Hello and welcome to the session. This is Professor Farhad and this session we would look at variance analysis introduction to it and specifically we're going to be covering sales activity and price or profit variance. This lecture as well as other lectures will be posted on my website along the PowerPoint slides so you can access this from my slides. In this session we're going to be introducing the idea of variance. What is a variance? Well it's all based on the idea of budgeting. If you remember in the prior session we look at budgeting. We looked at how do we budget and we learn about budgeting. Well budgeting is good so but let's assume the budget is here so we budgeted we plan to do certain things that's that's good nothing wrong with that but what matters is we want to look at what happened actually okay so we're going to have to compare the actual to the budget to see what happened to compare our performance to understand what we did right what we did wrong and if there's any changes we need to make we need to make those changes to get back our performance online we need to constantly review our budget versus actual. Now in this session we're going to be introducing new terms something called favorable variance and something called unfavorable variance. How do we know because I'm going to be defining those or I'm going to be using those so before I use them I would like to define them how do we know if something is favorable or something is unfavorable? When do we say a variance is favorable? It's when the variance that's taken alone that specific variance increases operating income if that change increases your operating income what does that mean? It's meaning either either have more revenues or less expenses then it's a favorable variance. What is unfavorable variance? Variance that's taken alone reduces operating profit. When do you reduce your operating profit?  So to illustrate this concept the best way to illustrate this concept is to basically draft real quick a budget a budget compare the budget to the results and talk about this analyze them line by line. Now the budget that I'm going to be working with or the budget the numbers I'm going to be working with here they're they're on the PowerPoint slides but I would like to I'd like to put them down step by step this way you see what happens. So let's assume we are dealing with the month of January just for the sake of illustration. So we're going to be looking at sales and sales and and sales is 840,000 and for the activity this is the actual this is what happened actually and we make this a little bit smaller maybe because this is a little bit large and there we go and we sold we happened to have sold 80,000 units so this is for 80,000 units so the sales was 80,000 then from the sales we are going to deduct less variable cost which is variable manufacturing cost happens to be 329,680 we're going to deduct variable cost that's selling variable cost that's selling and that's going to be 68,000 so we have variable cost of total of 397,680 this so this is total variable cost sales minus variable cost gives us a contribution margin of 442,000 320 dollars this is what's this this is the contribution margin sales minus total variable cost now let's let's list our fixed cost we have fixed manufacturing fixed manufacturing cost and it happens to be 195,500 fixed selling cost it happens to be 132,320 the total fixed cost is 327,820 and our profit is 114,500 this is our profit so this is the numbers that we're going to be working with this is what actually happened for that particular month we said let's consider it month of January now we're going to compare this to our budget and specifically to our planning budget planning or static budget okay our planning budget sales should have been we budgeted sales of a million dollar we budgeted variable manufacturing cost of 380 we budgeted variable selling of 90,000 the total was 470 of variable cost the contribution margin that we planned for was 530,000 okay then the fixed cost fixed manufacturing cost was 200,000 and the fixed selling cost was 140,000 a total of 340 and we planned the profit of we planned the profit of 190,000 which is contribution margin minus the fixed cost I hope you guys following this so we planned profit of 190,000 so the question becomes what happens well well I did not tell you this but I need to tell you this which is very relevant what we did is we planned when we plan our budget we plan to have sold 100,000 units okay guess what we only sold 80,000 unit so the question is can we compare this budget to this budget can we compare the actual to the planning and the answer is nothing will stop us we can compare we can compare the budget to the the the actual to the planning but what's going to happen it's going to be in a sense not that meaningful why because here what you're comparing you're comparing two level of activities you you plan for 100,000 unit and you actually sold 80,000 unit of course of course you're going to have overall unfavorable variance of course you're going to have unfavorable variance in the sense that your profit under the actual will be less overall why because you sold simply less unit you sold 20,000 unit so to make to make such comparison it will be in a sense useless can you make it sure sure you can okay let's go ahead and look at such such a variance so if you want to do so here's the variance between the actual and the master budget well sales revenue is unfavorable variable manufacturing cost is favorable variable selling cost is favorable overall you have unfavorable contribution margin your fixed cost manufacturing was favorable fixed selling was favorable overall you are unfavorable 75,500 once again this is practically not practically in a sense we're not going to use it we're not going to use it because it's not that useful for us so what does that mean does it mean we need to throw away our planning budget no what we need to do now we need to flex the budget and what's flexing the budget flexing the budget means taking the taking the activity level to 80,000 so rather than making a budget based on 100,000 we are going to make a budget based on 80,000 units so we're going to call this let me do it in a different color the flexible the flexible budget okay flexible budget in this budget this flexible budget it's going to be based on 80,000 unit so basically what would have happened if we actually sold 80,000 unit well what was our selling price what was our budget at selling price well we were planning to get a million dollar we were planning to get a million dollar okay a million dollar in sales based on a 100,000 unit so our selling price was our selling price was 10 dollars well if we plan to sell 80,000 unit our sales should have been 800,000 well our variable manufacturing cost was 380,000 based on a 100,000 unit output that means it's 380 and our variable variable selling cost was 90,000 based on a 100,000 unit output 90 pennies now what we do is we take 80,000 80,000 unit times 380 which is 304,000 once again this is 80,000 unit times 380 then we're going to compute our variable selling price which happens to be 72,000 and that is 80,000 unit times 0.9 90 cent per unit now we can compute our total variable cost under the flexible budget 376,000 our contribution margin is sales minus variable cost which is 424,000 then then we're going to now list our fixed cost but before we proceed that's before before we proceed let's analyze this let's analyze the difference here before we proceeds let's analyze the difference between between the the profit the contribution margin profit the contribution margin profit let's find the difference so what was the difference okay so we we were planning to have 530,000 and for comparing the flexible to the planning in 424 that's a difference of 106,000 there was a difference in the contribution margin of 106,000 so what caused that difference what caused that contribution margin difference well one thing and one thing only caused the difference between the flexible budget and the planning budget so when we find the difference between the flexible budget and the planning budget we call this difference sales activity variance and why do we call it sales activity variance so this is a term you want to be familiar with sales activity variance so the sales activity variance is the difference between the flexible budget and the planning budget what causes the 106,000 difference this 106,000 difference it it's caused only this the sole cost for it is the number of units sold guess what under the planning budget we sold more units let me show you remember our selling price per unit is $10 okay our variable cost is $380 okay and our variable manufacturing costs $380 variable selling price is 90 so per unit if you look at per unit $10-380 clear $10 selling price minus $3.80 minus 90 pennies clear again 10-3.8-0.9 $5.30 is your contribution margin per unit and you sold 20,000 unit less times 20,000 unit $5.30 times 20,000 unit less that's your variance of 106,000 so the difference between your flexible budget and your planning budget gives you what's called your sales activity variance so the only the only thing that explained this is the sales activity variance okay why just because of the sales so notice here if you want to you could compute the difference for each this is 200,000 you could compute the difference for those two and you could compute the difference for those two and when you net them they net to be 106,000 so this is how we compute the sales activity variance okay so this is one term you need to be familiar with sales activity variance now when it comes to the flexible budget guess what the fixed cost should be the same for the fixed manufacturing and the fixed selling because the definition of fixed cost is it's fixed in relationship to the activity so there should be no difference there therefore if you look at the bottom line if you take 424 minus the fixed cost minus the fixed cost let's let's go ahead and compute this the fixed cost is 340 so let's state 424 424 424 minus 340 that's going to give you a profit of 84,000 now if we take 84,000 minus 190,000 the difference