Hi, I'm Tom Greenaway, and I'm the games lead for the web developer relations team here at Google. Now, I know what you might be thinking. Web games, is that really a thing? Isn't Flash a little bit passe? And compared to native mobile games on Android and iPhone, can the web really even compete? Well, in this lightning talk, I will quickly highlight some of the opportunities, but also the challenges that the web offers to game developers. I'll touch on topics such as why raw performance isn't the most important thing in a game, what the major strengths and the weaknesses of the web are, and lastly, a few examples of game design patterns you can use to leverage when designing for the web. So firstly, the raw performance of the device or the games built for it, that's what decides the most successful games and platforms, right? Well, not really. In the history of game development, usually it's the platforms and the games that deliver some kind of mixture of innovation, ease of access, and last but not least, fun. In fact, I would say fun is the most important factor in games, much more important than the graphical fidelity. But let's dive into these three properties a little bit more in depth with some examples. So innovation, think about when the first motion controlled games took off. The best-selling console out of the PlayStation 3, the Xbox 360, and the Nintendo Wii, it was the latter, the console with the weakest performance but the most hardware innovation. And ease of access. Well, this can mean many things, whether games are easy to buy and download, or whether a device is portable and always with you. This is one of the reasons why mobile gaming has boomed over the last decade. The Google Play Store and the Apple App Store have made it ridiculously easy to download a game to your device. And these games are right there in your pocket, always ready to play. And lastly, what about fun? Some of the most successful mobile games of all time were not pushing the graphical limits of their devices. They focused on being fun. Think of the early mobile hits like Fruit Ninja or Angry Birds. In other words, if you play to the strengths of your platform and make fun your priority, there are often compelling game designs waiting to be discovered. So what are the strengths of your platform? What are the strengths of the web? Well, firstly, it's the most open and biggest platform that's ever been created. Nearly every device in the world has a web browser. And there are no limits on how you can monetize. Microchains actions, subscriptions, paywalls, or ads. There are no rules on the web, right? And the web is instantaneous and almost frictionless. With just a tap, a user can jump into your content via a link they find anywhere, whether that's on the web or inside of an app. But like the hero of any great story, these strengths are also the web's greatest weaknesses. It runs on almost all devices. So to take full advantage of that, you must design your game to be responsive and to be aware of different devices, screen resolutions, and potentially develop for the lowest common denominator. For example, Mobile Safari only supports WebGL 1.0. And what about payments? Well, the Google Play Store and the Apple App Store ushered in a new era of simple and trusted payment processing when in-app purchases were created. And sadly, the web doesn't have built-in payment methods like this, which means that there's a higher friction when users are being asked to pay. However, there are a lot of web platforms and APIs which help alleviate this problem, such as Google Pay, Stripe, PayPal, and even browser APIs like web payments. And lastly, the instantaniousness of the web that I mentioned? Yes, it's great that a user can load your content instantly, but to make that really work, you need to fine-tune your content to load as fast as possible. And the weakness is that just as easily as a user opened your web page, they can close it as well. The ephemerality of the web is both powerful and yet fragile at the same time. But if you play your cards right, you can make a game successful on the web by leaning on these strengths and mitigating these weaknesses. So what's the most unique feature of the web that we can hone in on with our game design? It's the link. The beauty of the web browser is that just as easily as you were linked to a piece of content, you as a user know that you can now share that link to someone else. And so that cycle of being linked and then linking others to content, that's the power of the web really. It's viral. It's the modern day word of mouth marketing machine. So how can you work the link itself into your game design? The key is that we want to drive virality. We want to give the user a reason to share the game and for the link that they share to be meaningful, not just to them, but to others as well. So what interesting information can be shared in a link? Well, here are three categories you can experiment with. Competition, collaboration, and exploration. But what would the URLs of these games really look like? Well, I could create a puzzle in a game, and then I could share a URL, and that URL could be a playable link to that particular puzzle. Or I could finish a level, and I could share the URL. And what I share could be a player ghost of me completing that level for others to compete against. And lastly, I could be playing a roguelike game discovering new areas of the world. And I could find a secret room. And then if I share the URL, that could teleport a friend into that same room that I've discovered. Now, for example, here is a game called Shellrock I.O. Where players compete in a Quake-style arena shooter. If the player shares their current URL, their friends can deep link into that exact room the player is in and compete against them. Also, here's a little game I made called Space Board. Built using the Slick Game Development Tool construct, which, by the way, not only produces HTML5 games for the web, but is on to itself an entirely web-based development environment. So I designed this game to demonstrate how URLs can be used to transmit data for the purposes of game design. And inside of it is a level editor I built into the game. When you play the game, you can send a link. And the link contains the entire level's design that you've created. Here on the left is the game itself being played. Try it out. The game can be played on desktop or on mobile. And why am I showing a QR code as well? Well, because QR codes can be a marketing tool for promoting content in the physical world. If you access that URL in the QR code, it will take you to another level I made. But this one's a little bit more intense. Now, you can imagine that Space Board could also generate QR codes of levels that could be shared with a friend in person as well. So in summary, if you're curious about the web's potential for game developers, think about how you can play to the strengths of the platform. Support as many devices as possible. Think outside the box when building your monetization model.  But most importantly, make your game fun, design it to be viral, to leverage the URL so users have a reason to share it and spread the word about your game. Thanks and see you next time.


You see this map here that I want to talk about because on my dad's side, we come mostly from the Papascheskri and I would say that most of my life have kind of had a preoccupation with identity, belonging, place, those kinds of things and it comes from the displacement of the Papascheskri that occurred in the 1880s. So this map comes from about 1880 in Edmonton, that's what it represents. My ancestors, the Papascheskri, were indigenous to this area here. They considered this area here right around Edmonton, their traditional territory. In 1876, when Treaty 6 was signed, they weren't there at Fort Pitt. They were busy doing something else, so the story goes right. But the next year, so they heard about Treaty 6 over the winter and the next year they came to Fort Edmonton, which is where the legislative buildings are today. And they went up to the gates and basically said, we want to be part of that treaty that was signed last year. All our relatives are on there, sign us up basically, right? The way it worked back then is that basically the government official said, go ahead and choose an area where you want to live, and there weren't really a lot of restrictions. And the reserve size was given according to the size of the band. So the Papaschesk band at that time was 241 people. Now from what I know, this area right here on this side of the river was actually where they preferred to live. But they were given advice to move further south back. So actually the reserve that was surveyed that people lived on started about Argyle Road and went south to about our Ellersley Road, went from 50th Street to about 122nd Street. Does that track a land there? Well, as you can imagine, Edmonton was just starting to grow outside the fort by then, and so there was a lot of lobbying that went on, right? We don't want that reserve there. It's going to be in the way of the growth of the city, which is probably true, right? It would have been. So what happened over a few years is that the land was expropriated and the Papaschesk were dispersed. And the band, basically, kind of fell apart. It was dismembered. A lot of people kind of went wherever they could, right?  That's where my dad was raised by his grandma. One of the things that I guess really keeps me awake at night is trying to figure out how it is that all of this could have happened and yet no one knows anything about it. No one talks about it, actually. We have a Papaschesk room in this facility here, but I've done kind of an informal survey and no one really knows what that name is about, where it comes from. So how is it that this happened? What are the processes that went on that enabled this sort of massive forgetting and all the things that go with it? And here, we're here at the university, it's on its hundredth anniversary, right? And it was only 32 years after the signing of Treaty 6, the negotiation of Treaty 6, that this university was created. But we know that there isn't much memory of that here.


Hey, you got a few minutes to help me carry some stuff out with a vehicle? Hey, yeah, no problem. My phone's about to die though. Let me get it plugged in. And I just received this really cool email with an attachment on it. I'm gonna download it to my government computer. Should be okay, right? That's not what right looks like. Hey, you got a few minutes to help me carry some stuff out to the car? Yeah, sure, sure. Just a minute. But I just got this suspicious email. They want me to download to my government computer and my phone's about to die. So I'm gonna plug it in the car and we'll go carry supplies in. That's what right looks like.


This paper assesses the latest version of the Modi's LAI-slash-FPR product, collection 6 or C6, and compares it to other existing global LAI-slash-FPR products. It finds that the C6 product is more accurate than its predecessor, C5, with reduced root mean square error, RMSE, values ranging from 0.66 to 0.80. Additionally, the C6 product performs better than the other global LAI-slash-FPR products tested, such as Glass, Cyclopes, and GOV1. Furthermore, the C6 product shows strong agreement with other global LAI-slash-FPR products, indicating that it can be used to accurately measure LAI and FPR. Finally, the C6 product is able to capture seasonal variation in biomes, except for evergreen broadleaf forests, where cloud contamination causes unrealistic variations. Overall, the C6 product provides reliable biophysical information on the land's surface when diagnosing climate-driven vegetation responses. This article was authored by Kai-Yen, Teijin Park, Guangjin Yan, and others. We are article.tv, links in the description below.


