QuickBooks Desktop 2023 income and expense graph let's do it within two it's QuickBooks Desktop 2023 support accounting instruction by clicking the link below giving you a free month membership to all of the content on our website broken out by category further broken out by course each course then organized in a logical reasonable fashion making it much more easy to find what you need then can be done on a YouTube page we also include added resources such as Excel practice problems PDF files and more like QuickBooks backup files when applicable so once again click the link below for a free month membership to our website and all the content on it here we are in QuickBooks desktop sample rock castle construction practice file provided by QuickBooks going through the setup process we do every time maximize on the homepage to the gray area view drop-down noting we got the hide icon bar open windows list open open windows on the left hand side we got the reports drop-down company and financial looking at the P and the L the profit and the loss ranging to the change in from 010124 to 1231 to 4 January to December 2020 for customize that report with the fonts and the numbers so we can change those fonts on up to 12 okay yes okay reports drop-down one more time for the other major financial statement report the balance sheets so we could change the range to the fiscal year 1231 to 4 customize it on the fonts the numbers the 12 the okay yes and okay you did that way too fast I know it's because we do it every time that's what we do every time these are the major to find financial statement reports all other reports pretty much giving some more information upon one or multiple major line items on these two reports we have here this time we're gonna be taking a look at some graphs that will be supporting the data on the profit and loss those are going to be the income and expense graph so I'm gonna collapse some of this stuff here so I could see my income and the cost of goods sold and the expenses so there's our major income statement categorization let's go to the reports up top and we're gonna go down to the company and financial we can find this graph down here income and expense graph or we could go into the report center and find it there too let's do that as well of report center up top maximize into the gray area I just scroll on down till I see a graph I'm in the company financial spot by the way and so we're gonna see where's a nice pretty graph there there's one look at that it's beautiful let's open it up and check it out shall we let's first change the date range up top so we got the dates let's make this from 010124 to 123124 to be matching our income statement report this is gonna give a supplemental added information on some line items on the income statement so as we saw with some other graphs what we kind of like to do is be able to say okay I could use this graph I could add this graph to say my year-end or month-end summary reports to my supervisor or possibly to a book keeper or something like that I would also like to make sure I know where the numbers come from so I can at least explain what is going on with the graphs and then I might want to consider being able to use the subsidiary reports or any reports that the data is being pulled from to make these kind of graphs in Excel now this one has a little bit more options so there's a couple different options we can play with so let's bear with me as we go through them we got two items down below which are income and expenses those being the two main categories of the income statement income minus expenses being the net income so and then up top we've got by account by customer by class so if I'm on by account and I'm on the income side of things that's going to be listing out over here our income accounts if we're on the expense side of things and we're in by account then it's going to give us our expense accounts on the right hand side if we go to buy customers up top that doesn't really make sense for the expense side of things because customers are not who we typically sell to right so it's going to be the income side of things broken out by customer then and then we've got by class which would only be applicable if we've got class tracking turned on which is kind of a specialty type of area all right let's go through those again we're going to go to buy account we're going to go to the income side of things here's the income it comes down to 455 130 36 if I go to the income statement then where's my income statement profit and loss then we're at on the income up top 454 657 14 so note like with the sub ledgers that we took a look at if we don't use it's possible for our income to be different than the sub ledger more so than some other sub ledgers for example the accounts receivable will typically always tie out to the receivable by customer reports because QuickBooks kind of forces us to do that remember that if when we enter data into the system and the homepage if I don't enter my income with an invoice and the sales receipt then it can throw off my sub ledger reports and they can throw off these graph reports so just keep that in mind if there's a difference that's probably where it's coming from possibly you entered something into income with a deposit form or had a journal entry or something like that all right so if we go back to the income statement then we've got our income accounts noting that the income accounts will typically be not as many there's more income accounts here than you might see in many companies because of the nature of this being a job cost construction type of company but typically we have a limited amount of income possibly an income line item saying for the things we sell like inventory sales line item for income and possibly services line item for income and then everything else we're going to break out in the sub reports if we're doing a full service kind of accounting system in other words we resist the urge to break things out on the income statement by customer we don't want income statements per customer we don't typically want income statement per item inventory item or service item maybe the groups of the large groups of items on the income statement because again we can get that detail on the sub ledger so usually if you're breaking this report out by by income account you usually don't have that many of them it might not be the most relevant but report but it could be a nice report so then you've got your percentages over here obviously the main income account by account is going to be the construction income so that makes sense so I think it's all it's also just taking the parent accounts so if I go back on over here then we're taking the Bart the income barter income construction income reimbursement income and it looks like it's taking possibly other income down below these being the other income categories that aren't part of our normal kind of major business care major business setting items that's why they're down here in the other section so if you wanted to do this on your own and make your own pie chart based on account wouldn't be too difficult to do usually you could just basically type these numbers into excel for example however for your income line items which could actually then tie out to what is on your income statement and then just highlight those sales and make a pie chart which will give you a lot more flexibility if you wanted to do it that way so if I go back on over and then we say okay there's the income by account let's go to the expenses by account so that adds up to the three three five nine seven five seven two if I go back to the profit and loss and check that out that's going to be here because we have cost a good sold which kind of confuses things that's a major expense so that's the cost of a selling inventories one eight oh two four one two four point one nine plus the other expenses one five five eight five one point five three gives us the three three five nine seven five so if I go back here then that ties out exactly there so there's our expense accounts broken out so once again on the expense side of things this could be a more useful kind of grouping for the charts because typically we're going to have more types of expenses and I think again that they're using the parent accounts instead of the sub accounts so I don't think they have fuel insurance just the auto mobile here so let's just check that out so here we've got job insurance automobile yeah I think they're just taking the parent accounts and not the sub accounts so but if we go to the profit and loss there's going to be a lot more categories for the expenses even though remember we're not listing the expenses out by who we paid we're not saying for the automobile that we paid you know mobile gas or anything like that we're saying it's going to go into automobile or possibly more generally the fuel what we used it for in these categories but because of course in a business we're concentrating on one thing that we do for other people and and we only concentrate on one thing we specialize or something or a few things and then everything else we're gonna we're going to pay for right so that's why there's gonna be different cat much more categorizations of expenses that we're paying for in order to keep the business in motion so a pie chart based on the expense categories could be good or we can have the sub ledger categories for the expenses in a similar way we had with the income breaking out them outflow the expenses by who we paid by vendor for example so let's go back on over and say I keep talking to the wrong one get to the right one so that's that one and then we've got the customers up top and and obviously just to if we want to create this yourself then you can export the profit and loss or you can export the trial balance I could work as well and then you just trim down just the expense categories and you could do it like they're doing here where you're just using the parent accounts maybe you want to see all accounts in the pie chart however so then you can filter out in Excel the all the all the accounts instead of just the parent accounts which means you'd have to delete all the subtotals and so on and once you have that listed you can sum up the total which should sum up to the same total here and then just highlight it you know order it from top greatest to least and then highlight it and make a pie chart and again you have a lot more flexibility to do that because then you could group this you can group the top 10 you can group the top 7 accounts put all the other stuff in other like we did before we won't do this again in Excel but just note you can do it in Excel fairly easily and you have a lot more flexibility if you were to do it in Excel alright so let's go back on over wrong one wrong one for crying out loud get it right customer center so on the customers this only works on the income side of things so now we're breaking this out by customer which I believe we saw in another report already so we're trying to get those income items that are broken out by customer with this one so I think we have another graph that actually focuses in on that already and then we got by class here if you got the class tracking turned on now up top you've got this kind of comparative graph that is comparing the income and expenses this is something also that you could basically try to do and you could do in Excel it's a little little bit more complex because now you got two things going on in the same graph but not too too difficult to do you could go into the income statement you can export the profit and loss or possibly export a trial balance which doesn't have all of the subtotals and then you could you could sum up the income items and then you could sum up the expense items and then you could basically create a chart with both of those bars on you know the same chart and construct something that that looks like this has like a side-by-side kind of comparative type of chart this one's broken out by month that could be a little bit more you know you can detail to get into you have to determine how are you going to be doing that you can look you can research that in Excel we won't get into Excel to jump into that but again something that's totally doable in Excel and if you were to do it in Excel you can make the pie charts different colors you can not have this this this 3d kind of thing and so on you can have different formats of the bar charts as well you can adjust the X and Y axes as you see fit if you were to do these kinds of things and Excel it also really helps your Excel skills and it helps you to be able to explain what the chart is doing because remember people have a tendency to put these nice charts in to reports and especially in a presentation you would like and be want to be ready for a question saying well what does that chart mean and so that you can you can answer those questions


So Kieran, it was a win in the EFL trophy tonight. How'd you feel after that one? Yeah, it's great. Obviously, we got the three points here away in a tough place. Like I said, it's three points in the in the club now and we'll go again. It was obviously a very rotated side and there was a lot of changes. Players coming in, players coming out of the squad tonight. How does that affect the team and how is it out there playing with a lot of different players you might not have played with? Yeah, we've a massive squad and we used that today and I think it shows the quality that we have in the squad. We had a new 11 coming in and getting the job done. I think there's a lot of quality players and we're all pushing ourselves to get into the first 11 when we have a game. And I think a lot of the boys took their chance today. Do some of the lads that maybe don't play week-in-week-out see as a chance to maybe prove to the manager that they should be playing week-in-week-out? Yeah, definitely. I think everyone's obviously reaching the player. Mal wants to be sitting watching. So I think getting the opportunity today to have a run out and getting the 90 minutes on the bell for most people, it was good. But like I said, the most important thing was getting the win. Towards the end of the game we saw you move over to full back as well. Does that versatility help you, do you think? Yeah, I hope so.  I don't mind that at all. I'm comfortable in both positions, so if everyone wants me to move out there, there's no problem at all. There was a lot of younger lads from the academy around the squad today. How good is it for them to be around the first team and experience nights like this? Yeah, it's a great experience for them. Once you've been around the lads, been around the crowd, it's great for them getting on for a few minutes today. You can see the quality coming from the new team is brilliant. And there's a lot of long away games coming up. Is it a case of just kicking on from today and the weekend, obviously, and just keeping these good performances going? Yeah, exactly. We just have to prepare for each game. We'll be in there with the cover film and getting stuff for Saturday.


