Hi, I'm Joe Rosner. Um, I'm an engineer at Privatee where I've been working on, um, some mitigation techniques for C-Surf and this is a kind of run through of some of the research we've been doing and how it all works. Um, this is kind of a deep dive into C-Surf as an attack vector, how it works, um, that solutions exist currently and, uh, some new ways we can basically help to avoid it in the future. Uh, and I know what you're gonna say, it's 2017, why are we still talking about this? We know about C-Surf, it's nothing new, it's this attack that we've known about for like 10 years. Um, what could I possibly have to add to this that hasn't been said already? All the modern frameworks take care of this, they do it for you as long as you play within their, their rules, you get it for free.  Uh, so this is kind of a solution that you can use for those situations where you are unable to patch it and fix underlying flaw, but you need remediation right now. So what is C-Surf? At its most basic level, C-Surf is when an attacker forces a victim to create a request on their behalf. Uh, so I the attacker force your browser to initiate a request that does something on your behalf and that has some action that is probably bad for you. Uh, it comes from, from three different uh, conditions that exist within HTTP and those three are, are, begin with uh, the concept of safe and unsafe request types. Um, so safe methods are traditionally designed for accessing data. So you make a, a get request or a head or an option and you're asking the server for some kind of restful resource. And this isn't designed to have no side effects, it's designed to uh, basically have no impact on the data on the server. You're just pulling it back down and, and getting a copy of something.  Um, and, and part of the problem is that these aren't typically used correctly. Especially in, in older uh, like PHP apps and, and uh, apps that don't really have the concept of a router or any kind of uh, way to distinguish between the different request verbs, you'll see a lot of time they'll respond to whatever is sent to them. And that's really bad and we'll see why. Um, usually it's due to laziness or just not understanding it or just a lot of legacy code that never took advantage of um, building out to the HTTP spec. The other uh, main issue is, is cookies. Um, and, and these are kind of a work around for the concept of, of HTTP being a stateless protocol. Um, we, we get around this by having what's called sessions. And, and sessions are some server side storage that can be trusted uh, that you can basically say uh, throughout every request for this user for this session, I wanna bring this data along with me. And you might store things in there like uh, you know a session ID, a user ID, some information about whether or not they're logged in. Um, and so the way that you typically implement this is on the server when you initially log in or come to the page for the first time, you generate a cookie. That cookie gets sent down and that cookie has some unique identifier. Every following request, that cookie gets sent up with it. And the server will look up that ID, pull the data out and let you access it. Um, cookies are, are kind of this, this weird thing that um, we, we depend on the browser to secure for us. Um, it has some concepts of security like, like locking it to a specific domain. So the cookie will only be sent if the domain matches the domain that the request is for. So if, you know, my cookie is set for google.com and I'm going to google.com, that cookie will be sent. If I'm going somewhere else, that cookie won't be sent. Um, and, and the cookies work cross tabs and they work automatically across tabs. So if you have 10 tabs open all to the same site, they're all going to share that same cookie. Even if they're being sent at the same time, uh, they, they all share that information and they're all going to update it accordingly. And, and each tab will always send the cookie as long as it matches the required domain and path. That's always going to, to happen. So this is an example of, of what you might see in a cookie when you're setting it from the response. Uh, in the headers, you'll see the, uh, the cookie name, the value. Uh, if there is a domain, it will be set. It's not required. Um, sorry, sorry, it is required but it's, uh, uh, the rest are not. Uh, secure is used to say that you only want the cookie to be sent over an HTTPS channel. So if the secure flag is set and I'm connecting over HTTPS, the cookie will not be sent and that's a security mechanism that we'll discuss a little bit later. HTTP only, uh, is also, uh, an idea that if you set that, the JavaScript on the page will not be able to access the cookie. Uh, we need to make sure that this is always false. Uh, typically you'll want this to be true because it's a, it's a really good security mechanism that helps you avoid like, uh, theft of cookies. Um, but for the specific example, uh, it's not going to matter so much in this case and it's important that it not be set. The, the last is XSS and this isn't strictly C-surf but it enables it. Uh, you know, C-surf or cross request, um, uh, cross set request, uh, is, is the idea that you have, you know, across sites to two different ones. Um, but you can also do the same kind of idea from within the site if you get XSS.  Um, in the case of XSS, like, this is bad and you should feel bad if you have it, like, it's, it's, it's a bad time. Um, no matter what you do, if, if you have XSS, you will never be able to stop C-surf. Uh, it is, once, once you have that, any mechanism that you add, uh, that is a counter measure to that attack can be bypassed once you have sufficient code execution on the browser. And there's, there's basically nothing you can do about that. You just have to eliminate the XSS. So how does it work? There's, there's three distinct types that I'm going to cover and this covers the vast majority of the kinds of requests that you might see. Um, the canonical one that you'll, you'll typically see demonstrated is resource inclusion. Um, and by this I mean tags that specifically allow for external resources, for instance, image tags, audio tags, video tags, objects. Um, when you specify the source, when the browser loads that and, and renders it on page, it's going to call out to whatever that resource is and try to pull that resource down. Uh, and so for the case where you're not using, uh, get requests correctly and you're not enforcing the safe and unsafe correctly, uh, these can be used to make get requests to arbitrary places. In the case of like an image, you'll see it show up as a broken image, but that request will still get made and so the damage will already be done. Um, this specific type is limited to uh, only get requests, so if you are doing the safe and unsafe correctly, um, this technique will most likely not be usable for you. Uh, an example of this is, is something like this. Um, we'll be using a banking demo that I, that I built uh, shortly. Uh, and so this is how a trans, uh, transfer would occur. Um, it's to get requests that has a two and an amount. Um, so if you were to put this into an image tag, you would see, uh, the transaction went through. The next is form-based and uh, this is typically what you'll see a lot of the time when you're dealing with people who do, do safe and unsafe correctly. Uh, you'll build like a form-based template and on your attackers control website, you'll put this in, it will post back to whatever the, uh, whatever the page is, it actually does the, the request. And you'll usually have some JavaScript in there so that it forces the user to click. Uh, and it will be really quick. It's common with phishing emails or other methods where you'll direct a victim to a page, they'll load it and immediately the JavaScript will just force a click of the form and submit it and you'll never even know you were there. You'll wind up on the page wherever you were trying to go to. Um, and this is a really good option if you have to bypass cores. Cores is a cross-origin request. So, um, something really important is the, the same origin policy which basically dictates that, um, if you're making like an XHR request, you can't go to a different domain than where the origin was. And one way around this is with cores. It's, it's used sometimes, um, but it's a good way to avoid this. Uh, and so an example of a really basic template you might see is a form like this. It basically just has a bunch of hidden elements so you would go in when you're creating it and you would put in all the values you want them to submit for you. Uh, and then the little, uh, stripped at the bottom just causes the form to submit and they'll never know it happened. They'll end up on the page where the, the action is here and it will just have been done. The last is XHR and this is, uh, pretty much only ever going to happen if you have XSS on the page. Uh, the only other exception is if cores is enabled for the endpoint and you can put some XHR code on an attacker controlled place and get the victim to go there, um, and utilize, uh, cores for that. Uh, like I said, you know, with XSS it doesn't really matter because it's game over anyway. Um, but this is the other type you might see. Um, the cool thing about this is that no page reload is required. So when the victim does get hit, they're not going to know it, but basically the only way you're going to see it is if you're watching network traffic or you're in like the web inspector tools and you see the, the requests go by. Um, it's really difficult to detect and like you're probably not going to see it. There's also all kinds of cool tricks you can do, like hiding stuff, um, like, uh, in like a real page. So it looks like they're actually at a real site or something. Um, the, the code for this is actually pretty simple. Um, this is all it is. This is a basic X, XHR request. Um, and that's pretty much it. Uh, let me jump into a demo really quick and I'll kind of show off. Uh, this is a, a demo banking app. Um, basically it allows you to perform transactions, uh, to transfer money from an account to another account. Uh, so I'm just going to send myself some money. Uh, I'll sell myself 100 bucks, thousand dollars. Um, and so it just goes through and it will do the thing. Um, so this is an example of an image-based one. Uh, you'll see here, uh, it's basically just the image tag that I used before. Uh, I'll refresh the page and we'll now see that the request went through. We, we forced the victim to go make this transaction. So if, if I had, you know, sent this over to an instant messenger or an email and got them to click on, you know, a page that had that image, it would have the same effect on them if they were logged into, uh, this bank because they had their session active still. The next example is the, uh, the form based one. I'm going to really quick go back and reset this. If I can find my mouse. Uh, and so we end up at the transfer page. This is the JSON that