Good morning. Welcome to CMC markets and Friday the 21st of May in this quick look ahead at the week beginning the 24th of May with me, Michael Houston. Before we get on to that, I think it's probably going to be instructive to look back at the events of the last few days because we've seen a significant ratcheting up in volatility without really, I think, getting an overall idea of where the next move higher or lower is going to come from because I think one of the things that we can take away from the events of the last few days is the fact that we've seen an awful lot of choppiness, an awful lot of volatility, but we haven't seen an awful lot of what I would call direction and there have been a number of narratives that have been driving the price action this week. Obviously, one of which is concerns about inflation, they haven't gone away, albeit I think markets have started to become slightly more comfortable with the idea of slightly higher levels of inflation. Certainly this week's Fed Minutes didn't really add anything to the overall debate for all the discussions that you saw on financial TV. Ultimately the bottom line for those Fed Minutes was that they came before the disappointing payrolls numbers, they came before the disappointing retail sales numbers and as such are very dated and one of the key takeaways from those minutes was the fact that Fed officials were looking for a sustained economic recovery out of the U.S. economy and certainly those two numbers from payrolls to retail sales have really I think delayed the prospect of that. So I think any prospect of a taper in the short to medium term has been put back which means that it's unlikely that the Fed is going to tighten monetary policy either by way of reducing their $100 billion asset purchase programs or raising interest rates anytime soon. And I think that has given rise to a wider concern that perhaps the Fed's apparent lack of urgency over inflation could mean that they might be too late in the event prices suddenly start to turn or run away to the upside. So in essence the Fed can't win. They're sort of stuck between two schools of thought. For me it's not really worth thinking about to be quite honest. At the moment you're always going to get these debates in financial markets. I think for me the most important benchmark of where the market risk is is in the U.S. 10-year yield and at that moment that's that's fairly steady at around 1.65 percent. It hasn't gone back anywhere near close to the highs that we saw in March around about 1.77 percent and it's well off the lows at 1.45 in the wake of that disappointing payrolls number. So I think for me the debate will inflation will go on. Obviously we saw a little bit of a sell-off earlier this week on the back of increased regulatory interventions in cryptocurrencies which prompted a massive slide in Bitcoin and Ethereum and at one point Ethereum had dropped 40 percent but I think if you actually look at it from a technical point of view while we've broken out on Bitcoin from this upward channel here what we haven't done is broken below the 200-day moving average on this chart here and that's held the uptrend for pretty much most of the last few weeks and months and I think until such times as such times as we get a significant push below that 200-day moving average or this 30,000 level which also happens to coincides with these series of lows through here then I think the bias still remains very much towards the upside. Whatever you think about the fundamentals whatever you think about how credible an asset Bitcoin is ultimately it still has to abide by the technicals and for me the technicals are probably the most important thing when it comes to analyzing any given market. You can have all the fundamentals that you like at your fingertips but it's very very difficult to really sort of look at all of the fundamentals in the round and say well that particular fundamental is more important than this particular fundamental item. To strip all of that away that's why I generally tend to place much greater emphasis on the technicals simply on the basis that the fundamentals should be reflected in the price all of them everything and you know as a consequence of that we've seen a little bit of a stabilization over the course of the past few days or past couple of days but we haven't as yet been able to get much above 42,000 42 and a half thousand which are the highs from the last two days here coincidentally it's also coincides roughly to this peak that we saw in early January so I think there is an element of a little bit of resistance in around 42,000 so it's certainly worth keeping an eye on in terms of the overall direction for Bitcoin whatever your views on it whether you're a Bitcoin skeptic you know you're a Bitcoin fanboy or girl. The thing for me the most important part of it is the fact that it is really the fundamentals. So the big sell off in Bitcoin prompted I think a little bit of liquidation in equity markets but overall within the context of the uptrend that we've been in over the course of the past few months we've got a very sharp spike down after a move higher on Monday we got a sharp two-day move lower we managed to hold above this trend line that I drew in last week through here we've gone slightly below it but what's important is we haven't taken out the 50-day moving average so for me all of this volatility aside we're still within the overall trend higher and while we remain within the overall trend higher and above 68.05 then for me it's very much a case of by the dip on the FTSE 100 that has to be your overall strategy it is struggling at the moment to sustain a move above 7000 but nonetheless it's not coming crashing off the lack of a rebound back above these previous highs would be a concern over the course of the next few days which does suggest that maybe momentum is starting to wane but that could just be a simply a case of the summer doldrums or if you believe in the narrative sell and may and go away which I don't sometimes it works sometimes it doesn't ultimately the price action is king as far as I'm concerned and the same pretty much goes for the S&P 500 which again similar sort of play out here in terms of the overall trend line over the course of the past few weeks and months we are still above this nice little trend line that I've drawn in here and that for me keeps the bias very much towards the upsides even if you set aside this bearish reversal here if we quickly look at the weekly chart what we can also see from the weekly chart is these long lower shadows on the weekly candle and that tells me that irrespective of the selling pressure that we're getting on a week to week basis the sellers or the bears don't feel confident enough to push the market down and hold it near its lows and that suggests to me that while bearish sentiment is starting to come in it's not yet strong enough to sustain a break lower until it does it remains very much a case in terms of the daily chart by the dip that still remains the overriding strategy going forward it's the same on the Germany 30 or the or the DAX we can see that here similar sort of story we have seen intraday spikes below the 50 day moving average in this trend line that I've drawn through here and nonetheless we still remain broadly above the trend lines that have been in place pretty much over the course of the past two to three months just quickly have a look at the NASDAQ this I mean I think that I think that's the one concern that I do have but what I would say is we've broken below the 50 day moving average but if we look at the way the rebound of the lows is played out I think there's a decent probability we could well get a retest of this 13,700 level given the fact that we weren't able on this move lower to take out that low there so looking at that this does feel like it wants to go back to this resistance level and that red line that I've drawn in there so those those I think those are really the key indices and obviously Bitcoin as well and any crypto fallout could will also play a little bit of a part in the way equity markets are playing out but I'm still of the fervent opinion at the moment that we remain very much in a by the mentality when it comes to equity markets more broadly which brings me I think neatly on to the upcoming week the 24th of May and I should also point out that there will not be a video next week I've got I'm taking