that are in the RFC. They typically have three letter names and these are for things that everybody uses, stuff like when the token was issued, when it expires. There's also a provision for public keys. These are designed to be registered with IANA and you would do this if you were making a JSON web token protocol that you were going to expect to be very widely used. It's probably never gonna come up. And then there are private keys, which is your data, the stuff you care about. And you can put anything in there. It's just a plain old JavaScript JSON object. And then finally we have the signature, which is the header plus the payload, which is then run through some sort of HMAC algorithm along with a secret that you have and that generates a signature. Generally, like I said, the signing algorithm is in the ALG key in the header. So I'm gonna be showing a fair amount of code in this talk, maybe a bit too much code, but I really wanted to drive home how simple and elegant the JWT system and algorithms are and showing how they actually work on a code bubble is I think the best way to get this across. These are not complicated. They're really pretty simple. It's elegant is the word that I keep coming back to. So in real practice, for a lot of the code that I'm gonna show you, you would never write this code. This code is in a library somewhere that you should find and use, but it's also useful to look at what's actually going on so that you understand this is not really rocket science. For each code sample, I'm gonna show you the whole chunk of code at once. At first, it is going to be very tiny and those of you in the back are gonna be like, dude, but don't worry, we're gonna step through each in like three or four line blocks and you'll be able to see it. But I do think, just seeing, it's not really that much code in the grand scheme of things. So here is JavaScript code to generate a JSON web token. That's about 20 lines, only the last four are actually doing the work. The rest of it is setup code. So first we have a helper function to base64 encode a pojo and it just takes a JSON object, stringifies it, converts it to base64 and returns it. Very simple. We have another helper function that takes a string and a secret and then generates an hmax SHA-256 object, uses the secret to initialize it, sticks the string into it and gets the signature digest out. Again, very simple. We have here the actual data, we're gonna put into our JWT and the header and the payload are just the exact same data I had on the previous slides and then we have a secret, can just be anything, it just needs to be kept. Secret, just right there in the name. And then this is how you actually generate the signature. We're gonna use our two helper functions. We're gonna base64 encode the header, base64 encode the payload, take those two things, concatenate them together with a dot in the middle of them and generate an hmax signature from that combined string and then we're gonna stick all three of those things together, header, payload, signature, with dots in between. And so if you take this code and actually run it, you will generate hand roll about artisanal JSON web tokens that you can print out and it just looks like that. I have introduced line breaks after the dots but that's a valid JSON web token. The key part of JSON web tokens is because the signature is based on the combination of the header and the payload, any modification of the header and the payload invalidates the signature and validates the token. So I can generate this, I can give it to you, consumer of my API or whatever, require you to give it back to me as part of using my API and you can't change it. If you change it, it's gonna invalidate the signature. You can't generate a new signature because you don't have the secret, I have the secret. So that's pretty much, you can leave now. That's like we're done. That's the key, right? One other useful thing you will find on the jwt.io website is this little bit up in the header, it's probably too small to read, that says debugger, which is a nice web interface that lets you go backwards. It's a nice web interface that lets you paste in a JSON web token and it'll pull it back apart for you. So here, I've pasted in the JSON web token we just generated. You have to take my word for it that that's the same string. And if you're close enough to read that, you can see that it's pulling back out the same data that we put in, right? This is good. This is actually really super useful when you first start using JSON web tokens, particularly if you do some of the more complicated stuff I'm gonna talk about later. GWT also has, and these are all listed on the website, it has insane library support. There are JSON web token libraries for .NET, Python, Node, Java, JavaScript, Ruby, Perl, Go, PHP, Haskell, Ruby, Lewis, Scala, Clojure, Objective-C, Swift, and Delphi. Anybody in the room using Delphi? One guy. Generally speaking, in my experience, if you've got a technology that has Delphi support, it probably supports whatever platform you're using. There are no COBOL libraries yet. I had somebody ask me that once during this talk. I had to go look. There are frequently, for most of these platforms, there's more than one library. I think there's a 4chan77 library on there. So at this point, Sammy perked back up. Now that we're past the RFC reading stage, she's seen sort of how simple and elegant GWTs were. She started asking, how do I actually use these? So in this figure that I blatantly stole from JWT.io, you can see how you would use JSON web tokens in a kind of a basic standard authentication authorization flow. We have the client here on the left side, server on the right side, and you're gonna start out and you're gonna post to your login endpoint. In this particular example, user login. You're gonna include your username and password, and the API is gonna get that request. Authenticate the user, generate a JSON web token containing whatever claims you need, and send it back as part of the response. And then at that point, the client needs to take that token, and any subsequent requests to the API include the token with them. So every request to the API is gonna pull that token out, validate it, use the data in the token to help generate the response and send it back. So not a complicated flow. Then the important thing to note here is that blue box on the left-hand side, that doesn't have to be a web browser. It can be, it can be JavaScript code running in a web browser, but it can be a CLI script, it could be a mobile app, it could be a desktop app. It's just standard HTTP stuff. Something I'm going to emphasize several times during this talk is the header and the payload are not encrypted, right? They contain serialized data that is completely trivially reversible, right? If somebody has a JSON web token, they can see what's in the header, they can see what's in the payload. You don't want to put somebody's social security number in there, bad idea, right? But something like a session ID, something that would normally already be in a cookie, whatever, right? No harm, no foul. You are responsible for controlling expiration, token refresh, all that good stuff. I have seen some APIs, and there's no real rules for that. One of the simultaneously great and sometimes frustrating things about the JWTRC is they don't specify a lot of implementation detail about how these things are used. So I've seen some APIs where they send you a fresh different token along with every API response, and they expect you to constantly just be using a new token all the time. Or you can have a refresh endpoint that you implement and tell the client, hey, when you're about to expire that token, use your current token to get a new one. The other important thing, and I'm gonna mention a couple of times because it's one of the cool parts, is unlike a cookie, this is not subject to any browser control, same origin policies. This is not subject to any cores stuff. You can get a JSON web token from site A and turn around and give that JSON web token to site B, and as long as those two sites have made arrangements to share the secret, to validate the token, things work just fine. So this is an extremely lightweight way to do single sign on like things, which is pretty cool. Who's worked with SAML? Who liked working with SAML?  So how do you actually throw these tokens around? Again, the RFCs don't really specify how that works. You can do whatever you want. You can put it in the URL and a get request, just in line. You can put it in the body of a post, or a system that I quite like is there is a header that's in the HTTP spec called authorization, various schemes that you can use it for. One of them is the bearer scheme, and so you just have a header that says authorization, bearer, and then your token. You include that as part of generating your HTTP request. All right, so Sammy, as you're probably detected by now, is not really big on theory. She very much just wants to see some actual implementation. So this is the code, this is a chunk of node code for generating a token as part of an authentication workflow. Again, that's not a lot of code, that's like 20 lines of code. I pulled this out of an express app. So first we're gonna define a root for the user login endpoint. We're gonna point that at the user login function. We're gonna import a JWT library. This is an in-house, a very lightweight wrapper we use around the JSON web token library that you can get on NPM. I highly recommend JSON web token, it works really well. And then the first thing we're gonna do is make sure that we got sent an email and a password, because that's what we used to log in. And if we didn't get those things as part of the request, we're gonna return a 400 error. If we did get those things, we're gonna use the email to pull the user information out of the database. Then we're gonna instantiate a claims object. We're gonna try to validate the password. And if the password validates, we'll stick the user ID in the claims token. Otherwise, if it doesn't validate, well, you just fail to log in, here's your 401.  If we did make it past that, we need to sign that claim using the JSON web token library. And our secret in this particular code base is just inside that particular part of, it gets read from a config file inside that part of code.  