between those two is 106 so notice fixed cost is not really relevant in this comparison because the flexible budget and the planning budget the fixed cost should be the same in a sense so once again the only difference in the in the bottom line between the flexible and the planning budget is it has to do with the sales activity you sold less unit well you're gonna have less less less profit how much less profit you're going to have it's your contribution margin times the less profit and the opposite would have been true if you sold more units than more units than what you planned for okay so now let's now move to the other side of the the other side of the budget and now we're gonna be doing rather than rather than the sales activity we're gonna be looking at the difference so we're done with the sales activity now we're now we're gonna be comparing the actual the deflexible the actual to the flexible so let's take a look at the difference well the difference in sales that Let's start with sales, the difference in sales. The difference in sales is $40,000 and that's favorable. What does it mean favorable? That means if you report sales of 840 versus 800,000, your profit will be higher by 40,000. Therefore, the variance is favorable. So what caused this variance of $40,000? Well, what caused this variance is the selling price. So what caused the $40,000 favorable variance? It's the selling price. So what happened is somehow, somehow you had a pricing power. You had a pricing power. Maybe there was a high demand for your product. Therefore, what happened?  So now you have $40,000 more. So let's compare it on a per unit base. Your planning, your selling price was $10. That's what you planned for. But guess what? You sold 800,000, your sales was $840,000 divided by 80,000 unit. So 840,000 divided by 80,000 unit. You were able to charge your customers $10 on average, $10.50. So that's good. So you had a favorable, favorable, and we call this, this is the sales price variance. This is the, this column, we're going to call it the sales price variance or the profit variance. Well, you made more profit. Why? Because you were able to sell at a higher price. Not because you sold more or less unit. Now this column here is the selling price. Let's compare your variable manufacturing overhead to your, between the flexible and the actual. And here what happened is you should have spent $304,000. You spent $329,000. So now what you have is, well, this is unfavorable, not good, not a good, not a good variance. $25,000, $680,000, and that's to you. That's unfavorable variance. Now why did that happen? We'll examine that later when we drill a little bit down. All we're focusing here is on the sales variance. Let's look at the variable selling price. Variable selling price. You're supposed to spend $72,000. You spend only $68,000. That's good. So there's a difference of $4,000. And that's a favorable variance because you spent less. Now if you want to, you could compute the contribution margin, the difference between the contribution margin variance. And let's do so. So $424,000 minus $442,000, $320,000. And that's $18,000, $320,000. So you have more profit $18,000, $320,000, which is favorable. Or you could do, you could also net these out. Favorable, unfavorable, and favorable. And you'll get to the same figure, which is $18,000, $18,320. So that's basically what we did. We did the sales price variance. Sales price variance. Now the only thing we're going to also analyze in this example is the fixed cost variance. Well, to tell you the truth, the fixed cost variance, you should not have any. In theory, and in practice, to a great degree. Why? Because fixed cost is fixed cost within the relevant range, and we're assuming within the relevant range. The fixed cost should not change. But let's first compute the figures, and we analyze it a little bit further. Your flexible budget is $200,000. You only incur $195,500, which is, in a sense, it's good. In a sense, it's good, which is how much it's better by $4,500 favorable. And you plan $140,000. You only spend on the fixed selling, $132,320. So you have also a favorable of $7,680. Now you can, that's also favorable. Now you could also compute the all the favorable, and obviously this is favorable, favorable, favorable. But what happened to the fixed cost? Well, again, the nature of fixed cost, it should be fixed. What could explain this change? What could explain the change? Well, one thing is maybe you forgot. Maybe the company forgot to include something or did not do something they were supposed to do. So they did not incur an expenditure that they were supposed to do. Or they maybe anticipated a rate increase, maybe their insurance. They anticipated a rate increase in their insurance, in their insurance premium, but it did not happen. So that's why they planned $200,000. They thought, well, the insurance company, they're gonna hit us with a rate increase, but it did not happen. That could be the case. But to a great degree, to a great degree, to a great degree, there should not be no change. There should not be no change between the two, between the two, okay? So let's take a look at the overall difference at the profit analysis. 1,400, 500, minus 84,000. The difference is 30,500. Again, you can reconcile, and this is obviously favorable. So we did better. And the reason, the main reason why we did better this month is because we were able to sell at a higher price. And that's a little bit unusual for companies to plan for 10 and to get 10, 50, unless the marketing people, they already knew they couldn't get it for, they can get it for 10, 50, and they priced it for 10. So they look good, beside the point here. But the point here is they were able to do it. And let's reconcile. If we take the 30,500, 30,500, and we can analyze the numbers. So we have 18,320 favorable, just to make sure you could reconcile this, 18,320. Then we have 4,500 in the fixed manufacturing favorable and 7,600 in the selling. And if you net these out, they net out to zero. It means, you know, you're able to explain everything. So this is basically the sales variance. Now I'm gonna go back to the PowerPoint slides and I'm just gonna go over this. Again, we said this number is really useless in a sense because you're looking at apple versus orange here. So this way, this is not very good. This is not very good. Remember the static budget is for a single activity, usually the master budget. Then we learn how to flex the budget, the budget that indicate revenue, cost, and profit at different level of activities. And what we did here is we flexed the budget. The static was 100,000 unit. We flexed it to 80,000. Then we did our analysis. Remember the sales activity variance is the difference between the operating profit and the master budget and the operating profit and the flexible budget. It's called the sales activity variance. I showed it to you. The variance arise because the actual number of units sold. It has to do with the number of unit sold. It has to do with the number of units sold. And this is the sales activity column that I showed you earlier, but this is cleaner. Okay, you could examine this. Okay. The profit variance analysis is analysis of the causes of the difference between the budgeted profit and the actual profit earned. Okay, so what was the budgeted profit? What should have been the budgeted profit and the actual profit tested with sales price variance? This is what we focused on. Fixed production cost variance, variable production cost variance, marketing and administrative cost variance. And this is basically an overall picture what I just showed you. So this is the 75,200 comparing the master budget to the actual budget. And we say you really don't wanna use this because if you are asked to do so, that's fine. This is the total variance from the master budget, but just in the real world, you don't do it. In the real world, what you do, you prepare a flexible budget and this is what I did. This is what I did. Then what you do is you start with, if you want to start with the sales activity variance and you analyze the difference. And this is the 106 that was unfavorable because we sold less unit. It has to do with less unit. And whatever we get favorable or unfavorable, that's gonna go down to the bottom line to the profit because the fixed cost, it should not have any effect on the sales activity variance because fixed cost is fixed in terms of sales. Then you could compare the flexible budget to the actual budget. And here what they did in this slide, they broke it down into sales price variance. And we said here, you were able to charge more. Therefore your sales was higher, although you are selling 80,000 unit. Your variable manufacturing overhead cost was unfavorable. Your variable selling price, which was favorable. And don't worry, we are going to do a little bit more into these figures. But the point that I want you to, the big picture that I want you to start to see is this. Notice what we did in our analysis. Let's, I'm gonna break it down into two component here. I'm gonna break this down into two component. So this is the flexible budget. Basically the flexible budget is the middle. What we did here, we looked at the quantity. So this is the change in Q quantity because on this side, everything happened because of the quantity. And on this side, everything happened because of the price. Okay, and what we're gonna be doing later, we're gonna be drilling when we do additional analysis. This is just an introduction when we drill into our direct material, into our direct labor, into variable manufacturing overhead. We're gonna be broken down. We're gonna be broken those figures into price and quantity or efficiency and usage variance. Okay, so just get, just look at, I wanna make sure you understand the big picture. And we'll look at this later. Don't worry about this. Don't worry about this. But this is an overall analysis about the sales activity variance and the profit analysis. If you have any questions, any comments by all, by all means email me. If you're studying for your CPA, make sure you study hard or for your CMA. Good luck and study hard.