some time out I'm taking a few days off having a bit of a break over the course of the next 10 days so there won't be a video next week so although there will be a week ahead summary it'll be a slightly shorter version but nonetheless the key items that I've got my eye out for this week are US first quarter GDP that's going to be a second iteration so it's not really going to tell us anything we don't already know or and we've also got US personal spending and income for April where we could well see post-march hangover in the same way that we saw a bit of a post-march stimulus hangover in April retail sales when they came in flat was very disappointing there I would expect to see a similar slowdown in personal spending and a big drop in personal income as I say I wouldn't be overly concerned about that because what that's doing is evening out the big spike higher in personal income that we saw in March more importantly and I think this really sort of feeds into the inflation narrative you know we've heard an awful lot over the course of the past few days and weeks about whether or not the US is likely to either taper the Federal Reserve is likely to taper its bond buying program as we head into the end of the year I think it's inevitable that they will start tapering I think if the economy continues to improve and yes some of the improvements that we're seeing are uneven and it's likely to be slower in terms of hiring trends simply on the basis that it pays an awful lot of people to actually claim benefits and it does to actually work and that will slow down the rebound in the labor market I think there is a case for withdrawing some of those benefits to try and hasten the move back into the US labor force but they're going to be ending in September anyway so I think we're going to get that it just could be a little bit delayed but more importantly I think in terms of the inflation narrative the Federal Reserve doesn't look at CPI or doesn't use CPI and it doesn't use PPI in terms of its dual mandate it uses the core PCE deflator as its inflation benchmark and now that's not to say that we won't see a strong rebound in the core PCE deflator for April we will but it won't be 4.2% and it won't be 6% which is what the PPI numbers it will be lower but it will be it will also show a very significant jump from what we saw in March when it came in at 1.8% now the level of 1.8% that we saw in March was the highest level since February 2020 pre-pandemic with the measure slipping to a low of 0.9% back in June last year so I think if you look at the core PCE deflator and you look where it was in June last year at 0.9% you're going to get a significant rebound in the April core PCE deflator now part of that will be as a result of base effects we've talked about them in previous weeks video so you should be familiar with that concept now but if you're not I will quickly reiterate the fact that when prices dropped a year ago they're always when the economies went into lockdown there was a significant deflationary bias to headline inflation that is now being reversed with a significant rebound so you will have a knee jerk reaction we saw that in UK retail sales with the April ones that came out on Friday today the annual number for UK retail sales was 42.4% but that needs to be put in the context of the mark the April lockdown of last year when retail sales activity declined quite sharply so you have an equalization effect you have an averaging effect which basically prompts a significant rebound so going back to the PCE deflator we're expecting to see a sharp rise to 2.9% now obviously if you look at that on a historical basis that's huge it will be the highest PCE deflator number since the early 1990s but you also have to look at it in the context of what happened a year ago as well so there needs to be some form of smoothing effect when you talk about headline inflation and that's what central bankers are essentially banking on now that's not to say an awful lot of the price rises they're currently seeing are likely to be less than transitory some of them will be some of them won't be there is upward pressure on prices the big question is is it as high as the headline number suggested is and I would argue that at the moment it isn't and we won't know for several months so looking at the way the US dollar index on the CMC dollar index is behaving it is starting to find a little bit of a base in and around these levels here on this chart around about 938 935 so for the purposes of this I would probably say there's decent support in and around 938 and we're likely to continue to get push pull in terms of what euro dollars doing what cable is doing and what pretty much every other currency pair is doing at the moment you can see the push pull being played out quite nicely over the course of the last three days euro dollar strongly higher on Tuesday strongly lower on Wednesday strongly higher on Thursday near the highs today interestingly enough we haven't as yet taken out the 122 50 level all these peaks that we saw back in February so that's the next key obstacle to a move back to these peaks here overall the trend on euro dollar remains upward we've got higher lows and higher highs and that would suggest that we are probably going to see a retest of this chart of this of these peaks here but we need to get a foothold above 122 and a half and it's likely it's likely to be a very choppy move higher it's a similar sort of story when we talk about cable and the only the only numbers of notes that we have are next week UK public finances for April which are due out on the 25th now we've just come off the biggest annual post-war deficit last year so over 300 billion pounds the the the the government borrowed to support the pandemic recovery and I think it's important to note while that seems an awful lot of money 12 months ago the numbers were basically being penciled in to come in an awful lot higher got an awful lot of businesses repaying their furlough money which means that I think even though we've seen an awful lot of upfront spend that number could still come down as more companies decide that actually they don't need that furlough money and can afford to repair all their business rates relief whatever certainly I think the economic hit in terms of businesses is probably not going to be anywhere near as bad as maybe from an awful lot of people first feared it would be that's not to say it hasn't been you know there haven't been casualties there have and and you know and that's that's really disappointing local local businesses local pubs local restaurants that haven't been able to stay open and there is going to be a significant transition period as we get used to what is a new normal if you like as restrictions continue to slowly get eased whether or not we get a full blown easing in June is looking increasingly doubtful but certainly I think there is going to be an element of a more normal economy in the summer than was probably going to be the case three months ago so April public sector borrowing expected to rise I've got a number of about 20 billion 20 billion pounds but I think the numbers I think largely irrelevant when you look at it in the overall scheme of things but certainly I think the fact that a lot more people are coming off furlough as businesses reopen should mean the borrowing numbers should start to come down as we head into July and then into September but the bias here for cable still remains towards the upside need to see if I want to see a move through 142 and a half and then we can start looking back at the highs that we saw all the way back here in 2018 143 85 and the highs are still getting higher the lows are still getting higher we are still very much on track to move towards that 145 level going forward euro sterling euro sterling is a tough one it's in a range at the moment and I think you know we're probably due for a little bit of a consolidation there's still decent resistance at 87 30 I haven't changed my mind on that for me the buyer still remains for a lower euro and a higher pound and the recent price action really hasn't changed my mind on that at all so we've also got first quarter Germany GDP on the 25th that's expected to confirm a contraction of 1.7 percent in the first quarter and we've also got the latest German IFO survey which is expected to show a significant improvement in business confidence so those those are the key economic