All right, thanks everybody for coming. I will start two minutes early because the room is full already anyway. So my name is Klaus Purer. I've been a Drupal contributor for a long time. And my specialty is code review. So I have new contributors. When they publish the module, they have to go through this process called the security advisory coverage process. And my screen just went out. Damn, new screensaver. I hope it's back soon. You can find me on drupal.org under Klausi. I was also part of the Drupal security team for a couple of years. I work for Tropicode.com. We are a job work provider that is doing their technology based on Drupal. And yeah, during this process, when I do the code reviews, I thought it would be a good idea to somehow give some examples what kind of stuff that I find so that you can also apply that when you review the code of your colleagues or code on drupal.org, whatever. What are the goals of the code review? What are we trying to accomplish? So we want to find problems before they hit production. So somebody is writing the code, and then it would be a good idea if somebody is actually reviewing the code and making sure that nothing bad is in there. And that way, we can prevent security vulnerabilities before they are exploited. So we are in the security process that is called the prevention phase. So before anything actually happens, we make sure that we prevent as much as possible. Code review is also a form of knowledge transfer. So the developer that is reviewing the code might know some things that the author of the code didn't know, and they can point it out, and that way that the code can be improved. And actually, that's also a good opportunity for new people in your company or new contributors on drupal to point in the right direction how APIs should be used. And in the end, what do we want to do as companies? We want to save costs by preventing problems. We want to prevent bugs so that it's not embarrassing for us when clients detect those bugs. We want to catch them beforehand. But we also want to save costs and prevent the security breach, for example, or any vulnerability that would expose our data or compromise our data. Usually, code review is done in pull requests. So that happens a lot on GitHub. But we also have the patch system on drupal.org. And within your company, I don't know what to use. Many companies also use pull requests. And the goal is one, developer writes the code and the peer reviews the code and makes it better. All changes to drupal core, for example, are peer reviewed and code reviewed. So before a change goes into drupal, it has to be looked at by another contributor. And then they approve it. And then it gets committed by core committers. So we're also doing that in drupal already. So yeah, I structured my talk by giving just a couple of examples. Let's look at the typical drupal 8 module layout. In this example, I used the name PANTS. So we have some kind of PANTS module. Not sure what it does. The typical files that you are seeing in this module is install files, module files, and then a couple of YAML files in drupal 8 that contain your configuration. What I look at first is the module file and the routing file, because when I first look at the module, I want to see the attack entry points. What can somebody do with the module? Where's the request coming in? And where's the request handled? And what problems might we see there? Then I go through the controllers and classes and services that we have in the drupal 8 module. And in the end, I want to know where the information goes out. So I would be looking at the tweak templates, preprocess functions, anything that creates output in drupal render arrays, what they are doing. That's my typical process. And in the end, I want to read through the whole code of the module. I think that's also important. It's not good if you review parts of a module. In the end, you should just take a look at every file, what they are doing in there. Then you also better understand how they are interacting. So let's start with routing. Routes are defined usually in the routing YAML files. You can also create dynamic routes in some dynamic route plugin. I don't know if it's a plugin. I think it's an event subscriber. But usually, people do that in the routing YAML file. So this is where I look first. Incoming requests, they are mapped in these routing files to controllers. And here, for example, we have a PANTS controller in the source folder. So that's just to look at the routing file, what is defined there, and then the PANTS controller, what it's actually doing. This is not the only attack entry points that you can have in a Drupal module. So Drupal is also known to do a lot with events, plugins, and hooks. So those would be the next extension points that you would look at in a module after you are done with routing. All right, so let's take a look at this PANTS routing YAML file. Let's read through it. The route has a name at the top, PANTS.admin. It exposes something at a path called slash admin slash PANTS. And there's a form attached. It's the PANTS admin form. And in order to access that admin form, you have to have the permission access content. And we define it as an admin route. So not sure I like that. Any idea what might be wrong here? Access content? Yeah, access content is really a weird permission that shouldn't be here. So this would be an access bypass in a route. I don't know what this admin form does, but just guessing from name, I know already admin stuff. We don't use the access content permission. We need to probably use some other permission there, like administer PANTS, for example, if it's about the PANTS module. Some people also use like administer site configuration, which is the very generic backend configuration permission in Drupal that is a bit overused. So better module defines their own admin permission and use that, but don't use access content for admin routes, for example. And I tried to map this a bit to the OWASP top 10 security vulnerabilities. OWASP is a project that collects risks, vulnerabilities, and how they can exploit it in this comprehensive documentation framework. It's the open web application security project. And actually this would fall under the top five called broken access control. So some access control is broken and a attacker that has access content could actually change something on this admin form. But I even see even worse things. So in the requirements, if it's by specify underscore access true, it means everybody can access this admin form. Why do people do this? Why do I see this in code reviews so often? So people, they prototype with their module and they don't have a permission yet. And just for development, I will put in this access flag true and then later I will fix it. Of course that later never happens and then this stays in the module and then the module might be deployed and then this is really dangerous because any attacker, actually any user can access this path and change values in the form. Yeah, so that's a second access bypass. Let's look a little bit more complicated example. Now we want to delete pants. So pants are some entity, some object in our group system, we don't care actually for this example. And we have a delete path where I can specify an identifier of a path. For example, in number one, two, three, four, five whatever the identifier of the pants is. Then it goes through to the delete controller. We specify it in the controller here. Some pants module is loaded and in the controller as you see at the bottom, the pants are deleted and then we show a success message in a Drupal render array. So this looks good, right? What could possibly go wrong here? I see you're raising a hand here, any idea? Regular expressions? No, regular expressions should be a problem here. So if you just pass an ID, that's not the point I want to make here. Any other guesses what might be wrong with this code? No confirmation step. Exactly, and what does no confirmation step mean? This is a cross-site request forgery vulnerability in a route. So we never confirm in the user's intent here. You have to imagine if I just type in slash pants slash delete slash one in the browser and you do this as an admin, it will just go ahead and delete this pants without user confirmation. What do we do in Drupal to prevent that? Can we use confirmation forms or tokens in the URL or the request? So how could an attacker exploit this? They put together an image tag and instead of using an actual image in the source, they use this path to your Drupal site where they point to some specific pants they want to be deleted on your behalf. And that's actually also the root of the problem. The browser is doing something on your behalf. So you visit the attacker page and there is this image. And the image source fetches something from your page from your Drupal site. And what the browser does, it also sends the session cookie along. So you're logged in as admin on your Drupal site. The browser fetches this image, sends the cookie along and then something on a completely different site is just executed with a get request, right? Because there is no form. There's no step in between. The pants just get deleted and then it's done. So the pants delete controller executes your callback and suddenly pants five are gone. You didn't intend to do this, right? And that's why we need confirmation form in Drupal when you delete the node you get a confirmation form. When you do data changing actions in your Drupal code, then you need to confirm the user's intent. And another way to do that, sometimes you don't want a confirmation form because it's bad for usability. If you're deleting something unimportant which we don't care about, then you might not want a confirmation form and you can use something called CSRF tokens. And Drupal 8 has some nice support for that. So you put this CSRF token property into your routing yaml file. So this is the same routing yaml file that we have seen before except that we have added this CSRF token entry and we say true. And then we have an output link to delete those pants. Such a cryptographically secure token is appended and this token has a different value per admin user. It has a different value per session so the attacker cannot guess it. The attacker cannot put an image on their side and come up, I will use this in this token as we surely work now. It is generated specifically for an administrator so an attacker cannot recover it. So if this token is missing, what happens then? Drupal will return an access denied for this page. So this attack that we've seen before with the image wouldn't work anymore because of course at the end of the source here the token is missing. And where do we use these tokens? If you don't have a confirmation form, so for example the shortcut module in Drupal Core, you know it, you can create little shortcuts somewhere in the admin interface and then you can quickly jump to an admin page. And if I delete such a shortcut having a confirmation form