Thank you. So hello DEFCON, I'm David. I'm here to talk about terminals. I actually came through four terminals on the way here, from the other side of the world. My flight got rerouted, so that was four airport terminals. But that's not what I'm here to talk about. I'm from G Research. I work for our open source team. We're not a security research company. We're a quantitative research company and we predict things. So we use a lot of machine learning, AI. But we also use a lot of infrastructure underneath that. So our open source team aims to improve the infrastructure we use. We contribute some projects on top of that infrastructure. We use things like Kubernetes. But we also use terminals. And that's what I'm here to talk about today. So what is a terminal? Well, first of all, we need to go back in time. So we're going to go back to the 1960s. And what are terminals built on? ASCII, American Standard Code for Information Interchange. We've all heard of it. Do we know it that well? Probably maybe there's some strange things in it that are legacy. We take it for granted. This very slide has ASCII on it. To give it its full name, American Standards Association X3.4-1963. That looks like this. So this is the ASCII Standard Code. Now, if you look closely at this, it's got seven bits. It's got this large unassigned range. It's got an escape. That's what a lot of this talk is about. There's also something called WRU, which is who are you. And that's a way of asking the terminal on the other end what it is. And a lot of this talk will talk about that. So from the early days of the ASCII Standard, replies were something that were a key part of it. So in this case, you sent a single character, WRU, and in response, the other end would probably respond with RU. It turns out that this is actually a bit vague, because later on ASCII changed, and in 1967, they added, well, lower case, which was quite key. They also moved escape. So now, if you look closely at this table, all the control sequences are on the left two columns, except delete, which is actually an interesting legacy and one of those facts that I really like. Delete is where it is, because on a punch card, if you punch out all the holes, you delete a character. So sort of legacy things that we still have in ASCII, a design like that for a reason. It's one of those legacy things that doesn't hurt, but it's kind of amusing. So there's a few other details about ASCII. It only defined seven bits, as I said, although interestingly, two years after this in 1969, Vinsurf wrote RFC 20, and that basically said that the internet should use ASCII, but it also said that it should use 8-bit characters, which is what we expect these days, but that RFC actually defines that the 8-bit should just always be zero, so they hadn't yet actually defined what the 8-bit was, but they were leaving room for expansion. So there's a lot of sort of history here, and if you're interested in character A encodings, there's some references for this talk. There's books on it. IBM were very involved in it and some other things. So 60 years ago, there were some proposals on escape. So before ASCII was even officially published as a standard, Bob Bemmer, who was an employer of IBM, wrote an article in communications with the ACM called A Proposal for Character Code Compatibility, which is a bit of a wordy thing, but basically it was saying, we've got this single character set, but what are we going to do if we need to put international characters in and so on? And that was where escape was defined as a mechanism that allowed basically to say something different is coming after this point.  So basically this is in-band signalling. And so the second reference is from 1963, and that was written by someone at AT&T, you know. So they really loved in-band signalling. And so this was a proposed discipline for the use of escape. And this was kind of the first time that what escape might mean was defined. And it's very interesting to sort of go back in the history of this. And one of the key things it actually defines is not what escape does, but how it is parsed, essentially. And so it says that particular letters or symbols after escape will either continue the escape sequence or end it. And that later becomes relevant. So what was ASCII actually used it? So in 1963, the teletype Model 33 was released. And this was one of the first devices to use ASCII. It's kind of lost a history of exactly what was using it. But, you know, this was a thing you could type into and it was used in the development of UNIX.  Ken is sitting at a teletype writer or a TTY. So this UNIX machine has two TTYs.  They're something quite different. But this is where terminals started. So in 1976, Lea Siegla released the ADM3A. Now this wasn't the first glass terminal. That was released by Datapoint in the early 70s. But this was one of the first affordable terminals, at least for the time in kit form. It cost under a thousand US dollars. And the University of California, Berkeley, standardised on these for various uses. And Bill Joy had one of these. And if we look closely at the keyboard, on the very left hand side are the configuration options. So you open a panel and change dip switches to adjust the speed and other things like that. But if you look very closely at the H, J, K and L keys, you say they've got arrows, then if you're a VIM user, you might be familiar with what those do. So this terminal was used by Bill Joy in the development of the X editor, which had a mode called VI. And as we all know, the rest is history. So this was the first device that was used to develop the visual editor that we now know on Unix. And there's another Unix reference here. If you look at the top right hand side, the home button has a tilde on it. And that's obviously what the home directory is these days. Exactly whether this is the exact reason that that is the case, people think so, but it's kind of lost in time. But yeah, there's definitely a lot of Unix history here. But why is this also interesting? Well, this was also one of the first terminals that let you position the cursor anywhere on the screen. This is from the manual, which someone has kindly preserved. And it basically says that the escape key can be used in conjunction with character keys to position the cursor anywhere on the screen. So rather than just moving the cursor up and down, you can say, I want it five rows down to across whatever it is, which lets you essentially implement any kind of editor or a visual application, at least as far as you can go visually in a terminal. And this was one of the first devices to support this kind of thing. Some of the earlier terminals only sported moving up and down, so it was more inefficient, especially over at the time people were using 300 board modems to talk to things. So if you imagine you have to send multiple characters to move the cursor around, you can literally see the cursor move. So the interesting thing in this document is actually somewhere in the middle. It says this operation may also be initiated by the host computer. So the user can type this as an escape sequence or the computer can basically say, position this where I want it on the screen. And basically that makes VI possible. So in 1978 the VT100 was released and this was really continuing the introduction of more and more features into terminals. But the interesting thing about the VT100 is it was one of the first terminals to implement this standard, which is known as X3.64-1979. But many people know this simply as ANSI. So we'll get to what that means. But to give it its full name, additional controls for use with American National Standard Code for Information Interchange. So basically this was, as I said earlier, there was a working group on Escape. That working group turned into this standard. There were some other details along the way, but this was the final product. The standard was actually released in 1979. So the VT100 was built in development of that standard and DEC actually released it before the standard was released. So very close together development. I haven't looked that closely at the history there, but it's quite interesting. But what does a VT100 give us? So it gives us escape sequences like this. So I'm using C-style strings here, so slash E is the escape character, and then the other things you see are just the symbols you expect them to be. So like I said, a particular sequence is defined. So here the left bracket opens a particular kind of escape sequence. Then you can have numbers, semicolons, and then usually a letter ends the sequence. So here the top one sets the top and bottom margins, which is a DEC specific one based on the name. The bottom two are positioning the cursor, and those are ANSI standard ones. They don't have a DEC prefix to the name. So we can actually just demo this. So like on a VT100 emulator, we can just, in a command line, we can run printf, and this will do something Sorry, this bit is not. So I'm actually using OpenBSD to demo this. So here I am just logging in as root as you do. But a console is a VT100 emulator, and here I can just type printf, and I've now limited myself to the top 10 lines of the screen. So if I type clear, you can now see I'm still hitting enter, but I don't go further down the screen. But I can use an escape sequence to move further down the screen. So I've now moved myself outside that restricted region using the DEC escape sequence. Now I can move 2,000 lines up. So OpenBSD just rebooted when I moved 2,000 lines down then. So what just happened? So have you tried forcing an unexpected reboot? So that was a present day OpenBSD bug. It resulted in this reliability fix in early 2023, and I found that basically the VT100 emulation, which was originally written for NetBSD in 1998. I don't think anyone had ever really audited it, so basically, yeah, you asked it to move around the screen, and there was some kind of... It was basically just a bounds checking error, as it says there. I later found another bug, so there's a further reliability fix while I was writing this talk. It turns out also, if you look at those escape sequences, I said you can have numbers and semicolons and things.  Both of these will either cause a kernel panic or a reboot, depending on exactly how they're arranged. I don't believe they're exploitable further. I'm sure someone might prove me wrong, but I would expect that address randomisation and other recent additions to a kernel's limit and a lot of this. Also, on a 64-bit system, you're probably far enough away and you can't actually set a more than 32-bit parameter. So maybe a 32-bit system without any address randomisation might be exploitable. If you went back to when this code was written in 1998 and found this bug, it would probably be far more interesting than it is right now, but no one found it then, fortunately or unfortunately. It's interesting that this bug has existed in OpenBSD and NetBSD for 25 years. There you go. Let's go to the 1980s now. PCs. DOS 2.0 introduced a driver called ansi.sys. This is a screenshot from PCJS.org, which is an awesome web-based PC emulator. It actually is quite a faithful emulation of PCs. It's not just like trying to make sure that XX6 works. It really does have the IBM BIOS and some other things. So you can go there, type in those commands, and if you see at the bottom where I've typed CLS and piped it to more, that's actually something that is built into DOS. If you type CLS and it's not directly connected to the screen, then it will output the escape sequence. In this case, I've not actually rebooted the drive said to load ansi.sys, so this is the default DOS behaviour. You just see the escape character on the screen. If you do this on the PCJS emulator, you reboot, then it will actually run that code. So that's how that works. Unfortunately, I've mined a tech, and of course she's meaning this particular demo is not going to work. I was going to demo what happens with ansi.sys on a more recent DOS, so basically bulletin boards and things use ansi.sys, and it was kind of awesome. Combined with this particular IBM code page, this is IBM code page 437, so I mentioned that what ASCII is, but if we look at the second