It's time for the Laun Jean Chronoscope, a television journal of the important dishes of the hour, a presentation of the Laun Jean Wittner Watch Company, maker of Laun Jean, the world's most honored watch, and Wittner, distinguished companion to the world-honored Laun Jean. Good evening. This is Frank Knight. May I introduce Mr. William Bradford Huey, noted author and analyst, and editor-in-chief of the Laun Jean Chronoscope, and Mr. Hardy Burke, noted author and correspondent. Our distinguished guest for this evening is Dr. Ari E. L. Kuboby, former Israeli minister to Czechoslovakia and Poland. Dr. Kuboby, our viewers tonight are very much interested, sir, in what's going on in the Russian satellite countries as regards the Jews, and you, with your long experience to satellite nations, in satellite nations, are peculiarly well qualified to give us that information. You were ambassador to Czechoslovakia, and I believe after you had left there, the Russian government, in effect, asked the Israeli government not to send you back. Now, sir, specifically, when did you leave Czechoslovakia? I left Czechoslovakia November the 28th, the day after the end of the Slansky trial. That's just two months ago. Answer, how long had you been there before you left? Well, I first want to state that I was minister to Czechoslovakia and Poland, and I spent there 17 months. And so you were there 17 months? You were there during the Prague trials? That's right. You observed the rise of anti-Semitism, and now you have been away from Czechoslovakia just two months. That's right. Doctor, is there a pronounced rise of anti-Semitism as you saw it there? Well, there is no doubt that the Slansky trial was an expression of anti-Semitism. I see, sir. Now, can you tell us something, sir, as to the extent of anti-Semitism in Czechoslovakia? Specifically, are the Jews living, are they afraid the Jews who are now in Czechoslovakia? Do they live in terror? I would say that since the arrest of Slansky and the purge of Jewish officials, which was followed by an oustel of a number of Jews from their economic positions, the Jews have the definite impression that this is a regime directed against them. That's Jews as Jews, not Jews as political figures. Not at all, at all. Is there any difference between what's going on in Poland and Czechoslovakia? The Polish regime has shown more scalability as far as its composition is concerned than the Czechoslovak regime. I mean, as far as his ruling class is concerned. But there has remained in Poland among the Polish population a very deep-seated anti-Semitism. And those Jews who remained in Poland remained because they could not emigrate in time to Israel a feel that they are in a very dangerous situation. Doctor, why do if there is this anti-Semitic feeling there in Poland, why do they want to keep the Jewish people in Poland? Why don't they let them leave if they don't like them? I mean, if that's the idea.  And they permitted the emigration of Jews for a certain period immediately following the war while there was still a feeling of guilt, still the feeling that the Jews, after what had happened during the war, the terrible extermination during the war were entitled to rebuild their lives in a home of their own. Well, Doctor, do you see any comparison between the Hitler's persecution of the Jews and what Stalin is doing today? Is there any comparison there? I would say that anti-Semitism is always a mean, an instrument for certain bigger purposes. And in disrespect, I would say there is some identity between all kinds of anti-Semitism. Some similarity. And the Jews are being made a scapegoat again. Made a scapegoat. I see. Well, the important thing that you've said now, sir, is that you are not, as an observer of this situation, you make a difference between what's going on in various satellite nations. You don't apply a general statement to what's going on there, sir. Is that correct? I would say that the recent developments make us very anxious because if one could build the opinion that the Prague trial was destined for Czechoslovak purposes in order to find the scapegoat for the economic difficulties of Czechoslovakia, to give the people an explanation why from the very high standard of living they have known after war their standard of living now is so low. After what we have seen in Eastern Germany and after the indictment of the physicians in Moscow, we have every reason to be very anxious and to see there the symptom of a general development. Pursuing this question a little further, that Mr. Hewitt raised, doctor. You mentioned a difference of degree in the treatment of the Jewish people in Czechoslovakia and in Poland. Now, to your knowledge, is that difference also a difference of degree in the Soviet Union itself, I mean within Russia itself? Or would you have any knowledge of that, that difference of degree? Again, I would not like to speak of the past because the fate of the Jews in the Soviet Union has passed through a great number of phases. What I would like to state is that we are witnesses now of a very, very disturbing development. I see. Well, sir, now can you explain to our viewers why this is happening, your understanding of Soviet techniques. Is this number one, is it aimed, we've heard that it's a tactic for the Middle East, that it is a tactic by which the Soviet Union hopes to attract support among the Arabs. Would you say that that's one of the reasons why this is being done? Well, I would like to distinguish between various reasons. And I would like you to understand that a trial, like the Prague trial, is not destined to administer justice. It has a great number of purposes. It's a tactic. It's a tactic. It's a method. It's a method to achieve political purposes. It's also a method to indoctrinate the masses as well as the leaders. Now, let us take a few purposes. The Prague trial, for instance, was one of the purposes of the Prague trial was to convince the Czechoslovak people that their present leaders are real Czechs and real Slovaks, they are real Patriots. Now, this is a general line which we will develop in all the satellite countries, because it's very important to convince the population that their governments are real national governments. Of course, there are wider implications, there are more general purposes. And I would say, as far as the Soviet Union is concerned, that there is no doubt that this method is destined to win the friendship of those who are, or maybe the enemies of Israel and of the Jewish people. In view of all of this, Dr. Why is it that the government of Israel realizing that there is this great wave of anti-Jewish propaganda and cinema that's been set up behind there? And why do they continue to recognize the Soviet Union? Well, I do not see any purpose in withdrawing our representations from the various countries. Israel is not the only country which has been the object of very violent attacks. And if I may say, I have seen the treatment, for instance, of American diplomats. And I am sure I have considered it an act of courage on the part of the American diplomats to maintain their contacts and their connections in order to serve a higher purpose. Well now, sir, our viewers will be particularly interested in what Israel as a state expects to do about this latest development. Now, sir, do you think that it will be Israeli policy to try to bring as many of these people to Israel as possible? There is no doubt that this will be our policy. If the Soviet Union and if the satellite countries could assert in the past that their Jews didn't want to emigrate, that after all, they were citizens with full rights. And now that the Jews are under such attacks, I think that we are entitled to tell them, let our people go. We are willing to accept these cosmopolitans. We are willing to accept this so-called science. This means that certainly many, many more Jews, if you are successful in this, many, many more Jews will be brought into Israel itself. Yes, this is our intention. This is our determination. Well, sir, that comes down to money and that there have been several efforts to sell Israeli bonds in the United States. Now, are you and the United States in connection with the bond drive? I am in connection with this drive because we have to strengthen Israel economically in order to permit it to absorb the many immigrants which we want to bring to Israel. And that can only be done with outside economic aid. Only, or let us say, mainly. Well, I'm sure that our viewers have appreciated these expressions of yours, sir, and thank you for being with us. The opinions that you've heard our speakers express tonight have been entirely their own. The editorial board for this edition of the Launcine Chronoscope was Mr. William Bradford Huey and Mr. Hardy Burt. Our distinguished guest was Dr. Ari El Kubobi, former Israeli minister to Czechoslovakia and Poland. Launcine is a superior watch in every respect. In fact, one of the finest watches made anywhere in the world, and yet Launcine is in a class by itself. Launcine is the world's most honored watch. Thus, amongst the finest of the world's watches, Launcine watches alone have won 10 World's Fair Grand Prizes and 28 Gold Medals at World's Fair's and International Expositions. And in the competitive accuracy trials organized by great government observatories, the brilliant record of Launcine over the years is a surpassing achievement. The world's most honored watch, Launcine, makes the world's most honored gift for an anniversary, a birthday, or as a sincere token of affection on any important occasion. The pride with which every Launcine owner regards his watch is something we've all observed. Launcine, the world's most honored watch, the world's most honored gift, premier product of the Launcine Witner Watch Company, since 1866, maker of watches of the highest character. We invite you to join us and for the Launcine Chronoscope, a television journal of the important issues of the hour, broadcast on behalf of Launcine, the world's most honored watch, and Witner Distinguished Companion to the World Honored Launcine. This is Frank Knight, reminding you that Launcine and Witner Watches are sold and serviced from coast to coast by more than 4,000 leading jewelers who proudly display this emblem. Agency for Launcine Witner Watches. History repeated, and you are there, Sundays on the CBS television network.