would be tedious. Yes, I really want to delete this shortcut. So although it is a data changing operation, right, I'm deleting something and delete the shortcut. It's not that important. So even if the user clicks it by accident then this is also executed and the shortcut is deleted. It's not a big problem because they can just quickly create a shortcut again. You would never use such a CSI token for a node for example. Let's say you have huge block articles with very important content to you then you wouldn't use this token because then a node would be deleted immediately so you would rather use confirmation forms. So by default always use confirmation forms for delete operations for examples or for your forms when you edit the node there's of course also forms because forms by default in Drupal are CSRF protected. So that's already built in and if you do need something fancy for better usability there is this CSRF token helper which only exists in Drupal 8 so in Drupal 7 you have to kind of do the CSRF token validation on your own so Drupal 7 is not nice in that regard. Yeah, so a couple of Drupal 7 examples so what we saw in the Yammer files when you review a Drupal 7 module this is basically one-to-one the same concept except that it's in hook menu which is defined in the module file. There the routing is defined there you have the title page callbacks and whatever and as we saw before the access content permission is wrong here again because we are rendering an admin form and it should have an adequate permission. The same for the access callback true we have this in Drupal 8 we have this in Drupal 7 so when I look into a model I always scan the routing parts if the developer forgot to set the access callbacks correctly and then I can point out maybe a security vulnerability. So everything that we saw in Drupal 8 also applies here and when I review this and maybe a developer does this on purpose there might be a payment gateway which has to have an open access page callback because paper is calling back and paper always needs to have access so we define it like that so it would be actually correct and then I tell developers please leave a code command above it. So above the command they should write a comment there is no access protection here because paper always needs to reach this page and then the reviewer knows aha they did it on purpose and it's not an accident. We also have the same patterns for course write request directory in Drupal 7 routing is defined in hook menu again and then we have some page callback which deletes something pants in this example and we also should use confirmation forms here same as in Drupal 8 we don't have automatic CSF tokens so if I want to validate some token and it would have to do this myself in this page callback a couple of contrib modules are doing that I think you can even find it in Drupal 7 core so you would copy this token generating and token validating code from there. All right so some attacker entry points with routing summarized in Drupal 8 you have routing gamma files we have first look at and then in the source folder the controllers and the forms they are important to me because those are things that an attacker potentially can directly reach and in Drupal 7 the equivalent is hook menu and page callback in modular ink files so module files are always important in Drupal 7 and in 8 so you should always review those and as I said to check for access bypass with permissions how the access handling is done and also for a cross-site request for a tree so whenever you see an action in a routing file like delete something or change something I immediately go checking is this a confirmation form is it just a controller and then I already think there might be some CSF vulnerability here. Now for something different a bit so we see this method of a class it gets log items since some time stamp and what the developer did here they wrote a query with the database API all is looking good they are writing a WHERE query here and then they execute this WHERE query and return the results of stuff that they get from the database. SQL injection SQL injection I heard, yeah, correct so whenever you see string concatenation or whenever you see variables embedded in a string which is related to database query you shouldn't do that because what's the problem? So we are passing off information to another system and this other system is the database and to the database we are sending instructions and we are sending data but if we put the instructions and the data together the database cannot distinguish anymore they just get the instructions and execute it the database doesn't know what is coming from an attacker and what has been done by the developer so this is one of the top risks in the OBASP top 10 it's actually number one because it's so, it's a high risk it can happen often people often get it wrong called injection it doesn't only apply to SQL injection there are also other injection vulnerabilities and yeah so whenever you see string concatenations or we are variables embedded in a string that's a code smell that something is wrong here actually this might be hard to exploit in a WHERE clause in this specific case so when the timestamp is attacker supplied so the attacker puts in some query tries to insert something that might not actually work because the WHERE query part in Drupal might sanitize this but you should still never do it and the correct way to actually do this is the condition API here where we clearly have the separation the name of the property want to query and then there is a specific parameter for the user supplied value the timestamp in this case and then this is safe because the database API escapes it correctly and then the instructions sent to the database the actual SQL query escapes that data correctly all right what do we have here so we want to extract content from a PDF and PHP is not actually good at that so we want to use Apache Tica which is a Java library we wrote this little function where we can specify where this library lives on our server it lives in opttica app.jar and then we build a command and then we execute the command and this shellexec function that you see here it will just execute the command and then return the standard output well, I guess that works any problems anybody sees here? right, so the variables that we are passing to the command they are not escaped so you can have a remote code execution in your shell it's called shell injection so if this URL that is coming in this is coming from user data then the attacker can execute for example a second command so let's imagine something from URL something like this so they specify some URL but then they use the semicolon to execute a second command on bash for example to give me the contents of slashetc slashpassvd where we have some user information there that should never be leaked from any server so then this is executed together with Tica Tica runs on this URL whatever the URL is Tica generates some output then a second command is executed which also generates some output so the output gets together in this parsed variable and the parsed variable is returned and not only did I extract code from a PDF document suddenly I also get the contents of this file on the server so if an attacker can supply this URL this is really dangerous you have shell injection they can execute arbitrary things on your server how do we prevent that? bitb has a bit in function called escape shell arc for arguments so whatever goes into that command needs to be escaped with escape shell arc and then we are safe so I'm not only doing this for the URL here but I'm also doing it for the variable because it can't hurt so the Tica lip path is also escaped it probably doesn't have to be escaped because it's provided by the developer but what you want to do when you're writing Drupal code you always want to have a defense in depth approach so even if an attacker is able to inject something into the variable table and we get it out here even then we would escape it so they wouldn't have a chance here so that's always good to have a layered approach to your security that you're not protecting yourself in one place but in multiple places if it doesn't interfere with the operation of your Drupal site of course but in this case it's totally fine to escape this static string and it will still work and even better maybe avoid using shell exec all together maybe you can use Apache Tica as a service and an HTTP request and that is also much safer and you can avoid that so in Jackson's summarized we look into page callbacks and everything that executes query or shell scripts typically those are controllers or forms in Drupal 8 we also look in API functions that are used in services in Drupal 8 somebody would probably provide a service and do the shell exec there so that's also a good place to look and whenever you see concatenating strings instead of using placeholders that's a very, very good indicator that either the command is vulnerable or the SQL query is vulnerable so look for that what do we have here this is an access hook for hook taxonomy term access and it forwards the in the first if clause it forwards the code to another static function whatever so this is actually real code as I saw in a Drupal module and then it checks if we get an access result allowed there I'm also returning an access result allowed so I think it looks correct look what could go wrong here so we have this if it looks a bit long yeah I think it's hard to recognize do we have any problem with the first if? I think we do because we have an access result if bypass so from the function from a method below you get an access result and then you check if access result but that will always be true the problem is if you just have if access result that is an object in this case so because the things below they return objects so we have an object here and of course an object always evaluates to true so access will always be granted in this case so always review your access hooks for that access results are used correctly and for access checks always use access result result is allowed another example this was actually from the GraphQL module which I maintain so I find security issues in my own modules so this happens so we have some result function and it loads some entity from somewhere and then we have the same access result again by calling access on this entity and the true parameter at the end means return it as an object so I want to use it as an object because I need to add it to my casual dependency tree here that's the reason why I get this object and then I call if access result is forbidden do nothing and otherwise return the entity this is also a problem because it's the access result is forbidden track that's what I call it in Drupal 8 the access result can have three states so we have allowed forbidden but you have also neutral as we have seen before already and you have to call access result is allowed because it's forbidden micro return false