comes back and if we go back to this tab, we'll see, uh, the request has gone through as well. And then the last one is the XHR. Uh, we'll see, this is the code I had in there. Um, I'm going to go ahead and reset this and we'll refresh the page and we can see in the network tab here, uh, the XHR request went through. It sent for money from, uh, to the attacker a bunch of money. Uh, and it should be showing up here. Come on mouse, you can do it. So there's a bunch of current solutions that exist and we, we see these all the time. Um, basically, you want to have a combination of at least two of these. Um, all three would be great. Uh, first is using safe verbs correctly. Uh, if you're building your app, uh, make sure that GET requests don't have any kind of, uh, side effect. Don't let it modify data, just do it. It's going to make things so much easier. Uh, and I know that a lot of what I've been talking about is around the idea of fixing this in applications. We can't go in and rewrite for whatever reason. Um, this is not one of those easy things to fix, but if you're doing it from the beginning, just go ahead and do this. It's going to make things so much easier. Go use a router and, and, and let it be nice. Um, verify the origin. Uh, this is useful if you're doing cores specifically. Um, but it also is very helpful if you want to avoid, uh, attack or hosted pages that are coming into your site, uh, with format, uh, requests. Uh, if you're already using the safe verbs correctly, you should only have to worry about unsafe, which is why we do the forms, uh, the images. Um, maybe a little more complicated because if people are like hot linking into images on your website, it might be a problem. Um, and the last is synchronizer tokens or crypto tokens. This is like kind of the industry standard and what everyone uses. If you're using any modern framework, this is what it's probably doing under the hood. It's creating a token and then verifying it on the requests. And a little bit of a disclaimer before, uh, we, we go into the real like how the, the technique works. Um, this is a greatly simplified, um, walkthrough of the code. There's a lot of very specific domain knowledge that goes into wherever you're going to build this. Um, we've built it in, in Java and dot net, but like you could go and you could build this literally anywhere, uh, where you can intercept and modify HTTP requests and responses. Um, but in doing this, you're trading a lot of complexity, uh, of the platform where you have to know a lot about that and work within this really, really complicated platform for solving the problem in your app and just like doing it, um, there and probably a simpler solution, but it requires, um, potentially more work. Um, so this may or may not work out of the box for you, but this will be all the information that you need in order to basically implement something like this to the needs that you have. Uh, and so why is this important? Like I've already said, um, if, if we can't modify the application, maybe it's, you know, a 10 year old legacy application, 20 year legacy application, and we can't do anything about it. We don't have the source code. The risk is too high. Um, this would be a good solution, um, as a mitigation if you have a problem you can't fix right now. Um, for bulk support across applications, if you wanted to set the load balancer or a proxy or a WAF, um, this would be a good solution for that. There's already some that exist out there in WAFs where they'll, uh, rewrite the forms and the responses. Uh, that's great. Uh, it doesn't have the effect of working with XHR, uh, and some of the other request types that we've talked about so far. Um, and last, if you wanted to provide this to like your customers, if you were like a hosting company and you wanted to say, hey, all you guys that have really insecure apps running on my host, hosted servers, like, here's some security for you. Um, this would also be like something you could offer them and it would, uh, probably solve a lot of their problems, um, for like a low hanging fruit. So what are we looking for in a solution? Um, we need this thing that can be easily added into apps, whether we're doing it at the network level in an appliance or we're doing it in the application itself. We need it to work across browsers because one of the things about C-Surf is that it's a totally client side attack when you're performing it. You're, you're attacking the, the victim, the victim's browser, not the server. Uh, so we, we need good, uh, cross browser support. Um, and it needs to work for XHR, for forms and resources. It needs to be low impact. Uh, it can't, uh, take down our, uh, our servers. It can't, uh, reduce the throughput we can do. It needs to be something that's really, really efficient. Uh, and we can't do any additional requests because there are some solutions out there. They'll make outside requests up to the server to pull down your tokens and then get them back and then do this whole verification, like, dance. And we, we want to avoid that. We want something that fits in with the standard request response that you would normally see with your application. And that's what we're shooting for. Um, I've already talked about this, just do it. Uh, it's, it's gonna be so much better for you. Um, there, there's routers for basically every language out there. They basically will allow you to define a whole bunch of endpoints and then match it up with a, uh, a verb and then pass it off to the correct, uh, handler during dispatch. Just do it. It won't solve your C-surf problem out of the box, but it will make things easier. Uh, so verifying the refer and the origin, uh, this is used, like I said, to detect, uh, permitted cores requests and to detect, uh, outside requests coming into the application. And this is done, uh, by looking at the, the origin and the refer. The, the refer is, uh, one of the headers that tells the server where you were coming from. So if I'm on, you know, account.php, uh, and then I go to transfer.php, the refer is gonna have the URL of account.php. So it can track where I was before I got to this URL and how I got there. Uh, the origin header is used mostly for cross origin requests and XHR. Uh, so you may or may not see it in all requests, but it, it could be there. These are both headers that are not supposed to be set up by JavaScript in the browser. So you can have a reasonable sense of, of assurance that these values are, uh, safe. They are something that can be spoofed if you're making a request. But in the case of C-surf, because it's coming from the victim, the only way you'd ever have a spoofed value there is if the victim was attacking themselves. So the value should be trustworthy and you shouldn't have to worry about the fact that it's not always going to be, um, accurate. It is possible that you won't see it and in our case we found the best way to go forward with this is if it's not there and you can't validate it, uh, just fail open. Uh, you might have more strict requirements, um, but on the off chance that like, you know, they're running a, a privacy plugin that strips it out of their requests, um, you don't want like legitimate traffic to be stopped. Uh, and that's one potential downside to, uh, fail enclosed in the situation. Um, this can be sufficient, uh, alone if you are using safe verbs correctly because doing that should eliminate the possibility of resource inclusion attacks. So as long as you don't have XSS and as long as, uh, you're doing this, you should theoretically be able to block form-based attacks from outside. Um, I wouldn't bet on that. Um, there's a really good write up, uh, from this company Mixmax that, uh, implemented something like this and, uh, they used just this technique, uh, for their core system. Uh, and you should definitely go read it if you're, uh, interested in how that works. Um, I'll cover a little bit but they have a much more in depth, uh, write up on it. Uh, and this is just a typical request. This is what I would see with origin, uh, refer. Uh, their actual form is a little bit different so a little bit of parsing is required in order to get the correct data out of it to, to figure out, uh, whether or not it's valid. The code is pretty simple. Uh, this is essentially taking straight out of, uh, the code that we use and basically we just look for the presence of the origin header. If it's there we parse it. If it's not there we fall back to the refer and if it's there we parse it. If it's not we'll fail open. Um, and then we, we compare the authority, uh, which is the, the host in the port and, and that's basically the origin. Um, we compare that with what's in the host, uh, which is another header that you would see and that is required as of HTTP 1.1. So basically like every server on the internet now pretty much. The last is tokens. Um, and this is like I said the most common system you'll see. Uh, the actual solution that we're doing, this is what we're going to focus most of our time on. Um, is walking through the token implementation that I've built, how it works and the benefits to it over a traditional approach that you might see, uh, in most of the frameworks. Uh, so these typically come in, in two forms. You'll have synchronizer tokens which are kind of just like a, a random value and those are typically stored in the session and used for a straight comparison. Um, you'll also have, have crypto tokens which are basically a random value that's encrypted and then the server can, uh, decrypt that and verify it. Uh, this is cool because it's stateless so it doesn't require having, um, any kind of shared state across your app servers. So if you have like, you know, 50 app servers behind a load balancer, you don't have to worry about like Redis or sharing state or, or anything or sticky sessions. Um, the solution that I've built uses the best of both worlds. You should basically never use the crypto stuff. It's usually slow even with AES acceleration and that's probably what you're gonna want because it's a, um, pre-shared key that you can share across all your servers. Uh, instead we'll rely on HMAC, uh, shot to, um, but we get the stateless aspect of it, uh, as well which is really nice. Um, and so, tokens are designed to basically tie a, action to a specific user, uh, at a specific time and enforce that they're not gonna repeat these and that only this user is actually performing those actions. Um, and you'll typically see these used mostly, uh, for logged in users because the idea is that if you're not logged in there's not much you can do that's dangerous. That's not always true. A lot of the time you'll go see, um, like people won't pay out bounties for like, I don't log out CSERF because like who cares if you can force someone to log out. It's not like a, a dangerous thing usually. Um, so, cost them, uh, analysis there whether or not it's worth it. Um, and like they can sometimes be used for stopping replays which is cool. If you want to stop