Everybody forced here up. It's 20 22 tops archive signature series retired player edition baseball 20 bucks case number 18 of random divisions Let you check those out real quick while I get some water Thanks everybody for joining a good look I dropped a link Here comes your link I didn't drop it. Yeah, Thor's 12 15 Running around chasing boys He's like super old man though, like we're like he will just want to go outside and just lay in the grass Like in the Sun, and it's like a hundred degrees and he's like, ah, yes Let me get my dinner served at 3 p.m.  Oh, yeah. Oh your home cool Alright Yes, right. Yeah. Oh, yeah, it's right. It's been a while All right, one of the AL East a willy Randolph 4 of 23 AL East From 80 was 87 84 86 six tops Take a peek at the schedule That's a Jeremiah's bunny. Oh nice You got AL West Steve Finley auto 34 or 52 Ash's ALS what up Shane? What up illegal? No, I did not That's really that's really interesting to a one of one Carlos Delgado whoo as a Marlin Wow NLE East I Was thinking NLE East for Delgado, but not this team There you go. That's dude. That is sick bowman platinum, right?  Oh, yeah, Bruce Bochi NLS Bruce Bochi manager on that one 30 of 38 Now West Giants legend manager One of one mini Jim Palmer tops 206 mini Jim Palmer one of one polar bear Where's polar bear? I thought that was what is this Jim Palmer or people on The Garvey NL West auto 13 of 99 Weird seeing him as a Padre Stop all star Dale Murphy auto 2 of 19 NLE East you go left from Ralston Purina is dog food card Red Lynn as a California angel 18 of 22 AL West Red Lynn collect all 33 baseball cards Especially mark packages of cookie crisp Donkey Kong and other Ralston cereals Kmart card it is 3 of 12. It is a vita blue It's like a it's like one of those cards that has a picture of the other older card You go or just a picture of that card Vita blue AL West 3 of 12 They should come out with like a wall walkards That is 95 out of 99 Tony Perez NLE Tony Perez the Phillies Reading a lot of players that it's like but not even like the second team I think of Even a presently, I only think of the reds. Yes NLE East on the Tony Perez. I Do like that about this and yet that's I mean that's that's a huge card Ragger Fractor Jose Ramirez tops chrome rookie. Yes One of five Moises aloo NLE East Expos go to the Nats NLE East on that one Moises aloo bring back the expo Gary Sheffield as a Yankee 14 of 18. She had Gary Sheffield as a Yankee. Delgada was a Marlins Al East Gary Sheffield 14 of 18. I'm not sure if that is all star Dennis Eckersley one of one AL West AL West done very well Nice act dude. I aspire to have that hair and facial hair Only I could man. I Think my hair would grow that long and if it did it wouldn't look half that good Juan Gonzalez AL West auto 35 of 44 for the Rangers AL West is NL central Raleigh fingers auto 63 of 83 for the Brewers I think in a gossage. Yeah, different mustache Julio Franco auto AL West 48 of 83 AL West man, they've got a few hits now The MQ at the AL West nice Franco. He was really good. I've been I've been to k-marts before when I was younger But never I don't know that That is a NLE you saw to Keith Hernandez You go NLE's nice one there well one of one nice. It's like I'm missing something here 1985 all-star sets nice one-of-one there for the NLE's Keith Hernandez Yeah, I never I never saw that when I was a k-mart as a kid There we go. It's just a little early on this one rich gossage rich gossage weird to say six of seven AL West Rangers It's not the first or second team. I think of You go AL West the Jackie Robinson jersey there too. Was he number 42? He must have he must have exited I didn't come along until the 90s AL East Ron Gidry 404 all the all the pictures mustaches. Oh, yeah There you go AL East 404 Ron Gidry And NLE's a Dave Magadan 31 of 85 Dave Magadan And that's gonna do it for the break. Thanks again everybody. We've got some more bass while coming up


update. Hi folks, Basel Chapman here with the three o'clock eastern time tiger financial news network update on this fourth day of April Monday. We're looking at the doubt the high of the day up 93 at 34,911. Really nice turnaround from earlier in the morning where we hit the 14 period moving average on the left side chart to 80 in the middle of the weekly on the right is a monthly and you can see a very nice turnaround and what we are looking at here is S&P was holding very nicely but it suddenly pulled back and then it started another rally and this rally is going to be very important going into the close is there a selloff going into towards the end of the close or is it going to continue because you wanted to see a filling in on Thursday's ugly candle terrible candle went to right down to the ninth bed moving average went under it on Friday and today is nicely above you want to see certainly sometime early this week by about Wednesday above 4600 will be very good we're at we're up 31 by 4576 the QQQ this is the story of the day when I was doing the analysis for my subscriber to my opening call over the weekend I showed them in my overview my web my video on Saturday that there was internal strength in the QQQ the NBX 100 and that it held the 200 period exponential moving average in the daily there should be a rally and by about the end of the week there should be a move that takes you nicely above the 371.83 high of early last week because it's only peak B in the chapter wave methodology a bison who goes to a buy mode and essentially says there should be four higher peaks so we still expect a peak C and then a higher peak IWM it's coming back a little bit it's now up 48 cents to 8.06 it's really been struggling gold had a very nice earlier session it is trading right now let me just get to the price if I can get that correct here we go gold is I miss that uh-oh there's a little problem here put that in press your GC button and there it is gold is up 12 at 1935 it's just stuck I'm going to be talking about this I'm going to be doing the Tom O'Brien show next and these patterns they come down and look like a lowercase h and go to a lowercase m we're going to talk about that crude all has held very nicely it is up $4.103 but still within a narrow range of the spectacular move then the TLT bonds are struggling to have a run is down 87 cents in 131 and 52 ticks we're looking at the yield stall at the upper end of the range I'll be back for the Tom O'Brien show hope you can stay see you in a moment


The Bemidji Chamber of Commerce commemorated 110 years today with its annual celebration. This year's theme went down memory lane and took a trip through the decades. The event celebrates the chamber's year and the passing of the gavel with the new board of directors. It also thanks donors, sponsors and everyone else that's helped the chamber within the year, including volunteers. We have a staff of three or four people. So to have volunteers who help us who go to businesses and welcome people or help put on events like the Dragon Boat Festival, that's, we couldn't do it without our volunteers and they mean so much to us. Our board is made up of volunteers. I'd also mark the last hurrah for outgoing president, Lori Parris, who is retiring. This was her 19th annual dinner since she began in 1999. It says it's bittersweet. An opportunity just a chance to thank the members for all the generosity and the support that they've given myself as well as the chamber over all that over the past 18 years. Lori's been in her position about as long as we have. We started in 1998. She started in 1999, so we've all been a part of the community for a while. Wish her well with her retirement. If you've enjoyed this segment of Lakeland News, please consider making a tax-deductible contribution to Lakeland Public Television.


