Thank you Adrian, so could you move to the first the next one? Yeah, okay So those were our main spring goals as you can see We didn't perform very well. This this is last this last spring Mostly because testing the testing the wall the QA process is a very intense and large Process but in any case I Can say that we integrated the last accessibility Minor fixes, but we are going to be doing additional work to improve the app accessibility in the next version we also Integrated and deployed the biometric login solution and I will show you a few screenshots in the next slide later Regarding the QA we are at 85 percent. So we have only a few remaining issues Sorry test to complete Everything is looking good so far. So I think that Maybe tomorrow we have finished the QA process and then we can start with the Release regarding the release. We already released the beta versions of the 4.1 version And I recently posted in the QA forum at modal.org as well. So people get notified about this and I think that we have around 14,000 people with the beta versions installed so they will get this update automatically Um, and they will be able to report any issue Uh, using an an spreadsheet that we usually share with them um, once we've completed the release the remaining issues as you can see are mostly about uh into a um Documenting everything updating the user and development docs Regarding the release and also doing a small release for the workplace app with some minor improvements And after that, uh, we will do a round of uh, project weeks And that I think that it will happen during The end of the well not december because I think that most of the people are going to be on holidays, but after the Christmas and holidays Uh, so if you can move to the next slide, please edrian Uh, uh, the the quality is not very good, but uh, you can see this is how the Uh, biometric and face and face ad thin works on the app that basically is like Is the same workflow that uh, happens in banking apps That you are you can use your fingerprint or face face ad to automatically log in after a logout from from from the app And yeah, that's basically So thank you any questions


How much are you worth? How would you answer that question?   So typically in our society, we tie the word worth to a dollar amount, a monetary amount. And so when people say charge what you're worth, they're saying it's a very confusing statement and it's worth looking at because how much are you worth? Are you worth $100 an hour? Are you worth $10,000 an hour? Are you worth $25 an hour? Who's to say how much you're worth? Well, I hope you make that decision for yourself and I hope you'll say that there is no number that I can put on what I'm worth. Now, it's interesting that scientists have even looked at this idea of what is the chance of a human being being born and they came to a number that was one in $400 trillion. The chance of you being born just looking at science and all the different factors involved is one in $400 trillion. That is almost impossible that you would have been born and so how much are you worth? You are worth infinity. You are worth more than any money in the world. So why are we saying charge what you're worth? Because if we're saying charge what you're worth, nobody could afford you because you are worth more than anything. No, let's stop saying charge what you're worth or claim your value or stand up for what people should pay you.  So let's get more realistic and more reasonable and more compassionate with what we should be charging. Right? So let's look at whether some of the common teachings out there about what we should charge. We should charge based on what the market will bear. That's a common economics idea. Charge based on what the market will bear. What does that mean? That means charge as much as you can possibly get away with. Charge as much as people are willing to pay you for. Now, I always like to bring in the golden rule when it comes to doing authentic marketing. So let me ask you the question. Since you are my potential client, right? You are a potential client for George Cow, me. How do you feel if you knew that I was charging the most that I could get away with charging you? Doesn't feel good, right? There's this common idea in business, sort of it's assumed that the business owner is just out to look for himself and the customer and our client should also be aware of the business. There is an adversarial relationship between the business owner and the client. That is assumed in typical marketing and business trainings. But that's not how I want to relate to you. I don't want to be looking out for myself and trying to get as much as I can from you. And I don't want you to be in this position of being afraid of me and wondering what George is going to charge me. That is not a good relationship for a friend or somebody you want to have on your team. Somebody and I think that all of us are on one team on planet Earth. We're all trying to survive. We're all trying to thrive. And we all need each other to do that. So instead of that typical assumption of we all just look out for ourselves and just you got to be aware of each other, what if we brought compassion into this and say, what if I look out for you? And what if you look out for me? What if a business assumed compassion to say, I'm going to be as compassion as I can to my clients, to my audience. And I expect that they will also be compassionate towards me. I expect that they will also look out for me. And guess what? As I've been doing this experiment called authentic business for the past five years, I found that to be true. As I take actions toward bringing compassion into my business, I also notice that you all are looking out for me. And I'm incredibly grateful for that. So how should we charge? What kind of money should we charge? Should we charge what the market will bear? Well, let's look at it this way. What if we charge based on compassion and based on enoughness? What if instead of charging the most we can get away with, we charged the least that we can get away with? What do I mean by that? How much do you need to live? How much do you expect your business to earn you at the same time? How do you expect your business to earn you at this time? It might not be all of what you need to live. You might need an alternative income source and many of you do have that. You have a side job while you build your business. That's probably a good idea. If you don't have savings or not lucky enough to have, you know, spousal support or parental support or other support, probably need a job to pay the bills while you build your business on the side. And so you don't give your business all that much pressure to make all the money for you to live immediately because then you can't be compassionate to your clients because you need to charge them the most that you could possibly get away with because you're trying to get as many of them paying as much as possible so you can live immediately instantly. You're giving your business that much pressure.  