You can name this whatever you want, right? It's just the client has to know it's gonna come back in this header. And then we return a 200. Okay, cool, so that's how you generate one. How do you handle subsequent requests where you need to validate it? And again, because this is express, the easiest way to do this is with a middleware. We can just load up a middleware in our express app. That's gonna get a chance to inspect every request that comes through, and we can make sure that it has a JSON web token on it. So we're gonna load up that library again. We're gonna instantiate a middleware, and we're gonna take the request object and put an empty JWT key in it, just to have a place to hold stuff. Sorry, this is a little bit too much code for this slide. The important part here is right in the middle, we're calling JWT.verify and giving it the token. And if that verifies the token, it'll return successfully, and we'll return that value, and it'll move on to the next step in the promise that I'll show you here in a minute. If it doesn't, it's gonna throw an exception, which we're gonna immediately re-throw. Otherwise, if we didn't even get an authorization header in the request, we'll throw an exception for that too. And I will post these slides online later and tweet it, so that if you wanna look at this code in more depth, that will be possible. If the promise successfully receives, we call the then, we get the payload passed in, which in this case, the library is just returning the payload object, decoded and ready to go. We stick that into the JWT slot on our request object, and we call the next function in our middleware chain, and we move on. At this point, we may go to the endpoint, we may go to some other middleware, but we've gotten the JSON web token, we know it's correct and proper, and we've decoded the payload. Otherwise, if there was an error thrown, we have this terminal error handler, we need to make sure that this isn't a request to log in. If you're trying to log in, obviously, you're not gonna have a JSON web token, and we need to let you through the door anyway. Otherwise, here's your 401, have a nice life. So at this point, Sam was like, okay, this is kinda cool. Like, I can see how this would be useful, I'll use this in some projects. But she was wondering if there was anything else JSON web tokens could be used for. This is the point where I, this is the thing that actually happened that inspired me to write this talk, because I thought this particular usage that I'm gonna talk about was actually really cool, and it is a solution for a problem that I feel like I've run into multiple times in the 10 or 15 years I've been getting paid to write software.  You can put no access control on it at all, you can just put it on the internet. The MongoDB pattern, probably not the best idea. Or you can implement a full user authentication authorization system, and then a couple of weeks later you can implement admin screens for it, because you get tired of directly doing SQL queries to deal with users, and it just turns into a horrible thing. Or you could use OAuth. I've never had a good experience implementing OAuth, server-side or client-side. Who's used OAuth, who liked it? Few people, okay, you can join the beer party later. So it would be nice if there was some middle ground, I feel, between a completely open door and a bank vault. I want a screen door for my APIs, right? I want to be able to set them up so that there's an API, and I don't want to just let anybody in, but I don't want people to have to authenticate either. And it turns out that there's a way to use JSON web tokens to accomplish this. So instead of using a symmetric algorithm to generate your signature, you can use an RSA public-private key pair for generating the signature in the JSON web token. And you generate the signature with the private half and you validate it with the public half, but the super cool thing is, there's a special defined header so that you can put the public half into the header of the JSON web token itself. Okay, so this is called JWK, JSON web key. It's a special format for defining, for serializing out the RSA key. And what this means is you can set things up so that your API client can generate a JSON web token all by themselves without hitting an endpoint on your API, without authenticating to your API. They can generate a JSON web token. You'll be able to tell it's from a valid user of the API and they'll be able to use the API. So to make this work, we have to give our authorized clients a key pair. We need to know the fingerprint of the public half of that key pair. We don't actually have to give them the key pair. We can let them generate the key for themselves. We just need the fingerprint of the public half. And we'll see why here in a minute. On the client side, they generate a JWT. They sign it with the private key. They include the public key in the JWK slot in the header. You need to make sure if you're going down this road that you have issued out an expiration, time claims in there as well. I'll explain why here in a minute. And then once you have this JSON web token, you just send it in with your API request. On the API side, we get the token. We pull the public key out. We validate the signature on the token using that public key. We generate the fingerprint of the token and we make sure it's a token we know about. It's in our whitelist. So at that point, we know that the signature on the token had to be produced with the private half of this key pair because otherwise it wouldn't validate. And we know that we have a whitelist fingerprint for the public half, so therefore, this token came from somebody who's authorized to use the API and we can continue processing their request. You need to look at the issued at time and make sure it's not in the future. You need to look at the expires time and make sure it's not in the past, obviously. Ideally, you will find a library that just does this for you. And again, nothing is encrypted, so you don't want to put anything sensitive in the payload or the header. Here's some client-side code for this. It's written in Perl. That's because this is what this project happened to be in. And again, that's not very much code. We're gonna start out and load up a couple of libraries to deal with cryptography stuff. We're gonna load up an HTTP request library and then we're gonna read in the private and public keys. Practically speaking, you probably shouldn't store these in the same directory as your code. You should probably have them in some sort of secret vault service. Then we have this single call to this encode JWT method from the crypt JWT library. We're gonna use the RSA 512 algorithm. We're gonna include some extra headers, including this JSON web key header that is coming from the public key. We're gonna use the private key to sign it and we're going to include in the payload an IAT claim that's the current time. And then one of the nice features of this library is it lets you say, this token that I'm about to generate has a relative expiration time. This is gonna expire a half an hour after it's issued. And it'll figure out the math for you. Both of those values should be epic seconds. And then we just make a new HTTP request, sending this to wherever, putting it in the authorization header. So that's pretty simple. The critical bit here is the extra headers part where we take that public key and export it in the JWK format. I spent about six hours writing this project. It's a very simple API. About two hours of it was figuring out that that needed to be in JWK format and not PEM. That's not really clearly documented anywhere. Older RSA libraries don't know from JWK format, but these RFCs are a couple years old. You should be able to find one for your platform that does this. On the API side, again, not a whole lot of code to handle processing this token. We're gonna load up those same libraries again. This API was written using a micro web framework for Pearl called Dancer. That's very similar to Sinatra, if you're familiar with that. We're gonna take and pull the authorization request header. It is Pearl, so I'm required by Union Rules to use one regular expression minimum. So we're gonna regex the bearer token out of the authorization header, and if we can't find it there, we're gonna return a 401. Then we're going to try to decode it. We're gonna do this inside an exception handler. We're gonna use the decode JWT method from that Crips JWT library again, and we're gonna give it the token. We're gonna ask it to decode the header. We're gonna tell it that only the RS512 algorithm is acceptable, and we're gonna ask it to verify the issued at and the expired claims for us. So this will make sure that the token wasn't issued in the future. This will make sure that the token hasn't already expired. If any of those things fails, so if the token doesn't validate if the issued at or expired claims aren't there, if it's not the right algorithm, it'll throw an exception. I don't have to even catch that exception, because if it throws the exception, there won't be any values in the header and payload variables, so I just checked to see. Did I get a header and payload? If I didn't, here's your 401. Here's a slide that tells you everything I just said. So all of this stuff is happening inside the library. I don't have to deal with it, and that to me is sort of the mark of a successful coding platform is stuff that I don't have to deal with. We also have to do a few more checks. We specify in our API documentation that tokens can only be issued that are good for an hour, right? So we need to check that. We also need to make sure that this isn't some random RSA key pair. I'll explain that here in a minute. So what we're doing here in this first line is if the expiration time is more than an hour after the time the token was issued, we throw a 401, because again our API documentation says don't issue tokens that live for more than an hour. The threat model with the screen door approach to the internet is if somebody manages to get a token, somehow they sniff it off the wire, whatever, somebody writes it down and puts it on a USB key, they'll be able to use your API until that token expires. Now this API for this particular project, I don't care, if you manage to steal a token and get to 47 minutes of access to the API, more power to you, right? You're not gonna be able to generate a new token after that. So we have to check that ourselves. We also need to make sure, so everything up to this point, right up to this point in the code, you could get to here with just some random RSA key pair that you generated yourself that I've never seen before. There is no check up to that point that the person who generated the token is somebody I know about. That check happens when you make sure that the fingerprint of the public key is on your white list. At that point you know, oh, this came from a good key pair. So that's what we're doing here at the end is just pulling that key back out of the header, generating its thumbprint, and making sure that's on our white list, right? So that's it. We know the public key was in the header. We know by its fingerprint that it's an allowed public key. We know the key validated, so it must have been generated with the private half of that public key. And if somebody has the private key, by definition they're an authorized user of the API. So we're good to go. This does of course depend on the client keeping the private key actually private. So for example, if your client was implementing a single page web app that was going to hit this API, and they included the private key in the big blob of JavaScript that they were shipping out to the browser, that's not really private at that point anymore. Not that that would ever happen. But the good news is that the revocation protocol for this is very simple.  