automation, um, it's, you can work around that but it's, it's possible and it adds a little bit of, of nicety there. So the way that they're composed, um, typically there, there's four pieces you need to have any successful token that, that's safe. Um, and you may not see all of these in the token value itself. They might be taken care of, um, in other ways. So the first part is, is the random value or the knots and in the traditional type of token when you're using session storage, basically this gets stored in the session and it's then compared against. Uh, the user ID, uh, this could be anything. It just needs to be a unique thing that is tied to a user and that no one else is going to have. Uh, in our case, we go ahead and use the session identifier, um, and because no one should have, no two people should ever have the same session ID and not be the same person. Um, but you can use anything here. Uh, in the case of like a normal session system, you would typically rely on the fact that the session is tied to the user and so you get that, um, that for free. You don't have to like build any kind of, um, additional check for that. Uh, there's usually an expiration time. Uh, you want these to be relatively like short-lived so that if someone steals it, it's not going to be good forever and they can just keep reusing it over and over again. Uh, this is usually tied to the session lifetime. So when the session expires, user logs out, it's no longer valid. And then authenticity verification. Um, like I said, we rely on HMAC SHA-2 with a pre-shared key. Um, you could do a whole bunch of different things here. Typical session implementations rely on the fact that, uh, a user can't typically modify session state directly. So if they can't do it, then the data should be authentic because it hasn't been modified other than by the server itself. If any one of these is missing, you severely compromise the, uh, security of the token. Um, if you don't have an expiration time, it lasts forever. If you are not verifying authenticity, you can forge tokens potentially. Um, user ID, if you don't scope it to a specific user, you can steal a token from any one user and use it for everyone else. Or if you were a valid user on there too, you could grab a token for yourself and then use it for other users and just kind of like force it in. This is the typical life cycle you'll see, uh, for a client and server. You'll make your initial get requests. Um, this is usually unprotected. And then this will send back a token. That token is then forwarded, uh, in the, uh, unsafe requests either in a header or in the, uh, request body depending on the implementation that you're using. We use both. Uh, and then on the server side, once it goes back up, the server will verify the token. If it's good, it lets it go through. If it's bad, it fails it, like with a 403 or something. Um, I've already kind of talked about this. You really don't want to use crypto. It's nice because it's stateless, but the performance is usually pretty shitty and, uh, you just kind of don't want to bother. There's better ways to do it. The generation is pretty simple. Uh, this is the code that we used to handle it. Uh, you pass a user ID and a key. You grab a random value. Uh, you should make sure to use a secure random value here. So like from like a good entropy source. Um, then you sign it. You concatenate it. Uh, one thing to note here is we use hyphens. Um, this is one of those little gotchas, but the colon is actually not a valid character in the value of a version one cookie. Uh, so it will force an upgrade. Uh, if you're going to do this, don't use a colon as a delimiter. Uh, or you might have issues with Roger compatibility. Validation is also pretty simple. Uh, you just split it up based on your delimiter. Uh, and you recompute the, uh, the, the hash or the, the MAC from the parts and then you make sure that it is not past the expiration time. You verify that the user is correct and everything is cool. Uh, that is a valid token. Uh, so the way that we handle, uh, putting the tokens into the, the client browser. Um, basically we use middleware and various other, uh, systems whether, wherever you're, you're doing your interception. And you basically just look at the request, you determine whether or not you have to generate a token. Uh, and you add it in if you have. Um, and the browser should take care of the rest. Uh, we'll be appending a little bit of a, a JSON payload to the response that we'll handle putting that into further requests that need to be protected. Uh, and there's a lot involved here that you may not be aware of. Uh, there's all kinds of like weird, uh, edge cases with regard to, uh, like dealing with the request coming in. It's like, typically as middleware, if you're going to read the body of a request, like if you read it in, there's no more data on the wire. So you have to buffer that and then expose it.  And this is like that complexity thing I mentioned about, you have to trade off a lot of domain knowledge here to make sure you do things right and you don't break the app downstream. Um, giving it something it doesn't expect. So the token is back. This is like the real innovation and like where like the bulk of the work went into was building something that could take the tokens out of the cookie that we sent down and send it back up in a secure way that allowed us to put it into basically any kind of request that needs to be protected. Uh, we'll be talking about two different forms which are, uh, form-based and XHR. Um, I'm not going to touch resource inclusion because there's not really like a good way to do it. You can use some weird techniques and I'm happy to talk about it later. Um, but it's going to be kind of error prone and very dependent on your site. If you're using safe and unsafe verbs correctly, this shouldn't be a problem for you. Uh, and I did a ton of browser testing across all this work. Uh, and I'll show the matrix. It basically works back to like ancient browsers. So this should be pretty good.  Um, so the way that it works for forms is basically on document, we're going to attach an event listener and we're doing it on document and not on the form itself because the form may not be rendered yet on the page and we have to ensure that, uh, we can get to it at any point in time. So we, we delegate from document and so whenever the event fires it'll bubble up and bubble up and bubble up and eventually we'll just say, is this the right thing? Do I have to fire it on this thing and we'll do whatever it needs to do and we can walk through the code for that right now. Uh, so this is what you would see in your, uh, your click handler and it's important to use click and not on submit because submit does not bubble but click does. So if you were to, uh, try to attach it to document for submit you'll never see your event fire. Uh, and this was tested across browsers and we didn't see bubbling in any of them as far as I remember. Uh, so basically we, we set our target and the target is the, uh, the element that was clicked on. So this is the HTML element that the event was fired for. And what we're gonna do is we're gonna walk up, uh, the DOM trying to find one of the, uh, elements that we care about, uh, delegating to. And we do this because you might click on a span that is, you know, three levels deep in the DOM of a submit button or an A tag or a, um, a button and so the event's gonna fire on that span but not the actual thing you care about that's gonna do the submission. So we need to walk up until we find it. And it's possible that we won't find it. We may get all the way up the DOM to the very top and we'll see nothing and in that case we just don't have to worry about it. We're not inside of, uh, a form or anything and so it's not something we have to worry about. From here we're gonna look at the type, um, if it's, uh, if it's an input we have to make sure that it's a submit and not like a, uh, like a text input or something. Uh, this is just a bunch of edge case code that basically finds out whether or not something we care about. Uh, from here we know we're in an element we care about but we then need to go look up the form. We have to go look, find the form that we're in. It might have more than one form on a page but luckily we're in a tree so we just continue to walk up and we'll either hit the top, we'll either hit a form or we're gonna hit, uh, the top of the DOM and then we know we can just stop worrying about it. If we're in the form we're good. From here we're gonna determine if a token already exists in the form. Um, we're gonna look it up by the thing that we're inserting. If we find it we're gonna verify that the value of that token is valid. It's the one that's in our cookie. If it's not we're gonna update it, uh, and if it's not there then we're just gonna go and we're gonna append it into the, uh, into the form. And so when, when the actual request happens the form data will be sent with that token. For XHR it's a little bit different. We're basically gonna be monkey patching, uh, XHR to rewrite the open send, uh, methods and add some additional code that we wrap. Uh, and this allows us to have some additional functionality like adding in the token value into the headers. Uh, this is specifically, uh, bottlenecked at IE 8. Uh, most other browsers are basically supported all the way back to anything anyone would use. Uh, IE 8 is specifically the bottleneck because before IE 8, uh, it used, uh, active X controls to do XHR and so because of that, uh, we can't monkey patch the code. Technically in 7 was, uh, where they moved over to XHR like the normal standard compliant version but you can't, uh, use prototype in 7 so we don't have the ability to monkey patch any of it. Uh, you might be able to, to simulate some of this with active X controls. I don't know. Uh, I didn't try that but if it's a real use case you have, it might be an option. Um, this is essentially the code we're, we're writing. Uh, it's important that this runs early on so you want this code to execute and basically we're gonna save a, a copy of the original send and open and we're going to just overwrite it with our own. It goes in and grabs the token and then inserts it into the header. Uh, and this is a header that is, uh, valid to write to as JavaScript and then we just call the original, uh, value, uh, the original function. Uh, there's special toggles you might care about. One is the secure flag if you want to make sure HPS is, is all chill. Uh, protecting safe verbs if this is something you have to do, you'll have to enable this and you, you do this by basically creating an exclusion list and this list is safe URLs you can go to so like initial page loads you can hit where you can get a valid token because otherwise all your requests will fail as an invalid, uh, token because it won't be there. Uh, and then whether or not you want to allow cross origin requests and what those permitted origins are going to be and this gets layered on