Check it out, you guys. I'm making homemade chicken and dumplings for under 20 bucks, and it only takes you about 45 minutes, and I promise you, anybody can do this. You're gonna need three large stalks of celery. I'm using like five decent-sized carrots. I'm gonna use one small onion. Now reach down on your hip for Dano's original. We got about a third of a bottle. We're gonna add all that in there. I know I can run to Walmart or Kroger, or go to the Dano's seasoning website and check out the store locator. Now we're adding 12 cups of chicken stock. We're also gonna add six cups of water. Now the beautiful thing about Dano's and the chicken stock is that we already got enough salt in here. We're gonna bring that to a boil just to let the vegetables cook for at least 15 minutes. Now it's time to make our dumplings. I'm gonna use about three cups of flour. Now the key here is I like to use self-rising flour. Now I'm gonna use a half stick of melted butter. Usually I would use softened, but I didn't have any soft. We're going in with Dano's original. The one cup of warm chicken stock. We're definitely gonna have to add some more flour. Now we got to this consistency.  We're gonna knead this all together. Flatten it out a little bit. More flour, fold it over, press it in. Just keep doing this. There's our dumpling ball. Put some flour out on your table. Go down. Now you need a pizza cutter and a rolling pin. I'm gonna cut it into three sections. Set these two to the side. Just start rolling it out. I wanna keep it kinda thick. Scrape up your dumplings. Look at that, perfectly cut, just how I want it. All right, our vegetables are cooked. We're on a soft rolling boil and it's time to start adding some dumplings. Make sure you don't just throw them all in. Drop them in one at a time.  When you use your spoon, just use the back of it to move them to the side. Don't stir. Look at those monster dumplings, you guys. That's why I like using the self-rising flour. They just tend to puff up a little more. We got these little crusties in here. So we're gonna get some of these that actually got the dough bits in them. It's gonna help thicken up our broth and really turn it into like a gravy. Put the lid on, turn it to a simmer, let them cook for about 10 minutes. Get your rotisserie chicken. Definitely adding that juice in. Get that chicken pulled apart. I like to leave it in bigger chunks. All right, it's been about 10 to 15 minutes. We're gonna turn it off. So now the last step is to add the chicken. Let that chicken come back up to temperature and you're ready to eat. Time to serve it up. It's time to reap the rewards. Let's give it a try. Wow. You wanna add a little spice. Either add the spicy danos or the chipotle. I love the spicy danos on some chicken and dumplings and gives it an awesome little spice.  I hope you enjoyed. It literally took under an hour to make this. From scratch, yum yum get you some.


Hello. Hi. I'm Yuval. I work for Red Hat, and I prepared that together with women that sadly couldn't stay for this Friday, so I'll do the presentation myself. I work on the self-storage project, and let's see what we have today. So a little bit about the agenda. We're going to be, I'm going to be pretty much all over the place. There'll be a lot of things I'm going to touch upon. Eventually everything would hopefully converge into one nice demo. So first the background, a little bit about the ransomware. A big disclaimer here. I'm a storage developer, not a security expert. So everything I'm saying here about security, please take with a grain of salt. A little background about information theory, and then the architecture. I'm going to cover SEF. I'm going to cover RUK. I'm going to cover what I did with Lua, and then hopefully tie everything together, explain, and then demo that. Okay. So first ransomware. So ransomware is here to stay. Information data is one of the most important assets that organization has, and the criminals or whosoever's want to take advantage of that will do that. So this is such a powerful tool that it's not going away, anyway. If you think you're going to build strong walls around your organization, then you're wrong. The first line of defense will break, because either via social engineering or somebody from inside the organization or a day or zero day attacks, the malware will get in. So you cannot assume that the malware will just stay out. The important thing is to think what you're going to do once it's in. Now, one important thing about ransomware to know, it's not like when the malware hits or crosses into the organization, then everything is suddenly encrypted and you have no access to your data. There's an incubation period, and incubation period is actually how the, well, it's for many reasons. First of all, usually the ransomware gets into the organization through one point, and then it needs to spread in the entire place, and that takes time. The encryption process itself also takes time, and more important, they know that people have backups. They know that you have snapshots, and usually an operator for their ransomware, like a real person that controls the things from somewhere, will check what are your backup systems, what's your retention period. So let's say you have a one month retention period, then they would find that out and would wait for one month and encrypt your data in a way that it is still accessible to you, and then after they know that all your snapshots are encrypted as well, this is what they'll turn the plug on. This will be in a time where all the data is already encrypted, all of your organization is covered by their malware, and then your snapshot doesn't help you at all because they're encrypted as well. So during this incubation period, this is the time that you can still save your data. If you detect that there's malware going on, this is the big question, because they're going to do everything that they can to prevent that. They're going to make sure that whatever they're running is going to be well hidden, so when you scan your hard drives, your antivirus or whatever will not find that, they'll make sure that they're not going to spike your CPUs, they're not going to spawn some suspicious looking processes all over the place, they're going to make sure that they hide. Now, it doesn't mean that they don't do anything, they have to do something, and there has to be some behavior around somewhere that we can detect during the incubation period, and that would help us to find that there's something bad going on. Now, the characteristics of this behavior has to be something that they benefit from, because they're going to make sure that any behavior that is not mandatory for their operation is not detectable. The one thing that they have to do is encrypt your data, so the encryption itself, the encryption process has to happen, and another thing that we would like to kind of see in this behavioral analysis is something that is an animality. So if business as usual, if we don't detect anything that is different than the usual operation of our system, then we have no way to know that the advancement is going on. And so we're looking for animalities, we're looking for something that they have to do, and ideally, and that's the last point, we would like to have the mechanism running not on the infected machines. So usually the infected machines are the desktops and maybe some other servers of the system. I won't say always, but in most cases, something like the storage servers are usually not infected. So the storage servers are administered by fewer people, they have stronger passwords, nobody is like clicking on the wrong attachment in an email on the storage server, and the attack surface is much smaller. So we can hopefully assume that the storage server itself is not infected and is not controlled by the malware. So these are kind of the assumptions around the behavior analysis of storage that we're going to leverage here. Okay, so I'm going to track back for a different topic and then tie that back in. So entropy. Well, by definition, entropy is the amount of information or uncertainty that a random variable has. Now, a random variable is just something that gets different values with certain probabilities. So something that has different events and each event has a different probability. And when we talk about the uncertainty of information of an event of a random variable, then the definition, this is the log of the probability of this event. Log in the base of two, why the base of two? Because the events that we talk about are either having zero and one. Those are binary events. So when you talk about an event, it's either something gets a zero, something gets a one, and it has a certain probability for zero, certain probability of one. Minus log of this probability is the information of this event. And the entropy is the average information of this random variable. So I go through all the events, calculate the information, which is the log of the probability, and create an average, which means multiply them by the probability. So it's like a weighted average. So this is the definition of entropy. This is pretty theoretic. And as an engineer, I don't like those kind of things. So I'll take an actual example. So let's look at a random variable, which is just a string. Now, there is one thing that is a bit different here. This string is considered of one of the 26 letters of the English alphabet and a space. So my different events could be different values, like different letters or a space. Those are not bits. Those are not zeros and ones. So I'm going to normalize this. So I have to, in theory, I have to use the log in the base of the number of variables or events that I have. But instead of just using log in the base of 27 in this case, I'm going to divide the whole thing by the log in the base of 2 of 27. This is a logarithmic identity. It works, trust me. So let's look at one of those strings, hello world. So I can calculate the distribution of this hello world. So each letter, a to z, and a space has a certain probability to appear in the string hello world. I can calculate it. It's pretty easy. And then I'm just using that in the formula and calculate the entropy of hello world. And this is about 0.6. Now I'm going to take a different string, a different random variable.  The reason I picked this string, because as you guys probably know, it has all the letters of the English alphabet and some spaces. It's not like every letter appears exactly once. Some letters appear more than once. But this is quite close to what we would consider a uniform distribution. So in a uniform distribution, the probability for each of the events or for each of the letters in this case is the same. Here it's not exactly the same, but it's pretty close. I mean, the couple letters appear more than once and the space appear more than once. But if you apply the same formula here and calculate the entropy of this random variable, this sentence, you see that it is much closer to 1. So I hope this kind of made more sense than the theoretical definition of what entropy is. So how can we use it? Well, we're not talking about strings. We're talking about files. So a random variable now is a file. And the file contains bytes. So it's not 27 values, 256 values. So this is my space of events. So one of the 2256 values. But everything is the same. So all the calculation, everything is pretty much the same. The closest the distribution to a uniform one, the higher the entropy is. Compressed files will have higher entropy. An encrypted file will have even higher entropy. Why is that? When you encrypt something, you want to reduce the amount of information that you convey in whatever you're encrypted. Because if you have the information, then it's clear what it says. You don't want that to be clear. You want that to be encrypted. So you want to make the information as close to a uniform distribution as you can. This is why strongest encryption is close to a uniform distribution, which means that a much higher entropy or entropy much closer to 1. Now, if you wrote some ransomware and you want to encrypt, you would like to have strong encryption.  