There are other things that you can do with JSON WebToken that are more advanced than these two examples that I have given. There are ways to, the defined ways to encrypt the payload so that you can ship around sensitive information. I'm not gonna talk about that. There is an RFC for JWE that you should look at if you're interested in that. And it's also possible to nest JSON WebToken that's specifically spelled out in a very detailed and perhaps not overly exciting part of the RFC where basically you generated JSON WebToken and then you stick that in the payload of a different JSON WebToken. See those RFCs if you're interested in those things. In conclusion, I think JWT solves some really common problems that we probably all have as API developers and users. I think they solve them in a pretty elegant way that's much simpler and easier to understand than alternatives that do the same thing. I think that's pretty damn cool. And I think you should think about using them if you're not already. I'd like to thank the JWT.IO people and offo.com who is the people behind JWT. I am not affiliated with them in any way. I just think they develop something cool. I'd like to thank the organizers. This is the last session of the conference. So round of applause. This is the first time I've been to scale and it's a large impressive operation. I've helped put on smaller conferences and I can't even imagine how much work this is to do successfully and it's been pretty fun. And I'd like to thank you for sticking it out and actually coming to the last slot. I've pretty much been convinced since I saw I was in this slot that I was gonna have two people in my talk. So I'm glad there are more than two people here. I also need to thank my company because they pay me to work on this crap and they pay to send me here and they give me time to write these talks and we're pretty cool. We do stuff. If you need stuff done, talk to me and I'm happy to take any questions. Or we could all just go home. So JWT says there are two different algorithms to use. What are the differences between the two? In the validator you're looking at. So one of them is the HMAC SHA-256, one that I talked about first where you have a single secret and the other one is the RSA key pair one. And if you toggle that to the RSA key pair one, you won't be able to validate the token online, I think. I think the debugger really only fully supports the HS-256 algorithm. What we've done practically speaking is we don't worry about token invalidation at all. We just use the expiration time value and the client code is written. So the overall expiration time is picked as, sorry, let me back up a step. So we're writing this against the particular security policy and the security policy says sessions have a 60 minute lifetime, right? So when we generate a token, the expires time is 3,600 seconds later than the issued at time. The client code is written so that if at any point it sees a token or the TTL, the time to live, the remaining time on the token is less than half of the lifetime of the token, there's a refresh endpoint. And that refresh endpoint kind of works like a TKT and Kerberos, right? If you have a token, you can get a new token from that endpoint. So the client code just has a routine that fires asynchronously that just says here's my old about to die token and gets a new one. And then other than that, we don't track. We log the token in the database but it's just informational, like we don't invalidate them in any way, they just expire. Does that answer your question? If you're a bad guy and you've already gotten the token, we already lost in that particular instance. Because at that point, if you've gotten the token, you've already gotten everything that's in there and yeah, we're screwed. Right, have we thought about having the clients into secret so that we're sure there's not somebody, man in the middle, in the token request? No, I haven't done that. That might be, that sounds familiar and that might be one of the use cases in the RFCs for the nested JSON web tokens where you can basically, you can include an RSA encrypted web token in a signed web token but no, I haven't done any of that. I've only been using this stuff for less than six months. I just thought it was really cool and it doesn't seem to have gotten as much traction as I had hoped that it would but half the people in here use it so maybe I'm just wrong. Any other questions? Yeah, sure. So how does knowing the fingerprint help you know that the API user is legitimate? Okay, so we get the token, we validate the token. So here's the extra checks. So, up until this point, right, all that we know is there was a key pair out there somewhere and somebody took the private half and signed a JSON web token that included the public half because the public half that we're using to validate that signature we pulled out of the JSON web token we got. So that could have been just any old random RSA key pair. I need to make sure that the RSA key pair that's being used is one that somebody has told me, like, hey, we're gonna use this key pair. And the way that I do that is the fingerprint of the public key. I record that, right? And then when I pull the public key out, I just generate its fingerprint and make sure that it's on the list of allowed keys. Does that make sense? The client can generate the public private key, they just need to tell you the fingerprint. Yeah, yes, exactly. Questions? Thanks again for sticking around. I really appreciate it. I hope everybody had a good conference. I hope to see you next year. And thank you. Oh, and like I said, Jean Hack is my Twitter handle. At some point within the next 24 hours, I will put these on a slide sharing site and tweet about it. And I'll scale 15x tag it.


That's it. That's it. That's all you're getting after last week I don't have the willpower within me to even make a joke right now So no chainsaw today and a lot of you are actually worried whenever I hold it So for today only next week we'll get back to it But today I won't attempt to chainsaw a limb off my body because I need to see what happens And I think Machima is alive. That's my theory.  Okay from Kyoto. Let's do this now that I got that rant out of the way Shit man. Was she come back to life?  I'm watching chainsaw man. So It's about a chainsaw Dog that fuses with a man. Well, I'll call you later Cuz I'm gonna do this video and then I'll call you All right. Love you. Bye Finally, all right, let's do this man. I'm on the edge of my seat over here.     There we go again with chainsaw, man.   I preached about this on Twitter.  Only if you knew and then the chain Bro it got better the CG got better And a key to sit in there like like he's telling on he doesn't know what the fuck's going on denji He's just full crazy now. Oh my god.  Can she but but no, no, no, I can't do this This is how I'm a feel when attack on Titan comes back like I'm my heart's racing man Who is she talking to Bowser the final boss? Yo He doesn't know what's going on Why is she wearing short shorts?  Oh, no, I don't want to like her It's saying it's a pro that intro with so dope I'm so nervous right now This is my face. This is gonna be my face the whole episode. Isn't it? Is it me or did the CG get better? They were like, oh the real show starts now Actually, it's pretty much the same now that I look at from this angle But before before the yo at the ODOP came on I don't know what they were doing what drugs they were taking but that CG It's like they dumped a million dollars into it.  Mr. Beanie over here This guy's wearing a turtleneck with pistols.  Yeah The people's elbow we got the rock over here. Where's he gonna tombstone the next night?  I learned that from anime watch What oh wait, he's Denji is Denji See how excited I am. I'm not even overreacting. It's Denji. It's fine. I've seen how worse happened That's sticky like a chainsaw he grabs it by the head That's hard bro replace this guy's voice with anybody else's voice. It wouldn't be hidden that hard Oh That is Is he a cow? Oh, he was holding his hand. Oh my god That was hinting we meaning we can't we they can't win against guns that was foreshadowing. I believe my keepers not dead She's not dead. She's fine Is this we're not gonna come back No, man, they were shot in the head. This is sad. No, I don't play this OST man.   So so so something probably happened I need to know what happened though.  This makes her even more insane Oh She was hit The minute is her body still there. Does she like duplicate herself?  I've stopped my nose. I don't even want to blow my nose man I only want to get up. She didn't have to rip out then. She's hard to get to his heart So here are two new characters right here, and you know their main characters when they have scars on their face The side characters they have no Differences to them this guy you can tell me his business and the girl she's oh my god This is gonna be too too two new chainsaw milfs and she's tall.  You're gonna go to Rikers Island Give me the 30 predators and let's let let's use them as bait. You can use my ex consider her an inmate Yeah, man, I mean walking around New York. You'd be fine. Nobody would look twice people walking around with blood on their clothes I went to the hospital a guy walked in crawling in like like This And nobody looked twice. I kept reading from my phone. I was looking up like an article bad man. Are these the inmates? Yeah, let's fatten up the inmates. I need to know what they've done like if they just drug deal whatever But if they're like creditors to some shit, I'm gonna applaud every time they die We couldn't see the whole scene Chainsaw man, you're letting me down It reminds me of like Hanji or the girl from jujitsu kaizen. What's her name? Miss Maki ma so called on a mister. I don't know what she is anymore man.  