Welcome to Wild World News. What's happening, Magnus Sacks? What color is this dress? You say? So, I found this article on Yahoo News. Internet's going crazy about it. It says the simplest scientific explanation for why some people see the dress as white and gold. I have no idea why they would be seeing white and gold. Now, I'm color blind. Okay? Seriously, I am. And it looks like, I don't know, maybe it's black and something to me. I'm not really sure what that color is, but let's see what it says. Tumblr, what color is this dress? There's actually a pretty simple explanation behind the dress that sparked an all-out Internet war and divided everyone between team white and team gold and team blue and black, which is what I'm seeing. I'm team blue and black. Well, black and blue. Because that's how I leave you motherfucker. Anyway, this picture of the dress originally posted to Tumblr after a group of people couldn't agree what color it was, completely freaked out and invited the Internet to help solve the mystery. Mitchell Moffitt and Gregory Brown helped explain the confusion in their latest ASAP science video released on Friday. Moffitt and Brown both saw black and blue. And they noticed at the dress and figured, they looked at the dress and figured, sorry, y'all, I really did just wake up, so I apologize. So I got to make video when I get up and figured this was some kind of ridiculous Internet hoax. For the record, the dress is definitely black and blue, but it appears white and gold to some people due to a phenomenon called color constancy. And the way that our brains interpret colors. Moffitt and Brown do a great job of explaining the phenomenon using a blue cube. God damn, what am I doing? A color cube. The two middle squares on this color cube appear to be different colors. Yes, they do. The top one looks brown and the bottom one looks more like orange. Yeah. But in reality, they're actually the same color. Aha, okay. No, this is not a photography trick. It all depends on the context in which you see the color. Our brain sees the shadowy part of the cube and registers that shadows make things darker. So to compensate, our brain interprets the square as being lighter until the shadow is removed. They did something like this on brain games before. The same thing is going on with this dress. There's not much color context in the photo itself because it's so zoomed in. So what color you see depends on individual perception and the environment in which you're looking at the photo. People who see white and gold may be looking at the dress in a blue lit room or near a window with a blue sky. It also depends on our own individual sensitivity to the bluish tinting in the photo. The brains of people who see white and gold are interpreting the photo as more shadowy. The brain compensates for the darker blue tinting and interprets the blue part as white and the black part is gold. People who see the correct black and blue might be looking at the dress somewhere with artificial yellow lights. I'm definitely doing that. Or the brain is interpreting the photo as more illuminated. It's an illuminati dress and it's a trick to deceive the song. And therefore it doesn't need to compensate for the shadows. Here's the original photo of the dress taken alongside some other photos. Okay, with helpful color context. It definitely is blue and black. That's cool. Alright y'all. So, tell me. What galel did you see, Magnesites? Let me know. Hit the like button. And don't forget to subscribe. Woo!


Now, I want to announce the talk of Junde LeGray. He talks about reverse engineering a Qualcomm baseband and the question and answer session is at the end of the talk. So please give a wonderful applause to Guillaume. Hello everyone. So yeah, the topic of this talk is about reverse engineering basebands and especially in this case Qualcomm models So Well, just a few little intro about baseband, the baseband world. Well, for people who don't know what baseband is Well, the baseband processor is So it's a main chipset of your phone responsible for handling telecommunications and Everything over the year, it's interface to hardware and handles the protocol stacks for the telephony protocols So, well, most of the time, well, a lot of people have a smartphone which is capable of running a separate operating system like Windows Mobile, Android, iOS, etc But the baseband, the baseband operating system is most of the time Well, it's always hidden You don't directly interact with it. You don't have the hand on it So, well, the biggest suppliers of Qualcomm of the baseband chips or well, the leader I think is Qualcomm followed by Mediatek and Infinium Well, in fact, I just mentioned a few phones like HTC iPhone, but they are sharing the market across various models of phones So, well, this talk mainly results from an observation which in my opinion, the hacking phones it's something quite hard to reach for multiple reasons Not a lot of people are actually not like on PC, I mean interested in in France Because it's hard to reach. It's quite close industry The phone, I mean, the phone manufacturers don't disclose any specifications Every baseband model is proprietary So, on the system side, you see kind of a black box running like a purifying piece of code and link terrifying protocols Well, if you're just interested in the network side well, you go to the 3GPP.com website and then, well, it's very discouraging to say the least So, there's multiple reasons to look into basebands The main reason would be to understand how a phone really works because everybody is using phone nowadays and everybody has a baseband and, well, it would be kind of cool to know what's really running into your phone Another reason would be for vulnerability research Obviously, because the code base is very real like 20 years or much It's very big, the network protocols are very complicated so it has a good potential for finding vulnerabilities into it into them and also for sim unlocking, for example Well, so CGR has been prior works on baseband exploitation, for example So, one of them has been presented last year at 27C3 by Ralph Philippe Veinman who reported vulnerabilities in Infineon and Qualcomm basebands but there is no much detail actually on what is the environment the code environment of the baseband And in this context, I think exploitation is almost impossible Well, anyone who has done a little bit of exploitation knows that you need to know at least in which architecture you're running what is the operating system, the memory, where you can jump or not, etc. So, in this manner, there is a clear lack of literature about baseband Well, for example, last year there was this presentation about SMSOF where they took all funds, they deployed a nice fuzzing architecture with OpenBTS and they began to fuzz the funds just to see the result and as a matter of fact, well, almost all funds has crashed or break but there was no really exploitation behind this because people who were presenting this talk could not get the end on the system of the funds So, it's very interesting to know that you can find vulnerabilities in this manner but if you can't exploit them, you have to, at the very best, classify them as denial of service, whereas they may be exploitable and that's quite well So, about this talk, I will be presenting what I've done on a USB 3G stick which is a quite common 3G USB stick you can find on eBay or from your phone operator I will describe, so it's a Qualcomm baseband inside and I will describe the operating system running behind this and how it's possible to develop a debugger to do live debugging on the baseband which is quite necessary if you want to reverse the baseband and also find vulnerabilities So, well, maybe I'll need my stick, sorry So, yeah, so this is the stick actually In France, you can find this stick with France Telecom, orange, sorry which is the main operating phone operator in France I'm not sure this stick is actually working on American frequencies but they are closed models So, well, the name is an option stick It's an Icon 225 It's a 3G USB stick with a Qualcomm inside The Qualcomm model is MSM6280 You can find inside an ARM V5 processor and two proprietary DSPs for processing the audio signal and the modem data So, it's not the newest USB stick you find in, for example, on eBay or in a shop It's dating back to 2008 And, well, the kernel which is running inside it has quite evolved since this As far as I know and as I've seen now Rex is the name of the kernel in the baseband and now it's an hybrid kernel which is coupled with OKL4 which is a derivative, a proprietary derivative of the L4 PistaQ So, well, if you plug a new USB stick on your computer, what happens? Well, basically you have this emulated serial port of a USB which allows you to talk to the stick and passing 80 commands So, like, for example, 80 plus CPU equals 1234 to unlock the same And, well, the stick is only supposed to carry data, packet data over 3G In fact, it's only supposed to do this but the manufacturer has just taken the baseband of a full-blown phone and put it into a USB stick So, when you look inside it, it can also do circuit switch operations which means voice and such thing The only difference with a phone is that obviously you have no screen no speakers and no microphone and no GPS and such things Well, if you plug this USB stick in your computer you will see, in fact, three serial ports firing up The first one is used to pass 80 commands to the modem and also packet data if the serial port is multiplexed The second port is only used for packet data when the ports are not multiplexed And the third port, which is interesting, is a channel to a Qualcomm diagnostic task which is something which has been left by Qualcomm engineers to debug the baseband So, how to enable the diagnostic channel? It's very easy because, in fact, on this model it's directly accessible You can directly pass commands to the diagnostic mod And on some phones, I've seen you might need to send a strange AT command like AT or QCDMG to activate the diagnostic mod So, well, it's a serial port so you can pass data into it but there is protocol and the protocol is fairly simple It's not documented, obviously, because it's an engineering protocol from Qualcomm It has been partly reversed in the modem manager, if you look into the source There is a directory named libqcdm where you can find part of the protocol So you have begin and markers, one byte indicating what is the command and the variable parameters, like depending on the command, actually and a CRC So, there is a lot of commands in this diagnostic mod and actually some of them offers direct access to the baseband memory So, for example, the second command reads a byte in memory and the command 5 writes a byte in memory but there are like hundreds of commands So, from this, it's directly possible to byte by byte dump the bootloader at FFFF4.0 which is the entry point in ARM and you can also dump the whole system memory from 0 because it's loaded in memory There is also a second mod which is accessible from the diagnostic mod which is called the downloader mod It's a mod which is specifically designed to write a piece of code into memory and execute it When you enter this mod, you have only two commands available writes data and executes at address You can only write in an artcoded range of memory, which is quite small And, well, to get to this mod, you have to go through the command 58 of the diagnostic mod It's also enabled when the system crashes and on some HTC phones, like the HTC Desire Z, I think You have, when you boot your phone, you can hold volume up, volume down and power During a few seconds and booting, you'll see five vibrations If you plug the USB stick, the USB cable on the phone you'll see a serial port and this serial port offers the downloader mod So you can push data and execute in the baseband It's directly accessible, it's free But, in fact, you do not really need this since you've got unlimited written write access in memory with the diagnostic mod already But if you don't get this mod, you can try the downloader mod So, as I said, you can dump everything in RAM in the baseband So you've got some kind of a live memory snapshot of the memory, which is nice It's not actually a real memory snapshot because each time you call to read a single byte the task which is handling your request will have been scheduled by the operating system So the image you get might not be