Hello, Myself Ravendra Chauhan, Assistant Professor, Department of Electronics Engineering, World Change Institute of Technology, Solabor. In this session, we will discuss how the different tasks in RTOS can be managed. It is RTOS task management, the learning outcome. At the end of this session, student will be able to elaborate the task synchronization. Student can describe the different mechanisms for inter-task communication. Outline of this session, first the single tasking versus multi-tasking. Then review of task, task scheduler and dispatcher. And then we will see the different mechanisms available for inter-task communication. Basically RTOS is the real-time operating system which is a multi-tasking operating system and it is mainly designed for real-time applications. Now, what is single-tasking and the multi-tasking? Now, when a single program is allowed to run at a time, the system is grouped under a single tasking operating system. Means only one program can run at the same time. While in multi-tasking, the operating system allows to execute the multiple programs or the multiple tasks at one time. That's why it is classified as the multi-tasking operating system. Now, recall the concept of task in RTOS. Now, what is the RTOS task? So, the software is decomposed into small, schedulable and sequential program units known as task. Means the any software can have the number of defined tasks. So, in real-time context, the task is the basic unit of execution. Task is governed by three time critical properties. The release time, deadline and execution time. Release time means when at what time task should be ready. The deadline means the task has to complete within that particular defined time and execution time, which the task is taken to complete the execution. So, release time means the time at which the task can be executed. Deadline is the point in time by which the task must complete and execution time denotes the time the task takes to execute. Now, the task scheduler. The scheduler keeps the records of the state of each task and selects one which are ready to execute. So, task scheduler selects only one task at the same time. So, task scheduler allocates the CPU to selected task. A scheduler also helps to maximize the CPU utilization among different tasks in multitasking program and to minimize the waiting time. There are generally two types of scheduler, non-preemptive and priority-based preemptive scheduler. Now, see what the non-preemptive scheduling. In non-preemptive scheduling, consider the example shown in figure one where the four tasks have shown and task one and task three is having the higher priority than the task two and task four. So, the scheduler first selects the higher priority task that is task one. Then it will execute the task one and task one will complete the execution at time t1. Then scheduler will select the task two and the task two will get execute. After completion of the task two, the scheduler will selects the task three and so on. But suppose while executing the task two, task three is ready for the execution where the task three is having the higher priority than task two. But in non-preemptive scheduling, to give the control to the task three depends on the task two. So, task two has voluntarily give the control to the task three. Means it is not mandatory for the task two to release the resources for the task three. Now, in priority-based preemptive scheduling, consider the example shown in figure two where the scheduler has selected the first task that is task one. And task one is completed at time t1. Then scheduler has selected the task two and the task two is executing. But in mean time, the task three which is having the higher priority and it is ready for the execution. Now, in the preemptive scheduling, the task two has to stop and gives the control to the higher priority task that is task three. Then higher priority task three will get execute at time t3. And then the task two will have the control and it will execute the remaining part. And after completion of the task two, the scheduler will go for the task four. Now, task dispatcher. The dispatcher gives the control of the CPU to the task selected by the scheduler by performing context switching and changes the flow of execution. At any time an RTOS is running, the flow of execution passes through one of three areas through the task program code, through an interrupt service routine or through the kernel. Now, the inter-task communication. Now, inter-task communication means the exchange of the required data between the different tasks. So, inter-task communication involves sharing of data among tasks through sharing of memory space, transmission of data and etc. Few of mechanisms available for executing the inter-task communication which includes the CMA4s, mailboxes, message queues, pipes. So, first we will see what the CMA4 is. So, CMA4 is a kernel object used for both resource synchronization and task synchronization. And CMA4 is like a key. Now, suppose for example, the two persons are there and which both are want to ride the one bike. Now, first the person who is having the key will ride on a bike. After it's ride over then it will he will hand over the key to another person and then the another person can have the ride on the same bike. That means the person who is having the key that person can ride the bike. So, similarly here consider the example shown in figure 3 where the two tasks that is task 1 and tasks 2 are shown. And both these tasks want to use the display to display some information. Now, when task 1 wants to make the use of the display. So, first task 1 will acquire the CMA4 for this display. And once the CMA4 is acquired by the task 1, then task 1 will use the display unit. The task 1 will display the required information. And then after the use of the display the task 1 will release the CMA4 for this display. And then the task 2 may acquire the CMA4 for the display and the task 2 may use the display. Now, the mailboxes. Mailbox is just like a postal mailbox. This task can have a mailbox into which others can post a mail. Now, here the one example shown in figure 4 where the two tasks are shown. That is the task 1 and task 2 and the mailbox is shown. Now, this mailbox is nothing but the shared memory space. The task 1 will write the message into the mailbox. And then the task 2 will read the message from the mailbox. Now, message queues. Message queue can be considered as an array of mailboxes. Since the number of mailboxes are cascaded. A message queue is an object used for inter-task communication through which the tasks send or receive the messages placed in a shared memory. A task seeking for a message from an empty queue is blocked either for a duration or until a message is received. The sending and receiving of messages to and from the queue may follow first in first out. Means the first return message will come out first from the queue, last in first out and third one is on priority sequence. Visually a message queue comprises of an associated queue control block which includes the name, unique ID, memory buffers, queue length, maximum message length and one or more task waiting list. A message queue with a length of one is commonly known as a mailbox. Pipes. A pipe is an object that provides simple communication channel used for unstructured data exchange among tasks. A pipe can be opened, closed, returned to and read from. Traditionally, a pipe is a unidirectional data exchange facility. There are two descriptors respectively at each end of the pipe for reading and writing. Data is returned into the pipe as an unstructured byte stream via one descriptor and read from the pipe in the FIPO order from the other. Unlike message queue, a pipe does not store multiple messages but it stores the stream of bytes. References. Embedded Systems by Raj Kamal and a book Embedded Real-Time Systems by Dr. K. V. K. Prasad. Thank you.


Let's welcome Dee Lu, Senior Product Manager at Tech Matters. Dee has experienced building software as a service or SaaS business software after working at Yext, a New York-based technology company, and has worked on pro bono projects for international social enterprises as a past fellow of the Moving World Institute. Dee is based in New York City. Hi everyone, so my name is Dee and I am a Senior Product Manager at Tech Matters. I'm here today to talk about a SAILO, a modern contact center platform developed by Tech Matters in partnership with the Child Helpline Movement. Across the world, Child Helplines receive over 25 million calls annually, and over 30% of calls can go unanswered due to lack of resources. We realized that most helplines have dated technology solutions and still primarily focus on voice calls while kids are moving online, more and more to social media. So, while each helpline that we meet has their own operating philosophies, the commonality of their work means there's a lot of opportunity to provide a technology solution that can be shared across helplines, while still being flexible enough to be customized to each helpline's needs. Our role in building a SAILO is to provide helpline partners with the tech tools to make the crisis response movement more powerful. Okay, so onto the demo. A SAILO is browser-based, so helpline staff can log on for their shifts from any location with an internet connection. With a SAILO, callers can reach out to the helpline using their preferred communication channels across voice and supported tech space channels. The single pane interface, which is what you're seeing here, is designed so that counselors can view incoming voice and text conversations across channels, manage active conversations with a simple chat window, and capture data about the caller, all in one unified place. We built several efficiency tools to give counselors more time to focus on active counseling. For example, we have a chatbot, which you can see in that active conversation pane in the middle, that captures basic demographic information from the caller and auto-populates the data forms from that information collected. Counselors can choose from a list of customized canned responses set by their helpline management and instances where the helpline has preset messaging for how to answer frequently asked questions. We also automatically flag to the counselor if a call or chat has come in previously from a user. You can see that in that little yellow banner across the top right hand pane. And so we'll flag that based on an identifier, such as phone number or Facebook user ID, and counselors can easily look back at previous data records for that contact. In the rightmost pane, you'll see that data collection is built right into a salo so that counselors can capture the information they need while in conversation with the caller. We work with each helpline to customize which data fields they want to capture, which fields are required, and what the input options are. For helplines that need case management, we have an optional case management module that allows counselors to create case records, keeping all necessary information in one place. For each case, a counselor can record internal notes, external referrals, reported incidents, and documents, such as filed reports. And then once a conversation has ended, the counselor will save the record. Helplines can then choose to trigger a customizable post-conversation survey, which allows them to collect feedback on the quality of service they received and aggregate that feedback into reports. Switching over now to supervisor capabilities, a salo is designed to give helpline management extensive tools to view and report on their team's operations. A salo provides two main sets of reporting dashboards for management teams to report on operational and programmatic trends of their helpline. Helpline operational dashboards show call center activity, tracking counselor call time statistics, and abandoned call volumes. Programmatic dashboards are built from a standard reporting framework and give helpline managers insight into the types of calls they're getting. This screenshot shows a breakdown of incoming calls by category of the call, and the flexible filters across the top allow you to slice and dice the data, so helpline management can see what types of calls are coming in for specific demographic groups. Beyond that, there are many more optional and customizable features that are worth calling out in a salo. For example, the salo interface can be translated into the helpline's preferred local language. We can work with the helpline to set up automated messaging for operating hours, welcome and goodbye messages, and data collection consent. We can configure IVR and ITR triaging based on the service requested or the caller's preferred language. We have integrations with local reporting portals for reporting child sexual abuse material online. And lastly, we are expanding support to other types of crisis response helplines, such as gender-based violence lines and online abuse reporting hotlines. We are building a salo as a modern open source platform to strengthen the crisis response movement. If you have any questions about the salo platform or if you run a crisis response helpline that might be interested in adopting a salo, please reach out to us at contact at assalo.org or visit our website at assalo.org. Thank you.