It looks like he just came home from the Bronx There's anybody die in the show He didn't say Oh My god, I came to pretend to have a deep voice like that. I think I found my new favorite character I love him Katana, man.  My god the birds are here. Yeah, I keep still on a roof. Oh, what did you sleep in there?  Oh my god. Wait. This was in the ending.   I've heard a break is someone's back Wait a minute man, she's like she blindfolds people tells them to say your name and that what is she that the human death?   We really just begun Are they dead? Are these people dead like she sacrifices them? Man So it's like a sacrifice You Are psychotic And it turns me on It's another day for makibo. You see how she's walking the streets now.  Now she's anime running. Did somebody give her a devil fruit in the time?   She's so annoying Oh, I dare you to sell it out. All right. Good. They're safe. I like those two people They better be they're gonna be coming back bro.  Oh my god All right I'm all in for go benny. I'm all in for her I need to know The chainsaw man author author I need to meet him and I need to verify that he's a human being Or is he really part of this universe?  I have a headache from the screaming and many heart attacks. I'm having He protect like like like like like he got shot and then he protected her and it took that second bullet Like man, I feel bad for anybody that doesn't watch this You gotta go to the graveyard for that. I'm quitting when I see her again Oh my god. Don't you understand what that means? She's never quitting Unless she sees her in the afterlife You see what I mean about this show is just something else man, tokyo I'm going there to march. Am I gonna see makima greet me from the plane? Why are you smiling? Makamakamokaba I forgot about the gun devil.  Is he a gun? Like you have a chainsaw man.  Wow She's in control of everything This dude says so makima is like ilan musk and this guy was like twitter employees. He's like here I'm not gonna be on the twitter with ilan musk in charge So makima's musk ilan musk confirmed. I'd buy a makima car.  Look how she walks.    I'd never decline her One week I asked for one week Of a week episode. That's it. Just an episode where i'm like, oh It's not that bad But episode 10 is gonna come and i'm gonna see tweets chibi reviews himself is gonna say you're not ready When will I be ready? Am I ever ready and even when i'm ready?  Now I understand I'll quit when I see him and her again like like stuff like that. It's so beautiful writing Oh my god, and the music dirty episode Don't get me started on the scene before the the the opening came on Dive all in the name of devil that was so good Oh god, I wish it continued, but then I get copyrighted and I actually get mad But i'm gonna watch that scene again. I'm gonna watch over an episode again. Ah, he's still on the roof Are we gonna stay on that roof for the rest of the season because we got to see how he's feeling about this He was just stunned. He didn't care what was happening He didn't care if if if Glock a devil came if if a bat devil and satama devil came He would have still been in awe. I don't blame him, man We would the audience is our key.  I'm precious. I don't love you because this was just phenomenal Nick you don't know enough about anime to say that I know enough about Storytelling to say that okay.  Absolutely amazing And now makima You just add another layer answer. No, no, no, no, no, no, no, no, no They answer 10 questions and give you 55 more questions So in the end are you do you have any answers? You know what I mean? I got a lot. I got a lot to think about bye


Hello everyone, my name is Dr. Haroon Meeram Reddy. I am a consultant paddock surgeon at Manifold Hospital, Whitefield, Bangalore. This video message is to let all our patients know that we have commenced all our OPD and elective procedures and surgeries in full-flow after the lifting of lockdown. When the patients visit us, the patients as well as the attenders who come with them are screened by thermal screening, non-tactile thermometer screening at the entrance, followed by hand hygiene practices.  All the social distancing norms are enforced and followed properly. And there is frequent cleaning of common areas so that patients are not subjected to unmetting contact with possible asymptomatic areas. Even in the OPDs, after every patient visits, the room is cleaned so that the next patient and the relatives come. They are made to feel safe and the doctor also wears on the protective equipment while seeing every patient. Some patients will have doubts that that may not require them to be present personally, but they still want to know how to go about it and follow up. For such patients, we have encouraged more of videos and presentations so that their needs can be met and they don't have to subject themselves to the risk of viral transmission. And then when it comes to operation theaters and procedures, cardiac surgery has emergency services have always been going on even through the lockdown. But now we have opened up all elective surgeries for adults which will include bypass operations, valve operations, for congenital problems, lung problems, all these things we have commenced like we were having before. So and in the hospital, operation theaters, all the infection control protocols have been intensified and there is more strict precautions being taken in light of the pandemic that is grouping up and presently. So all the operating staff which include the surgeon, anesthetist, operation theater technicians, all of them wear protective gear and even the anesthesia machines and ventilators and laminar airflow systems that are present in the OP all have been revamped and made relevant for the present pandemic. So during the lockdown, there have been so many patients who were not able to travel to avail the treatment that they required. So now we have made this video to let them know that they can come to us if there is something that needs our help and we will be glad to help.


In 2019, it was reported that Vanessa Hudgens purchased a new home in LA's historic Los Filos area for about $5 million. This vine-covered colonial estate was built in the early 1920s and has a Hollywood history of its own. Prior to this enchanted mansion, Vanessa lived in a stunning Mediterranean residence in Studio City, which she sold in 2019 for $3.15 million, and to date, we're gonna check out the actress' home. In these videos, we don't reveal any addresses, and even though I've done a house tour of my own place, please do not show up at any private residences because it's not safe for anyone. Vanessa Hudgens is an actress and singer best known for her role as Gabriella Montes in Disney's high school musical film series from 2006 to 2008, which brought her mainstream success. Considering how well the first film did, it led Vanessa to land a recording contract with Hollywood Records, releasing two albums in 2006 and 2008. At the time, the high school musical days may be long behind her, but she's amassed an estimated net worth of about $16 million. Hey guys, it's Kara The Vampire Slayer back with another exclusive house tour here in Femus Entertainment. You guys requested this one, so we're looking at the homes of Vanessa Hudgens. Don't forget to like, subscribe, and hit me up on Instagram to chat. Now let's get into this video. In 2019, after already settling into her current crib, Vanessa sold her former home for $3.15 million — a definite cut from the $3.85 million she was hoping to get for it. Either way, the star purchased the home hot off her Disney success back in 2008 for $2.75 million. While Vanessa's former house looks like it belongs tucked away in the Mediterranean somewhere, it's actually situated in the Los Angeles entertainment area of Studio City. During her decades of ownership, Hudgens did make a few changes to the home, including repainting the exterior in a bright white and adding moreish-style decoration and touches throughout, including Moroccan lamps. The three-story, stately mansion boasted 5,200 square feet of space with six bedrooms and 6.5 baths. From the outside, Vanessa's former home was elegant already, with a fresh paint color, curved staircase, arch windows, and balcony. There was also plenty of lush greenery out front, such as towering trees, vines, and more. The small front porch and carved wooden door opened up to a double-height entryway with floating raw iron staircase, setting the theme for the impressive rooms to come. The bright and airy living room had a mix of contemporary and traditional, with red armchairs framing tall glass doors, which opened to the lawn. There were rustic hardwood floors with a natural beige rug over top, adding warmth as well as a long white sofa flanked by antique table lamps.  