Hi everybody it's Sam at Mixed Up Craft thank you for watching my tutorial today. I'm going to be showing you how to make this really fun pop-up card so inside you have these kind of pieces that flap about on acetate and it just gives a really fun effect. Now I actually made this one during my hobby-based live tutorial a couple of weeks ago or would have been a couple of weeks by the time you see this video and the inspiration for this came from a lady, her blog's called My Stamp Lady but it was from 2010 and hers had stars on the inside and I just thought what a real you know clever card and it's really really easy to make so the inspiration came from hers but the measurements and I guess well this is I guess this is how she would have put it together I didn't see that I just saw the picture and really liked it so I'm going to show you how to make it using the new secret garden collection because I just have this this idea to put together just a really detailed little card and I've done lots of stuff and so far I'm really you know enjoying and liking what I've done so I have got everything here and I'm going to show you a few little kind of tips along the way as I like to do but I've done the bulk of it so this is the secret garden collection if anybody new to my channel hasn't seen this yet this is the new dovecraft release and it's amazing it's my favorite one they've ever more favorite dovecraft that I've ever had um I absolutely love it so I've used the large these are the wooden toppers these are the birds I've used some of the blossoms here blossoms and leaves all these links and everything is on my amazon storefront and I'll also share other links on my blog as well to where you can get this I've used the pearl flowers I fussy cut images from the actual paper pack um and I've just put it in this one here this was the wooden shapes which was the little picket fence which I'll show you in a moment I've used the ribbon the bunting and these paper flowers along with the washi tape and the six by six paper pad okay so lots and lots of the collection used in this one today but as always you can make this card with obviously something completely different so that's the paper pack you always get the overview there of the papers on the front which is really nice and then here I've got everything so on the front this is my front already done so underneath here I have some silver mirror cardstock then some paper that I've cut from the paper pack then a silver doily which I shared this was in my what did I get and this was from the works and a few of you have already told me that you've already received or purchased your silver doilies they're beautiful and then on top I've just done this kind of little cluster there and that's the ribbon so on the front it says just for you this is a piece of four and three quarters by six and three quarters and then the mat is four and a half by six and a half standard layers mats and layers for a five by seven card base also you're going to need two five by seven card blanks however we are going to be cutting into this so if you don't have the card blank I'll give you the exact size in a moment there's a little um picket fence so I've had one left so I've just dressed this popped a little kind of like that was a bra that I cut to look like a little gate um the rest of these got used on my she shed storage box which also uses a lot of this collection so I'll link that up here again if you're new and you'd like to see what else you can make with this so I've got that ready I have already created some grass and I will show you kind of talk about that in a bit more because I've got one there I need to finish off I've created my bunting I've gone ahead and fussy cut lots of bits and pieces because this is all going to be part of the decoration inside and then I've got all of these mats and layers as well okay so with the two card blanks here what I'm going to do is pop it in here so you've got the top kind of flapping to the left here and you've got the score line here that's score line you want to line up with the half an inch marker now on this Tim Holtz guillotine the half inch marker is literally the metal kind of plate here so I'm just going to line mine up with that and make sure the bottom is obviously lined up as well um I've had people ask why my arm goes all the way back mine's actually broke I dropped this that's why it goes all the way back so if for safety reasons it shouldn't it should lock in somewhere down about here I think maybe even just about there so yeah that's why yours don't think yours is broken because yours doesn't go all the way up yours is all okay yours is good so you want to then cut the whole piece off so you're going to do that on two of them now if you like I said if you don't have the card blanks then you'll just want two pieces of cardstock that are five and a half by seven and along the five and a half inch side you will score at five and it will give you this little half inch tab okay because those are the pieces that we will end up sticking together like so okay so now that acts as a hinge on the inside of the card and there's the front and the back okay so it is very very easy but really fun to do so that's that done now I'm going to go straight in and pop down all my mats and layers because these pieces I don't actually need to you know once they're stuck down nothing else is going to be done with those it's all about the pop-up element in the middle which I will go through in a bit more detail in a moment so the same mats and layers that I gave you for this piece here on the front is what you need for the inside so I've got two silver pieces here which are four and three quarters by six and three quarters so they are going there okay and then I have two pieces of four and a half by six and a half and they will go perfectly on top and then I've got this one here fat that one is my one that I'm having on the back like so and this one is going on the front then on the back one I have this piece here so so I've just stamped in silver embossing powder sending many wishes your way and I've just cut a rectangle any size and then the smaller one there which is in white so I can write on it I've gone and distressed all the edges with this little tool here it's by dovecraft and you literally it has tiny little blades in these little sections different size blades and you just go along and you scratch the side and it just gives you a really nice kind of distressed a bit of a shabby chic look really so you do get a few bits that come off you just need to brush them away and then that one it's upside down because obviously it's facing away that one's going to be stuck like so now I've also added some washi tape there which is this floral one here from the collection I stuck that down first and then when you stick that over the top you just get a little bit of it poking out the sides on the one facing the front I have this piece here and again if you want to do something similar this is two and a half by the six and a half inch width because it sits there perfectly on that layered piece and then I've just stamped this lovely birthday wishes sentiment again with silver embossing powder and that's using the woodware and this is the big birthday words which I've used so many times I love it it's just such a nice stamp set again all of these things are linked and a lot of them are already over on my amazon storefront but that one is going to go there like so so that's that's the inside flat parts all ready to go so I'm going to get that all stuck down okay so I've stuck everything down so that's the front panel so whoever opens it that's what they will see at the front and then that is the back panel where I will write my message and then those pieces are all going to be stuck together so next what we need to do is to start creating the scene so it's quite nice to get that all laid down and then you can kind of see you know how everything else is going to look so you want to fold these tabs inwards okay like so and you're going to add adhesive onto those sides there now I'm going to use red tape and for the moment I'm just trying to find I'm going to use this one here which is a quarter of an inch now this tab is obviously half an inch I would advise don't put the adhesive right down to the fold side you want to keep it more up towards the this edge here okay so I'm just going to run my tape kind of in the middle really okay so don't worry if it doesn't cover it all because it yeah it makes sense once you start to put it all together off that piece there I'm just going to work on one side for the moment so I'm working on the side with this facing me so I'm going to be creating my scene that's going to pop up so what I want to do is I've got this bunting here okay now it doesn't matter if you don't have this collection you can easily make some bunting you can just cut some small triangles out now I've already gone ahead and measured that this is going to work and I'm going to have it sitting like that okay now behind these ones here I'm going to have my acetate which is going to come down and stick here so I've just got some acetate here I didn't know kind of what size I want it but my strips are going to be half an inch so I'm just roughly eyeballing half an inch there now you want a strong acetate because obviously whatever you have you want to make sure it's going to pop up so I'm just going to cut them for the minute I don't know like I said if I'm going to need more I'm not sure if I'm going to have the birds popping up as well but I want to sit the acetate on there and then bring it down it's going to kind of be on an angle and then it's going to come and sit down here so now I can see where I need it to lie I'm now going to just trim that off but again you don't want the acetate poking you don't want it coming right down to that fold line okay because you'll end up seeing it so like here if I bring up this one you can't see anything that I've stuck inside there okay because it's all kind of further up within this half inch section so now I've got that one roughly where I need it I'm going to just pop this one underneath here so I'm just kind of showing you the process that I am going to be doing for this kind of bunting but anything you have you want to lay it down first before you actually commit to sticking it down so even if you're doing these here you know I had them all laid down first of all here so I could just check that I had them the right height and you also want to make sure that whatever you have doesn't overhang here because when you close it up obviously it's going to stick out and it won't fit in your envelope that's why I wanted to lay this bunting down first just to make sure everything's going to work so I'm happy with where that is going to kind of lie so what I'm going to do is I'm going to take the backing off of this first now I've moved them but that's fine I want to get them in place so I'm going to stick that one down and then bring this one back it's there in place I'm going to remove that for the minute and then on the very ends of these acetate pieces I'm going to pop some of this red tape again I would advise to use a double sided tape or you know the strong double sided tapes or the red tape when you're working with