What if instead you say, okay, I'm going to get a side job or two side jobs or whatever you need and I'm going to not give my business that much pressure to support me right away knowing that authentic business means to evolve in a way that is that keeps that to evolve your business in a way where you can continue to stay true to yourself instead of making compromises in your conscience and in the way that your soul is calling you to do business. And you can, if you do your business authentically, you will be proud of how you do business. You will build an audience who tries to take care of you and it will eventually support you completely. So charge based on enoughness and based on compassion. Now, an important couple of ideas here for you, practical ideas in order to do this. One is right now, let's say you, like I said, if you don't need your business to make all the money in the world for you, okay, try to have a side source of income and then charge the least you possibly can for your service. Really, okay, look at your, look at the market, look at the people in your industry. What is the range of what they're charging? So maybe people in your industry are charging somewhere between $50 at the lowest to $200, $250 for per hour for the kind of business. The service that you want to provide. Fine. Then charge at the lower end of that, of that rate, charge $50 an hour right now. Now, by doing so, you will appear to be a great deal for people. People go, wow, I can get, I can get your service at that rate. Amazing. Sign me up. Okay. If they, you know, if you talk with them, they're a good fit.  They like the service to provide. What a great deal. $25 an hour, $40 an hour, $50, whatever it is that you are willing to charge at the lower end of your, your range, the range of your industry do that. This will then bring you clients more easily and you'll have a waiting list eventually at that rate. Once you have a waiting list at that rate, you can then raise your rate for the next new client. And you can also inform your current clients that you're going to raise your rates in three months or six months or whatever. Three months is reasonable. Six months is very, you know, compassionate. So you, once you have a waiting list, you raise your rate, let's say it was from 50. Now it's 75 for the new clients that come in and for existing clients, they get 50 out of three more months, let's say. Okay. Now, once you have a waiting list at the new rate of 75. Okay. Once you have your client roster is full at 75, you raise your rates again, let's say to 90. Okay.  Okay. Maybe I'll go elsewhere or maybe I can't afford it right now. That's okay. All right. You keep raising your rates as you have a waiting list, giving your clients at least three months notice. Until you add a level of enoughness until you can say goodbye to your, your side jobs and your business can support you on its own. Until you have enoughness and you can still have a compassionate rate for your clients. Now, in terms of compassion, another important idea is that your one to one service probably shouldn't be your lowest rate thing that you offer. You see what I mean? So if I say, well, I want to have compassion to my clients and my, and some of my clients can't pay me even $50 an hour. They can pay me $10 an hour or whatever. So I'm going to try. So remember enoughness and compassion have to go hand in hand. So your one to one doesn't have to be the lowest price thing in your business model. This is why I talk about the importance of business models. You can maybe sell an online course. Maybe you can sell a group program where you can charge less per person. Right. That's another way to be compassionate to your audience. So for example, many of you can't afford my one on one rates. That's okay. I charge my one on one rate in a way where I won't feel resentful for providing that service given how busy I am. I only, I actually try to limit my one on one appointments to only a few appointments per week. So I, I, I, that's not my bread and butter anymore. I've raised my rates to a point where I purposely priced myself out of most of your range. I, you can't afford me at one to one, but I have compassionate ways for you to afford my services. My online courses are lower priced than most people's online courses in my industry. I promise you that. So my online courses are priced compassionately or you can buy my books. If you can't afford my online courses right now or don't want to spend that much money or if you can't afford a book or don't want to read a book. I have so much content for free. That is the ultimate compassionate move is I have so much freak. I mean, you can watch videos of me all day long for months and I have over a thousand videos. I have, you know, many, many, many articles. So you should have a business model that allows you both enoughness and compassion. So anyway, I hope this is helpful for debunking that idea of charging what you're worth and instead charging based on enoughness and compassion. And then that that's that you're at your job then to find that business model that allows you to do that. So I hope this video gave you some gave you some interesting ideas to consider. And always I look forward to seeing your comments and questions below the video. In fact, I'm going to give you a moment to add a comment below while I go and look at the live comments that are coming in now. And so I'll just let you comment below while I find that here. Okay. So, thanks to thanks for those of you who are joining me live. Miriam, Noel, Kelly, Natalia, Colleen, Kim, and captain. Thank you so much for your comments Miriam captain Colleen those are the ones I'm able to see right now they might be more, but yeah. So, you know Colleen. Thank you for this great comment she wrote. I so agree with your position of not saying charge what you're worth and it. She says that it troubled her for a long time and she says, I also feel uncomfortable when coaches offer high end programs and use the rationale, you deserve it, you're worth it.   You deserve everything you deserve way more than high end programs, but doesn't mean you should be paying for that stuff. Okay. And yeah, Colleen says I'm worthy enough human being to deserve to purchase what I need and what feels like good value. I will also if I sense myself worth intrinsically, rather than needing external validation to be discerning about my finances. It feels like in both the situation you're describing and my example here, the people are playing on the ubiquitous sense of unworthiness that so many of us in our culture feel. Yeah, absolutely. And the unworthiness that many of us feel, unfortunately, some of it comes from marketing, maybe a lot of it comes from marketing. Right. Oh, you want to look pretty you got to use the skincare product.  Okay, so marketing has made us feel like we don't fit in we don't we don't have a tribe we don't we can't be respected unless we spend money doing these things right. Yes, thank you for for your comments, everybody below I really appreciate it and for those of you don't know me I am George cow authentic business coach I love talking about how do we build a business in a way that we can feel really good about ourselves. And we can be, we can know that we are putting out more compassion more wisdom into the world. So thanks for joining me I always appreciate your, your presence, and your engagement so alright I'll see you in the next video. Okay, until then, I hope you will remember that you are worth infinity. There is no value you can put on your worth. And you also have the ability to charge based on enoughness and compassion. Alright, see you in the next video take care.


Look, the one who found Adele at 19 years, he discovered Adele at 40, he retired at 19, an African-year-old boy, he's thinking about sex.