announcements there's a sound just really going to circle back to the US personal spending number and income number because that is likely to take probably some of the gloss of what could be a very high PC deflator number both those numbers come out the same day on the 28th of May so in terms of personal income we're expecting to see a decline of 15 percent and that's significantly that's a significant reversal from the 21.1 percent rise that we saw in the previous month in terms of personal spending only going to expecting to see a modest uptick of 0.4 percent in April given the fact that retail sales in April came in flat there is a there is a possibility that that could come in negative and as and we'll probably feed into the narrative that while inflation is high or looks high in the US a rebound in pent up demand remains something you know a little bit less than a sure thing that an awful lot of people were penciling in two or three months ago so that is likely to keep I think that's likely to keep markets guessing as we look ahead to June because obviously this will bring my last video for May and my next video will be some time in June so in terms of the earnings let's have a quick look at three or four that I've got got my eye out for this upcoming week before we look at that we're going to have a quick look at Brent, Brent Crude because at the moment we've seen three successive days of gains and it looks like we're going to finish the week lower and the overriding story for this week has been these Iran nuclear deal talks and the fact that they there appears to be some I think very positive mood music about Iranian crude being allowed back on to the international market and sanctions being loosened and on the part of the US I think irrespective of your views on where crude oil is going and we've seen a number of bullish forecasts from 80 to 90 dollars a barrel we're not going anywhere much higher until such times as we take out this resistance level here so 70 dollars 71 dollars a barrel that's the line in sand for me while we're below that then the bias for crude oil prices remains lower not higher on a technical basis so you know if you're reading all these research notes about how crude oil is going to rebound and head towards 80 90 dollars a barrel may I remind you about two words that could undermine that scenario and it's called demand destruction and the last thing I think the global economy wants right now crude oil prices above 80 dollars a barrel and certainly I think OPEC wouldn't want that either because it would certainly kill demand for their product as well it suits OPEC to slowly release oil onto the market as demand picks up and keep prices stable so that for me suggests that we're in the range between 60 and 70 dollars a barrel and the longer we stay there I think the more likely it is that inflation expectations will continue to fall and I think that's the key thing here commodity prices are showing signs in the short term of topping out if you look at some of the recent moves that we've seen in metals prices as well copper has started to slip back as well so that's good for inflation expectations if we start to see a stabilization in commodity prices that should take some of the heat out of forward inflation expectations so in terms of earnings I've got my eye on a couple obviously retail is a big topic at the moment Marks and Spencer's case in point is reporting its full year numbers on 26 now when M&S reported its first half numbers back in November last year it was notable that it was the first time that M&S had posted a loss in its 94 year history there's only a minor loss 71.6 million pounds but nonetheless it was notable for a 15.8 percent slide in sales to 4.1 billion although its food division came to the rescue due to the recent deal that it signed with Ocado so I think with respect to the full year numbers hopefully the company won't post a loss but the share price the share price movements over the course of the past month or so they've been fairly stable they've been stable within a range 164 on the on the upside and fairly decent supporter around about 144 I would be surprised if the numbers were bad enough to send the shares back down below these lows they're going to be a beneficiary of the reopening trade obviously their food division has probably going to significantly contribute to revenues in the second half of the year given the deal with Ocado and I certainly think in terms of going forward they maybe need to widen the number of products that they make available via Ocado to try and push the numbers up for the general merchandise section nonetheless not really expecting any surprises from Marks and Spencer sticking with the retail theme got Ted Baker and this is a nice little chart here because what we've got is a series of previous peaks through 172 and we've got a trend line from the March lows now you know by myself here I actually like Ted Baker products you know they make very very good products unfortunately the management of the business hasn't been particularly great they're on a slow turnaround plan you know and if we can see how the fortunes of Ted Baker have really I mean that sort tells you everything that chart there I mean this is where Ted Baker was back in 2018 over 30 pounds a share yeah and now we're all the way back down here so they've fallen an awful long way they've signed some fairly decent deals in Asia and I think the Chinese business could well provide a boost we've certainly seen evidence of that in other retailers that have exposure in the Asia region Hong Kong Macau and the greater China region as well and despite the recent losses the new CEO Ted Baker Rachel Osborne has insisted that free cash flow will be positive this year inspired of the restructuring efforts and COVID-19 headwinds Ted Baker don't have a big store footprint so I think in terms of the turnaround plan even though the shares are off the highs of May as long as we stay above 172 and a half you know the uptrend that we've seen thus far you know it still it still looks on course for a fairly resilient second half of the year quickly look at Aviva in terms of support levels here it's their first quarter numbers been on a bit of a disposal spree in recent months and the share price move higher suggests that investors are fairly positive about the turnaround plan which focuses very much on the UK and Ireland businesses going forward and I think the big question that needs to be asked there is is all the good news priced in as it gets set to update the markets on its opening quarter of the new fiscal year quickly look at Snowflake at IPO'd end of towards the end of last year when Snowflake reported in March its revenues came in better than expected at 190.5 million dollars losses rose to 70 cents a share or 199 million dollars largely as a consequence of higher stock compensation so I think with respect to here it's really about revenues annual revenues rose by 120 percent at the end of last year to 553.8 million dollars and since those peaks that we saw in December as part of the tech space the share price has continued to slide back you look at the valuation on Snowflake and it's hefty it's hefty for a company that turns over less than a billion dollars or is expected to turn over less than a billion dollars a year for the current quarter the company says it expects to see revenue of 200 million dollars which would be in line with market expectations so we've got decent resistance all the way through 240 here if we look at that low there and then we look at these series of highs through here you can see there's a nice decent barrier all the way through here and as a consequence I would keep I would certainly keep an eye on that particular level for any further advance advances to try and undermine the uptrend that has been in place since those December peaks I'm going to finish up with Nvidia similar sort of story here I mean it's been a real success story for Nvidia this is this is new fiscal year the last two quarters for Nvidia have been really impressive most people know Nvidia for graphics chips however it's also been moving into high-spec CPUs for data centers and that's where the real growth has been now there is some talk that it's 40 billion dollar deal for arm holdings is currently under review and obviously that could well act as a drag but even without that the shares are only marginally down from the record highs that we saw in April and the biggest revenue earn has still come from the gaming segment where the 41 rise in revenues which accounts for 7.6 billion dollars of the 53 rise in total revenues that we saw in last year's accounts data center revenue was the big gainer in 2021 that rose 124 to 6.7 billion dollars now in the last quarter the company saw 5 billion dollars in quarterly sales for the first time ever in q3 it saw 4 billion dollars in quarterly sales so in the last quarter increased sales by a billion dollars by 20 percent big question is can they maintain that sort of growth strategy the cloud obviously is a big boon you know it's a big growth market and obviously data center chips are a key component of that so I think a key test for Nvidia is will it be able to sustain the type of revenue growth that we've seen in the last two quarters um profits are expected to come in around three dollars 27 cents a share okay so that's sort of I think neatly summarized brings me to the end of this week's weekly market update once again thank you very much for your patience um thank you very much for listening and um I will speak to you all hopefully in a couple of weeks time thanks very much and I hope you all have a great weekend thanks a lot