or neutral results so that's a bit I think a weakness of the Drupal access result API in Drupal 8 and this was this is forbidden called was overlooked by three very senior developers in the GraphQL module and which has recently found out about it and what's the correct fix which has called access result is allowed because that takes into account the neutral result which should also forbid access correctly so it's important to familiarize yourself with the access API in Drupal 8 when you write this access code and make sure that the logic is correct it even has this quote in the documentation important note you have to call is allowed when you want to know whether someone has access yep the problem is the other and the other methods are also available and PHP is gone or which is to your code whatever editor you use just auto completes them for you so you might want to use them but don't always use is allowed so access control summarized we have to check the logic that we do in the access controllers and the hook entity access which exists in Drupal 8 and in Drupal 7 and we need to check if the if conditions are correct and whenever access result is lose use this object we should check for is allowed and know other methods called to determine access to get a boolean out the only right way to get a boolean out of the access result is to call is allowed also the cache context information can also be security critical so make sure that you catch the correct things you don't want to cache an unpublished note and then suddenly return it for users that shouldn't have access to unpublished notes yeah so also check that now some example for render race and cross-site scripting so cross-site scripting happens on output so I'm switching out to the output side of reviewing I typically would look into page controllers they are generating outputs and tweak templates and what an attacker is able to supply in this example is a script tag so it would execute some JavaScript and now I'm putting this JavaScript variable into a render array what do you think is this okay would an alert pop-up pop-up in Drupal 8 or do you think it is safe so the answer is a bit complicated here in Drupal 8 this is safe because the render system runs XSS filter admin on it so this is a very good improvement in Drupal 8 where all the markup that we are generating all the things that we are outputting in tweak is how to escape the default so we try to escape everything against this cross-site scripting attacks by default but unfortunately in Drupal 7 it is not safe because the render system just prints whatever there is so whenever you have user provided an input and put it in markup tags or prefix tags whatever you have to be very careful this is the top seven vulnerability listed by the OWASP so I encourage you to check that out let's look at a tweak template in this example so tweak is usually very good it does auto-escaping on all the variables but there is something in there which is actually an XSS vulnerability it's already highlighted by the syntax highlighter here and this is this little raw keyword so whenever you read your templates check if a developer uses this raw keyword because it means auto-escaping is disabled and the variable is rendered as is so this would be a template cross-site scripting vulnerability so whenever you look at templates check if they use the raw filter how can you actually test for cross-site scripting? so I'm always using this alert XSS snippet I put this in all inputs in get parameters whatever and then I see if it's coming out of Drupal again and if it's coming out then I get this annoying JavaScript pop-up and I know something is not as tape correctly this is very helpful for Drupal 7 specifically but it's also useful in Drupal 8 but tweak isn't perfect, right? if I'm doing something very stupid like this so putting the node label, which is the node title directly into the source attribute without using quotes that's not good because it bypasses auto-escaping actually auto-escaping is happening but it's not really helping here because the attacker can put in something like this so you have this A this A is then used as the source of the image of course it doesn't load so an error is thrown so the browser executes the unerror attribute which would then open a pop-up and this is just an example but an attacker could provide some other JavaScript there it's a bit tricky with the quotes so the attacker would have to be very careful but it's possible to have this so make sure that you have the correct quotes in your templates don't forget them because then the auto-escaping doesn't help you the auto-escaping mostly helps you between HTML tags but if you're working with attributes in HTML you have to be a lot more careful what you're putting in there and there is the over-aspect cross-site scripting sheet I encourage you to check that out as well it has some examples like this one what people can put in attributes so they can also trigger cross-site scripting oh yeah, that would then be the resolved version we have this as the node title and then this is injected into the template and this would be the image tag and then the pop-up would trigger so cross-site scripting summarized and the auto-escaping is really good in Drupal 8 be careful with the HTML attribute as I said in Drupal 7 it's unfortunately a bit of a nightmare because you have to check so many things there could be cross-site scripting in the PHP templates and the team functions pre-process in the callbacks where you vary your building and this but there's a good documentation page called Handle Tags in a Secure Fashion I linked it here from the slides and I will post the slides later another vulnerability we had this year was the un-serialize vulnerability that is executed on user-provided data so un-serialize is used to take an array or an object and put it into a string so that you can send it over the network and what is happening here even with get requests if you have the REST module and some REST resource enabled and this request is incoming then Drupal tries to deserialize that an attacker would put an evil serialized payload in this options value and then this would be deserialized and there was a vulnerability in core which just deserialized everything and that's how it happened and then you have remote code execution why do we have a remote code execution? you can take a look at some evil un-serialized payload that would be supplied so an attacker is specifying O which means objects and then some class in Drupal in this case it was something from the Gazel project which is a dependency of Drupal core and this special class can hold some properties which execute arbitrary PHP code and what an attacker does they supply the pass-through function which is a PHP function to just execute something on the shell and then an evil command in this case it's very primitive it's just echo hacked something happened but of course an attacker would put something more severe in there and then what Drupal does or what it has done it has been fixed in the meantime it deserializes this then we have this Gazel object and then the Gazel object runs out of scope then the PHP garbage collector runs and then this object is destroyed and when the object is destroyed then this page core not this page core but this shell command is executed and that would be the remote code execution I linked some exploit code also in the notes of the slides how somebody abused that so what do we learn from that and we need to use unserialized correctly this is not showing up that often in the in contributed modules that you see but whenever data is coming in we need to make sure that we call unserialized correctly we can just disallow our classes because what is Drupal using serialized stuff with usually it's arrays it's some option array that we have been seeing some properties on the link and then we don't need classes we can just disable it and then unserialized is safe and actually unserializing stuff has been a vulnerability in many programming languages and frameworks and that's why the OS was classified also in the top 10 list ranking eight in security serialization we also have a vulnerability with XML entities so if you're passing XML you also have to be careful because you can have special XML documents like this and what we are doing here is it's called entity expansion and this is part of the XML standard which is not good for internet applications so what it's trying what it's doing is it's just commands that are then filling XML content so in this case it would read data from ADC passivity and then fill it into this full text and if the attacker gets back this XML somehow they are sending the XML and you are outputting it somewhere or processing it then it would contain the content of this file on the server which an attacker shouldn't have access to it's also on the OS top 10 list actually is number four so what can you do in PHP about that you would disable the entity loader in the libxml library so PHP is using a C library to pass XML and there you can just disable this and then this expansion just wouldn't work it would just not expand anything it would just leave the content as is and that's how you can deal with that so it's actually a simple fix but whenever you work with XML in PHP you shouldn't forget it all right so those were just some examples and what so let's summarize what do I do on a full code review rundown I checked the ng points in the Drupal module as we had routing files, module files is the cross-site request for tree what is happening in the module files then I check how is the module dealing with input so on input we always want to validate what is coming in that is usually done in controllers are they having some SQL injection vulnerabilities with the input or deserialized vulnerabilities that we saw and in the end I check where the data is coming out of the module again it rendered into templates or something else checking for cross-site scripting there important is to check also the access control this is usually done in Drupal, plugins, hooks whatever and then I always make sure to read through the rest to understand completely what the module is doing and what you should always do when reviewing you should get into the attacker mindset how could the code be abused what could go wrong with this code and security professionals they always recognize security as a process so code review is only one small part of everything that you should do the easier thing that you need to do is just keeping your software components up to date because they're known vulnerabilities and we all use Drupal, we all use existing contrib modules just updating them helps you to keep that secure we need to make sure that everybody is aware and trained for security so we want to deploy a defense in depth approach that we secure a server or a Drupal code or custom modules and also the people people shouldn't for social engineering attacks where somebody calls and says please give me your