Musicians don't even know when things are going well. I love DIY music culture, but one of the things that a lack of mentors and experienced label people brings to musicians is misery and that they don't even know when they're doing well. On so many of my consulting calls, they'll say something like, only two of the last people I reached out to wanted to collaborate with me. Or I wrote 25 playlists and only three said yes. You gotta realize, that's an insanely high batting average and you're killing the game if things go that well. The road to success is paved with rejection. And you need to see rejection as a callus you build up. Except if you're cold play when David Bowie did them like this. Then they should have given up. One hour of planning your releases gives you an advantage over most of the music business. So this dude Warren Buffett, the type of dude, finance bros and khaki pants used to have man crushes on before they discovered their hairplug, Donning King, Elon Musk. But Warren once said this really great quote.  And truly I can't think of a much better quote that explains the way the music business works.  I recently made a video on how planning helps engage potential fans attention span and how algorithms all work together. And truly just doing this one hour of work that I explained can be a game changer for getting fans. Want to get fans to share your music to their friends on social media? Once you start to have a few fans, find something cheap you could share with them. This could be one of those enamel pins or a cassette of your music. Mail it for free to 20 of your most engaged fans and make them do something for it like sharing your new song. Send the gift to three of your friends before that and have them make a video in their stories and TikToks where they play your song while showing the gift you sent them the day before the packages you sent to your fans arrive. The fans will see the examples of your friends putting your song in their videos and showing it off after you share it on your stories and do edit and you'll encourage your fans who got the gift to do the same thing and you'll get all their friends to hear your song and learn about you. How to find your perfect social media handle?  And that's if the artist has a different name on one social media platform compared to another it will haunt them daily with marketing mistakes and opportunities lost when their TikTok name gets tagged instead of their Instagram name and now some random girl in Ohio is getting a thousand followers instead of their face tattooed rapper. So to easily check if all your names are available on every platform, use this site name check which can instantly show you if putting .mp3 or ya boy at the end of your name or whatever the hell y'all are doing these days is going to work on all the platforms. Machine Gun Kelly is right and Kanye is wrong.  I'll take Kanye's music over MGK's any day but y'all are learning the wrong lessons here. As someone who's spent countless hours in those major label walls the people who work at them aren't what you'd call charismatic but boy do they respect those who have that. MGK being cringe but showing how hard he'd sell a song is the right way to play this game in that room as it shows he's going to take it as far as he can whereas Kanye looking as confused in a meeting room as he looks today as to why Kim wants nothing to do with him that ain't it. Too many of you don't get that you need to be an exciting ambassador for your music otherwise people aren't going to give you attention. Bet you don't know what every major label in Big Indie is changing their budget to spend more on. So many DIY musicians have no connection to what is actually happening in the more professional part of the music business and don't get that a huge shift is happening. So many label friends I talk to tell me how they spend all their time now working on features collaborations and remixes with other artists instead of content since nothing has ever offered this big an opportunity for growth for artists than this because once you do a collaboration with another artist and you're both tagged on Spotify you start algorithmically building with that artist and ending up on the release radar the Spotify radio and Discover Weekly of the artist you do these collaborations with as well you have free advertisement for yourself on a song the fan may like that's sitting on their artist page for all of time literally there's never been a greater marketing move than this and that's why everyone is leaning into it and you see so many collaborations right now. Here's three tools to figure out what you sound like. So many of you are clueless on how to promote your music aside from wasting money on useless Facebook ads or playing the same gig over and over but the most effective way is to find your community and research it but even more of you have no idea what you sound like to even begin that so try these three tools every noise at once will show you micro genres of other artists or even yourself if your songs are semi-popular on Spotify whereas friends to the ends genre detector could show the artists and genres including their popularity score as well a lot of users of my Facebook group at Discord love submit hubs hot or not tool where you enable comments since while some of those comments are annoying a lot of people then compare you to other artists which my group finds really helpful to help them understand what they sound like. The album cover is the least important thing in your budget every week when I do consulting calls with musicians we look at the budget and I see some wild budgets for album covers unless you're gonna put physical albums out the album cover is the least important thing you could spend money on if someone is looking at your album cover most of the time they're about to listen to your song anyway or the covers are so small on streaming music they can barely make out what's there I'm not saying to put out trash art but you could reuse the same high quality image by just dropping new text or changing the background color on an image and save yourself time and money as long as it's based on a high quality image you can milk this for countless releases how diverse can you be with your music before it hurts your music promotion one of the most popular questions I get in my YouTube comments is how diverse you can be in sound before it hurts you so this is a complicated question but here's a simple way to look at it there's a bunch of artists who could do a country song then a dance song and still have their audience love it all but if you haven't built a fan base up yet the algorithm will often punish you if you go too diverse and sadly this makes it a hill that's steeper for you to climb in your promotions since Spotify judges putting your music in their algorithm by how many people skip it and when you're extremely diverse the likelihood that you're pleasing the fans of your hip-hop songs with your ska song goes down greatly with that said the only way you make great music is if you make the music you want to hear but if you want as many people to hear it as possible it sometimes helps to do different genres under different artist names and support the musicians they feel the closest bonds to one of the things I think some DIY musicians miss out on is that fans spend money and share the posts of the artist they feel closest to there's been so many studies that have shown this dating back to the semital one by MTV in 2012 and countless since that proved this feeling close to an artist comes from a connection yet so many musicians spend their days plotting how to avoid those connections by being anonymous or working on songs that they think will make them look cool instead of writing about their authentic emotions and showing them to the world but I got bad news for those musicians for years we've lived in a world where even the dumbest music fans can sniff out the musicians who are faking it so you have to remember your time on social media should be spent showing parts of you fans could bond with as well as in your music making sure you're also being vulnerable and guided by making as an intense emotion as possible since that makes the best music and what excites fans the most stop caring about view counts on YouTube so many musicians freak out about the idea of having a video of just their album cover that comes out first then a lyric video or a visualizer and then a music video because they worry about the plays being spread between all of them and not have a big number to impress grandma and show her how you're doing big things while I'm sure grandma is real sweet you really need to get past gatekeepers and they're gonna look at your Spotify and look at how many streams your song has monthly listeners and if things look impressive they're gonna make sure all those plays aren't fake and from Bot Farms in Russia in New Zealand since I know some of you think you're being sneaky but you're not concentrate on engaging real fans and the enthusiasm