Have you seen this before? Oh, no, haven't. But are those the so-called free-range chickens, or is that the ones in the barn? It would be a combination. Free-range chickens, they keep them in a massive barn, they can crowd them and they might let them out. But they still call them free-range? Or are those barn chickens? So they don't always adhere to free-range standard, but even free-range standard, it means nothing for the animal in the big scheme of things. I think it's more just a marketing ploy. There are things, they're slightly better conditions free-range, but they're still horrific.  They still live a life of slavery, their eggs are taken from them, their children are taken from them, they're essentially living in eternal torture. I thought, see, I always thought that one of the best, I mean, British pork is one of the best standards in Europe, which might be. This here isn't really, this is pretty standard, there's nothing surprising about this. To me, I've seen a lot of it and the reality is this is where the animals we eat come from. Even the things that come out of them, like eggs and dairy are horrific industries, you know about the dairy and egg industries? Yes, yes, the egg one, not the dairy one. Okay, so in the egg industry, the females obviously produce more eggs than... It's the male ones, it's not the produce more eggs than they can.     You know, this is a sow stall, so the mother pigs are kept in there six weeks at a time. I was just at the gas chambers yesterday in Suffolk and they're killing a lot of the mothers because they're just spent, they've got nothing left to give to the farmers. So after a lot of misery, they send them to get gassed and people eat them. So essentially we're eating the body of a mother who suffered, had their children serial kidnapped from them throughout their whole life, lived in these cages and then we eat their bodies. So what do you think about that? It does hurt. I've been aware of these things, not as aware. Now I see how it really is, but it's terrible. Do you think it's unnecessary? Yeah, completely. I think anyway, we're eating far too much meat. Here you have a vegan.  Wow, that's amazing. What made you switch? The animals? The animals? I've been a vegetarian for seven years. Okay, and you just didn't know about the other industries? Yeah, I wanted to switch. First I wanted to try it off for 30 days. Yeah, that's a good idea actually. That's a really good one. How about yourself? Have you thought about it? Become vegan? No, admittedly not. I'd see my mother, for example, who's living in Germany. She lives near a farm where the animals truly have a... A better life? Actually completely. Okay. What about their death? 10 pounds. Well, they... They have a better death? Oh, completely. They are completely... I mean, she's seen it, even herself. Okay. They're completely... Do you think it's justified though? We don't have to eat them.  Well, we don't have to eat them. We're right there. I have to admit, as long as an animal has that life, that particular farm that my mother goes to, in Germany, in my mind, that's okay. It's okay to kill an animal for a sandwich if you don't need to? No matter how nice their life was. Do you think they want to live? Like, they're scared to die, even if they've had a good life? Well, I don't know if the consciousness of the animal, if as long, of course, you have to be extremely careful. I see your point. What about a dog? A dog wants to live? I don't know whether the consciousness is that far that it is. Well, you know that another human wants to live? True. How do you know that? I don't know. What makes you think another human wants to live? Because they say so. Language determines that. What if they try to avoid me with a knife, a pig? They were scared of me trying to stab them. Would that show you that they didn't want to die? That would show me that they didn't want to be hurt. Why wouldn't they want to be hurt? They care about their own well-being? Because of pain. So if you were in the pig's position, you wouldn't want someone to harm you? I would not want to suffer any pain. You're absolutely right. You wouldn't want to have your life taken short? Yeah. Again, the question of consciousness, whether if someone is not aware. Like, let's say, yes, no, I want to die. But if I or I was led somewhere without knowing, I was about to be killed. That's murder. You're talking about murder? Yes. If someone murdered your family member, you would want justice. You see? Yes. But I think for me, it's really this matter of consciousness, having the consciousness about these things and not, and because human beings... You're against animal cruelty, yeah? Cruelty, yes. So you think they have moral value, animals? You think they have some kind of moral value, animals? No. But you're against them being mistreated? Yes. But if they had no moral value, why would you care how they're treated? Because I don't want any being to suffer pain. You know they suffer pain, so they have moral value then. Wait, no, no, moral value. No, no, think about it that way. Okay. Look at the animal world, in the jungle and everything. Yeah. I mean how... Or let's even just look at a simple cat. Okay. How can it kill and play with a bird for hours? Yeah, that's a cat, that's a cat. Yeah. Is that moral value? Cats don't have moral agency like us. We know right from wrong. A cat is killing to survive. Yeah? Yeah, well, no, no, wait, wait, wait. Why does it have to play with... I've witnessed it before. Yeah.  Would you say that we should justify our behaviour by the behaviour of a cat or should we be a little bit more civilised and you know what I'm saying? No, because you're just saying they have moral value. Animals do. Animals do. That cat doesn't. Why not? No, no, no, that's different. The cat has moral value. It's not okay for us to hurt the cat, but the cat doesn't have moral agency. It doesn't know right from wrong. A cat doesn't... A cat is an obligate carnivore, yeah? Yes, yes, that's true. So they eat to survive? That's true. Are we eating animals to survive? No. So why are we doing it? I like it just for pleasure. Do you think an act of evil is justified because we derive pleasure from it? Think of any other act of evil that makes someone feel good. Is that act of evil justified because it makes them feel good?  No, no, of course not. So in a similar way, killing an animal because we derive pleasure from that isn't morally justified because we don't need to do it to survive.  But, wait, wait, wait. But if now, let's look at that far, my mum goes to, I mean, she eats very little meat, but still if she bites me, she goes there. Those animals, she's seen them, they are not stressed at all. That's what they are, I mean, from beginning till the end. Well, that's treatment. That's treatment. Good treatment from beginning till the end. A knife in the throat in a happy animal is still as bad as a knife in a throat in a sad animal. Think of it as a happy human.  Then one night you smothered her in her sleep, she didn't know. Now, it's okay, she didn't suffer, she didn't feel a thing. Now, is that justified? Again, here. If she, for example, was suffering, right? If she was suffering. But she's not? No, no, wait. Now, what about euthanasia? What about people who decide to die? That's a different thing. That's not what we're talking about. We're talking about raising pigs here that are happy and stabbing them in the throat. Yeah. That's what we're talking about. It's not euthanasia. Yeah, but you're asking... I tell her dad. I know. But no, but... So do you know... Sorry, do you... This is a really interesting... No, no, I'm having a really good debate with you. This is amazing. I really... No, because I'm just thinking... Because I was asked, does the pig want to live? Yeah, obviously. Because they avoid pain. They avoid pain. And they feel love for their children. They express emotion. That is true. You see that emotion in yourself and you know you want to live. If you couldn't speak, you still know, I'd give you the benefit of the doubt that you wanted to...  I would stick up for you. I would stand up for you. See, it's this survival instinct, right? You don't have that. We all have. We have supermarkets. We don't need to survive. No, no, no, not about meat. In general. Survival instinct that I don't want to be. Let's say I'm in an island. Someone who tries to kill me. It's a survival instinct. Yeah, but why do you have that?  Every animal has that. Every animal has that. Every bird. Every dog. Every cat that you feel love for. That they feel love for you. They show affection. Yeah, but it's on a different level. No, it's not. How? How is it different? I... You have to explain now. I just really think it's a... No, because I really think that... Pigs don't value their life. So it's okay to stab them in the throat. Come on. You are wrong. It's very... Come on. Just be honest here. No, I'm truly... Come on.  Would that make you feel a certain way?  