From one perspective, you can see the luxury dining room through the detailed archway with intricate gold ironwork. One focal point here is definitely the glowing brass ceiling with Moroccan-inspired lamp, all of which is contrasted with a modern table and chairs. This high-end kitchen was equally impressive and full of notable elements. Cabinets were decked out in a mix of white and jade green, while floors were made of unique burnt orange terracotta tiles, adding to the Mediterranean vibe of the home. To round out the kitchen, there were coffered ceilings, designer appliances, and a casual dining space with windows looking out to the San Fernando Valley. The attached family room boasted yet another fireplace with built-in media cabinets and full glass doors opening up to an outdoor dining terrace. Elsewhere in Vanessa's mansion, there was a black-walled home theater with a widescreen projection system. The en suite guest rooms on the upper level were joined with Vanessa's former master suite. This sprawling space was divided by a thick wall featuring a welcoming fireplace set in tiles, with the sleeping quarters on one side and the sitting room on the other. The windowed sitting area looked perfect to use as a reading nook with amazing city views, while other master retreat features included a luxury en suite, walk-in closet, and private balcony. Finally, moving outdoors, Vanessa's backyard was built for entertainment and enjoyment. There was an irregularly shaped swimming pool and spa built in a lagoon style, also boasting a waterfall, as well as surrounding lounge chairs to sunbathe. Multi-level terraces round out the yard and were decorated with string lights, lush plants, and plenty of shaded areas. While her studio's city estate was no doubt beautiful in 2018, Vanessa moved to the historic and trendy Los Angeles neighborhood of Los Feliz, snagging her current home off of actor Gary Oldman for about $5 million. Built in the early 1920s, the vine-covered colonial abode has quite the Hollywood history. It was built by director Cecile B. DeMille to house his alleged mistress, silent film star Julia Fay. During Gary Oldman's more recent ownership, he installed 18th century wooden floors. The walled and gated corner mansion checked all of Vanessa's boxes. While showing off her home to architectural digest, she explained, I wanted an old home, to me there's something so romantic about that, a home with character and quirks. I love the old Hollywood elements, the art deco air vents, the chandelier over the staircase, the yard that feels like a park. I love the old Hollywood elements, the art deco air vents, the chandelier over the staircase, the yard that feels like a park. The property wasn't listed on the open market, but Vanessa did recently give a tour of the home in October 2021, and records show it spans 3,168 square feet of space with three beds and four baths throughout. The Georgian colonial also retained many of its original features, adding to the character and class of the place. Situated on half an acre of land, the estate boasts a separate one-bed one-bath guest house on top of a two-gar garage. Vanessa reportedly spent five years searching for this dream home before she found it. She admitted, There were so many things about it that struck me. Walking through the gate and seeing this house covered in ivy surrounded by olive trees, it was like I had been transported to France or Italy. It felt like such an escape. While Oldman made some changes to the home during the time he lived here, Vanessa went on to make some of her own. She even enlisted the help of her former high school musical co-star and friend, Ashley Tisdale, to make interiors exactly how she wanted. That included getting new marble, painting the cabinets, and other little details in the kitchen. Her kitchen boasts stainless steel appliances and plenty of windows letting in natural light. Meanwhile, in the breakfast nook, eye-catching House of Hackney wallpaper meets a 1950s pendant light and a leather banquette custom made for the space. Vanessa's living room is cozy with French doors leading outside as well as a fireplace, piano, and plush furnishings. Main floor living spaces open to the expansive terraces outside and have an easy indoor-outdoor flow. While Vanessa took on the kitchen redecorating herself, she hired interior designer Jake Arnold to remodel the master bedroom. Her room is quite simple with quilted coverings on her bed, but the attached bath is another story. Vanessa opted for a dark cave vibe in her master bathroom. It boasts smoothie dark walls and a deep ceramic bathtub situated in a windowed nook along with a separate shower stall and vanity. Moving outside, Vanessa also added her own thoughtful touches back here. There are plenty of expansive terraces surrounded by stunning gardens to one of which the star added a long table to host alfrasco dinners. She also has a small citrus grove including two massive grapefruit trees and elsewhere an avocado tree. The serene retreat offers a pool and spa as well and Vanessa says about the yard, all the limestone tile, the plants, the foliage help make the grounds feel like something out of a European retreat. Finally, the guest house is where Vanessa and her friends end up hanging out some nights to watch movies and it's been transformed into the ideal space to do so. Alright, so I think that wraps up our Vanessa Hudgens house tour. We not only saw her current French-style mansion Los Feliz which she's no doubt proud of, but we also checked out her former Studio City mansion. While her current historic dream home was redesigned perfectly, I actually liked both of the actresses' properties. Out of the two, which would you prefer to live in? I think her latest home has slightly more character and history, so I'll say that that one is my fave but it's definitely a difficult choice. Be sure to let me know your thoughts on Vanessa's homes down in the comments. Thanks for watching, don't forget to follow me on Instagram if you want to chat and I'll see you all in the next video. Bye!


What's going on, YouTube? My name is John Hammond, and we're back with the MITRESTEM CTF, looking at the next 100-point challenge in the Linux category. The challenge title is January 8th, 2014. It says, all you need to do is read the flag, and we're giving an SSH connection. So, all right, let's fire this up, get a terminal open, and let's make a directory 100, Jan 8th, 2014, Jan. Let's make a connect script just for good practice. Literally, just pasting it in here. Why not? I like to do it. I don't know why. So, once we are connected, again, you might need to hit yes for the first time you're trying to get through. There's nothing in this current directory, which is odd. Looks like we want to read root flag dot text, I'm assuming, from all the other previous challenges. We are unable to do so, however. If we check out the permissions on that, it is probably owned by root and only readable by root. Looks like it won't even check that. Cool. That makes sense. So, what have we got here to work with? We can echo path. Looks like we have been again to work with, but if we were to create new binaries, it would just be working with our privileges, so that didn't help us. That would just create commands for us. I like to use set to see all the variables in case there's anything else interesting in here. So, you basically want to do the regular enumeration that you would do in the first time you got in a box. In the hack the box EU mentality and mindset, you can totally use linenum, linenum.sh. If you haven't seen that before, RebitUser, that's a pretty great script. I like it a lot. I would absolutely recommend using that if we could get something in there, but kind of the takeaway that you'd want to just pull from it is that you immediately want to know what can you run as root. That's at least in my mind the first priority that I have when I get on a box. What can I do as sudo? Is sudo on the system? Can I even run stuff as root? So, sudo tack L will list the things you can run with the super user. Super user do. And it says user CTF may run the following commands on this machine. Without a password, you can run as root VIM with whatever file name here. That's fine. That just means we can sudo VIM. It means that we can't sudo VIM that command, like simply sudo VIM, but you can sudo user bin VIM, home CTF, blah, blah, blah, hack me too. That is kind of just a little bit of a distraction in that, oh, you'll be like, oh, this file doesn't exist, but that command solely is what we can run with sudo. So, I wouldn't be able to run sudo that without a password just like I'm doing, or sudo that anything because it needs to be strictly that command that we've seen in sudo attack L. So, don't let that confuse you, but sure, when we open this up, it'll be like, hey, that file doesn't exist. That doesn't matter. We're still inside VIM right now, so we can do a lot of cool things because VIM has got some neat tricks to break out of VIM or run commands or run shell commands within VIM. With VIM VIM, looks like it has some exclamation point stuff. That will run last command from history or all into the current buffer. You can run commands like that. You can just like run bash even, and I've shown this before and I think some other videos, but run bash, bash shell. I'm trying to see if it'll get the current, the syntax that I'm looking for just so you can find it online, but oh, looks like they've got it. I don't want it. If you run just shell or sh while you're in the editor, you'll be placing an interactive shell, and if that doesn't happen, like if you just type .sh or .shell, it doesn't give it to you, you can set shell like a variable, like if for some reason that's not set, you can set shell equal bin bash, and then you can just straight up run shell and it'll get you back to that root shell that we were just in. So, now we're root, right? Because we've escalated our privilege. We were running vim as root, so now that we've executed bash through that, we are now root. So, let's check out the root flag, and we're done. That's it. That was the challenge. Not too difficult, but it needed the narrow point of pseudotackl. What can I run as root? That's literally all you needed here. So, let's go ahead and grab this flag. If you wanted to take note of that, I'm gonna have to quit out of vim. So, if you need to quit out of vim, it's colon lowercase q exclamation point, so that force quits without saving. Like w would be to write. I don't care. You guys don't need to know that. You already know. You're already all smart. So, if you wanted to just jot down a solution, pseudotackl run vim shell and then cat reflag.txt. As the given command from pseudotackl. That's also important thing to note is that it needs to be strictly what pseudotackl tells you. Even if that file doesn't exist, that's totally fine because you just need to be able to run vim without a password, because we wouldn't know the password for root otherwise. All right. That's that. That's that challenge. Not too hard, but good to know. So, let's mark that as complete.  So, that's fine. Just know the mentality. Just know that methodology and you have gotten the moral of that CTF challenge. So, hey, thanks for watching, guys. If you like this video, please do like, comment, and subscribe. We have a small discord server. That's what I played the CTF with, and we always do for lots of other cap competitions, right?  And there's a highlight reel coming up pretty soon, hopefully. I don't know. We've done that before for Xmas CTF, and I recorded while we were playing this. So, it's a lot of fun if you want to come join the community. I highly encourage that, and I'd love to see you there. I do have a Patreon if you'd like to support me, as well as a PayPal. I am super duper grateful for each and every one of you that does. Thank you so much. But that's enough of me talking. Hope you guys enjoyed this. See you later.