half of this, there's some custom characters, and these are the IBM PC characters, and these, combined with the escape sequences that the ansi.sys driver gives you, allows you to do part like this. This was taken from dreams of insanity bulletin board, the intro to it, and you can find this online on textfiles.com or other places. So how you can actually view this on a modern computer is you can actually use ICONF to convert from IBM code page 437, and then you can pipe it to PV, which is a command line tool that can do various pipe-like things on Unix, and in this case I'm asking it to slow down enough that it behaves like a 28K modem, and if you run that, unfortunately the demo is not working for reasons, but basically you'll see the output just below it, and what that actually looks like when you look at it in a raw form is something like this. So you can see the text is actually sort of here and here, but there's all these control characters here. So it's kind of hard if you actually just open this in an editor to see what it's doing, and that of course brings us to a potential attack. So there's something called ansi bombs. Now the ansi.sys driver had a special ability to redefine keys. So if you could write something to someone's screen, you could redefine keys. Now what I'm showing there is actually a still detected by some antiviruses. That is a real virus, and it basically says for particular keys, redefine them. So if you type this to the screen like it tells you to, you do type help.txt, which is for those who've forgotten how DOS works, that's the same as cat to the screen basically. So raw cat is a bad idea, raw type is a bad idea on DOS a long time ago. So anyway, you do that, and then you hit enter, and what that actually expands to is a dow tree. So if we just go back, each one of these, the first sort of part of the sequence is which character to redefine. Sorry, I'm just... Sorry about that. So that's which character to redefine. And if we go right back to the ansi table, which I won't do right now, but you'll see that my favourite one here is... So 27 is escape. We'll talk about that a bit later. Eight is a good one, that's backspace. So you think you've made a mistake, and then you press backspace, and basically this is a prank. Bombs are always a prank. But anyway, it redefines certain keys if you cat this to your screen, and maybe you don't immediately realise this. There were many different variants of this. Some were sort of weird, and you maybe didn't even touch that key, so you didn't know it happened, and then later on you randomly press it. So this wasn't really considered a real security thing back in the day, but it's kind of amusing, because it's a predecessor to some of the things I'm going to get to. So yeah, probably bad deleting your C drive. And this worked, as you can see here, this was on DOS 622, I demoed this, but it worked all the way back to DOS 2 if you loaded the ANSI Sys Driver, which not everyone did, and there were also secure versions of the ANSI Sys Driver, but obviously this was the 90s and the 80s, so CVEs weren't really a thing, and stuff like that. So, you know, some of these attacks that I'm talking about are older than you may realise. So let's go to the 90s. So this was from FRAC in 1994, and it's a utility called flash.c. And so it says here, it's intended to quickly mess up a user's terminal by issuing a talk request and sending special characters, and it says it's really nasty. So let's have a look at what that actually is. So it sends these evil strings, so I won't go into exactly what they all do, but one of the ones that I mentioned earlier, and was the limiting to the top 10 lines of the screen. Well, this is limiting you to the top three lines of the screen, so already that's quite annoying, because you've got a really large terminal and you can only see three lines. It also inverts the background colour. One of them is a deck specific sequence that sends a test pattern to the screen, which basically means it fills the screen with ease. So, yeah. But just a quicker side, this, you see that says slash 033. So that's octal, so 033 is actually 27 in character numbers in decimal. So there are many ways to represent escape. I've already in this presentation shown free at the top, but you can also use JSON and Stockstalk mentioned that you probably should escape certain output to the screen using that. So, yeah, you can do that in JSON. If you're writing stuff in Go, then it doesn't do C-style string, so slash x1b, and in some cases just slash 27, and we'll get to some other variants on this in a moment. But yeah, so if you see this in various different forms, just be aware that there are many ways to represent escape. So, hello Defconn. This is a VT520. My dog also says hi. So, November 1995, this was released. Now, Windows 95 was obviously released before this, so this was new-ish tech for the time. It did some fancy things, but in the terminal world it was new. In the real computer world, most people are actually using X terms, and if we go back to this flash.c it says in the middle that it's actually expecting to target an X term. But let's just be time-appropriate here. So, what happens if we simulate receiving flash.c terminal DOS attack? I'm just going to have to switch inputs. This is going to be a bit crazy, because I thought I had this video copy, but I don't. Sorry, this flickers both because the video recording of this is kind of bad, but also there's an issue of the projector. But what happens is the screen goes blank anyway. So, this is kind of annoying. So if you send this to a real terminal, a reboot of it takes several seconds, so you literally send escape and see, and a real terminal breaks. If we remove the escape and see, and we send that, then we see roughly what we would have seen in X term or another terminal. So it starts flashing a lot and inverts the background. And now when we start typing, we also see our characters are not the normal characters. So there's a special alphabet that is designed for box drawing and things, a bit like we saw the PC had its own. So, yeah, we then went and reset, and we can see what happened. But notice reset didn't reset the fact that the screen was inverted. So this really messed up your terminal, send these things to the terminal, and it's kind of broken. So, yeah. So, let's go to 2003. So HD Moor did some research and published this article in bug track and poor disclosure at the time. Terminal emulator security issues. And now this is some of the first proper research. CVEs were still relatively new at the time. That's in quotes because it was rather CVEs. It was actually CANs. It's just going to go blank for a second. So these were CANs, and they later became CVEs. Is that going to come back? Let me just type XR on our commands for a moment. So, yeah. So this was among the first published CVEs. And so one of the ones in here is about window title reporting. So I've mentioned this in some previous talks. Sorry if you've seen that before, but I think it's important to repeat some of this. So what does this look like? So if we print something to the screen, like I showed before, you can print escape sequences to change positions on the screen and move things around. This is a special escape sequence to set the title. So your shell prompts will often include the command to set the title, for example. So what happens if we set it to CalchiXE? Well, that's not bad. But some terminals have a special sequence to ask for a reply of what the title is. So you ask for what the title is, it replies with what the title is. And so then this looks something a bit like this. Which one are we doing? This one. So, yeah, so we do something like this and CalchiXE opens back here. So it's literally that simple. But, yeah. So this is interesting. This wasn't an old vulnerability. I just ran that against ConyMU, which is a Windows terminal. So that vulnerability from Xterm also exists on ConyMU, and Swiftterm, and Westterm. The ConyMU is the most concerning, though, because actually what I did back here, if you look closely, is that I'm going to press enter slash X0D, which is also known as carried return. So in this case, I didn't have to press enter. The terminal pressed enter for me. That makes these attacks much more scary. It's either before you had to social engineer the user and pressing enter somehow, but it turns out, actually you don't always have to do that. So there are other ways to deliver this. I use printf. A user running printf is a bit like someone in a JavaScript console. Ask them to open the JavaScript console and attack themselves. But you can run curl on things. Curl is just like cutting something to the screen.  You pipe it to shell and it says I am evil. Down at the bottom, I've piped it to cat minus V, so you can see what's happening. Actually there's a comment and then a lot of backspace characters. So basically what you see is I am good when you cat it, but what the shell sees is I am evil followed by a comment. So you can basically make the user run one, see that they're going to run one thing and then run something different. This is actually kind of interesting because some recent attacks in the past year were called Trojan source where people used Unicode to achieve similar effects in text editors. So these kind of things have been possible in basically anywhere you have text. Sometimes text is not just pure ascii. There are other things in it, escape characters, Unicode, right to left, overrides, other things. So these things can apply in various ways. So cat minus V is considered good. In the 80s, the original Unix people from Bell Labs wrote an article called cat minus V considered harmful that cat shouldn't have any command line options and it should be its own thing, which is kind of amusing. But cat minus V is a good idea. Anything that can potentially write raw text to your terminal is harmful, so you can pipe it to cat minus V and see what's happening. Alternatively, the program itself, if it expects to print to a terminal, should just do the escaping itself. So if you use curl, what else can we do? Well it's always DNS, isn't it? This is a bit crazy, but it turns out you can put lots of things in DNS. So the easy place to do this is text records. I can put stuff in text records. But it turns out I can also, in many cases, put funny characters just in the host name itself. The interesting thing about that is depending what libc you're running, it may or may not resolve. So what I'm sort of proposing is a slightly crazy delivery method here is someone finds out that they can't access this host, but someone else says they can. So they start debugging it. And it turns out that on Alpine you can ping the relevant host because it does follow the C name chain to the crazy thing. But glibc doesn't. Actually, due to an unrelated vulnerability, I actually made OpenBSD change their behaviour. So OpenBSD older versions for about 7.3. Newer versions, it doesn't. You can also use this to tell the difference between macOS and Windows, potentially. So I reckon there's some fun things there. Anyway, that's kind of an aside. So what can we do with this? So Windows terminal, it turns out, supports some kind of music thing. So, yeah. Let's see if we can make this work. I just... I'm not going to work because I don't have any sound. Yeah, okay. So, yeah. Because I've changed the device here, that sound output is not going to work. But anyway, so you run that in Windows, and it turns out it starts playing music here. Which is kind of fun. But what did I just actually show you? Well, I showed you that if you run NSLookup, then it actually just writes raw things to the screen. So it turns out that this is a bug. So, for example, you have a bug in a tool called Commander, which actually is based on ConyMU that I just spoke about. So here we are. We just do an NSLookup on ConyMU.Lab. So, yeah. The interesting thing about this is... The interesting thing about this is I previously disclosed this as a bug. But actually this still works on the fixed version. I had a bit of discussion with the author of ConyMU about this. But if you look very closely, I'm using control O here, rather than pressing enter. So it turns out what the author did to fix this originally was look for carriage return and line feed.  