It's thrashing in pain. Just keep stabbing it. No, no, no. No. That's exactly what I don't want. The death has to be in a different way. The killing of the animal. Tell me how. Tell me how to kill an animal in a humane way. There's no humane way. Well, if there is no humane way... No, the way I think it is done at that farm, I believe, is that the cows, they are brought into the same environment where they always are. Okay. Okay. Completely stress-free. Yeah. And I think that is with this shot. Oh, okay. So that's humane? A shot in the head? Well, I mean... Would you... Okay, okay. There's like a millisecond... I'll tell you this phrase. The way you judge whether or not something is humane, first ask if you'd want it done to yourself. Well, I have to say, if I didn't know that was going to happen, that is the way I... Truly, rather than someone stabbing me like this... Oh, no, no, no. No, no, no. Now you give them two options. Rather than being stabbed, rather than being shot in the head. I'll give you another option. Harmony and freedom. How about that option? Would you rather that or being shot in the head for no reason? This is what we're talking about. No, the thing is, the thing is, if I don't know, I don't care, to be honest, because I don't believe in such... But it doesn't... No. Of course, I don't want to. Does that justify murder? Does that justify shooting people in the head because they don't know about it? There's many people who get killed that don't know about it. Yeah. This is... That's not it.   People around you are going to be suffering. Yeah, no, yeah, yeah. That is the only reason why I'm really sorry about that. That is my... Truly... But do you really believe that if an animal doesn't feel it, then it's okay to just shoot things in the head, shoot animals in the head, humans in the head that don't feel it, that makes it okay. As long as there's no suffering involved. If I now didn't have my children and my husband, that's right. And I was alone and you just shot me in the head. Of course my parents were very... No. What's the other option though?  I let you live in peace. That's the other option. You have that. Yes. We can give that to animals. That's what vegans are. Yeah, but at the same time... We're giving them the other option. If that happens to me, right? I don't care. I'm dead and I don't know anymore. But I would never shoot you in the head because I respect other life. That's what vegan is. No, but I'm truly thinking... I'm really... I'm not joking. Okay.  My husband would suffer. My parents would suffer. If I didn't know that... Does that make it okay if you didn't know? That's the question.  Is it okay to kill anyone if they didn't know? No, it's not okay. Okay. That's all I want. That's all I want. I personally wouldn't care. I just want you to admit that it's wrong to do that to an animal. That's true. No, no, no. All your meat come from your mum's farm. Does all your meat come from your mum's farm where they were treated happily? Not my meat, no. Okay. That's what we're talking about here. That is the bad thing. Absolutely. No, no, no. That's not just the bad thing. Even the happy farms are still bad. No, I think it's okay. No, you just said it's not, though.   I said a human's life, because we're talking about humans. We're the same in many ways. In many ways, but not in all ways. So if we have slight differences... Like, for example... So you're discriminating now? Let's say, for example, right? That I'm thinking... Think about the family structure in an animal's life. Like, the piglets will leave the mother at some point. No, they'll get taken from their mother. No, no, no. I mean, and let's say if we leave them happily in peace. Okay. They will eventually go and start their own family. Oh. That's fine. That's what will happen. And the mother, then, will not even necessarily recognize the menu longer. How do you know? Like, I saw on my dog. She didn't recognize her mother five years down the line. That's fine. So the structure is different. So eventually, I don't know how it all is. Different types of animals, but let's say in a dog, it is like that. She didn't even know. They don't recognize her anymore. They're proud at each other when they met each other five years down the line. So... So what are you trying to get out here? That makes it okay to shoot animals in the head? No, no, no. I just mean that the consciousness is different. I'm just saying we are different. We don't want to suffer pain. We don't want to feel pain. Agree. Agree. But shouldn't we focus on what we have similar versus what we have different? Because that's just discrimination. No, no, no. Yeah, but...  They're different, so it's okay to kill them. Okay?   No, no. I don't know enough about family structures and everything in the kingdom. So what is your justification for shooting an animal in the head? For no reason. What is your justification for that? What makes you think it's okay? As long as that particular animal has had a happy life at the beginning and all through the life and has not suffered till the very end, basically shot in the head without basically being dead without feeling pain. Okay. That is actually... That's okay. That is actually... So you understand that scenario? That sounds really... You know, what would be the word for that in any other scenario? In any other scenario. Oh, well, let's put it in a murderous context. Like, you mean a human context? A human context. So that you want to...  Well, as I just said... What would the judge say to you about that? Of course, that's not true. You're on it. They had a happy life. That is... Yeah, but then, of course, but that is why we're humans. That's because of our rules. You understand it creates a double standard. I'm not sure about that. We want a certain... We want to live in a certain way. We want to live in freedom. Yeah. In peace. Yes. Well-being. Yes. We don't want to be enslaved. Yeah. We expect that trigger for us. True.  So that is a double standard. We would cry out for help. See, but we come again back to the very initial question. Moral values, moral standard, like morality and consciousness. Consciousness. Consciousness. If you think animals don't deserve to be treated cruelly, you're admitting that they have some kind of moral value to you. Yeah, see, I think the terminology... Otherwise... I struggle with the terminology because I'm not quite sure whether we're on the same line. I just think that... You think that they're below us. It's okay to raise them and shoot them in the head and eat their bodies for no reason when we have alternatives. We can buy other things. We can eat other things. I absolutely agree that humanity we are... You would still choose to cause, let's just say, no suffering, but a bullet in the head to an animal. You would still choose that even though there's other options.  I know. I know. Plus it's healthier. I know what you're saying. Their whole life is not their whole life. Pigs are here at six months old. Oh, yeah, babies, yeah. Does not live in a whole life of happiness, is it? It's not. There's two babies at six months old. Their most pigs are killed at around six months old, unless they're south, which are mothers, then they're killed at around four years old. And is that... I mean, here again, I don't know... Most of your meat you eat is from these farms that are showing you. Yeah. So would you... You know what I'm trying to say? The majority of meat people get from these farms. But even in the best scenario, in this dream world farm, shooting an animal in the head is still wrong because you wouldn't accept that on yourself. Otherwise, it's hypocrisy. Do you understand why it's hypocritical, though? See, I don't... Because you're saying it's okay for them but not okay for me. And they're living beings. That's feel pain and suffering, value their families just as much as you do. Yeah, see, that is where we differ, I guess, but you didn't shoot by yourself. Oh! Yes, very interesting. You would shoot... By the way, by the way, I thought about that a lot of times and I thought several times ooh, I wouldn't do that. I certainly would not slit a throat of a sheep. Why not? Because that, I think... Why not? Yeah, because I think that is quite a cool way to go. No, but animals are below us. No, no, no, no. No, no, no. But you know what I'm saying? If you think it's okay to shoot an animal in the head... And now, misinterpreting my words. You're now put... Because I only was talking about the... The way? In a second. Which is... Which is a second. But that's not where you get your meat from, right? I... Yeah, but no, no. Wait, wait. I'm... I'm talking now about the ideal farm that my mother goes to. But that's not the scenario in your life right now, is it? And I'm saying that is wrong. So what you're doing right now is wrong. What I'm doing right now... By your own moral standard, what you're doing right now is wrong. Yes. Would you like a card? But... But... Okay, okay, okay, okay. We'll just leave that there. Thank you, thank you, thank you. Give us a hug. I really enjoyed that conversation. Yes, it was very nice. Okay, bye bye. I hope that gave you something to think about. I know, like, you can debate that sort of things, but just think of it from the animal's position. I see what you mean. And I see... It's unnecessary, you know? She has a wheel. Look how healthy she looked at your vegan. She always tries my food and she's like, oh, that's not that bad. Exactly. That's nice. It's not. So it's vegan ice cream. And your homemade ice cream tastes so much worse than my vegan ice cream. No, no, no, wait, wait, wait. I have to say one thing. Your husband... I loved it. Her husband... You loved it? Her husband said my ice cream tastes better than yours. Yeah, yeah, of course I tried it. I hope you can ice cream at home. I hope you can cheese at home. I hope you can vegan it. What's your name? Annika. Annika. Thank you so much for that conversation. What's your name, sir? My name's Joey. What's your role with this? What's in these documentaries? You love them? Oh, yeah, that's certainly a good one. Thank you so much. Bye-bye.