Hello and welcome to the session in which we would look at solvency ratios. This topic is part of the financial statement analysis, part five of seven. In part one we looked at the introduction of financial statement analysis and part two we looked at horizontal, vertical and common size. In part three we looked at the liquidity ratios and part four we looked at activity ratios and in this part, part five we look at the solvency ratios. The solvency ratios are similar in concept to the liquidity ratios except they measure the ability of the company to pay off its long term debt. So on the long term, can you pay off your long term debt? Can you survive long enough? Do you have enough ability to survive long enough? Can you handle additional borrowing? This is what the solvency ratios are measuring. There are a few ratios we're going to look at and it's going to be the same concept. We're going to go to the balance, we're going to go to the excel sheet and look at the figures, compute the numbers and try to make sense of them. Once again we are looking at this balance sheet and income statement and this balance sheet can be found on farhatlectures.com. So let's take a look at our solvency ratios and try to make more sense of them. Let's take a look at the first one which is called the debt ratio and it's computed by taking total liabilities divided by total debt. Now to understand the debt ratios or the solvency ratios, it's very important to understand the concept, the basic concept accounting equation which is assets equal to liabilities plus equity. So let me show you what does that mean. If you have $100 in assets, 40% is that, 60% must be equity. So assets equal to $40 in liabilities plus 60% in equity. Now the debt ratios show you the proportion of your assets that are financed by debt. How much of your assets financed by debt? For example, this example here, we have 40 out of the $100 is financed by debt. It means the debt to equity ratio, debt to asset ratio is 40%. Well, is this good? Is this bad? Well, here's what we can say about the equity, about the debt ratio. The higher the debt ratio, the higher the proportion of your assets financed by debt. What does that mean? It means more debt and this theme is going to reoccur again and again in this session. The more debt you have, the riskier you are as a company. The lower is the flexibility. It means you cannot borrow additional money if needed because you're already maxed out or close to maxed out. In some companies, they might have, for example, a ratio of 80 or 90%. For example, airline companies, most of their assets are financed through debt. Their airplanes are leased, which is a form of debt. It means if we have a lot of debt, it means we are relying less on equity. So let's assume in this example, we change this to 80% liabilities in 20% equity. Now it's 80%. It means 80% of your assets are financed through debt. Now, for the company that we have, we can take a look at the last two years and see what's happening here. Just to get an idea. If we take total assets divided by total liabilities for year one, it's 0.54. It means for every dollar we have an asset, 54 pennies are coming from liabilities from debt. Now, is this reasonable? As an auditor, you have to ask yourself, is this what we expect in this industry? Is this what we expect from prior years? So the auditor will always come with an expectation. And if the expectation is to have 0.4, then something happened. There somehow they're having a lot of debt. If the expectation is 0.7 and what we're seeing here is 0.54, then we have to question this. Are they hiding any debt? What happened? Did they pay off the debt? And if so, how did they were able to pay off the debt? Or are they hiding? Is there any debt that's off the balance sheet that we can't see anymore? But if we compare those two companies from year to year, it's pretty stable. And that's the good thing about ratios. When you have multiple years, there should be some sort of a relationship between the years. So if it's stable and if there's no reason for those ratios to change, then any change will draw attention. It means take a look at this. It might be a red flag, need further investigation. The equity ratio, kind of similar to the debt ratios, and you're going to see they complement each other, is total liabilities divided by total equity. If we remember this example, when we started, we said 100 and assets, $40 finance through debt. It means the remaining through equity. So if we take 60 divided by 100, our equity ratio is 60%. Again, what does that mean? It means 60% of our assets are financed through equity. Now, bear in mind equity could be retained earnings. Equity could be common stock. Equity could be preferred stock, so on and so forth. But the point is 60% coming from equity. Well, do we like to have more equity or more debt? Depending on your risk tolerance, if you are a risky company, if you like risk, you will take more on debt. That means more risk. Why? Because debt, you have to pay the interest rate, whether you are doing good or not. And that's why debt is risky. When you rely more on equity, the equity holders are willing to wait if the company is not making profit because they're the company themselves, so you're under no pressure. So that's why higher equity ratio means more flexibility for the company because if an opportunity comes and you need to borrow money, now you have less debt relative to your asset. Maybe lenders, maybe bankers can lend you the money. And notice here, if we look at this company for year one, it's 0.46. And notice it's no coincidence that if we add 0.54 plus 0.46, it gives us 100%. It means this company, the one that we are working with, 54% of it is financed through that, 46% of it is financed through equity. And notice in year two, we relied less on that. We went down 2% on that. And we relied more on equity. And that 2% went to equity. So it's very important to understand this. And debt to equity and equity ratio should be pretty straightforward. At least I hope you understand them. Before I proceed, I would like to remind you whether you are a student or a CPA candidate. You take a look at my website, farhatlectures.com. I don't replace your CPA review course. I don't replace your accounting course. I'm a useful addition to your accounting education, to your CPA exam. My motto is saving accounting students and CPA candidate one at a time. Invest in yourself. This is a list of my course catalog where I have lectures, multiple choice, true, false, about intermediate accounting, advanced accounting, governmental accounting, basic accounting, managerial, so on and so forth. My CPA material is aligned with your Roger, Wiley, Becker, Gleam, so on and so forth. So it's very easy to go back and forth between my material and your CPA review course. I also give you access to all previously AI CPA released questions. And that's 1,500 of them with detailed solution. If you have not connected with me on LinkedIn, please do so. Take a look at my LinkedIn recommendation. Like this recording, share it with others. Connect with me on Instagram, Facebook, Twitter and Reddit. I'm going to go from the equity ratio to the equity multiplier. And if you notice, all what we did with the equity ratio and the equity multiplier is we flipped the numerator and the denominator. What does that equity multiplier means? How do we interpret this? So let's start with an equity multiplier. Let's assume we have a company with $100 in assets equal to zero liabilities plus 100 in equity. It means this company is 100% finance and equity. So if we compute the equity multiplier, we'll take 100 divided by 100 equal to 1. Well, what does 1 mean? 1 means everything is coming from the equity shareholders. Because to find what's coming from the debt, we'll take the 1 minus. We always subtract 1. It means the other part of the company and it's going to give us 0. So let's use some numbers. Let's assume we have $100 in asset. And let's assume for the sake of illustration, 75 is coming from equity from debt and 25 from equity. Assets equal 75 of liabilities, 25 debt. Now, let's compute the equity multiplier. It's going to be 100 divided by 25. And that's going to give us 4. What does 4 means? Well, 4 means for every time, if you want to look at it from a dollar perspective, for every dollars we raise, if we subtract 1, 3 coming from debt. So for example, if we raise $4, if we have $4, 3 coming from debt, 1 coming from equity. And the higher this number, and the higher this number, the more leverage we are. So let's assume we have $100. Let me just go to the extreme, $90 from debt plus $10 in equity. Now, 100 divided by 10 equal to 10. It means every time we have $10 to work with, $9 is coming from, oh, I do subtract 1 to come to the debt portion, $9 is coming from debt and $1 is coming from equity. Now we are really, really highly leveraged. It means basically we control, like the owners have practically not zero risk. They're taking a lot of risk, but they're not risking their money. Yes, there's a lot of risk in running a company with a lot of debt. But who's going to carry the bag if in case anything went bad? The debt holders, they invested most of the money. The company is highly leveraged. So this is what the equity multiplier is. The higher it is, the riskier is the company. It means we are relying on that. Now, if we go back here and look at debt to equity ratio, it shows us the structure. Basically, again, if we go back to 100 equal to 75 using this 75 and 25. And what