top of your cores config. This is the browser support matrix. Like I said, IE8 is the bottleneck but like you can see here like everything is supported. I mean like, and in some of these cases, it might be that some of older ones are supported. I just couldn't find older browsers in some of these versions. So it might work. Jump back to the browser. Uh, this is like a demo site that I put together and it basically walks through a whole bunch of different use cases where, uh, you might need to see whether or not this would work. So in this case, this is like a normal form submission. Um, and the job is just going to insert the token here and do its thing. So we'll see like all of these requests go through. Um, and it's, oh, my token's expired. Refresh this. And so it succeeded now. So it did the check and it failed because, uh, my token's like over an hour old at this point. Um, and so like this is, uh, it's like mock validation with bubbling off. So if I was going to, you know, want to do some JavaScript validation on the client side, but I wanted to stop bubbling, making sure that our JavaScript code will still run after the callback that they registered fires. So all these different weird edge cases, just making sure that it works. Um, this is all going to get released. So you can use this to verify whether or not your solution is functioning. Um, same idea, but this has bubbling on. Um, preventing defaults. So what, making sure that our stuff's still going to fire. Um, this is non-form-based XHR. Um, this is a button submitting a form. So you click the button. The button has a callback that then hits submit on the form rather than using a real traditional input element. Um, this is inserting a form. So making sure that the form isn't rendered on page, on page load so that we do actually delegate to document and we're not firing on something that was there from the beginning. Um, and this is an anchor tag. So being able to overload the behavior of a link and make that do something else. Um, so just a whole bunch of different edge cases that you might run into and verifying this actually does behave in the way you expect it to. And that you can actually insert these tokens and have it verify for, um, everything. Let me get back over to here. Running kinda short on time. Um, so let's just get into the future. Um, there's this really awesome spec out right now called SameSite. Um, this is coming very shortly and it is basically, um, what we're approaching as possibly the final nail in the coffin for C-Surf. Uh, and this is an extension to cookie use. It basically allows you to specify, um, an origin in your cookie. Um, or it uses your origin and will only send it if it matches. So there's two different ways you can do it. Lax and, and strict. You probably only ever want to use lax because strict will probably fail a lot for you. The difference being that strict will fail on safe requests where lax will not. So if you're say going to a page that requires a cookie being there and it's a get request, so like I'm going to the initial, you know, Google or gmail.com and I'm already logged in, that request would fail because my cookies wouldn't be sent with it, uh, because I was coming from a different origin to that page. Because forming, coming from like my empty tab or another tab and going to there, the origin didn't match from where I was going. I needed to do a, a page reload or you'd have to do like a, a redirect to make it all happy. So lax is probably what you want. Um, it's fully client side, which is the coolest thing. There's no tokens required. It basically does what you'd get out of this, um, by securing the session data itself rather than, um, relying on a token to make sure that, uh, it's coming from a trusted origin. Um, so we can see here, this working, we, we send our initial page request in, um, and it comes back, we make some requests and it's all good. Um, so like, this is like an example of a phishing attack where, uh, we might get something, uh, a link, we go to that link, it spawns and that sends us out. Um, here you would normally see the cookie go across, but it's, it's not gonna happen. Um, and then this is the browser support matrix, um, for same site. As you can see, it basically is supported on nothing right now. If you're using Chrome you're, you're cool, but, uh, nothing else really supports it. Um, so the one issue with this is that it doesn't support cores. So if you have cores as a use case, uh, you probably won't be able to use same site. I talked to the authors of the spec and they didn't really have a good answer for me. Uh, so probably it's not going to happen and there's going to be, um, nothing that happens to make that solved. It just doesn't really work with, uh, this type of system. Uh, so that's it. Um, this is the solution that, uh, we've been working on for the last year or so. Um, the code will be up, uh, or some aspect of it, uh, and I'll be posting the slides. Um, this is a pretty good solution. It hits most use cases. If, if this is the kind of issue you have or you have a lot of site changes, uh, add protection for, but you can't go modify it. Um, like I said, ideally, best case scenario, you go fix the app or use a framework that supports it for you. Do you're safe, unsafe, correctly? Uh, you'll be really happy you did. It will make things so much easier. Uh, and check out the same site. It, it might be, uh, a valid solution in the future. Uh, it is backwards compatible, so if you want to start using it, newer, uh, older browsers don't support it. We'll just ignore it. Like it doesn't exist. Newer browsers, it should work. Um, I've tested it in, in Chrome and, and got good results. Uh, but like, if it doesn't get supported by anything, it's not going to really matter. Uh, cool. Thank you.


We're going to get started here. I'm very pleased to introduce our basic science speaker this morning, Vladimir Kapilov. I met Vladimir just a little over a year ago when I was a guest speaker at Washington University and saved a list of where he was. And I found out that although I was familiar with some of his work in public literature we shared an awful lot of things in common, particularly with the interest of the visual cycle and cryochemistry of vision, and which people will be talking about this morning. He also will be giving a second talk later today to the basic science faculty when we work them or await them. And that will be at new years. And that would be on a different subject than calcium in the eye. And so I hope that many of you can be able to make it to that talk also. Just in terms of a background, Vladimir is from Bulgaria. He is into motorcycling and actually lived or not, he did drive here from St. Louis over the last three days on motorcycling. Rainstorm in, or rain and snowstorm in Wyoming just to be here. He still has a multiple day trip, a journey back. He's going to take a more southern route, which hopefully will be a little more temperate than that. He did his undergraduate and master's degree in Bulgaria between 1988 and 1993. And he was into physics, hard core solid state physics at the time. And then came here to the U.S. and worked in carnitornals, a laboratory at Boston University, and got his Ph.D. there. Often be into the physiology and early events of visual pigment regeneration. And then he did a postdoctoral fellowship with King Wai-Yau Johns Hopkins, working on the functional differences between retinal rod and photoreceptors. He's been at Blashew for a little over 10 years now. He's moved up to the ranks very rapidly and now is a full professor. So I think I will let him go from there. Thank you Paul for the invitation and for the kind introduction. I'm really excited to be here. Good morning everybody. I'm still on central time, so it's 7 a.m. for me and like Paul said, I'm a basic scientist.  So this is a new presentation for me. I haven't given this talk before. The same goes for the noon talk. If I say something that doesn't make sense to you or maybe you have questions, feel free to stop me and ask me anything. So as Paul said, my lab is interested in the physiology of photoreceptors and I thought I'll tell you a story today which essentially the punchline is that we believe that some of the studies that we have been doing have a very fundamental clinical relevance and the story that I hope you remember from this whole presentation is that the mule agliocells actually play a very important role in mediating the function and more importantly the survival of comphoto receptors and of course those are the cells that mediate our daytime vision and without them again I'm sure you all know we are legally blind and cannot function well. So before I start into diving into the science I just want to give credit. This work is mostly done by a couple of people from my lab. I have a small lab, Jin Shan Wang and Yun Lu who is now a student in Konisepko's lab at Harvard and some of the work was actually also done by Sasha Kolesnikov. I'll show some collaborative results with Joe Corbos' lab who is also at Washington University and at the end I'll show you some really neat gene therapies studies which were done in collaboration with John Finnery's lab who makes these just amazing AAV viruses that can drive expression in comphoto receptors and we've been helped with colleagues with reagents and mice and of course we've been fortunate enough to still stay afloat despite how difficult and even more difficult funding in science becomes and I have no conflicts of interest for what it's worth. Alright so you all know this picture of course you know that the retina is in the back of the eye and light travels through all the layers in the retina and eventually it is detected by Rod and Con photoreceptors and for the purposes of this presentation you should be aware that of course the photoreceptors are not functioning in vacuum. They are actually surrounded by two separate layers of supporting or helping cells. Behind the photoreceptors is the monolayer of retina pigment epithelial cells and their processes span between the photoreceptors and of course the RPE cells play a critical role in supporting the function of photoreceptors by providing them with nutrients by removing the shaded outer segment disks and of course by also providing chromophore which is vital for the function of photoreceptors. But in addition to that on the other side of the photoreceptors there is another supporting helper cell which is usually ignored and that's the muller glial cells. So the muller glial cells actually span the whole retina. They're like rubber bands that essentially keep the whole retina together and they have processes that kind of also wrap around the cell bodies of photoreceptors and as I'll tell you today they actually play a very important role in supporting the function specifically of con photoreceptors. So of course we have two photoreceptor types and they have very similar structure but they mediate very different kind of visual experience and I