Yeah, it runs... When you press control O, it actually is bound to a history add and accept, which is the same as pressing enter as far as anything is concerned. So, yeah, that's a thing. So... Sorry, I'm going to have to speed up slightly because we've got a few more of those to come. So we're not done with DNS. It turns out there are other tricks you can play with DNS. So... Apple terminal is actually relatively secure. I looked at it for a while and didn't find anything. But it does have a way of setting what your working directory is. So the way this works is the same way that I said that a title integrates with your shell prompt. You also integrate with your shell prompt and send the terminal a hidden escape sequence that tells it what working directory you're currently in. Which is, you know, that makes sense. It's useful to tell your working directory you're in because it turns out up here you have a thing that tells you that you're in either the temp or your home directory. And it gives you a pretty icon of your home if you're in your home directory. Anyway, if you actually read what's happening on the slide here, so I can print users DGL. First of all, that works fine. I can also, it turns out, put a host name in the file URL. And over here, on that file URL. So it's not like the end of the world, but it's an information leakage thing in that if I for some reason connected to a server that maybe doesn't have access to the outside world but the computer that I'm connecting from does, some malicious thing on that server could write something to my terminal and then it could actually through DNS tunnel it back to wherever. So you can use DNS as an actual exfiltration method via the terminal that some user is connected via. So I reported this to Apple in, as you can see here, October 2022. And I unfortunately haven't fixed it yet. So they're quite past the disclosure deadline for this one. It still works as far as I'm aware. I haven't tested the very latest version. But it turns out there's also another bug, which is kind of fun. If you actually get to about 1024 character somewhere around there, when you open a new tab, what it tries to do is change into that directory. And this sort of CD command you see on screen here is what it wrote. So it does that sort of for you. It turns out if it's longer than the allowed directory name length on macOS then it just hangs the entire terminal. So it's kind of a bit like a sleeping time bomb in that if you run that then the terminal time someone opens a new tab will just hang and they won't actually know why. The one saving grace there is if this actually is integrated for your prompt, the next time the prompt is displayed it will clear that and then it won't work. So it's not the end of the world. So back in HDMor's paper in 2003 there was a fictitious case study and it spoke about Apache locks. What's more relevant today? So developers run things like python free HTTP command lines. And if you saw stocks talk I'm afraid this is basically the same demo. But which one are we on? There we go. So we've got an attacker down here and a victim up the top. We can't put escape characters in via just using curl, but if we write raw to the screen sorry the screen, if we write using netcat we can write things and it turned out python didn't escape the log file. So we can change the colour of the logs. That's kind of fun. So it turns out if we've got a terminal vulnerability we can do things with that as well. This is item 2. The vulnerability was that it would reply with a user controllable string. So what it's supposed to be used for is querying the colour. So here it's telling us that the colour is 31M red. I just changed the colour back to the default colour and it says it's 0. But it turns out if we put something else there then it replies up here with something else. And it turns out that can be anything else. So the real insight is that we can put control C there. So by putting control C there it will basically kill python. And at that point we can run anything we want in the terminal. So we put control C. Because of how this works in item 2 we kind of have to split each control character into its own escape sequence. But it turns out python just doesn't care what the HTTP request looks like. So we can just really put any characters we feel like in the request thing and eventually calculator pops up. So that was a bug in item 2 that was fixed. And as I mentioned the request selection or setting which is a depth specific escape sequence was used for querying the color and thing. There was an implementation bug in that. And it unexpectedly echoed a string back. Control C is also a part of a string. So we can press control C. And I call this a full echo back. So how about another one? So this is the git for windows. Also known as git bash. So here we're cloning a git repository. We're going to this git repository. We run git log. So what does git log normally do? Git log opens calculator today. So if we pipe that to cat minus v we'll see up here it says just below is an escape sequence or own you and that's actually in the commit log of this git repository. And it's also a cross platform exploit as you might notice because this is actually the same bug as the item 2.1. It's a new user. So this is a tool that you can use to access. And it turned out on windows was vulnerable to this. So yeah, sorry, slides loading slowly here. But we'll get there. So yeah. So git uses less as a pager and less had a bug in it's OSC 8 handling. Mae'n dda i dda i ddim yn mynd i lles a ddim yn y terminol. Dwi'n d din i ddim yn shawdd i wneud gyda'i gyda am y byddau mynd i ddim yn gyd, ac mae'n ddim ddim yn mynd i ddim yn mynd i chyfnodol cyfwylo gyda lles. mae'n ddim yn mynd i ddim yn mynd i chyfnodol cyfwylo. Dyna nhw yn ddim yn mynd iddynt, rydyn ni'n ddim yn lleu doennwyd o'ch byddag teithio, mae'n ddim yn mynd i'n ddim yn lles i ddim yn mynd i'n meddwl geistrae. Felly, here, this ended it as far as Mintity was concerned, but it didn't end the escape sequence inside the OSC8 as far as Les was concerned. The funny thing about this is, this bug was disclosed earlier this year. In the posting of it, I sort of said it was a denial of service attack and then later on I worked out actually, this can also be used for a bit more when I found a terminal exploit. I don't know if anyone else noticed that, but anyway, so we're getting a bit long time, so I'm going to run it a little bit faster here. So basically this deck RQS thing I showed was actually an external bug, and it's funny because it was documented incorrectly in the external manual of control sequences, and then various other terminals have recreated similar bugs. So let's just go to a slightly different thing. So we've got a shared system. Administrator gets an alert about excessive memory usage, starts debugging. What command do you run? Top, someone said. Good. So what if there was a bug in top? Which video is it? That one. So here I've got top, oops, that went too quickly. Anyway, I've got a script running on the, sorry, we'll try that again. I've got how short this video was. So here we're running top minus capital O, sorry, minus O, capital res, and on the left-hand side we've got a little script running. And what just happened? Well, you got owned. So it turns out this is an external bug in its optional graphic support. So basically we can do something like this. So we can get escape sequences into top. Regis is a particular graphics thing that digital invented in the 80s, and some of their terminals supported this. So if you tell X term to run in compatibility mode of one of those terminals, and then you print some special sequence, it replies with something like A1 equals XXX, and the exploit essentially is you can build up a, you don't get very many characters, but you can build up an environment variable if you run about 10 different processes. So it's a bit obscure. The X term Regis support isn't default. Some distributions enable it, hello NixOS. But top 3.X doesn't do escaping. 4.X does. Very few distros have it. I failed to convince the top authors that this is a security problem. As far as they're concerned, there are other ways to spoof things in top. So it's actually the terminals problem. And this can also be used as a docker escape.  So potentially there are other avenues to this. But we can also attack Kubernetes here. So let's have a look at Windows terminal. So this is Windows terminal. Here I'm just running busybox and deliberately running this as a nobody user. So this is, you know, not, no special privileges here. But there is this interesting file called termination log. And so if we write an exploit to termination log, and then actually we just exit, for whatever reason, this container has just died. So the administrator starts debugging what's happening here. So how do you debug Kubernetes? You run kubectl. So there's this pod running. It's just said it's restarted. So maybe the administrator got an alert, it restarted or something.  And then nothing really happens. There's no message, which is a bit strange. But yeah, the victim over here doesn't really know what's happening. They start debugging a bit more. So they decide that they're going to duplicate this tab so they can have more context. So this was, I'm going to skip that one. So that was a Windows terminal bug. But what can we do with documented escape characters? Well, it turns out there are certain replies that do interesting things. So if, for example, we ask what color something is, colors in some terminals are separated with slashes. And where can we find lack of escaping? So we can create, put files on disk and see if things do that. Turns out NMCLI on Linux, if we happen to connect to a wireless network with an escape character in it, will happily, I've got a network at home called Red. It was actually the color Red. Bluetooth CTL on Linux mostly doesn't escape things. Some of these are hard to exploit. You don't get very many characters. But like I showed at the top, you could maybe create lots and lots of devices or networks or something.  See stocks talk for more on that. But let's have a quick demo. I'm running out of time, so I'm going a little bit faster than expected here. But here I've got a script that sets up a particular thing in slash TMP. And so now I'm just typing CD slash TMP. And I hit tap like you often do, right, to see what's existing in that directory. So when I hit tap, what happened? My cursor disappears. That's strange. So I'm not sure what happens. I press control C and then I hit enter and everything goes red and it all gets a bit broken. So what just happened there? So the slides for this will be up later. I'm going to skip this quickly. But basically you hide the cursor, you ask what colour it is, and because you're in a control directory slash TMP, you created a file that the shell printed out on screen and basically, magically, the user basically has to hit enter. You make it, there's a scape sequence for X term that makes it so control C, just writes some escape characters to the screen. So there's literally nothing you can do except close the terminal or press enter. So you're social engineer, the user into, they probably press enter because they think their terminal is broken. So how do you protect yourself from all this? So terminals are just like a browser. They deal with untrusted input. Ensure correct output escaping, see this talk, stock talk. Secure settings. That's a fun one. If you use itone 2, just go and turn this on right now unless you actually use the shell integration features that might be bugs there. Who knows? Also ST is a cool terminal. You should use it. It's like really basic.  There's probably some end days here. So I'm crazy and if you've got a phone or something, try a sage into that particular IP address. It's on the Defcon network. It will test your terminal. And I want to make this repository public. How many buttons do you have to press to do that? Really? Anyway, so I just published that. In writing that tool I found another bug. That's all the bugs I found. Thank you very much.