totally coherent but in practice it's fairly efficient And what is nice is that you can also do this by dumping, for example, a firmware upgrade and pass it into IDA Pro to look inside the system But with dumping the memory of the baseband you also get access to the BSS section, which is empty in a firmware upgrade obviously So you get access to the stacks, you have the backtrace of the stacks You have the heap, you have everything, any global variable in memory which is directly accessible with the write values into them So it's a lot of information actually, and it's very nice So the memory snapshot is 32 MB strong You can find the entry point by reversing the bootloader And it can be directly passed into IDA Pro And well, from this point you can also already see some system characteristics Like all tasks share the same address space You can quickly find where is the page table And see that the first, I think it's 12 MB of memory or marked as read-only Everything is running in ARM supervisor mode And it's presumably compiled with a real view which is the official ARM toolchain for compilation with no stack protection, and ARMv5 does not support the XN bytes which is the same as the NX bytes on the X86 So I'll talk about what I've seen from this operating system and especially the kernel from this memory dump So Qualcomm has developed its own proprietary real-time kernel which is called REX, standing for real-time executive The whole operating system, which means the kernel plus the network stacks and any process is named AMMSS And well, the system is made of approximately 70 tasks running concurrently in the baseband So you have multiple, each task has different purpose There are some tasks for handling the hardware like the USB, the UCM, the DSPs and so on And you've got also one task for each protocol stack at each layer So such as L1, L2 or AMM for WC, DMA and so on So if you want to, in fact it's a tiny kernel but the main, the biggest part of the operating system are the network stacks which are very, very massive But if you want to reverse some tasks randomly, for example, I want to reverse GSML1 You'll need to know what is the API exported by the kernel So you have a minimum understanding of what the code is doing So you need to, well, at least reverse the kernel API the C library also and some built-ins, some compiler built-ins like subfloat or 64 long arithmetic operations So, well, at first, how the system is booting So, well, you've got a primary bootloader which is stored in ROM which is immutable which will read from NAND 12-con secondary bootloader named QCSBL This SBL is supposed to load another SBL named OEM SBL which means the manufacturer of the phone can implement their own bootloader So such as, for example, on HCC phones you've got HBOOT which is the OEM SBL So you have a menu, a splash screen and so on And then it loads the AMSS operating system which is what is really running in the baseband in the end And between each of these transitions, you can have cryptographic signatures for each of the layers On this particular, on this specific model of USB stick you have no OEM SBL So QCSBL is directly loading AMSS And there is no secure boot at all So there is no signature You can reflash, actually, the stick and run your own baseband your own operating system, if you like You've got to write it But, well, for example, it could be possible to run a Smokam BB on this Well, so the RECS tasks So you've got, as I said, you've got a lot of tasks, like 70 I'm just talking here about the core tasks of the operating system Well, you've got the SIP task, which is the idle task, doing nothing DPC task is used, I explain later, what is APCs in the RECS world It's just dispatching APCs across tasks The main task is the first task loaded, the first task created It creates all the system tasks and then under the timer events There is also a task, which is used to verify that critical tasks in the system are still alive And, well, you've got data service tasks, gathering any information from each protocol layer and paces them through pipes to create sockets and so on You've got a task dedicated to code management, so to for secret switch processing and packet switch processing to implementing a TCP AP, for example So, the kernel, so it's a real-time kernel The scheduler, well, it's quite simple Well, you've got, actually, all tasks run in the same address space and in the same state, the same mode of armor, which is a supervisor So, you do not need some complex processing to do task switch You just save the context of the task on the stack and you change the stack pointer and you can by this process switch tasks very quickly There are also, well, there are a lot of fields, I just put in the main fields here Each task has a signal, a set of signals which can be fired or cleared A task can wait for some signals, well, it waits for signals and another task will send a signal for the task to resume and the tasks are also, of course, ordered by a priority So, well, as I said, the context switch is very easy The scheduler also supports critical sections So, the kernel also supports APC, DPC mechanisms I'm not taking this terminology from the Windows world It's really called like this in the strings of the kernel So, well, basically it works in the same way as Windows A nice and pronounced procedural code is just pushing a new context on the stack of a stack on the stack of a task and when the task is resuming because it was in a wait state, for example, it will execute the code and then resume to its original execution So, you've got a task which is dedicated to APCs, which is a DPC task with a high priority and it allows a task to execute some code in the context of another task The operating system also under timers, of course, because it's a real-time operating system So, well, you can set a specific action to occur at regular intervals It's very reused in the kernel because, well, in the RF world, you have to do some processing at various intervals So, timers are only by the main tasks When it has processed the creation of all the tasks It's entering a loop, checking for timers to fire When a timer is triggered, you can, well, whatever, send a signal to a task For example, a signal can, it's just like an event, you see A task can wait for a signal and then another task can send a signal to another task So, it's like an event, you can trigger an event to a task You can execute an APC, and you can also execute a direct hold Which will be directly processed in the context of the main tasks So, tasks, of course, there are 70 tasks running in the base bound each for one protocol layer So, there are some communications between all those tasks So, kernel IPCs are fairly simple also Well, the main method to communicate between tasks is the use of signals Like, for example, a task will have a queue shared between two tasks It will push some data and send a signal for the task to fetch the data And then the overtask can send a signal to CTA, A have acknowledge the data, I've got it I can pop the stack So, the DS task is a data service task It's used to unify all the gathering of protocol stacks at lower layers It will fetch all the data and put them into pipes So that you can see the data as a continuous stream of data, like a network flow So, it's very widely used all across the base bound, all across the system I'm not sure, but I think this is also used for the implementation of sockets on a packet switch services Well, the memory management, you've got an IP, of course There is a global IP in the system, but actually I don't really know why it's not very used In fact, each task implements their own IP, they reuse the same code, of course But they have separate IPs at fixed address, hard-coded address in the code So, the IP structure is very simple Well, the IP metadata will just keep track of what is the first block, what is the last block And for each chunk block, you will see what is the size of the data and is the block free or not So, the next block is just the block after my block plus the size There is no defragmentation process involved or complex things, it's very quick and efficient Well, that's all So, the nice thing that you want to do is to debug the base bound Because, well, I mean, for example, this is just a quick overview of the kernel of the system And the system is made of a lot of tasks You can take an image of the firmware of the base bound and statically reverse each task one by one if you want But, well, first of all, the code is very, very dense, like horrible And the main problem too is that a lot of interactions are involved at runtime between every task So, if you try to look into the base bound, you will see for a task big switches For the handling of signals, sending signals to over tasks and so on And if you just look at it statically, it's almost impossible to understand what's really happening in the base bound So you have to get some to see the system running in live at runtime And eventually, you would want to be able to catch interruptions, for example, if you were able to trigger an overflow or something And you want to single step a task and follow the control flow and so on So how it's possible? Well, for code execution, getting code execution on the base bound, given what I've told before about the diagnostic mode Is very easy, obviously, because you have an arbitrary read and write in RAM So, well, you got the execution is given, it's free Well, you want to upload your code, but you also want to communicate with your code easily So the two main ideas would be to either to hook an IT command or either to hook a diagnostic command I prefer to hook a diagnostic command in my case, because it allows me to debug the IT command Well, if my debugger is running in the context of the diagnostic task, I cannot debug the diagnostic task, obviously So if I inject it in the IT command and learn, it's the same thing Well, optionally, I could create another task in the system and be able to debug every task But it's not very important, because the diagnostic task is not a critical task in the system So I'm basically just reusing the future of the diagnostic task And using its own API to communicate with the payload over USB on the emulated serial port It's possible to quickly get a code execution, because actually only the first 12 megabytes of memory are marked as read-only in the page table But the code section of the binary is 16 megabytes long So there are like 4 megabytes which are writable, and luckily the diagnostic loop and link commands is in this range So you can just rewrite the command table pointer, duplicate the command table pointer elsewhere And get code execution through this, just hooking a command So it's very easy Well, when you get code execution, if you want to write a debugger, next you want to be able to break a task Well, a task should be stopped if you instruct it to do so The debugger tells you to stop this task, or if you eat an exception or a breakpoint So you have to be able to unschedule a task and resume it on demand For this, I just reused the kernel API I've reviewed before So there is a specific function for waiting for a signal for a task So I'm just using, well, I'm just taking a task to wait for this signal And the debugger can resume the task by sending the signal to the task The reason is that the signal is not used in the system in normal conditions Otherwise, you would wake up the task even before you would have told it to So what is done is that I have to execute this piece of code in the context of the task So I could patch the code of the task and redirect the control flow But the kernel directly offers an API to execute code in the context of another task with a DPC So I create a DPC and send it to the task and tell the debugger to wait for this signal So, well, if you want to, I don't know if anybody in this room has developed a debugger for ARM I mean a software debugger But, in fact, it's quite horrible because ARM has no native support for single step It's quite crazy Because if you want to, well, do something as simple as single stepping thread Well, the first way to do it is not like an X86 where you have the trap flag And you will trigger an interrupt at each instruction There is no mechanism in ARM for this So the standard way to do this is to predict the next pointer, the next value of the PC register Set a BP in memory and resume the thread So the obvious problem in this situation is that if you are