like to use this slide to kind of remind everybody how different rodent cone mediated vision is. So rods of course we use in dim light. They are extremely sensitive. They can detect even a single photon of light. But this high sensitivity comes at a high price as well. So rod responses are relatively slow. In addition our visual system integrates the signal from hundreds and thousands of rod photoreceptors into a single ganglion cell that goes then to the brain and as a result the spatial resolution of our rod mediated to dim light vision is relatively low and that's why in dim light the images that we see are kind of blurry and of course because we only have one type of rod photoreceptor we're not able to detect light colors to discriminate colors and again this is why in dim light everything looks kind of grayish, greenish. You cannot see red and green and blue colors. In addition rods saturate even in moderately bright light so as soon as the sun comes out actually your rods become saturated and they no longer contribute to your visual experience and finally I'm sure all of you have experienced this. Your rods actually are very slow to dark adaptor to reset their high sensitivity after exposure to bright light and the example that I like to give is if you are going to the movies and you are late and you walk into the movie theater after the movie has already started and it's dark in the room and all of a sudden you are blind. You don't see anything so you kind of stumble around and you find a place to sit and if you look around half an hour later you can actually see pretty well and the reason it takes so long before you can see is because your rods which are the cells that you need for dim light vision take about 30 to 40 minutes to fully reset their sensitivity. They are extremely slow and so again this is what happens in dim light and of course the situation in bright light is very different. This is when your com photoreceptors take over and because you have three types of coms red, green and blue you can discriminate colors and in addition coms have very fast responses which mediate very rapid very good temporal resolution of your com mediated vision and this is one of the topics that I will talk about at noon if you get a chance to stop by and critical for the function of coms as our daytime photoreceptors is their ability to remain functional and adapt even in very bright light. So even if you are out in beautiful Utah skiing in the winter and there are billions of photons hitting your photoreceptors your coms are still somehow able to adjust their sensitivity and remain able to respond to light and finally coms darken up very quickly so there is no refractory period as in with your rods and if you go from bright to dimmer environment but still bright enough for your coms to detect light again there is no period where you're blinded and so my lab has been really focused on understanding these particular properties of com photoreceptors, their ability to function in bright light and also their ability to darken up very very rapidly and one of the features that we have been focusing on is the visual pigment and what happens with the visual pigment in coms after it is photo activated and it turns out that what happens in coms is very different from what happens with rods and it helps to a large degree explain this functional difference between rods and coms. So let me tell you what I mean by the visual cycle so in both rods and coms detection of light happens in the outer segment of photoreceptors which again are kind of embedded in the RPE cells and detection happens when a photon of light is absorbed by the visual chromophore which is 11 c-th rate now and this chromophore is bound covalently to opsin, this is a G protein coupled receptor and the two together form the visual pigment and the outer segments contain stacks of lipid disks which are packed with so much visual pigment that a photon of light traveling along the outer segment has about a 50% chance of being detected and activate visual pigment molecule and when this pigment is activated by light it triggers the whole transduction cascade which ultimately result in generation of the light response but then consequently this pigment needs to be recycled or resetted just like a light switch if you turn it on you have to turn it off again before you can turn the light on again and so this happens through a fairly complex set of reactions called the visual cycle so first what happens is that the c-th rate now which light when light absorbs it is switched to all trans-rate now and this is the molecular switch that activates the pigment comes out so there's the covalent bond between opsin and retinal which is broken and opsin is left behind and then all trans-retinal is reduced to all trans-retinal which then is actually exported from the photoreceptor into the RPE cell and there through a set of enzymatic reactions is recycled to 11 c-th retinal and then this 11 c-th retinal comes back into the photoreceptor finds a free opsin molecule binds covalently and the pigment is regenerated again and so there is as you hopefully can appreciate there is a fairly involved process in resetting the visual pigment and the reason why rods take about 40 minutes to darken up is because it takes about 40 minutes for their chromophore which was destroyed essentially by the light to be recycled from the RPE cells and for the pigment to regenerate and this same process happens also in comfort receptors and for the last 100 years the dogma has been that the RPE cells is the only location for recycling of chromophore and the only source for chromophore for both rods and cons are the RPE cells however if you think about it if it takes the rods 40 minutes before the RPE cells can provide them with chromophore then how come the cons can darken up not in 40 minutes but in 2 minutes so something smells fishy something looks like it's not right and if you look through the literature over the last maybe 40-50 years you can see bits and pieces here and there of evidence that cons might use a separate visual cycle that is independent of the RPE and provides chromophore only to them and not to the rods and the idea was again based on biochemistry from multiple groups is that actually the milder glia cells in the neural retina itself might also play a role in recycling chromophore and taking all trans retina, the spent chromophore from photo receptors and then simply converting it back to 11-6 retina which will then come back into photo receptors be oxidized to 11-6 retina and used for a generation of pigment and so this was all kind of the state of knowledge and this pathway had been shown to again there were biochemical reactions mostly than from condominant species like chicken and ground squirrel suggesting that the mule cells might be able to do that but there is really no physiological evidence, no functional evidence that this pathway actually exists and it wasn't known whether it functions in rod dominant species such as humus or mice and it was not known what if any the functional role of this pathway is and so this is at the time when I was setting up my lab and I thought that it looked like an interesting question to tackle and kind of the proof of principle, the basic experiment that we did is conceptually extremely simple, almost embarrassingly simple and it's amazing that people didn't try it before us or maybe people thought it was too easy to work or maybe somebody tried it and didn't believe the results and so the basic idea is that if there is a pathway that allows you to regenerate pigment only in cons that does not involve the rp cells and instead involves the mule cells then all you need to do is basically dissect the retina out from the pigment epithelium so get rid of the rp and then expose this retina to bright light that will bleach the pigment and convert it to opsin and destroy the pigment in both rods and cons and then simply put this retina in darkness for an hour or two and then go back and examine the state of adaptation or the amount of pigment and ask will the pigment come back or not and so if there is another pathway that involves the mule cells the cons should darken up, they should regenerate their pigment and regain their sensitivity but if the rp is the only mechanism for providing chromophore we should see no recovery once we get rid of the rp. Everybody still with me so far? So how do we study this physiologically? It turns out that the sensitivity of photoreceptors is directly correlated with the amount of pigment that they have and this kind of makes sense is the more pigment you have in the other segment the more likely a photon is to be detected and to generate a light response so what we can do is we can indirectly measure the state of adaptation or the state of the visual in the visual cycle by simply measuring the sensitivity of the photoreceptor so if we place the animal or a subject in darkness for a long time and we allow all the pigment to regenerate in both rods and cones they will achieve their highest maximum sensitivity on the other hand if we bleach the pigment and prevent it from regenerating then the cell should be highly desensitized by orders of magnitude so again we can use physiological measurements to detect the sensitivity from there deduce what state of the visual pigment we are looking into so how do we study this we do this mostly in mice we've done some of those experiments actually also in primate and even human retina and what I'm going to tell you holds there as well so the basic approach is again pretty straightforward turns out that photoreceptors are polar cells they're essentially like a double A battery you can think of them as the outer segment as the plus sign and the inner segment as the minus sign and that's probably the closest I can get to a double A battery but so what is that current actually flows into the outer segment of the cell in darkness and then the current leaves through the other end of the cell so essentially there's current that flows along the photoreceptor in darkness and when you shine light this current is reduced or fully blocked and so what we can do is we can make a glass electrode that has just the right diameter so that we can draw the cell inside like that and so now the inner the outer segment of the cell will be inside our recording electrode and the current that flows through the cell will also flow through our suction electrode and then when we stimulate the cell with light and the current changes we can actually record the changes in this current and the beauty of this technique is that you don't have to break into the cell to measure the current that flows through and as a result the cell actually lasts a long time so when we do for instance recordings with amphibian photoreceptors we can fully dissociate the cells we can take a dissociated rod or comphotoreceptor completely detached from the retina get it in our recording electrode and record from the same cell