will be easy to see by anyone who's worth working with here's the easiest way to get streams for your song that actually works one of the dumbest things I see musicians miss doing is they should always link to a playlist of their music instead of an individual song when you look at an individual song on Spotify once it's done it starts playing the Spotify radio of that song which then plays other artists when you play one video on YouTube it could start playing a tutorial on building a desk afterwards so always have a playlist of the best experience a fan would have listening to your music with similar songs as they won't hit stop until they hear a bad song most of the time and will keep listening and driving up your streaming numbers music stacks can help you market your music you may know music stacks as the site that will show you Spotify API information about your track like its popularity score which you know is the metric of whether Spotify is gonna put the song into its algorithm but it can be used for more than that if you scroll down a bit on your song's page it will show you songs your song is similar to you can then put the most popular of these songs on your artist playlist next to yours and if fans engage with that playlist it will continue to up the level Spotify sees to connect you to the songs that are most similar to you and help the algorithm further strengthen the suggestions it will make for your song to be recommended when the other artist song is played on things like Spotify radio four weeks a year you shouldn't promote your music and what I mean by this is if you're planning your biggest events on certain weeks they're gonna do way worse than they would if you just waited a few weeks for example the level of consumption of new music drops greatly in the last two weeks of the year especially as the end of year list seem to now come out the week after Thanksgiving but just as bad the internet seriously slows down the last week of July and the first week of August as it's hot out in one of the most popular vacation weeks oh yeah and never release music near a presidential election since your posts just get buried with all the news Spotify canvas boosts your streams so it's time to make one seriously people half the time when I stream your Spotify songs there's no canvas now I know a lot of you think why do they work but here's the thing when people share them in Instagram stories or have something fun to look at they feel the song more when they see the visual and this is one of the simplest things you can do to get your song a little more juice and Spotify confirms this and they say you're a hundred and forty five percent more likely to get track shares 20 percent more likely to get added to playlist and this is so easy to do since they are three to eight seconds and you could do the same canvas for your song as another one just change the color or filter a tiny bit pre-saves don't do what you think they do fun fact Spotify can't see the pre-saves you get on your song until it's released the pre-saves are stored inside the tool that does the pre-saving which is not in Spotify system so Spotify only sees the save on the day that your song actually comes out but here's the thing you all think this helps get that song on Spotify playlist when it doesn't do that how to get more streams and connections in the algorithms on the night after your music video drops announced an Instagram or TikTok live depending on which works better in your music promotions schedule everyone who worked on your song to come on for 15 minutes and talk about making it this includes all the musicians who played on the track producers mixers video directors actors hey even someone who is just a good vibe that was hanging out this will alert all their followers who are online that they are doing a live and you could have them come promote it which will in turn promote your song and bring your awareness to what you're doing with the people most likely to enjoy it since they worked on your track this literally puts you in front of the eyes of all the people who worked on that track who have followers who are most likely to be interested in what they do


All right, it's noon, everybody. I'm going to let a couple, a minute or two go by and let a few more people filter in. If you'd like to follow along in the slides, I've already uploaded them to SlideShare and it's linked to you from the session. All right, let's get started, shall we? Welcome, everybody. It's nice to have you here. So many faces, some I've met before. There's some familiar ones in the audience and there's a lot of new people, but it's great to be back at DrupalCon. Hope you're all having a great convention. Let me introduce myself. I'm Suzanne Aldrich. I'm a solutions engineer. I work at Cloudflare for the last couple of years and prior to that, I've worked at a couple different Drupal hosting companies so I've seen a little bit about what it's like having DDoS attacks hit your infrastructure, hit your website. It's not a fun day. Nobody likes it. And the purpose of this talk is to familiarize you with some of the terminology and some of the technologies involved with launching DDoS attacks, the methodology, and also what can you do to mitigate it? What kind of strategies can we advise? So to get started, DDoS attacks are making headlines all the time. We hear about them and it's an ever-increasing thing. They're getting larger and larger and it's becoming increasingly important as more businesses move online. They have a lot of vital operations on their websites. They have web applications. There's APIs and they're all possibly targets. So this is important for you to understand so that when something like this happens to you, you have some tools at hand potentially to help mitigate that. There's different kinds of DDoS attacks. They can be roughly divided into some different categories and I'm gonna help familiarize you with what these categories are. So from a high level, and I mean very high level, all that a DDoS attack is is a traffic jam. It's an attempt to make it difficult for normal traffic to get through by clogging roadways with malicious traffic. And it prevents the traffic from getting to its desired destination, which is gonna be your server that's serving your web app, your API, et cetera. Let's break it down a bit. Distributed denial of service. It's a malicious attempt to disrupt this traffic and it has a target. There's gonna be a targeted server. So there's attackers and there's a target. And it does this by overwhelming the network or any kind of intermediary point surrounding infrastructure with the flood of internet traffic. These attacks are achieving effectiveness by utilizing multiple compromised servers or systems as sources of the traffic. That's the part that makes it distributed. Types of machines that can be exploited include home, office computers, servers, VMs sitting around that nobody updated. Might be an IP camera. Could also be something like a malicious app running on a mobile phone, mobile devices. Other places that we see are also just any kind of any kind of a networked device. The motive behind these attacks are varied. Used to be more often it was political, social, some kind of animus against whoever was running the site, the API, usually a website. These days we're starting to see more financial reasonings. And one of the things that I believe has driven the rise in some DDoS attacks is the emergence of cryptocurrencies. Cryptocurrencies allow people to get paid in a semi-anonymous way. There's still ways to track who received the payment which is how law enforcement gets to the bottom of who is the receipt of that wallet. But people will actually literally put their crypto wallets in email ransom letters that they send to targets. And so one pattern that we often see is a DDoS ransom note like this one that I've attached there with ever so wonderful English in it explaining how they're gonna give you a demo attack to give you an idea of how painful it's gonna be for your website to go down. And if you don't pay up X amount of Bitcoin, in this case I think it's eight Bitcoin, then they're gonna take you down for an interderminant amount of time. And that could really be very frightening for somebody who receives one of these attack letters. So our piece of advice at Cloudflare is never pay a ransom note. It's not like don't pay attention to it but don't pay a ransom because that's just encouraging the attackers. They're gonna keep going around collecting money and funding these kinds of operations. They use this money to do things like purchase time from these internet stress devices, these networks or these services, these booters, and they utilize these booters to launch their attacks. So don't pay the ransom. Another thing to keep note of is that these attacks occur for every industry. It's not isolated to just political candidates. It could be your mom and pop store and you can imagine how worrisome that can be especially if a small and medium business is making