They will pay money to somebody to break your encryption. If your encryption is strong, it means that you have increased the entropy significantly for those files. Now, you can say that the heart of the problem is how to distinguish something like a compressed file, because a text file will have a very low entropy. You can see this log file here at 0.6. You would see that compressed file, like the JPEGs and other files here, have a pretty high entropy. So the main issue is how to distinguish compressed files and lots of the files that we have, whether it's PDF or docs or stuff like that, they're all compressed to compare them to encrypted files. So you can use file types. But file types is difficult to detect, especially if the malware is kind of making it harder for you to detect that. And also, an absolute entropy threshold, saying above that this is encrypted, below that this is either compressed or nothing, is very hard to come with. But what I'm going to have a look at is the changes. So it just bites. I chunk the file to bytes. So each byte can have, those could be binary. Yeah, those could be binary values like it's not text files or anything. So what happened when you're encrypting? So I've kind of encrypted those files. And you would see that for most of the file, there's a significant increase. Now, for example, the log file, of course, it's a huge increase. The JPEGs and the PDF, well, it is an increase. Does it file? You can hardly notice the increase. So here come into play another thing that I have here. And the fact that I'm looking at a directory. So when I move to the space of objects store, that would be called a bucket, but it's the same concept. And the thing is that I don't have to be right for each and every one of the files. But if something is going on and encrypting all of my directory, then I'll see a difference. Maybe I won't know that for all the files, but I know that for a couple of them. So the fact that I'm using the difference in entropy and the fact that I'm using, I'm looking at an entire directory really helps me here. Okay, so that was entropy. We'll go get back to that in the future. Seth storage systems. So Seth is a free and open source storage system. It's software defined storage. It's free open source. It's free from vendor lock-in. It's also software defined. We don't have any specific hardware requirements for the actual storage devices. It's not an appliance or anything. It's open source. You can change it. You can read it and so on. And the last bullet is what I really want to focus on later on. And this is that it's also open-ended. We're working towards that to be open-ended. Why is that? In theory, you can fork the Seth repo. And if you are an experienced C++ programmer and you're not afraid from a huge project with more than two million lines of C++ code, then you can change it. But if you are afraid of that, you're correct.  So you're good with writing Python code. You don't really want to mess up with Seth. So us as developers, we have the... We need to make sure that you can tweak our code.  So this is why we've worked towards open-ended. I'll elaborate that in a second. Another point about Seth, just to focus us where we talk about, like, in which area of Seth we're discussing, Seth is a unified storage system. So the same back-end called RATUS is used both for files storage, for object storage, and for block storage. Now, file storage and block storage, I'm not going to talk about today. Only object storage. And there are certain characteristics in object storage that makes the whole thing easier. The mechanism or the algorithm are going to make it easier to implement. So I'm going to focus on the object storage. We have something called the RATUS gateway. This is an S3 slash Swift compliant front-end for Seth that gives the object storage functionality to Seth. Now, circling back to the open-ended. Okay, so we need a couple of things in Seth to make that more open-ended. We created something called objects classes. So you can write C++ or Lua code, kind of compile them or upload them, and they can be running co-located with the storage itself. This works for all types of front-ends, like file block and an object, because this is really at the back-end running. We have something called back-endifications. Back-endifications is more for, like, out-of-band processing. So whenever you're uploading something, I'm going to send over-endification to some external system. And this external system can do whatever they want. This could be like a serverless function in Knative, KDA, AWS Lambda, and they can go fetch the object, do whatever they want, lots of processing. The thing is, this is out-of-band. So once they've got the notification, the object is already in the store. So for a use case like I'm going to talk about, which is ransomware, it might be a little bit too late. So it's great for tons of applications, but we need something that is in-line, running in-process in-line, and like the object will not reach the actual storage system before it crosses the execution of this script. And this is the object we were scripting. Another thing here, Cefi is a big beast. It's complex to maintain. It's complex to install. That's a big thing. But for that, especially if you're running in the OpenShift or Kubernetes environment, and like, I guess, if you're in this conference, then you probably know about that. We have Rook. Rook is an operator where you can install, deploy, and even more important, you can manage Cef. You can create buckets. You can even configure bucket notifications. So there's lots of things that you can do. Everything is easy as a YAML. Everything is declarative. So you just write the YAML. There's no order in which you need to deploy things. And eventually, everything is configured and falls into place, except the Lua scripting. Because it's a new feature, I usually, like, first develop that at the actual C++ code, and then I switch gears and I write some goal line code so you can do that nicely in Rook, but I haven't done that yet. So for that, you'll have to actually manually upload the Lua script and do all that work. But I'll do that. Okay. So first of all, why Lua? Well, hopefully, I convinced you that we do need some mechanism that is not C++. You don't need to recompile and test Cef and still be able to change in-line behavior, in-process behavior, of the Red Escape way. So Lua is a mature and powerful language. It's not a very common language. I didn't check, like, on the Tiobi, whatever, ranking. It's not ranked very high, but it's very easy to learn. So, I mean, even if you don't know Lua, in no time, you can figure out the things and write Lua code. It is very lightweight. This is very important because of concurrency. Like, we're managing tons of requests at the same time. So we don't want to create, like, one Lua VM and have locks and all kinds of problems like that. So we're spinning tons of Lua VMs. It's very lightweight. It spins in no time. It's resource consumption is very low. It's very efficient integration with C and C++. So I don't know if you ever integrated with, like, between languages, like, I don't know, C++ and Java is in JNI, you have marshalling and un-marshalling and all kinds of problems like that. In Lua, you have nothing. You just pass pointers back and forth, and you have zero copies of any information. Lua was first invented to do something in the energy industry, but in the past couple of years, it is very commonly used in the gaming industry. So World of Warcraft, you can script Lua into that. I don't know if you have young kids or if you are young at heart, you know Roblox. It's a great game development platform that uses Lua. And the reason it uses gaming, because of the low overhead zero copy characteristic of the interaction between Lua and C++ or C. This is an example of code. Later on, I'll show, like, the real code is just a simple example. So it's all about the context. So it's not like the script can run anywhere. I have to create a certain context with certain bindings between my C++ code and Lua. And the context that I have here is the request context, which means that whenever I upload an object to the object store, that's a request, and it has fields, and those fields, some of them are read-only, some of them are writable. So for example, I'm checking here if the operation type of the request is a put object, and if it does, then I can change something in the metadata of the request, as if the client have sent me some new piece of metadata, and write that. I have an RGW table. This is like a global table in which I can share information between requests or between different contexts. And here I'm also showing that an increment stuff in the table, decrement. I mean, I have a couple of tools here, and this is evolving. Just as an example, some community user did, he kind of posted that, and he said, yeah, I want to change the storage class based on the size of the object. I'm like, okay, you can do that in Lua. So he's checking the size of the object, which is a field that he can read, and he actually made the storage class field writable, and he modified it. So it's a large object. You put it to cold storage, small object to the regular storage. So this is a simple application that somebody wrote, like three lines of Lua, and it has this application. So this is what we do with Lua scripting. Now let's try and tie everything together. So this is kind of a description of the algorithm. Please read the yellow kind of cloud at the side. It's probably wrong. Again, I'm not a security expert. Even if I were, it takes lots of research to get that right. But the beauty of it is that changing the algorithm is like writing a couple of lines of Lua and uploading a new script into our server. You don't need to recompile. You don't need to take the server up or down or anything. You just upload a new script and it works. So here's the idea about the ransomware. I have this global table, and for each of the buckets in the global table, I'm holding a state whether this bucket is infected or not. Well, if the bucket is infected, and I'll later on show how we figure that out, if the bucket is infected, then for each bucket, I have a quarantine bucket. So the reason I have a quarantine bucket is that I have false positives. So if somebody is uploading an object, I don't want to block that. Even if I think that the bucket is infected, maybe I'm wrong. And this is information. I don't want to get rid of that. So if I think the bucket is infected, I'm going to put that in the quarantine bucket, and then later on, somebody will figure out whether this is okay or not. So the information is not lost, but I'm not overriding the good file or the good object with the encrypted object. If the bucket is not marked as infected, then I'm calculating the entropy of the object being uploaded. Now, objects could be used like an object could be a VM image. This is gigabytes or a movie or whatever. So I don't need to calculate entropy for the entire object. I'm just calculating entropy for the first chunk of the object, usually four megabytes, but it could be smaller. Now, I need to see, well, do I have this object already? If this is a new object, I have no idea. The entropy could be high, it could be low. Who knows? Like, I'm just going to write the object, and if it is encrypted, well, tough luck. If I do have the object, then I've saved the entropy of the object before, and I can compare them and see if the difference crosses the threshold. If the difference crosses the threshold, it doesn't still mean that I'm infected with ransomware, because it could be one object out of a hundred or a thousand or a million objects, and then it doesn't mean anything. So I have to update something in the global table and then figure out if I've crossed a certain rate or a certain percentage, I mean, whatever. You're going to change in the algorithm saying, okay, 50% of the new object in this bucket are suspicious or had an increase in entropy. Maybe something is wrong. I'm going to mark the bucket infected, and the next object going to be uploaded is going to be quarantined. And anyways, I'm going to also update the entropy inside an attribute of the object, so next time I have something to compare it to. So that's overall the idea of the algorithm. And as I said, it's probably wrong, but it's easy to change. It's easy to play around with, and this is really the real power I want to show here. One, maybe another step, that's right. So if there is a, well, maybe I'll repeat the question. So the question is what if we're on purpose encrypting everything? So if we're encrypting as part of the storage process, and this is also possible, you can do encryption as the object of being uploaded to storage, then you would see all the information prior to encryption. So this is fine. I mean, the Redis gateway can encrypt stuff, but that is happening after that. So here we're okay. If somebody is encrypting everything on the desktops because they decided that everything has to be encrypted, well, somebody has to know that they're encrypting the organization, and therefore this is not a malware. I mean, I don't have any way to tell the two, right? But I mean, one thing that I haven't mentioned here is you can send emails from Lua. You can do all kinds of stuff from Lua. So I can send an email to the assistant main telling him something is wrong. But then you say, oh, my goodness, I'm running like a full encryption on the whole system now. This is fine.  