So, if you are already in the Sources panel and want to log some values without triggering a breakpoint, you can use logpoint for that. You can log multiple values and expressions just like the console.log. Hold the command or control and click on the line. Select logpoint and type in our expression. We want to log the list and the total items in it. That's it. Repeat the step again and BAM! The values are logged in the console.


Every time that I do wear them, I actually enjoy them more and more each time. Because I'm happy, c'mon. I'm gonna do a review today on Homeland and Amberland by Happyland Fragments. Two new fragrances that EJ Wells sent to me after I did top 10 or top 12 of my favorite Happyland Fragments. I went ahead and listed them all. These were two of the newer ones, so he sent me nice one ounce samplers here so I can give you guys my two cents. I mean, he gave these to me back in January. Initially, I smelled them. They're just 100% 80s and 90s style fragrances. If you know anything about my channel, I'm not the biggest fan of 80s slash 90s style fragrances. Now I know people will put them in their highest list and some of their best fragrances ever. I don't know what it is. I don't really go towards those generally. So I kind of postponed doing a review on these because I didn't want to just make a review saying, you know, oh, I'm just not really into 80s slash 90s style scents. I've actually wanted to do a review on this for a long time and I've actually worn these probably about four or five days each. And every time that I do wear them, I actually enjoy them more and more each time. So let's jump right into homeland again, like an 80s slash 90s style fragrance. This is probably DJ's most right down the middle style fragrance that I've smelled going after a normal style cologne. Usually he has a lot of different style fragrances. They're not really just, you know, a classic man's signature style scent. And this is kind of like, I would say his signature. I think he has a homeland extreme, but this one actually lasts pretty long. The notes are lavender, citrus, wood notes, bediver, amber, green, very classic style notes. Not really too much of anything adventurous, but at the same time, classic notes that are used in everything. It doesn't surprise me. This one lasts probably a little bit longer than amber land. To me, I'm not really, but I definitely do prefer the opening to me personally. On the dry down, it's just kind of a little bit average to me not taking anything away from it. And again, it's not really my style fragrance. I'm sure there's somebody, if you like 80s slash 90s style fragrances, this is probably one of the absolute best I recommend that you try for sure. Smell rating of eight, likability of a 7.5, just because it has a little bit of those data qualities, but it also is very good.  And they also have an extreme version if you want even more strength. But I did find that this one lasts a long, long time. I think I sprayed this in the middle of the day yesterday and I could smell it on my hand in the morning and I sprayed this on the other hand and I didn't really smell it in the morning. But let's jump right into amber land now that we're talking about it. I did prefer amber land to homeland because it's almost like a sweet likability similar to ozone, similar to highly blended amber style fragrances. And like I was saying, it doesn't last as long, but the dry down on this stuff is absolutely heavenly. I didn't really smell any of the negatives. I wrote down the notes here. Bergamot, orange, labanum, labanum, something like that. Petruely, sandalwood, vanilla, amber, the lavender was in the other one. But I think the lavender and the petruely contribute to that classic style vibe that I get in both these. I was super surprised by the dry down of this one yesterday. None of that 80s slash 90s style vibe that I got in the opening. And even then that vibe is a little bit muted. It wasn't as strong as homeland, but I wouldn't recommend these scents if you just don't like 80s slash 90s style scents because you're just not going to like it. But if you're like, yeah, I really do like it. If it's well done, if it's high quality, if it's well blended, and these are a hundred percent just fantastic. The more I wear them, the more I enjoy them. And I think for a lot of people, this is probably one of the higher recommended I would recommend for kind of older guys. If you want to get into happy land fragrances, I like their Raya lights. I like their paisley sky. I like a few other ones, but Raya light and paisley sky are kind of a little bit extreme, maybe a little bit more youthful, a little bit just more straightforward, sexy. These are a little bit more robust, more classic style fragrances. And then I know there's a lot of style people who these are probably some of their best offerings from happy land right here. That's been my thoughts on Amberland at Homeland. Two very good fragrances. E.J. Wells, I've read something on Facebook that he wasn't doing too well and he had to shut down the happy land store temporarily. So hopefully you're feeling a better E.J. Wells. Sorry for taking so long in this review. And actually it was a good thing because I got to test these more and I actually really, really enjoyed them. And you guys know how much I really like happy land fragrances. I don't think I've smelled a bad one yet. I just really, really enjoy them. Let me know if you tried happy land fragrances. Let me know if you've tried these two. I definitely think they are very solid. But again, my favorites are probably Raya light and paisley sky. And maybe there's another one for I forget I'll put it on there. But Raya light and paisley sky. I absolutely love them. This is by my two cents. Like, comment, subscribe if you enjoyed the video. We're on the road, 25,000 subscribers. I couldn't do without any of you guys's help. You guys are the best. I'm having a great day out here. Hopefully I'm having a great day at home. See you all in the next video. Peace. Two new fragrances that you would.


News for the live stream. So everybody we've got a lot of things to cover so let's just jump right in we're gonna talk today about is a little bit of everything first we're gonna take a look at Correlation between the traditional market and what's going on our market and surprise. It's not like it's that correlated We're gonna do some quick on-chain analysis. I'll take a look at who's in the money and who's out We're gonna do a quick three to 15 year price prediction Also, we're gonna talk about some insider trading allegations from Coinbase and you've been around like I have you'll probably remember the example I'm gonna give which is the Bitcoin cash listing and then finally we're gonna talk about DeFi how it is number one For DeFi exploits scams and revenue loss. So we'll take a look at all those things But first, let's take a look at the market. So if you're here for the live stream, thanks Thanks for stopping by I appreciate it usually we do these a little bit earlier But we got a couple of things going on. So there's a little bit late So we'll do the news. It's about 10 or 15 minutes There's gonna be time stands below so you can check out if you're actually watching the replay So let's jump into it and get going. So first off the reason why I'm late today Because we're building this also, of course it's a charity event me and the wife do twice a year here in El Paso and It's for underprivileged kids. So this morning.  So feeling pretty good about that. That's the reason why so the next couple days Will be a little bit choppy as far as the times of the show So speaking of which why you really came here the market. So the market itself is doing not too bad I mean, I'll be honest with you. There was some earnings reports Apple came out and said that they had actually beat some expectations. I think that was one of the big ones and They're up for almost 5% today and for the crypto market That's good for us because that means we're up a whopping 0.7. Listen, I don't care what it is as long as we're up That's the big thing and then just remember that even though our market might not be in the all-out parabolic bull run There are many bull runs to be found in certain places and if we take a look down There's this coin called a coin. I just want to say congratulations all the a coin holders I didn't buy into it because I didn't get it and there's gonna be a lot more that I'm gonna miss but we have to be happy for each other because like I've said before crypto is one of those things that's We're it's us against everybody. So when you got some winners rally around those people and say hey, good job Congratulations for sticking it out and it actually worked out for you. So good jobs a coin holders So that's what we got and then in the comments section. Let me know anything about the other earnings reports I don't know which ones are coming out But seems to be doing pretty good except for of course the dip that you've heard about for the GDP Which everybody's been talking about 1.6 percent So yeah, just remember also one more thing and that is that there's a big difference between Wall Street and the economy the economy is not Titched to Wall Street itself. It's a totally different realm. We say that over time and time again So yes, we're actually slowing down in goods and services provided But that doesn't mean the Wall Street can't pick up that doesn't mean that crypto can't pick up either So that's what we got and then if we take a look at actually the market itself traditional market It was a good day for S&P 500 holders as well. So they're up 2.47 percent But my thesis was always this we were in lockstep with the NASDAQ and if we take a look at the NASDAQ today It's brutal. I mean all honesty down eight percent. Look at that. And that's a oh, sorry Excuse me. That's one year. Ah, just kidding. So yes, we are still we are still in lockstep our crypto market I feel is Kind of going in line with NASDAQ when NASDAQ is up We're up when NASDAQ is down we're down when it's going sideways we're sideways now It's not perfect, but that's just how I see things. So let me just think about that in the comment section Let's take a look at just some quick on-chain data and this is um There's been a couple. I read all the comments That people post for every video.  