In their book Manufacturing Consent, Noam Chomsky and Edward Herman argue that the way media and journalism functions is not to inform the public or to hold power to account. Noble ideals that those of the profession might refer to as the Fourth Estate, but instead, it works as propaganda. Their propaganda model for media manifests because of a series of intersecting forces. One, profit. Media organizations are owned by large profit-oriented corporations, and so the type of news they cover will always be information that generates revenue and is beholden to those interests. Then, advertising. Because one of the primary ways news generates money is through advertisements, they will always be submissive to other corporate sponsors. Next, sourcing. Because journalists need access to these large corporations in order to get early coverage, they will try not to be too disruptive, because doing so will exclude you from news that might help with said profit. And finally, there is flak or enforcers. People are institutions that push back against any positions that fall outside acceptable discourse, forcing news into self-censorship. The primary application of this framework is, of course, with regards to political news. How news organizations, even unknowingly, will tacitly comply with the demands of both the state and businesses, because it is in their best interest to do so. Unfortunately, this only serves to manufacture the consent of a population, who meekly acquiesce to forces they might otherwise find objectionable. News is propaganda, journalists are propagandists. Journalists are unfairly lambasted, some might argue, though. Surely they are governed by a code of ethics, you know, cite multiple sources, report the facts, make corrections, limit harm and slander and be as truthful as possible. Sure, but under this model, it matters not the valiant ideals of individual agents, the system incentivizes the wrong things. Distrust of news and journalism is seemingly very high, and what's interesting is that this still applies when you look at other sub-domains of journalism, in our case, video game journalism. The meme of the corrupt journalist needing a journalist mode, distrust for large media conglomerates, there is ample evidence of this sentiment in gaming. In fact, Gamergate, regardless of the politics and implications of the movement, was by its own account a crusade against bad ethics in journalism, irrespective of whether or not that's what it ended up being. At the very least, this shows the power of the idea in mobilizing gamers, even if for ulterior motives. A fascinating thing in gaming is the blending of subversive anti-corporate ethics and reactionary elements all at once, making movements such as these as conflicted as they are hard to pin down. In any case, the net output was widespread harassment, and very little impact on the dynamics of a status quo that gamers themselves participated. Am I going to discuss the history of Gamergate? No. Am I presenting a theory about the structure and nature of journalism in games? No. These are subjects that have and require dedicated research and scholarship that the medium of the video essay will never do justice to. What we can do is play with these ideas and see what insights they yield about how the identity of the gamer itself might be manufactured by these forces. Manufacturing consent is an interesting expression. It implies that our views and ideals are shaped by others. We are always beholden to narrative, to ideology. In video games, the trajectory of an individual gamer is deeply personal. You might have started your life as a gamer as I did when your parents bought you a console. You play with your friends on the weekends. You try and beat them. You eagerly await the release of new games that your parents only buy for you on special occasion. But then, you read reviews in magazines and websites. You get on online forums and discuss with gamers who both agree and disagree. Fast forward enough time, and social media starts to amplify individual voices, creating more polarization and trapping you in an echo chamber of your own thoughts. How does journalism enter the fray here? How does it contribute to manufacturing the gamer? This we can never fully know. It is deeply anecdotal. The corporate and advertiser focus of games media wants to sell you games. This is what sustains the industry. Yet, we also get our information about games, critical reviews about games from these same institutions. In journalism, there is a divide between news and editorial, facts and opinions supposedly. And in most games media, advertising and writing are also separated. We can trust that this does happen in principle. The problem here isn't that we should suspect that this isn't the case, but the strange conflation of journalism and criticism. Journalism is not criticism. They overlapped but are distinct professions. Journalism holds power to account, informs the public. Criticism is about artistic evaluation. When we blend the two as we do in games, we dilute both. Vacuous scores out of 10 are meant to be an objective metric of a game's value. It's a consumer report. Games aren't cheap. But is this journalism or criticism? It might actually be neither. Outlets need access to new games early if they want to publish a game review first. This means they are beholden to publishers to grant them copies. There is ample evidence of publishers blacklisting journalists and critics who they deem unworthy. And so criticism might be financially risky. There is also the infamous episode of a particular journalist getting fired because of his bad review of a game. Having advertisements of games in the same place or criticism of those games takes place might be strange. There is co-dependency. Corporations need journalists to promote their games as much as journalists need games to promote themselves. But why is it neither journalism or criticism? The best criticism in games doesn't happen in large websites by corporate-sponsored media or influencers. It happens in books, journals, blog posts, by renegade authors who are not doing a consumer report. The best journalism doesn't happen under the umbrella of a larger organization. But when independent investigative agents take it upon themselves to divulge information about perverse labor practices in the industry or predatory monetization schemes directed at children or how dirty the supply chains of gaming as an industry are, the information most present to us all is neither journalism nor criticism. We are informed about the medium while simultaneously being completely misinformed. Perhaps manufacturing consent should be adapted to manufacturing content. Content creation, the currency of our age is not knowledge or beauty but entertainment and money. A story about the design philosophy of some obscure developer or about the nature of playing games in academic books does not get as many clicks as some salacious article about leaks in a game or speculation about technology that is never really used beyond the immersive fallacy or fueling the flames of some absurd console war or an article about why this game or person or publication sucks. Money leads but only when entertainment and sensationalism bleeds. We know the drill. Negative headlines capture attention. Arbitrary lists promote engagement. Controversy is another currency of the modern age. Narratives that pit gamers against gamers as the console wars do or pit players against developers are toxic, sure, but they are profitable. Sega versus Nintendo, PlayStation versus Xbox. Console manufacturers feign propriety but are playing a zero-sum game, going negative and then claiming innocence. There is a chain of transmission we all bear responsibility for. Journalists spread the news about the leaks of the Last of Us Part II's plot. Gamers got incensed and directed their anger towards the developers, even the voice actors before the game came out. The media reviews the game positively. Gamers assume this is evidence of misconduct. Accusations get slung every direction. Journalists are being bought. Gamers are rage-filled maniacs. Developers are imposing their political agenda. What gets lost in the shuffle? The actual game. Ironically, this kerfuffle perhaps accelerated disclosure of Naughty Dog's crunch culture and yielded many interesting think pieces about the controversy itself. Regardless, it bears repeating that we are the enforcers of propaganda. In his book, Handmade Pixels, Jesper Ewell documents how our conception of indie itself is informed by narrative. We have this prevailing idea that indie started in 2008 with games like Braid and Super Meat Boy and this was reinforced by movies like indie game The Movie. But as others like Bennett Fadi have argued, indie started at the inception of our media. Small teams or even individuals than birthed large corporations. Also, there is the construction of the myth of the heroic creator, although this has happened before with so-called art tools. So is indie game The Movie propaganda?  The point is our perception of our own history is mediated by narratives and these narratives are generated by the media, which we then transmit uncritically. Again, we are complicit in this too. The fourth part of manufacturing consent is enforcers or flak. It is gamers themselves who seem compelled to enact this. What is a hardcore gamer? What is a casual gamer? And why is this even a question? Hardcore gamers play difficult games, right? They keep up to date about industry news. Casual gamers just play a mobile games and don't have the same nuance and understanding of the medium. Why this gatekeeping though? Why the exclusionary rhetoric? Culpability in the construction of this image is distributed though. Hardware manufacturers sell to young men and adults because that is their main demographic. And couple this with the military industrial origins of our medium and you have a recipe for a present day. Hence, they cultivate the image of the edgy mature gamer, the technophetishist and we buy into this because our ego is appeased. Then we get strange discussions. That's not a game. That's a walking singlet. That's not a gamer. They haven't played X or Y thing. I understand the medium even though I have never designed a game or read a book about the nature of play or have contributed anything meaningful to the industry at all. Journalism outside of games intersects with journalism inside of games in interesting ways. And this also manufactures the gamer. Video games are causing violence, said the mainstream media for the longest time. Games are addictive. They are developmentally hampering our children. Gamers are then portrayed as cave dwelling anti-social miscreants who are cultivating perverse instincts because of the simulation afforded by games. To some, calling yourself a gamer is a matter of pride. For others, it's a source of abject embarrassment. Then journalists inside the medium fight back against this, trying to highlight all the good that games do, reporting on things like charity drives or the sense of community games and gender. Journalists are not a monolith. They are individuals with different incentives, biased, sure, but they often fight against one another. In his talk, the medium is the message. Jonathan Blow argues that the financial incentives of our medium are actually stifling the creative instincts of designers. Predatory monetization schemes, loot boxes, these are sold because people buy them, and then this gets implicitly instantiated as good design. He uses the example of how the advertiser model in TV created short-form content that was superficial and cheap, where a subscription-based model yields more artistic freedom. Interestingly enough, the same is true of journalism in some sense, and this overlaps with manufacturing consent. When news was a subscription-based model, it could serve the interests of its viewership. It didn't have to worry too much about advertiser revenue. The incentives are all aligned, as opposed to the sensationalism that accompanies yellow-letter journalism. Now, functionally, as much as you want to separate editorial and news in games' media, the outcome might always inevitably slant towards advertisers, who in many instances are the very industry itself. No real criticism of industry practices because that might anger advertisers. No real political content because in games, polarization decreases profits. No academic transfer of ideas, well, because that's boring, and gamers don't want that. Sometimes servicing your viewership is not just giving them what they want, but what they need. So journalists may be able to inoculate themselves if they are independent, crowd-funded, don't take sponsorships or look for access, and hence don't need sensationalism or headlines. If they are not concerned with the flak they receive from the industry and others, they might be free. A journalist who cares what others think of them will probably always engage in self-censorship. Here's another issue, though, and it ties back to our discussion about the distinction between journalism and criticism. Objectivity is not neutrality. What does this mean? Journalism is not about saying, look, climate scientists have one opinion, climate denialists another. No, journalism is not neutral. It is objective in saying it's 99% of scientists versus 1% funded by fossil fuel companies. The truth often takes sides. It doesn't sit back and parrot information with a vacant stare. What's funny, though, is that media, in an attempt to seem objective, uses neutrality as aesthetic coverage. We are manufacturing authoritativeness and authenticity now. Why do you think news reporters speak in that horrible monotone? This language of neutrality is the same thing that plagues journalism and criticism. Nine out of 10 seems objective, even though the writer gives no explanation, no framework as to why. I'm just reporting the news, says the journalist who spreads rumors, not realizing that jobs are at stake, and there is a journalistic code of conduct that asks us to minimize harm. Like mentioned, people conflate journalism and criticism, expecting neutrality masquerading as objectivity when they are actually demanding critical perspective. Truth, beauty, and understanding. Decentralizing news and journalism is good in one sense. We are not subjected to corporations. But in another, it leads to the abolition of any journalistic standards that has created an anarchy of absurd and ill-informed opinions. So what is the solution to this? We can't reframe the incentives of corporations that seek profit above all. Journalists don't know enough about the medium, both academically and development-wise. In fact, most of us don't. Alternate funding models and more literacy about journalism and its function might help, sure. But is this simply a band-aid for a bullet wound? In his book, News Games, Ian Bogost argues that games as a medium can help do journalism itself by representing ideas and stories systemically. An example he gives is cutthroat capitalism, a simulation to help represent the issue of piracy off the coast of Somalia in the 1990s, which uses procedural rhetoric to show how circumstances make it somewhat rational for pirates to act the way they do. Given institutional failure, the problem of pervasive poverty, the history of colonialism, and how easily we are all corruptible, seemingly irrational acts can seem somewhat rational. As fascinating a vision this is for the future of games and journalism, we can apply the logic in the book to journalism and games itself and, ironically, yield the same answer. Institutional forces make irrational and destructive behavior rational in our medium. It isn't just the fault of journalists that journalism often fails, as much as it is all our faults for being complicit in a system that necessitates it. Then again, maybe we can manufacture a different version of the game and then the present one. We see glimmers of hope. There is a genuine anti-corporate manipulation ethic present amongst even so-called reactionary gamers. Gamers care more and more about crunch and do whole companies to account, at least in words, when labor practices are perverse. Gamers want change, but are at a loss as to how to fight against the forces of consumerism and sensationalism and a society of control. The journalist then, under this view, can have an active role in facilitating this impulse in the gamer, who ultimately wants a better media without getting distracted by the incentives that might corrupt that vision.