we do is we, if we take 75 liabilities divided by 25 of equity, we got 3. And what did I tell you? It tells us how much the debtors are bringing to the company. All we have to do is notice, 217 minus 1 equal to 117. For this company, what's going to happen? For every $2.17, the debt holders are bringing $1.17. For the 4, when we had the equity multiplier 4 for every dollars minus 1, the debt to equity will be 3. That means for every dollar we bring in equity, the debt holders are bringing 3 to make that $4. So 3 from the creditors, one from the equity holders. And the more you bring from the debtors, the riskier is the company. But again, the higher is the return for the equity holder. Now, why are we talking about all of this? Well, again, from an auditor's perspective, if there is anything unusual, if the company can't highly leverage, this is important for the auditor. High leverage means high risk. High risk means more pressure on the company to fudge the numbers. So the higher that risk, so if you see these numbers, if you see debt ratios is increasing, if you see the equity multiplier is increasing, well, the company is coming under financial pressure. You have to pay a little bit more attention to that company. The time's interest earned is basically computing, taking income before interest and taxes and be careful income before interest and taxes divided by the interest expense. Let's start with some simple numbers. Let's assume our income before interest and taxes is 10, our interest expense is two, the answer is five. How do we interpret this number five? It means our income, our earnings, before we pay interest and taxes can cover our interest expense five times. Now, generally speaking, we want this number from a investor's perspective, creditors perspective, especially creditors perspective, also investor because you have to pay the creditors first. We want to be this as high as possible. This is basically a degree of protection. The higher, the better. So if you only had $1 in interest expense and you have earnings before interest and taxes of 10, then this is equal to 10, it's higher. The higher, the more protection. Again, how do you use this? If this number, you would have an expectation walking into the audit that this should be seven. You computed the number at 7.98. Well, it's a little bit higher than seven, but it is within seven. But if the answer was six or the answer was five, then they have less protection. We need to know what's going on. Just FYI, or if the answer was 10 for this company rather than 7.98, what's happening? Are they reducing their interest expense and increasing their income? Are they playing with the figures? So on and so forth. Now, the good thing about interest expense, it's easy to compute why? Because as long as you know how much that the company has, you can estimate the interest expense because based on the loan balances and the interest, you could compute interest expense. And you would compare interest expense to income before interest and taxes to come up with some figures. And hopefully that figure is close enough to what the company is starting with. Again, you're gonna audit everything. But at the beginning, if something is out of unusual and unusually abnormal, then you can focus on it. It seems here that's between eight and nine their times interest earned. If this has been the trend for the past five, six years, then it means that's what they're trying to keep. If this is not what the trend, you need to understand why. So those are the solvency ratios. What should you do now? Work multiple choice questions. Go to Farhad Lectures, subscribe, work multiple choice questions, download the Excel sheet and play with it. See how the numbers are working. So just change the total asset to see how the equity multiplier will work and see how debt to equity ratio will work. Good luck, study hard. And if you're studying for your CPA exam, it's worth it.


How can women be equal in society if they don't control their own bodies? People across the U.S. have been organizing regular protests and demonstrations since the Supreme Court struck down Roe v. Wade, robbing people of the federally protected right to an abortion. The ruling permits the right-wing lawmakers that control several states to eviscerate abortion rights. These states have a combined population of hundreds of millions, many of whom are black, Latino, or other racially marginalized people. Many states have already enacted abortion bans of various degrees of severity, and many are likely to do so in the coming days and weeks. 58 million women are not going to have access to abortion in their home states in a few days or a little bit later. The trigger states and the ones that are close to being trigger states. And even women in states where it's going to be legal, it's going to be an influx of people from other areas, and it's going to be very difficult and create huge anxiety, and difficult economic, social, political, and emotional situations for people, women, and others who can get pregnant. Not having abortion affected the entire class and the entire population. Especially the working class, because women who had the means could always get abortions. The lack of abortion will do is that it's going to increase maternal mortality. The number of women who die within the eight-month-a-year period after giving birth. And most particularly, black maternal mortality.  Making women come to term, carry a pregnancy to term, giving birth is 14 times more dangerous than having an early term abortion. And for black women who don't have a decent medical care, who are subjected to racism in the medical arena, and who are subjected to the wear and tear of racism everywhere, which creates an unhealthy situation, more going to die at greater rates. With the overturning of Roe, people in a dozen states have immediately lost their right to an abortion. This is due to trigger laws that 13 of the 50 states in the country have passed since the Roe decision. Trigger laws are legislations which are not immediately enforceable, but can be enacted given the right change in circumstances. Now that Roe no longer applies, the trigger laws in 13 states can be triggered and take effect automatically or by quick-state action. Some states have abortion bans that are a holdover from the pre-Roe era, but were never taken off the books. These can also come into force again. Others like Oklahoma and Texas had already enacted highly controversial abortion bans in the past two years. In 2021, Texas banned abortions after six weeks before most people even know that they are pregnant. In 2022, Oklahoma essentially banned all abortions by prohibiting abortion after fertilization, potentially threatening contraceptive access as well. This patchwork of laws creates a deeply unequal distribution of abortion rights in the country. In the wealthiest states by poverty levels such as Vermont and Massachusetts, abortion will remain legal. In states with the highest poverty levels such as Mississippi, Louisiana and West Virginia, abortion will be or is already outlawed. Many of the states with the most vicious anti-abortion laws also have the highest concentrations of racially oppressed people, such as former slave-holding states in the deep south. But the people are fighting back. There is immense anger against the Democratic Party, which has failed to protect people's reproductive rights, despite being in the majority in the Congress and occupying the post of President and Vice President. Biden made a statement, but it was of the mildest nature. He didn't say he was going to do anything. And he actually cautioned. He didn't want to see any violence. He said, stay calm.  People will die from this. And the fact that you can't control your own body, what kind of a violence is that? Pretty being perpetrated on you. But he put the onus of violence on those asserting their right and protesting it. Biden could suspend it. Lawyers are saying now that Biden could suspend that, but he hasn't done it. Movements and legal organizations have highlighted several federal actions the government can take to ensure continued access to abortions. This includes using federal land to open abortion clinics, declaring a national public health emergency, taking steps to codify abortion rights into law, etc. Until now, the federal government has not moved to act on any of these steps. People are continuing to mobilize on the streets to express their outrage, even as they face repression and violence by security forces. Apart from mass demonstrations, people are organizing reproductive health funds and networks to provide abortion information and services to those in need. Health and civil organizations, particularly Planned Parenthood and ACLU, have filed lawsuits in multiple states against the abortion bans. In the states of Kentucky, Louisiana and Utah, judges have temporarily blocked the trigger bans and allowed abortions to resume. It's an issue of all reproductive rights. So I think we have to fight on every level together for abortion, for housing, for nutrition, for the right to all kinds of medical treatment. So I think we need to tie these together and not stop.  So here we are fighting for abortion rights. We're fighting mass incarceration. We're fighting for the right to tell the history of slavery in the schools. We're fighting for LGBTQ rights again. And we're fighting endless war. And we have to fight capitalism and sweep it in the dustbin of history and replace it with socialism, a system for the people.