So, uh, I mean I don't really take too much Uh Stride into it, but some people just not too happy and I can understand why But a couple of people have said, you know what? There's a lot of people out of the money As far as like investing in the crypto and if and I was thinking about like I wonder You know, if there's some on-chain analysis for that and that magically there is So this is uh into the block one that I like using a lot this one in ben's website, but uh, it shows us That if we take a look at all the addresses for all the bitcoin wallets that are out there Uh, and we take a look at the price right now and they have it listed at 38,920 It could fluctuate a little bit, but right now just for bitcoin itself In the money, which is right here 60.88 percent of people are in the money Out of the money is about 29 28 and a half give or take and then right at the money are somewhere in the in a very small range of people That are actually not losing and not gaining is about 10 percent. So I know like I know a lot of you got into crypto in 2021 I know because I've done a couple polls and everybody's told me that So I know it just seems like when you're here when you're other places, you may think like, oh You know what? Everybody's out of the money But in reality, it's not and all these people here that's 60 percent. Those are the ones that just said Okay, I'm not going to be rich tomorrow It's not going to take a week or a month or even a year It's going to take a lot longer and they just did the laziest thing you can possibly do Which is not sell and just hold on to it and just wait and that's really what it comes down to Now I can't give you financial advice. That's what I've done and it's worked out Okay, so far Depending on the actually altcoins that I get into and that's a whole other video So that's just a little quick on-chain analysis and then also I wanted to show you this This chart this is from ben's website Into the cryptiverse. There's a link in the description non-affiliate link. Just I love using it And uh, there's two things first of all if we take a look at roi for the monthly returns statistically Let me Pull this up so you can see it Statistically april's a pretty good month in all honesty In 2021 we're only down one percent 2020 it was Europe 34 20 19 28 31 you can see there's a lot of green Just for april. I think the next best one would be february actually go figure, huh and then uh December november october's a really pretty actually october's a really good month So it actually fits in my thesis about selling man go away, which I probably will do I'll probably sell a good amount depending on what's on chain metrics and even a little ta might tell me But I'll uh, I'll talk to mo it on that one. Maybe he'll give me some insights But april this is the worst april thus far on record since 2011 and we've got the Couple days two three days left and uh right now. This is a brutal brutal month So we'll see how it goes and that's what happens when we zoom in we zoom in we see these things like well That sucks. That's a crappy month. Now. I want to do a little bit something And just zoom out for a second. I mean really zoom out so This is uh the crypto market cap and tread line and what you can see here I show this a lot of times, but there's one thing I want to show you today So it'll show us What the fair value market price should be or could be And the fair values around that's in may hold on 1.63 trillion. We're actually above that 1.9 And of course the upper band is 9 trillion that'd be sweet, but it's not lower band Thank god. It's not this 500 billion in it. So we're looking at that. We're like, okay So we're just a little bit above. All right, we'll take it right, but there's this and of course we can go up we can kind of see it but Check this out on the log line extensions if you go nine years Just I'm just gonna go nine years for a second, right? So 2022 see this red light right here red line. Let's just follow this up This is what it could be This is what it could be not what it is, but just in 2023 we could we could see three trillion again 3.9 and 24 Five and again 2024 six trillion seven trillion nine trillion 2025 Imagine that in three years. We could be at a fair value Listen to this a fair value of nine trillion Right now the fair value that we are sitting at is below what we're at right now 1.64 trillion So you're telling me that in three years We could be at nine trillion What is that like a five x roughly four and a half x something like that And then if we keep going out 14 trillion into actually no, let me let me go back. Let me go back 10 trillion 16 trillion and not to say this could happen, but if we go out we can really see that things get a little crazy April 2 2031 I don't know if we're all gonna be here, but let's go out 15 years just for giggles 75 85 95 100 111 this is 2030. This is in 10 years a decade from now Imagine a fair value of 111 trillion and then going even further 357 trillion in 2037 now with inflation Those might be the numbers that you may think it is and as far as the price But if you're here and you're looking for like something to really put your money into as far as generational wealth These are the things that I see for my kids and grandkids and just something to think about Of course can't give you advice. This is just what i'm doing So let me know which thing about that in the comment section. Let's break into the story today This will be quick insider trading so this was a pretty reasonable article about what's going on in coinbase and Before anybody sues me. Let me read the whole thing giving my assessment here. So Following insider trading accusations coinbase moves to a more stringent review system so Let's hope so. Here's what we got when we blow this up So CEO brian arms wrong of coinbase said his company would make changes over the next few quarters to prevent on-chain data From being utilized by savvy traders Until now, I didn't know this was actually a thing and I wish I did Until now traders have been able to use data to detect when the exchange may be testing for new digital asset integration Or via changes the platform's api responses to those products Basically what they're saying is like they can look at the on-chain data and go Oh, this one's gonna be listed pretty soon. We should probably invest into that and then off they go and invest Coinbase said it would attempt to prevent on-chain data from giving a signal to watchful traders by removing those Information asymmetries. That's the first part And then also we addressed the company employees which They have actions of buying up certain assets Before it was announced or listed on the exchange before I go on There was a famous Well famous for me if you're here in tons when this is going to be a nice little story for you in 2017 they Coinbase had roughly correct me. I'm wrong. It was four different cryptos it was bitcoin ethereum litecoin Something else. I forgot the other one. It wasn't excerpt. No And it was very few and that's all you could really get and then all of a sudden they started they were going to add one more And everybody's like, what was it? What is it? Right? I know it's below 10 and they added a bitcoin cash on december 19th 2017 and it was a weird day weird actually four or five days before that and the reason was So December 19th is right here December 19, 2017 it went from it hit 3,785 which was very weird because Just Six seven six days ago. It was below 2000 And just a little sideways action and all of a sudden and then everybody everybody saw this I mean I saw this and I was like, what's going on big crash went from below 2000 2200 2800 and then 3700 on that day and it was like Hmm. How the heck did everybody just know that and do it and of course the assumption was That's somebody who works in coinbase told somebody who's told somebody told somebody that's insider trading And that's probably what it came down to now. Do not sue me because I those are just unsubstantiated rumors But it does make a little bit of sense So on that part armstrong reiterated the company maintains strict policies that attempt to prevent instances of insider trading you could all employees trade crypto solely on coin basis trading platforms As well as having a dedicated trade surveillance Leveraging advanced software to investigate potential abuse. Here's the thing though. Very tough to stop that I would assume because if you get somebody who works there How hard would it be to tell a friend of a friend? Hey buy this stuff. It's about to be listed although There isn't the coinbase effect as there used to be because now they have so many different cryptos on there And then to finish up the company also said it was labeled newer and less proven assets in an effort to educate potential traders on the risks which they've done right now for the end step tokens or step in tokens GMT and GST they say it's very New and they should do their own research So I guess a good step in the right direction and lastly The exchange said it would continue to improve its evaluation capabilities by reviewing the tokenomics giving you tools And brian said we won't catch everything but these investments will help us get better And we may be able to open source these approaches and standards to the industry over time These are still early days for crypto and it's going to take time for us to figure everything out. Well, here's what I say about that brian armstrong is Absolutely, right It's true What he just said there and I got to tell you I've given coinbase a lot of flak for a long time because of their their outages and their different problems that they have and customer service is just abysmal but I mean look at some point. You can't really do it all or much I think they're moving in the right direction and uh, I got to tell you it says something that the CEO goes Yeah, we got problems. We're trying to fix them and we'll do the best that we can now. Will they do that? Anybody's guess, but I do appreciate the effort. Anyhow, let me just think about that in the comment section and let's move on to our last piece and I call this I forgot to say this. It's not what you make. It's what you eat so That little story that we just talked about insider trading that doesn't just happen coinbase I don't know if you knew this, but if you're a trader, just know that insider trading happens all over the place for crypto And the thing is we only have like two trillion market cap Like if you've ever seen those those videos where I talk about all the money in the world The stock market has over a hundred trillion dollars real estate is over 280 trillion dollars and then options and derivatives have a quadrillion dollars So for a couple trillion dollars is a drop in the bucket. It's very easy to manipulate those especially in v5 what we're going to talk about now so Really all's it really comes down to it's not what you make. It's what you keep Insider trading was of things but also on the next one as far as uh defi so It doesn't matter if you make a boatload of money on a project and you know, you know what? I'm just going to get some super huge yield on a defi product Well, but all gets rug pulled where you at just the cautionary tale So this is a report 1.3 billion in crypto stolen a q1 2022 and 97 percent were from defi just something to think about so last year 3.2 billion in digital currency were stolen Just last year just 3.2 billion That's not bad And so far 2022 has recorded over 40 percent of 2021's aggravate during the first quarter alone So we are exceeding expectations as far as the amount of assets stolen in a very short amount of time Why is that? Well, it's because defi is growing. That's what really comes down to and people get greedy when they see like a thousand percent yield Like that sounds good No, I mean it's up to you. I can't tell you much dad So in q1 2021 only 72 percent of the stolen funds derived from defi and in 2020 The number was as low as 30 percent easy enough. There wasn't many defi products out there. So it only makes sense Most of the theft in 2022 came from faulty code exploits. Let me say that again Most of the theft in 2022 came from faulty code exploits where smart contract errors Were used to siphon stolen money from defi products. So it's our protocols. It doesn't matter It's it's not about there's some super genius hackers out there that are able to do it it's because These defi projects they go a little bit too fast and too loose with the code and before you know it They're like, whoops, we forgot to close that loop and then there it goes I am not a coder so I can't speak to this but It does as a layman just looking from the outside in Seems like we need a little more security just saying And but there is some good news centralized exchange hacks have dropped and centralized exchange hacks only account for less than 15 of the stolen cryptos So that's pretty good because uh, even like binance I mean, of course mount gox is the biggest one But even binance have been hacked for their hot wallet and that's becoming less and less common Because they know that they can't screw up So they put a premium on safety and security. So I applaud them for that Common defi protocol hacks came in the form of flash loan attacks and security breaches Of course the rona bridge attack Which saw over 600 million dollars lost and that's is the story mourning glory right there It's again. It's not how much you make.  