password, yeah don't do that, people should be aware of that and then code review is part of the quality assuring thing with testing where we try to prevent security vulnerabilities but we should also have a plan in case anything happens the good frameworks what you can do on incident response when the Drupal site is hacked what you need to do having backups in place and then you can also have penetration tests where you get some external company to validate your code some resources I have there is the OVAS code review guide it's fairly long I think it's a really long document it's a lot of words I don't particularly like it it's just too much text for me but I think it's a good framework to understand like even from the outline what you can do in code review there was top 10 security risk I already mentioned there was also a session at this Drupal console what we're recording from that one in Drupal 8 we have documentation about writing secure code so it's also important for every developer to understand that and what I like to work with are there's Drupal security coverage applications where we review modules of new contributors that want to get security coverage for their modules and I'm reviewing what is there if you want to know, learn more about that there's also a link and with that, that's it any questions? so there's a microphone we should try to get it on the recording so if anybody, or I can also repeat the question so yeah, Danny back there's something I've missed from your talk is code testing because the access test should be called by many tests yes, absolutely so code review is only one part with code review you can just find stuff that has not been covered by the tests or where the tests might actually be wrong so yes, automated tests should also check for security that's very important so that your tests for scenarios which could be abused by attackers so what people usually often test is the happy path they test something, they save a note and then the note shows up but they don't test the thing where they put in some dangerous stuff in the note title and what is then showing up and sometimes people don't think of all the possibilities what can go wrong with the module or the code and then they don't catch it with automated tests and that is actually so I think these are both sides of quality assurance that you need to do peer review is one side to get the perspective of a human and automated test is something to ensure what the developer wrote is actually correct yeah so the code review is validating what the developer did from an external standpoint and automated tests is the developer making sure herself that what she did is actually correct yeah yes yeah quite a few of these are probably repeating all the time everywhere yeah can these be or are they included checks against these in any of the coding linters or anything like that yeah so the question was if we can automatically detect this common vulnerabilities that I just shown in those examples the question is we don't really have something like that so I'm also the maintainer of the Coda library which is checking for coding standards and we have something in there called Drupal practice so this is a scanner which tries to give you hints on what you might be doing wrong in your code but it's just it's a static analyzer so it doesn't have the full information what is actually going on and especially that's a problem in Drupal 8 where you have complex object dependencies and you might not know what the method call actually means and if this is a bad method call and people should do something else but since we wrote libraries such as Drupal check where we check for deprecated APIs and I think that is using some other PHP passing library we should be able to write something similar where we can check Yaml files for example is there an underscore access true property in there and then maybe throw a warning yeah we could do that but I think no such library exists at the moment Any more questions? Yeah, you again? Yeah, on the SPR injection example you gave you trusted the SPR API to fill the input but should we trust on such APIs or myself I always try for example if I expect an integer I have an input or check Yes Yes, so that's a very good point so the question was can we trust the Drupal database API and if I have an integer if I know it should be an integer I can just cast it to an integer for example so I think you should actually do both the API I think you need to understand what kind of stuff you can pass to the API and just never use string concatenation that's the basic rule for the database API but in principle you can trust it that's also the goal of the database API that it is a tool for the developer that is actually secure this is very important that this tool is secure and regarding the integers I think you can do it on top so if you're passing in a condition an integer you can also cast it to integer it doesn't hurt and it's clear for a reviewer also that this must always be an integer so I think it gives a lot of additional clues so I would recommend it Yep Anyone else? I have a bonus slide so yeah this was actually from another talker I gave this year also with PHP itself you can have a couple of nasty problems in this case we have an access bypass because of a typo the syntax highlighting basically gives it away already but in this case we have some security function which checks a key so the first if condition so if it's not 32 characters it returns force okay, yeah that looks correct in the second case it trims the shared key and if it equals the empty string it returns something but it's not returning force it's returning flase so this was a typical typo that some developer did and then this led to some privilege escalation vulnerability I also linked this in the notes of this talk so what would have an attacker to send in here so I can send in 32 white spaces if I send in 32 white spaces it will pass the first one and then it will go to the second one and it will be the empty string and then it will return flase and if somebody calls this function and does not strictly check what is coming out of this function I mean PHP will give a warning it will say there's some undefined constant here but PHP doesn't care that we just happily continue on and return this string and if somebody is not doing a strict comparison with the result of this function then I can elevate my access what can we do about that and we can do PHP type-hinting as a security protection so I'm a big fan of that, yeah static types everywhere so we can put in a return type-hint bool so the only thing that is allowed to come out of this function is either true or false we have to enable strict types for this to actually work through a fatal error so whenever you're working with this type-hinting I would recommend that you enable strict type for your PHP files and this is not the Drupal core standard because we're not doing it in Drupal yet but for every code that you write for example for custom modules or even for contributed modules you can say I depend on PHP 7 and I actually require this then you can do that and then it will result in a type error that the return value of the function is a string instead of a boolean and your code will not continue your site will break, right so the attacker will get a white screen but at least they didn't escalate the access and can exploit something in the site yeah so I would recommend that we should also push for that in Drupal core so that we adopt this at some point that we have more type-hints because this doesn't only review security issues in your code it also reviews type problems or other problems that you might have overlooked okay any more questions? yeah you mentioned that Drupal by default enables cross-site free-read for forms yeah and that is for authenticated yes so the question was what do we have more? what's your standpoint on for anonymous users for forms? so for cross-site the question was cross-site request folder in forms only works for authenticated users but not for anonymous users and this is a bit by design in Drupal or how Drupal understands this is this and anonymous you cannot distinguish anonymous users between each other so you don't actually know from whom the request is coming from so the security tokens that we generate in the form would be the same for each anonymous user so an attacker can just copy their security token and do something on the behalf of the anonymous user so whenever you want to protect anonymous users you either have to start a session or lock them in yep that's the reason for that because an attacker has the same access as every anonymous users to the tokens that come out of the form so they can copy it and then do something on behalf of the user and sometimes you get a security scan from an automated token that comes out as its vulnerability yes so the comment was that automated security testing tools report is as vulnerability in their reports and that's obviously not good I wonder if we have if we have some documentation on Drupal.org I'm not sure why maybe we have something yeah we should be able to look this up or we should write it should write down on Drupal.Drupal it doesn't do cross a request for free protection for anonymous users because we cannot distinguish them and because our protection with the token is based on sessions that's why we can't do it and anonymous users doesn't have a session so any more questions? alright thanks everybody