I'm Robert Edmonds. This is Paul Vixie. If you came to see him, you might be disappointed because he's got a little ten minute thing at the end. The talk we're covering today involves passive DNS. Hopefully most of the attendees here are familiar with the DNS in general. Can I see a show of hands? People who know what the DNS is. Very good. How many have read one or more DNS RFCs? Excellent. How many of you have heard of passive DNS? I'll probably skip over the introductory material as fast as possible because I have way too much material. I'd like to get to the demos, but in order to understand why the demos are so cool, you do need a certain amount of depth. Let's get started. This is the structure of the talk. There's four parts. I'll skip that. The DNS maps host names to IP addresses. This is generally what we consider it to be. In fact, it's more of a generalized system. It's basically a distributed key value system. More generally, it maps key type tuples to a set of unordered values. Basically, a multi-value distributed key value store. Excellent. Some terminology. We have clients, caches, and content. There are three fairly well-defined roles in the DNS. Clients request full resolution service from caches. Caches make zero more inquiries to content servers on behalf of clients, and the results are cached. We have content name servers which serve the DNS records that have been delegated to them. Here's a PowerPoint diagram showing the eyeglass nature of this delineation. You can see that an ISP might have millions of clients. These clients are everywhere, phones, laptops, whatnot. There are millions of content name servers because there are millions of domain names that people want to look up. You have very few DNS caches. Even the largest ISPs have around 100 DNS caches or less. We have this natural choke point where we can insert a monitoring application. The DNS, I just explained, we have two different protocols. One that the client speaks to the cache and one that the cache speaks to the content name servers. They're fairly different semantics, but they use the same water protocol. The DNS is commonly considered to be part 53, but it's terrifically complicated. The two protocols are the client server protocol and the inner server protocol, spoken between caches and content name servers. Passive DNS focuses on the latter because we don't want to see client queries or give the impression that we are spying on people. In fact, what we want to do is gather intelligence about the domain name system rather than clients that are requesting that information. Passive DNS replication was invented by Florian Weimer about six years ago who found a variety of uses for the technique. The most impressive use of that to date has been in combating malware and e-crime. Domain names are so cheap as to be basically free, but infrastructure and numbering resources are not, and the sharing of that infrastructure to host multiple e-crime campaigns makes it possible to track and link malicious uses of the DNS. Just to give one example, fast flux botnets light up the passive DNS like a Christmas tree. Passive DNS replication basically consists of a number of passive sensors that listen to the packets that are generated when a DNS cache performs a lookup. The packets are then forwarded to a central collection point for analysis. After the packets captured by a passive DNS sensor are submitted to the collection point, they're then parsed and analyzed and reduced into a stream of individual records that we then permanently store in a database. And here's a picture of our DNS architecture again where our cache is talked to content servers. We've taken the clients out of the picture since they're not particularly relevant to passive DNS and we've inserted a sensor between the caches and content showing how passive DNS monitors and forwards the inner server traffic to a collection point. And that collection point is called SIE or Security Information Exchange. We'll cover that as briefly as we can because the main thrust of this talk is concerns the database that we build based on that data. So there have been a number of different implementations of passive DNS over the years. The original was Florian Weimer's DNS logger. He was back and was initially hosted at Rust cert and then at BFK. Florian's implementation uses a custom libpcap forwarder on the passive DNS sensor and a Berkeley DB database for permanently storing that data. Then we have Bojan's DNS parse set of New Zealand, which uses a fairly primitive TCP dump-based sensor and a MySQL database. And the most recent and to our knowledge the largest implementation is in ISE's Security Information Exchange, which inserts an elaborate distribution layer between the passive DNS sensor network and the analyzers of the captured data. And we use a custom analyzer that is hardened and more advanced than the analyzers using DNS logger or DNS parse. And our storage components have been similarly hardened and have advanced functionality for dealing with the large amount of data that we collect. There may be other implementations, but I don't know of any other publicly known passive DNS implementations. This brings us to ISE SIE, which we'll describe briefly, and only the features that are relevant to passive DNS. So SIE is a distribution network, as I said, for replicating the security data from multiple sources to private secure lands, where the data is broadcast to trusted consumers, including ISE itself, of course. One of those types of data is, of course, passive DNS. Passive DNS sensor operators run sensor code that captures DNS traffic and periodically uploads it in batches to our submission servers. And our submission servers take care of replicating the data among physical SIE sites, where the data is broadcast out in a standardized format on private VLANs, sort of a poor man's multicast. And we use a standardized interchange format called inMessage, which we use to encapsulate the data. It's an extensible binary format that we've optimized for real-time transmission on jumbo frame ethernet. And we use this format to record the raw packets that are captured by our passive DNS sensors. And this allows us to add a good deal of metadata along with the raw messages. So, for instance, instead of storing a flat stream of packets like your typical PCAP file, we embed both the query and its corresponding response into a single message, which we can then process as a unit rather than groveling through an entire PCAP file. And we don't really need to cover data messages anymore, but you can see our Google Tech Talk where we describe just that format at that URL. And this is the end of our introductory material, and we'll move on to some ancient DNS security issues and the analogues that they present in passive DNS. Unfortunately, nothing short of universal DNS-sec deployment really helps us since passive DNS operates on a lower level than DNS-sec. So we have to be able to handle signed and unsigned data in a secure fashion as possible, so we won't be discussing DNS-sec further. So what DNS security issues are most important to passive DNS? We have cache-puref poisoning, which is an