I know this is like Not the sex used video, but really you think about it You worked hard for this money you worked hard for dollar cost averaging or trading And uh, you know buying the dips and all the good stuff. So just be careful out there and that's it So that's it for today's stories and news. So if you got to take off the o's thanks for stopping by do appreciate it If you like to uh, stick with us for the little q&a We'll just do a quick couple questions. See what you guys got and then we'll get the heck out of here So let's do that Let's see here banners Ah quite a show, huh? All right, lola green Where'd you go? I just saw you Okay, lola's got a great question Now that celsius cannot give interest to non-accredited investors and before we go on Just know that that is not accredited investors in the u.s If you were in canada or mexico or eu doesn't matter for you that does not Mean anything for you. It's just that america sucks in this part and they want us to stay poor I guess so non-accredited investors you can't get yield on Um celsius if you had tokens or cryptos in there before april 15th and don't move them You can still gain yield on that but anything you put in there new and you're a non-accredited investor meaning you make less than 200 000 per year or you have a combined uh I think income of a million or if you have a corporation over five million Then you can become an accredited investor fill out the paperwork or fill out the online form for celsius So could you evaluate vault and hold not Hold not exchange they give interest in crypto. Sure. I'll put it on my list of things to do I've only got 30 other things ahead of you. But yeah, you can do that and then also just remember If you're in the u.s Voyager still does that They still give yield. I think crypto.com still gives yield and a couple other ones. I think I don't I don't think ftx I know binance Does and they're they're pretty big, but uh, yeah, I'll take a look at that. So just so you know, all right What do you think of? Oh, yeah This is the second question. Hey, rob. What do you think of anatoly? Yakovenko nailed it. Solana founder. Thanks Saying that bitcoin needs to go proof of stake or fail. I don't What I see bitcoin I see it as the most Secured network in the entire planet And the reason it is because there's no single point of failure like you've got a bank account. I know you do Most of you I mean if you got an internet connection probably and uh For the for those bank accounts, there's there's single points of failure for where they can get hacked And you know, your information has been stolen numerous times. Just look at all the different breaches that facebook allowed even ledger but So when I take a look at a bitcoin, I don't want to go to proof of stake I don't think that's that's the whole point of the whole thing I think the proof of work aspect many making it the most secured network on the planet that has real world utility And I think that's what a lot of the people that don't really understand Bitcoin as just some crazy internet money that we have to dump a bunch of electricity No, no, no, you can put anything in there and it's Safe, so I'll take that All right Mm-hmm Yeah This is a good point. Why do people worry about e2.0 coming out? But never worry about slana and beta and it's constant shutdowns. Well, first of all, it doesn't have shutdowns a lot of them They have slowdowns and there's a difference between like and We can talk all day about this slowdowns versus shutdowns I mean, it's still a degraded performance right for the network So we'll call a spade a spade and that's what it is and there's no layer two that fixes security flaws Only time will tell and really it really comes out of the free market Which ones of these projects are gonna pick aetherium versus avalanche versus cardano versus slana Let the free market decide and then you just kind of look out and go Which one should I invest into as I do my own research? Any thoughts on hex and richard heart, I bet richard on the show seems like a nice guy Hex not for sure Just like we talked about ape coin and I missed out on that I'll miss out on a bunch of other things and Hex is just something that I just don't really I mean, I get the whole process of locking up and all those things. Great. I just That's boring I'm sorry. And of course If it's just about numbers go up. Okay, great That's uh, I don't really again. I don't get it. I said I don't get a point either I do the other stuff. I mean like, uh, the metaverse plays and the play to earn gaming I understand that that to me that makes total sense as far as utility But for this stuff Gary hates us all Gary ginsler is trying to protect you. Don't forget that that was sarcasm. All right Coincidence says dan wears on money.  Just so you know you see that Right underneath here where it says dan will never contact you I will never contact you So whoever contacts you and asks you for money That's not me and if you want to figure it out to like if you if it was a scammer or not God dang, I hate doing this every single time Yeah, let me show you on my screen. There it is Yeah, it's putting digital ads on new scam. There's a video It's about eight minutes long and it shows you exactly what the scammers and the spoofers do for my email And how they're able to track you down and get and sucker you out of your money That's why I put this thing right dan will never contact you. So if that's what it is coincidence, let me know because uh That's never gonna stop All right. Oh, it's a good question Hey, dan. Hey rob. Would you recommend manly doing my dch week or set up automatically do it each week? I don't I can't tell you what to do but I can tell you what I do I just set up a voyager and it's the same thing every day It's uh, it buys bitcoin and ethereum and luna and cosmos and Crap there's one more and oh usdc. Yeah, I buy usdc because it's on my debit card now from voyager so, uh, I just do that automatically because I get kind of lazy sometimes and also the emotion of the market gets me a little bit even me So i'm just like, well just set it up and let it go. That's it Ah, thanks dromama It's funny ftx dev does give yield Let's see And then of course Yes, dan will never contact you period. That is true Hex is a rug pull way to happen On top of the 30 other comments I just got before about how great hex is So look You're wasting your time with me on hex. I'm not going to buy it. So sorry And let's see rob. Would you buy phantom? I have bought phantom. I actually have I own some right now And last question. This is a great question rob. Is there a reason why your videos are so late every day? So today it's because we're doing that obsolete course for charity That'll be done by saturday. Also. It's because uh, i'm not in portorico right now portorico is uh, right now It's on eastern santa time. It's actually atlantic santa time. So it's two hours ahead So usually what I was waking up at usually I wake up every day about 5 5 30 Which is 5 30 eastern time and that's uh 7 30 here. So i'm getting started late And that's just how it is. So yeah That's it. All right And that's it. So well everybody 26 minutes. I think that's good So thanks for stopping by. I do appreciate you like this video and give it a thumbs up Or if not give it a thumbs down that button's broke also consider subscribing Let me do this every day and I will see you on the next one. Thanks everybody. Adios


Okay Our next speaker here today is Vincent Osamann. What? Osavada Vincent's a long long-time participant of these events has been coming since I think the Galactic Hacker Party and Long career in information security and payment security, but today he's gonna be talking about a subject also very close to my heart boats and About some of the onboard protocols used and some of the possible vulnerabilities in those so please a warm welcome to Vincent Osavada Thank you so much and Welcome to my presentation For something about me as you already mentioned I'm a long participant in These events I have a whole bunch of t-shirts at home of all the events have been in fact The only one that I missed was the Intergalactic Hacker Party in Paradiso because I was too young to travel on my own to Amsterdam by then But since then I've been to almost every event that's been held in the Netherlands I'm also an active sailor boat or anything that floats or is in the water I'd like to be on it and I'm Enthusiastic about it, and I'm a crew member. I've been sailing a lot of miles or across the sea And I'm a real enthusiastic boater in my daily life. I am Active in the payment security industries. I'm a qsa. So anyone that has anything to do with payments Probably has hated me as your PCI auditor But that's not what we're gonna talk about today. We're gonna talk today about boats and about security and safety onboard and with ships We are And I'm talking about we because my colleague Rogier was here in the room We did all the research and all the stuff together. So we are a big thanks to him as well And we have been taken a look on how secure or insecure the design and the communications of vessels and interfacer communication is Which one of you has any prior knowledge of boating over Any so that's that's very good We came to this talk after research of a lot of onboard electronics And it has been a road that brought us into places We've been to Barcelona to go to one of the biggest harbors in Europe in order to have a look at how big super yards are actually protected For their onboard systems here you can see Rogier on the Dock of the ship in Barcelona not showing on the picture is the security cam Which was right above him and filming everything for this Russian billionaire yacht where we are sitting at But we've also done some research on our own vessels So this is my sailing yacht and you can see her on a sunny day, but it hasn't always been sunny So then we moved downstairs and went into the boat itself As we take a look at boats, this is what people normally perceive of boat navigation In ancient times boat navigation was just a steering wheel to get the ship from island to island but now it looks more like a cockpit of a aircraft or a Lot of screens. So this is actually a picture of a large vessel and this is a picture of the Marine Control Center in the Helder where they track all the all the ships you can see a radar screen Just on this screen and you can see a map up there which displays every target that is in the sea currently So this central command is able to safeguard all the ships into docks or into harbors across the Netherlands Which is quite important because Netherlands harbors one of the largest harbors in Europe It's the second largest harbour. So it's always a very busy shipping lane up there This is a glass bridge on modern Normal yacht and you can see here that modern navigation is more in screens All these screens are just available on consumer electronics This is just regular consumer electronics, which is fitted on a yacht that is normally Which which you can normally drive yourself And of course for all the sailors Among us this looks familiar here. You can see how navigation takes place on a sailing vessel In fact, you have the same data, which is important for your safe passage and why is that important in Onward systems and safe navigation has always been a very important part of marine traffic You can see a paper map in here, which is not something from the way back machine But in fact, it's still the predominant way of navigating right now if you're on a vessel Every boater has his paper charts and still has to learn how to navigate with all these