You know, St. Paul exhorts us in one of our letters, work always not as if we're working for a merely human master, but as if we're working for a divine master in the service of God. So I think to say a little prayer, very brief prayer, before we undertake any activity, both to remind ourselves of that and to implore God's assistance and grace. A key to being able to do this is to set aside a certain amount of time for holy solitude, literally for doing nothing, but being in the company of God. This might be only five or ten minutes each day, but it makes such a huge difference, I think, in keeping the right balance. So not to let our tasks master us, but to remain in mastery of everything that we do, making it an offering to God, knowing that God sometimes asks a lot of us, but he will never ask more than we can possibly do.


RCA Victor, world leader in radio, first in recorded music and first in television, presents transcribe the Phil Harris Alice Faye show. For your enjoyment, here is the Phil Harris Alice Faye show, written by Ray Singer and Dick Chevrolet, with Elliott Lewis, Walter Tetley, Robert North, Janine Roos and Whitfield, Walter Sharpeness music, and yours truly Bill Forman. Today, Phil and Elliott make plans for a very special event. They're quite excited about it, but they forget to reckon with Alice. More about that later, but first a word from RCA Victor. You and your family will enjoy evening after evening of fun and excitement when you own RCA Victor television, because this season you'll see the greatest lineup of stars and shows in television history, and you'll see clearer pictures of everything on TV, thanks to RCA Victor's exclusive magic monitor. The magic monitor circuit system acts like an engineer inside your set. It screens out static automatically, steps up power automatically, and automatically ties the best sound to the clearest picture. The magic monitor is built into every RCA Victor set, into the new Brandon, for example. Here's big 21 inch console television, and every feature, every detail from the full length doors of its rich colonial style cabinet to its world famous golden throat tone system reflects the quality that has made RCA Victor the world's most owned television. Yes, every year more people buy RCA Victor than any other television, so see the entire line of wonderful RCA Victor television at your dealer's tomorrow. Prices start as low as $199.95. And when you buy your RCA Victor television set, remember to buy an RCA Victor factory service contract for expert installation and service. And now the stars of the RCA Victor program, Alice Faye and Phil Harris. Yesterday was the day of the big football game between USC and UCLA at the Los Angeles Coliseum, and Phil was one of the lucky ones who managed to get tickets for it. And now let's go back to yesterday. Phil has just gotten the tickets and he's called Elliot over to the house to tell him about it. Hey Elliot, have I got good news for you? I got two tickets to the USC-UCLA game. Currently that's sensational. How did you ever manage to get two tickets for that game? They're at a premium. Oh it wasn't difficult for an old grad. UCLA always sends tickets to us members of the aluminum. You must have been an honor student. Do you have any degrees? Ostensibly. I've got a lot of degrees and so have many of my friends. Some of them are BA's, some of them are MA's, and most of them are AA's. Yes, I have a few of those too. Hey Curly, we better leave for the game soon. There'll be a lot of traffic. I tell you we got time. First I want to tell Alice we're going. Don't tell her. You've only got two tickets and she might want to go in my play. Nah, nah, she hates football. She don't know nothing about it and she's not the least bit interested. In fact, she wanted me to take her shopping today. Well how are you going to get out of that? What excuse are you going to give? I have to give no excuse. When I want to go someplace I just tell my wife I'm gone. That's all. I don't beat around no bush. Will you be able to take me downtown soon? No, you'll have to get somebody else to do it. Why can't you take me? Because I've got to go to the hospital and see my grandmother. And your grandmother's sick? What hospital is she in? The Coliseum Memorial. Where is that hospital? Where is it? Right on the 50-yard line. You two talk. Now hold it boys, I just got a message. Phil, where do you want to go this afternoon? Well honey, I want to go to the football game. Football? Isn't that the horrible game where all those men get on the field and knock each other over and trample on one another and kick each other all over the place? No, that's the Ritz Brothers television show. I'm talking about football. I think it's a revolting exhibition and I can't stand it. Well neither can I, but well I've got to go. I happen to have two tickets. Good, I'll get my hat and go with it. I knew it, I knew it! That blonde will do it every time. Alice, Curly was supposed to take me with that other ticket and you have no right horning in. He'd rather take me. I'll ask him and prove it. Never mind, never mind. I'll ask him. Phil, who would you rather take to the game?  That's a nice loaded question. Don't let her bluff you, Curly. Answer it and tell her the truth. Yes. Who would you rather go with? Well, uh, I'd rather go with you, dear. I knew you would, sweetheart. So long, Alice. Too bad you lost. Oh, Curly, we'll have a wonderful- I'll come back here. Phil meant he'd rather go with me, and that's who he's going with.  Look, honey, you wouldn't enjoy the game.  Oh, dear. All those people are going to see me? Well, I'd better go to Saxon and buy a new gown. You don't need no new gown. Where's something you've got? Oh, but what have I got that's appropriate for a football game? How about your strapless pig skin? The one that laces up the front. All right, all right, fellas, you needn't be sarcastic. You can't talk me out of going to the game. And, Phil, you'd better let me hold those tickets. But, honey, I- Thank you very much. I'll get dressed now. I won't be long.   I hate your children, and if I ever see a mother, I'll set fire to her teepee.  But, Curly, I had my heart set on going to the game. The biggest game of the year, and I can't go. Everybody's going, but I won't mess with you. All right, Ellen, wait, but don't cry. Elliot, now, please, please, well, don't cry. I'll tell you what, if you stop crying, I'll sing you a song. I'm going to sing it anyway. Now dry your tears. And the cow jumped over the moon. Now how in the devil can a cat and a fiddle? And the cow jumped over the moon. But just like a kid, we start to croon. But the goose is its favorite tune. The cow and the fiddle with the cat in. The fiddle has its high fiddle, fiddle and tune. There's a little kid, a curly-headed kid. Sings his sweet refrain. Born at night and noon, the little shaver's tune. Runs right through my brain. Oh gee, but it's the cutest thing. When the little shavers sing. Ooh, hi, little, little, and the cat and the fiddle. And the cow starts singing a song. And how in the devil can a cat and a fiddle. And the cow keeps singing all wrong. Then the little bluebird shopped with glee. Cause all they like is harmony. The cow plays a fiddle and the cat tells a riddle. And they hide it a little for me. Hide it a little and the cat and the fiddle. And the cow jumped over the moon. When your clouds are gray and the sun don't shine. Just try and sing this little rhyme. Hide it a little and the cat and the fiddle. And the cow jumped over the moon. Hide it a little and the cat and the fiddle. And the cow jumped over the moon. You're not mad at Alice anymore? Of course not. I don't carry a grudge. As a matter of fact, to show there were no hard feelings while you were singing, I made us all a martini.  Hand me my drink. Well, just a minute while I put the finishing touches to him. Here we are. Olive in yours. Onion in mine. And a knockout drop in Alice. Elliot. Curly, I just got to go to that game. Well, then maybe if you're nice to Alice, she might give you her ticket. You mean flatter her? Certainly. Women go for flattery. Just tell her how beautiful her clothes are and what they do for a figure and rave about the color of her hair. She's a sucker for that. Yeah, yeah. I guess if I get her softened up enough, she'll... Well, Phil, I'm all ready to go. I had to. Alice. What's the matter with you? Oh, Alice, you have such exquisite taste and clothes. Oh, you think so? Oh, yes. That dress you're wearing. Why, it even makes a figure like yours look good. And your hair. It's such a lovely color. Only an artist like you could mix a dye that shape. Elliot, come here a minute. Yes, sir? What are you trying to do? I thought you were going to be nice to her so you can get the ticket. I am, but I'm also being nasty to her in case I don't get it. I'm not one to throw compliments away for nothing. Well, you're not being very nice to my little woman and just for that, I'm glad that you're not going to the game. Come on, honey, or we don't want to miss that kickoff. Hand me my chrysanthemum, my pennant, and my freshman cap.  You're not getting out of this house. Let go of my raccoon coat. You're stretching the tail. Come on, Alice, we're off to the game. Come on, Alice, we better hurry. We better get inside before the kickoff. I can't walk any faster through this crowd. I've never seen so many people pushing and jostling and... Say, Phil, you'd better watch your wallet in a crowd like this. There's libel to be pickpockets. Don't worry, I'm watching it. Nobody... Hey, Alice, you're right. Somebody's got his hand in my hip pocket. Oh, I'll just reach around fast and grab it. All right, but I got you. What are you doing in my pocket? Just browsing. I thought maybe... Oh, Curly. How can you stoop so low as to pick a pocket? I was just after my own ticket. How'd you get to the stadium so fast? You know that front tire you were complaining with so wildly all the way down? What about it? That was me.  I hid in your trunk rack. You ain't going to shake me. Look, Elliott, we only got two tickets, and Alice and me are going. I told you that. How can you desert me like this? I'm sorry, Elliott. Alice, you've got the tickets. Where are they? Oh, yes, the tickets. I've got them right here in my... Well, I... I put them right here and... Oh, no. I left them home. You forgot the tickets?  Now you know what it's like not to be able to go the game. We're still going. I'll buy tickets for the three of us. It's my treat. Alice, give me some money. I told you I left my purse home. Elliott, have you got any... No, he ain't going to do us no good. All right, don't be sarcastic. I got 50 cents. And I've got about a dollar in change. Let me see. The tickets are $5 apiece, so we need $5 apiece. So we need $15 and all we've got is a dollar and a... No, it ain't going to work. Why not? You're not very good at arithmetic. What are you talking about? How can you make $15 out of $1.50? You moved the decimal point over one place. Yeah, that would give us $15. Better yet, if we moved the decimal point over two places, that'd give us $150. We should get away from here. Bill, I'm sorry about this, but as long as I forgot the tickets and we don't have any money, let's go home. No. There must be some way we can get in. Maybe we could climb over one of them fences and then come back... Hey, wait a minute. Hey, Elliott. Do you notice the young kids they've got at the gates taking tickets? So? Well, we should be able to outsmart a teenager and bluff our way through. Yeah, and I know how to do it. We'll put our union cards in our hats, rush through the gate, and yell, Press! Yeah. Yeah. Hey, that'll do it. Alice, you wait here, and once we get in, we'll arrange to get you in too. Come on, Elliott. Now, look, we'll just act as though we belong and nobody ain't gonna stop us. Ready? Here we go. All right, son, let us through. I'm Scoop Harris, the chronic. And I'm his photographer, Flash Lewis. Open the gate and... Better yet, Cheslin Franks! Why are you two trying to sneak in? It's too cheap to buy tickets. We had tickets, buddy, but we left them home.  