in a multisread context, like here You can't do this in a safe way Because between the time when you put the breakpoint And the time when you order the task or the thread to continue Another task could have eaten the breakpoint So it would have to check if the breakpoint was meant for this task So it can be done, but for example, if you single step into memcopy It will trigger thousands of interrupts per second You don't want this, it's not reliable So another way would be of course to, you have the context of the thread You emulate the instruction and you update the context of the thread Well, if you need an emulator for this The solution which is offered by GDB in a multisread context Is to use displaced breakpoints So it will use a scratch buffer where it will copy the instruction It will put a breakpoint after the instruction Set PC on the scratch buffer and resume the execution In this way you do not put the breakpoint in memory where the code is relying And so the other task can continue to execute without triggering exceptions In fact, at first, GDB does not support some for this So you have to record it And also you have to, in ARM you can address PC So you have to take care of instruction relocations Like loading a value from PC Or using, if this is a jump for example You would jump out of the buffer and the breakpoint would never have been hit So you have to account for this scenario too And well, it's quite painful to implement If you want something which supports ARM and some You can also, another solution will be to virtualize the address space for each task In this way you just put a breakpoint, use copy and write And follow the page where you put the breakpoint And in this way all those tasks are safe for execution But for this you need to patch the scheduler and implement patch tables for each task And it's quite painful too So my solution for the moment is to use this place breakpoint And standard too So what is the debugger architecture? So, well, you've got the stick, you've got GDB I tried to be a GDB compliant You are communicating over the diagnostic protocol So while you need some kind of a proxy to put the GDB request into your protocol And well, you can also show each task of the operating system as a thread in GDB So this way you can reuse the multi-threading features of GDB to debug the baseband So I think I do a demo of the debugger So, wait a second Okay So at first, well, I'm using the diagnostic mod to push my debugger into the baseband memory And as I said before, rewriting a pointer to get access and cut execution So, well, here it loads the thing It will be finished soon here So, I'm running the proxy Okay, so the proxy is ready So we can communicate with the debugger inside the stick Now I've got a cross-compile GDB for ARM And I'm just connecting the proxy and the GDB client And here it should work So, well, when GDB is connecting to the proxy, it will ask for the list of threads on the target So here GDB is seeing the baseband test of the operating system So, well, you can see the name of the tasks Like, for example, you have the DPC task, the DOC task You have a lot of tasks which are dedicated to network protocols at various layers You've got the main tasks, some hardware tasks like DSP, the vocoder The envirom, and so on So, okay So, when you debug the baseband, actually, you have, as I said before, you have a watchdog task Which is constantly checking whether tasks are alive So if you break a task, for example, with a breakpoint or something, the watchdog will detect it and rebuild the system So you have first to account for this and break the DOC task So I'm going to... Okay, so here I'm getting into the context of the task and interrupting Okay, so the task is interrupted I can check its registers, I can check its code and so on You can also, well, directly inspect anything in the baseband memory, obviously So, for example, if I call rex self Sorry Which is the API in the kernel to get the current task, the current task structure So here I'm calling it So, okay, I get this No, I'm printing it Okay, so as you can see, well, if you can inspect, you can do the same thing for the heap, for example My debugger has a separate heap, so you can inspect the structures very easily You can see that I'm really calling this function in the context of the DOC task You have the name in the field directly in the task structure So, now, for break points and blah, blah, blah Just a second For example, I will... So here it's just an 80 command handler for the SGSN 80 command It's just a command, an 80 command to get the e-mail of the phone and the serial number of the manufacturer, of the mobile So, well, just putting a bit of fun on it I don't see my screen on my computer Here I'm in the 80 channel 80, please, SGSN No, not CGSN What? Okay, so here I've hit the break point If you look at the task, you can see which task, in which context I am It's quite slow because the GDB is doing a lot of useless stuff Well, here it's in the data service task, which is unlink the 80 commands So I'm getting into its context I get access to its registers, I can check its parameters As you can see, this is the right task and I can single step into it Well, it's also nice for catching exceptions So, well, going back to this... I like to use the watchdog task for my experimentations because when it dies, nobody cares So just calling, for example, a function which happens, which happens to have another stack overflow And we use stack overflow into it Just the main copy of the stack Okay, and here you get this So, yeah, you can see that you have rewritten the EIP, get a backtrace Well, the backtrace may not be accurate anyway in GDB because it has no way to distinguish between code and data So I suppose it uses heuristics to find this Well, so if you find... Well, if you use this thing, this debugger and you fill out the USB key You can catch interruptions and see the context, the task in which you are triggering the exception Yeah, and there's also a nice possibility with this way Because when you get code execution on the stack, well, on the stack, code execution on the baseband You can also directly pass commands to the baseband And so you can, instead of deploying a huge... Not huge, but like deploying a BTS and doing a radio frequency fusing on the baseband You can inject data locally on the USB key So possibly, well, it could be possible to fiat the baseband with no BTS at all Just passing commands to the debugger and transferring, making the right function calls Well, you need to know which function you want to fiat, of course So, okay, so in conclusion, well, baseband systems are still massively used and poorly known There is no much literature nowadays for seeing how is the architecture based on the operating system The nice thing about the Icon 2.5 is that it uses an insecure bootloader So you can easily reflash it if you know what you're doing There is also easy code execution achievable, so it's nice for reverse engineering But you have to know that the more recent versions on funds today use an OKL4 REX hybrid kernel So it's not exactly the same thing As far as I've seen, the L4 kernel is just used for the scheduling, but the REX kernel remains for everything else Well, of course, on smartphones today you have a second processor with interactions with the application processor So, well, you can see some related tools, the Ryfee Vaman baseband apocalypse last year Luis Mures talking about baseband playground on an infinite unlocking And, well, on the web you have the various communities, you have a TG World, BB.osmokom.org, for Osmokom BB And many communities like XDA developers and so on Interesting Okay, so, thank you for your time So, thank you for your talk I just want to ask you to please sit down until the questions also are done And if you leave, please leave through the front door and take your trash with you So, questions, here in front So, thank you for your talk and the question regarding the base Have you seen JTAG lines or something? So, for example, if you try to mess around with the flash, you need an emergency exit So, you can, for example, rewrite the flash with a JTAG debugger So, if you, for example, have a closely commercial JTAG debugger that can use the ARM device So, you can obviously flash the device So, if you mess around with the flash, you have a brick device Yeah You mean through JTAG or? Yeah, yeah, have you seen some JTAG lines or have you looked for this? I have not looked for this I know there is a JTAG which is connected directly to the ARM processor But through the flash, I don't know, I have not looked into it Okay, because it would be interesting to do this But you can re-flash the NAND through software calls So, you do not need an underword Yeah, but for example, you can hook up the buggers like from Lauterbach or other companies who make both the buggers And then you can just debug via JTAG You can send the bug to the device via JTAG It's a normal way to debug a device Do you have a trace cell that is connected to JTAG inside the chip And then you can debug with a JTAG debugger Okay And so if you mess up everything, you can just write the flash again Yeah, but I don't know, honestly I have not looked for it I have not tried to re-flash the device for the moment As you saw, I'm just pushing the code in the RAM at runtime I've got two questions via IRC The first one is, is the baseband you analyzed identical to the embedded basebands of Qualcomm's MSM7000 or Snapdragon chipsets? Are they? Sorry Whether the baseband you analyzed is identical to the embedded basebands in the Qualcomm MSM7000 chips or Snapdragon chips? I think in 7000, you have a Rix L4 hybrid kernel So it's not exactly the same thing The system is, you know, they have not rewritten the system from scratch They have just changed the kernel But I think if you find, I don't know, but if you find a vulnerability, for example, on this stick There is some fair chances to find it in other versions Whoever or not, the kernel is different Someone is asking, how long did the whole process of reverse engineering this take? This, honestly, maybe for reversing just a kernel, maybe five days, maybe But just gluing all the things together and testing, developing the thing, two months Could you please put your slides and URLs on the PentaBARF? That would be cool. Thanks Did you have access to any documentation, any papers of Qualcomm? So like user manuals for Rix or something? There is, I know there is some leaked documents from Qualcomm on the internet I've looked into them But the thing is, something interesting is that you have the Rix sources which has been leaked for a very old version of Rix But from what I've seen, what is in this USB stick is much more complicated than what I saw in the sources So it's looking alike, but not the same thing And in the baseband, there are a lot of leaked documents, but I have not gone through all of them So it's good to check on them to see if you are on the right path I have two questions First of all, the agenda was to find out interesting things about the Qualcomm baseband So I'm wondering why you are not using the Qualcomm diagnostics tools that are more or less freely available on the internet Which seem to have leaked from Qualcomm licensees So your work is somewhat different and it's impressive, but why not try this first? And the second question is, are you doing this privately for fun or are you doing this through your company with some agenda? No, I'm working for a company, I'm working at Sogeti, which is a French company But that doesn't meet, I do not work for fun, I mean, I'm doing it for fun also In fact, the first idea I had when I started looking into this was not to find vulnerabilities or developing a debugger But developing more of something to dump the data, like at various network layers Just to see, without deploying BTS and something, just to see what the network data would look like in telephony protocols But I find this interesting to be able to dump data on this key But as a matter of fact, I realized for reverse engineering I needed a debugger, so I first developed a debugger And well, there was two questions, but the first one was... Well, why not use the tools that are available on the internet, like QCM or so, you can find this in several places Sorry, can you repeat? Which attach to the diagnosis board you mentioned Yeah, what is available on the internet, sorry, maybe there is something I haven't seen