Hello everyone and welcome to Black Star Potential. My name is Lee Fuge and I'm here today with MGRmusic.com and in this video we're going to learn the remaining four shapes out of the five shapes of the minor pentatonic scale. If you haven't already learned the first shape please check out the video on the Black Star YouTube channel which details this shape. All of the notes and the theory from that video are transferable to this video and what we're going to learn today. All of the tones you're hearing in this video are coming from the Black Star IDCore V3 which is mic'd with the Luit Audio LCT 440 condenser mic. The amp is set on the clean bright voice with the ISF all the way to the American side. So in the video where we talked about the first shape of the scale I mentioned that the pentatonic scale is made up from just five notes. So to keep this consistent with that video we're going to talk about these shapes in the key of A minor today. So as a refresher the notes we're going to be using are A, C, D and E and G. We also referred to these by their interval numbers which is 1, flat 3, 4, 5 and flat 7. Once we've learned all four of these additional shapes I'm going to show you a little method you guys can use to quickly map out the position of each of the subsequent shapes all around the fretboard. The reason this is useful is when you start to build your lead guitar vocabulary and you go into playing more complicated solos you want to break away from this first position box. It's super easy to get stuck in this position as a new player but all of your favorite guitar players if you watch them play they're probably flying around the fretboard and playing notes all over the place. So having the ability and the knowledge on how to break out of that first pentatonic box is very useful and it will give a lot of benefit to you as you start to develop your own lead guitar skills. So we're going to start off by learning the shapes and then like I said I'll show you a quick method you can use to put them all together and find them very quickly. So here's the second shape so we're going to be playing 8 and 10 on the low E string, 7 and 10 on the A and D strings, 7 and 9 on the G and 8 and 10 on the B and E. So here's the second shape ascending and descending. The third shape now we're going to start off by playing 10 and 12 on the E, A and D strings 9 and 12 on the G, 10 and 13 on the B and 10 and 12 on the E. So here's the third shape ascending and descending. Fourth shape now we're starting on the 12th fret of the low E string so it's 12 and 15 on the E and A, 12 and 14 on the D and G, 13, 15 on the B and 12, 15 on the E. So here's the fourth shape ascending and descending. And finally the fifth shape we're going to be starting up here on the 15th so we're playing 15 and 17 on the E and the A, 14 and 17 on the D and G and 15 and 17 on the B and E. So here's the fifth shape of the pentatonic scale ascending and descending. Now each of those minor pentatonic scales are directly related so here is where the little tip comes in. Once you've learned all five of those shapes you need to start putting them together and as you start to build different lead guitar solos the ability to mix shapes will be very very useful in moving around the fretboard. So in order to understand how these things fit together we first need to think about those five notes once more A, C, D, E and G. Now you just saw me play a couple of different scale shapes moving from the 8th fret right up to the 15th and 17th frets so I covered quite a lot of ground there but I was still just playing five notes. Every note you hear there was an A, a C, a D, a G or an E so this is why minor pentatonic scales are great because not only do they allow you to move on the fretboard but they're also great for your fretboard mapping knowledge just by knowing that that's simply five notes. I now know those five notes all over the guitar when I understand how octaves work I can then map out the same shapes in higher registers for instance the fifth fret is an A note as is the 17th fret so I could actually take that first shape I learned last week move it up an octave and play the same shape from the 17th fret. Now the hard part is learning how to remember these shapes and where they all start now A is a great key to start in because it's quite easy to map the fretboard in the key of A minor obviously as you move this into different keys you're going to face different challenges but the same principles will apply so A minor is a great place to start so let's once again take those five notes A, C, D and G. Once you've learned the pentatonic shapes so the form of each of the shapes so first the second the third fourth and the fifth learn them as patterns then you need to apply them based on their position to the root of the key so that's this first position first note this A note here is almost like my home note this is where it all starts and this is the point that we should relate everything back to I think when you're learning scales and you're learning mapping on the fretboard it's really good to have a home point to pull everything back to so once I've memorized all five of my shapes I now need to lay them out in a way that they're all relative to this first note so here's a little tip which is great for speeding this up if we take those five notes A, C, D, E and G and I lay them out along the low E string A, C, D, E and G what I've now done is I've actually given myself a starting point for each of my five scale shapes so as long as I know what the five notes are for whatever key that I'm playing the minor pentatonic scale in I can lay those out on one string the low E string and those are the starting points for each of my shapes now the great thing is because this is only five notes what we're essentially doing is each time we play a new shape we're playing the same five notes but we're stacking them from the next note in the scale so for instance the first shape A, C, D, E, G that's from the one one flat three four five flat seven that's the first five notes of the first shape if I start from the eighth fret what I'm actually doing is I'm playing the same notes but I'm starting with a C so I'm playing C, D, E, G and A so now I'm just playing flat three four five flat seven one playing the same notes though my third shape I start from a D so I'm going D, E, G, A, C so I'm doing exactly the same thing but I'm starting from the fourth note of the scale so I'm doing four five flat seven one flat three as you can imagine the fifth shape now is the same thing but I'm starting from an E note so it's E, G, A, C, D and the fifth shape I'm starting from a G so it's G, A, C, D and E so each of the subsequent shapes starts from the next note in the scale so as long as you know what those five notes are you can very easily move them around now because I know that the fifth note of the scale which is my flat seven is a G I can also take that fifth shape that I learned and I can put it here from this G so this allows me to not only go above my first shape pentatonic but also below now again going below the pentatonic shape is easier in certain keys than others A it kind of works in because I'm quite low down the fretboard but if I'm in a key like C for instance where I'm playing C minor from the eighth fret I've got a lot of room this side and I also have a lot of room this side so I can extend my pentatonic up and also backwards thinking this like a rolling sort of note scale like a piano it just keeps going I can infinitely extend my shape either direction as long as my fretboard allows it so certain guitars if you've got 21 frets or 24 frets you may find you lose a couple of notes from one shape it's just one of those things the different guitars will give you different capabilities so when you're practicing this kind of thing make sure you know the notes on the fretboard refer to the fretboard diagram in the written part of this which is on the black star website look at the notes for whatever key you're playing in I'll write this up for you in A minor so you can see it laid out the way we've talked about it and then try and apply this principle to some other keys as well take a minor pentatonic scale in whatever key you want learn what the five notes are lay those out along one string and there are your five starting positions for each of the five pentatonic shapes so there you go there is an overview of all five of the minor pentatonic shapes and a little trick you guys can use to quickly find them all around the guitar so hopefully that really starts to open up the fretboard for you now and as you start to dig deeper into your lead guitar playing these tips will help you expand beyond that first pentatonic shape thank you guys so much for watching hope you've enjoyed this lesson let us know down below in the comments what you thought how you've gotten on with this and if there are any other topics you'd like to see us talk about please put them down below as well don't forget to check out black star amplification on youtube for more free lessons just like this and if you're looking for a guitar teacher please head to mgrmusic.com check out the music teacher database there are a great network of teachers all around the country waiting to help you guys out thanks so much for watching and i'll see you soon


Blockchain is about empowerment of the people. It goes to the grassroots society to make sure and guarantee the benefits to the producers, to the community. IOHK is in Ethiopia now to train class of 22 young Ethiopian women and 4 Ugandan women and the idea is to train them in Haskell and if they succeed to employ them. There's a problem with believing in Africans as developers. People would rather outsource their technologies than trust in us who have done four or three year courses to develop for them their software so that's a really really big challenge embracing technology and also believing in ourselves to develop softwares. Being able to build these transparent and decentralized systems is a big privilege and a great opportunity for me and when I heard about it I heard that experts that are working in the field are coming to teach us so it's something that we've never had before so it's pretty exciting. The blockchain community as a whole agrees that Africa is an incredibly exciting region because there aren't legacy systems in place because this technology is cheap and that's obviously attractive to the continent but which problems to solve and what appropriate solutions are is often much harder and it's a lot harder to do if you're asking these questions or coming up with these ideas from London, New York or San Francisco. I think it's very important to actually go somewhere to really experience it. I mean of course you hear about the challenges in developing countries like Ethiopia but to actually experience it first hand is a completely different story the traffic, the internet, the infrastructure and so on. So by doing this training course here and training this group of developers we're going to have people who understand the technology understand how to build solutions on it but crucially also understand what problems we should be building solutions for. The use are open to new ideas and new development. Creativity comes mostly when there is a problem. A very good example on the African level would be coffee farming. There's a lot of participants involved in this sector. There's the producers, the manufacturers, the processors, the suppliers. So the fact that you can keep track of your coffee from point A to point B to point C you could keep track of everything that's happening to the produce. The most important thing is