old-fashioned tools Like a ruler and a pencil modern ships Do have some advance advancements ships normally have Sensors that censor every part of the ship in order to safeguard a safe and comfortable Passage and why is that important as you know ships do not cannot see the road So you do not see how deep it is on the water you cannot see how quickly you are moving and By navigating on the water you also have to do with tides and with waves and with wind So it's necessary to have the proper amount of sensory electronics In order to measure how your ship is moving towards a safe and navigational passage And there's one just one law of the sea that you Immediately learn if you ever venture on any trip outside the inland waters That the rule of the sea is good seamanship is rule number one So whatever your legacy there is telling you whatever the local laws are good seamanship and safe passage Is rule number one So what are we what are the typical sensors that we need we have a sailing yacht here But this is also true for any other yacht every boat owner knows about these because they always break You'll always have to refit them once in a while. So we have a depth sensor We have our wind sensor you have a temperature sensor which temperatures the sea and you have a speed sensor This is just the regular basics of any vessel editors. It's normal what you need here As you can see by the way Sorry for the Slides all these sensors they communicate with each other Along a bus and the orange line which ends up at the end of the ship where the people that stare the ship Receive these data on these screens. So you've got a temperature. You've got the depth You get the wind meter up here and you got the The sensors up there. This has all also done some sensors up there So if we take a close look at these systems, what are these actual systems? these systems are analog systems that produce analog data and send it over to Screens into measurement needles. So on the left part you have a measurement needle that is Viewable by the captain or by the skipper and then all these sensors produce any data and they send it along to the bus And this bus is speaking a protocol which is called and Mia 0183 This and me a protocol is part of a standard. It's not a normal protocol It's a protocol that's being used for a lot of stuff and it's a standard published by the National Marine Electronics Association and why is it published there and why did they make it they made it? So you have interoperability between different vendors and different systems and you probably know about it because this is also the protocol that many GPS systems output also GPS systems that are just a household GPS systems outputs and Mia 0183 and If you take a close look at it, you can see that it's a protocol based on serial links Well, we know what serial links because we are in the IT stuff. So we know what serial links are and what they what they do one of the things One of the things important is that a device has a certain role a device can either be a talker or it can be a listener And you can only have one talker and multiple listeners in theory on a system So that is the reason why you have for example one depth sensor and you can see that into multiple screens These are examples of and Mia 0183 Messages you can see them just by clear text. You can see them just going around with a message and with a Data block just as we would normally perceive. This is if you take a close look at it and you can see some IA some other Traffic as well because you can easily capture that if you have the right equipment And Mia 0183 was designed in 1983 1983 This was 1983 which of you has been born before 1983 So and after so these systems were being developed before you were born This is what the current Fashion industry was in 1983 and you also may might have one of these cameras sitting at grandfather's or grandmother's home The computer show was introduced by then and of course everyone had access to your computer by a telephone So this was the year just to give you a slide or just to give you some examples This was the year when one of the predominant protocols was being born and was being made that is still in use on all commercial vessels in the sea and on our waters So in 1983 we didn't have encryption. We didn't have any authentication We didn't have confidentiality. In fact the old CIA triangle, which is a normal concept in information security was not there then Security was just not an issue in 1983 Skipped through it to today you can see that and Mia 0183 is still the predominant standard, but as time advances some people have more Requirements on their traffic. So a new protocol was being built in 2000 and you can already guess what's name it was it was and we had to Okay, I mean it took a added some extra stuff to the protocol which can be used on a vessel So it added the possibility to do high-speed communications over your bus And it also changed the way how these systems work in and we are one a three You had one talker multiple listeners You had a link between one device and another but it changed in and Mia 0 to 0 0 The concept of a bus was introduced and also prioritization So in order to make sure that all Stuff was being able to work on your boat. No one thought of replacing this stuff. No, let's just build a converter. So Today's system still speak and Mia 0183, but in order to read them out on Sophisticated sophisticated equipment. We have a converter box which converts these standard messages into a bus and As you all know if you're talking about a bus if you're talking about a converter You can easily do a lot of stuff that you probably don't want that's not all in Recent times we've seen the development of wireless connections towards your ship And of course any vessel is not a real vessel if you're not able to do it by the Wi-Fi's So we have on the left part on that part of the screen We have our multifunctional device that is capable of reading out all your systems in your ship Which is in this example communicating with a new kind of radar device over Wi-Fi on the Middle part you have this converter which transmits Wi-Fi towards your Normal systems and why did we do it? It was new. It was never seen before at the state of the art technology You don't want to ship without Wi-Fi. You don't need any wires. It's perfect But it does have some disadvantages because if you're able to connect to a radar Wait a second if you're able to connect on the Wi-Fi network on a radar You cannot see which device is connecting towards it. So let's have a look at it under the hood this radar dome Which is one of the most popular radar domes right now is a radar built by the radar production company called FLIR Wi-Fi security was not implemented there They actually didn't put any Wi-Fi in there. They built a chip and this chip Converts canvas traffic, which is to the normal standard for industrial applications towards Wi-Fi And if you install it on a standard vessel, it doesn't come with any Wi-Fi security. Oh Wait a sec doesn't that Make it possible to log into your ship over Wi-Fi if you have such a radar dome And it's also quite easy to work on the docks and see if the radar dome is up there You almost immediately now. Ah, the ship does have Wi-Fi and I can connect to it But there's more you can also connect your iPad or your laptop Wireless to your ship This is an example of a chart in here where we are connecting our iPad towards the ship The ship the iPad is just receiving its connection from the converter and it's just receiving its connection from all the data from the bus And Let's make it very easily We can also add an app which allows us to fuel all the data in the ship And in order to make stuff more easy, we can even control the ship over Wi-Fi without any wireless security This control is a little bit It's a you can just download it, but we took a look on it and have taken a look What's behind this control sequence and in fact, it just turns out to be regular RTSP traffic So let's just try to see if we can have this Data from the ship over on my own laptop or on my own machines That's kind of easy. I just open my field C which are normally used for any other movies And I can connect to my ship and I have all the stuff in your ship This is just a fewing stuff, so Let's not make it worse Except if you install one of these so these are the autopilots an autopilot is Fiddle if you take a long passage because you don't want to steer it by a hand So you have these autopilots that's actually a rely on all the sensory information that is coming towards these autopilots This is an autopilot system where you can see the same device which is for monitoring You can see in here. This is a steering steering Machine which steers the stuff and this is the a radar dome and some other equipment in order to a Gyroscope in order to balance out the ship But if we are able to connect to the ship we can also Modify this autopilot and make sure that it for example steers Around depth or it can do other stuff So you can easily control it and it's even more essential if you have such a system Which is connecting to the Wi-Fi's as well and you can easily configure Your ship So when you own the sensors you can inject data that is used by onboard systems If you saw in the previous slide you can see it for example, you can we can add depth detection we can add Stuff in it and we can inject it over the Wi-Fi We can easy even do many of the board procedures, but communications get a lot worse if you look at AIS. AIS is a Specific protocol on systems to monitor all the shipping activity in your environment So this is a chart of the Netherlands where you can see some AIS targets These are the blue ones and the blue ones are ships that actually Are able are floating in the sea it is a mesh Like system where all devices send out AIS message and it uses VHF as its main carrier And it sends encoded data on there You need an MMSI number and you're either and Transponder a receiver if you're a receiver you only receive that and if you're a transponder you can also transmit it This protocol is protected. So You need to have a maritime license and you need to have a radio license in order to operate equipment that is used For AIS and all the equipment on board must be certified That is the only safeguard that there is so you can only buy certified equipment The equipment should function completely standalone Including its internal GPS system so you cannot send GPS data towards any AIS system It has to have its internal GPS Large and commercial facials are required to have such a system on board. It's not optional You are required to have it in order to identify yourself But if we want to have a look at that We actually only need something that can send AIS and as already explained you only It's only protected by the fact that you cannot you only have to buy certified equipment So AIS transponders are protected by law, but It's just VHF so any device that can send out on the VHF Frequency would be able to send out IAS messages and let's have a look this system is an SDR It's a software defined radio So you can program anything in it and it can be anything you want it can be an FM radio It can be a walkie-talkie. It can be a taxi sensor But it can also be a VHF and if it can be a VHF we can use it to send data out of it so That's what we did AIS is a An insecure protocol because you can actually send it but by researching in it and by testing it You are crossing the boundary of illegal stuff because you are transmitting on frequencies that you're not supposed to be And you're using equipment that you're not supposed to be So what you're going to see here on this on this on the slides is an SDR Which is turned to an output frequency so we modified the number that you can see up there Into words