If you Google it, you will find it Yeah, you mean the diagnostic channel, for example? No, no, no, the tool for it, which is called QXDM Well, maybe, okay, it's not very willing to reverse actually I had a quick question, we noticed some symbol names in the GDB output Are those your symbol names or did you find a symbol table within the binary? Actually, in my GDB script, I'm just loading... Well, my debugger, I include the symbols into the binary of my debugger in ELF and I load it into GDB So it can look into them Okay, so those are your symbol names though, not official ones No, they are my ones Thanks So, are there any other questions here? Oh, there are some... Another question from IRC, do you plan to release the source code or is there a possibility to get the source code tools? Yeah, I have not done it yet, I will upload it to Google code IZAB I think you hinted it, are you actually working on a protocol analyser? Is that what you're actually building? You sort of hinted at it but didn't actually say, were you actually working on a protocol analyser? Was that the sort of initial starting point? Actually, it was Did you have any success in that or is that something you're still sort of working on? In fact, for this, the debugger is not finished Well, it has basic debugging capabilities for the moment But there is a future I need for this It's the implementation of trace points So the ability to not to resume the task immediately after hitting a breakpoint And for this, it's not very evident because you have to displace the instruction And execute it elsewhere, so you have to perform relocations and so on And my relocating motor engine is not completely finished yet So as soon as I get trace points working, I will put trace points on the circuits in the basements And I will try to see what comes out of it So, thank you, Jung We are now at the end of our time and it was a very interesting talk And have a wonderful plause


Felly, mae'r newid ddechrau ar gyfer Rydym yn ysgrifellol, yn ymgyrch o gyfoedd, mae'n ffawr sy'n ei fawr, roedd y rach cyflym yn gyffredig unrhyw o'r cyflwyntau ac mae'n gydig i gydig, mae'n gydig i gydig i gydigig, ac mae'n gydig i gydig i'r gweithio, mae'n gydig i'r gydig i gydig i gydig i gydig i gydig, mae'r cyflym yn maelol, mae'n maelol yn cyffredig i gydig i gydig i'r cyffredig, a'r crossbar was the way the bike was being held and a friend of mine J.O. pointed this out on Twitter and it's just little things like that so it's often that what looks like a neutral everyday audience is quite often a male audience and often quite a specific type of male audience as well and again this cuts across other issues here around race, around class, around sexuality but for today that was our starting point of just saying look a little bit closer I think is neutral often is anything but. We were sort of particularly thinking about people, physicists who are actually going out and trying to connect with people and to share their level physics and also to try to get perhaps more people to take up physics and there are actually quite a lot of subtle things that are hidden away in the way you do things and maybe from your own education or from just what you think is good practice or the natural ways that might come to you are actually quite conditioned and so we heard from Faisal Khan from Lachwick Boswell School and he had looked through his school brochure about the science photos and they were all of poids or the girls were in the background looking forward and so he went through and a very simple thing was to refresh the photographies so that there was a much greater positive impact of the girls in the brochure and they were clearly enjoying the science and his school has achieved 50% of girls doing physics but there was also a really helpful sort of encapsulation of all of the research wasn't there at the start of the day? Yeah I think the first three speakers certainly who were Liz Whiteleg Liz Whiteleg from the Open University, Peter Hane Peter Mane from IOP and Tracy Berry from Royal Hollow and they all presented in very different ways either for Tracy she talked about the Juno project which was a way of trying to instigate best practice around gender across university physics departments and she took us through quite detailed sets of hoops and group departments have to jump through it on a constant basis rather than just getting their award and then saying we've done it, now there will be more women in physics Peter talked about the drop off for girls taking up physics at A level and actually when you poke it a bit more closely it's shaped by the school environment and Liz jumped off the day with this incredibly thorough examination and retelling of her research that she's done about the representation of women in the UK TV media, the idea of the role model but also as well for all of them the limitations of outreach that a lot of it has to come from within organisation or culture itself it can't just be this kind of thing that's swooped in and then swooped out of there and what I liked particularly I think about Tarek's fantastic demonstration that also ended with things being set on fire because I wouldn't expect anything less was that he was talking about if outreach doesn't work so well what can you do and they were talking about the fantastic social media campaign not even a campaign but engagement strategy that their school does as a way of answering questions, putting material up that creates this intimacy with the school audience but it also tailors that dialogue too that it's not someone random saying learn about physics it's a way of creating that dialogue that can be inclusive as well and I love that, I thought that was fantastic I thought that was really good, I mean Faisal had really fantastic demonstrations I mean there were two other things that came across during the day generally which was one which was transparency and openness in procedure and process no matter what you're doing and that way both male and female benefit and have a better working environment, a better teaching environment and that was really quite key and the second thing was to allow girls particularly to make their own construct of what they would like to be what was their impression of a scientist and this kept coming up again let the girls build their own version of how their career is going to be and not try to teach at them and also not be constrained by the ideas of what a girl or a woman is that gender is a very malleable concept and that's just trying to play some stereotypical however well-meaning idea of femininity on to things just doesn't work because there's so much complexity in there as well and I think that kind of finished off the day was a science girl again presentation which was fantastic where Heather took us through the, it's only been six months of the work they've done, it's a great calendar that is again inclusive has a lot of women talking about their work or presented but all the way up I think from students to post graduates to professors but also men there as well holding up the photos of the female scientists that they've been inspired by as well I thought the science building was quite an interesting sort of thing to end on because it showed that actually there were new ways to connect women and girls and physics together and to generate a whole new energy about how possible having a career in physics or studying physics was so the day was centred around the way we communicate and if we communicate inclusively so we were looking at how gender influences can affect the way that physics is communicated in particular and so two groups of the institute came together the women in physics group and the physics communicators group and we jointly built the programme and brought our two communities together and we wanted to bring in lots of different influences not just from work done by the institute of physics but also taking in sociology and other factors and so that's how we built up the programme and we wanted to emphasise the positive aspects of that and how people who are trying to engage with girls and promote physics can actually take positive steps to change their own behaviours and be awareness and get the best results for encouraging girls to take up physics


So we decided we would finish up today with a speaker panel Q&A You already know our speakers We rock well David Gordon Justin Paltano and Dr. Ron Paul So we're very interested in your questions and thoughts, but Before we do so I wanted to give a special thanks to two of our real host and hostess for the day I don't know where they're seated Gary and Nina Turpanjian are sitting here They are They're both Relatively relative to some of our benefactors relatively new to the Mises Institute and we're affected by Ron Paul's two campaigns, I know and We're very generous in making today's event happen for us all they live in the in the Rancho Palos Verdes area generally here I will not hear but in Los Angeles and we're very thankful to both of you and We're very glad you're part of the Mises Institute So with that we have these two young men with microphones We ask that you speak into the mic and we ask that you Go with a question rather than a soliloquy Given the discussion and the optimism and that's great, but we had a long ways to go So talking at the term government love most people think nothing to like that term And then selling the concept liberty or freedom if you go out in the street and talk to people you got freedom I guess we go anywhere in the world by any clothes We want apparently we have a lot of freedom That's just is there's some language changes here that we can make to propel our movement Well, one of the things that I try and emphasize perhaps to the type of audience that you're speaking of is To ask them who owns their income them or the government Why is it the government gets their income at the same time they do and why is the government Disagrets the decide how much of their income they get to keep and then you can make the same argument with their home I mean here in California real estate taxes are about as oppressive as they are in New Jersey So that should be relatively easy arguments to make and then I sort of play off on something that I think Ron may have used before It's actually a Murray Rothbard argument and it's fairly effective And that is there are three ways to acquire wealth and one is by the sweat of your brow and one is Because you were fortunate enough to inherit it and the other is the mafia model Which is your property or else and then I pause and say Which model does the government use? Judge Napolitano, this is a question. I've been wanting to ask you for years Are you in favor of having the goal being a stateless voluntary society and if not? Why not am I in favor of what being a stateless aside our society being stateless the absence of any political state Are you in favor of that or not and if not why not well? I would be in favor of that as the goal I mean, I Except when Walter block is in the room. I'm the most libertarian person in the room and Ideally I could probably protect my life liberty and property better than than the government can but that's an ideal and and that Ideal is not going to come out come about overnight. So I would be in favor of the Incremental movement toward that ideal This question this gentleman this question is for the judge Respectfully go easy on me on your answer, please I'm with regard to the threat of Ebola and you're you're comment about the lady that was Incarcerated unjustly for sure, but there is a great risk So where is the line between? Protecting her from getting on an airplane and spreading that risk versus her rights and her freedom Well in my world there wouldn't be a TSA and the government wouldn't decide who gets on the airlines the airlines would Because they have the most to lose and so if the owner of the plane decided He didn't want someone on that plane for whatever reason the owner American Airlines United Airlines Delta Whoever it might be can make that decision and then we wouldn't we wouldn't reach the issue with Chris Christie locking her up In a tent but in the present world in which we live We still at least in theory have the presumption of liberty and the burden is always on the government To show why that presumption is lost it never switches to the individual Was I easy on you? Dr. Paul in your talk you mentioned you said that I think we are all naturally libertarian