acetate because it will just stick much much better than any of your liquid glues eventually they will just end up peeling off really okay so that's those and then I'm just going to take off the backing like so and then I can just again hang it over and kind of start to bring it up a little bit just so you can see how it's going to work but I know it's all going to work so now I can just lay that down like so here you go I'm happy with that now another thing that you will want to do I'm just going to carefully fold that back over so now when that pops up when the envelope when the cards open this is going to hang like this it's going to look really nice but you want something again I'm just being a bit detailed and a bit picky I guess but when that person reads this side you also want the other side to look nice so if you are making your own bunting you'll want to cut double really so you can stick on the back as well but the nice thing with these that are in the pack is you get so many of them so I'm going to just add some red tape onto the other side of that acetate piece like so and then I'm also going to add some wet glue just around the string and the any other kind of exposed pieces and then I have my here and I'm just going to stick those completely right over the top like so like that and then I'm going to actually trim off now the string okay so right now I have this really pretty bunting kind of dangling around so now is the time to lay this down again and make sure so I could have a little bird kind of sticking up here or maybe one or two there but because I've got this skate that I'm going to have maybe here on the other side I'm probably not going to have anything else kind of floating around I think I'm just going to stick with that so like so if you do want to add more stuff then you know do that whilst it's in this position now I'm going to bring this one back here and I'm going to run some tape along the very top like so just go over the acetate there and then you want to line them up with the tabs folding outwards so you know you've got room to kind of move it around without it sticking make sure they're completely married up hold it down with your hand like this and then you can just pinch up the two together like so there we go and now your little pop-up piece kind of floats around it looks really nice that's why you want a strong acetate so it does stay upright like so so now I am going to decorate everything else okay so now I've gone and cut these grass strips and they're going to stick over the top like this and then I was going to have the silver there but do you know what I don't think I'm going in now because it almost mind you it does tidy it up yeah now I'm going to keep them there you don't have to you can have it now I do like it like that I'm going to leave mine actually I'm going to keep it just like that I'm not going to add the silver strips so if you want to add silver strips you want them to be three eighths of an inch by the full width which is seven and you'll see there how I've used these on here okay so it just decorates that white piece but because I'm going to add this grass over the front so I'm going to stick this one down here I'm just going to run some of this double-sided tape along the bottom okay so that's that one stuck down and I really like that I think that actually looks really cute now the way to get that grass is exactly the same way as I make the any of the kind of tassels I make and things like that and basically I just cut a strip so again the same width so length sorry so this is seven inches and I use these vegetable scissors so it was by one and a half in width and then it was like I said seven in length and just go along and just cut up and then I went in with my scissors and just kind of shaped them all so just like so and you just get little grass effects and then just add a little bit of I've got like a blend a really nice ombre effect and I'm just using this is the shabby shutters distressed oxide and just coming in I've already done that side so just have this side left to do and you just kind of just catch the tops really of the the grass and again it just gives a nice little subtle blend and just adds a little bit more to the card really like so and I really loved the effect it gave me on my paper as well so get another idea there for something I'm sure so yeah it was just again I don't know how well that is picking up you probably see it better in the camera but you can just about make it out there it's just a little bit of something so don't worry if you haven't you don't have to do it but like I said I do like adding all these little extras so move that out of the way because I don't want that to ruin anything else again I'm just going to pop some tape along the bottom of this one and stick it down okay so now in the middle I've got this really cool grass effect and because I've doubled them up it just looks really full and I absolutely love how that looks so next I'm just going to start adding all these bits and kind of nestle it all in so I've got my gate which is going to stick like so okay so that is a bit bulky I know but it's fine I like it and then I'm going to have the watering can the birds and all kinds of bits and pieces I've firstly cut some flowers and they're going to kind of just poke out of the grass and yeah I'm going to put this on to high speed now just so you can see what I'm doing and then I'll show you it all finished okay so there is the finished card so that's the front with all that lovely detailing there I absolutely adore it and then as you open it up oh that pops out and that is how it looks when it stands up so it does stand up I think I've got a little bit of added weight there with that little wooden fence but you can see there it's fine it's completely straight and I absolutely adore it let me bring it up so you can see that's how it looks how cute all those little images I just love the illustrations love that little fence I just think that bunton looks great and yeah there's the front and then on the back I also added a couple of the little birds there as well so it's really easy it's just down to how you decorate it really so if you've got I always say if you've got a collection and if it matches it it's just really fun to work with I think I love creating these kind of little mini scenes I think that's why I'm loving this collection so much because I can do so but they have it too really fun little pop-up cards I love it I think it's brilliant so yeah there it is guys I hope you've enjoyed today's tutorial please give me a thumbs up if you have and subscribe to my channel so you get to see more thanks for watching bye


Here we go third gear this car actually handles so nice What's up everybody welcome back to the channel I'm evil rabbit here. I'm forza motorsports 7 So we are staring down that 2008 dodge Viper SRT 10 ACR and that Oracle lighting Dean Carney livery v10 powered a 1,020 horsepower with a supercharger on it centrifugal supercharger Because last one of the last videos I posted I got a challenge from a subscriber From alpaca the boss saying can you handle the power on a v10 Viper? So we're here today to get this thing sideways. I have also built a another 2016 Dodge Viper ACR set for drift as well. So we're gonna see how well this works we're gonna start off drifting the ACR and then 2008 will probably do a little maple valley test and probably head over to Long Beach and see if we can't run some FD lines in it and that will switch over to 2016 so both these cars are pushing over a thousand horsepower probably the highest amount of horsepower that I have ever done in one of these drift car builds, so You know, I got challenge to see if I can handle one of these things and handle the power So well, that's what we're gonna do here today. We're gonna go into single-player free mode And then we're gonna hop into maple valley.  I don't have sway bars in it It's set pretty soft And we're gonna see how this goes Didn't really have too much practice with this car. So this is kind of gonna be a test in itself So we're gonna get the wheel cam turned on here and we're gonna start the race and see how this goes Got our handbrake all set up Dean Kearney on the side on the door Oracle Lightings Viper Maple Valley. There's only a three-minute little test Is I forgot to change it but we enter in kick it sideways sparks flying already. It's actually a really bad entry, but Able to somewhat save that this car handles so nice right now Kicking it in thousand horse power Viper. I think the downforce of the rear wing is definitely helping so To back of the boss, can I handle a v10 Viper? Can I handle the power? Yeah, I can this car is definitely a lot of fun to drive I'm gonna throw the tune up before the end of this episode. You guys want to give it a shot Throw in sparks with that sauce suspension set up though We go third gear This car actually handles so nice I'm actually very impressed with how this car handles except for when I do that But this car definitely is a monster thousand horsepower monster here on fours of seven It makes me wish that I could use this car in ESTA, but this car is Restricted and banned from ESTA. I am not allowed to use any of these ACR Viper's from the list that I saw I am working on a secret project on an ESTA car that I found is allowed but Too bad this car is not allowed because This thing is actually very stable. I mean very minimal corrections to that section. I Mean it's just It's just so nice Save that there we go. This thing just drives so nice. I'm actually very impressed with it I'm wondering if it has to do with the downforce of the rear wing that is allowing me to be that stable on the high-speed turns and If it is I think I may have to put a nasty wing My car for ESTA for sure Well, well there goes my wing so it goes all the downforce so let's see what it does I Kick that in way too early But you could see how soft the suspension set up is throwing sparks, but look at this. It's so stable Very minimal corrections on the wheel Matted playing with the gas a little bit to keep that, but I mean a thousand horsepower V10. I Think I'm running 355s or 305s in the rear some really wide sticky sport tires because this car is on sports So this car definitely handles a lot better than I thought it was going to so for the V10 monster that it is I think I got to handle this car pretty well. So we're gonna switch it up We're probably gonna head to Long Beach now try running the FD section and See how we can Handle this in a Long Beach FD scenario like I said, I wish I could run this car in ESTA But unfortunately it won't let me because it is a banned car But I'm working on another car That I will be possibly debuting on the channel before ESTA Dsda or maybe I'll keep it a secret until I actually get a chance to run ESTA once they announce all the events So we're gonna go into race settings. We're gonna go to We're gonna change this from drift to just circuit Sure three laps day zero five laps streets of Long Beach Because we're gonna flip it around and go right to the FD section and see what we can do with this Dean Carney viper And then we'll probably switch to 2016 ACR Viper v10 Supercharged not centrifugal supercharged that one is supercharged that one is pushing 1,100 horsepower so With that being said We are definitely ready to send this viper Here at Long Beach Oracle lighting on the side definitely a pretty cool livery can't take a tank it can't take credit for it because I did not make it we're gonna flip this car around and Head up to the start of the Long Beach section Definitely don't know how this is gonna handle in the Long Beach section, but Because that wing definitely helps me on the Higher speed, but is it gonna help me here in the Long Beach FD section. We're gonna find out cuz I Know it can handle very well on high speed sections. We're gonna see how it handles on this section kind of medium speed to low speed at the end surround So Oracle lighting v10 supercharged thousand horsepower here at Long Beach Let's see if we can handle it. I'll be a third gear. I probably entered it way too late.  