Thanks for the question. So maybe as for the next steps, as I said, those thresholds, it's very hard to figure them out. One thing that we can do, we can use bucketifications. So some external system reads the object and do some offline processing to figure out, for example, or especially if you can feed the information into it, whether there is a real infection or not. So do some machine learning and figure out better thresholds or better algorithm. But this is really outside of the scope, just an idea. So still have a couple of minutes. I'll try to do a live demo. Yeah, you would look at that later. I mean, I didn't invent all those ideas using entropy. There are a couple of papers. I mean, it's under debate. People say it's good. People say it bad. There's research around that. So you're welcome to read those papers and decide for yourself. Okay. So I have here, I know that in the presentation, I said everything is nicely done in Rook. Running a Kubernetes cluster on the machine demo looked too risky to me. So I do everything with SF without Rook. But I don't, if anyone is interested, I can send you like there is a repo with the all the details of the demo and everything. So you can reproduce that using Rook like in on your machine. But I'm not going to do that. So the first thing I have a stuff cluster running here on my laptop.  So I have a bucket called home. But I also need to create another bucket, which is the quarantine one. Now I have the two buckets. And now I want to put the scripts. So first of all, let's have a look at the scripts. So the, the first script, hope this is visible. Maybe I'll increase that a little bit. Okay. The first script, the quarantine script is the one that check whether the, the global table with the bucket name dash quarantine is true, which means that I've set it to true previously in the other script. And if it does, then I'm going to change the bucket name to the new bucket, which is same dash quarantine. And then the system is going to write that to the new bucket. The whole thing works because this script is going to be running in the prerequest context. So it's kind of done backward. I first need to figure out whether there is ransomware, set the, the flag, and then the next bucket coming will be redirected because after I've already read everything and did all the processing, it's too late. I cannot switch buckets. So this is why it's done. So this is the simple one. Now let's look at the one that actually implements. Okay. So the first function here is the calculating the entropy. So this is pretty much an implementation of the formula that I've seen. It first create the distribution or the capabilities and then go through them and calculate the average. And this is the calculate, the entropy calculation. Now I have the more complex logic and this is to detect the ransomware. So first of all, if I'm writing something to the quarantine bucket, I don't need to calculate anything. It's already quarantine. This is fine. I mean, not fine, but it's there already. If something is not a put object, I don't care. I just need to look at put object. I have something here called an upload ID. This is like objects are quite often not uploaded as a whole. Like they're uploaded in chunks and I want to do the calculation only on the first chunk. So this is why I check this upload ID. So I'm just going to do the calculation on the first chunk with being uploaded. I'm going to calculate the new entropy. Sometimes there's no data in the object or whatever. I don't care about that. Then I calculate the current entropy. If there is current entropy, which means this is an update to an existing object, then I'm checking the difference. And if the difference is crossing some threshold, then I'm incrementing a count in the global table. And if the count crosses a threshold, it means that this amount of object in a bucket are suspicious. So I'm marking the bucket as quarantine. So if you look at the light 86, this is what the other script is checking. If I don't have a current entropy, it means it's a new object. I don't care. I just store the entropy. And that's it. So this is pretty much the code. I mean, it is 100 lines of code. But if you look at that later on, you would see it's not that complex. And even if you don't know who at all, you can read the code and pretty much figure out what's going on there. So let's upload that. So I'm going to upload the quarantine code into the prerequest context. And I'm going to upload the ransomware code into the data context. Data is like when I have the data of the object, and I can read that. Now, I have everything set up now. Okay. So I have a directory here called home. It has a couple of files. You can see them. I don't know, images, docs, some text files, whatever. Alpine, Linux, ISO. And I'm going to upload them into the home directory. So that's going to upload them. Now, I have a WannaCry script. Not really. Just a simple encryption. So I'm going to encrypt all the stuff from the home directory. Usually the encryption would override the files, but in this case, I want to keep them. So I'm just doing that in a different directory. And then I want to upload from the encrypted second. Let's see now what's going on there. So I'm in the encrypted. And I'm going to upload to the same, I mean, it's the same file, same names, encrypted, into the same bucket. And let's see what I see. Okay. So at some point here, you would see, I mean, it could be that some object went through, maybe the first one, and then at some point, I reached 22% of the object may be encrypted. And then when I switched the flag, so from now on, you would see I'm scraping entropy calculation because I'm already in the quarantine bucket. I don't need to calculate anymore. So, and, you know, just for the sake of this is the encrypted bucket. So it has the same file, but you see there's no preview because they're encrypted. And now the most important thing, let's say that I know that something bad happened and I want to recover. So I have a recovery directory. And in this recovery directory, I want to download from the good bucket. So I've downloaded. And you can see that in the recovery directory, well, not everything is 100%. You know, you do see that some of the some of the objects are still encrypted because they went through before I figured out that I'm in a problem, but some of them didn't. So, and this is just a handful. So in a high scale, or when you have a hundred of objects, then you would lose some percent of them. But overall, you see, according to the previous case, you see some of them are actually okay. Yeah. So that's the demo. This is the presentation that I have. I'll be happy to take questions. Yes. I'm using, yeah, just to repeat the question, the question is, did I play around with the threshold? Do I as percentage or absolute? Yes, I'm using percentage of change. I mean, it's, sorry, you can see that in the code, actually. So what I'm doing, and as I said, I mean, I play around with the threshold so it would work. It could be that in real life, you need to play around a little more. You probably need to do some more proper research in order to get the right threshold. So for example, here, I have the, yeah. So I'm checking whether something is more than 0.5% increase, but I'm also checking whether it's the absolute value is more than certain because, I mean, if somebody had a text file, right, and changed the text, it could be that the entropy would change, but overall, it'd be small. So it has to be over some threshold to even be considered as encrypted because, I mean, encrypted files usually like 0.99 at least. And you do also need to see the change. Also, you can play around with the bucket threshold. It's like 20% here. This is pretty arbitrary. You should be able to find the better numbers. Yes. This is if you know your payloads. This is true for some payloads, but not true for other payloads. Like, for example, many of our deployments are for like data lakes, right? So you have tons of sensors and logs and things that gather data, and they're all poured into this huge data lake which Chef implements. So you would see tons of uploads. Maybe not so many runovers of file, but also that. I mean, this couldn't also happen. If you know your, so if you know your payload quite well and it's pretty static, then you can write simpler rules. By the way, you can also implement them in Lua if you want. But especially in environments like where the Chef storage is data lake, you have lots of very, very different users. It could be like that it's a data lake for an organization and different departments are using it for completely different applications. It's very difficult to write one rule or simple rule saying, okay, this is how it should behave because it's all over the place. So the question was how computing intense it is. It is. So this is why I'm just calculating the entropy for the first chunk, but I must say that my next step, and this is really, I was really happy to hear all the stuff that went on here in the conference, my next step would be to be able to run irreversibly inside the registry. So once I have irreversibly, I can implement something which is really CPU intense like this entropy calculation. I can implement that in Rust or C++ or whatever language that I would like. And then that would help with performance. So Lua is easy, but and it's it's pretty quick, but it's still a scripting languages like they're faster languages than Lua. Yes. I didn't do the proper research, I must admit. So in my example, I had it right, but this is just because I tuned everything so it would work. The one thing, so because of the quarantine mechanism, it's not that bad to get false positives. To figure out the false negatives, I would probably use something like bucket notifications. So I would shoot a notification to some external system that has much more horsepower and that external system, some serverless function probably would fetch the object, maybe crunch through the entire object and run more processing, which is not in line. So to solve the false negatives once, I would probably use an external system using bucket notifications. And to fix the false positive issue, this is because I'm using a quarantine mechanism, I'm not so afraid from false positives. Any more questions? Okay. Thank you very much.