Thanks for checking this video out. Your mountaintop news video is coming up in just a minute.  Why is it your ad here? Call me. In 2021, House Bill 574, the most significant reform of Kentucky's election system since 1891, was passed. Following the reform, the General Assembly passed House Bill 564 and Senate Bill 216, making elections more accessible and secure. We're going to have early voting and it's going to be on the 11th, 12th and the 13th. Not sure about the times, I'm pretty sure Saturday's going to be from 10 to 4. They will be eight hour windows when the polls are going to be open. We discussed some about opening early one day, maybe at 6, just to get people that go to work early a chance to vote and then you've got six days of excused absentee voting. That's if you have a reason to go to legitimate reason, you're not going to be able to vote, you can come in and vote. I think all those were designed to increase the percentage of people voting. You've got to make it easy for people to vote. They're not going to drive out of their way and stand in line. In addition to expanded voting access, elections will now be more secure with double the number of counties subjected to post-election audit, a full transition to paper ballots by January 1st, 2024, and codifying existing policy of not connecting voting machines to the Internet. Elections are just too important to take the chance on somebody being able to hack them. When they make these rules, they're for the whole state. I doubt that anybody is going to hack an election in Pike County, Kentucky, but they have to make a law that governs the whole state. Who knows what capabilities are out there, how easy it is to get hacked in the future, so I agree with the rule. I don't think the voting machine should be tied to the Internet or have access to where people from outside of the area, from around the world actually, can get involved in their elections. Reporting for Mountain Top News, I'm Brianna Robinson.


your own identity, how you could run your own identity server and use that to authenticate against other services like Google or Microsoft or whatever, and how you could enable this trust relationship. A topic that is rather complicated, rather very interesting in the current times. And yeah, all more. I'm not qualified to talk this, so we have two speakers with Rick van Rijn and Henry Manson, so please give them a very warm round of applause. Thank you. I have a very small business. I do stuff with cryptography and open source protocols. I'm probably the only one here. But over the years I've constantly been annoyed by how poor authentication has been organized. Also in open source, actually, in open protocols. I think it should be trivial, as trivial as DNS is. And I know DNS is complex, but for an end user it's not noticeable, and that's the level of understanding you want to reach, because then people don't mess it up so easily. And that DNS is quite simple, right? You have an authority defying the names, exporting them over the network, and there's a resolver that can actually verify, yes, these are the names, and thanks to DNS, it's even secure. Why don't we do this with authentication? And if we can, please give users maximum control over their online presence, because I don't like if somebody else decides who I am, and whether I'm allowed to continue to exist, or whether I'm allowed to be removed from the scene. I don't know if anyone of you ever deleted account for somebody who perished, who died, and that's terrible. You have to jump through all sorts of hoops with the third party providers. Also, if you're a security officer in a company, you would like to set a certain security level and say always two-factor authentication, for example. What we see now is that service providers, like GitHub, for example, decides you need to start using second-factor authentication, because we think it's important, but as a user you want to make that decision. So basically what we've been working on over the past few years is something that we bring to users, explain to users, bring your own identity. You're just someone at your own domain name, like you have an email address under your own domain name. But how we can make this happen with identity? This should be trivial, and it can be, because every relying party can connect securely to any other domain using DNS, SACDain and TLS. We have the infrastructure to know who we're talking to, to what domain we're talking. And there are standard SAP records for quite a few identity providers. There's Kerberos, there's LDOT, there's Diameter. Diameter is radius, but designed for this sort of crossover thing, so it's the easier choice in this case. But there are standard SAP records for this sort of thing. That together means you can trust, you can find an identity provider under someone else's domain and trust it. And this identity provider then, of course, has a prerogative on the usernames, whether John exists and whether Joe exists. It can be trivial. In practice, it's far from trivial. I'm looking at really big screen trying to read it, I shouldn't. Yeah, I know. Credential handling is very often done in applications, and that's a problem, because an application programmer has quite different ideas and wishes and things he wants to do than a security programmer. So what we end up with is passwords, the lowest common denominator. We've been doing that all the time. I can't make a mistake if I do that, too. Shouldn't we just tell the application programmer, we authenticated this guy, this identity you can trust? That should be enough.   Ideal for web shops, right? Also, if other parties manage them, they need a recovery protocol, you can't have a local administrator overriding things. So you need some mechanism and some jumping through hoops to do this, and you end up supplying communication details, which means a privacy problem. So, and there are many solutions that look like the sort of thing we're doing, but I found that most of them are web only, or in other ways, protocol specific, but usually that leads to web only, meaning IMAP has to reinvent the wheel, meaning just about any protocol has to do it again. So, in terms of technology I used, I don't say bring your own identity, because that's like how users would experience it, but we speak of realm crossover. And there are ways of doing this for quite a few common authentication protocols already, and we made small extensions to existing standards and could then make this happen. In case you don't know it, it means that the server sends you a list of mechanisms you might use. It might be something like plain text, or it might be GSS API, or it might be Duchess MD5. It just gives you a list and the client chooses which mechanism to use, and then they start passing tokens back and forth, interpreted through that mechanism, until the server says, yeah, you're welcome, no, you're not. This is a very generic thing, and it allows you to negotiate what you want to do. You might go for a simple password, or you might go for something as fancy as Kerberos. Kerberos, in case you think it's old fashioned, let me rephrase that into old and fashionable. It works with symmetric keys, so in a trivial way, it's always been quantum proof, and it's already been designed to prove a campus with curious, innovative students, pretty much what we have on the internet today, where everybody's challenging security all the time. And it's with due to the test of time with, of course, crypto updates. And lastly, certificates can be used for TLS signing encryption, and we also see ways of doing realm crossover for that. So I'm going to talk about these three realm crossover mechanisms. And Henry later on is going to one of them. So for Sassel, Sassel is embedded in just about any authentication protocol. It's amazing. It's almost everywhere. So if you can support Sassel, it's wonderful. I know HTTP doesn't have Sassel, so we built that. Don't worry, we got you covered. And to make this work, we designed a new mechanism for Sassel. That's one of the extensions we made. It's a pretty trivial extension that anyone can make, basically. We call it SXO++. And that's like an end-to-end tunnel that wraps around a standard Sassel exchange. I'll show later on why. And basically, you have an intimate server that wants to use something that passes this Sassel and then in the end knows that he's talking to John at theexample.com. So this is from my internet draft, so that's why it's an ASCII art picture. Is it readable? Good, thanks. So let's say the application at hand is email, but keep in mind it could be anything. But let's say we want to have an IMAP server for a group. And it's hosted under some sort of domain somewhere. And John, who has an identity under example.com wants to use that. And this will be the identity provider for example.com. So John and example.com have some somewhere, sometime in the past set up an account. Now what John does is he says, I want to talk to the IMAP server. And I'm just saying, yeah, like you first got to log on because I need to know whether you can see this group. And perhaps wants to see what emails you've already seen. So it starts a Sassel exchange. And what a foreign server does is pretty much it says, okay, I see SXO++ being used. That means I'm not going to resolve the password locally, like web servers very often do. I'm going to pass on the request. And the SXO++ has a beginning where you can see what domain it goes to. So it's passed on to John's domain. It just says example.com. So it knows it can pass it on. And it does all the things I just mentioned. SFV, look up TLSA, and then just passes on the Sassel. It just sits in the middle, pretty dumb, just passing back