Hello, my name is Sean. Hopefully all of you are here for a bug bounty hunting talk. If not, you still have like a minute to leave. Otherwise, this probably will be a bit too boring for you. Nice to see you all. Thanks for coming. This talk, you should expect just like a light beginning talk. We should not dive into like any two technical details. Though, feel free to interrupt at any point. Feel free to ask any questions. I'm perfectly fine with saying I don't know what you are talking about, and we will just continue, or I will try to answer to the best of my abilities. So yeah, my name is Sean, and this will bug bounty hunting talk. Feel free to come in, guys. Also, if I'm not loud enough for the recording, by the way, hi, guys. We're online, then just tell me. Right, OK. Thanks for the doors. That would be disturbing. All right, so what's in front of us? First, I would like to give a bit of my background, and how did I end up bug bounty hunting? What things did I manage to maybe do or find? Then I will tell you a bit more about today to day things that you do as a bug bounty hunter. Where do you do it? How do you do it? Then I will tell a bit more about things that you actually are expected to do, and things that you are not expected to do. By the way, maybe just let's start show hands who knows what the bug bounty hunting is. OK, good. Who is a bug bounty hunter? OK, that's good as well. So I can say, or was there a raised hand? OK, OK. Sure, sure. That's good. And then I will try to give you a bit of a demo, or it won't be live demo that technology is failing me today, so unfortunately. I can't do it live, but maybe it's for the better. First, what's my background? Well, I, oops, and this. OK, perfect. What did I do? So I pressed different button and things. That's a great start. OK, so just start the presentation again. Cool. Things break. That's why we can hunt for bugs. So that was unplanned demo. All right, so at the end I would like to end with a demo. Just like to show you practical reports that might be interesting for you. What's my background? I did some mathematics. I'm trying to, or saying this, because you can come from any background. It doesn't matter what was your original, maybe. Did you pursue originally? But don't worry, there won't be that many equations. Every equation in slides is bad, as I heard. So let's not go there. I worked for some corporates. I worked for smaller companies. And I also did some forensic analysis, not this type of forensic analysis, rather this type of forensic analysis. So just looking into bits and bytes and try to get some meaning out of them. And right now I'm doing PhD at Crocs at the different faculties. So if you are confused about Verdi venue of Def Conface, there are two faculties in Burna. And the other one is my alma mater. And I ended up doing Babontis roughly two years back during COVID. And I worked on various programs for companies. So you might recognize GitLab or GitHub. Maybe you don't recognize this one. I think it's Ivan or some different company. I also find something during COVID in one of the European Union projects for digital COVID certificates. There are also programs for companies that do not disclose that they are running Babonti program and that those programs are considered private. So some of the things that I will be telling you about, I won't be telling precisely in details. What's the company, for example? Word of caution, just a disclaimer. I'm not inviting you or giving you the right to just go heck on the internet, of course. That's up to you and your responsibility. Just so that the lawyers are satisfied. Also, everything that I'm saying is on behalf of me and not my employer. Right, so Babonti hunting, founding bugs, founding security issues, vulnerabilities. Is it actually ethical? Well, the state of the things evolved, but thankfully nowadays, there are ways how you can just go heck on someone else's software, meaning that you just go as much as you can, go deep, go wide, try to find issues, try to leak data from the website, try to do remote execution or whatever, and still remain ethical. So it's sort of like a win-win situation. You will learn something, you might get, or gain some bounties, the companies will eventually get more secure. So that's where we are at right now. It wasn't always the case, so I'm quite happy about this. I'm not sure what are your expectations, even from this talk, but it's like, okay, I want to see whether I should get into Babonti hunting. I feel like often the misconception is that it's some kind of a get-rich-quick scheme that you just like, okay, I know software, right? I will just sit down and play around and find bugs and maybe some RC and suddenly I will make a lot of bugs. So I would discard this approach just because it might take you a few months before you find actually something reasonable, that someone else on the other side of the globe will be willing to pay you for, even though you two have never met before. Though, to sort of start on the more nice side, yes, it is possible to make some bugs, and I'm worried to press another button here because I would like to show you, is this deglazer, do you know? Let's give it a try, okay, at least. Cool, so what are you looking at? This is a GitHub page of Shopify, that's an e-commerce platform that allows you within just a few clicks create your ad shop and you can sell goods or whatever to customers. So a lot of money flows maybe directly through Shopify or indirectly from some other banks that are involved. And I mean, it's a good company, right? They have GitHub, so they must be good software buys. But only as long as another guy like Augusto shows up and just throughout other project that he's working on, he stumbles upon some repository that maybe he want to use or something. And so he's like looking into the code and suddenly there's, oh, there's .enfile. And you're looking at the report that he created for Shopify. And so he was going through some Shopify's code and suddenly there was .enfile. It's like, that's configuration file, right? So first he was like, I'm not interested in that because I'm looking for the functionalities of the code. But then it contains GitHub token. And what's the point of GitHub token? Well, you get read or write access to the repositories, right? So to all the things that I was showing you here, this is one repository, but to other repositories as well. So just like he stumbled on it maybe just by chance, but it's quite critical, right? Because now you can do big door of all Shopify products. It is even authorized because you are using GitHub token, right? So it's like you are not hacking through the software, through the server to change the production software. And what's the payout? Well, it's 50 grand, right? So that's a sum that probably people would be willing to switch jobs for and just go hunt bucks. But again, especially finding valid GitHub tokens, nowadays it's, I would say quite rare, GitHub scans for all the code. The tokens nowadays are not just like some random byte strings, but they are also annotated or there's a tag like this is GitHub token or Shopify token, something. And so you can just grab for them for every commit. And so finds like these are quite rare. Nonetheless, they still happen, but don't go into bug bounty just for the money. However, what I can promise that you will get out of the bug bounty hunting is learning or knowledge. So I cannot stress this enough, like this is basically infinite amount of sort of opportunities or possibilities to learn interesting things. So if you are into this and you say, yes, please, I want to learn, then definitely go ahead. You can basically go as wide as you want, as deep as you want. If you have like a language that you would like to work on, you can just find a project that has a program listed as a bug bounty program and you can just spend your time there. And not just you learn, but if you find something, you can go then report it and maybe get a few bucks out of it.  Now I don't want to offend anyone, but even though we are sort of developer community and we have points that we feel strong about and we are on the same boat, I would still try to convey that for hackers, the intentions are quite different. I know people often I want to reinvent a wheel and they want to create new projects and so it's like, yeah, new features, like project manager will be happy, customers will be happy, but like some kind of bug fix, like I don't care. Like the bug shouldn't be there, right? But it doesn't bring anything new. For the hacker, that's precisely where we want to look. And it's like, if you read documentation and you write as a developer, this endpoint is authenticated, like I don't trust you. I don't care that you want this endpoint to be authenticated. I will just like make few curl calls and see whether it actually is. If you say you cannot enumerate whatever emails through the Reset password feature because we are rate limited or it's rate limited. Well, have you tried it? It's actually rate limited. Maybe you are running through some cloud fraud or something and the rate limit breaks in the path. So hackers will go and test all the claims that you have, so they basically have this as their motivation. All right, so if you want to go and actually start hacking ethically, there are a multitude of programs. So there's hacker one, there's integrity back out as well. Maybe another question. Is there anyone from a company that you know that you have a bug-bounded program so that, okay, too, cool. So basically maybe you are using like one of these platforms as a company. It's basically a game of three entities. Me as the hacker, the companies, for example, GitLab or GitHub that are running the program and the platform itself. The platform is sort of like a mediator between those three because you can also imagine, and this question that I often get, like how do you know that they will actually pay you, right, you spend like weeks and weeks, you are finding all those like good vulnerabilities that you can exploit, but then you just like leak the information to the company, they fix it and then just like, we knew about it and we won't pay you a thing. So that's why, or one of the