and keep it alive for 5-6 hours so again you can do a lot of experiments on a single cell and so this is demonstrated here and it's kind of hard to see I know but this is an infrared image from a piece of mouse retina and you can see the outer segments mostly rod outer segments sticking out and you may or may not be able to see but you have to trust me on this is that there is one rod outer segment that was drawn in our glass electrode and so again when we do this and when we stimulate this cell with light we can record the changes in the current transient changes when we give a flash brief flash at time zero and of course the brighter the flash the bigger the response until eventually the responses saturate and so using this method we can measure the responses from single rod photoreceptors and if we take now the peak of each of those responses and plot it as a function of the light intensity of the flash that was used to generate it we can get an intensity response curve or a dose response curve for this particular rod and again because this is a mouse rod this is a highly sensitive dark adapted cell you can see that the cell starts to respond to as few as maybe 1 to 2 photons per micron square so extremely sensitive detecting single photons of light okay so this is kind of the baseline so now we can compare this cell with a rod that was taken from a retina that was removed from the RPE and then bleached and then kept in darkness for a few hours so no longer RPE around so no way to regenerate the pigment and when we look from a rod from a retina like this we find that the responses now are significantly smaller and a response that before gave us the maximum maximum amplitude this is the red trace the same flash now barely gives a threshold response at all again you see there is a little red trace here and if we do the intensity response curve for this cell again you see that there is maybe a hundred fault or more than a hundred fault decrease in the sensitivity you need a hundred times more light to get a response compared to the dark adapted so no surprise there the rod once you bleach its pigment stays permanently desensitized even four hours after the bleach so the RPE is really critical for the regeneration of pigment okay so what about the cons so we can do the exact same experiment in cons and this is shown here again those are dark adapted responses from a mouse cone and you can get in test response curve and now you need more light of course because that's a cone it's less sensitive but compare this to a cone that was taken from a retina without RPE bleached and then allowed to dark it up for two hours and the first thing you notice is that the responses actually come back the amplitude is all the way back and if you look at the intensity response curve maybe there is a two three fourth reduction in sensitivity but there is no way near the decrease in sensitivity that we saw in the rod and because this experiment was done without any RPE around the only way you can explain the recovery of sensitivity of this cone is that somehow it was able to regenerate a substantial amount of its pigment without any help from the pigment epithelium and as a way of understanding how this is happening taking place as the next experiment we actually pulled the cone from the retina and then we gave the bleach and in this case as you can see the cone was no longer able to dark it up and now the situation looks much like what we saw in the rods and so together what this shows is that the cones can dark it up in the retina with the help of cells they cannot do this autonomously but they rely on contact with other retinal cells and eventually we were able to show using pharmacology that the mule or glial cells play a critical role and they are the location where the chromophore is recycled and provides the dark adaptation in comfort receptors everybody still with me? okay all right so the kind of the emerging picture then is that whereas rods rely only on their RPE as the source of chromophore you can actually draw chromophore from two separate places one is kind of the canonical RPE visual cycle and the other is this novel neural retina visual cycle where the mule or cells provide the chromophore and through a set of experiments we have been able to show and most of those are published now that this pathway actually is what provides the initial rapid component of con dark adaptation and then the RPE visual cycle comes in later to complete this last default of sensitivity that the cons did not recover so one question or one preissue that we had not been able to resolve until recently is to find a way to genetically manipulate this pathway and the reason we wanted to do this was to understand what is the relative significance of this pathway versus this pathway in mediating the function of cons and also the long term survival of comfort receptors and so we started looking around and trying to figure out again a way to tease apart the two visual cycles and understand the relative contribution of the RPE versus the mule or cells in mediating the rapid regeneration and dark adaptation of cons and also their long term health and when we were doing this we realized that we might be able to do this when we found that one particular protein called CRLBP which stands for retinaldehyde binding protein is expressed in both the RPE cells and in the mule or cells so CRLBP is a chromophore binding protein and it binds specifically to 116 retinoids and so it's believed in both the RPE cells and in the mule or cells that CRLBP speeds up the recycling of chromophore by binding to the product to the 116 product of the reisomerization reaction and by a simple mass action law accelerating the turnover of chromophore in both RPE cells and in mule or cells. Patient there are mutations in CRLBP that have been associated with a whole range of visual disorders in people in humans and also mice where CRLBP has been knocked out has abnormally slow wrought dark adaptation. Again consistent with the notion that CRLBP essentially speeds up the recycling of chromophore in the RPE. So we wanted to know whether we can actually tackle the question what is CRLBP doing in the mule or cells and indirectly from there maybe get a genetic or molecular handle on manipulating individually each of those visual cycles as a way of understanding its function of significance. And so to do this we applied two separate recording techniques because we wanted to record the recovery of course in real time. So again I'm sure all of you are familiar with in vivo ERGs where you basically place an electrode on the cornea and then a reference electrode somewhere else on the body and this allows you to record the voltage changes across the retina when the retina is stimulated with light and you get this kind of prototypic ERG response consisting of a downward A wave which is generated by raw photoreceptors and it's just the initial rising component of the photoreceptor response actually which is very quickly masked by an upward B wave which is generated by bipolar cells and so using this again people this is widely used in the clinic I'm sure by some of you but also it's a very useful research tool in animal studies and you can do ERGs for mice and it's a very informative technique. This technique however has limitations especially when you want to study cone function photopic ERGs because the amount, the fraction of cones in human retinas or mice retinas is very small 3% to 5% and so the photopic A wave generated by cone photoreceptors is usually miniscule very very hard to see and so typically any photopic study that you will see is actually looking at the photopic or cone driven B wave because the B wave is much larger and so the B wave is a wonderful tool but it's an indirect measure of the function of cone photoreceptors because you're looking at the cell downstream from the cone not at the cone itself and so to go around that we've been using another technique kind of a variation of this which is ex vivo ERG so it's the same principle but now you dissect the retina again obviously you cannot do this with humans but with animals you can take the retina out and have an electrode on each side and then again you measure the voltage across but the advantage that you gain by doing this ex vivo is that you can use synaptic blockers to prevent the signal from traveling beyond the photoreceptors and so whereas in vivo you'll get the A wave and then the B wave ex vivo you can essentially block the B wave and what you will get then will be the A wave but the B wave will no longer mask most of the response from cones and so you'll get actually a beautiful response that will look like this which will be generated by the cones and you can study then the kinetics of this response, the amplitude and all that, the sensitivity and so we've used a combination of those two methods to study the role of CRILBP in the function of cones and this is an example of what we did in vivo so these those are in vivo ERGs from wild type mice mice that are deficient in CRILBP and that's just the gene name of the protein and heterozygous mice and again you see that the A wave which is the downward inflection in the response is relatively small but you can see a substantial B wave, the upward wave and if you compare, if you plot the amplitude of the B wave as a function of the flash intensity again you find that the wild type and heterozygous mice have normal ERG responses cone driven ERG responses but the knockouts have severely desensitized cones and also their maximum response amplitude is substantially reduced and so is this coming from the cones or is this coming from the bipolar cells because again the readout here is bipolar cells and so to go into addressing this question then we did the ex vivo ERGs and you see how you can get beautiful responses now those are driven from the cones and again if you think about that this is the A wave inflection that we see here but if we block the B wave pharmacologically then you get the full response that will look like this and that's what I'm showing you here and those are the controls cones and those are the knockout cones and so again in the absence of CRILBP cone sensitivity severely reduced the cones require more light to be activated and their maximum response is also substantially reduced so why is that? Are the cones fewer? Are they sick? Why is their response lower and why are they less sensitive? So to address this question we looked at the morphology of retinas and the first thing we noticed was that cone pigment was mislocalized in our knockouts so whereas in wild type cones, coenopsin is localized exclusively in the cone outer segments in the absence of CRILBP coenopsin was all over the cell and this is consistent with an idea that Rosalie Crouch has proposed maybe 10 years ago namely that coenopsin requires chromophore as a chaperone to be folded properly and to be targeted to the outer segment and when we take out this protein CRILBP we are