and forth the Sassel packages. And at some point, the identity domain says, yeah, this is indeed an account that we have. And it's called John. It doesn't say john at example.com because he knows that he validated that using SFV and all that stuff. So the identity domain only says stick john in front. So now the foreign server knows it's talking to john at example.com, it can relay back the okay, and everything can happen as it is. So what did we need to do for this? I meant to use diameter, and it is like radius, but radius is optimized for trusted internal networks. And diameter is more optimized for realmrosoft sort of thing. So mutually untrusting domains. So we needed to define a couple, three address value per attribute value pairs to carry the Sassel content back and forth. That's pretty much all plus, of course, the sx over plus mechanism. And we implemented this stuff and it works like crazy. As I mentioned, we thought it cool to demo this with HTTP. So that's what we'll show you. So we have an authentication mechanism for HTTP that actually passed the Sassel. So then you get in this picture, a web browser speaking Sassel over HTTP to a web server. And that in the back end can use the identity domain. And something else I'm also doing now is I'm building it into PAM so you could use in sudo, for example, or in the console access for container, for example. That also means your very simple small container doesn't need to know what comes. It can just forward it to a trusted internal node. Kerberos is entirely different. But I think this is the goal path for what you want to do because Kerberos does single sign on you log on in the beginning of the day, you get a sort of method tickets and use it for the rest of the day to get additional tickets without effort. Kerberos even has realm crossover built in, but it's static. Meaning I ask my Kerberos controls key, it's called key distribution center. So I asked my Kerberos realm controller, please hand me a ticket for a service I now want to see. And he says, oh, gosh, I don't know that one. But I know the realm that does. So it says, I'm going to give you a key that I share with that realm. And you can use that to ask that realm for control. So then you have the client identity users, its own realm and service is at another realm. And this is realm crossover, but it gives us static keys that have been preconfigured like shall we say the name of my cat? Yeah, let's do that. And then it's set. All we had to do to extend this is to basically say first of all, if you ask for a service that I don't know, I want to know what realm it is, what Kerberos realm, so what domain. So it needs to be able to look that up in DNS. Well, that's a text record. It's pretty simple, except when you need to pass it through it. But it's a pretty simple idea. And then the next thing is these two Kerberos servers, when they see gosh, you're asking me for a service through DNS, I can look up what realm it has. But now I need to set exchange a key. So the two key key distribution centers, so the realm controllers for Kerberos, get in contact and do a key exchange, which basically is a key extraction facility that's standardized in RC5C05. Basically, they use the master key, add some seeding and add some strings and that ends up being a key that the two endpoints have without explicitly passing it. It's a lovely mechanism. And from then on, it might be for three weeks, for example, and the client realm would do that for everyone in the client realm can use these keys to address any service in the service realm. And of course, it might also be done the other way around. But that's independent.  So after the first has come through, you really have very fast access to remote service. And this can serve as the internet. That's pretty much the idea. The entire internet can use this mechanism and use Kerberos for all their authentication. That's something Kerberos can't do now.  Certificates, we haven't done much on this, but we understand how to do this. Certificates have these funny names in the subject, right? They're actually an LDAP location. So they would look like user ID is john and maybe organizational unit and organization and whatever. And then the domain is split in a number of components. The domain is very long. I need to walk along and for it. But this is basically a location in the LDAP. And that is standardized. That is just something we don't do very often. But it is a standard. And even if you know the domain part, it has been standardized that you put LDAP TCP in front, find up find the SFE record and then look up the LDAP server. Of course, LDAP can be encrypted with TLS after start TLS call. And then you can continue with the with with Dain to make sure that you're talking to the right one.  Because these are locations for objects. And they made may have attributes with X5 and nine certificates, PGP keys. So you can use sign in your encryption with someone you haven't talked to before. And the interesting thing is, it uses a slightly different name. But open PGP has this installed. If you use minus R on PGP or GPG, you can actually pull in based on the email address, pull in that key. If they set this up, realm crossover can really be done very easily. And an extra idea that we're trying to get through. And I think people are listening is, why should I use an external authority to sign the users in my domain? I would very much like to be able to just publish a root certificate for so for a local CA and publish that with a Dain record and client Dain could do that sort of things. It's all in the pipeline. We'll see. Imagine mail servers, they talk to each other and when one domain sends something to another domain, they need to trust the identity that's been supplied to them. Imagine adding authentication here. That definitely makes it more difficult to spam. And it also makes it very pleasant to select between the ones you trust and the ones you may trust or may not trust. So it can make you switch between wide listing and great listing your mail server. It can be really valuable. And email, of course, was designed in the time that everybody trusted everyone with 32 computers online that was safe, I suppose. But you can actually expand on that quite well. And basically use the distance to retrofit more security on the SMTP. SIP, that's used for calling, not just audio, but it's generally used for telephony and video calls and all of that. With a pleasant thing that unlike all those platforms that we have like Zoom, if you use IPv6, it's very trivial to make use to user direct connections. So just call recordoperforters.nl, you will be connected. Imagine adding RomeCrus over there. You would know who's calling because you could check. You would know somebody is scamming you and you might even look up information in their enum records, for example, to see what kind of person it is. And you might even find key material there. So you could start an encrypted call. Helpful, I would say. HTTP, well, Henry is going to show all about that. As I think that's one of the lovely... Yeah, he came up with a wonderful way of building this into Mozilla using a standard that is new, but that was already in Mozilla. But in theory, it can be rolled out in other browsers as well, but they also adopt this new standard. Doing this for... Doing this for HTTP authentication means you could add RealmCrus over there, bring your own identity, so log on to Gmail, if they would support this, of course, but log into Gmail using your own identity managed under your own domain.   If you lose your password, you go to your local admin, you have it changed locally on your domain. I think that beats having these 30 seconds exploration that Gmail uses while they don't implement great listing properly. And here, too, I mentioned that applications have problems with getting to the information. A web server can easily set the number of environment variables and pass the information over to scripts. So we made a simple protocol to allow you to... If you need to implement diameter in every single server, it's going to be hassle because diameter isn't easy. So we made a very simple wrapper protocol that basically says we've got open authentication, close requests, and responses. They can be multiplexed. And this turns out to be very easy to build into an application. We also made, instead of just a protocol, we also made a library to use this. And we have demonstrations for synchronous, threaded, and event-driven applications. So fork-based, thread-based, and event-based. And this... Usually we copy these things and get things working very quickly. What this assumes is that within your domain, you have a central node that runs diameter, and quick-diasasal connects to that node. So you have one place that basically is declined for authentication. And all the others basically just use that. So we have had funding, but we can also hand out some of that to other people. And I'm very pleasant. I'm very pleased to say that. Sassel works is a project name we had. We did all sorts of nut and bolt work on Sassel. And it's been sponsored by Anelnet, including the Pam module that I just talked about. RealmCrossover, as a mechanism, has mostly been sponsored by NGI Point, which is a European Union project. European Union doesn't really like to offer you Facebook log-ins. And if I have to be honest, I don't very much like to say Facebook is now going to decide that I can log on to this site that holds all this personal information about me. Somehow I think that's challenging them too much, offering them too much. But some of these NGI Point funds are remaining. And as I said, with the quick-diasasal, it's really easy to add, to make a modeler's extension