I Should have entered in a little bit earlier Definitely just throw in sparks without soft. I have this cars that oh Man it rocks like Von getting Junior's Mustang. I don't think this one three wheels, but I'm gonna try this again Here we go sparking so we lost our really big wing, but Other than that this car Does handle pretty well, so even though the wings gone, I think we still have our Our downforce so we can give us another rip. I do like how this car handles. I really wish I Was allowed to use this in ESDA But I think they may ban it because of the fact of how wide the tires are and this thing I mean just look at that if I could use this this would be sweet Definitely gonna be using this in some online sessions. Can we get some tandems with this car because uh? It definitely enjoy how this car drives I will throw the tune up like I said before the end of this episode so that you guys can try it if you guys want It is set very soft with no sway bars on sport tires, so There we go. Just a tap I'm okay with that a little bit of a tap Oh right on that wall and I honestly think that probably was my best Long beach run I've had since I've tried it that was sick This viper. Yep 10 out 10 definitely love this car So big thank you to alpaca the boss for challenging me to try running one of these cars because uh, I think I may have found my new Fun drift car here, so we're gonna run this one more time, and then we'll probably switch up cars try that other ACR Here at Long Beach as well This thing just sounds nasty and flicking my wing up against the wall So it wasn't a perfectly clean run with a tap on the entry, but Definitely was a lot better than some of the other runs I've ever made here at Long Beach Without Long Beach only a few weeks away Definitely the hype of FD with everybody posting their new liveries and everything on Instagram is definitely awesome There we go So a better of an entry which I could have got further out to the wall, but oh I keep wanting to get so close to these walls and I keep up Screwed myself on that All right, so we're gonna switch it up to the other ACR this car is definitely a lot of fun to drive We're gonna be having a lot of fun with this throwing this car online Gonna be trying some online sessions with this car in the future for sure So we're gonna switch to the other ACR that I have built this car is 1109 horsepower pretty much just a tad more powerful than the other one So we're gonna switch this one. This one is set tuned style pretty similar to the other one It just has a different supercharger on it still v10 though Sit with a really big nasty wing on the back I'm gonna flip this car around This is well is on sports tires And it is set soft as well, but I don't think it's as soft as the Other one I was running Don't lose my wing already. I thought I was gonna break my wing off already So definitely getting a lot better here on the Long Beach circuit Definitely want to get more practice with this with the car that I am probably gonna be running any SDA To be getting some of my friends online gonna be getting some tandem practices and such As well as probably tandeming with some of the other people that I know will be competing in ESDA To you know get some more practice in a tandem, of course, so ACR 2016 let's do it Roasting the tires There's gonna be a third gear as well and are in Just a tap. I always go too far in there, but And I'm gonna go too far there So this one obviously is It's just as close to the other one, but I Think before we end this episode off. We'll have to take this car to Maple Valley and get a good run on it. See how many points we can get with this ACR car at Maple Valley Because these vipers definitely are monsters thousand-some horsepower Definitely an insane car, but a lot of fun to drive with short entry Once again, oh I want to get a good run with this car and give it one more shot Have to get a good run We broke our tail light on that wall. I think I just need to initiate sooner But then I feel like I'm gonna cut that turn too short so we're gonna try initiating a little bit sooner One last try here. We go initiate a little bit sooner. There we go. Okay, that's better Out to the touch-and-go out to that wall Should have gotten a lot deeper to that wall, but we're gonna finish this run off I didn't cut into the wall like I always do a Pretty decent run probably not a very good qualifying run here at Long Beach But definitely a lot of fun so I think we're gonna switch this over to Maple Valley real quick and try and get some uh pretty solid drift runs at Maple Valley We'll do a five-minute drift session at Maple Valley full and See how this goes So if you guys want to see more drift builds like this or challenges like this Just make sure you guys you know comment down below tap the like button subscribe if you have not already done So I do appreciate all the support Definitely appreciate the support going on here soon into eSDA looking forward to hopefully competing in a full eSDA season depending on time So hopefully we'll be able to get that and do it so we're gonna take this ACR 2016 viper here at Maple Valley. We're gonna send it here and See what type of drift totals we can get see how we can get this thing to handle Not messing with the tune, but like I said, I will throw this to the tune for the other one up before the end of this episode and are in late, but car has the power to hold itself and The angle this one not as stable. I don't think is the other one I built but Definitely gets the points For sure, I mean we're gonna clack, you know 18 large on that first section I mean probably other people are doing a lot better, but Not a bad points total Go No, don't lose it. Don't lose that points now I'm gonna stay in fourth. I was gonna shift to third, but then I realized this thing has the power To just blast the tires off and forth Over a thousand horsepower supercharged V10 under the hood of this thing But hold 19 large there And on the grass Gonna hold this Little clutch kick. No, oh that change of oh that change of the You know a little Unsettling over that bump kind of scooted me, but we're good. We'll keep it going We'll finish this off There we go So much power Just threw it way too much So I think that's gonna do it here for this episode here on fours and doors board seven We're gonna finish off this last three minutes But like I said guys you guys know you can follow me on Facebook Twitter and Instagram all over You found in the description box below If you guys want to have other cars that you want to challenge me to drift or maybe a tune that you want me to try Let me know down in the comment section down below if you are doing a tune You want me to try to make sure you comment your gamer tag as well as the car and the tune so that I know Where to find it? Now I'm just getting all kinds of screwed up throw this in there a faint initiation Too much angle, but they said I think the other one handles a little bit better than this one So I will be throwing that tune up before the end of this episode There we go We'll be trying some new games here on the channel very shortly We'll be doing a live stream tonight on the channel So you guys want to come and you know chill and hang out in the live stream tonight on the channel I will be on I'm not sure if I'll be playing for the seven or if I will be playing horizon three but definitely Looking to get sideways with some subscribers here to the channel So if you guys want to be part of that live stream make sure you guys come back to the channel tonight We'll be doing live stream and 1080p as well with the new Elgato system and everything that I got going So let's go put that tune up for you guys before I Forget for the other car and we will end the episode off here So guys, hope you enjoyed this episode here on Forza Motorsports 7 doing a little subscriber challenge drift here in the v10 powered acr vipers Definitely was fun. I mean not gonna lie the cars are pretty powerful and A bit difficult to drive, but you know, I got a handle of I hate how it doesn't show my livery All the time so we're gonna go in the tunings go to tune then we're gonna go to setup manager save and share Thousand horsepower acr and we're gonna just name it evl drifts and uh We're gonna save that here and we're gonna share it as well with that So if you guys want to give this tune a try definitely give it a shot See what you guys think about the tune. Let me know If you guys like it or you don't like it Let me know down in the comments section down below description evl drift as well So that's definitely gonna do it here for this episode here on Forza Motorsports 7 Once again, thank you guys for watching. I'm evl rabbit and i'm out


The National Broadcasting Company and its affiliated stations present the Pacific story. In the mounting fury of world conflict, events in the Pacific are taking on ever greater importance. Here is the story of the Pacific and the millions of people who live around this greatest sea. The drama of the people's whose destiny is at stake in the Pacific war. Here, as another public service, is the tale of the war in the Pacific and its meaning to us and to the generations to come. The Kandung Army. The army and not the navy is the eldest son of New Japan. Kowiso said that. Kuniaki Kowiso, the premier of Japan, and he knows where of his speaks. But is in its run forces, not its sea forces. What Kuniaki Kowiso means by this is that Japan's army, particularly the Kandung Army, not only guides the basic policies of the Japanese navy, but also guides and controls the destinies of Japan itself. The Kandung Army is the elite Japanese army. It is an army 700,000 strong. It is the army responsible for the invasion and seizure of Manchuria. The attacks on Russia over the Manchurian-Siberian border. The starting of the present war with China at the Marco Polo Bridge. The thinking of the American gunboat for Nye and the promotion of the present war against the United States. Through these deeds, its leaders have become world-known. Itigaki, the crafty policymaker. Nishio, the mysterious strongman. Doihara, the law in sub-Asia. Hashimoto, the fire-eating zealot. Tojo, the bogeyman and the razor. Kowiso, disciple of Japanese world dominion. These arch-militarists along with Araki, Minami, Sugiyama, Umizo and others have brow-beaten and bent Japanese big business to their will. Have taken charge of executing Japan's plan for world dominion. And to assume