reasons why it's good to have the platform as well because the platform sees the communication between the company and the researcher and they can say, hey, like, you are claiming that you are not obliged to pay but we have this in the terms of conditions, in the contract with the company that you are supposed to pay and we will make sure. So that's what sort of enables this to actually be practical. Also for the company, it's much easier, they just like, I haven't ran a program so I can't necessarily go into the details but I imagine that the company just gives a bulk of money to the platform and the platform then can just like pay to the researchers so it's quite a smooth process. All right, again, if you have any questions, feel free to stop me as I go. So if you go to the platform, you make an account and you want to go check a program. So what programs do we have? So there are public programs and private programs. The public programs are usually like, the big players do have them, right? Everyone knows there's a GitLab, GitHub, Facebook, Google, whatever, so it doesn't make sense to hide the fact that they have a program. They are also quite big so that they can manage the program. If you imagine that just like the whole world goes heck on GitLab, it will create so much potential noise for the company to go through. So the big players are public, some smaller companies are private. The one of the reasons is not like they are trying to obscure the fact but they simply are starting the process. So if you are in a company and you are thinking like, is bug bounty program something for us? Well, there's one way how you can get into just have a private program, just say to the platform, okay, we expect only like few tens of reports because we don't have the manpower to go through all of that. So this is sort of the page for the program. There are some statistics like how many reports have been resolved. This is not really up to date as of today. So don't take it as a fact for now but there are at least 1000 reports on GitLab. One nice thing, for example, is the response efficiency because you can imagine that you spend weeks finding the bugs, then you report and then you just sit and wait. And here you would expect it's probably better than in some open source project that only one person manages but I can tell you that you can take weeks or now you're sitting on possibly remote code execution and just like nothing happens. So 10 hours for GitLab, that's exceptional. And of course, we are interested probably also in what are the categories and what amounts you can actually get. And so there are low things for just few hundred bucks. So if you find just like something like you leak email address here and few addresses here and so on, nothing that important, that's probably like hello. If you get remote code execution, SQL injection, things like this, that's critical. That's another program that can be private, for example, but this one was just deducted for the purpose of the talk and it's GitHub's actually, they also get a good response efficiency. Another important part or aspect is the policy. So what actually makes this legal or ethical? So as part of the page that you've seen, there's also just policy, just straight up text like you can do A and you cannot do B. I'm not from the USA, but I know about the Computer Fraud and Abuse Act which basically to my understanding sense like if it's not yours, don't touch it digitally. Like you're not authorized to do so. But GitHub has especially or the program to especially say like you are authorized to do this as long as you follow this policy. Though if you violate certain restrictions, you suddenly go beyond this policy and it might just mean that, okay, we are interested in the report but we are not paying you anything or we ban you from our program or we ban you completely from the platform or maybe even more severe consequences. The policies differ quite a lot. So this is GitHub that's quite nice. Like GitHub is a software company, right? So they understand a lot of the things. PayPal on the other hand has something in the policy that can even this sort of make you not want to report to them. You don't have to read the whole thing but basically they say if you report to us, you hereby grant PayPal and not just PayPal but basically anyone we choose to like subsidiary basically it's customers irrevocable right or license to the things that you've given us, okay? It's not exclusive so hopefully it's still yours but we can publish, distribute, we can sell, offer for sale and do whatever. And this like for some researchers, this is like well I don't want to get into this like I want to just submit a report, I'm not giving you a license to just go sell it suddenly. And they even explicitly say like well don't submit to us if you don't want to and I can tell you like this was one of the reasons not to submit to PayPal for example. So that was sort of on the high level and now what you can do and cannot do so the next thing it's the explicit listing of things that you can hack on. So those can be any assets you imagine, those could be IP address ranges just like from this range to this IP address you can hack whatever you can scan, you can run automatic tools. It can be just the GitHub repository, it can be Android, iOS app, it can be like a hardware product, maybe hardware wallet that you can hack.  Maybe the company acquired like a small business so now you know that it's part of the bigger business but they are first going internally trying to fix all the issues that they are able to fix. And you can really break things as you can probably imagine if you like try remote code execution and production website and you break everything. The next thing that's important is impact. Maybe you are like, if you want to contribute to open source like people care about like typos in documentation, small things, small bug fixes like things like these. But for bug bounty hunting, it's like we want something that's actually practical that there is an impact. Like if you leak one email, maybe like we don't care that email probably exists on the website somewhere on the internet somewhere as well. But if you leak like the whole database or if you have remote code execution like yes, we do care. And this differs per program. So it's not like you get the denial of service on GitLab and GitHub will pay you the same or even more. That's what I experienced. Like GitLab said, yes, this is high severity. We want this. GitHub says, oh, denial of service. Sorry, we don't care. That's not even known. And so for example, self cross-site scripting meaning that you can save on the website your JavaScript but it only affects you. So for example, it's in your, I don't know like bio that only you see or something like that they don't care. It's excess says that's good but it's not impactful, impactful. Right, so again, if you have any questions, feel free to ask. Right now I would like to get into more specific reports. Unfortunately, the ones that I reported are not disclosed. So I cannot go through these but there is one guy, William Bowling that does seriously good stuff on Hacker One and it's all disclosed. So we can just look through the reports and hopefully you will see as like how good of a resource the activities are. And so one thing that I have mentioned is that the platform sort of gamified the whole experience. So right now there are things like rank. Okay, for William for some reason he doesn't have a rank assigned but basically you can say like, how those are the top 10 hackers in this year, top 10 hackers on this program. There is some kind of general reputation like this guy knows what he's doing. There is some impact. So like if he reports, it's really impactful. Okay, it's not like just some rubbish that maybe would cause something but not in general. And then there is a signal like if he says something, it's not noise. Like you should go and listen to his stuff. And you can see that Vax, by the way, if he ever listens to this, thanks a lot. That's really good research. And the resources, for him it just works to go direct to GitLab and to specialize on GitLab because it's not a small feat, right? I'm not sure if you are familiar with Ruby, Go, all the backend stuff. You can deploy different Docker instances and see how all these things interact together. So it makes sense to just like go specify on GitLab. I also said like you should not go in it for the money but you can see that for Vax it kind of works nicely. He has several arbitrary file reads. So if you have a server, you have slash ETC, slash password, you can get it. You have remote code execution, stored, cross-site scripting, another remote code execution, another one, another file reads, et cetera. So that's very good stuff. And we will go through one of these. I suppose all of you are familiar with GitLab. I don't have to explain. You short code, you version code, you create issues so you can write some text, you can get the XSS, that's just for the examples. But now remote code execution when removing metadata with XIFTool. So who knows what XIFTool is? Okay, so imagine you have a JPEG, you take a picture and it stores also GPS location, timestamps, what kind of device took this picture, right? If you imagine that you would have access to all the data of all the profile pictures of GitLab, you would know basically the location of like several thousands of people, right? So that would be an issue. So what GitLab does, it takes XIFTool and run the images through this tool and it strips the metadata. It can strip the GPS location, I'm sorry. It can strip the GPS location, it can strip whatever, what device took the picture. And so what they do, they have a runner, GitLab Borg Horse, and whatever you upload for images, at least conceptually, it goes through this tool, it strips the metadata. But there's a clash of what GitLab expects and what the tool expects, okay? GitLab just goes, maybe it would be test if I show you the code. So, okay, so we have something like this. You upload an image and it goes to some part of code that asks, is this XIFTool? So it should be running through the XIFTool. Well, there are some regex, that's always good for background