to your server and to actually implement this. So if you're interested in this, we can probably help you with some funding. So contact us, contact me, for example. And what we'll be looking for is things with the most impact. So if it's generic, it's interesting. If it's a frugal proposal, we can do more of those. And if it ends up in the core distributions, we say, hooray. So if you think this is interesting, if you want to implement it, talk to us. And that's where I hand off the microphone to Henry. If you download these slides, and there are many links to documentation and backgrounds, I won't go over those now. But if you download them, there's extra goodies. Good. Now to train LibreOffice. Terrible program. Hello. Hello again. I will continue the talk of Rick by demonstrating HTTP social. Which I'll introduce already. And I have to look up a little bit, because this is my first speech. How did the pay social? It's a new HTTP authentication protocol. It's a standardized way to add new HTTP protocols. As the name already says, it involves headed the social protocol, which allows you to specify the mechanism in the social protocol itself. So it could be the only HTTP authentication protocol, because social provides for choosing a mechanism, while the HTTP authentication protocol contains the mechanism. Almost all HTTP authentication mechanisms choose one specific authentication mechanism. And social habit that allows for any mechanism to be used. How did the pay social was invented by the previous speaker, which one thing in mind had the way on because of he just mentioned and his ethics over plus protocol, which will have which will be the mechanism you choose when you want to have the on crossover. But HTTP social also allows for conventional mechanisms to be used, which don't allow for crossover. There is a draft on it, and it's shown there, and that will be available on the slides. That is the last protocol, which contains the latest updates. Next slide. Here is the, I can do this by heart, this is the demonstration of a conventional HTTP social exchange, the most used one, by the way. It's very simple. You try to visit the website and you get, you are not otherwise, you have to log in. And then the browser reacts by showing a popup, that the login is required, and it shows some real HTTP real-alarm message, which is always on the top of the popup box, and it says something like, now you enter the secret area, something like that. And that's the real-alarm passed in the W, W, W authenticate header. And the client then responds in base 64 encoding, it's not encryption, it's just a simple encoding, with username and password, and then the web server checks, those credentials are correct, and they either succeed or not. Next slide. This is a flow, how it goes, with our new HTTP social mechanism, and you can see that there is one extra ping-pong, so I have to say. And the first outindicate from the web server is, here I have my list of mechanisms that I support, and then you can choose one of them, and the real-alarm is exactly the same as the real-alarm which is used in the basic authentication mechanism. This is just something you can show you're now logging in some secret area. And the next, at that time, I will show you in a minute, instead of the standard, a pop-up works from the browser itself, which is built in all modern browsers, we show up, pop-up box is shown by an external program, it's not a browser, but an external program, which not only allows you to enter the credentials, but also which mechanism you want to use to log on. And that is all happening in the R skews and the left side of this diagram. And then here you can see, as a demonstration, that the user chooses digest MD5 to log on. And then it's almost the same as a conventional HTTP authentication mechanisms, that is the web server sends challenges, which the client has to make a response on. And the only extra parameter we use is the so-called server state, S2S in this Taiwan, that's something the web server can send to the client. And the client always has to send the same state back in an extra request. And that's what you can see in the same string, it has the same string which is sent by the server and sent back by the client. And then in the case of digest MD5, business as usual, and then the credentials are checked, and when the credentials are correct, you get an OK or authorization refused. This slide, the most complex one, this is the one which cross over. And it's using the same software, but now the server had a client not selected digest MD5, but the SXO protocol. But then, my proper books of the new client program has extra fields which you can fill in. That are the alias and the client domain fields. And the most important is of course the client domain. That's the domain which Rick just talked about, which you want to log on to identify yourself. And the alias is used for showing at the entity which the foreign server had is the middle server in Rick's diagram. We'll see. I can authenticate as Henry, but I can, as the foreign server can see a totally different identity, the entity you want to provide to the server. And I will show you in a minute how that proper books look like. Let's see. Then, as on the first, after the client has chosen SXO protocol, it's nice to indicate what's inside the encoded client-to-server field. Here what you see there. And then just to make it clear a little bit how crossover works, that contains the client domain you want to log on to. And not to be confused with the realm which is shown in our proper books. Had a client domain you filled in the proper books of the client program. Let's go to the next slide. Because here I have the components which are involved in our setup, which I will show you in a minute. Here this is on the left side on the purple, how do we call it? Magenta box. It's the native client, which is a C program which is just a real authentication. And I built this, and fortunately it was possible because browsers have standardized the way plugins work. And one of the possibilities you can do is so-called native messaging, which allows a browser plugin, which is the yellow box, which runs inside the browser as a JavaScript extension. When you set it up correctly, then the plugin is allowed to talk to an external program. You have to organize it yourself. So had it not any program can talk to the browser, which would be a huge security risk. And on the right side we have a server. It can be an Apache module, but when I first started for NLNet, I had to just so that this concept works. I used, for example, a Java serverlet to do the work. Had it was, of course, only a conventional mechanism, which was unused. And I think everything I mentioned here is done. And yeah, here I can make sure that it's okay. And here maybe you will recognize some of the components which Rick showed in his realm crossover talk. Because here are the components in the Apache server identity provider. These three things, I have no pointer, but the blue, the green, and the red box are the same components which Rick showed in his slide had how the anchors of set of three parties. The Apache server contains the three-diameter client, which talks to possibly a different three-diameter server, a server on a different domain. And a three-diameter allows for that. And I will have to have a look on it because it's a little bit complicated. And it rest my heart, but this is because the Apache module, which is used here, which is capable of doing the diameter sussle, is one of the two Apache modules I wrote, a start with a simple one, which really involved that the entire authentication was done in the Apache module or on the same server. And this module, which allows for to authenticate on an external diameter server, is called the module for the diameter sussle, which uses what was it? The diameter sussle protocol between the blue and the green box. That is correct, Rick. That is the diameter sussle protocol, this is the sussle protocol you invented. And this is, we have created a demo for this, and then you can really see how the three parties and that headers of client can log in using its own domain and then the authentication succeeds. And that is one of the next slides. Here you see the headers on the 5-hubs browser, you see the new public works, which replaces the public works of the browser, which you all know, which only contains a user in the password field. And here you can see the fields I just talked about. The first one is very important that you see the same URL as in the browser, so that you know which resource you are accessing. And along with the user in password fields, there's a re-enter for dots, and you can see the alias in the your domain fields. And in this log-in session, I just used conventional log-in, so I didn't need to use alias in your domain, and I think the next slide shows the, here you can see it. Oh, no, that is not the matter. That's it, I'm afraid, because I didn't include. Yeah, this is all, huh? Yeah, sorry. Then I don't have a picture which includes, yeah, because this is essentially I just talked about, that are the fields which you can choose. But in a crossover situation which you can see in the demo we have, we have sticks and we have also virtual machines on which you can see all of this work, and then you can see a client domain log-on, as I forgot to include that slide. And that's my talk, my first talk, to be honest. Thank you very much, both of you. We do have some time for questions and answers, so if you line up the microphones, we also allow a comp, no, provide the possibility to ask questions through the interwebs. So just a second, I would like to check with the signal angels. Do