such power that to question them is almost the same as to question the Emperor. Japanese civilians, one September morning in 1931, woke up and learned that Japan was at war with China. We did not even know that war was imminent. There have been riots in Manchuria since July. But it was said these were only incidents. Last month, Captain Nakamura was killed in Manchuria. You called that an incident? They said he was a spy. And yesterday, the Chinese blew up a section of truck on the south Manchurian railway. It is time that we put a stop to these incidents. The Manchurian incidents were cooked up by Colonel Kenji Doihara, long recognized as a master of intrigue, a smoothmaker of incidents. China forced war upon Japan. Because of the incident, it was necessary for Japan to intervene. That was Doihara's story. At the time, he was secret service agent of the Kandung Army, which for years had been garrisoned on the Kandung Peninsula on the mainland. Since the defeat of the Russians in the Russo-Japanese War of 1904 and 1905, the Japanese had had troops in Manchuria. And after the Kandung Army had put down the incident by taking all of Manchuria, Doihara went about establishing a puppet government. He will be served in a moment, Mr. Ying. Thank you. Cigarette? Not just now, please. Mr. Ying, is it possible that you are not satisfied with the present policy of the Chinese national government with respect to Manchuria? There are, of course, shall I say, certain changes which some of us believe would be helpful. I understand. It is such progressive men as you who should have a voice in the destiny of Manchuria. What do you mean, Colonel Doihara? We feel that we can work together for our mutual good. A man of your caliber is needed in Tongchiao. In North China, yes. Tongchiao needs an administrator. We would, of course, establish you comfortably. We feel that a man of your intelligence and background would see the advantages of such an arrangement. Perhaps we shall have an opportunity to consider this at another time. Do not hurry away, Mr. Ying. Sit down. It is now 10.35 o'clock, Mr. Ying. You may have until 11 o'clock, so accept. Behind the scenes, using cunning and bribery and threats, Doihara pulled the string so well that it became known as the Prince of Puppetry. He established Henry Puyi, last emperor of the Manchu dynasty, as Emperor Kangte of Manchuria, renamed Manchukuo. And while he was doing this work, other leaders of the Gandung army were busy with other tasks. What we must have now in Manchukuo is a regimentation of economy.  We shed our blood to conquer Manchukuo.  We shall not permit them to do that. We of the Gandung army must develop Manchukuo as a base of operations against China, and as a base of operations against Russia. But how can we control big business once we permit it to enter before we permit it to enter? We shall determine the basis on which it shall operate. It must operate for the Gandung army, or it shall not operate at all. But these were the conditions. The Gandung army had taken Manchuria and held in its hand the development of the country. Before long, the effects of this control became apparent. Excellent highway you have here. It is our purpose to make Manchukuo as modern as your America. Yes. I've seen highways like this all the way from the Lao Deng financial after the Russian border. Roads are arteries of commerce. Or there's another company of your troops along the road. They are bandits in Manchukuo. Enough so that you need that many troops to guard the road? We never know where they will attack. We must keep the roads open at all times. You could move a good deal of equipment over a road like this? Yes, like your American roads. I noticed that highways branch off from your railways. The railways as well as highways must be protected from sudden attack. Well, who runs this great integrated system? Business interests or the military? We have worked out a very happy plan of cooperation between both. I see. Under the control of the Guangdong Army, Manchuria became not only a base of future operations against China and Russia, not only an arsenal. It likewise became the training ground for the military firebrands. And here the blueprints of conquest were worked out. Officers of the Guangdong Army bent over maps of East Asia. We cannot move from here in Manchukuo down into another China. We cannot move against China until we know what Russia will do. If you conceive of Russia as a possible ally of China, let us then first determine how far Russia will go. We must know Russia's position. It will be no great task to determine that. We shall simply create an incident on the Soviet border by sending... Yes, Sergeant? Two Japanese gunboats are trespassing in the Soviet channel of the river. Japanese gunboats? Yes, sir. Here, take my field glasses. Yes, they are Japanese gunboats and they are trespassing. Go back to your post at once. Fighting has broken out on the Amor River between Japanese and Soviet troops. After Japanese gunboats trespassed in Soviet channels of the river, Russians landed troops on two small islands in mid-stream. Japanese forces of the Guangdong Army today attacked the Russians, sank one Russian gunboat and damaged two others. Ascendant expeditionary force against Russia! Down with Russia! Well, looks like they're beating the war drums for action. Yeah, that's a Japanese weapon. What do you mean? Yes, I know. Both the war minister and the chief of staff have reported to Hirohito. The cabinet has been in conference all night. Well, they're just going through the motions of preparing for war. Do you think all of this is just double talk? Well, I've been over here in Japan a long time. I've seen this sort of thing before. And what do you think is the purpose? Well, that's pretty hard to say right now, but chances are we'll know pretty soon. Demands were made of Moscow by Tokyo. And those who understood the situation looked to Moscow for the next break. Japan had forced the hand of Russia. Now it was Russia's play. Moscow today took a conciliatory position in the Armour River flare-up. When it advised Tokyo that the Japanese demands would be met... In Tokyo, the high command had learned what it wished to know. You'll see, General Asugi, Russia will not take sides with China against Japan. Then we are ready to move. Five days later, through the manipulations of the Kandung Army leaders, the Japanese attacked the Chinese at the Makopolo Bridge outside Beiping. And the war against China was started. Meantime, another leader of the Kandung Army, the stormy petrol king Goro Hashimoto, had been training firebrands in Manchuria, the Kandung Laboratory of War. Our sublime mission is to dominate the world. This was Hashimoto, and these were his exact words.  Goodbye! Goodbye! I swear to behead any individual who seeks to atroat our mission. I swear to have no contact with foreigners or their thought. I swear to devote my life to the Japanese domination of the world. Under Hashimoto, murder became a method. The young officers he trained suspected not only foreigners and public officials and private citizens. They suspected even their own senior officers. Hashimoto burned his stamp into the souls of the young Japanese under his command. And with ruthless cruelty, he demonstrated his attitude toward foreigners. In December 1937, during the Japanese drive on Nang King, Hashimoto was in command of shore batteries along the Yangtze. There are still some foreign ships in the river, Colonel Hashimoto. Hashimoto scanned the river with field glasses. Yes, that is the American gunboat Panai down there, Major. Oh, that is the Panai, yes. And another gunboat, the Ladybird, is evacuating foreigners from the city. They are so in getting out of the way. Well, the Ladybird has already gone. But the Panai is still down there. And there are American and British cargo ships still on the river. Colonel Hashimoto, sir. Yes, Colonel, this communique has just been received from headquarters at Shanghai. Yes. This is in order to clear the river of shipping. Does that mean enemy shipping or oil shipping? The order says clear the river of shipping. Take the necessary action, Major. Use both aircraft and shore batteries. On the bridge of the United States gunboat Panai, the Americans were busy with their routine duties. Look out to bridge. Look out to bridge. Yes, look out. The Japanese planes overhead, sir. It looks like they're maneuvering directly over us. Yes, I see them. It looks as though they're diving on us, sir. Yes, they are. They missed us. It's fast and safe. Aircraft guns, machine guns, concentrate, fire. Look out to bridge. Look out to bridge. Go ahead, look out. Shore batteries firing on us, sir. Shore batteries. Heavy guns, reply to the shore batteries. Reply to the shore batteries. Abandon ship. Abandon ship. As the Panai shattered with bombs and shells settled, and the waters of the Yanksy washed over her decks, a crew that could still move fled in their small boats to the shore. They tried to conceal themselves in the marshes. Get down. Stay under the marshes. They're coming back. They're coming back to stay for, sir. Colonel Hashimoto had done what many a Japanese army man had wished to do, but had never dared to do. As a final gesture of discipline, he was transferred. But he was to be heard from again. Meanwhile, another young Colonel, Colonel Teishiro Itagaki, was rising out of the strong man of the Gandung army, General Poshizo Nishio. And he it was who saw the value of the intelligence of Itagaki to the Gandung army. It is a matter, Colonel Itagaki, of controlling the key positions in the government. Without controlling the key positions, we can never have control of national policy. That is right, Colonel. We must have the same complete control in other departments as we have through the Minister of War. The Minister of War has direct access to the Emperor. The only member of the cabinet with this privilege were the exception of the Minister of the Navy. That is invaluable. We must have more of these key positions. We must be in a position to control the cabinet or to force it to collapse. This Gandung army can do. But, General, I am no soldier. You have a command, Colonel. Use it. Because of his brilliance, the Gandung army looked more and more to Itagaki. They saw him as, potentially, one of their most valued leaders. In 1938, he was in command of a fighting unit in China. Finally, Itagaki, sir. We are caught in a trap. A trap? Yes, sir. The enemy is bringing up strong reinforcements. It was my understanding that we were on the enemy's flank and that he had no reserves in this sector. Our losses are heavy, sir. We are completely trapped. Twenty-five thousand Japanese fell in that battle and Itagaki suffered complete humiliation. He prepared to join his ancestors through Harikari. I told you I was no soldier, General Nishio. You are much to not think of. No, no, you need not try to convince me. My spirit shall be of greater value to Japan than my body. The Gandung army needs you. Arrive. Japan needs you. Twenty-five thousand Japanese soldiers entrusted to me. Dead. I can never accept a command to... Each of us serves in his own way, Colonel. We are not thinking of you as a commander of troops. But I have given proof that I am of no value. You are of great value in your