What's happening guys? It's Shane here. So last year I did the video about my favorite investing slash finance apps and it did really well, but a lot has happened since then in the investing community. Today, Robinhood cracks down on trading GameStop shares as the Reddit Rebellion dominates discussion on Wall Street. And I've also spent a lot more time using and researching a lot of these different apps. There's so many at this point. There's some new ones that have come onto the market that I wasn't even aware of. And so that's what this video is. It's going to be an update on my 2020 version. So without further ado, let's jump right into it. First one on the list is going to be Acorns. And I have to say this is probably the easiest investment app to use. So basically what you do is you hook up your debit card or your credit card to Acorns.  And it will invest about 50 cents into whatever you choose to invest in. It takes like 10 minutes to set it up super easy. So if you're looking for the easiest possible way to just get started investing, this one can be great. The only problem is they charge you about $1 a month in order to invest. And chances are unless you're just buying stuff left and right, that $1 charge is going to be a heck of a lot more than what normal brokerages would charge you for commission. So for that reason, I'm going to go ahead and put Acorns into C tier. C for costs a lot. Next one on the list is going to be Betterment. And this one is going to be a robo advisor. So if you don't know what robo advisors are, that's basically kind of like an algorithm that invests for you. And sometimes they'll even give you financial advice. They have little to no human intervention whatsoever. Some of the robo advisors have a little bit and then some of them have quite a bit more, but this one doesn't have all that much intervention. Now robo advisors are still relatively new. I would say that Betterment is one of the better ones out of all the robo advisors. There's so many of them these days. So I'm going to go ahead and put this one into B tier B for better than average. Next on the list is going to be M1 Finance. Now M1 is sort of like a robo advisor brokerage hybrid. So it's a good kind of combination between having that automated investment.  And then also having a little bit more control over where your money is going. They also have pretty much zero fees on their platform, which is awesome. I used M1 Finance. I really liked it. I think it's probably the best robo advisor. I liked it so much that I actually started investing my Roth IRA into M1 Finance. So I moved my Roth IRA over from Fidelity, which is also awesome, into M1 Finance just because of the fact that I love how hands off it is. I don't have to do anything with it. So M1 Finance is going into S tier S for shares are bought automatically. All right. So the next one on the list is going to be mint.com. This is one that I used for years. I absolutely loved mint.com. It was great for budgeting, just keeping things simple and budgeting. And I made an entire video about mint.com because I liked it so much. Basically what happened is the company moved away from their free product, which was, you know, mint, into kind of not really providing any support for it. Like you would call and, you know, they wouldn't have any support. They would tell you to call another number. And then the other number would tell you to call back to the original number, just really awful support. There was a lot of bugs with it. And you could just tell that the company decided into it is the parent company. They decided to move away from their free product of mint. And so this used to be an amazing product. It looks like they're still kind of going down that route of not really providing much support for it. So for that reason, it is going into D tier D for disappointed. Next one on the list is a really good alternative to mint.com, which is personal capital started using this one last year. Huge fan of personal capital. It's very similar to mint. Not quite as detailed, but it's kind of like a wealth planning site. Very easy to use, good budgeting tools, customer support is great. I've been really enjoying personal capital. They are going to go into S tier S for super useful. Next one on the list is going to be a very controversial company. They have been in the headlines all throughout 2020 and into 2021 Robin Hood. So I used to be a huge fan of Robin Hood. I still maintain that they changed the investing game forever when they basically made fees almost nothing. All of the other brokerages kind of tried to copy them. Robin Hood basically made it to where the average investor could invest for very low fees and also get into investing extremely easily. Okay. So they changed the game forever. You got to give them credit for that. But unfortunately they were involved in a huge controversy this last year. A lot of people probably know about it. You know, they blocked the buying of a GameStop stock when it was going up, when hedge funds were losing billions of dollars to average normal people investors. And that actually helped the hedge funds out and hurt normal people. Now there's a lot more to it than that. You know, there are certain stipulations that they have to meet as a financial company. You know, the CEO of Robin Hood came out and he kind of explained what happened. And you know, there's a lot more to it than that. But they seem to be the scapegoat for the entire situation. Also, there is a lot of limits to Robin Hood and how you can use it, how they make money is a little bit sketchy as well to say the least. And you know, I've just been, I haven't been using Robin Hood as much. I think I really like using Webull, which is kind of the main Robin Hood competitor. It's a little bit more difficult to use than Robin Hood, just slightly more difficult. But there's just so much more that you can do on Webull. So overall, I'm going to have to go ahead and drop Robin Hood down into B tier B for blocked GameStop stock. Next one on the list is going to be Stash. And this is a really interesting company. So basically what Stash is all about is let's say you really believe in something like let's say you really believe in like augmented reality. Okay, you can invest in companies that are surrounding that entire technology, right? So you can really get down to what you believe in. Let's say you are really into like sustainable energy. You can invest in companies that are sustainable energy friendly, right? So you have a choice in what types of companies that you invest in. And then they sort of like make everything else automated for you. So this is a new thing that I see a lot of people really getting into is they don't care as much about the profits. Like they're willing to maybe take a few hits on when it comes to the profits, but they want to invest in things that they really believe in. So that's why I think Stash has been so popular, especially with the younger crowd. So, you know, Stash is kind of a dark horse candidate. They could potentially be even worth more in the future. But at the same time, I could see some of these other companies kind of copying what they do relatively easily. So I'm going to go ahead and put Stash into B tier, B for belief and investing in what you believe in. Next on the list is going to be Titan. And, you know, this one is really interesting because last year when I went over them, I wasn't a huge fan of them, but they have done really, really well, especially over this, this, you know, 2020 and this last bull run that happened. Titan has really performed well. So I got to give them props for that. But basically what Titan is or I guess kind of the way that they market themselves, which I don't know, to me, it's just a little bit sketchy. But the way they market themselves is like you have access to hedge fund managers and they invest for you, but they sort of like educate you on how they're investing. So the way they market themselves is they're bringing hedge fund investing to the general public. So if you're the type of person who wants to get really serious about investing, like maybe you want to go into the finance industry, maybe you should invest on this one just so you can kind of see their thought process behind their stock picks. Now I'm not really into like hedge fund investing and like mutual funds and that sort of thing. I think mutual funds are great. It's just that index funds are better. The reason for that is because index funds do just as well as mutual funds, if not a little bit better, but there's less fees. But with that being said, you got to give Titan their props. They did great over this last year. I'm going to go ahead and put them into B tier. Next on the list, we're going to be talking about wealth front, another robo advisor. This one is, you know, they all have their own kind of little flavor to them. They're not all exactly the same. This type of robo advisor offers some other services kind of like wealth management as well. So it's not just about investing, but it's about the full financial picture. That's kind of what wealth front is trying to do for you. So they're kind of integrating like your full financial picture together, so that you sort of just have one platform to go through that will kind of make a plan for you. So I've used wealth front's emergency fund for a while. I thought it was really good. It was like 2.57% at one point. And then a drop down like ridiculously low when stocks dropped and it hasn't really recovered. So that was a little disappointing. But if you want a service that just invests for you, makes everything super, super easy, you got to give it to wealth front. They are great. You just put your money in with them. You set it to be automated and they'll just do all of the work for you. And they'll also give you really good financial tips along the way. They also do what's known as cash loss harvesting and they can do that automatically for you, which can save you a little bit of money when it comes to tax time. So overall, really big fan of wealth front. I'm going to go ahead and put them into S tier S for superior robo advisor. Next one on the list is going to be Weebel. And this is my favorite company for beginners. Okay.  