identity to the products. And when we have a record of our activities and how our production is going through which levels it goes and who are the consumers and what is the price over there and who is really benefiting. And coffee farming is just one example out of all the many that we could apply blockchain technology to and this could impact people's lives. I'm personally interested in the health sector because I have friends that are working as doctors and nurses and the like and usually when referrals are made to governmental hospitals they don't have full records, full medical history of the patients. Things like this I feel can be tackled by blockchain technology. To my country Uganda recently there is a big problem of land rangers. People keep on buying land more than once. So if at all we put this system into blockchain and everything becomes digital I don't think our country will have the same problem again. For me incorporating blockchain into all these sectors would be a really big deal. The fact that we wouldn't have one elected party controlling the system but a whole lot of transparency for all of us to see what's going on. I love being here and hearing all about how blockchain would affect various aspects of the economy in this country and perhaps throughout Africa. So it's really cool to be part of the conversation and be part of making it possible. These are all really interesting projects for which there's huge demand across both government and private sector. So when it comes to IOHK deciding what technology we're going to be building baking into Cardano and other products this information is definitely being fed back. We're looking to build solutions for these problems all this year. I mean I am the teacher and I'm here to teach the students but actually it's also the other way around that I by being here learn a lot and a whole new appreciation for how important our work actually is and what blockchain can possibly do for these countries and these people. Yeah what I think the role of IOHK is there like with a Haskell training that is happening right now is to really bring or add to the curriculum that developers get in the universities like in this line of education because universities are not that fast in adopting new technologies even though of course there is some research happening there are new things also being developed at universities but they're often disconnected from the private sector so this kind of I would even describe it as a collaboration between public sector and IOHK because yeah you just create more value for the educational system on the one side and you create value for IOHK so you can reach out to a large community that's at the end of the day what you need you need people here on the ground who are working on this topic who are working with this technology and therefore it's a great job. Emerging technologies are attractive to young upcoming youth I read a statistic somewhere that 70% of the world's youth in 2050 will be in Africa and a significant portion of the young so this is an opportunity to target those and there will be a lot of opportunities around that what's lacking is not the technology what's lacking is the know-how but I think if we can solve that there could be massive amounts of leapfrogging this is not about ketchup this is about leapfrogging so maybe the next best thing in the world will come out of Africa. I'm really impressed by the student's attitude the eagerness to learn and so on but it's more than that I mean it's really humbling how how much they sacrifice to be in this course I mean there are students who left their children behind with their family for two months just to be able to attend this course others quit their jobs or basically put their university degree on hold just to be able to attend so this really puts a lot of pressure also on us as instructors in a good way I mean because it really shows how important this is and this is not just some exercise so it's incredibly exciting for me to see the progress which this course really represents when I moved over here first in maybe February or March of last year you know we had a lot of ideas I was having lots of conversations with Charles about what we can do and to see this incredibly ambitious plan now for 2019 with huge rich house cross dozens and dozens of countries real education programs working both through iowich k-led courses and also accreditation with universities and the capacities actually build solutions through the teams that we're building out and hiring here I think it's going to be a great year and I'm looking forward to seeing seeing with the Holt. I'm really extremely happy to be here because I love teaching and I love education I love high school I love mathematics so it's already great working for iowich k-led I can do all these things but combining that with with the chance to actually help people improve their lives and really make a difference that is I can't think of any better thing to do I've loved mathematics and programming almost my whole life and I love working with mathematics I love working with computers and I love teaching but all of that is somehow dwarfed by what I feel now being in in Ethiopia here and and actually having the chance to to really have an impact on on so many people's lives so this is like a great conclusion I mean I feel I'm almost as if all my training all my university years everything built up to this point where finally I'm in a situation to to give this class and and share my knowledge with people that really can use it to to change the world for the better for me I want to see a world that's controlled by technology not only Africa but the world


This is Bill Doyle on Vermont Issues and two special guests is Wanda Brill who won a recent award and we'll be talking about volunteers and Selfie Kirsten who's known for the penetrating questions Let's start off with Wanda and talk about the why why did you what does the word that you received talk about the award that you received? one night and This voice on the phone said You know I'm so-and-so and I have some news for you and I said oh really because I thought it might be Somebody who's wanting to sell me something.  I said well, what is it and This voice said well, I'm here to tell you that you've been awarded the citizen of the year by the Montpelier Rotary Club and I said you're kidding and He said no, I'm not kidding. I said are you sure you're not kidding? I said I don't even belong to Rotary So I don't know why I won an award. You're a citizen of Montpelier and very well-known, but go ahead so so he talked to me about it and He said well, we'll get back to you later, but he said we will be having a lunch for you at the hotel and I'll tell you more about that later on. I said, okay So I hung up the phone and I'm sitting there going Did I really? Hear this is this real or is somebody picking on me? and so I went to sleep and The next day I came to work and I didn't say anything to anybody because I'm thinking Well, maybe this isn't a real thing so About five days later, I said to my my manager and I work at United Way That this had happened and she said really oh That's exciting and I said do you think it's real and she said yeah, I think it's real so Then I got small phone calls about okay. You need to be down at the hotel And this is what I'll tell you talking about the one in Montpelier Yeah, Frederick Sheriff's Hotel and so I Went and here were all of these people that I had never I've seen But it's been years since I saw some of them some of them are you were just High school boys when I knew them and here they are all grown up So I'm going around talking to everybody and they had a wonderful lunch My daughter was invited and she came Which I didn't know whether she was coming or not and So it was just a fine fine affair and they presented me with a plaque and The reasons why I was chosen let's go into those reasons The plaque is still being worked on so I don't have it with me but it was all the different things that they had gotten information from about Things I had done in the community I'll talk about them a little bit later and any questions at this day Sophie Well, I'm I'm right with you. I want to know what the plaque says So and and it's it's a big plaque, you know like this and The fellow has got it framing it. That's what he's doing. So One I can tell you that I'm very active in the Red Cross and I Am on the disaster action team Which means that? if my phone rings at one o'clock in the morning and Somebody says we need you there's a fire How quick can you get here and? Usually there's at least two of us from the Red Cross that go together Because they don't like one person going on its own So that could last for maybe four or five hours You're working with the firefighters. You're you know doing what they want you to do Like can you help somebody out of the house? Somebody's in the ambulance and their blood pressure is going down.  You can't just go do it So I had been trained to set up a shelter if we needed Remember when we had the hurricane? Everything We needed a lot of help well I opened a shelter at the Berlin elementary school because that can be used as a shelter Yeah, and there's a lot of things you have to do to do that You can't just open the door and say come on in you have to take information You have to fill out forms you have to make sure that nobody's sick that everybody's okay and I didn't know for sure exactly how long they would be there Yeah, that was a big question and you have to Feed them and so there's a lot of things involved in something like this to do this and our Red Cross members Basically are In the Washington County area We do go outside that area if they need us but the Red Cross folks Down in the southern part of Vermont and also in Burlington will tell us those things so We can figure out where we're supposed to be and what we're supposed to do Then I'm also on the the town of Berlin Emergency management team, which is a different team. We meet once a month and we talk about things that in Berlin Are we ready for an emergency? Do we know what the fire department is doing? hopefully Their new chief is going to be meeting with us every month, which will Be good for communication But what you never know when these things come along so I've learned a lot that way and then We've just started a new program in central Vermont, which has to do with rescuing animals and We're just beginning to get that started so it's Interesting but we haven't learned everything we need to we have to take tests that the state has and If we don't pass the test then we have to take it again So it's a it's a complex but a very rewarding kind of volunteerism Which I never thought about when I first started in doing volunteer work I was working a national life, and I think my boss said wanted they need somebody to Go down to the state and be on a board Which is true, and I said well why me and he said because I think he'd be good so off I went and It was a it was a a board that was talking about education and What we needed to do and how we needed to do it, and I didn't know everybody on the board. I felt like I was kind of What do I say? Kind of thing new kid on the block. Yeah, and so that's when it started and I have probably worked at national life for maybe I don't know 15 years or so when they asked me to do this they also asked me if I would like to Work for United Way as a volunteer Because two or three other people at national life were doing the same thing. So I said, oh, yeah, that might be interesting so I went and got acquainted with them and There were several people on the board and at some point along the way