You might say that. I wouldn't, but you might. Look, son, we may have our little differences, but deep down, I know you really love Mr. Lewis and me, don't you? Yes, and that's my problem. Oh, loving the body is the way I do. I find it hard to choose between you. And when I walk to the altar, I want to be sure that I have... All right! We don't want to marry you. We just want to get in the stadium. Can't let you in without tickets. Julius, if you wanted to, you could let us sneak in. Couldn't you? Yeah, I could turn my back and close my eyes, so you two could glide past me. That's a good idea. Yeah, and it should work, except for one thing. What's that?    Fellas, I'd like to do it, but there's too many people watching now.  When? As soon as it gets dark out. Say about nine o'clock. Julius, one of these days... One of these days... POW! Now, forget him, Jackie, uh, Curly. We gotta think of some other way to get into the game. Let's get back to Alice. Oh, Elliot, hmm? That lad is beginning to annoy me. I gotta take him hunting sometimes. If I paint a target on his back and... Well, fellas, how'd you make out? We didn't. Then let's go home. Get your hot dogs here, hot dogs. Honey, we came here to see this game, and we're gonna see it. How? We need $15 for tickets and all we have is a dollar and a half. There must be some way we can raise the money. Any hot dogs, folks? Only a few left. Get them while they last. No, thanks. We don't want... Wait a minute. How many hot dogs you got there, bud? Five. I'll take them all. Here's a buck and a half. Thanks. Curly, our problem is solved. These five hot dogs are gonna get us into the game. That makes sense. How does it make sense? With him, you don't ask questions. You see, this is an investment. We need $15. All we have to do is sell these hot dogs for $3 a piece. Oh, that shouldn't be hard.  Elliott, nobody's gonna pay $3 for a hot dog. They will if they can't get him anyplace else. The man just said these are the last ones. It's a simple case of the law of supply and demand. Yeah, I guess if people want... Well, it's worth a try anyway. Now all we have to do is find some way to collect the crowd. The crowd? That's a cinch. Alice, sing. Arm in arm over metal and farm Walk in my baby back home We go along harmonizing a song Or I'm reciting a poem I'll go by and they give me the I Walk in my baby back home We stop for a while She gives me a smile And snuggles her head to my chest We start in the pep That's when he gets My powder all over is best After I kind of straighten his tie I have to borrow his comb One kiss then I continue again Walking my baby back home She, it's great after being outlanded Walking my baby back home Arm in arm over metal and farm Walking my baby back home We go along harmonizing a song Or I'm reciting a poem I'll go by and they give me the I Walk in my baby back home She's afraid of the dark So we have to park outside of her house for a rest We start in the pep That's when he gets My powder all over is best Hand in hand to a barbecue stand Right from the doorway we roam Eat sand and it's a pleasure again Walking my baby back home Alice drew a pretty good crowd We shouldn't have any trouble selling the hot dogs now Here comes a likely looking schnook Watch me go to work on him I know you don't, I'll handle this Hey mister Yes How about buying a hot dog? Well yes, I like one How much?  No hot dogs worth three dollars How do you know? You might find a pearl in it You only find pearls in oysters Do you ever find a pearl in an oyster? Well no Then try a hot dog, maybe you're lucky I think you're crazy Just keep your hot dogs Wait a minute mister I'll show you boys how to sell a hot dog Can I talk to you a minute? Tall, dark and handsome Who? Me?  That's how she got me Only in those days she was selling hot bagels I went for a bundle Now look here mister I can see you're a sport And if I asked you for fifteen dollars for these hot dogs You wouldn't be able to refuse me Would you? I don't know But I'm gonna tell you He's fighting her girl I did too but it don't do no good Wait till she throws him her sidearm curve with the Marilyn Monroe flow Now look sweetie pie I know you'd love a hot dog with mustard Relish And onion Wouldn't you? Not especially Oh you're just an old meanie I'm only trying to raise enough money to see the game Oh then why didn't you say so Of course I'll take a hot dog Here's five dollars so you can buy yourself a ticket Well thank you So long boys I'm going in and see the game Wait a minute wait a minute what are we gonna do?   Is the sound tinny or muffled? Does the volume go up and down every now and then? These faults that rob you of the full enjoyment of your radio Can also mean that one or more of the radio tubes Have become weak or defective A defective tube can damage other parts of your radio And result in costly service charges So don't neglect faulty radio tubes Your radio man would be glad to test the tubes for you And replace those that are no longer serviceable When he does ask him to install top quality RCA tubes He knows from experience that RCA tubes Give top performance in any radio Always buy RCA and you buy the best Radio Free Europe fights communism with truth Keeps the spirit of freedom alive behind the iron curtain Help Radio Free Europe by joining the crusade for freedom Send your contribution today to crusade for freedom Care of your local postmaster Thanks and good night Good night everybody Folks I'd like to be serious for a moment Let's not forget our GIs at home And abroad this Christmas They'll appreciate any remembrance from you no matter what You know according to the reports I get One gift they'd really like is a portable radio RCA Victor's new super personal radio Will be perfect for them because it's tiny, lightweight And long, long playing Now if you decide to send your GI And RCA Victor portable radio, remember this If he's in a location where he can't buy batteries Send along a few extra RCA radio batteries too Tonight here, Theatre Guild on the air over NBC


So now to begin the semester we start to talk a little bit of a refresher on Java For our textbook at least in this lecture. We'll start to talk about Chapters one and two the introduction to a computer what it means to program and then start getting into some elementary Programming with that so the first thing if we start to take a look at a program when we start to think about what it means to Have a computer We boil everything down into binary data if we think about it We start to look at the ones and zeros and really all the ones and zeros are is whether or not I have electricity so Do a little exercise here. This is What I would call a switch Let's even expand this out. So I've got myself a Little switch going on here right now that switch has no electricity right here I've got electricity. There's power on this end, but there's none over here because they don't Connect now if you've taken any type of engineering course before as soon as I make kind of these two metal pieces connect Suddenly that electricity is transferring from one side of my hand to the next side of my hand So why do I talk about this? Well? That's actually where we get the idea of Working with data working with ones and zeros because the computer is just a Component all it does is that it handles electricity if you take a look at the motherboard you take a look at the processor the memory all it is is handling electricity and When I have electricity I get What we call a one and so as we start to build these things up we can start to build out our binary data So let's think about it Let's think about it like this, you know If we have an LED light bulb by itself with no electricity it is in the off state Well, what else can it do it can turn? Off So that it's got the zero we can classify that as a zero But it can also be on now when it's on that suddenly means that I have power and that's a different state So suddenly I get a zero and a one. I have two possible states So what happens if we add another LED light to the equation? Well suddenly my first state is I have a zero and a zero But as I look through all the different possible combinations of how electricity can flow through these two LED light bulbs What I get is suddenly one will have power The other would have power or finally my fourth state They both have power so I actually have what we classify as two to the power of two Possible states we have two to the number of variables going on there This is where we get that idea of taking a single bit one bit one one or zero and Expanding that out into what we call a bite eight bits That's actually you can think of it is if what happens if I had eight LED light bulbs Well suddenly instead of it being two to the second power. I now go two to the eighth power I got two I have eight different LED lights that can be on and off So I have two to the eight power possible combinations of all of those So why does that matter? Well when we think about binary again when we look at the computer all it does is it handles Electricity if we take a look at that Processor on the bottom of the screen, you know, I know it's a little vector image But those little prongs sticking out of it if we take a look at a real life one You'll see that it's got a bunch of those prongs sticking out on the back and if you count them out They probably have 64 prongs. Well, why because it's a 64 bit processor It's expecting two to the 64 possible combinations of electronic signals So instead of our LEDs that we had before we now are dealing with straight electricity So how does this start to fall into play well? Memory memories memory it is there to store data But the processor starts to break down into two separate quadrants It's actually sort of the the brain of the computer. The first portion is we get what's known as the control logic and What that does is that acts as sort of the counter the step-by-step instructional set think of it this way Hopefully, you know, you know how to cook or if at the best, you know how to boil water and cook ramen Or at least use a microwave, but there's a step-by-step instructional set that goes into cooking Let's just think about you know boiling an egg for a second You fill the pot full of water you bring the water to a boil you set the egg inside there and then you wait and then you wait and hopefully Eventually enough time goes by you take the egg out of the boiling water It cooled off you peel it and you now have a lovely soft or hard-boiled egg But it's a sequential step. You have to go order by order You don't try and take the egg out of the water before the waiting process is done Otherwise you undercook your egg or it never gets cooked to begin with the same thing happens with the control logic It basically is telling my computer my CPU where to go next That's actually where the ALU picks up the ALU. That's actually the brains. That's this that's the the brains of the operation That's what's telling us, you know to do the addition between our binary digits the do the multiplication move our data from One memory location to another memory location. That's where that stuff starts to come into play It takes that and if you can see you know on the slides, I know I'm covering it up a little bit But we have things like add or and Exor in the MV stands for move again. That's exactly what it does is it takes our data It moves it to another spot Well, that's spot when we start to look at memory. I said all it did was store data And if we took a look at memory, that's exactly what it does is it looks If we take a look each one of those little blocks that we see on the memory stick Basically, they start at zero memory address zero and they continue going on and another word for that is memory offset both work they're synonymous with each other but that memory address well as our computers load up as we start to kind of put more and more stuff onto the computer That needs to get loaded up in somewhere. So the fact that I have screen recording software going on right now and that's being buffered into My computer that's actually being stored in memory right now and then slowly but surely being written to my hard drive well Something as simplistic as the word hello Hello is just that and you know we take each one of those letters each one of those letters has a binary Notation, so hopefully you've brushed up on your ASCII, but each one of those letters has a binary notation 0 to 256 or 0 to 255 that then has to get stored into memory somewhere Well just Putting these things in the memory how does how do we start to do that because obviously I don't want to have to do in V Let's think about for example The idea of just simple addition or simple multiplication simple multiplication is just Repeated addition. So if I were to load up notepad plus plus And I were to say something like two times 64 What I'm really looking at here is Zero zero zero zero zero zero one zero I'm looking at the binary notation of two if you were to remember from binary conversion in CIS 110 This is you can convert this out and you'll get two Now instead of just doing 64. I can't just do this This is how to represent 64 in binary, but the CPU doesn't know how to do that We have to teach it. We have to build it and what happens is I would have to do Repeated Edition I would have to continuously add to this and eventually I Get something like this I would get now four and then I'd add another two and I'd add another two and I'd add another two That would be literally my program multiplication Again, that's what we classify as more of a low-level language But we want to go ahead and expand on that. We want to design Languages that are a little bit more complex We start to look into different styles of programming languages Doesn't matter which one you learn one of the idioms one of the little things that Advanced programmers are advanced developers sort of laugh at is beginners always saying how many languages do you know and Truth is it doesn't matter how many languages, you know, for example, I don't know Mandarin, you know I don't know Spanish. I don't know French.  