an open frequency that is public in use and we throw down the power transmission in order to not disturb the other traffic I'm doing this on the official AIS Fyrgosys would be potentially harmful and I wouldn't suggest that you do that for testing purposes Um, so if we can send out a yes, let's see if we can easily do that. So we have this screen so can we Actually send out a yes. Yes, we have installed a great tooling We have patched some some stuff in order to make it work and in fact if you're gonna look in in here You can see on the official map you can see One vessel appearing up here Um, that's not how it's supposed to be because this map on the right side or on your right side is the official map where Authorities monitor ship activity. So we just protected projected a ship which it actually is not there So any presentation or Shah wouldn't be a presentation without Bob and Alice So what happens if we can impersonate? Our cells to be someone else. I just projected a ship up there, but can we project to be someone else? So this is my sailing vessel with my MMS ID, which is on the top part So would we be able to modify this MMS ID in order to for example put a larger ship in here? So any more any enthusiastic army lover would immediately recognize this as the USS Nimitz one of the bigger flight ships in in the US Navy And of course It's a little bit hard to understand that the Nimitz is actually turning up just before fanhouser You can see this is the Nimitz and this is the screen and this is the display that other people would see if they would monitor their IIS stuff right now you can see here It's the this is the ship and the length of the line Indicates the current speed as it is received by the fewer right now So this is the ID of the Nimitz and you can see here the speed of ground It's going up right a hundred knots if you can actually see it. It's going really fast stuff So it's just pretty new what it's Something that you can easily figure out if you have a look at it and if you If you know how VHF works But there's a little problem in here and The problem comes if we are going to take a look at why we are using AIS So you'll of course know that you're on a ship and you can see the surrounding on your so you can see that the USS Nimitz is not there But there are some Applications where you won't be able to see it and this application is a very special application that is a very dangerous field This application is what we call and that's it's going to be a tongue-breaker for me It's going to be a virtual buoy in English or beauty buoy So this is a virtual buoy that's Layed out in the in the in the water and this is actually what you're going to see if you're on deck of your ship You're going to see Absolutely nothing you're going to see water. You're not going to see the red or the green view in the water But you're going to see on your maps You're going to see one of these sites because some system is sending out these views towards your system and telling your onboard navigation system Well, you have to display a virtual beauty here. So you can safely Guard your ship around it. So these are some options of the views that you can see And this is in fact a map of US territory where you can see on the arrows You can see how a view is represented on my chart. It's just a regular chart. You can just see the view Popping up because someone is transmitting that So let's dive a little bit deeper into that because that might be interesting Would be be able to have a look at these views that are virtual that are being used in commercial traffic That are being laid out that someone is going to see and we can just send them out So this is what you and maybe it's a little bit hard to see But this is actually the message that you're going to send So I know you can also see why this is an important stuff You can send all kind of commands to a ship for example say well, you have to avoid this area You have to go to that area. This is an obligated area to go take care because there's a row ship recommender there or take care There's no depth in there In fact, it's currently widespread in use on wind farms in order to make sure that you're not Entering an illegal area of a wind farm a wind farm. You cannot just go through it. You cannot Go to towards a wind park. There's a perimeter which is secured But there's no way to put a perimeter fence or anything on the water. So they're using virtual tonnage up there But hey, wait a second if we can impersonate use as limits to be in the iso mere can we also Impersonate some views and we also think of a view and say well, let's make a virtual view up there Well, that's something that we tried and yes, we can yes We can do that and in here you can see a map and you can see if you look this is also a map of the Netherlands But we could have done this anywhere at all. You can see the Island of Mark and in here and you can see for the dumb out there and we decided well Let's have a look can we can we put a view on there and can we well, this is a little bit of a It's not a it's a movie. That's being a little bit quicker than normal But yes, we can so we we yes, we can put in views here So we try to make a race track on views and see if any ships would be able to follow this You can see this is a special kind of view. It's a called a north cardinal mark which Protects something on the south of it Well, this is what we actually did on the for any traffic guidance Or any control Tower that was actually watching the screen at that time would see the displays of these virtual views They are not there of course, but Would be able to see what's going in here any ship, which is there would have seen It as well. We've felt it out all the other ships up there So this is what we See of problematic part of AIS traffic But there's more you have several attack vectors on any public channel So you can do resource derivation, of course It's easy to do denial of service attack because there's a little time frame where this VHF Traffic is going through but you can also do easily do a poisoning attack or send false data In fact, it goes wrong because this ship had an accident a short while ago where this big US based ship didn't turn on its AIS and a Japanese ship ran into it At the tragedy in here is it's completely IIS based So we know that it doesn't meet the standard requirements of Confidentiality and integrity and availability the stuff that we think is important if you look at information security And we are also aware of several attack factors what what you are seeing in here We've seen other stuff being presented at Hack in the box and black hat that's Tark towards the same area So the most logical thing of course to do right now is implement this So this is an official publication of the Dutch coast guard, which is sent out to all the people that are on the sea it's an official Statement that we're gonna replace all the real beauties by virtual beauties and we don't think that's a very smart idea if you can easily Falsify them and easily send them away So in fact AIS virtual atons are currently being deployed worldwide. They are currently being deployed worldwide and they're currently in use for wreckage of ships of protection of wind farms of fencing out no-go areas of Port authorities to safeguard and make sure that for example refugee boats do not enter a certain line before the cost and It's implemented in several countries as real views. In fact some of the in America They say let's bring the Americas waterways into the 21st century by replacing all the current views for virtual views So AIS is inherently insecure and voting as well There's no authentication or encryption and its channel is insecure and we know that and we have been here before So let's hope that we can use the lessons learned from the IT stuff to make the water world a little bit safer and more secure And of course keep on voting anywhere. Anyway Thank you So any questions If you have questions, could you please come up to the microphones, please? Yeah, this is a perfect way of Doing the Q&A part, but any questions on this report? So do I do we understand it correctly that the only limit to this kind of attack of fake buoys Would be to figure out who is sending and to shut him down Could you repeat the question? Yeah Do I understand it correctly that the only defense against this attack is to find who is sending and to shut him down Yes in fact, that's the only only only real solution to add some thing like integrity or some kind like a Source Stuff because you cannot see who is transmitting it right now. That's the only way that you can actually Resolve the issue. It doesn't mean that you don't have any other options. For example We know some firms that have been active in building an IDS for Some but what we call an IDS for AIS systems But they were asked to shut it down because of this insecurity stuff. So there are some some Small fixes, but the only real fix would be to put in some authentication on the system or on the station that is sending out What is what is the typical sending power or the typical reach of this kind of system Well, the the typical reach of AIS doesn't have any any power Limit so you can send it out easily, but the main problem is that and we currently have a few Important systems like marine traffic or a vessel finder that has sensors all over the place to sensor any data and Replicate it and make sure that it's being sent towards the whole world These systems are very important in order to have a few of your whole world But the main problem is that these stations are public So you can just drive up to them and do an injection on it and it's being propagated all around the world Next question Boys also monitor their own location Do boys also monitor their own location and transmit errors if the chain comes loose or something like that No, the question was that if it does a bureau also send its own location So would you be able to have a look at the system that that's sending it and having a Some kind of a source coordinate and check against it, but unfortunately it's not required The protocol allows you to send it, but it's not required and it's there are many instances where it's not being used Because some of the equipment can't handle all the data fields that are in the packets So unfortunately, that's not a real very good alternative I'm not so into boats, but I like planes so I do plane how do you call it? Looking at the sky with also some kind of device and see what planes passes my house. I Was thinking about How is this do you know anything about the aviation world is good? Could you impersonate a plane? Yes, you could because a is is being it's not only used in the marine world It's also used in the flight world, but it does have some some extra stuff. It does have some extra Features in there, but it's also used in the in the in the In that world, but there's some different because you have there you have just a sending station and one receiving station And in the marine world you have multiple receiving stations and multiple sending stations. So you just have One ship can send it out to anyone who is going to listen so but the AIS system in terms of this is the same I Earlier in the talk you were talking about the GPS units that that had basically no security on it So would it basically be possible to tell the GPS unit to shut down? imitate the GPS units Say that the boat is at a certain location and have it stare wherever you want Yes injecting location. Yes, that is a Dual wall attack you can do it you can open up your box and just put in another GPS by Design or by the certificate of these units do not allow you to have an external GPS But any hardware hacker would immediately open up the thing and put in its own GPS because it's just a Different different thing. It's