I There I was asked to be on the board of directors So that was part of my learning about United Way. What do you do? How do you do it? You know, I know they raised money, but I didn't really have a lot of Information about it. Can you give us a small snippet? Maybe of what they do and what your part of it is when I When I yes, when we raise money we go out to the general public and We work in the three northern counties Caledonia Essex and it's one other one up there in that corner and then Washington County and part of Orange County so we go to a a business and we do a sales pitch Honestly and Ask them if they would like to help their community by giving money So that's how it started Basically, and then that money goes to teaching fiscal responsibility is that money goes to part of it to People who need money for whatever I mean, we don't just give it away Without having it have an impact like it could be on children It could be on homeless people. It could be but it has to go to a Non-profit organization that's working with these people we don't actually go in and Work with the people unless we're asked to help right the managers or whoever is Is dealing with the people what a wonderful resource? so it is and I may be able to get in a little bit later to how much we've grown this past year or or two so then I'm also involved what's called the local Emergency planning committee and we meet every other month and our job is to make sure that for instance, Washington County Is ready for any kind of an emergency that comes along and we have to put that in writing as by-laws Mm-hmm, and we're just redoing them now and the people that serve on that committee might be your police Person Might be the fire department It might be somebody from Burlington who is doing a program up there and can help us So it people can just come and be at the meeting and ask questions And say here's a problem. We're having in Plainfield What do you people think? You know the the river runs over constantly One person died because we think she fell in the river And so you get a cross-section of what towns are doing and the help they need We do get some money from the state to help us with some of the things that we want to do and That is just getting together talking to each other Trying to help solve problems and making sure that we're capable For instance of an airplane crashes at the airport in Berlin Can we get up there and help them? Is the hospital ready to take them in? Yeah So you've got a wide variety of things that go on in Maybe a day or a month or a week You know, I could go out on calls every night of the week if those calls came into us Through the Red Cross. It just it's just you never know So you have to kind of be ready Like we have vests that we wear we have pictures of ourselves and Badges that we have to wear Order that people know who we are and that we can be there a good example would have been when the Truck went off the road in middle sex and caught on fire. Yes. Yeah, that's where Sophie limbs I drive by that every day We were called out at about midnight to go and and help now help in this case was not To try to get them out of the vehicle But to serve hot coffee Something to eat for the people that were working there So again, that's a whole different type of thing that we do exactly Sometimes some of our people go to the hospital to be with the family To say We'll be here for you. Is there anything we can do for you? So that's another realm that we look at But this local emergency planning group is the one that meets every other Every other month and we try to figure out are we capable If a plane crashes at the airport of helping and do we know enough to do that so it's It's Constantly doing things and learning We the state brings in people from out of the state To do a day seminar for us Let's say and this one that I went to happen to be How do you know what to do if the train goes off the track? and That just happened in Canada big big one, right and and so how do you handle that? It was like the one a little bit over in Northfield that slipped off the track maybe a couple of years ago or last year. Yeah Like okay, how do we know? Where the fire is gonna go if there is a fire based on the wind And they'll teach you how to tell which way the wind is blowing But you start at eight and you end at five thirty and by that time You're you've got books and manuals and all kinds of stuff Back to school basically as a volunteer well, so if you and I congratulate you for your volunteerism Truly and and why is involuntary so important in our society well right now the United Way is working up in the Northeast Kingdom and We're finding that it's so important because we're volunteering up there I mean I am I don't work up there but if somebody came that was a volunteer they could go up there and and help people To pay their bills to do things some of these people don't don't know how to set up a budget Yeah, it'll come to us and say I don't know how to pay my bills. Yep, literally so that's one thing that United Way does with its volunteers now two weeks ago We had volunteers for one of the local businesses and our staff went up to a place here in Montpelier and Took their garden all apart. We did it. We sent all the plants and it's a an Organization a nonprofit who keep people that need help, you know because they're by themselves or Or something like that and they sat on the porch and watched us do all this work in the garden So that's another thing that we do as volunteers and the company that Sent their volunteers was paying them like they were working right there in the company But they were helping these people to know that they don't have to look at weeds now They can look at flowers and and it's very very nice. Thank you. Go ahead Go ahead That volunteerism do you talk about its impact on my life also because When I was 16 and the world war was in Progress the shortage of men and women and so the fire department asked where I'll be a and others my age If I would be a volunteer for him and so So so that that's how it in fact got me started my life and And whether men many other advantages. Yeah, I'll continue your story We that that brings up a good point is that we still do have volunteer firefighters And we do have volunteer police who are in training maybe to do something So that still exists. It just doesn't get maybe talked about as much so the United Way is is building on that and and Encouraging people like the gardening we did to do things in the community as volunteers and It's beginning to catch on and spread. So it's a mention gardening Pardon. Did you mention garden? Yeah, well the garden that we were waiting okay, and So we do things like that Waiting is an essential part of gardening with our source of information itself. Yeah We're we're gonna do a big project over in Northfield Falls shortly a Gardening one. No, okay. They're building a playground for the kids That's great, and that was done with a promise money that came to us from the federal government and different places in like Barry could apply and they got some money and Several like Northfield applied and they got some money and it came from the federal government But they had to take that money and use it to better their community Doesn't matter How did they use the money to better the community? Well, the one I'm doing we're doing in Northfield right now that I know more about is because They are going to build the playground for the children There's going to be one near the library right in Northfield in the back part and I don't I can't remember what it's going to consist of but it's like a big a big House built in the tree, you know, the kids can go there and just play And the other one is going to be in in the fall to Northfield Falls, which is you know in a different place so That That's another thing that we can do So that's given me an opportunity to feel good about what I'm doing It's expanded my knowledge of all of these things I've learned and so That's why I really like to volunteer Well at this point do you have any questions you'd like to have Sophie? Well, I just am so excited to get to speak with you about all these things because it really You know following Bill around a little bit in his volunteer projects and meeting You guys both being citizens of the year actually for Montpelier at one point or another guy And the impact that his works and you know the groups that you have worked with The impact that they've had in central Vermont are huge. Yes And I remember like when Irene happened there were a lot of misplaced people And there was a lot of damage that people needed help with and without volunteers Things could have been really bad. Exactly really dangerous sickness, you know mayhem the whole thing And so I'm so grateful to you guys Because well it's growing too. Yeah more people realize that volunteering is not being punished It's being oh my goodness. Look at all the things we can do for our community And the wonderful people you get to meet and work with exactly that part You mentioned the community the community benefits from the volunteerism because they don't have the funds in many cases to do What they'd like to do exactly. Yeah Yeah Both self and I want to know where you went to high school. Oh, that's right. I I went to Williamstown high school.  So I went to to Williamstown high school And we had 25 people in our class. Wow. That was the biggest class the school had ever had What I said about now much more many more than that. Yeah, because they well they've actually merged with Northfield. Oh, okay. And that's been part of the recent publicity. Yes and indicate that's a major step that Williamstown made but also Williamstown has gotten a lot of publicity on the kinds of program they had. Yes, and you must you Got to be proud of what what the school has done and what they're doing Yes, they are and and it's hard to change a school So it takes time and effort and along with other kinds of volunteer things that you do It may not happen right away but the feeling that you get when it's done is A nice reward makes you feel good And I don't go around talking to people about what I'm doing as a volunteer necessarily Unless someone has to speak Yeah She's got to show up at one in the morning. I mean who knew important for the job is to show up Oh, jeez So it's very interesting and that's why I've stayed with it all this time.  Well, I started when I was still at national life and I'm guessing probably A good 40 or 50 years. I've been volunteering from day one when I was still working at national life To where I'm at now and I've grown and matured and And and it's just natural for me like like the Red Cross we go and put it in smoked structures Right To people's houses. That's huge. I'm unbelievable. Yeah, and people need it and and you meet 95 year old people that are as spry as We are right. You made an incredible case from volunteerism on this program already Yes, and if anybody is interested they can come and and call united way or Go to their local church Or anywhere to fire department. Yes, you go to the local fire department and say I'd like to volunteer You can because uh, they'll train you Is it there's a training that goes with that? Oh, I'm sure yeah We're near the end of their program, but isn't anything you'd like to say before we we end the program I appreciate being able to be on the program and to talk about volunteerism and to encourage people to volunteer to help and you don't have to Choose one thing or anything else They can guide you to Whatever you want to do. So so anything else you'd like to say? I'd just like to thank both of you for the immense amount of care that you've given to this community And I think that you know if anybody wants to have a fulfilled life. They should follow in your footsteps And I appreciate your efforts. Well, thank you. It's been a pleasure Is a pleasure That's right What you brought up Wanted uh, uh, it's a it's a very reason that you were chosen. I mean, yeah. Yeah. Well, I Yes, you're right Definitely, I think they're exceptional projects and I don't know see you have to be you have to be Kind of uh Somebody has to nominate you and I don't know who that was Today any final word before we close our program I think we've said it about all don't you anything you'd like to ask answer or comment All right, it's just a huge honor and pleasure to be in your guys's company and to get to hear of your adventures It's a pleasure. I applaud you. Thank you Well, you're welcome and I joined Sophie in the in her thoughts And again, thank you very much for being on the program and your credit to your community Thank you very much. I appreciate your thoughts and comments This is bill bill Doyle and and Sophie christen. Thank you for being on the program. You're quite welcome