I'm sorry. I'm trying to work on my Duolingo, but I'm able to get by in the environment I live in by using simply one language and using that language very well That might not always be the case the same thing goes on with programming languages Really, if you know one language, you know them all the logic is still there making variables making Conditional statements loops the rest is extra fluff Well, we take that information and we start to build upon it and what we do is we develop what's known as source code What we do with that source code is we actually convert that into Machine code via the compiler now the compiler all it is is it acts as a translator for us It basically comes in and it says alright. This is what the source code means to the computer So again, I don't have to do that two times 64 multiplication into addition I don't have to make the repeated addition happen I just have to say to asterisk 64 So now that we've started to build upon this idea we break down into something called computational thinking what does it mean to actually Have knowledge and that breaks down it we have different kinds of knowledge.  It's just statements of fact. It's a very cut-and-dry Example pi is three point one four one five nine two, you know what it says on there Our classroom that we go into is in B 243 my name is Adam. Go ahead. My hair is brown. I'm wearing blue with white stripes That's factual declarative information Teach a man to fish and you feed him for a lifetime. That is imperative knowledge. That's that how to it's the Algorithms of programming. It's how we design out the code For example, how do I fish? I don't actually know how to fish and what happens if I didn't have someone who could teach me What if I couldn't call up my dad or my my uncle and say teach me how to fish? Well and say the internet doesn't exist so I can't go on the YouTubes and figure it out How do I figure it out? Well, that's actually where we as computer programmers start to pick up is we start to go and we start to pick that out And we start to figure out how to make our recipes Again those recipes, you know if we think about it in that food analogy again instead of boiling an egg think of something more complex Like chicken cordon blue. There's a lot of set-by-set instructions that go into chicken cordon blue First we have to get the ingredients and I don't mix those ingredients all together at once Because if I do I get this weird slop and that's just not what I want What I have to do is I suddenly I mix my dry ingredients and I send them to the side and I mix my Wet ingredients and I set them to a side then you know then I don't just immediately try and bread the chicken I have to split the chicken in half I have to flatten it out so that when I lay my cheese and my ham inside it I can roll it up Bread it and then cook it as need be so there is that step-by-step process I have to follow it otherwise I ruin my chicken I get sound vanilla and No more class Not that bad So how do we build our own languages? Well, we start by looking at something what we call primitive constructs primitive operators Every language has these be it a programming language or English and all they do is as we Continue to we start with the basics but as we continue to build upon them. We make more and more complex Statements think about the word bathroom Bathroom bathroom by itself All right If a five-year-old were to come up to you and say bathroom, you know, you probably understand get an infern so okay Well, you mean use the bathroom or where is the bathroom and point them on their way But at what point do you kind of look at someone and go use your words? You know say a ten-year-old walked up to you and said bathroom. Are you suddenly like what are you asking? Bathroom by itself is just a noun. It's a primitive operation. It's a primitive word But we can start to build upon it if we start to add in more context if we start to go where is the bathroom all these primitive words Stringed together we now get a comprehensive complex sentence Well, we can even make that even more. That's just a question But if I were to say where is the bathroom said little Billy doing the PP dance I've taken my question and I've now turned it into an actual story I made it more complex as I continued to build on that idea The same thing happens inside of programming languages The first thing we talk about are those primitive constructs in English its words its punctuation In Java we have a little bit of something different. We have numbers strings operators now I'll take a second to just think about Strings for a bit because strings are not the same as text And that's always something that throws people off in the beginning, but when we think about strings This is text Hello world if I want to represent that Senate if I want to actually have my computer program say hello world I Have to include quotations double quotes on both sides of it hello world that allows me now to Store that as a primitive construct as a piece of information So we can continue to build on this idea again bathroom by itself not Proper English syntax, you know the words right, but it's not how we would use that That's where we start to get into static semantics How things are being built up? Synthetically is it a valid meaning for example? I am Spartacus. My name is Adam. Govita. Where is the bathroom? Can I use the bathroom? Donde está el baño? Those are all valid syntax for Okay, all but the baño one are valid for English that one's for Spanish the same thing actually happens with programming Something like 1.8 divided by 1.8 that's syntactically Valid that's semantically valid 1.8 divided by cat not so much You know, I don't even understand kind of the concept and how would it go on there that seems like animal cruelty of my opinion We're dividing cats all of a sudden. I don't like that. I like cats That's where that stuff comes into play and then finally we get just simple semantics You know, what does it mean for example in English the reason why I mentioned this is English can be Interpretive so suddenly something like Java is so awesome That sentence by itself can have a number of different meanings. I can be sarcastic with that. I can be truthful I can say Java is so awesome Freaking out and wigging out over here and I have okay. You can tell I have a passion about Java Or you could look at maybe some of the students and they're like Java is so awesome Well, but aside from the the cross-eyedness, you know, what did I do? I gave you the verbal cues that I was actually not 100% saying I was saying the same thing But I was not saying it the same way Programming is a little different suddenly There is only one meaning for anything if I say for example, Java equals Awesome as a string what I'm saying is I now have stored in memory something called Java a variable and I have it being stored as the ones and zeros that represent the character notation of the word the string Awesome, so a w e all lowercase still all that matters, but there is no there's no hidden context It all means one thing So we'll stop there


My name is Annex, there's not so much to tell about me, I'm not formally, not professional security researcher or something, I'm just a dude. And I was kind of forced to do this talk by a good friend of mine who has been asking me for like a decade to visit one of the events he attends, he basically attends every event, I don't. So this talk is basically exclusively for him, but it's also for you as well, so have fun. Maybe it's a good idea to start off with a few questions, as so many do. It's a question that has been asked quite a lot in talks I guess. So how many of you have a Wi-Fi router? That's some people, it's not as much as I expected. So how many of you have a smartphone? That's more. How many of you trust your Wi-Fi router? That's not many. How many of you trust your smartphone? All right. Actually that's pretty encouraging, at least for me, because it shows you're actually skeptical of security issues, I guess, on those devices. I'm afraid many people are not, and that's why the first topic I'm going to talk about is Wi-Fi routers. I guess I'm not going to tell you a whole new story here, so Wi-Fi routers can be safe, they can be fun, they can be great for surfing wirelessly, primarily. But they can also be a menace, especially if you have default passwords set up that are pretty much easy to guess, or even plain readable. So there's been a lot of talk about this, there's like five to seven common models here in Germany alone that you can basically have a script, calculate the default password for, and just have free Wi-Fi, right? And of course it's not that simple, people may change their passwords, some routers have default passwords that we just did not reverse engineer yet, I guess. Some seem to be safe over the course of time, but in general you could say that there's a lot of models out there that have insecure default passwords and are still in use. So if you go along in LA here in Germany you will find like 50 boxes and maybe 30 of them still have their default password, they still have the default password on the admin page as well, so you could actually change things. For some people that may be cool, if you happen to be out of bandwidth for your cell phone, there's free Wi-Fi, right?  