and they beat it out of us. I Thought that was great. Do you agree that elimination of corporal punishment of children is an important step? To removing the conditioning of people to accept the violence of the state punishing kids Well, I don't happen to believe in it. I don't know whether I'm going to Have a policeman who's going to be rounding up parents who might have slapped their kid on their bottom for do it Something wrong so Corporal punishment. I think unless a child is really injured Needs to be ignored but you know to me that is minor but I Don't personally believe in it and didn't experience it and I think of course that's that is the best side to have is to understand that it's not worth anything and it doesn't accomplish the goals so I Basically would aim to have no no corporal punishments, but There's there's a limit to it I mean if kids are getting beat up and and really injured then somebody has to do something about it Questions is for Ron Paul Ron you ran you may recall running for president in 2008 you got 5% of the vote and You may recall running in 2012 and you got 10% of the vote I'm looking forward to getting 20% of the vote in 2016 So when are you going to announce I just wonder why I wonder why you have a guess to me Dr. Paul my name is Mack and I live here in Temecula and I've listened quite a bit to Your expounding and your development of the homeschool program, and I'm just curious I've got a daughter who's 16. She's a little bit too late to the party But I'm just curious as to how you see over maybe the next 10 15 20 years the progression from Independent or homeschool learning away from state learning Of course, I think a homeschooling movement is going to continue to grow Fortunately in the 1980s when they tried to close it down before it even Got going that there were some poor rulings to protect it and it's growing by leaps and bounds and as more evidence Of bounds about the failure of the government schools. I think you're going to see a lot more I don't think we're on the verge of seeing the majority of people being homeschooled You know There's a lot of reasons for that and the homeschooling program that I have with the help of Tom Woods and Gary North This program is doing quite well and it's growing mainly by word of mouth and it's designed not to Ever believe we're going to have a hundred percent of the students I mean we're looking for people particularly interested in a certain type of education and that is based around the Freedom philosophy so you know what kind of study on that history you're going to have and you're going to have Classics and you're going to have an economic policy is quite different And you're going to have a foreign policy and it's not going to be taught by neocons So I think they're you're going to see a lot more I think our program is going to continue to grow and I think there'll be different programs Emphasizing different things ours is going to emphasize emphasize liberty Which means that it should be in the defense of protecting anybody who wants to have any kind of a homeschooling program Would would be protected but I think the the failure of the public school system is going to be with us for a while It's probably going to get much worse statistic statistics right now are showing that Homeschooling is much more successful than I ever dreamed so I think it's going to be here for a while. It's going to continue to grow I'm sure there's quite a few central committee members here. Do you have any direct advice or insight? Into the politics at the local level It's trying to help us out Well, I think that local level politics probably makes more sense than some of the national politics Because government should be much more local and this is where I have been surprised because every day We we meet people that were brought into the freedom movement back in oh wait and and I tell them to go do something, you know, whatever and and Some of I don't know why they'd join the politics But they have and they've gotten elected. So there's a lot of local people, you know involve and but I think whether you're in local Government or national government it has to be done with a precise goal and it's When young people come to me in my office they frequently say, you know, I want to I understand what's going on And I want to be a congressman and now what are you going to tell me? I says don't set that as your goal You don't want it just to be in politics for the sake of politics because that's why 99% of the people in Washington Are involved in politics locally? I think that would be less so because you have to deal with Some real Important property rights, you know, maybe somebody locally could wake up the people on the way they waste our money and Use eminent domain and taxes and property regulations and all these things So I think I think that's worthwhile Always with the goal of not saying well what do I have to do to please the majority who wants more government and vote that way but to Use as a tool to influence people to believe precisely in the principal property rights and very limited government. I Think everybody in this room can agree that inflation is theft on a grand scale, right? So why don't we start doing some kind of citizens arrest of guys like Ben Bernanke? Well, he didn't you say my name, but I'll take Well my my suggestion is everybody goes back and reads the the corny jacked of 1792 and You know it the Constitution was written and the first act was for the For the government to write the rules about gold and silver being legal tender You know, they had this old-fashioned idea that you shouldn't counterfeit You couldn't shouldn't kind of fit government paper and you shouldn't kind of fit government money and anybody that did They thought it was so serious back then that they invoked the death penalty for the counterfeiters back then So, I don't know whether you want to go that far or not But we have this problem now about the counterfeiters because if unless we reverse Bernanke's belief that he says that Gold is not money and only paper is money. So they are official counterfeiters and I've actually told him that But once again, it's going to be an understanding that system is going to fail and we're going to have an opportunity To have a new monetary system. I just hope we do a good job Like maybe turning it over to the marketplace and making sure nobody commits fraud leave it to the government Guess what people government to commit fraud, you know and things like that. So Yes, but I think the penalty is going to be You know an intellectual answer to it by just revoking their ability to do what they're doing And I think I think that they'll come the other hand if you do want to engage And a citizen's arrest The rule of thumb is the citizen has to witness the person commit the crime in order to justify the arrest So get yourself over there the next time they sign away our liberties We're on I was I was just going to say that All your hearings with are with Greenspan over the years all your instructions that you gave him may be starting to have an effect I don't know if you heard this but he gave an address at the council on foreign relations a couple days ago And he said the only real currency is gold No fiat currency including the dollar can come close. So they actually deleted that from the transcript They took it out of the video and all we have is an audio of his saying that You know this raises a question whether or not Greenspan told me the truth many years ago Because we were having a hearing but prior to the hearing we were invited to have a one-on-one with with the chairman And it was sort of scheduled so I knew about it And I thought well I think you know because most people know about Golden and freedom the article he wrote in 1966 for the objective is newsletter for ran and ran So I dug that up because I just happened to subscribe to Rand's newsletter back then and and so I took it up And it was an old faded green In newsletter so I took it in and as we were sitting down there to chat for a few minutes I I asked him I showed him the color. I said do you recognize what this is? Yeah, I know what that is. So I opened it up to the Golden Freedom article, which was a fantastic article Everything is correct. And I said do you remember this article? He says yeah, yeah He says and I so I asked him I said if I said would you sign it for me? So he so he autographed this article and I said do you want to put a disclaimer on it? And his answer now, this is the important thing his answer was no He says I had just read this not too long ago, and I fully endorsed all the arguments in there So now what's Louis saying is sounding like the old Alan Greenspan? We'll see This question is for dr. Paul I have to confess in 2008. I was completely ignorant. I didn't know anything about the monetary system I didn't even know what the Federal Reserve was Of course, I'm a perfect product of the California government school system all the way through my structural engineering degree from Cal Poly But learning about all this and largely thanks to the Mises Institute and all of you gentlemen up there Has completely changed my thinking on everything. So my question for you is this You spent all those years in Congress. How many of those Supposed representatives of the people Understand what the Federal Reserve is what's happening? What the everything that's going on how many of them understand that or they just ignorant Or is it something far worse? There's probably about ten And about seven of them understand it and why they have to defend it because that's how they run wars and the welfare state And they know exactly why they believe in the Federal Reserve And then there's three or four or five that are on our side and they understand it clearly But no not too many do but it is changing mainly because people like you have changed your mind And you've gotten wind of the corruption through the monetary system So it Outside of Washington is growing and that's where it's necessary and and they talk about the Fed now and actually Because of this these changes It was something that I had worked on since the 70s Back then it was Henry Gonzales in Texas the populist liberal Democrat that wanted an audit of the Fed So that was when I first got active in that and right Patman and other populist Democrat always wanted to open up the Open up the banking system. So but but That has floated I kept working on it But it wasn't until the OA campaign because of these various educational activities and the college kids Waking up to this that Through the effort through the campaign for liberty an organization we have we lobbied You know and got information to the members and they brought it up twice in both times It passed overwhelmingly in the house with strong Bipartisan support. So it was a good example of how if views change They're not just partisan and they bring together both liberals and Democrats to have monetary reform And so we're making a lot of progress on on that but we But they'll be tenacious though when it comes to it But basic understanding of the I don't know the exact number But there aren't that many that really understand exactly how the Fed works I think the crisis helped get the attention because we were able to dig out some figures to show that the Fed was probably Involved with anywhere between 13 and 15 trillion dollars In churning that money to bail out all their friends and the average people are starting to get wind of this So I think we're making good progress on that issue Rana if you'll recall Ron there was a Congresswoman from the Empire State who shall remain nameless who sat on the banking committee with you and once asked you Came up to you after a hearing and asked you said oh, I thought we were still on a gold standard You mean we're not on a gold standard But it's okay because she was just on the banking committee Shall rename nameless as far as I know still in Congress Protecting the value of dollar My name is Bill Blair, and I have a question for the judge Today we've spoken a lot about liberty and Jeffersonian philosophy of government Could you tell us how you feel jury nullification? might Help us or you know move us toward a freer society Well, I'm personally all in favor of jury nullification And I'm personally in favor of the judge informing the jury that they can nullify the prosecution What you for those of you are an unfamiliar with this jury nullification Often occurs where the defend