Sup you guys what is going on welcome back to the channel welcome back to another video and welcome to rugby player reacts to Jarvis Landry the 94th best player in the NFL for the year of 2021 and really when I think of Jarvis Landry I think of the hard knocks series covering the Browns when he first came to the the team I remember vividly he Was at Miami came to the team came to the Browns Wanted to get the wide receiver core together in the film room and give them a little piece of his mind And if you saw that you know exactly what I'm talking about guys. This guy is professional He is clinical he is quick he is Surprisingly strong for his size among many many other things guys first and foremost I want to say thank you for being here. Thank you for the support I hope you enjoy the entire series, but before we continue there is one formality that needs to take place And that is a quick word from our exclusive video sponsor major key physics Stop guys. Thank you first and foremost for clicking on this video Secondly, it's brought to you by none other than major key physics and I'm wearing some right now Major key physics is a New Zealand based bodybuilding and fitness brand They have a complete range covering men's women's and accessories everything is sized from small to triple XL International shipping is always available. The products have all been designed with both aesthetics and Quality at the forefront with over a thousand happy customers and shipping worldwide There's no reason why you shouldn't check them out head down into the description box below check out the link www.majorkeyflex.com use code jacob20 for 20% off and Come and join the team. Thanks for listening and enjoy the video peace out So guys with all that being said It's now time to check out Mr.. Blessing Java slandry wide receiver for the Browns Whether you're ready or not, he'll make you ready Bless him Tell you what bang bang bang a hop hop right left. Yeah, that'll make you ready Lovely absolutely lovely Another player down a few spots, but still on the list and that's the main thing That is the main thing Don't tell you what don't mind a bit of Chris Godwin answer that Super Bowl winner So he's one of the guys that I watch like so this you know I have four guys that I like to give footage on Whether it's me trying to like take stuff from their game or just like out of respect of just watching them I'm like I love the way he plays See I tell you what I did make mention of this at the start of the series But the one thing that I really enjoy about this is not just hearing from the horse's mouth so to speak but more so hearing what other players in that same position or Possibly their opponents on the opposite side of the ball have to say about them Because the thing is you're not going to be included in this series You're not going to sit down in that seat in the hot seat in front of the camera and Talk badly about anyone.  He's snagging everything One hand to hand my boss goes, you know tops in the league actually that that is that's a bit of a consideration that I had Forgotten the sheer size of this man's hands He could have been a basketballer. He can palm a basketball. No doubt The shoots went down the middle and it's caught what I catch by Landry down the left sideline And it is caught a great catch.  Um, oh, I actually remember seeing this. I vividly remember seeing this It's not often you'll see a wide receiver with a hand size measurement of over 10 inches But Jarvis Landry is one of those guys. He ran a 4 7 7 40 yard dash. I'm gonna say I'm gonna say that was an off day. I'm gonna say he's definitely 4 6 28.5 inches on the vertical and 9 foot 2 on the broad jump 12 reps on the bench press Now I've seen these measurables before but they ain't the most impressive you're ever gonna see And my reaction last time was probably similar to the reaction I'm having this time But at the end of the day those pre-draft measurables Though respectable are nothing to write home about especially For an NFL caliber wide receiver, but anyways Just goes to show Just goes to show you dye your hair purple and you can do anything inside Outside he can run any route you need God, you know what? I I I really enjoyed that little snippet.   He's to the 30! 20! Go go go! Seven yard touchdown run!   So I I choose to go for strap backs Uh, but even then, you know, I'm right at the end of my um strap so to speak Although this is one of my best fitting hats. Um, just out of interest We have a really nice snapback here. It's um The oakland raiders it fits Which is a surprise But the biggest surprise is how many holes I still have to go Three so in honor of javis landry having one of the smallest heads bacon mayfield has ever seen I will wear my snapback for the rest of this video And he can pass too And that's a 45-yard bomb In fact come to think of it both browns wide receivers can throw I've seen Odell do that too Bank ladies terrible tackle just couldn't get a hand on them Way to stay on your feet Nice Respect the attitude respect the hustle And yeah, you've got a whole lot more work to do mate because you're only at number 94 And if you do want to get to that number one spot I've got no doubt you can do it. However Additionally as he said To have 1600 players in this league and to make the top 100 You are officially in the top six point three percent of the league If you are voted into this top 100 series and to think about it in a percentage like that Which I've never done before actually makes it seem that much more impressive So guys, thank you for watching Thank you for your support like the video if you've liked it subscribe for more And remember to check out the links for major key physics our exclusive video sponsor among other things Thanks guys And peace out


Excellencies, distinguished delegates, ladies and gentlemen, good morning. It is really a great pleasure and honor for me to welcome you to this 2013 edition of the Global Symposium for Regulators, organized by ITU in cooperation with Poland's Ministry of Administration and Data Realization and the Office of Electronic Communications. On behalf of Dr. Amanant Wei, the ITU Secretary-General, who cannot unfortunately be here with us today, I would like to express our sincere gratitude to our hosts here in Poland, and in particular to His Excellency President Komolowski for his patronage and support. Let me also thank our host, His Excellency Mikha Boni, Minister of Administration and Data Realization of Poland, and Magdalena Gai, President of the Office of Electronic Communications, who has kindly agreed to chair this year's GSR, but I also like to take this opportunity to express my sincere thanks to Mr. Tsingkowski, who spent his special time this morning with us this morning to deliver the message from President. Distinguished delegates, we have made extraordinary progress in the new millennium. There will soon be as many mobile cellular phones as there are people on the planet, and by the end of this year, some 2.7 billion people will be using the Internet. This is the marvelous achievement of modern human society. Among other things, the right policy and regulatory environment, in my opinion, has been a key contributor to this success. At ITU, and particularly within our development sector, we place tremendous emphasis on the importance of establishing an enabling environment in furthering ICT development and facilitate sharing the ideas and experiences among ourselves, among our members through the events like the GSR. Ladies and gentlemen, this year's theme, the fourth-generation regulation driving digital communications of hate, is particularly appropriate in a world where citizens expect to be able to have access to the latest communications applications and services, in particular 4G technologies. The theme will help us focus on the biggest challenge we face, the mobile broadband. We need to do for the Internet and the broadband what we have already achieved so successfully with mobile. In my opinion, there are two things which need urgent actions. Firstly, the government needs to ensure that broadband stays at the top of the development agenda so that the route is accelerated and the benefits are brought to as many people as possible. Secondly, we need to ensure that Internet access and especially broadband access becomes very much more affordable than it is today. This is where the GSR can play an important role. Distinguished delegates, effective regulation and sound regulatory framework are absolutely key for stimulating growth, increasing access to ICTs for all, extending broadband rollout and ensuring that we speed up progress in meeting the Millennium Development Goals. For the ICT industry, good regulation delivers predictability and stability. It reduces the risk. It encourages investment in ICT infrastructure and rewards competition and innovative business models. At the same time, it protects consumers by delivering a transparent marketplace and a fair system for resolving disputes. In closing, therefore, let me encourage you to pursue your discussions over the next three days and wish you all very productive debates and fruitful dialogue here in Warsaw. I'm confident. We will all be happy with the results of this GSR. Let me also thank our hosts once again for their exceptional hospitality and a wonderfully organized arrangement for this GSR. I landed last night. I had already a very good reception organized, wonderful reception, unfortunately I missed that. But I was told that that resume could be repeated Friday evening, so I will not miss that. And we just noted that from the message of President, the Warsaw and Poland is very proud of its history of solidarity. And I think that why I choose Poland to organize this is no secret. That is because Poland, ICT development over the last decade, achieved a wonderful level that according to ITU statistics, actually yesterday after my chat, that Poland is among top 30 countries, among 160 countries, ability to publish its statistics overall, ICT development. And Poland has a strategic position that breaches the eastern west and the south and north. And I think that Poland's experiences and achievements could be appreciated by many countries in the world, and they like to really witness what happened in Poland. So that is, I think that is a very good reason for ITU to choose Poland to host this GSR. And we are very grateful for our host to invite us here. So ladies and gentlemen, let me just wish you great success and great discussions of this GSR. Thank you very much.