So that's the problem, totally forgot, think about your parents. And even worse, that's not the end to the menace of Wi-Fi routers, usually a Wi-Fi router is, if it's Linux based, is a system of a chip, chipset that is usually produced by huge companies, something, a company like Broadcom or something, and they give you a development kit with it, they have a nice demo board and other companies come and get this development kit and kind of make their products and put them out there. The trouble is they don't make updates for those machines. So it's not only that you can access a wide range of networks, you could possibly do whatever you want with those networks, like have ports forwarded to you or lock the owner out or something, but they're actually running old software in many cases. And so yeah, I'm just forgetting to skip through here, please forgive me, because I didn't have time to prepare this so much. So there's reasons for this, I basically mentioned one of them, you have those chip producers, they basically do the initial part of the software, give you a development kit and the company's making the final product, basically rebranding them, they make their fixes, they make their changes probably at a Gizmo or two maybe, but they are not the masters of their code, they basically depend on the chip developer to give them updates, sometimes they do patches if you have a good vendor, like I don't know, I wouldn't call dealing good, but they make updates if something breaks, you can download an update from their page. And so even if there are updates, many people don't know that they are important, many people don't know that they could be installed and many people don't know that it's a problem at all. So there are some reasons out there, many vendors claim that it's just too expensive to have regular updates and they will only move if it's really, really, really, really dangerous and an update is needed to prevent like total mayhem, but actually they won't even do that, so there are reasons they are just not convincing. So those systems are Linux, right? So let's just fix all those systems. Well, first of all, Linux isn't Linux. It's a sad but hard truth that I had to learn, I did a lot of embedded development myself trying to modify those systems, trying to get them to do my bidding and what I learned is even if the source code, for example, for the kernel is available, you might be locked out of the bootloader, so you can just install a new kernel, it just ends there and you have to resort to accessing the hardware, disassembling the bootloader to find some way to work your way around the signature and to update the router in the end. I'm sorry, I'm getting a bit too technical. So coming with that, sorry, Linux is best imagined if you have a desktop computer and the full experience should be like you can build a new kernel, you can make all devices run somehow by getting your device drivers right, compiling some kernel modules, sometimes even more exotic kernel modules that will sometimes even be proprietary, sorry, so after all, it's really messy, you don't really want to do that without proper support, you would like to have the dev kit for example from the chip vendor, that would totally help but usually you don't get to that, there's a contract, you have to sign, usually you have to pay a lot of money to get access to those things and if you're not in education or something, you can basically forget that. I'm independent, I don't have any university backing me so I wouldn't get the nice stuff. So that annoys me, it's really messy and nobody wants to do that. Actually there's people who love reverse engineering stuff, people who love finding things out but this is a multiplication problem, you don't have just one router out there, you have like hundreds of them, hundreds of models and if you have fun assembling like one boot loader, maybe the second won't be funny anymore, maybe the third will be really annoying and maybe the fourth you won't do at all. After all, we need some way around that, it would be nice if we just got the complete sources for every distribution that's out there, not just the kernel sources but also the sources to their web front and they use the VPN solutions that are installed and stuff and it would be nice so I would say give us all your code but I'm just saying that, nothing will happen. So next up is smartphones, you can see I'm skipping over it because in the course of the development of this talk, something changed. My point was kind of made by somebody. So we're not going to talk about apples and Microsoft today because that would be too easy, right? It just doesn't make sense to bash them. So Android is Linux 2, right? But it has the same problem somehow. So in the Android world, you have chipset vendors, people like Broadcom again or MediaTek, there's a lot more and if you're not Samsung or like Google, you don't control the complete chain of creating this product.  Usually this ends up in a demo board with some vanilla Android attached to it. So now you have to find someone who wants to be Samsung, of course that's easy. There's literally hundreds of companies out there trying to do this. And those companies would be the product vendor. I have, for example, I have a device from Vico, it's a French company doing the exact same thing. And they basically make a nice design with shiny 3D animations and gloss on it and stuff and they figure out how to pack the PCB, the battery and everything into that device and they basically will prepare a campaign for that, launch the product and then of course money. And that's how far they think. Usually this goes on for like a year or something and then something bad happens. For example, like an exploit could be a buck that just crashes the device and bricks it or something. But in our case, let's assume it's an exploit. So usually Google would assess the exploit, would really deeply look into it or Samsung. It's not just Google, a serious company would look into that exploit, devise a fix, fix the bug, make a nice package and push it out to the users and bug them to basically install it because it's so important, it's an update. You have to do it. And then there's how many other vendors do it. So this is a huge problem. They don't do anything. They don't do anything. They just sit it out and hope nothing will happen. They hope nothing will happen. So let me tell you the story of my weekend. On Wednesday, I believe it was Wednesday, good friend called me and he said, well, I'm going to Easter egg and we have a problem. There's two workshops where the people couldn't come and couldn't you come over and like do something. And I was like, oh, a workshop? No, I can't do a workshop. Maybe I can do a talk. What's the furthest away day? I can do something. And he said, yeah, well, Monday. I had a little idea talking about the lack of software updates on Android and on Wi-Fi routers. And I was kind of joking with him and saying, yeah, well, the really good example to show how big a problem that is would be something like kernel level remote code execution. But when does that ever happen? Like when you can reach it? So I don't know. Out of a guess or a hunch, I just Googled that. And I was like, well, I don't know what phrase. And few days earlier, as it happens, there was an exploit was made public. So you can see it was actually found in 2016. That's a name and just a researcher that found the exploit. And what it basically does is own your PC. And I was like, well, I don't know. So I just looked at it remotely with full powers. You're not root. You're beyond root. You define what root is your kernel level. And it's actually pretty easy to write exploit for this because you can link against Kali seek directly, but it's out of scope. So what about this bug? It's something you should be honest about. That's why I had the word play with Ernest and kernels. It's Oscar white novel. You don't have to get that. But it's serious. It's serious. It's severe. It's pretty bad. It's really bad. But everything needs a context. And even this exploit is not almighty. Turns out it just refers to the receive from receive message function. I don't know why the road receive from. It's basically the same. It gets linked in glibc to this is called receive message. Concerning UDP used with the message peak flag. That sounds very technical. Basically, what this does and it's a totally legit use of code. I have to stress that and I will stress it multiple times because names will show up and you will hate those names and no, it's all cool. You can do that. And the bug is on the kernel side. Every software I will tell you about from here on is perfectly innocent. The kernel was the problem actually. As you can see, the current kernel version is something around 4.10 or maybe 4.11 already. I don't know. This was 4.5. Still a pretty recent kernel. Many stable releases have not yet made it this far. So what you can definitely say is that no Android device has such a recent kernel. And what you can definitely say is that probably no Wi-Fi router out there has such a kernel. So maybe to clarify the context we have to clarify what UDP is. Maybe not everybody knows that. Let's rehash. It's TCP sister protocol. TCP is basically a stream-based protocol. You have a two-way connection and you can write to the other side. You can read to the other side. The order will not be changed and it will be guaranteed to be delivered if possible. UDP on the other hand is a packet-based protocol. So you have no guarantee over the order. You have no guarantee over the arrival of messages. You have no guarantee at all. You might get an error back. You might. So it's lighter than TCP. That's one of the main reasons we have it. It's very versatile. You can basically build TCP on top of it or some other protocol. And it's used in some pretty, pretty, pretty important parts of the Internet like DNS that gives you Google.com or any other domain you could possibly want. And it's also used in DHCP, which is the protocol giving you your IP address when you enter a Wi-Fi network or some other network that has automatic address distribution. So those are pretty core. Those happen to be everywhere, those two protocols. It is also used to penetrate network address translation, which is measure or a technique. Your Wi-Fi router and other routers will use to make multiple users use one connection, basically. I will explain this in detail now. Well, not really. The reason we have IPv4 is that IPv4 is running out of addresses. And we have a replacement UDP.  We have a replacement that's IPv6 and that one is not coming along very well. It's getting better. It's being implemented here and there. But not everyone has it. And many people still just get an IPv4 address to use the Internet with. And that's why we have NAT. So basically if you have a computer here and a computer there, the NAT will note and remember which computer wanted to talk with which site on the Internet. And when the response comes, redirect it to the correct computer, to the computer that actually made the request. So that's nut. The industry tends to tell us that nut is a security technique. It is not just like virtualization is not a security technique. You should really not trust any machine that runs one thing to be completely disconnected from the other thing. There's always ways around it. And CPUs have caches. So it's wrong that nut is a security technology. But right now it may be actually be the sad truth. At least do we know more. Why am I saying that? Because the situation with this exploit is pretty, pretty, pretty complex and pretty vast. It could be the end. But I'm pretty sure it will not be the end. So it's probably going to raise some eyebrows here and there and make people pretty nervous. Maybe even make someone release an update who hasn't released an update in 10 years. I don't know. So what we have to find out is which software is affected. And this is crazy because usually you would do the reverse thing. You would see which software has a bug. But this time we have to look for software that doesn't have a bug. We have to look for software that uses totally legit code on a broken kernel. And will therefore forsake your system and your whole security. And that was pretty adventurous, I can tell you, the past few days. I didn't have that much time to do it in detail. But I was so shocked that I kind of decided to make this the bigger part of the talk. I was actually just going to reference it as, you know, here's one perfect example where you should update your operating systems even on embedded devices, even on your Wi-Fi router. So IPv6 is affected as well. There is another way to get around your NAT. If you are so lucky to already have IPv6, many ISPs have not yet found out how to configure a firewall for IPv6. They just have IPv4 rules. It's pretty devastating. So this could be a problem as well, but I didn't look too deep into it. If it works, it works. If it doesn't, it won't.  If you are on, like the local Wi-Fi with your cell phone, your firewall won't help you. There will be no NAT around you. If somebody could exploit that bug and you would, you would have some software running that is prone to this attack. By the way, you could do that by! So are you really sure? Nobody in this room has Skynet already? I have Skynet. So what software would really do that? Messagepeak is a flag that makes the kernel give you the next packet. In this case, could be the next few bytes on another protocol, but in this case it will give you the next packet without deleting it. So you can just take a peek. Is there something interesting for me?  