field. We have work for you to do. Rave the fighting to us. Well, Nishio went back to Tokyo and Itagaki succeeded him as chief of staff of the Gandung army. With his staff, Itagaki set up the government of Manchuria, set up its economy. Others carried out his plans. Such leaders as Doihara and Tojo. Tojo commanded the Gandung army's military police, including its espionage. Yes, General Itagaki. I have agents in every part of Manjoko. Dependable agents? The best. They are stationed everywhere, from the hotel rooms on day one to the Soviet frontiers. And what is the attitude of our officers these days, Colonel Tojo? No, this content has a chance to get started. And the foreigners? Have you found suspects among them? Only one. A Britisher. They care of him. Good day, Colonel. In Manchuria, Itagaki's work was outstanding. And he also was called back to Tokyo for a promotion to minister of war. For the Gandung leaders were rising to power in the Japanese government. Congratulations, General Itagaki. So spoke the Gandung leaders. But the liberal leaders regarded Itagaki's promotion with misgivings. It is a step backward. General Nishio put him in there. There are many others who should have been considered first. Yes, officers with a seniority of service and age. There are other officers who do not permit their armies to be trapped and suffer the loss of 25,000 kills. We can look for increasing the pressure from the Gandung army and the government from now on. They were right. Itagaki sent to Manchuria for Tojo. Named him Vice Minister of War. Requested him to carry on in Japan the same sort of policing and espionage that he had directed so well in Manchuria. Today, Tojo became the watchdog at home while Itagaki and Nishio proceeded with plans for their Holy War on Russia. Our first objective, Nishio, must be to end the China incident. Itagaki saw the wisdom of ending the war in China before taking any definite steps toward Russia. Meantime, we must move for a better understanding with Rome and Bahrain. Russia's strength and interest must be divided. Yes. And that will also have the effect of forcing the democracies to stop helping China. Rome and Bahrain have signed the anti-comintern pact. This could be the instrument to use against Russia? Yes, it could, Itagaki. Itagaki's statesmanship was beginning to unfold. One day, the world learned that Japan had signed the anti-comintern pact against Russia. This, in effect, made Japan a member of the Rome-Berlin Axis. Japan rejoiced, that is, those who saw eye to eye with the Gandung leaders. Russia was now hemmed in on both east and west. In effect, Itagaki, we have now cleared the way for a decisive blow against China. Then we shall move against Russia. But other things were in the wind. Hitler was getting ready to attack Poland. He needed to be sure that Russia would not go in on Poland's side. He sent Joachim von Ribbentrop to the Kremlin at Moscow. Hello. Hello, give me the desk. Yeah. Hello? Yeah, hello, this is Manley. Here's a bulletin for you. File it to New York right away. Russia's just signed a non-aggression pact with Germany. What? Soviet, Russian, Nazi, Germany? Well, it makes Japan look like a sucker. Especially a guy named Itagaki. The news fell like a sledgehammer blow on Itagaki, but with him still was Nishio. The fort is not yours, Itagaki. The blame rests on Premier Hiranuma. Hiranuma was to be the scapegoat. He was the premier. Recently, the emperor announced the resignation of Hiranuma. And presently, there was other news. Nobayuki Abe has been appointed the new Premier of Japan. Nobayuki Abe? Who's he? He is a figurehead of the Kandung Army. How do you liberal Japanese feel about that? Oh, that is only part of it. The Kandung Army has put its men in all key posts. Not only in the government, but also in the responsible positions on the mainland of Asia. Well, could I be permitted to assume that the Kandung Army plans to control the entire government and its policy? It is nearly an accomplished fact. The control of the army is nearly completely in the hands of one man. Nishio. The Kandung Army was moving toward control of the entire Japanese army. Control of the navy, control of the government. While Nishio and Itagaki pulled the strings of government and army politics, Tojo kept a weather eye out for intrigue.  They wanted to murder Admiral Yonai. Admiral Yonai, the premier. They were ready to move when we took them. They are now in jail. All of them? All except Arira. Who is he? Hashimoto. Hashimoto? Word of the conspiracy buzzed through the inner circles in Tokyo. Yonai, the premier, learned about it. Learned that Hashimoto, whom he knew well, was the arch conspirator. Yonai rested on easily for days. Hashimoto walked about scot-free. Nine days later, the resignation of Yonai was announced. Hashimoto's position became stronger, more secure than ever before. Prince Kanoya was named as premier. The world capitals watched closely to see what would be done about Hashimoto. Therefore, by direction, Gengoro Hashimoto is named head of the committee to draft the new political and economic structure of Greater Japan. Gengoro Hashimoto will direct the planning of this committee. That was Prince Kanoya. Hashimoto had shown that it's not always necessary to murder. The fear of murder is sometimes a stronger weapon as assassination itself. Through the structure which Hashimoto and his committee set up to be known as the Imperial Rule Assistance Association, Japan moved down the road toward totalitarianism. You see, it has replaced all political parties. Well, that's practically what happened in Germany and Italy. Almost the same. Then what of representative government? The government is in the hands of the militaries and we liberals must go underground. Nishio and Itagaki worked hand in glove. They controlled the army. They controlled the government. The pace of events was accelerated and in 1941 Kanoya's cabinet fell. We must see that a premier is appointed whom we can't trust without the question of doubt. So spoke Nishio and Itagaki knew whom he meant. It must be a man strong enough to control the cabinet for us. That can only be Tojo. The Emperor went through the motions of selecting a premier. All the living former premiers and many of the eldest statesmen were called for a conference at the palace. Behind all this was the smooth strategy of Nishio and Itagaki. In less than four hours, newspaper men and observers were summoned for an important announcement. War Minister, Lieutenant-General Adette Tojo has been appointed the new premier of the Imperial Japanese government. Congratulations, General Dojo. Do you have any statements you'd like to make to the American public? I dislike talking. I will make my policies clear by enforcing them. Dojo crapped the whip over the cabinet for his bosses. Nishio and Itagaki. Behind them was the Gontung Army. The army that had been spawned in Manchuria. That had risen to control the destinies of the nation. Within a matter of months, the names of these men were to be known around the world. For during these fateful months, the events leading to and following Pearl Harbor were being perfected. Dojo and Nishio and Itagaki wrote their names into American history on December 7, 1941. As premier and chief of staff, Dojo directed the policies of aggression of the Gontung Army. Like a poisonous fluid, the Japanese aggressors spread out over the map of East Asia and the Pacific. Wow, the Wake Islands, the Philippines, Hong Kong, Burma, Malaya, Singapore, the Andaman Islands. Sumatra, Java, Borneo, the islands of Micronesia and Melanesia. When the aggression was stopped and the Japanese suffered defeats at Guadalcanal, the Marshals, the Guilders, the Carolans, the Marianas, the shadow of defeat fell across Dojo. General Tojo has been relieved of his position as chief of staff. The announcement came like a thunderbolt. However, this change will in no way affect General Tojo's post as premier. Being relieved of the responsibility of being chief of staff, General Tojo will have more time to devote to his duties as premier in order to guide Japan to glorious victory. Two days after Tojo was relieved as chief of staff, American listening posts heard a Tokyo radio announcement. General Hadiki Tojo has resigned as premier. The Emperor has asked General Kuniaki Koiso to form a new cabinet. And General Koiso is now in the process of selecting his ministers. General Koiso is a man of poor experience. The details of Koiso's experience were well known to men familiar with the Japanese scene. Koiso? Yeah, he's been the governor of Korea for some time. Koiso, he's got an academic military background. He was once chief secretary of the Supreme War Council and he was once vice minister of war. Koiso? I knew him well. He was a member of the staff of the Kandong Army and Manchuria in 1932. Something of what might be expected of Koiso was revealed in his first public statement after becoming premier. Japan will further strengthen her ties with Germany. And Japan will befriend neutral countries in order that they may offer positive cooperation to the Japanese people. Japan offers sincere friendship to Russia. It will be our privilege to... Koiso made a bid for better relations for the countries that would have most to do with the successful prosecution of her war. This was the analysis of Koiso's position. But for those who saw in the removal of Tojo, a move taught a more liberal Japanese policy, there was the realistic view of the men still around and back of Koiso. Koiso's cabinet is as much under the control of the Kandong Army clique as Tojo's cabinet. The key positions are still held by Kandong Army men. Three of Tojo's ministers are still in Koiso's cabinet. And in addition, there's the gray fox of the Kandong Army. The militarist has been identified with every important step and they rise to power of the Kandong Army. General Jen Sugiyama. These are the men who control Japan. You have been listening to the Pacific story presented by the National Broadcasting Company and its affiliated independent stations as a public service to clarify events in the Pacific and to make understandable the crosscurrents of life in the Pacific Basin. For a reprint of this Pacific story program, send 10 cents in stamps or corn to the University of California Press, Berkeley, California. The story is written and directed by Arnold Marquess. The original musical score was composed and conducted by Thomas Paluso. Your narrator, Gain Whitman. This program came to you from Hollywood. This is the National Broadcasting Company.


How could people have these wonderful visions, have these experiences of floating out of the scanner going to another dimension going to God? How could that happen without the brain being turned on? In fact, we were so bemused by that first result that we repeated the whole thing. Got exactly the same results and then realized we'd actually discovered something really important that these drugs don't turn on the brain. They actually turn off the brain, but they turn off the parts of the brain which keep the brain doing what it's always done. When you turn those bits of the brain off, the brain can run free, it can do its own thing. It's like taking the conductor away from an orchestra or taking a school teacher away from a class of kids.