So what I thought I'll do was you know before I started talking about mass personalization I thought let me take you back 50 years. Yeah, let's rewind a little bit and of course We're all familiar with this iconic movie. Which one any yeses Godfather and we've all heard this line, right? It's not personal sonny. It's strictly business. Yeah, and you know that was an iconic line from that time And I was thinking that if you sort of now fast forwarded 50 years and think about what a marketer would like to say He'll probably sound something like this It is personal and it is business. Yeah, so personalize, you know mass personalization for personalized communication I think is a very critical way of actually generating business for brands and something that Marketeers and brands need to look at pretty seriously. So in the next 15 minutes, what I'll do is I'll just talk a little bit about the What why and the how and really end with giving a few examples which which I think stand out today And obviously there are lessons to be learned from those examples So I mean if you go back to the genesis of where this whole personalization thing came from I think it finds its roots in, you know, luxury marketing There were few people who are rich, famous, had a lot of money to spend and really wanted something which was a personal thing for them And literally that's how this whole thing of tailoring to your needs came about. So if you go back It's about London Saville Road, where you know, there was Janta who bought shirts and suits from the market And there were people who got it tailored a particular way, right? And that's where it started from But however, as things went along, a lot of it started getting democratized, right? So there were more and more people saying, hey, why should it only be for those kind of people? Why can't I also start to have personalized experiences? And that's how it started getting democratized over time And really the process of using, you know, data to get seemingly one-on-one communication Where the person feels that I am being talked to is really what personalization and mass personalization is all about And if you look at it as to why is something like this important, of course, one thing is that it gets consumers emotionally invested in the offering So what does that mean? As a consumer, I would love to be spoken to one-on-one I would like to have that connect with the brand or the product that I'm using And once that connect or the relationship is established, I'm then much more amenable to A, building a strong, you know, cohort with that brand Talking about it to other people and really being a brand evangelist, right? So that's what matters Second, of course, it makes me feel special because somebody is talking one-on-one to me and that's something that obviously works for me And last but not the least, if you really look at it, today thanks to, you know, people, the advent of internet and the digital options There is a lot more self-expression that happens. So in a way, the personalization is really about a reflection of the self-expression that consumers have in today's context, right? So these are some reasons why mass personalization would make sense from a consumer point of view Having seen the what of it and the why of it, if you really look at how one could go about doing it I think there are a couple of, you know, learnings here in terms of what could be used in terms of the how of personalization I think the first one is around, you know, cultural insights and how that can be leveraged Now it's no rocket science to say that all brands and marketeers look at using insights, right, to build their propositions Whether it is product propositions or the communication propositions And if the insight is also rooted in the culture and the local traditions, it makes it even more powerful So therefore one of the key things to look for is how do I leverage, you know, insights and those cultural insights in order to make it more relevant and meaningful to the consumer The second part of it is really around how do I empower consumers, right, and actually give them the power of choice Now if you look at it, consumers would like to have the option of selecting staff So if I am able to tell them that look, this is what you need, but I can offer this to you in five different colors in four different shapes And basis your choice and preference, you could sort of tailor make it to suit your needs, right That empowers me and makes me feel a little bit more closer to the offering that's being put forward And last but not the least, again, thanks to the massive digital footprint that we leave behind today Through the various mechanisms and means that we use, there's a lot of data floating around Some of them we give voluntarily out, some of them get collected as we crawl through the various, you know, forums of internet And all that data can be sort of analyzed and used to tailor make things for the consumer Sometimes with their knowledge and sometimes not necessarily with that But at the end of it, that data is a powerful mechanism for personalizing a lot of offerings and content So if you look at it, I think these are three ways in which you could personalize for the masses And what I thought I would do was the next three or four charts, just share a couple of examples of how some brands have really done this in a very nice and meaningful manner So the first one I'd like to talk about, again, one of the things I've done also is in the true spirit of being non-inclusive I've not plugged any perfect brand into this presentation, yeah So the one example I would like to take is Coca-Cola, we all are familiar with the brand So one of the things that they said was Coca-Cola stands for happiness, open happiness There was a campaign that they did in the summer of 2011 in Australia Where they said, why don't we do one thing in order to make it a little bit more personal Let's take the Coke bottles, one side of the label, let's personalize with names So they picked up the top 150 names in the country, you know, through most common names that are being used And then they sort of put that into their labels and they started that as a campaign about, you know, share your coke, kind of a thing Now what happened was this became a massive hit and then it got expanded to almost 50 plus countries And when Coca-Cola looked at it for India, what they said was, can we take it one step ahead One, of course, is to find the most common names, but India being such a diverse country I guess that would have been a massive challenge in terms of getting names that are truly common across the country So what they did was, when they did some work, they found that one of the most relevant things from a cultural point of view is relationships So there's a lot of importance attached to relationships in the country And it's not just about the relationship, so it could be bro, it could be dad, it could be mom But the meanings around the relationship were also very important So what did they do? They said instead of putting names like Rahul and Srikant and Neha They said let's use relationships and they did a whole campaign around having the labels with various relationships And they did a whole sort of communication around it which really elevated the brand and made it reach out to consumers at a mass level Yet personalised it to a large extent So what we'll do is now just see a couple of copies which sort of actually bring out this point Friends don't run away from each other But sir, you're my brother That's why you're my brother That means you're my brother Shhh I have to do something like that I'll do kitchen unpacking once, then living room, then dying room I mean, I'll even go for a breather Even that makes me sit and eat my work A true example of cultural insight got a lot of theories related to it and nodding vigorously. So again, great example of how the brand leveraged that to get to a beverage is of course sold widely across the country. Yet there was a large element of personalization in it. Another example is Nike again. So actually Nike did stuff even way back in 1999. And I quote from one of their CEOs at that point of time who said, Nike's goal is to get more personal but at scale. So they talked about it even back in 1999. And over the years, what they have tried to do is, I mean, if you see the example on the right, they have a pair of shoes. And then you can change the color of the pair to whatever you would like. You can even have something printed on it which is very, very exclusive to you. So you could do all sorts of customization with it. And the point was they launched something called consumer direct offense, which was all about saying, how can I drive business and growth for the brand yet in a very customized and personalized manner? And that's something that has been in their DNA for the last 20 odd years. And they have in fact taken it one step further in terms of backward integrating in actually buying out two companies which are huge on data analytics. So they actually picked up two companies called Zodiac and Invertex over the last few years to which actually enable them to churn all this data and try and personalize it as much as possible. And of course, supported by the data that they collected from the Nike app and the Nike loyalty points. So again, a great example of how a brand with an attitude has actually managed to take personalization to the next level. Another interesting example is, again, Amazon, all of us are familiar with the brand. It's been in India for a few years now. And again, here Jeff Bezos laid out long ago saying that we need to find a way to sort of understand what the consumer behavior has been online to figure out what they are looking for, what they are not looking for, form a sort of a pattern around the consumer and then make sure that you deliver offerings which are tailored to the pattern. So I'm sure all of us recognize these things when we see when they're shopping online, which is recommended for you, frequently bought together, or customers who bought this item also look that. These are some things that you see which actually comes out of something called affinity analysis, where they really look at patterns in terms of what you pick up, what are some of the things that you prefer, you don't prefer, and then sort of guide you in the direction of where they would like to take you. The whole idea being, how do I keep maximizing the value of the IKIT size, right? Again, a great example of how some companies do it. Another example, one of my favorites is what Netflix does. Again, Netflix is all about, everything is personalized out there, and interesting fact is that what you see there on the screen when you go into Netflix is, a lot of what you see there is actually recommended for you and you think what you see as popular on Netflix is actually not popular on Netflix. It is popular for people like you on Netflix. So, this is your browsing behavior, this is what you search for, this is what you watch, pause, or play. Netflix actually recommends stuff which is pretty much customized to, you know, what your viewing preferences are. And again, taking that to an interesting level in terms of actually trying to drive behavior by gently recommending to you what would be of interest to you. And you know, I would end by taking one example of the most common way in which we used to spread messages which is through television where it's totally democratized. You put it on a TV and then everybody gets to see it. Even that in US is going through a change where on smart TVs, what's happening is people are able to see ads which are targeted to them. So, there is a way where the ads are getting targeted and I think as we go forward, that's likely to be the norm in terms of even the large screen where of course in digital it's very personalized and very targeted, but even on something like a mainstream media on television that's increasingly happening as well, yeah. So, those were a few examples I thought I'll share and again I'll end with going back to Godfather in terms of what was another interesting quote. And I think it's really about mafiteer saying and how am I going to make an offer to them that he or she cannot refuse, right. At a very personal and at a very direct level. So, I think mass personalization is certainly here to stay and the sooner and the better way in which marketers can sort of imbibe that and translate that into more relevant and meaningful communication, I think the greater chance for the brand to succeed. Thank you.