the evidence of guilt is strong enough to convict But the jury is of the view that the person ought never to have been Prosecuted and that the government was wrong to prosecute this person for violating this statute under this time There are many many historical examples of this the Constitution of the state of New Hampshire Compels judges to inform juries that they have the right to nullify When you think about it the 12-person jury is itself a bulwark Against tyranny as long as they are truly free to vote their consciences They it might be necessary to inform them They are truly free to say even though the defendant performed these acts He should be declared not guilty because the government had no bring the business bringing this prosecution I wish every judge would say that to every jury Dr. Paul we're all very Appreciative of your political work in Congress and especially in your efforts to end the Fed the mechanism that their state is using to Put their hands in everyone's pockets and do whatever they want so anything that would be a great benefit But since it's been so difficult politically Do you see any ulterior or any alternative ways of ending the Fed perhaps? Or maybe even using do you have any opinion on the use of Bitcoin to go about and end the Fed? Well, I think the Fed probably will do more to end the Fed than anybody else Because I think it's a non-viable system and finally it'll just collapse and a big question is what will what will they do for monetary reform? But although right now, you know the dollar is up and people think that it'll be salvaged forever and ever I don't happen to believe that because of how much Credit and money they're creating so I think that will finally and But there will be a replacement the freer the society is and the more options and the more choice you have on currencies I believe in competing currencies and I believe that if if Bitcoin Satisfies people and there's no commitment of fraud by doing it. It may well be a participant But quite frankly I have I have a political opinion and a personal opinion my political opinion is very very clear No fraud the government should butt out and they shouldn't touch it and let you do what you want But I'm still old-fashioned enough that I like to see real money that I would jingle in my pocket My question is for Lou and for dr. Paul I Would describe myself as a pretty hardcore libertarian and I read Lou Rockwell calm every day And I'm familiar with the writings of like Lawrence Vance and yourself where you say don't vote And there are some very articulate arguments for not voting Well, I do participate in the system I ended up running for office and ended up winning So my question is for libertarians and our co-capitalists Which is the the best way to hasten the big correction to bring about the demise of the Leviathan? Is it is it by not voting and participating which most people don't or is it by? Getting and our co-capitalists and libertarians to run for office like dr. Paul has done To change the beast from within so it's it is it to participate or to not? well, obviously people know what I have done and But the one thing is is what people do is okay with me So if somebody doesn't like to vote or think it does any good and they choose to vote by not voting That's okay, but I still think that if you're in the Process that it is totally worthless and it's a very negative thing if you don't have Somebody believing in something and you're doing it for that purpose because see if When I first went to Congress in the 70s if I decide, you know what?  It might be 10 11 12 million dollars You know you have to raise to buy that by that seat now if that's the goal I think the electoral process is is terrible But if it's a place where you can use it as a bully pulpit and And set a standard I think it's worthwhile because quite frankly by going there. I First never thought I was going to be elected at the beginning. I always tell the story that when I told Carol I was gonna run she said why would you want to do anything like that and she says well? It's so dangerous. I thought I'm gonna be dangerous. She says you'll probably win But I guarantee her that you know that that wouldn't happen But but if the goal is like I told the young people if that is your goal just to be an office You lose sight of it and then you say how do I raise the money and how do I organize? How do I build these collisions? So I didn't expect much to happen then I thought well if I vote the way I said there's no way I'm gonna get real active so you know in the in the early years I well the whole time I'd always vote against every every bill that actually was beneficial to the district and They had every opportunity in the world to throw me out So if I would have stayed and promoted and stayed in office and became a chairman by doing exactly the opposite Then I think the political process is is very bad But so therefore I would say that those of you want to run I would like to see a certain target and a certain goal if you're supporting somebody find out what they believe in and See if you can trust them and see if you agree with what they believe in the big problem there is Everybody will tell you what they believe in if they know who you are and they think you're gonna be the best champion in the world But I could always tell within a week I help different members to get in within a week I could tell whether they have joined a gang or not because they want their political assignments and they want Something for their district and it as far as I was concerned. It was over so but I think that's an individual thing if somebody say That's too much. That's that's too much to think about. I'm just not gonna vote so Let's see what Lou is saying. Well, yeah, I don't vote and But I if somebody enjoys voting if they if they you know, I wouldn't tell them not to do it I I think in general it doesn't you know, it doesn't do any good And they you know, it's very important to the regime that you vote They really care that people vote you're you're demonized if you're a non-voter So that alone gives you some guidance that may be as to what you should do or what you shouldn't do You know, we could say there are many things that set Ron Paul Apart make him unique talk about his character is vast knowledge his intelligence his background and all that you know many many other Wonderful virtues we could talk about it But to me the reason he's really been unique in the history of American politics. He doesn't have powerlust He doesn't actually want to run anybody's else's life let alone the next country or the world or whatever like most of these guys so if you if you're like that By all means run for office and it can be a as he's shown it can be a great educational platform if you're Inclined to that if you have the talent for it and if you don't have powerlust Yeah, go to it This last week defending myself for not voting on Tuesday and so I wondered if Lou you could address Perhaps if you were sitting across the table from Bill O'Reilly and he was giving you all of his best arguments in front of you know The nation why to vote? Why would you what's your hardest-hitting message against voting in no offense? That's that people who do run for office assuming you wouldn't cut the mic off, which is his normal practice one. Yeah Well, first of all, I'd say your vote doesn't count I mean unless the election is decided by one vote. It doesn't matter whether you vote it as an individual doesn't matter whether you voted or not I Would say also the you know the vote is this sort of the sacrament of the state religion.  They don't care about the future and all that sort of thing But I when I find when I talk to people who are non-voters Even if they're not sophisticated people they they'll say things like well, they're all crooks It doesn't matter if it's crook this crook or that crook. Well, that's exactly right Unless we're on Paul's running right then it's a different different story, but since there's only been one Ron Paul in 200 years I'm not waiting around for more of them My questions for mr. Gordon There's been a lot of attempts over the years to codify Western thought and whether it's Mortimer Adler's great books And it's not to con all that I was wondering if you can point us to a resource that has attempted that with thought Liberty thought or maybe plans to write something like that Well on Attempts to codify thought I tend to think those haven't been too successful The basic thing is you just have to read as much as possible of the Sources I don't think there's you should let some kind of Someone else's ideas go Come between you and the sources, you know when they had the French encyclopedia in In the late 18th century the idea what they had was they were going to destroy all Previous books and they would have just an encyclopedia would have all the knowledge that people would need I don't think that's been very successful. So I Think you just really have to read as much of the sources as you can Jeff in the vein of Reframing the debate. Do you think it would be a useful reframing if instead of using the term a Stateless society we use the term a state-free society Well, I mean language matters clearly semantics matters and I have seen a comment I think it was just a random kind of comment online one time that said, you know anarcho capitalism It's almost two words that both have in have very negative connotations for a lot of people I mean that that's that's just the reality and and coming from Yes, as Mises did for you know born before World War I and coming out of Europe in the late 1800s There's a there were vast generations of people for whom the term anarchism meant left-wing Anarchism it meant Bolshevism it meant bomb-throwing that sort of peaceful Voluntaryism so, you know, it's it's been a loaded term and it's something we have to fight You know on the one hand I hate to almost seem dishonest by trying to use more flowery language that's not as honest or as accurate as it might be but You know your point is well taken. I think I think the term is going to continue to evolve I think libertarianism is is Slowly being supplanted whether that's good or bad. I don't know but I Will say this it's something we should all give a lot of thought to because semantics do matter We have time for one more Hi Lou or our Jeff you guys put on a lot of educational seminars Mises University And so on and so forth has there ever been any thought given to the idea of eventually conferring degrees You know the the state education complex of course wants to control that very much, but you already see private accreditation of sort existing in the marketplace with certain Tech certificates that you can get that are you know, you can become Microsoft certified Microsoft isn't a school per se It's not certified by any State or federal accreditation board, but nonetheless some Microsoft certification matters so I could very much see us going in that direction where you can get a Mises certification yeah, and Guido Halsman once did a study of this for us and The regulations in Alabama be a degree granting institution the normal sensor just as Jeff mentioned just Crazy I mean in terms of the number of faculty you have to have and many many other very expensive things, but We've thought of an eventually maybe granting degrees if that's possible It's also possible to grant Things that are not the government doesn't consider degrees like a diploma or a licensure in Austrian economics So yeah, I think that's if we have the support we would be very interested in doing something like that. Absolutely Well with that ladies gentlemen We conclude for the day the bookstore will be open for a while And we'd love to see all of you on the West Coast at an event next year. Thank you so much for coming It means the world to us


This paper presents a new approach to postural monitoring of wheelchair users. It uses a multi-layer neural network to classify different postures from sensor data collected by a novel monitoring device. The model is trained using a stratified k-fold cross-validation technique, which allows it to generalize better across different subjects. This makes it suitable for use in both familiar and unfamiliar situations. The system can then be used to help wheelchair users and healthcare professionals monitor their posture, regardless of physical complexity. This article was authored by Patrick Vermander, 8th Cyberman Cicidor, Itseer Cabanes, and others.