Hi everyone, sorry about that. We had some technical difficulties. Classic Mac. But welcome to this talk. Thanks for coming to Security Talk. I know that can be depressing. I'll try my best to keep it light-hearted. But today I have the light and fluffy topic of why I think the internet is broken. And basically how the modern supply chain has essentially created some of these problems. So just to start with, a little bit about me. I'm from New Zealand. If you can't pick where my accent's from, I live now in the Netherlands. I work in DevRel for a company called GitGuardian, which is based out of Paris. You can find me anywhere under the handle's Advocate Mac. I'm also the host of a security podcast. My mom says it's her favorite podcast, and everyone here should subscribe. It's called a security repo. OK, so I want to start at an obvious place, which is 1960s cigarette commercial. But this is here from a company called Lucky Strikes. And basically what happened is research came out that undisputedly proved what everyone already knew. And that was that cigarettes were bad for you. So what did the cigarette companies do? Well, instead of trying to maybe make a better product, instead of trying to improve it, make it more healthy, they came up with clever marketing slogans. One of it was it's toasted. And basically what this implied was that Lucky Strikes cigarettes were toasted. Therefore, they were healthier for you. And you have all these kind of things that they protect you against irritation. And doctors recommend this because it's toasted. But has anyone here ever tried an untoasted cigarette? Anyone had wet tobacco before? They don't exist, a brave hand. So the point is, is that saying it's toasted was purely just a distraction away from what it was. And this was repeated in a lot of their campaigns. So what does this have to do with security and the internet? Is, well, basically, we've gotten to a point now where the internet is toasted. We create a whole bunch of marketing to distract us from the fact that we're really building everything on something that is quite insecure. And I want to run through really the software supply chain, how that's moved on to the internet, and what this has done to affect security and make everything really quite vulnerable. So the first question is exactly how is what is an example, a concrete example of how we've created this toasted environment for the internet? And we call it the cloud. Like what is the cloud? The cloud is essentially a server room, a data. It's exactly how we were doing it before we invented the term the cloud. But it makes it seem more secure. It makes it seem less physical. Doesn't mean, it makes it seem like it's not a server room that people have access to, that cleaners need to come into, that people maintain, that has all your data on it. No, it's the cloud. It's a way of making the internet toasted and really kind of moving away along some of the security concerns that we have and really how we build everything. So what exactly is this cloud? And it's exactly what it was before we invented it. These are server rooms. These are computers. These are managed by other people. So if we take statements that we often see on security data sheets or on FAQs, they'll say stuff like, we securely store our data in the cloud. But what does this actually mean? It basically means we outsource security to someone else's computer. That's essentially what this is saying. There's some formatting issues, but hopefully that won't be too bad. But that's how it, this is how we've become toasted, right? This is really what we're doing. But now we're moving everything into the cloud. So yes, for a long time, we've been doing web applications. But now we're moving our development environments to the cloud. We're moving our testing environments to the cloud. And maybe you could say that you have some of this as being self-hosted, but it's still remotely accessible. It's still in the cloud. And we're all okay with just kind of pretending that this is actually physical data that we don't even know where it is most of the time. But someone else is managing it for us. So a little bit of a brief introduction to Hone and my point, and then I want to get into some more concrete examples and stop talking about cigarettes. But if we look at like the history of the internet, 1965 was when it was first conceived. 1990 was when it started to become mainstream. Most of the security protocols that we build everything on today were invented in this period. So asymmetric encryption, basically the fundamentals of how we secure everything was built in this period. There is no way that they would have been able to imagine in 1990 how we would use the internet today. Well, perhaps some people did, some visionaries, but I think generally it has exploded to a point much bigger than what we anticipated. And it was in 2008 where this started to become a problem. And this was the first time cloud started to be using mainstream. Dell tried to clay a trade market. Now they actually failed in that, so they couldn't. But this is kind of really, you could say 2008 was the point where we all started talking about the mystical cloud that we have today. All right, so why does all this matter? Why does it matter that we don't really understand what the cloud is? What is the big deal? And for me, the big deal is the software supply chain. How we build, deliver, ship, and manage our software. So we're probably familiar with the supply chain in cars, and if you're not familiar with the software supply chain, it's quite relatable in a lot of areas. You have your raw components, so these may be your dependencies, your open source packages, your frameworks, what you build everything on. You have your assembly lines, and now we have our IDEs, our source controlled, we have our testing lines, maybe we're using Jenkins, CircleCI, other pipelines to test it, and then we're doing our shipping and packaging. The reality today is that all of this is gone onto the cloud, it's all remote, it's all interconnected, and it's really quite confusing. So it's not just the fact that we're storing our applications in this cloud, we're actually putting the whole software supply chain in there, and that has been the biggest gift that we could have given malicious actors and adversaries, because this has completely changed the economic game that they're playing in terms of how to try and attack you. So if we look at Hackonomics one-on-one, so how do the bad guys operate? So we think of them as hackers in basement, still hoodies on, maybe few people here, but they're more likely today, like organizations, like malicious organizations. They have overheads, they have employees, these employees have sick days and vacation days, they really operate like businesses now. And like all businesses, they have to operate within constraints of risk reward equations in economics. So we have a victim here, it's going to cost money to try and target that victim, to do reconnaissance on them, to try and fish their employees, to try and do physical security. That's going to cost money. At some point, if their security is good enough, then that might not be worth it, so they will abandon that. And that protected a lot of, especially smaller businesses from these malicious actors, that the risk reward wasn't quite there. But now with the supply chain all moving into the cloud, with everything based on the internet, we can actually target components in that supply chain. And that means that we can end up with hundreds, potentially thousands of victims by targeting one area, which of course means that we can invest much more resources into that. And this is why security and attacks and with how we operate in the internet, with the cloud, it's getting much more sophisticated, much more advanced and much harder to defend against. So if we look at a simplified version of the software supply chain, this is from Salsa, which is a project run by Google. And I think for developers, this is pretty understandable. We have a developer here, they write some stuff, we build it, we bring in some dependencies, they get shipped out and then someone uses it. That all makes sense and we can extrapolate this to a large company. All parts of this supply chain, because they're all interconnected, because they're available in the cloud, are attackable to this. So what I wanna do is I wanna run through, I don't have time to explain how everything is attackable, but I wanna focus on a couple of points and give real world concrete examples of how these have been attacked and why. So I'm gonna focus on the source, the build and dependencies. And we'll start here with our dependencies. So we have our application. The modern application, we use a lot of dependencies. Most of our application is written by other people in the open source community. This is really powerful and has enabled us to do things beyond what we could have imagined. So we have our application and then we have our open source dependencies. That makes sense. Then those dependencies also have dependencies and those dependencies have dependencies and I'll stop there because it will get too small, but you get the idea. We could go on for a long time here. In fact, sometimes we can go back to about 30 layers of dependencies that happen. There's another type of dependencies that's really predominant now that we often neglect and that's our third party services. So these are also part of our application's dependencies. We're using Stripe for credit card processing, Algolia for search, Okta to manage our authentication. All of these are part of our application and all of these ones in particular are interconnected. They connect to each other using secrets and they really give, that the attack is lots of opportunities to target our organization. Now this looks quite clear because I can see these are dependent to this and these are dependent to that. I can manage with that but the reality looks much more like this because we have dependencies that are dependent on each other. We have our third party services that are also dependent on our open source dependencies and it's impossible to try and figure out this web of what we call dependency hell.  Let's just call this log4j or log4shell. And then you get downstream effects and effects in some of your dependencies over here and then your application has this massive vulnerability that you didn't even know you had. You never picked to use that. You never added that into your list. That kind of just appeared there through your dependencies and that's the reality with dependencies. So this is a statistic. I see, I don't actually know what the actual number is. I see some or 85, 90, 95. I just picked the biggest number to be honest. You know, 95% of our code isn't our own. It's written by these dependencies that we have these open source. But we have this thing called dependency bias where we trust it because we know that as developers we have some crappy coding practices. I may skip. I have secrets.txt on my desktop but surely the guys maintaining the open source dependencies, they don't do that. They do. They do. They're human, right? It's not that they're bad. They're just human and we all make mistakes. So, and this creates a problem because attackers now understand our software more than we do because they invest their time into understanding where these vulnerabilities are. So you've probably seen this before.  So this is here, like the modern infrastructure. You have all this stuff and then you have down the bottom here a project some random person in Nebraska has been stanklessly maintaining since 2003. This is so accurate. In fact, that person in Nebraska actually has a name. There's under a hundred of them but one of them is this guy called Fischal Solman. We like Fischal. He represents a really important part of the open source community that we have and he has been thanklessly maintaining a really popular open source package for a long time. That package, what's called UA PASA. So it's on nodes. It does something really simple. It just lets you know what devices your users are interacting with your application with, right? So basically is it mobile or what operating system? So you can see this is perfect candidate for a dependent, an open source tool because I don't wanna have to write that myself. Fischal's done a great job. Now if we're looking, we're not silly. We're gonna make sure that we have good dependencies in our application. So what do we have? We've got 10 million weekly downloads. That's pretty good. That's a lot. 56 versions, good version history and lots of other things are dependent on it. So here we have an example of, there's no way this wouldn't pass a smell test. I would use this in the heartbeat. But that doesn't mean that it's completely secure because we trust these dependencies more than our own. This is essentially kind of a toasted situation. So then what ended up happening? So this got posted on a Russian hacker forum. It's basically, hey, I have an account. It's got seven million installations per week. It's on NPN. There's no 2FA on the account. We can change the password if we want and this is what it's kind of good for. And this is how much he wants bidding in 1K increments. So you probably figured out who's account this is referring to. And this was the account for that UA passer and this is what they added in. They added in some malicious lines. Someone bought access to this account and they turned this package malicious. What was it doing? Nothing terribly crazy. It was doing some crypto mining and then they was trying to steal some credentials as well on certain types of users. So this is just one example of how these dependencies can get made malicious. So how did this actually happen? Well, Fischal was phished. Didn't have 2FA. He was able to get back the account and is maintaining it again. And I want to stress this is absolutely nothing against Fischal because without people like him, this whole thing would fall apart. But it just goes to show how vulnerable we can be to something that really is completely out of our control because this is all interconnected because it so quickly happens. And people are still using the malicious