We added two golden tickets Trey Edmonds Zach Gentry offensive line still needs work Why receivers could use some help d-line could definitely use some help a Dante Jackson still in my lineup I don't think he ever sees the field, but it still just pisses me off and Deon Jones bond Miller are slightly outdated So I was being negative about my ability to upgrade this team. There's a lot of souls in this team So our first wheel spin can you help me? Can you help me? Can you help me? Can you help me? I've gotten this the last few times. I've got this. I've literally lost Okay, now I feel like it's a curse, but wish me the best of luck Shit Let's me steal any player from the bonus team, but I always lose when I get it So, I don't know if I really have much to say about that Five times any store pack. Okay, so it's any store pack so I can use training And I'm out of ultimate legend fantasy packs, and there's no fan appreciation packs I don't think so I'm gonna go to the training currency and you know what I'm a drop off 597 overall theme builders.  So Dak L. Oh my D-Line. Oh my D-Line Actually really good. Absolutely. He's yes. That's a starter. All right, that's the That's exactly what I needed. All right now. We're really cooking with a little bit of fire. Okay, so What is this my fourth right here?  Let's go and the fifth. Come on sauce me out right in I Think that's gonna be my third string halfback, which I don't think I'll ever use but wow These poles were fun. I didn't get a single offensive lineman though. I'm a little I'm a little jaded about that But it's all good. Hey, so Damian Williams is definitely coming out down here left end We got mr. Cameron Jordan Absolutely coming in for the whole depth chart.  All right now Kenny Clark comes in here big clutch I puts a set of 96 overall boys Crazy that that's been my D-Line with all the games we've been playing and it just got that fat upgrade right there Alright, this is a big game. We got so many good players on the line here. Honestly gotta. Hey Jerry Rice. I just don't like him I'm probably gonna put DJ more here We got lots of new weapons offensively actually cuz we got DJ more and we guys that gentry offensively now We got Kenny Clark Cameron Jordan would have a nice grab a corner here, but I still got steel a player I still have steel a player So if I if my steel player goes well, it's either gonna be an offensive lineman or probably a corner I just realized that I didn't give myself my reward last game for completing the challenge wheel My reward was gonna be to do the upgrade set and I forgot to do it So no matter what after this game, I'm absolutely gonna do that Josh Allen CD lamb Bo Jackson.   So technically I could get two of them Let's see what we get. Our challenge is gonna be is it a 50 plus error? Yo, I'm not gonna sound so well last game. Hopefully I can keep it up Let's take this to the edge and see what's there. We got a lot of room with that bitch 50 plus our touchdown 50 plus I think he's on the mic, but I have no ability to go in and get that audio so I can't talk to him I'm sorry. Oh That should probably be open Oh 21 yards on his introduction to the team. I'm gonna hit it with a cheeky inside zone I don't know how I feel about this. We're about to find out though. Yes, sir God I did everything I could not get in for sir. Hit stuck right there. That's all I was going for Okay, so he totally did QB spy and you know what I think gentry might have been there after getting Stonewalled on a couple plays a perfect moment to introduce peaks on bubble to your opponent Let's see if he commits if he commits. He'll probably get the stop on this. We got to see if he'll commit to it Yeah, he committed to it damn Ooh, Mary's breaking tackle zone Fourth and goal. I can't take that risk. I need to win this game. I'm not taking that risk. I'm sorry All right, so fourth and goal. I'll take my points. He's gonna get the ball I have to so I gotta make sure I'm at least a possession ahead.  I'm pressed too hard here, but I'm shaded over top. So hopefully this doesn't get me in trouble Why is he open? Slay just made covering that it looks like he was toasted. I don't know Josh Allen Honestly got Josh Allen under three that ball Okay, so double team there easy No, get down get down. Oh my god. I didn't cross the line. So I couldn't get down I just got lucky and didn't fumble yikes. Tyree kill if he's not gonna switch over there.  Yes, sir. Easy easy easy yards I'm hitting two clock.  I'm hitting two clock here because oh, this is so open I should snap this I'm not going to though I always get myself in trouble when I snap the ball To hurry up for a quarter things that since I don't you very well be there. Let's see what he goes on. Oh, yeah Oh, yeah. Oh, yeah, Gentry Gentry with a great block Although I don't know if I can really chew that much. Oh, that's a touchdown come here Honestly, he's an enforcer too. So he probably would just wrecked me for a fumble, but I wanted it anyway 17 to 0 How do you this this keep happening? I'm afraid that I'm using all of my luck right now though You're real unfortunate. I'm using all my luck right now and we get into playoffs and I started I started goobin So I got that covered It's about to be out route central as he as he tries to get back in this game second seven I Got the out routes Clancy throws right out If I wasn't winning my 17 I'd be screaming right now that felt like such a pick first and ten Corner out. I'm guessing Yep, I dare you throw that Taylor mays in the sack He just lucky passed it into von Miller has been dropping bumper has been dropping interceptions That's his second wide open reception drop by CPU von Miller So I don't know how I feel about that. Let's see if he tries to run that exact same thing. Yes He does Dawkins was there, but that's all we need cuz that's fourth and five.  So that's good Got him got him Tina. He gets a ball. That's that's that could be a 14-17 game right there.  Oh Jackson just got a lot super super sketchy what I'm doing here first and ten.  It's now 17 14 Let's go big stop third and nine. This is huge That's why everything Gentry gentry sweaty that expect there was going off over there, too I'm glad to see you pulled off the clutch on that. All right first and ten.  Strips specialist fumble, that's hysterical.    I'm literally naked.  That was one hell of a game right there So Lamar vaguely outplayed Josh Allen eight for eleven one sixty eight a touchdown I threw one picky through two, but a huge game nonetheless. Now we got to get our upgrade set from last game I definitely did not complete at this game, right? I didn't have a fifty-plus yarder touchdown. No, I did not So that's playoff by the way.  It was on his top three So I took CD lamb now.  It's been a bang So for our completed challenge from the last game, we get a random 95 96 off as a lineman. Can my luck continue? offensive, maybe not L I should I should have a rule where I can like if I could sell some for training I could use that training but could 25,000 training do anything to anyone on my team right now Probably not just Brandon Brooks have an update. Okay, so I'm gonna use that training that I just got from Brian Dawkins I just use it. I'm Brandon Brooks. That seems fair enough. All right boys That's gonna conclude this episode huge one next episode first game of the playoffs We got a clutch up didn't get a buy. So we got three. We got two playoffs games gonna NFC championship.  I love you boys I'll see you the next one. Peace out