If there's something interesting, you let the evil intruder become rude and just be done with it. So keep in mind, using this combination is totally legit. It's just an interface the kernel offers and the kernel broke. So even if you hear a few more popular names here or if you don't don't curse the software I'm going to put up now. So what apps do actually use that call? I did a quick search, downloaded all the Debian and Arch sources and grabbed through them. I have fast internet connection at home. So that's actually too big. Just a sec. Sorry. So now everything is going down. I don't know what happened. Okay, there's a lot of packets. I found like 800 packets when I started out just looking for message peek. So it's not that uncommon. Famous German security researcher said, well, that's not so uncommon. I can't cite any case. He was shown a few cases in the ensuing hours. So there's loads of programs that possibly could expose this bug. The artist finding out which programs really have this bug. So the first thing that came into my mind when I read UDP was the DNS protocol because it's the most core, most essential protocol of the internet. The internet wouldn't work the way we know it without it. So in this case you had to check like core libraries, the G-Lib C library for example, how they handle DNS requests, how they ask the server and wait for the answer because that's the point where the exploit could actually be used. And turns out there's no danger here, no apparent danger here. Let's say a bit of a distance. I checked Bionic to be safe. It's a derivative of other Libs so it was pretty improbable that they actually added something like that. But I wanted to be on the safe side and it doesn't look like DNS would be affected anywhere. Because I'm a Stripped Kitty and use Node.js I also checked LibUV because it's used almost everywhere for event management and a lot of stuff but it looks safe to me. So that's the good news. In more good news people speculated that system would be affected which is a system, we have a good German word for it. It's called the application that brings up your system, checks the time, if you have a service here it can totally receive a package, start the service, pass on the message just like Inet was doing a few decades ago. No. So it's very popular, many distributions use it, the Debian has it as default. If that would be exploitable we all would be fucked. So there was one line over there, it said receive message, peak, if the peak variable was set, fortunately I checked which file descriptor type it was calling and it was a net link socket, it's not UDP, the kernel should, if the kernel was not again in error, the kernel should totally call the write receive message or receive from function, not the UDP function. So that was close. So let's get over to the bad news. What's probably affected is anything local, of course, it's a remote exploit that goes to kernel level. You usually have software locally that would expose that exploit. I looked into a few things I could think of, any NetCut version has it, NetCut is a program to just pipe network streams here and there. It's like a Swiss Army knife of networking and it's probably affected just as Nmap, very important security researcher tool, etc. There's even open SSH is a NetCut implementation, if you don't have a NetCut, open SSH will give you this version, even it seems to be affected and keep in mind it's not affected as in it does something wrong, it's affected as in the kernel will harm it if it does that call. So busybox could be, there's one case where I'm pretty sure UDP sockets could end up being called with this message peak flag. There's also an iNet de-implementation but I think that's a control port. I didn't have time to check it in depth because it was really confusing in that five busyboxes. I don't know. It's pretty clean but it can be disturbing sometimes. What's really a problem is DTLS. If you know TLS or heard of SSL it's what usually makes your browser connection safe. DTLS is the version for data-gram-based protocols and it's basically used by banks to trade a lot. So it's kind of an important protocol and not many people actually know it outside of the realms where it's used but it exists and it has been used for some jobs quite extensively. I really hope those people are aware of it because I checked some implementations. This is just don't be angry at OpenSSL again. It didn't do anything wrong this time. So DTLS seems to be affected and that could be a really big problem although the markets didn't crash as far as I know. I hope my talking about it will not change that. So let's come to really, really, really bad part. Most of the Wi-Fi routers out there based on Linux will have some kind of embedded Linux low-size system basically being based on busy box or some lightweight tools that they can use to do stuff other systems do with hundreds of megabytes in let's say four. So I looked into DNS mask because it was speculated it would be vulnerable to. Turns out it is vulnerable. So as far as I checked, you don't please don't take this as an absolute verdict because as I said I didn't get to check everything very deeply. I couldn't do like a life exploitation test on it because it just didn't work and I had to abort the test in order to write the rest. So VPN software is also probably affected but only if it uses for example the Ike program I found some suspicious lines in there as well. But the really bad thing is DHCP because it's going to be used. We can be sure it's going to be used. The rest is basically would be bonus. So your Wi-Fi router is probably affected if your provider doesn't force upgrade it or the vendor gives you an update, you're basically only protected by your nut.  If it's actually the case and that should be verified, I really don't want to have a final verdict on that yet but it's UDP, it's used with that flag and it seems pretty bad. So also virtually all cheap Android devices and that's why I explained the whole food chain of Android earlier. Somewhere in this food chain people will just try sitting it out, probably don't make an update and that's why this vulnerability can even be probably even be exploited in 10 years if somebody happens to have a cheap Chinese Android phone that is going to run in 10 years. So this also shows another problem we cannot control because it's not open source, there's a lot of voice over IP software out there and video software out there like Facebook, Skype and stuff. We can't look into their source code of course they have external audits but in this case we would actually have to see if they use the syscall on the binary, it's possible. I just didn't want to download Skype right now to check it but this should be checked as well and I obviously didn't do it but the essential thing is voice over IP protocols use UDP to break through your firewall to enable direct communication between the video chat partners so it's probably going to happen and they're probably affected without knowing it yet. The hotspot function on Android uses DNS mask as well because it's just it's a very nice program I use it myself to just set something up quickly I hate the config file and I hate the config syntax but everything else it does quite good and finally this is basically the core problem of this somebody at some point in the future could like give you an app that is totally legit using this syscall you just don't have a kernel that was patched against this bug it was fixed and he could just use this bug and of course it's android you have to press ok I grant this app every network access it wants but that's the kind of kind of click almost everyone does even even I do because you know I'm paranoid but that's a pretty standard request you want to talk to the internet okay do it so Android does things to prepare stuff like that to prevent stuff like that but it could ultimately be exploited and it could basically happen to me if I don't if I don't see it coming if you know in one year I will have forgotten about this probably and somebody will pass me an app and yeah fuck them I so let's come to the really scary part your internet service provider usually has a box at the side of the street cell phone tower I don't know those are usually big Wi-Fi routers or big routers usually running Linux usually needing some kind of authentication and because providers are the kind of people who want to pay nothing and take money for that and basically complain how expensive nothing is they use free radios it's a radio implementation radios is a TCP or UDP based protocol UDP is pretty popular on radios so I look into this and they are definitely using the rights is called definitely using UDP sockets if this setup would be running like this they would just as you are would just be protected by their nuts and firewalls if they had direct exposure to the network they could be exploited possibly very possibly if this whole thing works I you know I could be an easter egg maybe this exploit doesn't even exist I mean it's like a wet dream actually so you really don't want to look into browsers it's it's just scary I did a grab and I actually killed the grab because it was too scary it's used in WebRTC it's used in diverse other protocols you someone should really have a deep deep deep deep deep look into that so this is a rather broad scope every machine that cannot be patched your PC for example will possibly not even have it anymore because you updated at some point and you got in your kernel and it's no problem anymore every server on the internet you can just update there's just that's no problem so even if it's not open SSH remote code execution it is still pretty bad it affects services that run by default and that run in pretty prominent places and exposed places so this is certainly a bad wolf scenario just to get the doctor who reference here and so you might be asking yourself can we just fix it and the answer is it's already fixed it was it was not even deliberately fixed somebody discovered this bug in retrospectively this bug was fixed in 4.5 and he just discovered it last last year and end of last year when it was like 4.8 or 4.9 I don't know this bug is already fixed that's not the problem we can if you can install a kernel yeah but not everyone can do that and actually at this point I was going to show you how I would do it right now with my cell phone my famous Viko cell phone because they actually published the kernel sources for my device and I could just go into the kernel sources apply a tiny patch that changes three lines and I would be rid of the problem the whole action if it worked would take maybe about 10 minutes flashing rebooting and stuff and most of the time I would be angry about my cell phone because it was slowing down the process but not everyone can do that as well so we're in a bad situation right now so this is the patch actually oh it's four lines but okay maybe you can see what happened here but it's it's hard without the context it's a very context-based bug it's hard to spot and so we can all speculate about the NSA putting it there maybe even Skynet I wouldn't go so far I would say the NSA is just enough so we should still check this out I as I said I didn't do complete analysis of this thing I just went through the whole code base and saw what could be affected how far could the problem go something we call a threat assessment but as it was not finished yet is it is not finished yet you can't even call it that it's just a talk it's just me talking and please don't panic right now nevertheless you should take this seriously and if you can we should fix what we can because as we know in infection cases it's it's always helpful to immunize as much people as possible so they can actually have something we can actually have something like herd immunity and I think that is going to be a topic concerning this bug and probably other bugs that will follow because this was only a matter of time and you you rarely get such a beautiful one and of course it wasn't the end of the world because if that would happen on TCP we would be standing here nobody of you would be here anymore North Korea would have taken over and that would be the end of the world we were actually pretty lucky it was just udp so we should make vendors release