a lot of money on the internet and now they're being faced with some enormous ransom, thousands and thousands of dollars they might consider draining their bank account. But also large enterprises face these all the time as well and it's brand damaging. We've had a case of somebody who was on our network during Thanksgiving and for 10 days straight somebody went and attacked them with over 200 million packets per second and 400 gigabits per second of traffic and they would just pause each night to go to sleep and then the next day they would go and keep attacking but that's just kind of an example of what a typical attack might look like or a very determined attack. Eventually they give up because they're on Cloudflare and you can't win. I wanna show you a little bit about some of the historic attacks that Cloudflare has helped mitigate over the years. Cloudflare engineers have helped mitigate some of the largest known DDoS attacks in the world. We've been doing this for over five years. It's actually our seventh birthday this week so happy birthday to Cloudflare. In the winter of 2016 you can see we mitigated the largest layer three DDoS attack to date. Not only were we able to mitigate it but we were able to analyze it which is extremely helpful to understand the attack. DDoS attacks are taking all kinds of shapes and forms. In the middle attack you can see a 400 gigabit per second amplification attack where they use 4,500 NTP servers to attack from a mere 87 megabit per second source server. That's kind of an amplification attack. That's where you take a small thing and make it bigger. It's a little funny now to look at it but the third panel shows the spam house attack. That was 120 gigabits per second and at the time that was a big attack. But we kept their website online. With the evolution of DDoS you can see that we're growing. Each year they get bigger and bigger and bigger and by now they've way outstripped the capacity of any typical network link to be able to absorb this sort of attack. And in addition they've moved around on the layers of the networking model. They used to be more on the volumetric layer three and four attacks. We've gone up to NTP reflection and now an emerging landscape of IoT devices that have been potentially infected with malware or have weak passwords and are taken over as botnets. Those are enabling people to launch these very large layer seven attacks from all over the world, highly distributed attacks coming from hundreds of thousands of IPs. We see an L4 or L3, L4 DDoS attack every six minutes. We see an L7 DDoS attacks every eight minutes. So that's about 80,000 attacks a year for every six minutes or 60,000 attacks a year for every eight minutes. So we're seeing just a very large scale of these attacks. And to give you an idea of the size of your average attack it's not uncommon for an L3 attack to be around 50 gigabits per second which is easily five times what your typical router or server internet connections can take. DDoS attacks, how do they work? It requires an attacker to gain control of a network of online machines in order to carry it out. As I was describing computers, other machines are infected with a malware. Each one is being turned into a bot or a zombie. The word botnet is a portmanteau of robot plus network. So it's botnet. You can see some examples of devices that can be taken over and a lovely illustration showing you that the attacker is controlling all these from some kind of central command and control system. If you deconstruct malware you can find interesting bits and pieces that point out how that command and control structure is laid out. That'd be very interesting. So basically once the attacker gains control of the machines they send instructions through their command and control infrastructure to the botnet. The instructions are usually something along the lines of the IP address of the target. And then the little bots go about their business and they attack it depending on whatever protocol or function or script that these people are using. When the IP address of the victim is targeted by the botnet each bot will respond by sending requests to the target and potentially cause a targeted server or network to overflow. Its capacity is completely overrun. And that is exactly what a denial of service is. It can't take any legitimate traffic. It cannot answer a legitimate request. So at this point the attacker has succeeded in taking the target down. Because each of these devices could potentially be a legitimate client it could be very difficult to separate out the malicious traffic from legitimate traffic that you get from normal kinds of web clients or other sorts of applications. So what are common types of DDoS attacks? Let's dig in a little bit. What are the categories that we see? To begin to even really dig into that question we need to start talking about the OSI model. This is a model, a conceptual model that was designed to help give some sort of structure to all the parts of networking. So different DDoS attacks attack different layers of this OSI model, Open Systems Interconnection Model. Let's go through each layer kind of briefly so you get an idea. It might have been a long time since you studied network layers. We start from the ground up and it's like building a house. Each layer serves a function. So at the bottom you have the physical layer. That's the physical medium for transferring data. Cat5, fiber optic Wi-Fi, it's the bits. The next one is the data link layer. I have no idea what this does. No, just kidding, it's switching. Layer three is a network layer. That's where a lot of DDoS attacks happen and this is essentially the part where we decide what path a particular bit of data shall take. And this includes bits of hardware like network interface cards, routers. It's a combination of software and hardware. This is where IPv4 and IPv6 addressing occur. Layer four, the transport layer. That's important because that's essentially where our transmission protocols come in, TCP, UDP. This is where port numbers become important. Layer five, the session layer that manages the session. So building it up and breaking it down. Layer six, we have the presentation layer. This is kind of a minor layer but it's important in terms of formatting data and parsing it and this is where encryption happens. And then finally at the top, our favorite layer where pretty much everybody who's working in Drupal is familiar with this is the application layer, L7. And this is the human-computer interaction layer. So well-known protocols here are HTTP, SMTP, and DNS. It's a little anti-intuitive but DNS is an application layer protocol. So attackers are exploiting the different layers. They're exploiting them on layer three with flooding, reflection, amplification attacks. On layer four, they're using protocol attacks like TCP SIN flood. And on layer seven, they're taking advantage of hitting refresh a bunch of times or as complicated as something like slowloris, I guess is complicated to script. And then you have your DNS flood attacks. And I think the important takeaway is to understand that the attacks are layered and they don't always just drive this kind of attack, that kind of attack. There might be multiple attacks happening at the same time, multiple layers being targeted. So it can be attacking different parts of your infrastructure. With the volumetric DNS flood attacks, you're having a large volume of flooding of your DNS infrastructure and that's causing people to not be able to even look up the address for your website. So you're basically interrupting that lookup that happens when somebody types an address in the web browser. Browsers making a DNS lookup. Well, DNS server is not resolving. Your authoritative DNS is not responding. Nobody can go to your website. Amplification, in this case, the target is basically having their IP address spoofed and the DNS queries are happening in such a way that the answers to them are much larger than the query that was sent out.  So it doesn't take a lot to actually launch one of these attacks, just a well-crafted DNS query. And then on the bottom here, they're illustrating an HTTP flood, which is probably something you all have experienced or seen in logs before, where you'll see some requests, some particular endpoint being hit over and over again. Maybe you have some different refers, maybe you have some different slight variations on the query string, but that's what those look like. And you see those in server logs, unless you're blocking them. And all of these attacks are impacting the application's ability to be reliable and to serve it performantly. So let's go and talk about volumetric attacks. And I'm gonna talk about a particular kind of volumetric attack, which is a DNS amplification attack. These are neat, I like describing them. I will say that there are fewer and fewer DNS amplification attacks over the years because there are fewer and fewer open DNS resolvers, but it's still very interesting and we should discuss this. So this category of attack, essentially, it's attempting to create congestion by consuming all the available bandwidth between the target and the larger internet. Large amounts of data are sent to a target by using amplification or another means of creating massive amounts of traffic. So amplification is one way you can just directly cause requests to happen as well. Botnet would be a good example of that, layer seven botnet. DNS amplification attack is like, if someone were to call a restaurant and say, I'll have one of everything, please call me back and tell me my whole order. And the callback number is actually the target's number.  