The failed bass to Lux Flux Arcade is an installation we've created at the Brooklyn Museum that, at its heart, is really about engaging with the artwork, having fun, young and old, coming and playing, and having this hypersensory experience. When we were first developing the Lux Flux Arcade, I think some of it was about trying to bring some of the artwork to life for us to explore this new medium that we never really got to engage in in sort of a still manner of paintings and these kind of things. We could bring the characters and these icons that we were creating to life. Initially working on the arcade cabinets, we were kind of taken by the sculptural aspect of them and fell in love with that, getting a chance to print and paint on them and kind of highlight those details. But as we got to working more in depth with them, we fell even more in love with them as an art piece in the sense that they captured sound, digital media, and became a really exciting kind of interactive sculptural art form. When we were initially trying to come out with the environment for the arcade, we took a lot of cues from just our process of working on the street and putting up posters and kind of juxtaposed those with the cues that we took from the environments that inspired our arcade bars and arcades themselves. And a lot of those environments tended to be, you know, heavily posted and weak-pasted bathrooms were graffitied up. And so it just seemed like an obvious solution to kind of emulate that with our aesthetic, doing the arcade room itself black and white to try and keep the focus on the arcade cabinets and the color and the energy that they admitted. And when we addressed the black light room, it was kind of trying to create an environment that was a hyper saturation of the arcade's black and white aesthetic, bringing in neon light and trying to give something a little bit more dynamic, but with a similar energy that created the flow between both environments of the foosball room and the arcade room. One of the things I think we've noticed over the years as the shows evolve too is that the viewers start to become part of the show in their own way, in the sense of the way people interact with the games, the way they do yell and how much sort of fun and emotion they're putting into it. As you just stand back, you can watch the people play the games and you can watch their faces and it becomes sort of an extension of the show in a way that I don't think we originally intended, but the sort of viewer participation as part of the installation itself has become a fun evolution.


But I don't know, sir. Can you guys get off the stage, please? Let's go. I need to actually tell you something. On the table, everything, every role, every part is up on the table for me right now because a lot of people feel to realize that the theater has a lot to do with the discipline. It is a discipline, it's a disciplinary art and after we already struggled with persons coming to Rio, so I've had a particular issue with this one person. Right now I'm actually thinking about, it's about completing the play and I think the people who started with us might not be the ones ending it. My name is Shine Savory and I'm kind of a hands-on everywhere person in this play. I'm the assistant director to Ms. Dubois. I have some hands in writing and I'm hoping to do a little bit of stage management so I'm kind of running around everywhere, helping out. I'm not getting a clear motif from the movie so it's that and also the body language towards the end. But while you're talking to me, it's more of a space. It all comes from the phrase, I'll get there on ocean time or it's starting at 6 o'clock ocean time. That's something within our culture that we need to break off, that just we need to make people understand that when it comes to theater, especially that that doesn't apply and that you can't decide I'm going to do it this one week and then not show up for a month and then come back and expect that everything is going to be there ready for you. It doesn't work like that. You can't be there half the time or show up late and just expect everything to keep going. You have to have a certain kind of level of expectations for yourself and take yourself seriously before you can expect people to make accommodations for you. You know you have good days and bad days, today's not a good day. So you're laughing because I'm dismissing it constantly. Because it's funny, it's funny right? It's funny. I love XR2O. I'm telling you. You can say three more weeks. We've had a very tumultuous past few weeks because you know we've been struggling with people and the commitment coming to rehearsals and we had as of recent two people who have officially resigned from being a part of the play so I'm kind of in a bind. It's a noise, you're making noise, noise, noise, noise. Thank you. Thanks. My audition, to be honest, was horrible. It did not represent my true potential. I was not prepared, you know, I was practically clueless as to what exactly was going on. You know, I was not exactly focused, I wasn't centred. So when I did get to the audition, thinking that you know it would just be a read through like I said, it turned out to be like an actual, you know, I guess you know full on audition where I had to go on stage and do everything and I was not prepared. I had never gone through the monologues. I had no idea that you know we were auditioning for rules. I know it's horrible and sad but I had no idea we were auditioning for rules. I just, it was just communication was lost and somehow I was just all over the place. I tried to wing it but unfortunately that type of play I guess it just didn't work out in my favour. Wow, Luke Sadia just messaged me, hey Dinel, sorry I'll have to drop out of the production leaving the island next week. Do you see the same thing? Well, I didn't intentionally leave the play.  My name is Sidale and you may know some of my hits like this one. Our music inspires and entertains. It powers festivals and is an integral part of our history and culture. Creating good music takes hours of thought, writing, arranging, recording and production. When people or businesses who use our music publicly or for commercial gain get a music license, they're not just keeping the law. They're also supporting music creators, producers, musicians, singers, sound engineers and many others in the music industry. Keep the great music coming. Get a music license for your business place or even support music rights. For more information, visit EchoRights.com. This message is brought to you by Echo and this Echo License Station. Echo. Echo. Protecting music rights. Man helps, but that brings more togetherness, a feeling of, yes, we're doing something. I feel not belonging, so it was a very good thing. There's an open area, they don't need to have any props as such. So usually, people in fear they have a lot of life and you give them that latitude to do, you know, to express themselves and the more they're together it helps on stage because actors feed on actors. If actor is in character and they have the energy, the other one will step up. So all that helps in terms of trust too, if you have to hold some body on stage, you might feel uneasy, but all that can help because I could hold you, I could squeeze you. So all that, so I let the vibes. I know you and I know you and if I know the two of y'all, it didn't have anything to do with the way things are in the film, but somebody's personal life you're talking about. It will be common now.  There were two scenes that we had, well they haven't done and today we do it and we just go through it, which I was surprised. Although there was one or two lines that I was missing, but they didn't stop, they didn't buckle, they didn't, you know, they went right through. It was good. Yeah, I feel like one more becoming there, as I said. My character is a bit of an unfortunate character. We have a lot of those in the public right now. Tries to make a living by robbing persons, but he went one step too much. Oh, it's back, it's back, it's back! Drop it, drop it! She's getting it! That one is a little off of opposite to my character, persons would be quite surprised. I jump on the opportunity, it is different to what I would be comfortable with, but I hope that the director and writer would be satisfied with what I do. Huh? That's what you're trying to do? That's what you're trying to do first? Who are you going to kill? Boss, boss, boss, boss! Boss, no, no, no!   