just a different module on it. So any smart Soldering our king would be able to modify this and send its own GPS by default an AIS system With its internal GPS can only send out its internal GPS coordinates But if you can modify those which is pretty easy You have a very good attack factor in order to have to ship think well on somewhere else or Half like the autopilot or have the onboard systems steer you towards a goal that you probably do not want to go to Yeah, I was thinking not even with the AIS just the the GPS You showed a picture of the thing and I assume that goes to the to the pilot It's the autopilot itself without going through a yes. Yeah so So this is gonna be this this picture you mean well what we have to GPS of course, which is in In this box you it's very easy to poison this and send out your own GPS data. In fact what you Need for that is not so much. It's Where good did I have the strings and me a string? Well, I just showed you the picture of the enemy of strings They're just here. I'll show them again So this is what coming over your bus So you can if as soon as you have access to your bus by doing the Wi-Fi you can send out any of these Messages so you can send out your time position of your data You can have so all the G stuff is all the GPS stuff GPS messages and in fact if you if you look at this this is a live capture of what we saw So this GPS traffic is coming by and you can easily poison your ship and make sure that the enemy of us contains an extra GPS signal and your Equipment does not know where it's coming from because there's no way to see it because it's being converted The old protocol is being converted in to another protocol and they're all the source information is lost It's just originating from it's It's acting like a net net proxy in IT terms So any device that's behind that can send it and there's no way that the onboard systems actually know Which system is sending it? Any other questions good? Thank you so much


I'm really happy to introduce our next two speakers, Lisa Cockrell and Jordan Upperman. Lisa is the Director of Application Development at IssueTrack and Jordan is a lead full-stack developer on their product. Hey, I'm Lisa Cockrell and I've been with IssueTrack since 2004. In those 16 years, I've been a software tester, a new feature developer, I've managed the QA team and I've managed the dev team. Today I'm the Director of Development for IssueTrack and I'm also the Acting Scrum Master for our product team. My name is Jordan. I started at IssueTrack as an automated test engineer back in 2017. A little over a year ago, in early 2019, I was given the chance to work on the product development team as a full-stack developer. It was around this time that IssueTrack was really leaning into our adoption of Scrum and I received my Scrum Master certification followed by my Scrum Developer certification. Since then, I've been trying to find innovative ways for my team to evolve and further automate or streamline our processes. To give you some background on IssueTrack, we're a web-based ticketing solution that allows companies to track issues so that nothing falls through the cracks. We are a privately owned company with over 2,000 customers across nearly 40 countries. We provide cloud and premise deployment options to suit our customers' unique needs and our headquarters is located in Southeastern Virginia. We were founded in 1992 as a custom development company and our first iteration of the IssueTrack product was provided in the year 2000. As you can imagine, a 20-year-old product has a lot of legacy code. So we're going to be sharing the story of our transition to agile practices in the context of our adoption of GitLab. There were a number of reasons we took interest in GitLab, but the primary reason was a feeling of tool bloat. We were using several tools at the time and this presented innumerable challenges, one of which was the cost. Having multiple different tools and maintaining usage subscriptions for each member of the team resulted in costs that were becoming colossal. There's also the complexity of coordination. Creating a multitude of tools working together creates a lot of variables and thus more room for things to go wrong. But even when things go right, there's a productivity cost with context switching between tools that should just be avoided whenever possible. We had some trepidation when it came to switching as migrations of this scale are rarely simple. A lot of planning and consideration goes into adopting a new tool such as GitLab. Considerations can vary from training the team on the new processors, potential downtime during the migration process, and the possibility of data loss. Data loss could result from the actual migration process itself, or just an inability to adequately represent data from an old tool in the context of the new tool. Another major factor is any possibility of complexity or of the migration process itself. For example, if we had to manually copy every item from one tool to the other, that would have just been a non-starter. Thankfully, these were largely non-issues when it came to GitLab. GitLab provided a simple, easy-to-use method within their user interface for migrating our repositories and tickets from GitHub. While a similar option did not exist at the time for JIRA, we were able to use the GitLab API to programmatically import our ticket information from that platform. The GitLab API documentation made this task much more straightforward than we had initially anticipated. The ease of use did not end with GitLab's documentation, however. Our company fell in love with the intuitive nature of the tool and its use now spans beyond the development department and throughout the rest of our DevOps team, including our cloud operations, tech ops, and IT departments. The impact of IssueTrack's adoption of GitLab as a one-stop tool as well as our embracing of the agile software development methodology was huge. Probably all of our daily workflow tasks have benefited. We'd like to tell you about a few of the more impressive changes. While our main objective in adopting GitLab was to make our processes more lean, an added benefit was the ability to make our monthly costs lean as well. Prior to our transition, we were using five separate tools for our daily workflow processes. AppVayer and CircleCI for our CI CD pipelines. GitHub for our repositories and ticketing solutions, along with Waffle.io for a Kanban tool. We had recently onboarded JIRA for a separate ticketing solution as well. The subscription cost per month for all the licenses that we needed was substantial. But once we moved to GitLab, we were able to bring that cost down significantly, a savings of about 80% per month. Another important way that GitLab assisted us in our transition to agile was by allowing us to better manage our product backlog. Prior to GitLab, our backlog resembled a black hole. Things would go in only to never be seen again. There was very little conformity in our tickets, which made it challenging to group or categorize them at scale. It was difficult to prioritize tickets, and as a result, tickets were worked at developers discretion, which in turn made our output as a department unfocused, resulting in major time gaps between releases. At times, work would begin only for the developer to realize that the amount of information on the ticket was insufficient. This stemmed from a lack of a definition of ready. The ticket template featuring GitLab proved to be extremely useful for our backlog management. We now leverage templates to communicate what information is needed when the ticket is submitted. We have a dedicated template for every source of tickets. The product owner team uses the user story template. QA uses a QA bug report template. Customer complaints from our TSAs are added using the support bug report template and on and on. We use the quick action feature of GitLab within our templates to ensure uniformity of labels in our tickets. This prevents us from having to train everyone on which labels are appropriate for which kind of ticket. Instead, the appropriate template is chosen and all the relevant labels are automatically applied. Our utilization of these features has finally given us the ticket conformity that we sorely lacked. Another GitLab feature that we leverage heavily is the ability to customize our Kanban boards. Our team had some experience with Kanban boards prior to our transition to GitLab, but we were limited to a single board with static columns. We didn't realize what we were missing. Any ticket that wasn't currently in process was in the open column, a.k.a. the black hole. This made it difficult to refine and groom our backlog, so much so that we were copying and pasting ticket titles into a Google Sheet in an attempt to give it structure. When we migrated to GitLab, our ability to leverage the Kanban boards was a game changer. We now have multiple boards at both the group and the project levels, and the ability to select custom columns allows us to tailor these boards to our needs. There are two major boards that we use to process our workflows, the PO board and the Sprint board. Because of GitLab's customizable Kanban board feature, we created a new board specifically for our product owner. This board tracks our backlog refinement process and ensures that all of our tickets meet our definition of ready. The PO team now has the ability to focus solely on prioritizing the work that is coming down the pipe. We created this board with three columns, unrefined, groomed, and ready for Sprint. User stories are entered by our PO and placed into the unrefined column. The development team meets with the PO several times a week to discuss and design the new features, eventually creating and weighing discrete test tickets associated with those user stories. At this point, the developers move the user story ticket into the groomed column. The groomed column is not prioritized and is merely a holding container for the PO team to select work for the final column of this board, the ready for Sprint column. By the time a ticket reaches this column, each user story has a story point estimate. This new information gives the PO team the ability to prioritize our work and estimate release schedules with more data than they had when the user story was initially submitted. Our second customized Kanban board is our Sprint board. This board starts with the ready for Sprint column and contains columns for the rest of the development process. Because our two boards share the ready for Sprint column, we can rest assured that every ticket that appears on this board meets our definition of ready. The duration of our Sprint planning meetings has been greatly reduced. Now we can simply pull tickets from the ready for Sprint column until we've reached a weight that is equivalent to our average velocity, all without having to examine the tickets themselves. And the ticket counts and weights are automatically calculated and listed at the top of each column. Our use of these two Kanban boards allows us to pivot with ease when necessary as bugs are found during testing. It's easy for us to quickly weigh the new ticket, remove an item with equal weight and send it back to the top of the ready for Sprint column. This practice prevents scope creep in our Sprints and reminds stakeholders that when work is added to an already committed Sprint, something must come out. Our general ticket workflow has been transformed as a result of our transition to GitLab and to Scrum. As mentioned before, prior to our transition, tickets priorities were unclear and were worked at the discretion of the developer. More often than not, when the developer began on a ticket, there was minimal information and this resulted in some features being developed without