With very little effort, a long response is possible. And essentially how it has worked is that the request is made to an open DNS server with the spoofed IP address, which is the real IP address of the target. Just so that you know, spoofing IP addresses is still a really big problem on the internet. And there are some different projects out there that have done analysis on what networks allow spoofing. And it turns out that presently, there are about 25% of the world's networks are allowing spoofing of IP addresses. So of course, a recommendation is to, as a network administrator, clear that up. You shouldn't allow anybody to spoof an IP address from within your network. If it's not legitimately within your range, you shouldn't be allowing that to be sourced from your network and send outward. The next style of attack are the protocol attacks. A really good example of that would be a SYNFLED attack. And protocol attacks are state exhaustion attacks. They cause a service disruption by consuming all the available state table capacity of a web application server or intermediary firewalls and load balancers. These attacks are utilizing weaknesses in layer three and four of the protocol stack to basically render the target in acceptable. And I think a really good analogy for this is it's a worker in a supply room. So what's going on is you have a worker who is the target and they're being sent this initial SYN, the SYN packet. And the worker is coming back and giving them acknowledgement, but the original attacker does not complete the handshake. So what happens is the target leaves this connection open because it thinks it might eventually get an acknowledgement and then it proceeds to not ever get it. And what happens is that you end up with all these different SYN packets hitting the target, leaving these open connection states and the target is quickly consuming all of its memory resources. And the whole state table is filled up with these connections. This attack exploits it often times with a spoofed source IP address, which makes it very difficult to locate the source of the attack as well. You could probably work with an ISP to find that out, but it's a lot of investigative work. Application layer attacks, these are on the order of your web application. And so a simple example of that would just be hitting refresh over and over again. And if you had a really weak site, it would never be a Drupal site of course. That site might be taken down because it's unable to essentially respond to all these particular resource requests in a timely manner and eventually it kind of becomes a little overburdened. So the goal of these is to exhaust the resources of the target. They target the layer where the web pages are generated. The server is having to pull these resources every single time there's a request. It might be just files it's looking up. It might be a database query. So there are a lot of things that are going on to make a webpage happen. And that's what this is taking advantage of. Be expensive for the target server to respond. I should note that it in the past has been expensive for the client, the botnet or script to actually perform some of these attacks in the past. However, as computing power arises, of course, their ability to perform these attacks also increases. So that's one of the reasons why in the evolution of DDoS attacks we're seeing more and more layer seven. They're also very difficult to defend against. It's hard to tell the difference between a legitimate request and something that's not legitimate. What if it's just a sale and you publish something and marketing is very happy with all the eyeballs they've reached and suddenly your website's seeing a giant influx of traffic. How do you tell that apart from some script kitty? And it's not an easy question to answer. It takes a little bit of tuning and I'm not convinced that anybody's come up with the perfect solution but we're definitely trying. Simple implementation, it's the same URL over and over again. It's the same kind of user agent, same refers. More complex, you'll see randomization of these refers. You're gonna see different query strings, different endpoints, which makes it even harder to figure out is this legitimate or not. How are DDoS attacks mitigated? It's important to understand here that no one single method is gonna be capable of protecting against every variety of DDoS attack that's ever existed. So one must keep in mind that this is gonna be a layered approach. You're gonna have to probably implement multiple things in order to prevent all these different potential attack factors from being vulnerable points for your application or your network. The more complex the attack, the more likely it's gonna be difficult, as I mentioned, to separate from the normal traffic and that's actually the goal of the attacker. They're trying to blend in as much as possible. Anything that the attacker can do to make the mitigation inefficient, they're gonna go for that.  The whole purpose of this is to block legitimate traffic. So if you're dealing with an attacker who's trying to blend in and your mitigation strategy isn't good enough, isn't able to make that distinguishment, then you're essentially accomplishing the attacker's goal for them.  This is something any network admin can do and actually this is something that could happen to you from your upstream, your ISP of your service.  It's not a very good day. You're gonna have to definitely pick up the phone for that one. There's gonna be a lot of pagers going off. Something where you would want to have very specific criteria about what traffic is being black hole. The next methodology, and again, this is just part of a layered approach, would be rate limiting. Just limiting the number of requests that can get to your server can help prevent it from becoming exhausted. And yes, there might be some legitimate traffic that gets caught up in the mix, but you've saved your server for another day. Another request that could come through after this one's been kind of delayed. So this is definitely something that is, it's helpful. It's really better for things like brute force attacks or just slowing down web scrapers, but it can also help in this situation as well. So we do recommend rate limiting. A web application firewall is also very useful, especially when addressing any kind of layer seven attack. This is a way to discriminate against traffic in a kind of a targeted way. You can look at the exact user agent. You can look at particular IP ranges. You might wanna look at particular request types or query strings or something that's matching a pattern. You might be able to put some kind of regular expression into play here that can match a lot of the different randomness that these attackers are injecting. And I think one thing to keep in mind is that if you implement a WAF solution, you really need to make sure that it's easy to deploy new custom rules because in an incident, one of the things you're not gonna wanna do is waiting for a WAF rule to compile or deploy. Finally, I'm gonna talk about anycast network diffusion as a method of mitigation. This is something that Cloudflare uses quite extensively and is one of the reasons that we're able to absorb so many attacks. Let me just quickly back up. So there's Unicast where there's a one-to-one relationship between an IP address and the service. And then there's anycast where all these different servers are actually broadcasting the same IP address. And the way that internet routing works with BGP is that you basically go for something that's gonna be the shortest path. So the network essentially picks its own path and we're able to distribute very efficiently with really no work on our part, all this attack traffic through multiple servers instead of just routing them to one. And a good analogy for this is like a stream that gets channelized. So there are multiple channels for this stream and it's just naturally flows through these different directions and it doesn't concentrate on one server or set of servers. Now the reliability of an Unicast service to distribute a DDoS attack is dependent both on the size of the attack and also the network capacity of the Unicast network itself. So those are important things to look at. What kind of size DDoS attacks are you wanting to mitigate for? You have to compare that to the size of the service that you're looking at. For point of