I think this is the best company to start with. The reason for this is not only because they're very easy and beginner friendly, they've got a great interface on their app. But on top of that, they offer you a free promo just for signing up. And it's probably the best promo in the entire business. Depending on when you sign up, you know, as long as you invest about $100, they're going to be somewhere between like 1400 and $1800 in free stocks. Usually it's like two to four free stocks.  You get so much just for starting off investing with them. And because of that, so many people that probably never would have invested have started to invest. And, you know, sometimes it's not about how good the return is. It's more about just getting people to start investing, right? Getting people excited about investing at an early age, right? So if this gets people excited about investing at like 18, 19, 20 instead of the average person who probably doesn't even start investing until they're like 35 years old, then that is a great thing. You can also check out their link down in the description below. I think right now it's about $1800 up to four free stocks, which is awesome. Very user friendly, takes like 15, 20 minutes to set up. Love Webull. I actually have multiple accounts with them because I use them for some of my videos here on YouTube. This one clearly goes into S tier, S for Easiest Way to Buy Stonks. Next on the list is YNAB, also known as You Need a Budget. It's another budgeting app. This one charges a certain amount every month. It changes depending on the promo. It's like seven to like $12 per month just to have a budgeting app. There is an entire community of people who really love YNAB and I just don't understand it. It seems like a cult to me. You know, I don't see how this app can be better than the free ones. I mean, it's just very easy to set up like a free or you know, app that's a budgeting system. I don't understand it. You can also just, you know, budget using paper. There's a lot of different systems. You can use like the envelope system, Google Excel spreadsheets. I've actually made several videos on my channel about these. So I don't get it. You know, there's a, there's so many people who really like YNAB. I just, I don't know, F tier. I'm sorry guys. F4 should be free. Next on the list is going to be public. And this is a new company. What I really like about public is they cater to long-term investing. Okay. So public is one of those companies that encourages long-term investing, which, you know, I talk about this all the time on my channel. The best type of investing is going to be long-term, you know, doing like day trading or swing trading. Most people end up failing with that. However, it's very difficult to fail if you invest for the long run and you diversify. It also kind of sets themselves up as like a social media type investing platform. So it's sort of trying to be like investing, like making investing cool and specifically making long-term investing cool, which I'm totally behind that mission. Really like public. I'm going to go ahead and put up public into S tier as well. S for social media for investment nerds. Next on the list is going to be Zach's trade. And they kind of encouraged like day trading, kind of like penny stock type of trading, which I'm not a big fan of personally. However, if you are into day trading, they are going to be one of the better ones. They've got really good research functions and just really good functionality in general. So if you're into day trading, this is going to be one of the better ones. I'll go ahead and put Zach's trade into C tier. Next one on the list is going to be ally invest. And I would say that this is a company that has done a really good job of kind of integrating a ton of different finance related services into one. So, you know, you've got the online bank account, for instance, they've got a great online bank account, then they've also got this investment platform. I think a lot of these companies are sort of moving towards trying to combine all of these services into one so that people don't have to go to like five different apps just to use their financial services. Ally has done a pretty good job of doing that. I'd say they're pretty close to being the best when it comes to combining all the services together. It's not quite there yet. I would say they're kind of a dark horse candidate. They could turn out really well in the future, but right now I'm going to go ahead and put Ally into a tier a for all around pretty good service. All right, next on the list is going to be cash app. This is a new one that's kind of burst onto the scene. And they are sort of a combination of being almost like a Venmo where you can send cash from one person to another. But at the same time, they also offer an investing platform as well. So I'm relatively new to this one, haven't really looked into it all that much. One thing that's a big positive that popped up when I was doing my research is people who got their stimmies, you know, their stimulus checks, a lot of them were saying that if they used cash app, they would get their money right away. Whereas banks would hold their money sometimes for several days before they would release it to them. So that's pretty cool that cash app was able to do that for them. But I was doing some research on this one, and it doesn't seem like they are FDIC insured. So if you're using it as a bank account, they're not necessarily insured the same way. And it wouldn't necessarily be as safe as normal bank accounts. So this one could do a lot better when I do this list next year. But right now I'm going to have to put them into D tier. Next one on the list is going to be another one where they're relatively new and they're trying to break into the investing game and just use a bunch of different finance related services. And that's going to be SoFi. Now SoFi is best known for being a debt related company. So they will help you if you want to consolidate your debt, especially if it's like student loan debt, for instance, and then refinance it. Now with SoFi, you are going to have free management and access to financial experts that can help you with your just finance situation in general. You also have some choice over whether you invest automatically, or you have more control over your investments. They've actually separated those two functions, which I think is pretty cool. So overall, I'm not going to put them in S tier just because they're just so new. And I couldn't do that with a new company. I think one of the most important things in the finance world is that, you know, you choose companies that have been around for a little bit just because of the fact that, you know, sometimes companies will offer some really good promo. And then a year later, they take it away. It's like a bait and switch. You see this all the time in the finance world. So for that reason, I'm going to go ahead and put them into A tier. But maybe this time next year, there'll be an S tier, we'll just have to wait and see. Now for my people who are international, I know sometimes like that's one of the most common comments that I get on my videos. When I talk about these investment apps, is people were like, Oh, what, what if I'm in Europe? What if I'm in Australia? Okay. So I did a little bit of research. Obviously, I haven't used any of these, but the ones that you should look into if you're in Europe would be eToro, DeGiro and Revolut. In Canada, it would be quest trade or wealth simple trade in the United Kingdom. Trading to 12 is really good. Free trade is also pretty good. Really like that name, right? Free trade. And in Australia, I would look into stake or self wealth. Okay. So those are the ones that I would look into if you are in the other English speaking countries that commonly watch my content. See, I don't forget about you guys. I care about you as well. All right. So if you enjoyed this video, go ahead gently tap that like button, hit the subscribe button, ring the notification bell, comment down below any thoughts, comments, criticisms, let me know which ones I got right, which ones I got wrong, and also share your experience with these different investing apps. And before you go, check out my other videos right here. I made them just for you.