we have any questions? Unfortunately not. So good for the gentleman in the first row, please ask a question. I have to, actually. So first of all, do I understand correctly that you will then use something like DNSSEC to set up trust with parties that you do not know? Yep. Alright. DNSSEC, Dain and TLS usually. Alright, question number two is, so SAML obviously is another way for cross-rail authentication. Is that something that you compared with? I think some of the problems with the Sassel seems that you still are a man in the middle, which over complicates it a little bit. I think if you do SAML, you're completely redirecting, you just wait for the answer. Yep, definitely. If you log on to your email, you have to use Sassel. So that's why we have three solutions because sometimes a protocol says use Kerberos, use Sassel or use whatever else. SAML can usually be included in a protocol and among that, there is a SAML mechanism for Sassel. So given HDP, so you could actually put SAML in there, but I know it hasn't embedded in HDP already, so that's senseless. Unless you want to give the client a choice. And I think that's valuable. Two questions, line up at the end and ask a third question. Thank you. Next question please. So thanks for the talk. In your example, you said like we can give the authentication to the local provider, which may up the security of the user. But what if the local provider actually decreases the security of the user? So the webshop of whatever is in the middle actually doesn't want to provide your local authentication party because it's less secure than what they can offer themselves. Is there something there in the protocol? You split my brain by using another term and I'm not wondering whether you mean left or right. Are you talking about local authentication as in the quick diacessal receiving note that passes it over free diameter? Or are you talking about the identity provider that received the free diameter request? Okay, let me give an example. Like if I log into my bank, I need to fill in my username, password and then do two FAE for instance. But what if my local provider only uses like username and password? So my bank would actually say, no, you cannot use your local provider because it's less secure than what we can offer. Your bank wouldn't know.  I have advice for you to do it well. This, by the way, is very much what banks like because they're not interested in security, they're interested in covering their ass. True. And you're interested in getting the best security probably better than your bank account. Sorry, if it's evolving into a dialogue, let me cut this off here for a second. Feel free to come back or continue this as far as there's another question lined up. So please. Hi, thanks. I have a question that's sort of usability related. Do you have any ideas on how to guide a user into which authentication method they should choose? Because choosing digest MD5, I mean IU and he understands it, but my mom doesn't. Now your mom probably has a system administrator. Who insists on particular practices? Not really. Of course, we would like, we would like to encourage users to use crossover whenever possible because then you can use it. It's the only protocol currently which uses your own identity provider. And all the other protocols are normal, so to speak, that authentication takes place in the same domain as the server.  And it's also if you take email as an example, you don't usually configure in your email client which specific authentication method you would like to use, your email client sort of chooses one that sort of makes sense. Actually, to some degree you do. Because it's sassal and you do say stuff that you won't allow over plaintext connections, for example. Yeah, but there are ways of setting these things. And given that you have one option available or three, and basically what sassal does it matches the overlap between the server offering and the client's ability and finds a good one, maybe the best one. But if you're willing to accept all three options, then it might choose any. So yeah, you would want to control this to some degree. Thank you. I see a discussion group forming at the bar after the talk. We might get drunk if we don't. Before we get to the next question on the mic, are there any questions on the interwebs for the speakers? Harold, signal desk? Any questions? Nope. I see shaking head. So please go ahead. Very practical question. You mentioned the Apache web server. You mentioned Firefox. Obviously, there's no reason it couldn't work for other browsers, other web servers, right? Sorry, there is an anti-implementation. I can answer the question. Currently, head is dough. There was some kind of standard being built for all browsers. And currently, you know, there are only two real ones left. Head is reality is home and home contests Safari, currently even Internet Explorer, and of course, home itself. That's the one engine. And the only real other engineers still Firefox. And in principle, it would have been possible to implement this on home as well. But there is one addition which Firefox added to the native message thing, which involves that you can intercept HTTP request. And then the Firefox browser plugin can wait in the form of a so-called JavaScript promise for the answer of the external program on a request. And unfortunately, Firefox is the only browser who implemented that. And up to now.  There's no reason why others couldn't. But there's no current use case. We define a use case. So we hope to do so. They felt very fortunate that Firefox made that extension. Otherwise, I couldn't create a demo which I created for this not only across over with the entire HTTP shuttle and external program. We really wanted to pull credentials away from the browser. I somehow feel iffy when I need the same environment for looking at adverse advertisements and logging onto my bank. So you wanted your credentials outside the browser. And underneath the application so in the HTTP layer, these were very deliberate choices. You could, of course, implement this entirely in JavaScript. But then you wouldn't have access to Kerberos, for example, unless you build entire Kerberos in JavaScript, which might be a bit of a security problem. Did we answer your question? Yes. Thank you very much. Long answer, but a good one. Thank you very much for that. We have, yes, please. A couple of quick ones. I was wondering about replay attacks. I didn't see any binding into crypto protocols in here or did it just miss it? I couldn't read all of the slides from back there. Any decently designed protocol, you have an explicit connection that wraps everything that goes on. HTTP made a choice to have independent packets that have no notion of a connection, no identity to link them. And you can send others in other connection. That is a big problem. And that we managed to get this secure. But the replay attack answer because of this design usually uses HTTPS. I'm sorry, the web doesn't have a better answer. So we don't either. Yeah. So that's actually why some of the newer authentication protocols tie the HTTPS parameters into the authentication. It's called universal second factor, UTF. But anyway. Yeah. In Cecil terms, it will be channel binding. And we do that. I can elaborate a little bit on the implementation of crossover in HTTP Cecil. Though HTTP itself is stateless, Rick introduced a server-to-server token in the HTTP headers. And the implementation of crossover in diameter contains so-called session ID, which will be disposed by diameter when the session is complete. And so when you try to replay that, if I'm correct, the diameter won't accept it because that session ID is no longer valid. OK. I want to address the S2S headers in our most of our implementations is not the real state of the server, but only in the, so to say, indirect. It's the session ID of diameter session, but not the state which headers the authentication is currently in. Because then you are totally correct when you do that. I even made a proof of concept of that because we would like to have the headers for normal protocols, the HTTP server to be stateless. But then you can very clearly see the, indeed, the risk of replay attack because, of course, that succeeds. Because then you don't have the challenge response system anymore because you have all the state, it doesn't matter whether the state is encrypted or not, you have all the state into the S2S. And then you can just replay the last poem, so to speak, to the, you can replay that and then you immediately locked in. That is indeed quite a big problem I found out and together with some guy called Steph, which is really involved in his project, who pointed that out, as I proposed it to use it on his protocol and came up with it. In the only way, perhaps we have to investigate it further, but the only way to circumvent it is indeed using a secure protocol such as HTTP. But he's right, it is not a complete answer to replay attacks. And I do have to move that conversation over to the bar because we are unfortunately out of time. I'm very sorry for that. So please give another last warm round of applause for Rick and Henry.


So for the listeners who might be thinking about starting their own CPG brand or their own company, you know, what kind of time horizon are you are you thinking about as you obviously given your experience under with with kind, but then today, just to give people a window. So I am in my late 40s and I just where I am in my career and in life. You know, I really wanted to do something different, which was this a startup and I wanted to do it for the next 10 years. So we made a commitment to each other and we said, Hey, we're going to give this a go.