reference, Cloudflare has a 10 terabit per second network over that. And that's a complete order of magnitude above the largest known DDoS attack to date. So I wanna get into a little bit more of a deep dive into some of these different DDoS attacks, exactly how some of them work. One that you've seen commonly is a UDP flood attack. UDP is like the lesser known cousin of TCP and I would tell you a UDP joke but I don't know if you'd get it. So this is a type of an attack where these user datagram protocol packets are sent to a targeted server and the whole aim is just to overwhelm it and limit its ability to respond. The firewall protecting the service can also become overwhelmed and exhausted from this kind of attack. So you have to pay attention to all the layers of your infrastructure. How it works is that it takes advantage of normal UDP operations. With normal UDP, a server is essentially checking for running processes at particular ports. It's seeing, is anything listening here? And what happens is that if nothing is listening on that port, the server responds with this ICMP ping response and it sends that back to the center of the UDP packet so just let them know the destination's unreachable. I think a good analogy for this is a hotel receptionist who's receiving calls at the front desk for some guest. So the receptionist picks up the phone. Somebody, I'm looking for this person, I'm looking for Suzanne, can you connect me to her? And the receptionist goes and calls my room and turns out I'm not available. Then they go back to the phone and say, yeah, she's not there. Meanwhile, another call comes in and then another one. And quickly, the receptionist is not able to keep up with this falling of calls, becomes exhausted and probably quits and walks out the front door. So you can see that this becomes a quickly overwhelming proposition. The way that these are actually executed is that an attacker is gonna utilize this to go through all the steps. And what they're gonna do is they're going to not use their own real IP address, it's gonna be spoofed. But they're gonna spoof the source of the UDP packets and they're gonna make it hard for you to figure out where they're really coming from. The target's resources are gonna be exhausted very quickly and there are a couple of mitigation strategies that can be taken. One thing that a lot of operating systems do is actually limit the response rate of the ICMP packets in order to disrupt any kind of DDoS attacks. But one drawback is that during an attack, legitimate packets could also get dumped. So if you're running a legitimate UDP service, it's gonna be difficult to tell the difference between the ones that are coming in looking for an actual DNS response versus ones that are coming in with a spoofed IP address. You're not gonna be able to really distinguish between those. And any kind of mitigation at the server level also is gonna be quickly overwhelmed if any upstream is becoming overwhelmed as well. So how Cloudflare mitigates UDP is, it's actually pretty simple. We just drop all the UDP packets that have nothing to do with the DNS and that's it. Because of our Anycast network, we're also spreading it across multiple servers. So no one server is gonna be getting all these particular UDP packets. And so we have sufficient capacity to handle a UDP attack of any size. What is a SIN flood attack? So another terminology for this is a half open attack that refers to the way that states are left when the connection is opened and it's left open and left open and left open and never closed. This attack is just making the server unavailable to legitimate traffic and it's taking advantage of the SIN protocol. So we're sending initial connection requests and we're overwhelming all the available ports. And then the targeted machine is gonna basically get really, really slow. It's not gonna be able to handle all these different connections. Normal TCP connection, again, client sends a SIN packet, server responds with SIN AC packet. Client returns an AC packet to acknowledge the receipt of the SIN AC. And then after this whole series of packets have been sent and received, the TCP connection is completely open. And the attack is a little different. The attacker is sending a high volume of SIN packets. The target is responding to each and every one of these with the SIN AC. And then waits and waits and waits and nothing happens. It never gets this AC back. All these connections are taking up space in the target server. In networking, when a server is leaving a connection open but the machine on the other side is not, the connection is considered half open, which is why they call it the half open attack. These SIN floods can occur in a few different ways. One of them is a direct attack. This is one where they're not even bothering to spoof the source IP address. They're just sending out these SIN packets, target receives, and then what the attacker does, which is kind of clever, is they'll have some kind of firewall setup where they're filtering, so they won't receive that SIN AC packet back, so they won't get flooded with their own attack. And that's how they've performed it. These are very uncommon because they're not spoofing their IP address and it's trivial to stop this. You just need to block that IP address. So we don't see a lot of those. We've moved on. Now you're seeing a lot more of the spoofed attacks. So in this case, they're sending the initial SIN and they're spoofing the IP address from which this packet is being sent. And this makes it more difficult to inhibit the attack. It makes it difficult to mitigate. It's not impossible to trace these packets back to their source, but you're really gonna have to talk to your ISP about it. You have to call them up. It takes a little bit of network engineering to understand where this attack's coming from. But if they're willing to help, you might be able to get an idea of who was trying to attack you. The third kind, which is becoming more and more common, is the DDoS, the distributed SIN flood attack. In this case, they're essentially using the botnet that they've got control over to launch this attack. And in this case, it's kind of like a direct attack in that it's not really necessary to spoof the IP address. They're taking advantage of the fact that these are not their own computers. So it doesn't matter to them if these particular end points end up dropping off. But sometimes they'll even spoof these particular bots as well. And then it's getting even harder. And if they're using something like the Mirai botnet, they probably don't care about spoofing it. But in other cases, they might, depending on their needs. These kinds of attacks take substantially less capacity to launch than some of the other sorts of attacks, the volumetric flood attacks. And that's because the attacker has the ability to check out the behavior of the target and essentially determine what the actual size of the backlog queue is for these connections. And once they've determined that, then they can actually tune this attack such that they're sending the minimum amount of packets out to really take down the target. So this is pretty interesting. To mitigate a sin flood, there are some different methods that you could take. One of them is just increase your backlog queue. And this is something that is pretty simple to do. You just add more memory, essentially, make the queue bigger. Eventually you're gonna run out of memory though. So this can really only go so far. If there's not enough memory, you're gonna eventually gonna have poor system performance and get really sluggish, but maybe not totally down. Slightly better than nothing. Another methodology is this recycling of the oldest connection in the queue. So basically what happens is that you're taking the oldest half open connection slot and recycling it. And then that way you can kind of cycle through each of these connection slots that never really got fully opened. And that way you can receive future packets and hopefully they're legitimate and not more attack traffic. However, this is gonna fail if the attack volume increases because of obviously upstream architectures can be overwhelmed as well. Another strategy is gonna be sin cookies. Sin cookies is basically a way of attaching some information to the packet such that we can just dump the table that stores the initial sin. And if we get an act back, we can actually reconstruct the original connection. So we're able to, it's kind of like refilling the backlog, but it's using information that we're attaching to essentially reconstruct the connection based on an additional act that has to come back from the originating client. It's definitely better than a DOS, but it does lose a little bit of information about the TCP connection. Finally, I list here using a proxy service, Cloudflare's a proxy service. The way that we mitigate these attacks is that we're standing in between you and the attacker and we're doing all the handshake stuff and we're actually not forwarding any of the TCP