hunters if there are regexes. So we just check, is this JPEG, JPEG with E or TIFF. And if it is, we mark it as something that we should take care of. The next thing is the problem where, okay, so GitLab thinks that based on this code that you should go through it. But once you go through XIFTool, it doesn't check the extension, but it checks the header of the file, just like reads through bytes and see what kind of tool it is. And so you might actually end up with a different parser that parses DjView. And I have no idea what it is, but as a hacker I don't really have to care. But my point is that I'm able to make this clash of what you expect and what the tool expects. And so you suddenly can feed any file and make it parsed by this kind of parser. And unfortunately, it's possible to get to a state where even though there is some check, so there's maybe again some regexes, but the JPEG file that will get parsed will suddenly end up being evaluated. So if you've been to any basic 101 faculty course on security coding principles, like do not write, evaluate, or system calls, or whatever, because suddenly they can end up here and the file that Wax has uploaded will get evaluated. And the payload sort of, the file that he uploads is not that complex. You can just see it down here. So it's just this thing. So you get some metadata, some copyright, whatever. Then this is the crucial bit. You escape a new line. Suddenly all the checks break, and then you can just run arbitrary parallel. So you just echo Vax into slash temp slash Vax. So just like a proof of concept. This is by the way a very good example of how you can prove to them that this indeed works, for example on GitLab.com. You just create temporary file, no harm done. You don't touch any ATC password. You don't try to like, oh, like I'm such a good hacker. Like I can remove something from the database. No, no, no, you just like show them. I can run echo. That's it. Like now they know. And now you have a report for 20 grand. The whole sort of steps to reproduce are only those two five. So just download these payloads. You create a new snippet on GitLab. You attach the file, you select and upload, and suddenly the file will appear on the server. Nothing too complex. There's lots of text to sort of describe, but this is, those are the reports that if you want to learn things, just go to hacker1.com slash hacktivity and find these reports. Maybe one more that I can show you. That's also, so this was a remote code execution, right? So this is, that's very good. But maybe you can just get arbitrary file read and how this can happen. Again, it was critical. There was some path traversal, meaning that our input hits some code that can traverse your file system and maybe retrieve file that you weren't expecting the user to end up with. Again, serious bounty for that if you are into that. Actually, one thing that I haven't mentioned, like the people that read this on the other side are not necessarily like as good as the researchers as you are, right? And so sometimes it's just nice to attach a half a minute video of like what actually can happen. And so thanks to that, we can try to watch this. Basically, again, we have a GitLab. I'll just comment it. So there is some GitLab. You don't even need to like have access to some special, special project. You only need two projects that you can create yourself. You create a new issue. So whatever some issue and you paste a special payload. So if you know markdown, this is like a link or attachment A and it goes to some slash upload slash one, one, one, one. And then now we see the path traversal or at least the attempt. So we are jumping into the parent directories. Oh, hey, and now we have the ETC password. That's the file that we are up to. And this is just like a comment in snippet, right? Like how can this have any effect? So you save the issue and now you have the issue. And what you can do with GitLab is you can move issues between projects. So we just say like, oh, this was the wrong project. I want to move it to different project. So let's see what happens. So you move it to some different wax project. And suddenly, yeah, it worked. So you have issue. There is a sudden attachment with password. You can download it. And if you view it, that's ETC password from GitLab.com. So again, Alfred, it's two wax for this very nice find. Is it hard to recreate? Well, you just saw, like just create projects at an issue, copy paste this, where you change the file that you are interested in. The smart-down is broken, but just like move the issue to the second project. And that's it, three steps and you have your file. However, finding the issue is the crucial bit. And that's hard.  But because our thanks to it being open source, you can just like, it's out there. Like you can just go and see and try to find issues like this. And basically that's about it. To wrap up, a few things. So those were the slides for the issues. What things can you hack on? Well, there is also internet by bounty program where basically the big players put money into one big bag and then you can pay out for different smaller projects. So if you find something on Rust or Rails or Curl or Lip SSH, Nginx or OpenSSL and not just like the software products like the ones we know, but for example, Xro which is a project between different countries in the northern part of Europe. So Estonia and Norway, et cetera, they're using this as a data exchange layer. So they also run a bounty program. And not only these things, but also European Union cares about things like mastodon or library.  Google, of course, they have whole platform for themselves. They can by the way support also researchers for just like they give you budget. If they trust you and your knowledge and you say, okay, I'm going to fix this open source project for maybe a few weeks. So that's also another possibility. I haven't talked much about tools. Like you can imagine, you can do all sorts of analysis. You can automate all different things. One thing that I would stress is like you find a bug. The platform or the program tells you have you fixed it. Well, then you just go and check whether they actually fixed it. This was probably the easiest money that I ever made. I just rear end one crawl command and said like, no, no, you haven't fixed it. And within a few minutes, I get a few hundred bucks more because they just saw that like their fix was not working and they got this immediate response. So yeah, there's a bunch of tools. No time to spend talking about those. There are nice resources that you can have a look around the activity on hacker one. There are nice podcasts, critical thinking, zero day or more. If you're more into cryptography, there is a security cryptography, whatever podcast, very nice one. And I will also suggest one of my friends, which is Mr. Problem, it's a Czech podcast, not really about bug bounty hunting, but rather about various ways how to think about things. And I think that's related because you sort of have to step outside of the regular developer creating issues or features writing code. You want to really understand how things work and interact. And so be careful because there is a user input everywhere. It can get very nasty. It can be quite easy as we've seen. And stay safe. That's basically all from my side. And if you have any questions, hit me and also we'll stay around in the hallway if you want to discuss. With that, thanks a lot. That's it. Okay, so the question is how do the private programs work? They basically work the same way. You have to be invited. So after you report a few things that actually make some sense, they have impact, you will suddenly start receiving emails from heck around saying like, yeah, we want you to hack. Interestingly, interestingly, you only have like a week to actually submit the, or respond to the program. And there are various things also, like people just have a like a window of two weeks where you can get like twice the payouts for the issues and it differs per the programs. You can also be kicked out of the program if you don't hack on them. Okay, any other questions? Yeah, there's a very nice question. What do you do if the company that you found back in doesn't have any program? I would say they should have. So as soon as you do any website or whatever, at least have your email there that you can access. If they don't have, it sort of depends. Like I've been in cases where I found various tokens that for example, for GitLab, if you find active token, you can just query one API endpoint and see whether the token works. So sometimes you can like check whether it's a valid find and you get the email address of the one to whom the token works. So you can just submit to them directly. Sometimes I just try to just search for security at that company or just like any email. And sometimes you just don't get any response and like that's it, the end of story.  Yeah, it's sometimes hard. We have one more minute for questions. Last one, yes. Yeah, nice question, yeah. Nice question, thanks. I think I get it. So basically how do you start? Do you go through various services? Do you just hunt for one buck? The one thing that you suggested, just like if you are good with, I don't know, networking or like TLS, just like go try to like go for engine X and try to see how the code behaves there in the areas that you do understand that's a good start. If you just like don't know, there are capture reflex games where you can just like play around and you will get the results or like you will learn more easily because the things are prepared for you to learn more. If you know a little bit more and want to find the good stuff, go read the activity reports and then try to recreate them. But it's like it varies. Like for example, I didn't know PHP but I wanted to see what are the bugs in PHP about and so I was just going through PHP projects and learning PHP and finding things there. It can take time, it can be like months before you actually find something impactful. Okay, I think we are out of time. I'm not sure whether the chair agrees, if so then. Okay, if you have any more questions, I'll be around, feel free to ask me. Otherwise, thanks for listening and have a nice rest of DevCon.