When one person is not there, that energy is felt, that void is felt. So it's kind of hard to pick up or to, how should I say it, be fully engrossed within the rehearsal. Faster! Alice right now, for some time now, Alice has been struggling to come to rehearsals. When I realized some time back that it was becoming a problem for her to attend rehearsals, obviously to have to leave early. I told her, well, consider, you know, not being a part of it, seeing that I can't get the commitment from my actors. I now have to go and find somebody else to play the role and make arrangements so that we're not behind. Daniel I guess, you know, knows that I acted a few years ago. So many, many, many moons ago. And just asked me if I wanted to be part of the program that was happening. And of course, as anything else I volunteered to show off what I can do. What are we getting ourselves into? You love me enough to take me out of this f***ing place? You love me enough to walk in the bush and talk to me? I was an understudy for two roles. It was Doctor Pot and some guy that I love if a girl. Jack, alright. And Robert, he was playing the role cash man. When Robert came to play the role, I was like, boy, let me get the role already, let me get the role. Because Robert is more experienced in terms of being on stage and that kind of vibe. In a drama pussy. So I said, oh boy, let me get the role. So I was told to understudy cash man with being an understudy for two other roles. I was like, boy, that's a lot of pressure on me and after the nine, after the nine. So last week, two days ago, no, last week, Wednesday it was, the producer came and I was like, oh, I have good news and bad news. Somebody jumped out of the play. And my man was like, boy, tell me. Tell me it's messy. Alright. So then when they said his name, I was like, I'm charged. I'm disney. I'm disney boy. Here are ways to reduce your plastic bag use. One, refuse plastic and take your own reusable bags when you shop.  Three, repurpose your plastic bags and use them to line your trash can, paint trays and more. Four, dispose of your plastic bags by recycling. Shop wisely and reduce, reuse, repurpose and recycle. CF is both a champion for cultural preservation and development change agent. Established in April 2002 by the CDF Act of 2000 as the agency responsible to align the aspirations of cultural and creative individuals, groups, communities, policymakers and civil society through the implementation of the National Cultural Policy of St. Lucia, we envision a strong, united and proud St. Lucia community empowered by culture and creativity. For more information on how you can partner with CDF on some of our projects and efforts, go to CDFStLucia.org. Or contact Cultural Development Foundation, Barnard Hill Cathedries, PO Box CP5405, call us at 457-9021 or send us a fax at 459-0615. Email us at info at CDFStLucia.org. I asked my friend Shatoya from SHIR 758 to come and do dance rehearsals with them because I always like to just expose the cast to different things, to just get them in the zone and excited about rehearsals. So she came, we did our curtain call and we did our choreography for that. And as of recent, we've been challenging the cast to just run the play off script, which means no script, even though you don't know the lines, let's just improvise. So let's see how the movement of the play takes place.  The lips, the teeth, the tip of the tongue. To me, I see it already. But she saw it on Saturday, not today. I did saw you do something like a fair thing, try again. A million ways to say something. The lips? No! The lips, the teeth, the tip of the tongue, these are the tools of articulation. The lips, the teeth, the tip of the tongue, these are the tools of articulation. You know, they say sometimes your best performance is usually one of your best rehearsals. And I've seen the play performed and done so much better than what took place. So I was just kind of disappointed and I tried my best to not make them stop. So I just wanted to see if they'd pick up the energy or just check up vibe like it wasn't good and it was just like that until the end. So ask us to marry after every rehearsal. We give feedback and we have that one-on-one discourse about everything. And I think it was Dishon. He has, well, he's the one picking up from Robert. So he knew that almost about a week and change. And it was obvious that he didn't really go through the script. So I'll be honest, I've not been going through the script where I wanted to add funeral of all my great-grandmother. And after I was like, boy, you know what, let me channel the rest of the line. So when I got through rehearsals on Monday, I was like, well, Daniel, I cannot use my script tonight because, you know, I try and play things. I know my own. So I want to, like, you know, go through the script whenever she's like, no, we're improvising. So the past rehearsals, it has been improvising as well. So I was like, okay, cool. The last rehearsal, she told me, boy, you did excellent. Boy, you did good. So I mean, I have the hype by going and improvising. I know I could do it, right? So I, when I went on stage, my first line, I spill it out. It looked good. Daniel laughed 44 times. I was like, okay, Daniel laughing. When I got to the core of it all, as soon as I started speaking, Daniel was like, that's not the lines. That's not what I want, okay? That's not this. And at that point, I was just like, what the f***? I know sometimes, you know, you can't make a demand on an actor, you know, to learn their lines, especially if it's not space of time. But one week, in my opinion, was enough time to at least get the essence of the script. So when you're improvising, you're not so afraid that you're throwing everybody off. Can I use my script? No. Improvise. I'm trying to improvise. You're telling me that's not what's on the script. I went back, I sat and everybody was supposed to have given their feedback as to how the play went. So when it got to me, Daniel was like, what do you think should have been better? So I said, well, I think I have to learn my lines. Well, I guess I just have to learn the lines. So like, I just, I don't know what to say.  Of course, yes, you have to learn the lines. Daniel responded, and she was like, what the f**k you telling me about? You f**king don't learn the lines. At that point, I was like, I just, I guess I lost it at that point in time. No, I don't regret my behavior. I don't because I realized for some reason you have to be a mean person.  You'll not be able to recognize me. Don't test me, Pelina. From audition day, Pelina showed up and she had a stethoscope and she had her nurse outfit already. Like, Pelina is that kind of person. Like, when she does something, she goes deep in it and she goes out and she gives all her effort. I mean, I've acted before in the States and then brought me so, I'm happy to be able to do it. What would you do if a student was doing it after your class?  What would you do if a student was doing it after your class, Pelina?  You make me feel sorry for myself. I'm not making you feel sorry for yourself. You're making me feel sorry for myself. It's the best you expect. Yeah, you could have put a little better than that. And first of all, I was dealing with Daniel of his few decisions, so I don't know why the person is that sad. I'm not trying to make you feel sorry for yourself. Why should I not eat my bread? I was speaking to Daniel of his few decisions. She was speaking to me. She was speaking to me.  Because I could have wanted one lap off stage. It was disrespected to one stage. I would have asked disrespected. Nobody asked me to excuse I was disrespected. A lap and disrespected. I love my disrespected. I'm moving forward. I will be a little bit harder to get the results that I need to get. It's nice, Daniel all the time. And it's just unfortunate that it had to get to that for people to start like, alright, it seems like Daniel is serious. I'm trying my best to actually get it. And I'm just not getting it. And I'm just getting it. But won't you tell me leave? Come on. So I didn't know what to do. Today was a very successful rehearsal. I came to my rehearsal space. Everybody was in their spaces. Who had to be learning the lines was learning the lines. And I'm grateful for that. So it was a lesson. Everybody just have to shape up or shape out.  Coming up in the next episode of Curtain Call. I will say what I have to say. I will say what I need to say. I will say what I want to say. I will say what I want to say. I will say what I want to say.