connection into the origin until the handshake has been fully completed and we've got a real connection opening and that's how that works. So DNS floods, this is becoming more and more common. Now DNS, hopefully you know, is like the phone book of the internet to get a website, you type in an address. There has to be a lookup to find the actual IP address of the origin server or some load balancer or other infrastructure. If you flood a particular domain's DNS servers, however, you can disrupt the DNS resolution for the website. If you can't find the phone book, you can't make the call. So by disrupting DNS resolution, DNS flood attack will essentially compromise a website or API or other applications ability to respond to legitimate traffic. These attacks can be also very difficult to distinguish from legitimate traffic because these queries are coming for legitimate addresses, host names that are being served by the authoritative server and how do you understand who's making the bad query? So that makes it pretty challenging. In addition, this traffic can be very high volume but coming from a very large distribution of endpoints so that can make it also difficult to understand if this is something that's malicious or not because the actor has spread out the attack amongst multiple bots. Here's an illustration showing you in pictures. I like pictures, they help me understand a little bit better. So here you see the attacker, they've got the botnet. They're directing their botnet to attack the DNS resolver. Now a legitimate user is trying to make a connection to that DNS resolver to get to the address of the website and they can't because the DNS resolver is too busy talking to the bad guy. That's how that works. One of the issues with these kinds of attacks is that first of all, they're rising with the rise of IoT. As IoT devices are spreading and many of them are very insecure, they come with these really ill-advised default password username combinations. Some of them are easily hackable. What's ended up happening here is that these kinds of attacks are becoming more and more common. And it's really hard to protect against because this is having to do with your DNS infrastructure. Your upstream might be quickly overwhelmed and if you have a service instead of running your own DNS servers, then you have to watch out that they have the capacity to handle this. And also it's probably wise to make sure they have the network architecture to handle this. And this is of course one of the main reasons why Cloudflare is using anycast. We're able to effectively spread this attack to each of our servers and there's no one server that's receiving the brunt of it. And your website, if it's using Cloudflare DNS, will continue to answer. To give you an idea of Cloudflare's scale, at this point we're handling about 10 million requests per second, 10% of internet requests. We're handling 38% of all DNS queries. And we have 115 data centers located spread out globally. So that really helps keep the attackers in the country of their attack. It's not getting outside of their country. As I mentioned, we've got the 10 terabit capacity. Handling so many different actually unique visitors at this point, we're up to 2.5 billion. And I keep having to update these numbers on my slides. Six million websites, apps and APIs in 150 different countries. Just to give you an idea of, you really want to be looking for something of this scale to be handling your DNS, right? We're coming to the close of my slides. As a reminder, there's a contribution sprint. Please join, contribute to Drupal, make it better, make it a better world. And now I want to open up for questions, concerns. Also, if you have any stories, I always think that war stories are kind of interesting. If you're able to share, feel free to anonymize your customer or client, but really would like to hear what you have to think about DDoS attacks in this day and age. And if you're interested, I can also talk a little bit more about some recent attacks that we've been handling. Any other questions? Yeah, thank you. On any CDN service offers mitigation of some sort of additional service, the order C panel subdomain pointed to their actual IP address, your service and your attempts to mitigate the attack are quite useless because it is quite easy for any attacker to attack that direct address. And I have not seen a CDN network that would warrant the users against service of my domain, the DNS stop and look the FTP and there is not even a warning that this is a potential risk for my site to be attacked. One warning that we do provide is if you make a DNS entry and you enable the proxy for that particular IP address, if you were to disable the proxy for a different DNS entry that points to the same origin, we will provide a warning directly in there for the user then user to see. One of the recommendations that we give to anybody who's trying to protect us is to make sure that you're separating your concerns out into different origins. And it's also important to note that different services mean different things to different stakeholders. I think that in this day and age, a website in its uptime is probably more important for most like business owners than their FTP service. So it's obviously important to try to make sure that you're pointing to different origins for each service. I mean, some of the, I don't have an average duration number right in front of me, but we, as I mentioned, we sometimes see attacks that just span days, weeks that Thanksgiving attack was 10 days straight with rests at night when I guess the guy went to sleep. Sometimes you'll just see a few minutes worth of attack traffic. Those demos that those ransom note writers do, they'll just tack you for a short period of time, an hour or two, and then let off and give you an opportunity to answer your email and find their Bitcoin address and potentially pay them. But yeah, it could be hours, it could be days. We don't pass that traffic back through to the origin though. So hopefully they don't have any kind of service disruption. One thing to note is that it's our birthday week and on Monday we announced unmetered DDoS mitigation for any plan level, including the free. So if your client's under attack and maybe they don't have budget or you're exploring budget, you can sign up even under the free plan and receive relief from any kind of a DDoS attack that you may be suffering. Maybe with the slight exception of layer seven which might require a little more tuning. In that case you might wanna consider enterprise plan where you'll end up talking to a solutions engineer like myself and we'll tune the rate limiting solution in order to make sure that some of these different expensive queries. And I know how it is with Drupal. Not everybody has the opportunity to go and make sure all their views queries are cached. But it's important to do that. You've got to try to harden your Drupal. That can really help bring up the resiliency on the layer seven side. And it's also important to try to cache as much as you can on the CDN. So it's all living on the edge and it's not something that has to go back to the origin to produce that kind of response. Alex. You have much seen it. What we do when we have, we don't have dedicated IPs for every customer. Some customers like the free customers are on shared IP maps. What we do when we're experiencing a impactful attack against any of those maps is we perform what is known as scattering. And what this does is essentially, it's kind of like a binary function where you divide and divide and divide until you figure out who was the actual source or the actual target of that attack. You can isolate that particular customer away from the other customer. So that's one of the ways that we avoid having that noisy neighbor problem. Yes. So in a bunch of the attacks you mentioned, IP spoofing was kind of an important component of that. How does IPv6 affect that? Does it make it harder to mitigate or are there parts that make it easier to address? You know, that's a good question. I'm not sure if I know the answer to that question. I'd be happy to find it for you and talk a little bit afterwards and I can definitely inquire. I will note that as much as Claude Fuller is trying to increase the adoption of IPv6, it's been one of those kind of stubborn standards that seems to have this rollout that's been taking like, I don't know, has it been a decade or something like that? We've run out of IPv4 in North America. I don't know how much IPv4 you have left in Europe, but it's all allocated. So yes, it's definitely a concern and I'd assume that if a network is allowing a spoofed IP address, I probably doesn't matter as much, but I would assume that most networks are better configured for IPv4 at this point. We'll see how it is in five years.  I've seen a few interesting layer seven attacks in my time.  Sometimes it's police stations. There's different reasons why people might be doing this, but I've seen anonymous attacking websites and you know, it can be.