old, easily defeated type of DNS cache poisoning from the 90s. And we also have Kamensky poisoning, which is a particular type of DNS cache poisoning that makes use of spoofed response packets. Actually, spoofed responses in general are very harmful to passive DNS data collection. Let's see. Cache-puref poisoning is the name of a type of DNS cache poisoning that occurs when a content name server pens extra records to a response. It's particularly insidious because an attacker can poison any record in the entire DNS tree. Some people are running a content name server and tricking clients into looking up a DNS name under the control of the attacker. So that's very easy to do. Here's how the attack works. The attacker runs a content name server and a client is enticed to look up a domain name under the attacker's control. And the cache contacts the attacker's name server and the attacker's name server provides extra records to the cache. And these extra records are inserted into the cache instead of being discarded. I'm going to skip the actual example because it takes a while to explain, but the idea is that we have a malicious.example.com name and we trick someone to look it up and suddenly this unrelated name www.example.net points anywhere we want. So the blue one and the red one. The red one is malicious. The blue one is suspicious but not illegitimate. Actually, let me go back. The gray record there is the malicious one and it gets scrubbed out by DNS caches. Modern DNS caches. I think we can sort of skip this slide. Let's skip this one. And we can skip this one. Ah, okay. Now that we've covered all the background material has been lead up to the meat of the talk. How is this particularly relevant to passive DNS? So Florian Weimarin has 2005 paper identified several problems with validating the data collected by a passive DNS sensor but he chose not to implement protections against these problems but we would like to fix these problems if possible. So we have the two problems in passive DNS that are sort of analogous to the two problems in this active DNS and the problem with cash for F poisoning in passive DNS is that we can't see the DNS caches internal state so they can't recover what's called the the bailiwick that the cash associated with a particular response. The bailiwick is entirely in the eye of the beholder and this leads to a problem called record injection and the problem with spoofed responses is that they're treated just like normal responses by the passive DNS sensor and a single spoofed response can poison the passive DNS database so this kind of worries us because it makes passive DNS databases sort of an unreliable tool if they can be an attacker explicitly wants to target a passive DNS database. So anyway we'd like to make sure that passive DNS is at least as reliable as active DNS as far as resilience to cash poisoning goes for whatever that's worth in order to avoid allowing passive DNS to itself become a target in addition to the DNS. So let's move on to the protections that we've implemented on top of the basic passive DNS idea. It's actually relatively easy to protect the capture stage from spoofing in order to make our DNS sensor at least as reliable as the DNS cache that it's monitoring we need to capture both the outgoing queries that the cache is generating and the incoming responses that it gets back. So current generations of passive DNS only capture the responses and they don't have the context or the state that is generated by the actual query that went out. So what we need to do is capture the outgoing queries and correlate them with the responses and verify that they fit together and form a valid transaction. In most cases we need to verify that nine different fields between the query and response are identical and those are the nine different fields that we don't have time to discuss but basically we match them together and we can tell exactly which transactions are valid and which ones appear to lack the additional state to verify that they're valid. So ISC has released a tool called DNSQR that performs DNS packet capture and validates the query response pairs and validates the query response pairs that are seen on the wire. DNSQR temporarily keeps each outgoing query packet in memory in a state table and when a response packet is received we do a lookup against that state table and then the state table is keyed on that nine tuple that we just skipped over. We can skip this, it's interesting but we don't have enough time. There's blah, blah, blah. There's IP reassembly which I won't explain why that's cool. So now that we've eliminated this spoofing vulnerability in the capture stage we can move on to the data that is valid or the data that has been captured and has passed all these checks but it happens to be attempting to redirect us like the cache pref style poisoning. Cache is internally associated with Bailiwick with each outgoing query and Bailiwick is sort of equivalent to the zone but not really, it's a good enough approximation for this talk. So cache pref poisoning is pretty much identical between active DNS and password DNS and the solution is we're going to keep track of which zone or Bailiwick that we expect the answer to be contained in and we're going to discard any response records that aren't contained in that zone. And of course nothing in the wiring protocol indicates the Bailiwick that the cache is expecting. So when we're looking at a particular DNS query response pair we don't see anything in the packets that help us determine the Bailiwick either so we have to determine it ourselves from first principles. That's a relatively minor point. So we have to develop an algorithm that operates entirely passively it's not allowed to make any inquiries of its own it has to passively process each message and tell us for each record name and the response whether the IP address that sent us this response is really allowed to assert knowledge for that name. And this algorithm must provide a true or false value it can't be a heuristic we can tolerate a small number of false negatives if we have incomplete knowledge we cannot tolerate any false positives. That is the, so basically that is the passive DNS Bailiwick algorithm analyzes a DNS response and answers the question for each record name is the response IP address a name server for the zone that contains or can contain this name. For example the root name servers can assert knowledge about any domain name and pass the Bailiwick verification algorithm. And the GTLD servers the .com and the .net servers operated by Verisign can insert knowledge about any domain name that ends in .com or .net and in fact they did so for a short period in 2003 it's called Verisign site finder. Very good. So here's how the algorithm works first we allocate a whole bunch of memory that will be used to cache the name server and address records after they've been verified by the algorithm and we call this cache the Bailiwick cache and we initialize this cache using the entire root zone which will give our algorithm knowledge of where the root and TLD name servers are and thus it will know the Bailiwicks of all the root and TLDs. Then when we want to verify a given name against a given name server address we find all the possible zones the name could be located in and whether the name server address and the response packet matches any of the addresses that are name servers for these possible zones and finally each time the algorithm successfully verifies an NSA or quanta record that record is then inserted into the Bailiwick cache we're going to skip through the algorithm examples because they take a really long time to explain and we want to get to the demo okay what we call DNSDB is basically a database for permanently storing DNS records from a variety of sources along with a certain amount of metadata such as timestamps our primary data sources are passive DNS data as well as a number of zone files that we have access to each record is serialized as an array of bytes which we then store in an Apache Cassandra database we don't have enough time to go over the exact serialization scheme unfortunately because it's really neat we chose Apache Cassandra for a number of reasons in particular it's a distributed key value store easily as the size of the database grows and its data model provides a good fit for the type of data that we want to store it's also extremely fast and can easily keep