the intended context of the initial request and subsequently a loss in value for the customer. Without our refinement and grooming efforts, it was difficult to predict the level of effort of each request and therefore planning and scheduling were cumbersome processes. This caused deadlines to be missed and unhappy stakeholders as well as customers. Now with our system of grooming tickets in place, it's much easier to select a new ticket as they all meet the definition of ready, which includes estimates regarding the level of effort for each ticket. Having our backlog in a consistently prioritized fashion allows the team to select work quickly and without contemplation, further reducing the effort needed to produce deliverables. We've also implemented several systems to shorten our feedback cycles, one of which being improvements to our CI CD process. Before GitLab, we were forced to use two different tools for our CI CD. We used AppBear for our .NET projects and CircleCI for everything else. As these tools were separate from our repositories, the CI CD results were obscured and required us to context switch in order to consume the information that they provided. Another drawback of these tools was the lack of control over the process. We relied on the runners provided, which may or may not have been provisioned sufficiently for what we needed them for. This method had implications with security policies for our cloud storage and setup times. In terms of debugging problems in our pipelines, a major setback was the monolithic nature of the pipeline execution as a single stage. The GitLab CI CD functionality allowed us to create multi-stage pipelines which greatly aided in troubleshooting failing builds. Build failures can be viewed via the GitLab user interface and the multi-stage pipeline allows us to easily pinpoint the step that failed without having to retry the entire pipeline or go digging through log files. Today, it's much easier to block emerge requests if the pipeline fails, which reduces the number of bugs that are entered into our product. The ability to host our own runners has also been a game changer. We have sped up our pipelines by ensuring dependencies are present before starting our builds. Another major benefit is the ability to control the security policies on the runners themselves. Rather than using access keys to interact with our cloud resources, we set AWS Identity Access Management Goals on the runners themselves, which makes it easier to store our build artifacts. But it has also allowed us to start leaning into infrastructure as code as a company. We leverage infrastructure as code through the automated deployment of Lambda Functions with associated API gateways. We've developed internal tool sets that employ infrastructure as code, like our Trackbot, which runs our Slack integrations, but we'll talk about those later. We also use it for our Help Center Resolution service, which drastically reduces the amount of coordination that is needed between our development team and our tech writers. Another way we use infrastructure as code is our self-service site deployment app, which lessens the frequency of requests from our sales team to our cloud team by allowing a site to be automatically deployed to production with the click of a button. Finally, our webforms processing service, which provides the ability to host a custom form for an unauthenticated ticket submission into an issue track application, also runs as a serverless Lambda function whose infrastructure is defined as code within our GitLab repository. Infrastructure as code has also made its way out of the development department. Our internal IT department uses infrastructure as code to maintain user permissions in AWS via IAM roles. While we use infrastructure as code for some of our PC2s in development, such as is the case for automated Selenium testing infrastructure, our cloud operations team uses that much more substantially for automating the process of standing up new servers in our customer cloud, which has been a major milestone in our revitalization as a DevOps team. Adopting GitLab and our switch to Agile have both increased our ability to ensure the quality of our code. In the past, our developers employed the bad practice of merely throwing tickets over the wall, and therefore the QA team's only resource was the developer's documentation on the ticket with no prior knowledge or understanding of the feature. This practice unfortunately allowed for unnecessary refactoring, which had the potential to cause problems that went unnoticed by testers. Without our scrum processes, we were guilty of cowboy coding. And as a result, there was little collaboration when it came to the development of new features. And this created a lot of technical debt by generating an inconsistent code base. We now practice a technique known as paired testing. Developers will pair with a tester before a single line of code is written to discuss the intended changes and potential concerns either person has regarding the plan of action. This allows developers to gain crucial insights from the minds of testers before starting the code. The pair's continued communication throughout the life cycle of the ticket prevents a substantial amount of rework. GitLab helps us achieve this by allowing multiple assignees on a ticket simultaneously, a feature that wasn't offered with the other tools we were using at the time. The feature of linking merge requests to tickets in GitLab allows testers to review the code that was modified and to catch potential unnecessary refactoring problems. Gone are the days when testers were completely in the dark. And today we have far fewer unintended consequences when our product is released to the wild. Stakeholder feedback is another important tool we use to ensure code quality. In the old paradigm, feature acceptance was a very disorganized process. Various stakeholders would make requests often directly to the developers with little cross communication with their cohorts. Of course, these requests were never documented. The results, changing priorities, shifting requirements, rework and delayed output. This exact scenario happened when we were asked to implement a quick search bar in our product. The desk of the developer responsible for this feature quickly became a common destination for business side employees of the company. This resulted in bloated functionality that in production was so non-performant that it ended up being removed altogether. We solved this through our adoption of Scrum which requires a dedicated product owner as well as sprint reviews. PO approval is now required at several stages throughout the development cycle. Using another favorite feature of GitLab, we now mark the user stories blocked until work completes on all the associated discrete task tickets. We have a dedicated column on our sprint board named active user stories where user stories are placed when any of the work tickets have been chosen for the current sprint. Once the story loses its blocked indicator, the new feature is ready to show to our PO team at the next sprint review. We also now insist that all changes and requirements be documented on the tickets themselves ending the verbal communications that would often be lost in time. This has dramatically improved our transparency. Speaking of transparency, GitLab's out of the box integration with Slack allows stakeholders a quick peek into our daily lives. Certain actions within GitLab will cause a post to appear in our DevOps Slack channel. Those actions are when tickets are opened, closed and notes are added. As merge requests are open, approved and merged and build failures will cause a post to that channel as well. As a scrum master, this channel is my gold mine. It is literally a wealth of information about my team's productivity. Finally, I'd like to share ways in which we've made use of the GitLab API in order to minimize the amount of work we have to do manually. The first home brewed Slack integration we've implemented was a tool for automating our branch maintenance. To give this some context, when we release a new update, we push to master and then merge master into all of our protected branches. We've since automated this process using Slack, Express, Lambda, but most importantly, GitLab's API. The first thing that takes place is a developer will enter the command into Slack. If that user is green lit to continue the process, they will be given a confirmation box. If that Slack user is not authorized, they'll simply get a message indicating that they can't proceed. If the user selects to continue, our bot will automatically create a merge request for every protected branch in our project and then systematically check for conflicts using the GitLab API. And finally, prompt us to either finalize our merges when no conflicts are found, or let us know that we need to do it manually and review the changes otherwise. This has helped us streamline our release process and reduce the potential for human error. The last integration I'd like to demonstrate is a tool we created for distributed ticket weighing. Here's a ticket I'll use to demonstrate how it works. The Slack user will enter the ticket URL along with the slash command in order to initiate the process. Using the GitLab API, our bot will automatically parse the URL and determine the project, issue number, and title of the issue. It then tags all the users we specified in our application today. Next, it prompts viewers to vote for a weight they deem appropriate for the issue. A major benefit is that it posts the whole description as a snippet within the Slack thread. This way, the team doesn't even need to open GitLab to participate in the story poker session, which was a complaint we had when using a more generic tool in the past. If you notice up on the top, there's now a new row that's been inserted which contains the names of users we have received away from. These people have voted, but their vote remains hidden to avoid anchoring. We can now weigh tickets asynchronously, which is super useful in these times of distributed work environments. Once either everyone on the waiting for list has weighed in or the reveal button is clicked, we move to the next state. Here we can see the weights selected by the people who have weighed in. We're then presented a dropdown with the weight options and a button to finalize a selection. Users can, at this point, select the appropriate weight after whatever discussion is needed. Once that's done, the dropdown and button are replaced with an indicator showing the final decision. It also updates the original post so the channel we use for the spot stays pretty clean or easy to navigate. Here's where the GitLab API once again comes into play. As you can see, the ticket has now been updated with the weight of two and it's undergone the label changes unique to our process and added a link directly to the thread in Slack where the discussion took place, allowing us to regain the context that led to the decision whenever needed. This has removed multiple manual steps that used to have to take place for every ticket prior to its consideration for work. If you find this tool like it might be useful, it's actually an open source TypeScript Express app we built and you can find the project on GitLab under the name GitLab Slack Story Pokerbot. There's a configuration file within the project that can be used to easily modify the process if that your team needs. Well, we're just about out of time, so I'll wrap up. Agile and GitLab, what were we doing without them? Our product development team is almost unrecognizable now compared to where we were over two years ago. We made the switch and so can you. You belong here. Thank you to GitLab for inviting us here today and thank you for watching.