essentially depriving the retina from chromophore and as a result coenopsin is mislocalized. We also noticed that there was degeneration so the number of cones gradually declined with age in our knockouts so it looks like again taking out CRILBP had both functional and morphological changes in confotoreceptors. So what about dark adaptation? Ultimately again we are interested in how this protein and how the two visual cycles affect dark adaptation of cones. So again we did this both in vivo where we can look at the dark adaptation of cones in the context of the intact system where both the RPE cells and the Mueller cells are still there and providing chromophore and this is shown here. So the basic experiment is you take an anesthetized mouse and you measure the sensitivity with a dim flash first in its highly dark adapted state and so that will be when the cones will be the most sensitive and then you expose the eyes, the retina to very bright light for a minute or two that is designed to bleach over 90% of the pigment in the photoreceptors and then you put the animal back in darkness and you follow how the cone sensitivity is coming back after this bleach and this is shown here again the sensitivity initially goes down more than 15 fold and then with time as the pigment in cones is regenerating their sensitivity is coming back and I should point out that because those are anesthetized animals the kinetics of this sensitivity are somewhat slower than it happens normally. If you do this in an awake animal or in humans again the cone sensitivity is back within 5 minutes so again you see how the time course of cone dark adaptation in the normal condition. What happens when we take out this CRLBP protein? Well what you find is that this dark adaptation of cones is largely suppressed and that's really a striking result for me because that's the first animal model ever that I've seen where cones are unable to darken out quickly. You can do so many things to cones and they always bounce back immediately. It's almost annoying because if you want to study the dark adaptation it's so quick it's difficult to measure but in this case again dark adaptation was highly suppressed in the cause for mice lacking CRLBP so how much of this is because the mule cells are not providing chromophore and how much is because the RP cells are not functioning well. You see that the late phase is compromised and we know that the rods that could up slower so we know that the RP cells are slower but in order to look at the mule cells we can do the same experiment but now in the isolated retina where the only way chromophore is getting to the cones is from the mule cells and so this is the example in the control so now again this is an isolated retina no RP and you see that again right after the bridge this sensitivity goes way down initially there is this initial recovery is actually the response that the cell turning off from the light, from the bleaching light and then there is this late recovery of sensitivity which is driven by the mule cells and if we kill the mule cells essentially we will get the recovery up to here so what happens when we take out CRLBP it's exactly the same thing so this recovery driven by the mule cells now is largely suppressed and so what this result clearly shows is that the mule cells require CRLBP to drive this recovery of cone sensitivity still with me? Okay alright so that's great so based on this we know that CRLBP in the mule cells actually plays a functional role because we can see how when we take it out we suppress the recovery of cones but we still have an answer to the major question which is how can we discriminate between the role of RP cells versus the mule cells so one way we could do this is to now restore the function of either the RP cells or the mule cells by genetically or by using a gene therapy approach to drive expression of CRLBP in one of those two tissues and so the idea is again to take CRLBP knockout mouse and use an IV injection as a way of gene therapy basically rescue one or the other cell that either the RP cell or the mule cell and then ask which one will give us more beneficial effect for the function of cones and so this is just a wild type retina showing the expression of CRLBP and again it's present and abundantly expressed in RP cells and it's also abundantly expressed in the mule cells that span the whole retina and of course in the knockout all of this expression is gone and so we again we worked with John Flannery and they made this really neat virus which allowed us to reintroduce CRLBP selectively in the RP cells by injecting the virus into vitrally and the beauty of an intravitory injection as opposed to subretino injection is that the virus can basically penetrate and give you uniform expression throughout the whole eye and again you see now that the RP layer in the whole eye expresses CRLBP and this is also shown in retina section so now we have normal RP visual cycle that expresses CRLBP but the mule cells still lack this protein so how will that affect the function of cones or not will that rescue cones or not and so what we found was that there was really no rescue at all so this is of course the isolated retina recovery which since we haven't rescued expression in mule cells we didn't expect any change so we are comparing injection of GFP control versus injection of CRLBP driven only in the RP but more importantly when we look at the function of cones and their amplitude of their response and their sensitivity it was not affected even though we restored the RP visual cycle cones were still desensitized and they had small amplitudes just like in our knockout so there was no beneficial effect from the RP visual cycle what about the retina visual cycle so we did the opposite experiment where now are restoring expression of CRLBP only in the mule cells but not in the RP cells and again you can see how the mule cells throughout the retina are expressing CRLBP what will happen with the function of cones now boom so now all of a sudden now we see both the restoration of dark adaptation in the isolated retina because we've rescued the mule cell pathway but more importantly we see a substantial increase in the sensitivity of cones and also their maximum response was increased and so what this result clearly shows is that a functional mule cell visual cycle actually is critical for the normal function and for the health of cone photoreceptors and when we take this pathway specifically out even if we still have the RP pathway still there cones become desensitized and I'm not showing you this but we also saw rescue partial rescue at least on the mislocalization of cone opsin and so what we think is happening essentially is that chromophore coming from the mule cells feeds into the cell bodies of cone photoreceptors where cone opsin is being expressed and folded and by binding to this opsin it helps to fold it properly and then helps to target it normally to the outer segment and ultimately this provides a healthy and functional cone photoreceptors and when the mule cells are no longer able to do that when they lack for instance CRLBP then cone opsin becomes mislocalized because there is not enough chromophore coming in from the mule cells and then cones eventually degenerate because of the lack of opsin and so to summarize what I showed you again we find that this protein CRLBP plays a critical role in supporting cone function and survival it is a key component not only of the RPE visual cycle but also the mule cell pathway and specifically in the mule cells again it plays a role in providing sufficient chromophore to sustain the function of cones and this feeds again into this more broad hypothesis that chronic chromophore deprivation is actually really bad specifically for cones and not so much for rods and if anybody is interested I'm happy to talk to you afterwards we are doing some experiments by switching rod and cone opsins trying to really understand how the differences in the biophysical properties of the rod and cone opsins actually modulate this higher susceptibility of cones to chromophore deficiency versus rods and again I showed you that when we slow down the mule cell pathway by knocking out CRLBP we get a substantial suppression of cone duct adaptation another way of saying the same thing is that the functional mule cell pathway actually is important for the rapid duct adaptation of cones so where we are going with this is that we are trying to understand how chromophore is traffic between the mule cells and cone photoreceptors what determines the specificity of this pathway only to cones and not to rods and finally the last point that I want to touch upon is what are the kind of therapeutic or functional implications as far as clinicians are concerned of the presence of two separate visual cycles and so there are many pharmacological pharmaceutical companies nowadays that are interested in developing drugs that target specifically the visual cycle there are many mutations for instance in rodopsin or in any of several of the enzymes in the RP visual cycle both in the processing of chromophore in rods and in RP cells that slow down the pathway and also lead to the accumulation of toxic byproducts which eventually lead to retinitis pigmentosa for instance and so again there are drug companies that are investing a lot of money trying to target this pathway and find a way to slow it down as trying to slow down basically the accumulation of toxic byproducts and so one cautionary tale into this is that any drug that is targeted has to keep in mind what happens with cones because as I just showed you adequate supply of chromophore to cones actually is critical for their long term survival so you don't want to spite your face and cut your nose because if you get a drug that works so well that it actually fully blocks supply of chromophore to cones you might protect the rods but you will end up losing the cones and so this obviously will not be a useful drug and so I think if you're targeting a drug to a reaction in the RP visual cycle that should work because you will still have the mule cell pathway but if your drug is targeting a reaction that is common to both rods and cones for instance the reduction of retinol to retinol then again you will slow down the overall recycling of chromophore and that might have detrimental effects to the function of cones even if the rods are protected in the process another interesting twist and something that might be clinically relevant is for instance what happens with retinol detachment so if you think about it the retinol detachment is kind of like the experiments that I've been telling you about you tear off the RP cells and so when we started publishing this work I got an email from a Dutch clinician who was really excited because he had this patient who had retinol detachment and he was able to measure scotopic and photopic vision in the detached area of the retina and what he found was that rod vision very rapidly