Now let us discuss the other topics of interest for research. So an important topic of interest is problem finding. How do we find problems? This is a difficult topic to discuss but it is closely linked to creativity. So creativity involves generation of ideas which is in some sense finding problems to work on. So we will discuss the following points, problem solving versus problem finding. Then some points about formulation of a problem, types and attributes of research problems. Then sources of research problems and finally some piece of advice, words of wisdom. The finding a problem is harder than solving it or doing the actual research. Those students who have been given the problem which is clearly defined by the guide will not appreciate this statement. But in case you pursue a research career beyond a PhD, you will definitely be faced with this situation because ultimately you are supposed to be on your own and at that time you will find that it may be more difficult to find problems to work on and decide the significance and usefulness of problems than to solve the problems. Then finding a problem is often more essential than its solution and finally it is as much as scholars responsibility as that of the guide to find a problem. So many times the scholars are not aware of this and they are not clearly told about this aspect that finding a problem is as much as scholars responsibility. Now another point, only a prepared mind can follow a lead opened by an observation which is too insignificant to attract the attention of a common man. So this is where the prepared mind is important. We have already given some suggestions on how we prepare our mind. So we assume that the mind is sufficiently prepared which includes sufficiently interested in doing research. So a certain minimum level of interest is required to have the ability to find a problem. However, with a somewhat lower level of interest you may be able to solve a problem that is given but to find a problem you really need to have a high level of interest in research. Students are mostly presented with well-defined problems having a single solution. They are uncomfortable with ill-defined problems. So in the beginning this process is not going to be so easy because you really don't know what to do. A just found problem is ill-defined. Its formulation as well as a well-defined problem, its formulation as a well-defined problem is an iterative process which may get completed only after a thesis writing. So this is a very realistic statement about PhD research and it is not an extreme statement that the clear formulation of the problem happens only after you write it up fully and until then it is an iterative process. So you start with some vague idea and then you work on it after working on it or during working itself you realize that there are some difficulties so you change the statement of the problem then you think you have some results which you can report you start writing up. During writing you realize there are further changes which are possible to the problem and so on. So it is an iterative process. You should not think that at some point of time the problem is well-formulated and thereafter you do research and after you complete the research you start writing. It is not this kind of clear stages. Now loosely one can say the steps in finding a problem are identify an area of interest, gather information looking for gaps and then formulate a hypothesis.  Now let us look at the step of formulation of a hypothesis. We will discuss looking for gaps and literature survey these aspects later. The formulation of hypothesis happens in the following stages. There is a very general statement following which you try to resolve the ambiguities within the statement. So resolution of ambiguities it involves thinking and rephrasing. Here again you see there is a reformulation of the problem and iteration. So the arrows upward and downward show that there is an iterative process. Now at the end of this iterative process comes out a clear concise manageable statement. Let us look at an example to illustrate this point. Suppose someone is working on comparing productivity of companies in Japan and India. This is an area that one would like to pursue. So you start with the statement productivity of Japan is much higher than in India. You have some kind of a vague observation based on which you feel that you would like to establish productivity of Japan is much higher than in India and then you would like to discuss reasons for it and so on. Now this is a very vague statement. So a clearer statement is productivity of manufacturing industries was higher in Japan than in India during 1971 to 1980. So first of all the statement has been made in the past tense because when you say productivity of Japan is much higher than in India it is a very general statement which seems to be applicable for eternity. But you cannot make this kind of a statement. You do not know what will happen in future. So that is not a good statement to make. Nor can you call it as a good conclusion of your research. So first of all the statement is made in the past tense. Second a period is defined over which you are going to study the productivity. This is where the conciseness and clarity is coming. Now further clarity, what do you mean by productivity? So labor productivity of 15 selected manufacturing industries. It all depends on which industries you are comparing. So labor productivity of 15 selected manufacturing industries was higher in Japan than in India during 1971 to 1980. So now this is a sufficiently clear statement. Now one can collect statistics to see whether this hypothesis is true or not. And then one can try to interpret the observations and so on. Let us look at another example. Someone is doing a research in teaching learning processes in the area of psychology. Now this is a vague kind of observation based on experience. Statement number one, average learners are less nervous because they are average. Teachers who teach, who have taught large number of classes and large number of students find that there is a section of the class that is not nervous about anything. Seem to have cool. Whereas there are some people who are nervous. And then you try to analyze what is the reason that some people are nervous, whereas other people are not. Can we have some kind of a pattern? So then you think this is a topic that one can study. So now this is a vague statement, so you try to make it specific. The students possessing average intelligence are less nervous than others. So now you define what is meant by average student. What do you mean by an average student? The average student is a very loose statement. So now you are saying, okay, I'm going to measure the intelligence. And whoever is average in intelligence in the test that I use, whoever gets an average score, I will call him as an average student. That is the definition of an average student. So then I want to pursue this hypothesis. Students possessing average intelligence are less nervous than others. Now the next question arises, how do you measure nervousness? What do you mean by nervousness? In the beginning it's a loose observation of several facts, but when you want to make it scientific, every quantity should be measurable. So you further modify this hypothesis. Students possessing average intelligence have fewer symptoms of abnormal behavior than those having very high or very low intelligence. So now you have to measure two aspects. One is intelligence, other is the behavior. And in both these measurements you try to identify abnormal, average, these two groups. And then you try to see what is the correlation. Now again, how do you measure intelligence? So then there are several different ways of measuring intelligence. If you use one particular intelligence test, you may get one result. If you use a different intelligence test, you may get a slightly different result. So you have to be even more specific. Since not all intelligence tests measure the same aspect. So noting this fact, so you can make a more precise statement, something like this. Students at IIT Madras having an IQ score on the WBA intelligence scale, this is a specific intelligence scale, within the range of 90 to 110. So you also define who is an average on this scale. Have lower percentile ranks on the sub-scores of an MM personality inventory. It is the name of a test that tries to monitor the behavior of people. So MM personality inventory than a like group of students having a total IQ score of greater than 120. So by this method you are establishing that people who are in the region of very high intelligence tend to be nervous in the class. And those who are in the average region are less likely to be nervous. So this is the way one can study, for example in the area of psychology. So like this one can take examples in your own area of a vague statement and then you go on making very specific, statement very specific. And then you can pursue it for research. Let us look at some of the types of research problems. So broadly one can say one type of research problems are theory-building or modeling of experimental data. So you have some experimental data which people are reporting and you provide a theory or a model. The second possibility, collecting experimental data to prove or disprove a hypothesis. So some hypothesis is present. It is already there, people have made some sort of observations. We took some examples just now of some hypothesis. Now you want to establish whether this hypothesis is true or not. You can conduct experiments, you can design experiment. In the lecture on experimental skills we will see an example of how an experiment is designed to prove or disprove a hypothesis with some example. And then you can also have a category of research where you invent a new device and you want to show its utility. Now you can also talk of a process instead of a device that is also included here. Now as we have said it is very important to have a judgment on what is the likely utility of working on a problem. Supposing you have alternatives, working on this problem, that problem and so on. Now which problem should you work on? This is also a very crucial but difficult judgment. So one can broadly talk about these aspects that one can consider. First the difficulty level of a problem. A problem should not be too difficult nor should it be very easy. This is one important point, difficulty. Then usefulness or value. Now if you work on it a problem may be difficult but then it may not be useful. If you work on it and you get some result that may not be useful. So usefulness is also another thing that we should try to judge. As we have seen in creativity, the definition of creativity, usefulness is an important parameter not just newness. Then originality. What is the level of originality? Is it that many people have tried to give solutions to the problem or not many people have been able to give solutions and so on? Yes, you have a question? The one class of problem you stated was that to prove or disprove a hypothesis. Yes. So how come it adds value to, I mean as in if you prove or disprove a hypothesis, how come it adds value to the society or like. A good point. Well, therefore it depends on the extent of value you add varies with the type of problem you pursue. If some hypothesis is there which is more or less believed or accepted by many, then the kind of research that you can do in proving the hypothesis is only if you come up with a very simple technique to prove the hypothesis much more simple way than others have done. But then still its value is not that much obviously because the hypothesis is held by people and then it has been proved already. So still because there is some newness in the sense you are suggesting a new approach which is simpler, it has a value. On the other hand, if you can disprove a hypothesis, it has much more value. If you can disprove a hypothesis that is held by many, it has more value. It is suggested that you can try to look for such problems where people are likely to believe a statement and then you have a method of showing that actually that statement is not true. So one should attempt to look for such problems. In psychology that is how research is done. You take some myths. For example, people believe that if you are a genius then you should be eccentric. Genius is eccentric. This is a statement that one can examine. Now research on psychology has shown that this statement is not very generally true. Similarly, another statement. If a man is blind then it is likely that his hearing will be much better than that of other people. Now you can examine this statement and see whether this is true. You can examine whether the statement is true and you can also examine whether the enhanced