Buddy. Hi, this is George Cowan. That was my speedy dog buddy. So in today's short video, I want to talk with you about how important and useful it is to make your hard work easy and enjoyable. And I actually think that if you're gonna work hard at anything, work hard at that. Work hard at designing your work so that it is easier for you and more enjoyable for you. So let me give you a couple of ideas. One idea is to make your hard work chunked down so that it feels easier for you. So I thought of this because one of the one of the watchers of these videos emailed me and congratulated me on all of my hard work in creating these hundred videos. And I just thought that's so ironic because my whole methodology is about consistent, but casual action. It's not hard for me to do these videos. I mean, I in the beginning it was I had to get used to looking at myself. But just after a few days of that, it became more natural, more easier, and in terms of making a hundred videos, that sounds like a lot of hard work, but really it was just one video a day, one video at a time, you know?  I would have been here anyway, so it's easy for me. It's enjoyable because I'm out here in nature. I'm here with Buddy and he's so fun. So it's not hard. You see how it's not hard work if you chunk it down into individual pieces, making a hundred videos very hard, doing one four minute video a day. Not hard. You see the difference there? OK. A second way to make it more easy or enjoyable is to think about the sensory, the set, your five senses, you know, sight, sound, smell, taste, touch, that kind of thing. And so one another example, right? I'm making these videos out where I'm enjoying myself. It's it's pleasant out here. It looks beautiful. Smells wonderful. You know, my sights are are are being pleased by this hard work. But it's just out here. I'm enjoying it. But if you're working like in your office or in your home office, ways to increase the sensory pleasure may be to listen to some pleasant music that's not distracting for you as you work or to put on a good smelling candle or to make some nice tea that you enjoy. So increase a sensory pleasure is what you're doing. The third way of making hard work easy and effortless and enjoyable is to do it with other people. I've been doing this virtual co-working now, offering it for free. You're invited where we get together on a video conference call and we basically each work on our own project. I do a little bit of pep talk in the beginning and then we we work on it. And it's surprisingly productive for everyone who participates.  I think you'll really appreciate that. So I hope this is helpful. Remember, the most important hard work to do is to design design, consciously look at your hard work and make it either more incremental, more sensory, increase the sensory pleasure of it, beauty, et cetera, or do it with other people. So I hope it helps until the next video. I hope you do enjoyable work.


Hey everybody, my name is Martha Lucy and I am deputy director for research, interpretation and education at the Barnes Foundation. Today we are going to be looking at a painting by Pierre Auguste Renoir called Leaving the Conservatory and it was done around 1876 or 1877. At the Barnes, it hangs in one of the upstairs galleries. This is room 23. And first of all, you can see that it's hanging between two paintings from medieval paintings showing religious subjects. So already you're seeing sort of what's unusual about the Barnes and the way that Albert Barnes mixed up his works of art by different cultures and time periods. But what I want you to notice here really is how big the painting is. It's about seven feet tall and this is unusual for Impressionist paintings. Most of them are small, a couple feet wide, maybe foot tall. And there was a practical reason for this which was Impressionism was really so much about painting out in nature directly in front of your subjects. And so you had to have canvases that were of a portable size. And so, yeah, so it's unusual that Renoir is he's one of the only Impressionists who sometimes painted on this large scale. So it has the effect of the figures being almost life-size. What you're looking at here, so it's called, again, it's called Leaving the Conservatory. And you're looking at a group of students who are standing outside of a conservatory that was an actual place in Paris. It was in the ninth arrondissement, so in the north part of the city. And it offered free classes on voice coaching, music lessons, and acting lessons. And interestingly, you don't see the much about the setting in this painting. So, you know, Renoir is giving us very little information about where they are. You can't really see the street, you can't make out any details of the building. It's sort of this blank background, very neutral. The only clue that we have other than the title that this is figures standing outside of a conservatory is the scroll that is in the woman's hands right here. That's probably a piece of music or some sort of dramatic text. So even though there's not a lot of information in the background, there is tons of information packed into the group of people.  You can see that there's a crowd behind them. It's unclear whether these students are waiting to go into the conservatory or whether they've just come out. But our eye is really kept in the foreground on those four figures that are closest to us, these two men here and these two women here. And looking at their clothing tells us a lot about when this was painted. They are definitely people of their time. They are wearing fashions that are very much sort of a la mode. This dress here is a princess line dress and that was a style that was introduced in the early 1870s where you had kind of long, long panels that hung down without any kind of vertical or sorry, without any kind of horizontal element at the waist. And so she's wearing something that was very trendy at the time. And the men are dressed in fashionable suits and kind of high heel boots. So anybody looking at this painting in the 1870s would have recognized them as contemporaries. The way that we can do that now with contemporary fashions. Just to zoom in a little bit on some of these details here because they're fun to look at. I want to just first point out that the scroll which from a distance looks sort of white is actually really brushed through with all these blues and the materials probably lace at the end of the sleeves right there. But then just all this attention to detail in the costumes.  Renoir was always very attentive to fashion when he painted his figures. He loved fashion. He loved not necessarily for himself. He was a pretty simple dresser but his father was a tailor. And so he was very aware of what the latest trends were and he used the trends to communicate to people looking at his paintings about sort of who these people were in society. Now the other information that this painting gives us is communicated so much of it through gesture and body language. And it's really fun to look at what's going on this kind of interaction here between these two men and these two women. I think that the hands really tell us a lot. Every single, each of these four people, their hands are kind of doing something important. You know, she holds the scroll but she's got her hands kind of laced through the arms, through the arm of the other woman telling you that they're good friends, they're buds. And over here, this guy kind of has one hand behind his back. It looks like there's a flirtation going on. I sort of imagine that these men and women don't know each other and that they're meeting. Maybe not, but that's sort of what I imagine. And I think that that's what Renoir wanted was for you to kind of wonder what was going on here. But he has his hand behind his back in a way that almost makes him look like nervous. Like maybe he's fiddling with his fingers. And then if you notice this guy, he has his hand on his friend's back as if he's sort of maybe sort of gently gesturing him forward. Like come on, talk to these women. And look how he's, this one is striding, you know, sort of moving forward a little bit, like his leg is kind of in the space of the women. But she is leaning forward, sort of, you know, receptively. She is very much locking eyes with this guy. And it sort of seems like the friends are waiting to see what they're going to say to each other. Like the faces in the background are interesting too. You know, very summarily rendered except for this one, which I find really unusual. Who is why didn't he kind of blur out her face? It just makes me wonder who that woman was. At the same time that the gestures and the body language and the fashions tell us a lot about these people. You also don't know what's going on, you know, you don't know what their conversation is.  But the thing that's interesting about that is that that's kind of what it's like in real life when you see people on the street having a conversation. You know, you get these snippets of people's conversations. Maybe you overhear a word or you look at them and you kind of imagine what they're talking about from a distance. So and also because the painting is so life size, it really does feel like you are interacting with actual people on the street. Which I just find really interesting and especially because that was so much of what people were experiencing in at this time period during the rise of modernism when the population in cities was growing. So quickly and there were crowds of people and you couldn't know everyone anymore. You could only see people in sort of throngs and kind of wonder maybe what they were talking about. So I think he captures this, the modern experience of the crowd. But at the same time, he doesn't make the experience of the crowd feel alienating the way that or anonymous the way that some of his colleagues did. So while we might say, OK, Renoir must have set up his easel right on the street in front of a group of random people and painted what he saw. So that's what the impressionists are known for painting directly from nature painting directly from from what is observed painting the fleeting moments of modern life. But that is not in fact what happened here. We know from some accounts given by Renoir's friends that these students are not actually posed or standing in front of the conservatory. They're actually posed in front of Renoir's studio in Montmartre. So they're outside on the street, but they're they're not where the painting purports to be or where the scene purports to be. And the people in the painting are not random strangers. This man was one of Renoir's friends, George Riviere. And this woman here was one of Renoir's favorite models, Nini. So it's a constructed image. It's a constructed scene. And I think that that's a great reminder of how often impressionist painters really did think about about composition and not everything was just a sort of faithful replication of what they were seeing. So that is it for today. Please join us again tomorrow. Thank you.