declined but cone function persisted for days and days and days and one reasonable explanation for this would be that of course when you get rid of the RP just as I showed you today rods very quickly ran out of chromophore and stopped mediating vision but cones can still rely on their Mueller cell visual cycle and get chromophore and recycle chromophore and sustain their vision so again I think that there are potential clinical implications and particularly I think pharmaceutical companies that develop drugs targeting the visual cycle have to be absolutely sure that any drug that they test is not killing the cones in the process of rescuing the RP pathway and the rods. So this is what I wanted to tell you today again I hope kind of the message that you will take home from all of this is that in addition to the RP pathway which everybody knows is critical for providing chromophore to both rods and cones there is this other pathway which resides in the Mueller cells which is cone specific and it helps to regenerate the pigment only in cones and not in rods and this pathway has placed a critical role in providing chromophore to cones and helping to express and target cone option and in the long term sustain the function and survival of cone photoreceptors and so again with this I'll stop and I'll be happy to take questions. Thank you. So Fabulous. Thank you. It's great work. It shows even though people say this is an old cycle we've known and so on a lot of others a lot of still information. Exactly. Yeah. So once come out of our laboratories here is out of Robert Mark and Brian Jones lab about the fact that for a long time clinicians assumed that the rental system was kind of like wiring in your house and light bulb goes out all you do is you screw the light bulb in there and they work you fine and their work is shown to wipe out the rods and cones from any process you want to use disease and there's this extensive wiring curves that essentially neural tissue there's evidence down the brain as well if you're not getting normal stimulation those cells want to be stimulated so they don't work. What is your sense how much of the Mueller cells play in this rewiring and this transformation to this very bizarre language. I'm sure you've seen some of this. Sure. Sure of course. Yeah. Very bizarre. I don't know I would imagine so I think one kind of emerging theme is that the Mueller cells actually are much more important than previously appreciated for the function of specifically photoreceptors. I think now there is new data coming from Jim Hurley's lab for instance that metabolism in photoreceptors is closely tied to metabolism in Mueller cells and photoreceptors rely heavily on Mueller cells. I think it will be so kind of the long wind that that's a long wind and as the short wester is I don't really know how the Mueller cells are involved in rewiring but one way we've been thinking about asking the question in this question in the context of the visual cycle is there are diseases where specifically the Mueller cells are affected for instance in response to stress there is an upregulation of genes in Mueller cells they change their metabolism and it will be really interesting to see if some of those diseases there is an effect either on rewiring or in our case in the visual cycle and specifically on the function of cons. Again in some cases it might be beneficial again this upregulation of gene expression in Mueller cells might have a protective role or it might be kind of the early signals that drive the degeneration of photoreceptors.  If you kill Mueller cells the retina falls apart so again it's really tricky to study the function of role of Mueller cells because again they are so important and the moment you take them out the whole retina falls apart. So when we were doing, I didn't show those experiments but the way we showed that the Mueller cells are critical for the function of this dark adaptation of cons is we would take a retina and incubate it for a brief period of time in a gluteoxin basically kills selectively the Mueller cells and if we did this for an hour or so in a mouse retina we could show that the Mueller cells basically vanished, some of them not all of them and then we could see that the recovery of cons was suppressed but if you incubate it with the gluteoxin for 3-4 hours basically the whole retina would fall apart and we would not get anything out of it. So again I think that's a great point and the bottom line is that Mueller cells are clearly again much more important than previously appreciated and taking them out is probably not altogether is not feasible but if you want to study a specific pathway then if you have a genetic way of altering this pathway selectively in Mueller cells that will be very instructive and so that's the direction in which we're going, we're hoping to learn more about the enzymes involved in recycling of chromophore in Mueller cells and then target them and see how this affects the function of cons and the survival of the photorescent. Yes. Thank you. Yeah. Well is that really true though? So there are two issues. I think when you deprive of chromophore by vitamin A deprivation or by knocking out CRWP or any of the other RP, visual cycle proteins, so the cells are no longer able to respond to light as efficiently because they just have less visual pigment but the difference is that the rods don't die. So if you look for instance of the most dramatic at least in mice way of essentially fully blocking chromophore supplies knocking out a key pathway in the RP cycle called RP65 and if you take out this gene basically there is no chromophore in the retina at all but if you then take a mouse that is one year old that never had any chromophore and then you introduce chromophore back the rods will resume their function just fine but the cons will long be gone. So the cons die weeks after birth in these animals whereas the rods can persist for months and months and months. So again we think that there is some fundamental difference between the absence in rods and cons which again help rods to survive even without chromophore but in cons seems like chromophore is really essential for their long term survival. So what we're doing with again I don't have time to go into this but I'm happy to talk to anybody if interested afterwards is we basically made a mouse where we switched a cone option with rod option and the thinking was that we take this unstable cone option which requires chromophore and put the rod option which doesn't seem to care whether there is chromophore or not and this seems to have beneficial effect and enables cons to survive even in the absence of chromophore. So that's the bottom line. So it gives me a follow up question. As I remember in severe vitamin A efficiency, I'm talking about the level of vitamin A efficiency that tends to use people. But in histopathology there is broad loss of the cones but I can't remember. Do the rods survive in this? I know the cones just disappear. This is where people eventually are losing vision. I think the patient is an intern that actually died from the efficiency and had gone functionally blind other than some vision which fits what this does. I don't know. I remember that histopathology that was just broad wipe out seemed to be like maybe it was the cones and not the rods. That seems to fit again with what we see in animal models. It's not so much in the patients that I've had with vitamin A deficiency. There's still some specific delivery to the cones. There's something different because if you talk about it real, I don't think it's here right now. The cone function is actually preserved pretty well at least in humans with vitamin A deficiency. It's the rods that are down. The cones aren't dead yet. Until you get to the total crash with all bodies falling apart. If he's doing a full field of ERG then how much of his A wave is really, I mean his B wave is really cone function and how much of that is just the... You talked a little bit about the isomerase in archaeology. Tell me what you think is the state of knowledge of what's going on in the Mueller cells. Is it this one? Is it something else? So that's a thing still an active area of research. So what Paul is asking about is what is the enzyme that converts all trans retinol into levesis retinol. So Gabe Travis's group at UCLA published a paper a few years ago suggesting that an isomerase called DES1. DES1 is the one responsible for this reaction. We don't know yet. So the only way I guess the most straightforward way you test this is by just knocking it out and asking whether this will affect this pathway or not. And they have been suspiciously quiet for two, three years. I know they've been working on that and every time I see Gabe I said, hey, what's going on? When is this mouse coming out? And we haven't seen any results. So this is why we actually went for the serial because we were waiting for somebody else to knock out a key enzyme from this pathway. So I don't know, again I'm not... I don't have a stake in this fight. There are people that believe it is. There are people that believe it is not. Ultimately, again, somebody has to just do the experiment and find out. So I mean one of the problems with DES1 is it's a very nonspecific isomerase. It just, it equilibrates but it's not very efficient making 11 cis. Well RP65 that's what it has. Sure, sure. So when you knock out C-R-A-L-B-P and you remove the cells, do you see lots of different isomers? That's a great natural question. So we've actually been looking into that. So and our thinking was exactly this, is that DES1, so this isomerase in mule cells, seems to make more nicest retinal than 11 cis retinal. Whereas the isomerase in the RP cells makes exclusively 11 cis. And so we thought maybe some of the chromophore coming from the mule cells would be nicest. And we should be able because nicest can bind to ops and inform a visual pigment. But it will be blue shifted. It will have different spectral absorption properties compared to 11 cis pigment. And so we, by measuring the spectral sensitivity of course we should be, we thought we should be able to discriminate between nicest and 11 cis pigment in course and see which one is coming back from the mule cells. And so we've done this both in amphibias and in mice and we see no evidence for nicest retinal which was kind of bothersome. But then we actually looked at the C-R-A-L-B-P knockout mice. And one feature of C-R-A-L-B-P is that it binds specifically to 11 cis and not so much to 9 cis. So one possibility is that C-R-A-L-B-P actually favors by binding to 11 cis, favors the production of 11 cis over 9 cis. And indeed when we looked at mice that lacked C-R-A-L-B-P we saw evidence for about 50% nicest retinal in those cones. So we think that again the DES1 is still a viable candidate because if you take out C-R-A-L-B-P you seem to get a lot of nicest in the comfort receptor. But that's a very insightful question. Thank you. Okay thank you so much.