versions of this package even today. There's another one. I won't go into too much. EventStream. This one was a little bit interesting because EventStream, again, like popular, had lots of dependencies, passes a smell check. What ended up happening is what often happens is that people create these dependencies, these open source projects because it's functioning as something for them in their work. And then their work may change and it's not. So then they stop maintaining it. So then what often happens is people of the community come in to take over that, which is great. But those members of the community aren't always best intentioned. So in this case, someone came along and said, I'll take over EventStream. It was a long-term maintainer of this project. But little did we all know that that was malicious from the start. He wasn't silly though. He or she wasn't silly because they knew that if they did something to EventStream, people would find out. People would say that this looks suspicious. So what he did, he or she did, added another dependency called FlatMapStream. And this is what they turned malicious in the end. So that it was obscured by another layer. So another area here of how our dependencies can really kind of cause trouble. So I want to move on now from away from dependencies to another fun topic. I want to talk about our source code. Because it used to be that we would write our source code on our laptops, would test it in our local production, but now our IDEs are increasingly going into the cloud as well. And we've shifted this whole process, or at least we're in the process of doing cloud IDEs and doing our coding with various online AI tools that are terrifying and that's a different talk. So source code is actually everywhere. A lot of people will think that I have private source code. It's behind authentication. So I don't need to worry about if my source code has credentials or other stuff in it. Source code is extremely leaky. It has a terrible habit of becoming out in public in lots of wonderful and weird ways. Tomorrow I'm giving a talk that's gonna focus more on source code specifically and all the wacky things that it can do. But if we just talk about one element of this for the sake of this talk, I want to talk about GitHub. Because GitHub is something that you could even say to me, GitHub's not part of my software supply chain. My company uses GitLab. We do not use GitHub at all. But your developers do. So even it's part of your supply chain kind of by default, which kind of can create quite a bit of a problem because it is a blind spot in your supply chain. So some stats on GitHub. Over a billion commits were made last year. 94 million active developers last year according to GitHub and 85 million new public repositories. This is just public information. So not looking at private stuff. So huge amounts of information are out there. And with huge amounts of information comes huge amounts of opportunities for adversaries. So the company that I work for at Git Guardian, we specialize in detecting secrets in source code, amongst other things. But we decided to do a project and scan all of these billion commits. Anything that was made public last year on GitHub, we scanned it for credentials. And we'll do a quick quiz to see how many trends. But this is, how we did that is the same way attackers do it. And it's not really a supply chain attack. It's more of an abuse because we're not, when we're attacking something, we're using it in ways that are unintended. But we can use GitHub in ways that are intended but still do it for malicious purposes. So this is how many credentials we found on GitHub last year. 10 million secrets, just in one year. And these are all public. And most of these we can validate. So if you leak an AWS key, we'll check with AWS to see if it's a valid key. So these aren't just random high-entry strings. So this is a huge amount of information that is just sitting out there in the cloud that is publicly available. Here's some of the credentials that we found. So data storage, so access to databases, cloud providers. This is about two million cloud provider keys that were active that we found last year in public spaces on GitHub. So this is really quite scary. So how do adversaries, how do we actually find this? Well, we're just using GitHub in an intended way. GitHub has an API, like lots of things have APIs and anything that has an API, you can potentially abuse it. Maybe not completely misuse it, but change it away. So if you go to this address, anyone can go to this address. It will give you a public ledger of everything that's happening in GitHub right now. And I'm talking about GitHub, but this is for lots and lots of different things when we've moved our supply chain onto the internet. And what we can do is we can monitor this in real time. So here's all the events that happen on this API and we can just filter out to come at them. So the public event, this is when a private repository goes public, bringing with it all of its history. So you did something a year ago and you've committed over it. It's out there in public now. And also the push events. So as an adversary, even if GitHub's not being used by your organization, I can monitor your employees. I can try and find if some of them is actually pushed out a secret. And I can use that then against you. So this is particularly scary because this is source code that you didn't even know was out there in public that could potentially contain information about your organization. And there's plenty of attacks that happened for this. I just wanna give one example very quickly. Toyota has a mobile application called T-Connect. It's kind of important, it can start your car. And to do this, they were working with a contractor. Contractor accidentally made this code public on GitHub. I don't know if Toyota uses GitHub or not. I'm just gonna pretend that they don't so that they were completely unaware that this was happening. And anyway, they wouldn't have been aware in any case that this code was public on GitHub. Inside that code were credentials to databases, at adversaries were able to find them and then gain access to the databases that contained all the information of those customers using T-Connect. And then they were then able to launch phishing campaigns against them and sell that data on to other people. So this is how your supply chain and the fact that we have everything out there in the internet, in the cloud, can be affected when we were just talking about source code. There's lots of other ways. I said at the start, source code is really bad at staying private. These are all the companies last year that had their source code involuntarily open sourced, I like to say. And if we take just a look at one of those Twitch, they had their entire code base leaked publicly on a torrent. We scanned it and found 6,000 secrets inside there, including 194 AWS keys. How did this happen? How did their source code get leaked? For less than a day, there was a misconfiguration on the Git servers where it allowed public access. Someone found it in that time and downloaded the whole thing. So just a very simple mistake. But that's what we're dealing with now. That's the kind of security implications that come with bringing everything onto the internet. Okay, so the very last one, I'm running out of time, so I'll have to go quickly. But the build process, right? This is now moved into the internet as well, which can create problems. So I want to talk about one of these. This is CodeCov.  It's basically where you test your application. CodeCov was a little app that did something very specific. It tests how much code coverage you have. It tests how much of your application is being tested. So it doesn't do anything critical. Not that we might think. But what ended up happening? Well, how CodeCov's application was run was via a Docker image. Inside that Docker image, there was a leaked credential. That credential gave access to, I think it was a Microsoft storage bucket that contained code that enabled the attackers to manipulate that code. And they did something quite clever. They turned CodeCov malicious by writing one line of code that said, anytime someone uses CodeCov, I want you to take all of the environment variables, all of the code that they're using, and I want you to send them to me. And so that's what they did. So the attackers were able then to move into different organizations that were using CodeCov. Now, those organizations did nothing wrong by using CodeCov, but now they're part of a breach. This is the line of code. It was line 525 of about 2,000, so it was pretty well hidden in there and just said, send us these environment variables. I don't pick on companies very often. They have breaches, but I'll pick on one very quickly. HashiCorp was captured in this. Lots of companies were, but HashiCorp was one of them. HashiCorp creates a product called Vault. It's the best secrets manager on the market. HashiCorp invented the term secret sprawl, and their whole premise of Vault is that with Vault, you never need to put secrets in your repositories. Because of this, the attackers got into their repositories and they had to rotate a bunch of secrets that they left in there. If HashiCorp has secrets in their code repositories, no one has any hope. And CircleCI is a more recent one. This follows a very similar path. A developer's machine was compromised, a session cookie was stolen, and then basically everyone's secrets were stolen from there. So these things are bad. So there's a little taste of how that build process can be compromised. And of course, we could go on further and further. There's plenty more examples, but we're limited by time here today. So can we make the software supply chain healthy? Can we build a healthy cigarette here? And the answer is yes. So a lot of doom and gloom. But we do have options here. We do have options. We don't just have to pretend that it is toasted, but it requires some fundamental shifts in kind of how we operate. So what can we do better? Some of it, we're already doing, and I'm positive in the direction. But we need to move away from secrets. A lot of everything, an elevation that attackers get is from leaked credentials. So moving away from using API keys, going into centralized trust, using dynamic secrets, better understanding the composition of our software to things like an S-bomb is a really good start. So we actually get visibility into the dependencies so when they do get leaked. Infrastructure should default to private. One of the things that frustrates me hell is it to make things easier on developers to get started faster, everything is kind of by default open. So Amazon S3 buckets recently changed their policy, but it used to be quite hard to make it private. So we need to move away from kind of making things just arbitrarily easy and making it more secure. MFA, this is moving in the right direction. GitHub's made good grounds on this. So has NPN and other areas. And security education needs to be a pillar of developer training. Now I'm out of time, I believe I'm gonna, and I wanna take some questions, but here are some very quick things that you can do if you want to harden your supply chain. If you wanna make it more healthy and get away from just toasting it. One thing is that in a lot of supply chain attacks, you don't know that you've been attacked. They sit in there for months, literally months waiting to do it. Honey pots and honey tokens are a great way to do this. I have a workshop tomorrow on how to make honey tokens completely yourself. These are really low cost, in fact probably no cost. And they're basically just a bait for attackers to try and exploit them. So if you wanna come to that, tomorrow I think at 10, we need to get better at managing secrets. There's lots of levels to this. These are the top level, but I always say that whatever gets you out of hard coding your credentials and get, let's start there and let's move our way up. Secret scanning, so GG Shield is a tool that I'm connected to, so I'm ridiculously biased, so just bear that in mind. But there are other tools that are open source to help you detect secrets. SCA for dependency scanning. Plenty of tools out here to software composition analysis to help you analyze vulnerabilities that you have in your dependencies. So these are things that we can do. These are getting better and better and also some open source tooling to help us start on our S-bombs. And then finally, some other areas. Zero trust, add additional layers of threat, segment your environments. And lastly, change your mindset to assume that you're gonna be breached. Know that your supply chain is toasted. Know that the internet is broken in its current form and when you make that mindset, then you can actually start implementing good policies. So I've gone over time, but hopefully I wasn't talking too fast. But yeah, thank you all and I'd be happy to take some questions if you have any now. That's a good question. So I'm always about the fact that we should absolutely, open source should be a job and we should fund it. I think organizations should be funding that and there should be dedication to go into there. So I think that's a good start. Getting more of the crowd sourcing platforms, places like GitHub have made a start, but I think we should do more on that. But if we can, there's a lot of people that want to work on open source full time that can't because obviously if you live in San Francisco, then it's not gonna pay the bills. But I think we definitely can improve on that. That's a really worthy investment for security because that means that they can actually focus on doing this. So I'm probably not the answer that you were looking for, but I think that's where I'm kind of passionate about is trying to get more funding into these areas and make this a really respected job that actually can pay so that we can. The whole, it seems crazy to me that all the internet is based on this and most of these people are just completely unpaid. Like everything's so strong to it. But anyway, a rant for another day. Any other questions? Well, thank you all for coming here and perhaps I'll see you at the party later today. Thanks.