So as a family, we thought that it was a good plan to make these murderers pay for their sins. If you like true revenge stories, you found the best place for your vengeful needs. In this episode, we start off with a short story about a girl that gets abused by her boyfriend, but he doesn't know her brother has close ties to the mob.  But the family decides to take revenge so far, that it blushes the cheeks of all nuclear revenge stories. Lastly, a neighborhood creeper likes to rip off bikinis from underwater, but endures the claws of revenge. Be sure to invite the like button to a family dinner, but force it to pay for the ordered pizza. Let's dive in. Naturally, viewer discretion is advised. These revenge acts might be disturbing to snowflakes. For a little bit of background. This is a story that has been confirmed as absolutely 100% true, and has always been shared in whispers whenever I was lucky enough to hear it. I live in a predominantly Mexican family and my dad's side is the Mexican side. This story begins in the 1950s Midwest in a larger city. My cousin Jorge was working for a decently classy restaurant that the mob used to visit frequently, due to its supposedly stellar food. Now this was back in the day when the mobs used to run the cities with their protections and whatnot, so seeing suited up Tonys and the street wasn't the most abnormal thing. Every time the mob came in to eat, Jorge had them at a table in no time. They were weighted on hand and foot and nothing less. Jorge made sure they were fully supported throughout the meal and entertained with conversation. Now somewhere along those lines, the mobsters noticed how much Jorge was busting his balls and gave him a favorite card with a number on it. They said if anything goes down and he needs help, he is to call the number on the card and tell them what's going on, and that the situation will get taken care of. Enter Arabella, Jorge's sister. Arabella had started dating a guy named Jack, and everything was lovey-dovey at first. Short time later, Jorge started noticing Arabella getting more and more distant emotionally and always coming with new bruises, marks and silly excuses for them. Jorge then starts questioning Arabella about what the situation is and eventually Arabella breaks down and reveals Jack is the one laying his hands on her so much. Jorge didn't like this. Jorge didn't like this at all. So when he was all right and riled up, all he had to make was one phone call. He told them everything he knew. All that's known about this story to me, is the aftermath concerning Jack. According to Jorge, Jack was picked up in a van somewhere off the street, beaten halfway to death, and then left on the side of a highway far away from town. I guess it's safe to say, don't abuse the sister of a guy who's trusted by the mob, to serve them stellar food. Me and my family have lived in this house for 17 years in a third world country that's known for being violent. Fortunately, it's been good to us since my mother is a figure of respect, we don't have any kind of enemies or nothing similar, we were just a middle class family, living it out. Before the tragedy, we were a small family of my stepdad, brother and sister, my mom, who was pregnant at the time, and I. This Saturday changed my life forever. As they were making the baby shower preps, dad saw some intruders going into the neighbor's house, to which he responded with a couple of gunshots to the ground, scaring the robbers out and making them run, and that was the end of that. However, this seems to have caught the attention of six young military soldiers that were passing by. They came over to verify all was okay, this was understandable as it was their job. However, it seems that the six soldiers were a bit hyped up, and they were obviously under the influence of alcohol. Which made the situation tense and disturbing. My mother was told to lay down facing down the floor, as they, for some reason, thought it was a good idea to make a pregnant woman lay flat on the stomach. When my mom declined and stated the obvious, she was told to stop with the BS. They also wanted my dad's gun, which was legally operable and he had the papers covering that it was legal. When they were told these facts, it seemed that these frikwits didn't like that and the situation got more tense.  To make it all short, a handgun was no match for six assault rifles, my dad, may you rest in peace, you were a amazing man, died in the confrontation. My brother tried to fight back as well, which resulted in him getting shot too, and I called the police for help. It was five minutes of hell, to wait for the shooting to stop, while my family just laid there. Neighbors were petrified, it seems that everything we had as a family, just went down the drain. In the recovery process, the baby, the one in my mother's belly, died for being born prematurely, and for the next five months, everything was just sad. At this point in the story, I was 12 years and all I could do about the situation was cry, my mom was in the hospital and my sister was too young to realize what happened. My big brother was out of the hospital first, fueled by his thirst of wanting to claim revenge on those who took our happiness away. My mom eventually recovered physically, but not mentally. So as a family, we decided that it was a good plan to make these murderers pay for their sins. So after coming back from the brink of death, my mom first destroyed the image of the military of the whole country. She shared her story with the news and reached national attention, stating that the military of this country kills their own people. The military got wind of this through the news, they wanted to stop her, which they couldn't, as they are so incompetent, that they offered her a public apology, which they retracted soon after. This was done by one of the sergeants from the base that covers the city we live in. They decided a more fitting compensation would be a supermarket coupon for $20. I'm serious, it was for some supermarket deal I still don't know or remember what thing it was for. Guess they didn't want to take responsibility for what they did. Mom was furious to know that this was the only thing they offered. Who could blame her, she had her life completely ruined. So, to make things equal, she sued the six military officers that took action that night, but to top it all, she wanted for the guys to be judged as citizens and not military. The trial started two months after the claim was made. These freaking guys. They actually admitted everything, about the alcohol, the shooting, everything, but the most amazing statement they made, was that it was all in self-defense. Needles to say, our attorney was just relieved to get his hands on a easy trial. The gaze my mom gave the military officers was so tense, that you could cut it down with a freaking butter knife. Jury found the guys guilty. They got 80 years of prison. We later heard that these guys were going to be sent down to a prison, in which my uncle was as well. He's not a good family member, but family nonetheless. Two weeks later, photos were sent to us. They showed the military officers, beaten senseless. Needless to say, uncle stated that these guys will be experiencing hell until he is out of there. So that is that. However, mom was not happy, she wanted more, she wanted to take the military out of the city, wipe them of the face of the earth. She started a petition, which was supported by the mayor, to take out the military base in the city and also for her to get paid for the damage she went through. After some legal mumbo jumbo, I was too young to understand, and three long months, there was no trace of the military, they needed to get out of the city ASAP. The media played a big role in this, as they put a lot of pressure on them, the criminals of the area made word go around that they would burn down the base if they didn't leave the city. The people of the military base were just begging my mom to stop it all, but my mom wasn't having it, she still wanted more. To put the last nail in the coffin, the president came down to check on the situation of the base. They had to report and be transparent about all base activities as they were obligated to do so.  Some of them were also charged as they had started illegal alliances with criminals. In the end, we still live in the same house that was attacked seven years ago. There's a special police now, they are military as well, however, they are far more strict in their conduct and they are nice to everyone. They don't look down at people. Mom was seen as the walking miracle, and now we are waiting to move out of this place and seek a future in another country. Hope this works for us. This is my grandma's story that she loves to tell at family gatherings and it's always a good laugh. This happened when she was a teenager, takes place in the 1970s. My grandma used to live in this neighborhood that had a community pool. Her and all the other kids in the neighborhood visited the pool on a daily basis during the summer. There was one boy, I'll call him creeper, who was notorious for his swimming speed and removing girls bikini tops. Basically, creeper would sneak up on a girl underwater, untie the bikini top causing the girl to be exposed and swim away before anyone could really catch him, my grandma included. Of course the lifeguard on duty was notified and the lifeguard directly spoke to creeper's parents multiple times, but they never did anything about his behavior and always brushed it off. I'm assuming the lifeguard couldn't stop creeper from showing up to the pool or something like that since it was a repeated offense. Since nothing was being done about creeper, my grandma decided to take revenge into her own hands. My grandma's nails were and still are very strong and healthy. One night, she sat in her bedroom and carefully filed all of her nails to a sharp point. The next day, everyone was at the pool as usual. My grandma was in the water and strolling around. She purposely held her hands above the water so her nails remained hard, dry and sharp. And waited. Sure enough, creeper saw a back turn to him and thought this was another perfect target for his exciting endeavors. He swam up to her underwater, unknowing that my grandmother was watching him from the corner of her eye. And when her bikini top fell down, she instantly lunged after creeper while he was just about to swim away and raked all of her claws down his wet and soft back. Creeper screamed as blood began spreading in the water around him. He scrambled to the pool edge and was frantically trying to get out of the water and according to my grandma, she said it looked like he was attacked by a wild cat, to which my family jokingly says that he actually was. Everyone in the pool had to evacuate, for obvious reasons. Either later that day or the next day, creeper's parents stormed to the pool and wail about pressing charges against my grandma. The lifeguard simply responded with a reminder about their son's behavior and warned that he would also go to the police to be a witness. My great grandmother was also there and threatened with a lawsuit of sexual harassment against creeper's parents. Needless to say, creeper never returned to the pool after that. My grandma says she feels bad about probably permanently scarring creeper, but that's about it. Thank you for enjoying this episode, which was made with artificial love. Subscribe or give royal ASMR sugar by avenging the like button. Could you imagine doing one of these acts yourself? Share your experience below. I'll join the conversation.