current kernel trees at least and that's the thing that has been done you can put legal pressure on them you could do public pressure on them the thing that counts is that we get the sources and the kernel kernel tree even if it's messy would make me happy but we actually need device drivers as well because usually you may get a running kernel you can even boot your device with a mainline kernel like the top edge development kernel but you won't get your baseband modem on the smartphone running or you cannot use your graphics card because it's it uses a blob a piece of software that you don't have the source code for and you just have to talk to by a standard interface in order for it to talk to the graphics card for you and this is a fairly popular problem and so we want to drive us as well and that's that's one thing you can we can fix it also we have to think about the future we should make more informed choices about the products we buy and we should refuse having hardware pushed onto us especially if it's not updated as well so conclusions we need access to the kernel sources just to see what's going on if they changed something if they didn't patch something we need need to be able to see that because it's pretty hard reversing that and usually I'd say everything is possible if it's just one incident you can go miles to get an information but if you have it have to do it in like a hundred million cases for hundreds of models of smartphones and wifi routers this is not going to be fun that's something we can do a distributed but it's not fun for most of the people so we need the drivers we want them to and we want the bootloaders to be unlocked in order to take full control of course something needs to be it needs to change with the general situation as I described you can't have this whole situation where the information is kept back by a chip vendor hiding behind the product vendor hiding behind the sales clerk on your car hiding behind the car sales what you know you know what I mean it's been a long day so if you don't do that those markets may collapse because consumers may lose trust and this is just the first buck of this kind I'm not even sure if it actually works as I said I just try to present a colorful assessment of the possible threat if that all works out so consumers might be pretty disappointed and turn towards apple or microsoft and we can have that right so be aware winter is here so if you want you can ask some questions we have still a few minutes left maybe five minutes of questions if you have any I'll sit do you know if that is also usable as a local previous escalation so if yes and there's millions of ways to do it locally you could write this code yourself millions of ways you are talking a lot about the problem of devices of embedded devices that don't get updates with this bug in particular but isn't this problem isn't this a problem for every bug with devices that aren't getting updated and what makes this bug so special well I actually wanted to spread awareness about devices not being updated with this talk I just came over this bug and so the talk came was best specific to this bug I actually would have given you a broader scope with internet of things in it and many other things but current events change that so I have another question what kind of network access is required to create such a UDP packet that triggers this bug is an invalid UDP packet or invalid IP packet or what needs to be done to exploit the bug so as I said I never managed to reproduce the bug itself uh because of short time as far as I said I understand it you can send basically a pretty standard UDP packet you just have to trigger the the context in which the bug would be triggered and for that um I unfortunately uh was lacking the expertise and time but uh the bug is real it's uh it's um it has a cv e number it's rated 10 in every category so I guess it is exploitable if it finds a tech surface and that's what I was assessing I just didn't go into that if I had more time I would have done that I actually was hoping to be able to demonstrate something quickly but never works about your special device um there's the binary modules in the kernel like my cell phone yeah yeah yes I have um blobs for the baseband modem and I have blobs for the graphics card and um as I have seen it on all the embedded platforms I've worked on um be it raspberry pi be it uh more router specific chipsets with lower power um they all have kind of this problem they will all require um proprietary uh proprietary software at some point although the raspberry pi has been pretty unlocked uh very far so um the whole raspberry pi experience is is in my opinion is about unlocking the nda clauses uh on the hard uh on the hardware and getting the information to write open source drivers and the pi is the furthest one I guess uh you can always buy google nexus and stuff uh something you won't get um you won't get a binary blob free hardware um but it will be better you will have better uh uh support through the code base and it will just work but uh that's I guess that's not the phones most people can afford or want to have that so that's sad maybe a bit more of a comment besides the smartphone market and tablet market there are some uh silicon vendors which produce stocks for which we now have uh yeah full mainline uh kernel support graphic support and video support so on top of my mind there's uh the free scale imx6 which has the atomvif driver which some colleagues of mine uh worked on and are maintaining and yes but and there's also the the raspberry pi where there will be probably some good quality 3d acceleration and measure you you're making a very good point there everyone get a pyra everyone get a pyra that's one of the possibilities to get such a platform and it will actually rock if it's ever done and I'm pretty confident it will be done so it's not as fast as current smartphone ships no but actually don't require do we require like eight cores with two gigahertz two gigahertz each I think most of us don't yeah it's a trade-off you have a fully open system you have full control over the host and you can fix bugs so that's worth a lot more than fast graphics you preach into the choir choir are you afraid you shouldn't be um can you explain the bug if it's possible to understand easily um okay yeah basically the root of the bug was uh uh that um the checksum a checksum that was calculated uh uh in uh second level paths of uh uh uh logic this a check check sum was wrong the first time it does the re uh the right check sum and the second time this uh check fails because something is gone already or has uh has been has been uh um um has been excluded by logic and um that's that's what's actually this small patch fixes and um it's hard to explain because I was actually sure what's happening and uh what was happening and then it didn't work when I tried to exploit it so I'm totally confused now you should probably ask somebody who's unbiased and you know didn't try for like a half an hour to to to get it working and was was was really disappointed because it didn't so I think timing wise we're about through we have like almost two and I think talk is afterwards thank you and uh please would you have a little applause for my friend Max here who invited me who made me come over here who made me make up this talk while I was eating cake with my sisters on sunday he's the best the very best thank you


a big breakfast. And I will start out with sausage and bacon. I always start those first and then I mix up my biscuits. So today we're using swaggered sausage. We always buy it. It usually is in the frozen section where we shop and we get them out by patties. These patties don't curl up. They're nice and thick. This sausage has a really good flavor. It has plenty of spices in it to make it taste good. And a lot of the sausages today are just kind of bland. This is a really good one without it having to be hot to be good. And this is bacon. This brand is called Mariah. It is sliced bacon ends in pieces. I like to buy it like this, especially if I'm going to use bacon for BLTs or salads and different things like that. It's a lot cheaper to buy it this way. And it's still got some pretty good. I always cut up my bacon pretty little anyway when I fry it. So we're going to get some of this in here. See that's a really thick piece. I'll have to cut it. Now I don't flavor a lot of my meats and things that I cook with bacon. But if you do, this is a good way to buy your bacon. I like to take a spatula and kind of push it up off the bottom. So that if it's stuck, the spatula pulls it up. And if you got a good seasoned iron skillet, it won't be stuck much if it is at all. Maybe around the edges. Like that one. I'll use this skillet to do my gravy. You don't want to cook your bacon on a medium temperature so that it has time to get done without burning. Especially if you're using warm ale or something like that. Because they do, some of them, you'll have to look at the ingredients to be sure, but some of them do use the sugar in their curing and it will cause your bacon to get too dark. All right we're going to flip these. They're good and done. I'm going to let them just get a little bit browner on the other side and then we'll take them out. All right, this is good and brown. And if you don't like your sausage to be good and brown like this, I do. But if you don't, you can always add a little coffee in there with a little water and it'll steam it and they get really soft. That's how mama likes hers. So mama many times would add a little coffee to hers. Now this bacon's got a good bit of oil down the bottom, the bacon grease, which is nice because it does a good job cooking when it's like that. And I've got it turned down so low. It's doing a really good job just sitting here while I'm making my biscuits. I know I got biscuits on me but this is part of cooking. I'm going to put some coffee in here and just a little bit of water and we're going to soften this sausage because I really did get it too crunchy. Just let it sit there for a minute. You can also serve that as red-eyed gravy if you want to. Then you got red-eyed gravy and sausage made at the same time. I know it's not ham, but you can make red-eyed gravy out of any meat, not just ham. I'm flipping these over because it was the other side that was so crunchy and making sure they get good and soft on the other side. That would be really good on your grits, that right there. Go ahead and get this stuff out too. Two red-fills in just a minute and start some more bacon. I'm just going to pour up this in a little measuring cup. If somebody wants some of this on their grits, they can have it. But not everybody likes that. There it is. Somebody wants it. I'm going to start some more bacon and then I'll be right back and we'll make some gravy. All right, we're getting out some more of this bacon and I was going to show you how. Since I don't season a lot of stuff with bacon, as far as you know, the big bacon pieces, I'm slicing them to fry. This part right here was all one hunk, but it's all pure bacon, neat and not fat, which is something you don't even get a lot of when you go to the store and buy bacon. This one is really thick.  This is a way to knife and just take your time and be very careful and slice some bacon. That way you don't have to just use it as seasoning for something. You can fry that too. There we go. I'll flip these again. They look good. These are getting a lot brown on that side of this over here. Lots of times you can rotate stuff. One side looks like it's getting browner than another side, especially when you're frying up steak and country-fried steak and stuff like that. Make sure you rotate it if you need to. With a little red, because we got it, why not? I think I got more grease in mind than coffee, don't you?  But as the cook, I may go ahead and have me a plate and then make everybody some eggs, and that way I can take care of them instead of eat with them. Y'all have a blessed day and we thank you always for watching Colored Valley Cooks where we cook like our mamas did. I can promise you that everything on this plate is delicious. Bye. Y'all come back and see me. I love you.


One-to-one on the J-roll Very nice for the Phillies And it's gracious what a case