Meanwhile, the Assembly of Health Ministers of ECOS Region have announced that Nigeria and other African countries would get access to the newly developed malaria vaccine by the first quarter of 2022. The Health Minister of Ghana, who is also the chairman of the Assembly, Dr. Kuikou Agyaman Manu, disclosed this to journalists at the 22nd Ordinary Session of the Health Ministers in Abuja. Sea Dogs, a non-governmental organization, has embarked on free medical and eye surgery services for the less privileged in Oweri, the U.S. capital. The organizer of the outreach, Eken Obagh Bulam, who said that the aim was to help those with eye problems with no means, said that the aim was to help those with eye problems, but with no means for treatment. We intend to assist and support members of the society, and in such drive we have reached out to people who require these services. This is one of many interventions that we do as an association, however we prioritized supervision this year because amongst the six senses, this is the most important. If you cannot see, you cannot do anything for yourself. So the priority to ensure that we can work on preventing blindness was a big priority and we settled for that this year. We are here to check the eyes, give classes, do free surgery for the first 20 people. These are things that can cause an avoidable blindness. They were also shaking for glaucoma. Glaucoma is the leading cause of an avoidable blindness worldwide. The safest way to avoid that is to shake the eyes and when someone has glaucoma, it's not 13 early. But once they have gotten to a point of person using facial marketing, there's nothing anybody can do about it. 300 people you see, 10 or 15 have eye defects. And you know there are vagaries of these defects. Some don't even know they have it. But they know they have challenges. Some can't stand the brilliance of the song. Some can't do all these eye defects. But the way we notice it is when it impairs your seeing or reading. In this situation, you start running health and skeleton. One of the beneficiaries of the exercise was full of appreciation. I want to come and examine my eyes and have a solution to it, which they have done. And I have a solution. I have to thank God for this organization, who are really possible. Everything is purely free of charge. No charge, nothing, not even card, fee or whatever. When I thank them, it is God that rewards. I pray that God will reward them and let them continue with this. By this, the society will be okay, better off.


Hello, everyone. Welcome to Cloud Native Security Day. My name is Dan Popindrem with Sysdig. I'm the director of open source community and ecosystem. I want to start us all out with a favor. What's up, Mark? You said it's hard to hear you. Okay, there we go. Welcome again to Cloud Native Security Day, everyone. So I wanted to start out with a figure, everyone. Excuse me, $2.6 trillion. That's how much the industry was cybersecurity issues in terms of misconfiguration security issues. No single vendor, no single project, no single group can address this. But as a community, we can address this. So that's what I think the power and the benefit of tag security is being able to come together and address things as we have. Very proud of what we do in tag security. We have an amazing group. Before we get started as well, unfortunately, Emily Fox, shout out to you, is not here with us today. She was in an accident. And our hearts out to her.  And big love. I want you all to give her a round of applause. Just pretend like she's here. So today, Andres and I are your emcees. We have an action-packed day. We're also be doing the CTFs with Andrew Martin back there from Control Plane, excellent group.  We're going to be talking a lot about technical items. But I want to have Andres right here talk about the group in general. Thanks, Bob. Wow, great turnout. Thanks for being out here today. The first KubeCon, we had probably a little bit more than the number of people we have in this room. We certainly had security-minded folks in that audience. But looking back, the way we've come from having a limited set of sharp tools to safeguard our infrastructure, we have evolved drastically over that time. The technical advisory group started early on as the special interest group for security of CMCF. Many of you are members of the organization.  We meet regularly. We organize events. Very gracious for the CMCF and our sponsors for having us here today. The schedule you're going to see throughout the day is a sample of all the activity and all the progress made. Resiliency realized is the theme of the broader event this week. But without mitigating risk, there is no resiliency. So keeping that in mind and with that, just pass it on and let's bring our next speaker. All right, everyone. First keynote of the day is Yuval Sukhoti from Checkpoint. Let's give a round of applause.


In order to build a stronger BC, we need economic reconciliation. Indigenous peoples need to be a part of the economy. It means partnering with the people that inhabit our beautiful province, with the indigenous people that have inhabited it for millennia. We don't want to be left behind. We want to be on this journey. My name is Terry Teji. I'm the regional chief of the British Columbia Assembly First Nations, and I'm from Tacla Nation. We are the fastest growing ethnic group in Canada, and certainly our youth numbers will reach a million in the next few years. There's an untapped resource for employment, for training, the new emerging economies in the future. This is why, as a part of the economy, indigenous peoples need to be a part of the conversation. My name is Harlan Schilling. I'm the deputy chief for the Daily Dental Council in Moore Post. We're the farthest northern community in British Columbia. Having indigenous peoples be a part of BC's economic growth, I think it's extremely vital that the province works with First Nations. We want to be able to give the education and the training to our children, to our young female leaders, to everybody. We cannot be successful without the province's partnership. One of the biggest drivers in indigenous economies are female indigenous entrepreneurs. There is a lot of innovation. There is a lot of creativity from our indigenous women that are really taking advantage in terms of entrepreneurship, and this is why it's so exciting. You know, there are so many different things across, not just BC, but Canada, where First Nations have done amazing things. So having the First Nations Centre of Excellence provides us to have a hub of where we can go as indigenous leaders, as entrepreneurs, as economic development leaders in our communities to go and brainstorm. You have a think tank now. That young entrepreneur leadership with the drive it's growing every day, this centre is for them. It's their tool. To me, inclusive growth means that all indigenous peoples are involved in the growth of the BC economy, and this is why it's so important to be a part of innovation and growth within British Columbia. The future of BC, I think, we're writing it right now together.


And we back at the crib to trade a pop-off. Anybody on this roster that has more fun playing football than you? That's a hard question. I'm not sure. I love playing football, man, especially out there. Everything that comes with it, the competition, the trash talk, all that plays a part. I love it. You've been, like, practicing, it looks like. Yeah, I just know when we get better. That's where I can, you know, we form into a team. So that's how we get the chemistry.  That's probably just a big part for me. How much fun is it being a linebacker for Mike Brayford? It's a lot of fun, you know, of course, because he's played. So he has a lot of insight and stuff like that.  You know, he can help me on and help us on.   He's extra tough on the linebackers, though, isn't he? Yeah, yeah, as he should.  So we interviewed the rookies a few weeks back, and one of the questions we asked them is did they know Mike Brayford as a football player? And if you can believe this, the majority of the rookie class had no idea he even played football. For real? Does that surprise you? No, not really. Not really.  I think they do, but it was really funny, because like, no, never, never heard of him. And pretty good player, you know. Yeah, they're a pretty good player. Well, well, man, yeah, so bold. Yeah. All right, so let me ask you about your first interception at Los Angeles. How shocked were you when the ball came right to you? Oh, I was super shocked. That's why when you see when I got it, I didn't know what to do. Like, I ran straight. I should have scored. I ran straight. I tried to get into the end zone as fast as I could, but I didn't know it was too big of a whammy right in front of me. If I could go back, I wish I could have, you know, been more agile with it, though. A lot of times when those moments happen on an NFL team, then you have to go back into the room with the guys and you get the business pretty good. Right. Did they hassle you pretty good? Oh, man, I heard it for like five days straight. Like, you really ran it to the line. You really tried to run him over. And I really go back and look at it like, I could have went so many different ways to score. I ran straight down the middle. Next time, I know. Next time, I know what to do. You'll score next time. All right, so here's the thing about David Long. You've improved every year. I mean, consistently from day one, you have gotten better. What's allowed you to do that? I would say coaching, taking all the coaching. I think I'm a fast learner. And my want to, my want to be better plays a bigger role. And I think the chip, the chip on my shoulder, coming into sixth round, it's a lot that goes into me wanting to, like KBC has not proved anybody wrong, but proved myself right. Because I know what type of player I can be. And I know what type of player I will be as long as I'm in this league. So I just think a lot plays into that part of me just wanting to be better and me wanting to show everybody what type of player I am.  Yeah, I think the program, the city, it all fits me well. I'm blessed to be in a situation of three years straight. I'm 11 wins, playoffs. A lot of people don't get to do that. So I feel like I know I learned it in the right position. I'm just taking advantage of it. What's the next thing for you to do to take the next step? Just continue to come into my own. Once I'm back out there, just continue to develop into more of a mature leader. Everything that comes with it, just keep on learning and adding to my game. Just to not only show the team, but everybody else know what type of player I am. For a linebacker, it starts with that GPS to the football. You have to have that. That's an aid. But then what comes next to separate you and make you a great pro linebacker? The mental part. I think just the learning, learning offenses, film room, and I have the motor. The physical part, just for me, continuing to become a more better mental player and just knowing the offenses, the routes. A lot of stuff that can help me play faster. I think that's what will continue to help me grow my game. And keep having fun? Keep having fun. That's number one.