We propose the SCRUM method for Education Quality Assurance, which is based on the Manifesto for Agile Education Quality Assurance and its 12 principles. This method is suitable for both external and internal quality assessment procedures in higher education and can help achieve SDG for targets while also contributing to SDGs 8 and 9. Additionally, we suggest including stakeholder feedback during the sprint review process, as well as incorporating the DIKW plus DM hierarchy into the framework for Education Quality Assurance. This article was authored by Artem E. Artiakov, Yriyayu Vok, and Tashiana A. Vasileva.


My name is Andrea Trosti and I've been a dental professional since 2005. I'm currently a dental hygienist where I have my own mobile dental hygiene practice. And something I see nearly in every single client of mine is their gums are going to bleed. Whether they're bleeding during the cleaning or they tell me, hey Andrea, my gums bleed when I'm brushing, when I'm flossing, why is that, what's going on? So let me explain bleeding gums a little bit. Now typically, when anybody experiences bleeding gums, they get concerned. They're like, oh my goodness, what's going on? And you should be concerned, but not in the way that you might think. So let me backpedal a little bit. So when I see bleeding gums, when I'm cleaning somebody's teeth, I know I'm not doing anything wrong because during a teeth cleaning, we're there to remove the plaque and tartar that builds up on your teeth. If we don't remove it, then that can cause gum disease, it can cause cavities and it can cause pain. So we do need to remove that plaque and tartar with the tools that we have. Now if I notice the gums are bleeding, that tells me that particular plaque and tartar in that area has been sitting there too long and it's made the gums inflamed. Quite often patients are going to say to me, Andrea, I taste blood, like that doesn't taste good. Can I please have a rinse? And sometimes the bleeding just continues. Like it's not going to stop after a rinse. It's going to continue for a couple seconds, if not a couple minutes. Like it really depends on how long I'm cleaning in that particular area. Now some patients are overly concerned. They might be like, oh my goodness, what did you do? Did you hurt me? Why are my gums bleeding? My gums never bleed with any other hygienists, like what's going on? So basically bleeding gums tells us that that area, those gums, aren't healthy. It could be because you're not flossing every day. If you're the type that doesn't want to floss every day or you just don't find the time, you don't like it, I highly recommend a water pick. I'm going to leave a link for you guys down below where you can actually buy one from Amazon. I use the same one. It's a cordless one.  It's amazing. I highly recommend that. If your gums are bleeding and you're using the water pick or it could be also called the water flosser. If you're using that at least every day, the gums will get so much healthier in no time. What we say in the dental world is healthy gums do not bleed. So when we see bleeding, are we concerned? Yes, but it kind of depends. Even my gums bleed from time to time. If I'm using the water flosser and my gums are bleeding, I'm not immediately like, Oh my goodness, what's going on?  What's happening? No. I had more plaque in that area. I probably didn't brush that area that well today, or maybe I didn't quite get back there with the water flosser. So gums can bleed very easily, but if you notice bleeding, or if your dental hygienist has told you your gums are bleeding more than usual today, the best thing to do is start to brush every day, twice a day, use the water flosser every day. I tend to use mine after I'm eating, if I'm home, so maybe three or four times a day, and get your teeth cleaned on a regular basis by the dental hygienist. Because if the plaque or tartar is sitting there for too long, and you can't get at it with your toothbrush or anything else, then the dental hygienist, we have special tools to get underneath the gums to clean that off. Your gums are going to be unhealthy. They're going to continue bleeding unless we clean off that plaque and tartar. But like I said before, it's kind of like a double-edged sword. When I'm cleaning in there, the gums are going to bleed even more. So it kind of looks like I'm making the matter worse, but I'm not. Things have to get worse before they get better. I need to clean away that plaque and tartar. The gums are going to bleed a lot, but then the gums can start to heal. The gums are going to get used to things again, and they're going to toughen up. So what I tell my patients is, you might notice the gums bleeding a little bit more tonight, but by tomorrow, maybe a couple days, if you're doing everything you should be doing with your toothbrush, you know, brush twice a day. Use the water flosser at least every day. The gums are going to start to heal, and you'll notice them bleeding less and less each time. The gums need to toughen up. So now that I've cleaned everything out of there, the plaque, the tartar, all of that, the gums can start to heal now. So then you will notice it can take somebody a couple days. It can take somebody a couple weeks, maybe even a couple months. But you will notice, hmm, my gums are bleeding so much less now. Some people do need their teeth cleaned more often, say every three months, to keep their gums as healthy as possible, and to have the bleeding not happen. But let's say they wait four months and they notice the gums are starting to bleed more than usual, it's time to get your teeth cleaned. I'm not going to get too scientific about it in this video, but basically there's certain bacteria that you have in your mouth that can take three months to get really bad. So that's why if you've ever been told to have your teeth cleaned every three months, it's because you have more plaque and tartar than the usual person, or just more than what's ideal, and your gums don't like it, and they bleed more often than maybe somebody else. You might know some people who barely brush, but they have their teeth cleaned every nine months and things look okay, well, they're lucky. They have very limited bad bacteria, lucky them.  You use mouthwash. You use the water flosser. You have your teeth cleaned every three months, but your gums bleed so much every time, or you have so much plaque and tartar all the time. That just means you have more bad bacteria, so you have to work even harder at home, and to continue seeing your dental hygienists every three months. So leave me a comment if you guys have any questions. Thank you guys for watching, and I look forward to seeing you guys in the next video.


Shipmates, C&O Gillay here with my wife Linda to celebrate the month of the military child. During April, let's take time together to recognize the patriotism, strength, and perseverance of our Navy's military children. Let's applaud their daily sacrifices and the challenges they overcome day in and day out, especially this past year during the coronavirus pandemic. That's right, Linda. While life in the Navy can often lead to time apart for parents and children, now more than ever, our families are displaying incredible resilience and grit. As the parents of two young men who are both in college, we understand the impacts that the military life has on children and young adults, as well as the important role that the children play in our communities. There's no doubt, children are a vital part of the Navy's mission success as they set examples for their friends, their neighbors, and their local communities on how to make personal sacrifices in service of the collective good. To our military kids today, thank you for your love and support, which makes a career of naval service worthwhile. And to all of our military children, past, present, and future, thank you.


Hello, my name is Roger Watson and I'm the editor-in-chief of the Journal of Advanced Nursing and I'm also the professor of nursing at the University of Hull. Working in a female-dominated profession, it doesn't seem unusual to me that women should be just as good as men at science, research and publication and of course there's no reason to suspect that they shouldn't be. I come from a hard science background and I have to say that it was very male-dominated and remains that way. However, some of the most brilliant fellow students I had were the female students and likewise when I did my PhD some of the most brilliant colleagues were also female but it's shameful how few of them there are and it was certainly very shameful then how very few of them there were. I'm not very sure how we encourage women to come into STEM subjects if indeed it's true that they don't want to come into STEM subjects. I think it's probably more a case of a male-dominated side of academic life which needs to demonstrate that women can do as well and can develop their careers and can do the other things that women do if necessary like having families and babies which necessitates taking time off and this shouldn't be to the detriment of their careers. So I think it's more a case of change that needs to be made in the academy rather than by women themselves. I'd like to add something else. My subject of nursing is not considered to be a STEM subject and I'm not alone in thinking this that if we brought STEM subjects brought sorry brought nursing into STEM subjects which I think should happen our research is very cognate and supports a great deal of STEM work then there would be immediate influx of female academics possibly in the majority in some countries into STEM subjects. So that's one way that I think we could address this issue. Very glad to speak to you about this. I'm not an expert. I hope my views are interesting and helpful. I look forward to seeing what others contribute towards the debate. Thank you very much.