hearing power is because of the blindness. See that is also an issue that you have to establish. So this is how one can pick statements or problems for research. So then comes interesting whether the problem is interesting. You see a problem may be difficult and it may be useful. There may be originality also. Is it interesting? Generally again to repeat just now what we have said if you can disprove some widely held belief then it is very very interesting. The interest level is very high. If you can resolve some contradiction which is existing then the interest level will be high. So counter intuitive conclusions if you can get out of your research then that will be very useful. Then significance. These are additional parameters. Significance or impact. A problem may be interesting. It is difficult, useful, original. What impact will it make? This is something that is difficult to judge. But then one must remember it is also a factor. Let me illustrate this point with an example. Let us take the example of people who compose music for films. Now in one of the interviews of a famous music director he was asked to name what he considers are his ten most creative compositions of ten film songs. Now it was found that of those ten only six were super hits and four of them were totally unknown. So then he was asked how much time you spent on composing these songs, how much effort you spent. Now he said surprisingly I found that there is no strong correlation between the amount of effort spent on composing a song and one's own impressions about the melody of the song and its impact on the public. So some of the songs which were super hits he had spent very less effort and he never knew that they are going to become super hits. Some which he spent lot of time composing and would have liked them to super hits were not known at all. So this is one aspect that we must remember about research that there is a factor called impact which can be unpredictable. So one should not try to assess the possible impact of one's work very early and then try to make judgments. So one has to leave that to some extent to destiny. However this is where the guide can be of help. This is where experience is of help. In fact these are the situations where the guide is really the person who can contribute a lot. So the student is spending all his time in coming up with new ideas finding problems. The guide can help in selecting a good problem for research. And finally you must consider cost or equipment or cooperation. Supposing there is a student who is not very happy working with people managing people getting work done from others. Then it may not be good for him to choose a problem which involves setting up some big apparatus and going and getting things done from the workshop from this person and that person chasing people and so on. This is one factor that you have to consider. Of course one can also modify one's personality and develop interpersonal skills. That aspect is also there. So you must work with both the things. Cost is also a very important parameter that you must try to consider. Many times research scholars are infatuated by some field and they are not aware of what is the cost that will be involved if you want to pursue this particular idea. So these are the factors also which one must consider while selecting a research problem. Now let us look at some sources of interesting research. We said that research problems should be interesting. Explanation of an anomaly. This is an interesting piece of research. Anywhere you find something anomalous which is same as saying counterintuitive. Let me give an example from say electrical engineering. Supposing you have a device whose current voltage characteristics are something like this in some situation. So what is the anomaly here? What you find is there is a region in which the current decreases when the voltage increases. This is an anomaly because normally you expect that the current will increase when you increase the voltage. So now if you find that people have not been able to explain this then this is the kind of thing that one can take up for research. This is an anomalous behavior. So like this one can see some anomalous observations in one's own field and one can pursue that for research. Solution of a contradiction. This is another way of defining or coming up with problems. Example of this. Let us say I am a chemical engineer working on plating of substrates. Now I find that if I want rapid growth of plating on the substrate I must increase the temperature of the bath. So higher and higher temperature if I use for plating then I get rapid growth. But at the same time I find that I cannot do the plating for a long time at a higher temperature because the bath disintegrates when you raise the temperature. So this is where you have a contradiction. You need higher temperature for higher growth rate but higher temperature also disintegrates the bath and therefore you are not able to do the plating for a long time. Now how can you solve this problem? So you should get thick plating by having a higher growth rate but the bath should not disintegrate. So someone came with an interesting idea. What he said is you do not heat the bath but you only heat the substrate and then you drop a heated substrate in the solution. So near the substrate the temperature will be higher but all around it the temperature is not higher so the chances of disintegration reduce. Now this is a very good idea to pursue. It may look like a simple thing but if you can show that it works it will be very effective. You have to do lot of experiments and establish what are the advantages you get. This is what is meant by a solution of a contradiction. There are many other examples that one can give. For example if you are working on a power device. Now what is the basic contradiction involved here? You want higher and higher power to be managed. But you find that as your power goes on increasing the speed at which a device can be switched goes on decreasing. So there is a tradeoff between the speed of the device and the power that it can handle. Now can you come up with a new scheme, a new device which will give you higher speed at the same power? This is something that one can think of working on. So like this you can identify in your area what are the issues or aspects where tradeoffs are involved or contradictions are involved. And then you can choose some contradiction for working on to resolving the contradiction. Then another sources of interesting research transplantation of ideas and explanations from one context to another. So this is where it helps you to have an idea of what is going on in other areas.  And then you can think whether this technique we have never heard of in electrical engineering. Can I use that technique and solve a problem? If you do that that is an interesting piece of research. So this is nothing but similar to what we have said earlier working with analogies. Transplantation of the same idea given in a new situation is nothing but employing analogies to come up with solutions. Similarly not only if you find an interesting idea you can see an application in your area for that. You can also have a specific problem and then look for a solution for that problem by exploring other areas. So you have a specific problem in mind and you want to get its solution. You can explore other areas to see whether you can transmit some idea from other area into your area. Now let us look at some general sources of research problems. So if one is having difficulty in finding problems one can do a checklist. Have you done each of these things? And even after doing all this if you do not get a problem well then it is a difficult situation. But other mostly I have found that if you keep doing any one of all of these things you definitely have a very good chance of finding a good problem for research. So future work sections in thesis and papers. So you can read a thesis of other students in your laboratory. Nowadays many thesis are put up on the internet. You can see the PhD thesis of many other universities. So in your own area you can read the last section. Entire thesis may be difficult to read but you can always read that scope for future work section. Then interaction, constant interaction or discussion, answering doubts, teaching, explaining. Comparison of different approaches by some objective measures of efficiency or accuracy. So when you are reviewing an area you will find people have suggested different methods for doing something. But an effective comparison and a comprehensive comparison of all these methods has not been done. You can use that as a starting point. Here I am not suggesting that that itself can be researched. You do not know how the problem will develop but it is a good starting point. It is a good starting point for pursuing research. Because after all the main issue in many cases is getting started. Once you get started things start happening. The problem is with getting started. Look for harmful simplifications or arbitrary choices in a paper and then you try something different. Derivation of simple closed form solution. So you find somewhere people are using numerical techniques to get some data.  This is something one can explore. Some more sources. Identify all variables and alternatives of a situation to see which have not been explored. Study existing systems or procedures and note what they do badly at. Implement someone else's work yourself and see the many problems out there to work on. This is a very good starting point. And it is something that one can do easily. So instead of just going on reading material, doing literature survey, what you do is you take up something interesting that other person has done. And you just try to repeat yourself and see whether you get the same result. Now many times when I suggest this to students, students are not very enthusiastic. They feel what is the point in repeating what somebody else has done. Well the important thing is to get started. The important thing is to get started. Otherwise if you spend your time just reading, you won't necessarily find gaps or find problems. You should read and you should do something. So what is it that you can do even when you have not decided your problem? This is something that you can do. You do what other people have done. Combine and reorganize existing knowledge structures. Now finally some words of wisdom. A problem must spring from a researcher's mind like a plant springing from its own seed. This is the first important point. So if the student works on a problem whose seeds are in the guide's mind, then all that the student is doing is watering a plant. It is like watering a plant. A plant has already been planted and you are watering it. This is also a very satisfying experience. But still the attachment for that problem will not be as much as it will be if the seed is in your own mind. All of us know, I mean people like their own children much more than others' children. I mean it is something similar. So it is worth spending a little bit more time but let the seed of the problem be in your mind. Do not worry too much whether your problem is the best one to study. Once you go deep, any problem becomes interesting. The important thing is to get started. So any problem becomes interesting if you go deep. This is a very, very crucial point. So do not worry too much whether the problem is good. Once you have decided to work on a problem. In the beginning you may consider various options and then you arrive at a decision. But thereafter then you do not go on comparing at various points. That guy is working on this and then he is getting faster results. Now I am not getting results. So then you will constantly be in a stage of doubt. You need not do that. It is better to kill a little problem than to bruise a much larger one. This is a very important advice for particularly students who are independent minded and who are following the first statement that a problem must spring from one's own mind. So you choose a problem that you can kill totally than to choose a problem which is very big, very ambitious and which you can only bruise that is make a small dent. It is not worth it. Problem finding is an autocatalytic reaction. What is an autocatalytic reaction? It is a reaction in which once a reaction starts the products of the reaction themselves catalyze the reaction. So for example this is a commonly used method of plating in chemical engineering or chemistry. Autocatalytic plating. So here what you do is you have a substrate and in the solution you have the metal which you want to plate in the form of a salt solution. Now once somehow the metal from the solution deposits on the substrate the deposited metal itself acts like a catalyst and attracts more deposit. This