up with the amount of data that we need to process primarily due to the fact that Cassandra always performs sequential writes so it can make use of cheap slow SATA storage we then export the data stored in our DNS database via an HTTP API intended for both queries as well as an interactive web search interface and since we started loading data about a month ago the size of our database has grown to about 500 gigs out of 27 terabytes total storage that we've deployed we just bought some small little 2U boxes to test the thing out DNSDB consists of several loosely coupled components we have a number of data sources from which we receive new DNS data and that's the first and most important source of course is the passive the first and most important source of DNS data comes from a program called InMessageDNSCache which processes the raw passive DNS data as it comes in from our sensors this is after it's passed the query response state inspection and this program is now going to perform the passive belliwack algorithm that we described earlier and as that data comes in from the sensors and the second source of data comes from the GTLDs that make daily zone file dumps available so for instance you can go to AeroSign or Ophelius and get access to daily dumps of their entire zones because of the contract the contracts they have with ICANN that requires them to do so and the third source of data comes from DINAS zones whose administrators allow us to perform zone transfers of their zones and our smallest source of data is mostly just the IC.org zone and we're interested in adding more data via this method it's very cheap and easy to process in this manner within of data loaders that process the passive DINAS data into batches of individual database rows and columns and then connect to our Cassandra cluster in order to insert the process data so we have InMessageDNSCache which parses I'm going to quickly go through what it does and then we'll get into the demo as soon as possible it's a standalone program that reads the raw passive DINAS data and parses each DINAS message into a stream of individual resource record sets and then we apply a series of filters before inserting each RR set into an in-memory cache and these filters eliminate roughly 50% of the data stored on the database and RR sets that pass all the filters are then inserted into an in-memory cache which we've tuned to store about 8-12 hours worth of data and finally the cache is expired in a strict first-in, first-out order and these expired RR sets are sent over a socket so the output can be stored for later processing and insertion into the DINAS database I think I covered this so we sign up for the zone file programs and we then so we get the zone file dumps but these are just the NS delegations so in the .com zone we see Google.com as these names errors but that zone doesn't include all the records that Google.com wants to serve obviously since the DINAS is hierarchical and distributed and then we can use passive DNS to fill in those gaps in the lower child levels of those zones and this provides us with all the TLD data provides us with about 8 gigabytes of DINAS data every day and the passive DNS is probably a whole lot more than that we also operate a DINAS server that slaves a few zones like IC.org and when those zones get updated we apply AX for or IX for a zone transfer and when those zones are updated we get archived and processed and inserted into the database this is a crazy well it's scaled poorly but that's a crazy diagram of our architecture and this will not be on the quiz we apologize for that slide now we can start the demos how much time do we have left what time is it I'm going to switch configurations real fast this is the web interface this is in pre-beta mode ok let's see what we can find our domain name search allows us to do wildcard matches which I don't think any of the publicly available searchable passive DNS databases allow you to do a wildcard lookup so this is a kind of a neat new feature that we've implemented we're going to look at star.google.com we're going to only look at the records that are present in the top level com zone so this means essentially name server delegation records and address records that are necessary for reaching the google.com name servers so if we see anything out of the place in this particular domain in this particular TLD we know something is up so here are the four matches that we get we have up to four time stamps associated with each match this one has four and we have a pair of first seen and last seen time stamps for data that was seen by passive DNS and a separate set of time stamps for data that was seen in a zone file so this indicates that this first match right here indicates that the google.com NS delegations were seen with these records from both the zone file and in passive DNS and these down here say in zone file so that means that without the other two time stamps this indicates that these records were only seen in the dot com zone and if they weren't seen in passive DNS that means that we might have a mismatch between the com servers and the google.com name servers so we see these three records we have b and f.l.google.com which are kind of interesting because these exist in the com zone but not in the google.com zone so let's click on this and we get matches for two domains 20comments.com and antifaVLC.com and supposedly google is the name server for these names let's click on this one and we get a NS delegation for this domain and supposedly according to the dot com zone file this domain is hosted by google gtld servers and hroot for all the people that know about the DNS this is an incredibly unlikely event to occur legitimately so it looks like someone has invented a rather creative method of parking a name and we can do some more clicking around but I'm going to skip the rest of this example so we can get into some more interesting things but basically there's a bunch of weird people out there that claim the root servers and the com servers themselves are hosting their zones which they don't they only host the delegations to their zones okay I am not a security researcher but some of my best friends are a good friend of mine recommended that this particular audience would be interested in all of the names that are hosted by soft layer apparently it's some sort of a colo hosting provider or something that for some reason people really dislike so let's see what happens when we want to look up all the names that say soft layers DNS servers serve so we're going to put in we're going to do what's called an inverse query or an inverse search the DNS originally has something called iQuery that worked very poorly and apparently you have to build giant databases to support this so we're going to put in a name ns1.softlayer.com and we want to know which domains they host and here are 1,000 records this is probably tripped over the maximum limit that the web interface has so they must have a lot more than that so we see all these different domains hosted by them I was going to show you another software example I basically need a slash 16 that belongs to someone of interest unfortunately I neglected to look up that information so I'm going to use should I use ISC as an example okay let's look up an IP or network match I'm going to put in ISC's slash 16 and perform a search now this is really cool because it did it really fast at each slash 16 for breakfast so here are a whole bunch of names that go into our ISC's name space there's a whole bunch of crap here someone is hosting a lot of domains for some reason I can't imagine why that would occur but here's basically all of the domains that are pointed into our address space and this is interesting because NAS is a forward delegation treat so you don't really know who's pointing into your address space so this is a very excellent monitoring application to keep an eye on who's claiming to host something in your address space I think that's about it for this particular set of demos so I think I'll switch over to Paul Vixie and I think we can turn off the projector now so I don't think Paul is going to use slides thank you Robert it's true I'm not going to use slides I had some but they were terrible so I decided that rather than being distracted by them and not using them for anything I would just talk so this passive DNS stuff is very cool I want to thank Florian again but he's been here