As the Taliban take over Afghanistan, what is the fate of Africa? Many ask, more specifically, Nigeria. And the revelation that former governor of the CBN Sanasi Lamido Sanasi may indict the APC and vindicates us, says the PDP. But we'll get to find out what that is on plus politics. I am Mary Anna Cohen. In less than 10 days after the United States withdrew its forces from Afghanistan, the country fell into the hands of the Taliban. The country had been ruled by the Taliban from 1996 to 2001, when the United States and Allied forces invaded Afghanistan, aiming to stop the Taliban from using Afghanistan as a base of operations for terrorist activities. So now putting in consideration the security issues, Nigeria and other African countries such as Kenya, Mali are facing. Could this international incident, what would it mean for Africa? Well, joining us to discuss this is Al-Gogor-Obo. He's a foreign affairs expert. Farai Mubuti is a senior analyst at the Southern African Times. And we have joining us from the United States, Justin Higgins, a former U.S. policy advisor. Thank you very much, gentlemen, for joining us. Thank you for having me. Great. I'm going to start with you, Justin, because obviously many have been asking questions as to if it was very timely or if it was not the right time for the U.S. to pull out its forces from Afghanistan, looking at what's happened over the past couple of days. So, and I know I remember in 2009, if I'm not mistaken, when the president now used to be vice president, he somewhat did not agree with sending more people, more soldiers to Afghanistan at the time. So the question is, could that have been the reason why he pulled out now? Well, President Biden for at least a decade has been against the continued operations going on in Afghanistan. So for at least the last 10 years, he has been pretty consistent, like you mentioned. But here in the U.S., just to give everybody a feel of the strong criticism that the president is facing from both parties, from Republicans and Democrats, it's not so much that Afghanistan fell to the Taliban. It's the fact that we have a 10 to 15,000 U.S. citizens stuck in Afghanistan right now. And in addition to that, anywhere from 80 to over 100,000 Afghan translators, contractors, and people that we promised to get out and into safety after we evacuated. So it's not so much that the country fell to the Taliban, which is a point of criticism, but it's the fact that President Biden had seven months to get these people out of Afghanistan and into safety, and he was not able to do so. It's interesting. Now, we also obviously have a humanitarian issue with Afghanistan because we're seeing more and more people trying to get out of Afghanistan. And most of them obviously will become a problem to the countries that border around them. But let's talk about the politics of it. Can people, is it right for people to blame the U.S. for pulling out at this time and the fact that the Taliban's have taken over? Again, where will all of these people go knowing that the world as it is is facing the biggest pandemic it has ever faced, ever? I mean, is this not going to be a problem for countries that have to take these refugees in? Well, we spent two decades and hundreds of billions of dollars on a mission that originally was focused on eliminating al-Qaida and terrorism in the country, and it became very apparent many experts think over a decade ago that there was not going to be the ability for the U.S. and coalition forces to create a stable Afghanistan. So from a domestic perspective, from the way that many people in the U.S. are looking at this, a recent poll showed 66% of Americans did not think the war was justified. So politically speaking, there's a strong consensus that Joe Biden was right to pull out the troops from Afghanistan that whether we stayed for another year or five years, it wouldn't have made a difference in the stability of the government and that at the end of the day, we had been there for way too long and it was time to bring our daughters and sons home. All right, I'll come back to you because there's a lot more to talk about in terms of the policies going forward. But let me come to you for right. For Africa, there seems to be a lot of talk going on behind the scenes. I know that Uganda is to take in about 2,000 of these African refugees and this is because they're doing it at the request of the U.S. But for African countries, aside from Uganda who are facing terrorism, Mozambique is the latest on that list and I think a few days ago, there was another hit by Jihadists and if I'm not mistaken, another African country, I can't remember. What does this mean for Africa because we're seeing Uganda taking in refugees but for those fighting insurgency, what does this Afghanistan situation spell for African countries? Thank you for having me. I think with Africa, we have a different context altogether. If you look at, for example, Mozambique or even the current challenges of insurgency that you're facing in Nigeria, these are very particular circumstances that are very unique and intrinsically different to what Afghanistan would have in the case of Afghanistan, for instance. The Taliban is a home-grown group that is not external from the cultural realities of that disability country as the recent president or rather, I'll use the example of the head of the Mediterranean UK who described them as homeboys or cowboys who are basically locals within their own terrain who struggle, most of the people would read it as a fundamentally local struggle. In instances of insurgency, these are implanted projects that may be an extension, collaborating though with locals but inherently a state structure still exists and there is no external intervention which was, of course, the case of Afghanistan. What Africa may be looking at, however, is how it plays a role in that particular instance. So Uganda, as you've stated, will be looking into taking in about 2000 of those refugees to create, to support the outcome and the process of ensuring that humanitarian aspect of the Afghans who are actually traveling out can be met as part of their global contribution which demonstrates that Africa is a part of the global conversation through a course around it and there might be more of that. But in a political sense, there is a deeper argument that is currently prevailing about democracy itself, the notion that liberal democracy in its fixture or understanding or by virtue of its ideology can be transplanted. This is the new conversation that you're finding. So it's boosting the argument that perhaps countries like Uganda are making whose democracies speak to their own realities and their own cultural and historical record. The president of Nigeria, President Mohammad Buhari, I think he put out a report on the financial times and he talked about the fact that Africa needs to look within to be able to deal with its issues of terrorism. But he also said that Africa seems to be the new front line for global militancy saying that Afghanistan's uprising came as an unexpected momentum. Now he fears that if Africa does not begin to look for African ways to deal with this issue, we might be facing an Afghanistan situation just like what we're seeing playing out today. But how true is it? And looking at African countries because I'm gonna ask my next guest the same question. Are African countries finding African ways to deal with the issue of terrorism? Or do we still keep going cap in hand to the US or for those who are Francophone countries go to the French for support? And how well has that worked out? Well, I think there is truth in what the president is saying. However, I think it will be largely exaggerated to suggest that we would face an Afghanistan scenario because these are completely different circumstances as I said before. However, the non-collaborative approach to dealing with terrorism in certain instances or in certain circumstances can influence a growth aspect. So to that degree, to the extent of that argument, yes, I do agree. But we are seeing quite a number of collaborations. Sadik, for example, the Southern African Development Region has collaborated with Mozambique. We haven't seen the extended help of Rwanda. In Nigeria's case, there is a regional approach to looking at it. Of course, in terms of which on the ground that has not become the reality. But this is purely down to the fact that it has not been into Nigeria, Nigeria has tended to be able to have to do this on or rather sit on regional bodies that has been able to handle this on security concerns. So I think in as much as I do understand this argument, I think E2S head of state can push that through regional bodies and equally continental bodies. There is a thirst to make that happen. And do they have the power to do so? I think Nigeria in the largest economy in the continent has a lot of sway in what happens in the EU. So it can be empowered through its own role as well. Just joined us. Let me take this question to Agogot. Agogot, it's very interesting that our president is the one who's expressing the most fear as a result of what he's seen play out in Afghanistan. And when the president says this, it seems more like he's preaching to the choir because really, have we really had a Nigerian approach to dealing with the terrorism that we're facing in the country today? Looking at the fact that we have a hydro-headed sort of terrorist activity going on in the country under different nomenclatures. Is the president really expressing fear for Nigeria or just expressing a general fear for Africa, noting what's happening in the Sahel? Agogot, I don't think we can hear you. Maybe you'll have to lose the headphone. Works. Great, we can hear you now. Yes, we can hear you now. All right. All right, so I think that he speaks for the generality of West Africans, who unfortunately have bought the brunt of Boko Haram since 2009 and then a swap, which has taken over from Boko Haram recently also too. And then you have the farmer-headers crisis, the unknown gunmen who have now become what we call the Fulani Headsmen in this part of the world. So when he speaks this way, he's talking about a problem which has been with us for over 11 years and has led to the loss of lives in several tens of thousands and the millions of people who are displaced. And you make a great point in the way people have analyzed the government's approach in resolving first the Boko Haram terror incidents and what is going on with the farmers and then the headers crisis, which has now become number one compared to Boko Haram where you've seen in recent days, numbers of people who surrendered and no longer willing to fight or take up arms against the government. The question you probably will ask is what's happening with the states? Most of the Northwestern states where you have and the crisis happened, the abduction, the kidnappings, the killings. They are states that have the biggest developmental problems and indices. If you trace back, you'll find out that many of those problems that heralded the Boko Haram crisis are some of the problems you're seeing being faced by many states in the Northwest and the North Central. So the governors are asking for soldiers, they're asking for weapons, they're asking for everything, but the development which has thrown their states into crisis, they don't have enough food, they don't have water, they don't have housing, they have a large number of children who are out of school. So on the one hand, there's the military option in which a number of the governors have assumed to be the approach in resolving the crisis, but the other approaches which is getting those developmental indicators up to the point where we can then argue that because you have less children who are out of school or who have access to healthcare or have access to employment, then you're ready to fight this, or otherwise you'd just be blowing in the wind. Again, my question, just to go push you further, the Katzenes state governor, the governor of the state where our president is from recently asked that the people in the state resort to self-help, which again makes me look up Mr. President's message on the financial times and wonder really if the president is talking about us here, because he lives here, he lives in this country, he sees everything that's been happening. Have we done all that needs to be done by the book for us to begin to decide if we can resort to self-help? And when governors begin to speak from different sides of their mouth and the military is also on the other side, trying to see what they can do as per damage control, does this not make it look like we're in some form of a chaos or a chaotic situation? This is the case of the off-street highway, it's heard in the desert and it's ramp outside. If you ask all of those states, there's no state in Nigeria that gets security votes less than 200 million Naira. No state gets security vote every month, less than 200 million Naira. The richer states get about 800, 900 million Naira. There is no plan by any of those governors saying that those monies which have been put for their security, which interestingly, if you put those monies into education, you put those monies into healthcare on a monthly basis, you probably will be dealing with the problem squarely. The president doesn't allude to a hidden factor, which is public knowledge. In Nigeria, the states that have the highest population growth rate are located where you have the bandit tree and the terrorism going on in the Northwest, in Katina. They've got one of the highest bet rates.  