is what is meant by autocatalytic. So problem finding is an autocatalytic reaction. So which means what is the important thing here is to get started. Once you get started even you get a small thing to work on. As you start working on it you will generate more and more problems and the thing will develop. So the important thing is to get started. I think the last statement is a repetition of something that we said already. Problem becomes interesting as you think deeper and deeper about it. In fact I have a practical experience of this. Around 91 to 93 I was working on something. I first tried to develop a complete process for a device which has been imported in the country for long time. So already people abroad have developed a process for it. So I was trying to develop the process because I was wondering why we are not able to develop the process in India for the same device. It is a very simple device. What is the difficulty in developing a technology, developing a process? And so when I used to discuss about it with some important people in industry and those who are doing research. This to say yeah it's good but then why didn't you select something very recent? This is something that is people already made the device and then you are working on a process for making the same device elsewhere people have done it. And then I found as I was working on it I ignored that advice because I was really attached to what I was doing. So I just heard it. It didn't bother much about it. Now among the publications that I have I found that is the problem that I have worked on which led to it more as I thought more and more deeper about it as to what is the problem. I could identify something to work on which gave me which gave my paper many citations the maximum among the citations that I have so far in various publications. So this is I have a practical experience of this particular statement that things which don't look interesting as you go deeper they will become interesting. So now let us discuss few points about literature survey. So now incidentally I want to caution when I say that any problem becomes interesting here I am not saying that you should not look for problems relevant to your age or your years that is not what I mean. But the point is if there is something that you consider interesting but others consider uninteresting it can become interesting to others also if you go deeper into it that is the point I am trying to make. Okay literature survey. Why you should you do literature survey? What to read? How much to read? How to read and note taking? We will consider these aspects of literature survey. Why do you do literature survey? It may look like I know this is a trivial thing. It is not as trivial. Let us look at some of the reasons for doing literature survey. To know sufficiently enough to identify gaps and inconsistencies. Yeah I think this everyone knows. To know the views and interest of others in a topic. Very important the third point to know and establish contact with people who may be interested in your work. This is one reason for doing literature survey. Okay so as you will realize later that having contacts with people working in your own area is very important part right of building a good research career. So when you do literature survey you may find that some people have done very good work in your area. You try to establish contact with them. So establishing contact does not mean simply sending an email and then saying you know I am also working in your area. That may not be interesting. You may find some part of that work interesting and you may have got some doubts on it. So you can establish contact by you know writing an email saying what is it that you found interesting and what is your doubt. And see whether the other person is you know interested. Even if he does not respond still he will remember you. Right provided what you have said is interesting. So this is one can establish contact through literature survey to know if others have already done what you want to do. Very important thing. Now it is for this reason and this particular reason that you need to be doing literature survey continuously throughout your research. Okay it is not something that you do in the initial phase of your PhD and then you start working on the problem. Don't bother about reading on. So it is a continuous process. Sometimes you may find that a publication will appear which seems to be doing the same thing as you are trying to do. Right so and at that time you may get depressed but this is where a guide can be of help. In fact it can be shown that if you have done some work there will definitely be some originality in it. Right something that other person has not done. It depends on your ability to see this difference and then you can try to project that particular angle of your work. Right this is an ability then one needs to identify the uniqueness in one's own work to integrate and compare various ideas on a topic and to get hints on how to tackle your problem. However you should not aim at the solution of your problem through literature survey. Okay it is good if you think on the problem on your own and try to get a solution and then try to see what methods others have used. The reason being if you read too much as we will see how much to read that is the next question. Then you may get biased and if you had earlier or you could have thought of a unique method of solving your problem because of the bias you may not pursue that. Okay that is why how much to read also is a very important point. Yeah that is coming later let us see first what to read. So journal papers, patents not many students read patents incidentally. Research reports that is reports of some project, conference proceedings and thesis. So these are called primary sources that is the new information is there in all this particular sources. Then there are other sources also such as indexing and abstracting services, review articles. Review articles are very nice to get a feel for what is going on in an area and to get the history of the problem and of course reading books. Now let us discuss the crucial topic of how much to read. Start with articles published recently and go back to about 5 years earlier. So students always have this difficulty right should I start from 1970 or should I start from 1980. The point is do not start from that end. You start from the latest first this is very important. So you choose the most recent 5 years as your period to start with. To understand some of the points there you may have to go back that is different but where do you start? Read and think alternately. Do not spend eternity on literature survey. Start doing your own thinking early. This is another important point. One has to start in a state of partial ignorance and this has an advantage that you are free from prejudice which suppresses new ways of doing things. So always if you know everything about a topic then your mind will become closed. So it is a matter of belief whether you know everything. Let me not say everything. Know a lot. Let us say know a lot. So it is good to be in a state of partial ignorance because then you are likely to come up with a new idea. Reading should continue throughout the research process. Now how to read? Now scan to get an overview. Read the title abstract conclusions and figures. I am considering a research paper as something that is in this particular steps that I have described here. I am assuming that you are reading a research paper. So you first read title abstract conclusions and then you see all the figures. Do not read the text. Highlight anything that has attracted your attention. Then read in detail. Because many times people wonder how can you read 100 papers for your research. Evidently you cannot read 100 papers word by word. That is reading like a child. A child reads letter by letter and word by word. If you see carefully how the reading ability progresses. You know a child reads you put a finger on the each letter and then it reads. Then slowly it develops the ability to read word and then you can read up to sentence. But surprisingly the reading ability does not develop very much beyond that. So we are used to reading sentence by sentence. Now that is not at all suitable for research work when you have to read a lot. You do not have to read words or you do not even have to read sentences. So one can read word by word line by line paragraph by paragraph. It is possible to read paragraph by paragraph. Chapter by chapter. And you know book by book. There is a very interesting episode. Swami Vivekananda once took a book from a library. It was fairly thick book. And he returned it back within three days. Then the librarian asked but have you read this book at all? I mean how can you return it back in three days? Then this is the statement that he is supposed to have made. That people read in different ways. Some people read line by line. Some people read chapter by chapter. It is possible to read chapter by chapter. Which obviously means you are not reading everything there. The point is to get a gist. Point is not to read every verb and every noun there. That is the important point one needs to know. And so this comes by experience and practice. So this is where I have suggested that you do an internet search to see how you can read speedily. Note taking. I have already discussed the importance of note taking. These are some practical tips about notes. The purpose of notes is to try and keep information to assist memory. Notes are memory maps. So what is the role of notes? They are basically memory maps. Branching notes with sketches, remarks, ETC may be more effective than the paragraph wise compiled material. So here what is being suggested is do not write detailed sentences and all as notes. That is not what is meant by preparing notes. It is not necessary at all. In fact you must only note ideas. And then as your notes develop, it is not a serial development of sentences starting from top. Because you have an idea. And then this idea may develop at different points of time. So that is what is suggested is you take a piece of paper and you put the idea somewhere in the center. And then as you get more ideas associated with that, you put the other ideas surrounding this idea.  By arrows and so on. That is the way you should. So you must leave a lot of margin. Whenever you start preparing your notes, you always go to the center of the page and then you write a little bit. And leave a lot of margin because it is this margin that it will be used for developing. Notes are developed alongside the learning process not after the process. It is a very interesting statement. So it is not that I sit through some lecture, then I go back and in the night I write. That is like writing a diary. That is not a note. So when you are sitting and when the process is going on, you make a note of it. So evidently you are not going to write detailed sentences. It is just noting what you think is important. So in the same situation, different people may have different notes. So it is possible that one's notes may not be of use to other. Because it is a thing that you are prepared to assist your thinking. It is not necessary that other person should be able to read it. It may not be possible also. Leave liberal margins for future additions and remarks. Every new topic should start on a separate page. Notes must be updated by reading more and more. Notes taken for the same subject by different persons may differ appreciably because the subject matter understood by the note taker is integrated with the existing knowledge and then jotted down as sketchy notes. So it all depends on what the person considers interesting and useful for him or her. That one is taking note of. Now this is an important point for all research scholars. When you take notes, when you are reading a lot of papers, if you note an idea, you note at the same time the details of the publication from which you have got the idea. Many times what happens is students do not write the publication details. So you have made a lot of notes. You have read for one month, you have read a lot of papers. And you have made a lot of ideas. And then when you ask the student, hey, this is something good, where did you get it from?  Because at that time you are not aware that at some other time later you will have to provide references. This will be doing the job all over again. When you know that finally when you write the thesis, you have to provide references or you write a paper even before writing a thesis. You will need to provide references. And I have seen practically students spending a lot of time again going through all those things to, you know, prepare the references. So with that we come to the close of problem finding and literature survey.