he's come to DEF CON before some of you know him for coming up with this idea I want to admit once again when he first told me about it I thought it was a terrible terrible idea until I saw the ways that it could be used by e-crime fighters whether law enforcement or freelance to go find out who's doing what to whom DNS is fairly often used for bad stuff in fact it is personally used for everything that happens on the internet and so anything bad is also using DNS it bothers me that people that are trying to hurt me get to use a protocol that I helped you know I had a hand in maybe some software and they're using a global system that I'm helping to keep running in order to execute e-crime so last time something like this bothered me was in the mid 90s when I created something called maps which some of you may recognize as spam spelled backward was the mail of abuse prevention system so it's really unlikely that any of you has ever before now been in a room with somebody who's been sued more than I have and that's a result of me publishing reputation data about SMTP servers other people subscribing to that reputation data which we called an RBL and they would subscribe to that either by BGP or with DNS and tell their send mail or post fix or whatever see if it appears on Vixy's list then you can just bounce all mail that comes from there and the problem is that the people that were on my list didn't want their mail to be bounced and they found that spam that was coming from their networks was hard whereas suing me was easy anyway my wife has assured me that this won't happen again so as a result of sort of all that 10-12 years later we sold maps and are still selling the old RBL there are probably 100 other RBL like things I guess the new name for them the DNSBL but it will always be an RBL to me because that's what we called it and we're all getting as much spam as we ever got so I've noted that email is less reliable than it used to be a lot of false positives a lot of people have abandoned RBLs in place and put a wild card in there so that their subscribers bounce everything until they stop subscribing I will tell you that the really, really RBL the very first one is called rbl.maps.vix.com we only used that name for about 6 months and then we got mailabuse.org or whatever and started using that that's in vix.com and people still send queries to it 12 years later, 12 years after it was turned off it's rather frustrating I suppose I could wild card it and then they would all bounce all their mail instead I collect the data and I give it to the passive DNS effort anyway noting again that e-criminals need DNS as much as the rest of us do and not only do they need DNS they need it to work as well for bad guys as for good guys I have decided to try again except this time we're not going to create a reputation feed that is subscribed to by email servers no, no, no reputation feed that is subscribed to by recursive DNS servers the things we're going to black hole this time will not be the IP addresses of other people's mail servers they will be the domain names that the bad guys need for e-crime so if you go to our website www.isc.org you'll see that while Robert was talking I hit the publish button on a blog entry that describes all this we're also headed for a Q&A room after this if you'd like to talk more about it then but just to hit the high points on it we will not be sued ISC is a non-profit 501c3 we do not like being sued so we're not going to publish any content I know where a lot of bad domains are thanks to Robert but I am not going to make a list of them and publish them because that's the way you get sued instead we are going to publish patches in fact we have just published patches for bind 9 bind 9 recursive name server you can apply what is about a 600 line unit diff and get a new feature which is to subscribe to a response policy zone yes we are going to use DNS zones as a way to propagate sort of policy and reputation information about other DNS names it's a lot like the RBL in that sense it doesn't slow the name server down it has not caused any crashes or core dumps in the last couple of weeks anyway it will be no certain advisories yet it's not my code so let me think what else the spec is open no patents, no license, no nothing anybody else, any other recursive name server operator and nominum I'm talking about you who wants to implement this can do so I'm not going to pay any tithe we have talked to a bunch of content providers there's something out there called an RHSBL I guess first popularized by Jeff Chan of Serbil but it is like an RBL accepted refers to the stuff after an outside rather than before the outside or whatever I'm not sure what the right hand refers to but anyway it's lists of bad domain names spam house has one, Serbil has one bunch of other companies have them they didn't have a distribution channel for it now they do they're going to be able to use this because we're creating a single universal format that any recursive DNS server could implement and any reputation provider can publish with in order to have it be that if somebody is doing something bad from a certain domain name and if any of your users are using let's say windows they click on it, they will become infected and you can't stop them because we are all just barely evolved monkeys and we will click on anything that moves you can make sure that the DNS won't work so that when they click on it nothing will happen for them I hate that we have to do it this way but since we have to do it this way I've decided to make it possible, make it easier and to launch yet another multi-billion dollar industry to monetize in any way my wife has asked me questions about that too so we have some time for questions, either about Robert's stuff which I think is really interesting or my stuff which I think is sort of interesting how many minutes? we've got 12 more minutes so this room is much more full than I expected because the EFF party went until 8am so you must not have been there and they're talking about these cool badge in some other room and you really thought all of you would be in there listening to that maybe there was no room anyway I'm hoping that there are questions we have time he asked about covert channels via the DNS we do notice what appears to be covert channels they're conducted over the DNS and these are really annoying for us so when we find them we tend to blacklist them so that they don't enter the database because they obviously have the potential to evade the cache because all of the names and data are unique so we don't want to take anyone's YouTube downloads via DNS and shove them into a database we haven't really tried to discover covert channels using the passive DNS using the raw data itself as I mentioned I'm a not security researcher I just build tools that security researchers can use so I'm afraid I don't have any really hot examples for you any other questions wait a minute I want to follow up on that answer so we've described a database that was built on a bunch of passive DNS stuff it turns out that the raw data was our original product the security information exchange is an ethernet switch full of UDP broadcast traffic so all the data that we get from our sensors we play as UDP broadcasts on a sort of an ethernet switch that's in our data center and then we listen for that on another port on the same switch and we invite other people to come plug their computers in and listen to that so it's basically a tap point on our raw data stream we not only take the raw data but after we've run it through various filters like deduplication or this QR stuff or various filters are also touching down on VLANs on this private SWDI who is in our data center and plugs a computer into our switch is able to see not just the raw data but as we process it and rebroadcast it we can see it as it gets more and more refined the intermediate products, thank you so we hoped that that's all we would have to do and that somebody else would come build this database in fact I hope Florian would come build a database because we have a lot more data than he had and he was good at building databases but he's kind of on to other projects by now so we have built a database but if you really wanted to look for covert channels the raw data is right there so if you're a commercial entity we will charge you a port fee on the other hand if you're a university researcher or