According to the government's data warehouse. So what did the governors asking people to take off arms to fight against what the minister of defense, I think it was Margaret, she also a couple of months ago, it also asked them to take off arms. People who carry life weapons, RPGs and GPMGs ask the life weapons. What do you expect local vigilante to do? They have no way in going against these people and accepting the shot of simply being annihilated. So, politically, many people have said, but in the real sense of it, there's a lot more that still needs to be done. He's asking for investment. But the question is, if you're asking for investment in these places, what have the states done to show some transparency in how those states are run? Plartus, which is not central, I had the governor through his commission of information at this point, he said, people accused the governor of sleeping. But he said the local council officials have able sleeping and snoring far more than the executive. But the question you should ask, people have asked that they ask all of the state governors, is what have they done to free up the local space? There is no state in Nigeria where you don't have the governors superimposing and taking control over what happens at local government areas. So, on the one hand, there is no government at the local government level because the state governors, like emperors are sitting on and breathing on their necks. It looks like a very, very tough situation. Let me go back to Justin. Justin, it's very easy for Nigerians to quickly go to, or say to the US, we need you to help us at every point, whether it's with the Ansars, whether it's with terrorism and any other thing, we always go to the US or the UK to help us in this fight. Now, what's happened in Afghanistan? Can we say that maybe the US was tired of fighting or that the US saw that this war could not be won? And then now that we in Africa are looking also to the West for help, should we, Justin, in that hope that the West can help us to fight terrorism? And like my president said, begin to look inwards? Well, I'm to agree with what Farai said, or at least I thought he said, which is Afghanistan is a completely, completely different story and set of facts and circumstances than the terrorism in Nigeria and really Western or US involvement in a lot of different African nations. That's because of a simple fact. In Afghanistan, it wasn't that we were tired of fighting. It was that the United States mission was twofold. It was one, to fight terrorism, and two, it eventually became, after a decade or so, to build a government. We got tired of the fact that the second part was never going to happen. In Nigeria, we're not assisting Nigeria by building a government. We are simply assisting Nigeria with fighting terrorism. So it's a completely different story. And then the other thing I'll say here is this, if there's any lesson to be taken from any government in Africa, the Nigerian government, any of them, it is that cutting down on corruption and increasing on transparency is the best way to get full and robust support from the United States. We all know, I mean, you and I had this conversation a few weeks ago, if not months, maybe last month when we talked about the fact that the US Congress or the Senate had put a pause on the sales of some FISA jets to Nigeria because of humanitarian issues. Now, we're in the middle of an unconventional war and we're also having to deal with the fear of the fact that these terrorists continue to come down to this part of the continent and then the gun running around the Sahel. It's a big deal. How do we fight insurgency? How do we deal with terrorism when we do not have what we need to fight it? Yes, we know that humanitarian issues are dangling over our heads. But what do we do? Which do we choose over which? Well, I think you can choose both, right? If you have strong diplomats and a president who actually wants to get these tools to help fight and defeat the terrorists, then you sit down at the table with the United States negotiators and you come up with a path forward. This is just a temporary hold, as I mentioned earlier, by a few different senators. So if there is a plan put in place that the US Senate, that the US State Department feels confident about, and what does that mean? A plan in place that the US diplomats and the US legislators can feel confident that these weapons will not be used like weapons were used in the Ansar's protests to gun down innocent protesters and commit atrocities, then it's very likely that these weapons, the hold will be removed and that they will be sold to the Nigerian government to defeat terrorism. There just has to be some simple steps made by the government to show that they are willing partners. What lessons should Africa be learning from this Afghanistan issue, especially with the situation in Mozambique today, and of course Kenya is also dealing with the issue of al-Shabaab, and I mean the list is endless. If we start calling the names of the countries that are dealing actively with insurgents and these icewaps, now they call them icewaps, some of them are called ISIS. What should Africa be learning now? Just as my president said, should we look for Mozambican ways to deal with Mozambique's problems? Can we look for other ways in Kenya to deal with Kenya's insurgency? What exactly should we be doing for I? Well, thank you. I think the solutions are to be homegrown. We have to look at it from a two-point position. We have to deal with the economic realities that create the conditions from which some of these groups can dangle the support. So dealing with the economic, of course, is critically important. So strengthening institutions to ensure that we can widen the distribution of wealth. But secondly, the security, of course, has a major role to play in this. And there needs to be a coordinated approach to looking at how security is dealt with. So Mozambique, for example, is quite a good way to look at it. They've been able to slowly deal with the insurgency because of a joint coalition of militaries that are African-based. And you do have, of course, the involvement of the United States and the Portuguese, but only in a training capacity and equally supporting financial support to the Mozambique government. But that support has to be purely on that basis. But the boots on the ground, the hard work has to be done by African-based. And so far, we have military such as Zimbabwe. That have quite extensive experience within the Mozambique trade. You have Angola now currently going in. You have South Africa, launched into the deep of Mozambique. African solutions are our best because they normally have the experience to deal with that. And they understand the local realities by virtue of culture, but they equally speak the language, okay? So the community language as well. So all these things matter. So a home-grown-based solution is the best way forward. I, Geoffrey, for example, within the Western region, there is a strong coalition that can be created equally through the aid of the AU. But these things have to be looked at. So in one vein, I do agree with the president, when he argues for home-grown solutions. I differ when he uses Afghanistan as a critical example of that reality, purely on the basis of the differences of history, culture and context. All right, I'm gonna wrap up with you. Going forward, because I mean, everybody seems to be sounding the same. We need to deal with corruption, Justin says. Farai says, let's have home-grown security and fight against the terrorists. But in Nigeria, like you have said, we have issues of corruption, and now we have humanitarian issues dangling over our head. And we have so many needs that have to be met, the welfare of the soldiers who are at the forefront, the fact that we are welcoming so-called repentant, broken-around members. And we have rehabilitated such before, and some of these people returned back as informants to the Boko Haram people. So again, really, that saying of once bitten twice shy, shouldn't it apply here? And when we talk about debriefing these guys and actually finding out why they returned, shouldn't due diligence be done so that we avoid having the same problem crop up over and over again in closing? You know, at the height of the Boko Haram crisis, when former president, good luck, Jonathan, was leaving, there was a rough estimate about how many Boko Haram train fighters they had. There was about 6,000. But if you calculate the numbers of Boko Haram terrorists that have been killed with the number of press statements you get from the military on a weekly basis, it's like since that. So the question you're probably asking is where are those numbers coming from? So it's the same deployable situation that the local governments and the states over the years still existed to do. One of the reasons why you're having a large number of Boko Haram, I don't like to use the word repentant because each one is so in an ideology. It's a matter of conjecture how repentant you can really see that that person is either he's dead on the side of a terrorist and alive on the side of those who are not terrorists. And at the end of the day, they still got a cross on his back. So those conditions that made it fatal for them to join Boko Haram or Eastwap, are those conditions still existing today? The answer is yes. You don't have schools, you don't have hospitals in those places, you don't have the employment unit, a lot of investment in all of these places to get them on board. Many of those fighters, you also will have to do a reconciliation of some sort. And reconciliation comes with social justice. How many of them are committed crime that are against humanity, war crimes and those sort of crimes that should be punished for what they've done? That way, the people in those communities will be willing to accept them back because already there's a lot of anger towards these people and they don't want them back again. So those are things I think people are talking about and want that to happen as quickly as possible. So you don't have what happened in the Northeast, repeat itself in the Northwest, where you have a large number of people who aren't going to school. So those are things that we expect to see going forward. All right. Well, I want to say thank you. Justin Higgins is former US policy advisor for Raimavuti, the senior analyst, Southern African, the Southern African Times, Anna Gogo-Obo is a foreign affairs expert. Thank you gentlemen for a very interesting conversation. I appreciate it. Thank you, Marianne. All right. Thank you all. Well, thank you for staying with us. We'll take a short break. And when we return, the People's Democratic Party tells us it's thoughts about the statements of the former Central Bank of Nigeria governor, Sanity. Stay with us.