Okay, this is not necessarily a fair comparison, and I'll tell you why in a minute. But I thought I'd look at how a lower price range Pacific Northwest boot might compare to a quality made in China boot from Grandstone. Let's take a look. G'day, welcome to Bootlossophy, and my name is Tech. I acknowledge the traditional custodians of the land and waters I live on, the Wodger people. Today, I thought I'd look at a comparison between the White's Fulton Mocteau work boot and the Grandstone Mocteau field boot. One is made in the famous Pacific Northwest Bootmaking Center, and the other, from an American direct-to-consumer company, is made in China. It's not a totally fair comparison, because I chose a mid-US $300 White's Goodyear welted boot, and not one of the handmade rolled-welt boots. One is made as a work boot, while the other is a casual boot made in the style of American heritage East Coast hunting boots. But at the same time, they are in the same ballpark, because the comparison is between two Goodyear welted boots at the mid-US $300 price range. And in that sense is a closer comparison of value and quality within the same type of construction and price, if not the whole brand. Now before I start, let me be clear that I'm not going to see this from any political or jingoistic viewpoint about the land of the free and the brave versus a communist regime, but only in terms of quality and value of the product. This is the Fulton Mocteau work boot from Whites. A company that started in 1853 went for three generations of the Whites family right up to the 1970s, before selling to other people, and now is firmly established as a Pacific Northwest quality bootmaker since the turn of the 20th century. They are famous for making tough logging and firefighting work boots, and my favourite service boots, the MP boot, take a look up there, with their hand-stitched famous rolled-welt construction. Their handmade boots sell for US $600 and upwards. Recently they've been releasing lower-priced Goodyear-welted boots like their Mocteau peri boot, which I think was one of the first, which fall in between lifestyle and work boots and boots like the Fulton over here, which is more in the work-boot category. The Fulton is a taller 8-inch Mocteau work boot on the Whites' 1972 Archeese Last and sits on a Vibram honey-lug sole. It sells for the mid-300s, make possible I think by the faster Goodyear-welt construction. This boot is Grant Stone's Field Boot. Now Grant Stone started in 2016, and through long-term links of the founder's family to a factory in China, make their boots in China while headquartered in Michigan in the US. Their Keystone model is the Diesel Boot built on their Leo Last, which is also used to make up several other models like the Edward and the Ottawa. Grant Stone was set up as a director-consumer company and hence able to cut out middleman costs and undeniably, despite the use of top-grade American and international materials in the uppers and the soles and the other components, undeniably also benefits from the lower cost of production in China. What has set them apart has been the obvious quality control systems and procedures embedded in the manufacturing. First, let's take a look at the similarities. They are both high-volume mock-toe boots. By that I mean that first, their construction mimics the moccasin construction of American First Nations footwear. But unlike makers like Rancourt and Russell Moccasin, they are lasted from the top down rather than from the bottom up. They do not have a bottom piece that wraps around the bottom of your feet. Both of these have the vamp mock-toe stitch made by sewing the side walls to the vamp piece with that typical mock-toe apron stitch. Now I believe in both cases there are two separate pieces of leather. Both are good year-well construction. That is, there is a thin strip of leather called the welt which is sewn on the inside to the insoles and uppers and then separately on the outside through the midsole. It's known as a water-resistant form of construction and of course eminently re-craftable because a cobble can replace the worn outsole by peeling off the outsole and gluing another one on without potentially damaging the midsole or in fact anything else. If you want to dive into the good year-well system of construction, check out this video up here. They are both made of thick but supple leathers. The falton boot is made of a full-grain water-resistant leather in this colour that's called brown distress. I believe it's a combination tan leather. It's first chrome tanned and then oil tanned. The surface is I think slightly velvety, slightly waxy, feels like a newbuck leather that's pumped full of oil and I'm not sure but I think like newbuck if it isn't newbuck the surface is slightly corrected. All over 2mm thick it is very supple and comfortable with hardly any break-in required. The Grant Stone Field Boot is on the roomier Floyd Last and the leather is Italian Veg Tanned Leather from Badalassi Carlo Tanri. It's also about 2mm thick and being Veg Tanned is firmer in the hand but after breaking in is also supple, it's also a little more protective. Both have a lightly padded roll at the collar. The falton's in a brown leather while the field boot has a suede collar. Both have semi-gusseted tongues which adds to the water-resistant capabilities. The kilt is on the falton, doesn't come as standard and it's from Dale's Leatherworks. Taking a look at the differences, apart from the obvious upper's leather, the falton uses a vibram outsole that's their softer compound honey lug sole. This provides great grip and comfort. The field boot on the other hand is built on Grant Stone's proprietary wedge sole with a wavy pattern for grip but I have found it slippery under smooth muddy conditions. Made of something like blown rubber, it's very comfortable also but it might wear a bit faster than the vibram honey lug soles. The apron stitch is different also. On the falton it's a straight forward regular mock-toe stitch. I did have a problem with the stitch on the right boot where at the corner the stitch popped after only a few days. On the field boot it's also a real mock-toe stitch in that it does stitch two pieces of leather together but in this case the top vamp piece is rolled over the top of the sidewall piece before it's stitched together. I presume that in theory this is a better protection against water. The hardware is eyelets and hooks on the falton while the field boot has eyelets and somewhat annoying noisy D-rings. Now to the less visible. The Grant Stone field boot has a leather flat welt while the falton boot has a leather storm welt. The welt stitching on the Grant Stone has quite a high stitch density while the White's falton welt stitching has a lower stitch density. Now look neither are bad construction they're just different and you know aesthetic choice in how the stitches look is really in the eye of the beholder. Inside the boots the Grant Stone field boot has a leather insole, leather midsole, leather heel counters and a steel shank. The White's falton boot has a leather insole, leather heel counters, a vibram rubber midsole and a composite shank. I think it uses the vibram rubber midsole so as to adhere better to the vibram honey lug sole. Now Grant Stone glues their wedge sole directly to the leather midsole which in theory may not be as holding fast as if the two materials flex at different rates it might shift. But as an aside the modern glues used by boot makers these days is good enough to glue you up to the wall and you won't move so there. Little differences and similarities aside their prices are in the same range US 340 for the falton and US 380 for the field boot. By the way I find that kind of weird I call the falton the falton and not necessarily the falton boot but I call the field boot the field boot and not field. Anyway for a similar price do you get a similar quality boot and hence a similar value? Another warning controversy coming up much as I love my white MP boots. When I compared the MP boots to the Vibex service boot I concluded that the white MPs while built sturdily and totally worth the price they are built like a work boot maker makes boots rough and sturdy and not at all delicate and fine. It's much the same here the stitching on the falton is good enough if quite low in density on the welt but it's built like a work boot. The field boot on the other hand it can take it in the rough I have tracked in it but it's made a little more finely with high stitch density details like the road vamp piece and they take the care of joining that flat welt so that you can hardly see where the joint is. So far that's horses for courses right depends on what you like but even forgetting that mock stitching that burst on my falton that could easily be a one off. I think what you get from Grant Stone in terms of clean construction precision and overall consistency it's better than the falton. You pay an extra $40 for the field boot but I think it could easily be worth another $50 on top of that with the exception of the corrugated pattern on the wedge sole not a big fan. Let me be clear if I compared one of white's hand-welted rolled welt stitched down models it would blow up the field boot but those are $600 or even over $600. So don't shoot the messenger. In this case I think Maiden China beat up PNW. As a business advisor in real life outside of YouTube I believe that if your company wants to stray outside its central vision which in this case is a well-made handmade product worth many hundreds of dollars in order to compete at a lower or different market you have to either create a new brand like Vibeau did with your traditional work boots even putting them onto a different website altogether or you make damn sure that you beat up the competition at the same price range. Now I don't know about you but when McDonald's first started selling healthy salads as a side order to Big Macs it was jarring healthy fast food did not compute they actually struggled for a while before they made sure to really make good salads and then the brand image was intentionally changed to being healthy hey but don't worry the white MP service boot is still my grail boot and you cannot go wrong with white's higher end models.  The messenger appreciates it. Until the next time take care and see you soon.