hobbyist or whatever and we can vet you we will probably waive the port fee because we want this data to get used so as far as covert channel detection the fact that we're not doing it should not cause you to think it cannot be done we have more passive DNS data than anybody and we are going to keep doubling it every year until Moore's law explodes more questions about anything we have a bulk query oh sure we asked if there was a automated queries and we do have an interface for doing bulk automated queries it's a simple HTTP REST full type interface you construct a URL and download it and it will give you back either JSON or some binary format converted to an ad hoc text format but yes we actually implemented that bulk interface before we did the web interface and if you were and at some point we'll be able to allow external entities to query that interface any more questions that's a good question yes when it will be available we will probably start up a beta period right now and we're interested in reaching out towards people that are interested in hacking on a beta type interface following the back he asked what is in the 50% of the data sorry he asked what is in the 50% of the data that we throw away the big thing that I noticed when I was building this is spamhouse.org because it doesn't follow the usual distribution of data that normally gets a typical you'll typically see about 80 to 90% cash hit ratio for your typical DNS server but certain zones in particular generate a huge number of unique queries spamhouse is a very good example because it's a DNSPL and it's the key that's been queried as an IP address and botnets are constantly generating all of these different queries and then once I had done that I had implemented a blacklist that allows us to exclude certain domains and subdomains from further processing and then I started sorting by the domains that were generating the most data and I found things I believe Yahoo that puts chucks a ton of address records into a query and there's this combinatoric explosion of different possibilities and that was such a large volume that I blacklisted that particular zone that they used as well oh Facebook, that's a good one Facebook has a chat feature now they have this web chat thing you can instant message your friends and the neat thing about Ajax is that the web browser developers decided to implement a limit on the number of persistent connections you can make and to get around this web developers have discovered that you can use a wild card C name record and use different names for your server so someone at Facebook decided to use this in order to make multiple connections because you could have tons of Facebook profiles open in your same browser session multiple identities and the fellow who wrote the code that generates the new name to use decided to use a 10 digit random number so we ended up with I think around 5 megabits continuously of these Facebook records that were being looked up they were totally useless and they had a 1 hour TTL so I can't imagine what's happening to the recursives that are picking out all those records so we blacklisted that huge proportion let's see the other types of filtering that we do is we are not really interested in generically named pointers records so your ADSL post 192 whatever, bellsouth.net well there's tons of that so we use something called the enemies list to filter that and there's a very nice fellow by the name of Steven Champion who maintains approximately 50,000 regular expressions that we use to filter that data and that accounts for about 50% once we do a very aggressive caching what was your follow up question TTL is not a very strong part of the uniqueness of an RR set so we don't actually store that in certain of our intermediate products we do maintain the TTL but we don't actually insert that into the database because it can cause a lot of copies of the RR set to occur this fellow the forward look he asked if we had the ability to look up quad A records in the forward interface and the ability to look up IPv6 prefixes in the reverse it's fully generic all possible DNS RR types, it's just an integer and the web interface has some cute little drop downs to select the most commonly used type and the reverse search is done based on a byte prefix so we can support IPv6 prefixes, IPv4 prefixes we can start doing name prefixes and other generic data I believe we're almost out of time do we have a okay, more questions yes yes sure you can't search for regular expressions but you can certainly search for exact matches or prefixes questions about the sensor network it's true that we can't name all of the parties who are giving us data but on the other hand some of you should be giving us data this is all open source stuff for a good cause so take a look at our website sie.isc.org and find out if you should be running a sensor some very large ISPs are running sensors, some universities are running sensors, I love it when we get a sensor that covers an underground dorm complex because those people really will click on anything but we always need more I'm not going to miss this opportunity to do some outreach so if you have any data please share it not just recursive servers, if you have authority servers we can take your queries I don't care about your answers because those are predictable based on your own content but I'd love your query stream on authority servers I'd love your query and response stream on your recursive servers we're going to open up sie to other data formats soon we're going to be looking for NetFlow darknet who is since we've got somebody from Aaron here it's all kinds of stuff that should be shared in order that we can cross-correlate Andrew Fried last year gave a talk about how he was able to use sie data and the passive DNS and our spam trap feed to do cross-correlation and find botnets so if you have spam traps or you might be willing to start up a spam trap talk to us and we'll help you sort of extract all the interesting body URLs and format them in the format we need and then we'll share them with the security community so the sensor network is not public because people don't like to be thought of as targets they don't want to paint targets on their back but we won't tell anyone who you are if you're sending us data so please send us data to have some concrete numbers we're done, alright


With respawn week being here until next Tuesday, Tuesday the 15th, it means we can take advantage of certain bosses dropping certain items. Today we cover a boss which drew ups must have grenades. How's it going guys? My name's DP Jenner, I'd like to thank you for stopping by and checking out my video. If you do enjoy it, leave it a like, truly help us out and subscribe if you want to see more Borderlands 3. Also guys, I'm giving away copies of Borderlands every week, tell me one for yourself or a friend. Simply subscribe and make sure you have notifications turned on, drop a like on this video and leave a comment down below. So within Borderlands 3 there are grenades which I considered must have, I've uploaded videos on a few, mainly the Firestorm variants capable of this, but there are others out there which too are considered probably even better than the Firestorm. One comes to mind called the Hex, which comes in many, many variants. Today's boss until next week, meaning you have from this upload, this video's release, a full 5 or 6 days to farm to get this grenade mod you want, as this boss during this week has increased chances of dropping any legendary grenade mod. So the boss is called the Red Jabba and is located upon Ambomir on Eden 6, so spawn into Ambomir and follow the route I take onscreen now to this enemy's location. So once here, kill him, hope for that loot, if not simply quit out and load back in. The save point and the place you will spawn back in is the fast travel spot, but in all honestly people it doesn't take too long getting back here. Now I will state, doing this offline doesn't seem to work, as it takes away any patches or updates applied to the game, and proof of this is the fact that it's now rarehunt week and the bosses in which we can take advantage of are guaranteed to show up and when in fact it isn't this rarehunt week there's only a slight chance there will be here and my first attempt going offline and actually going to this red jabba location he wasn't here. So it kind of proves to the fact that patches and updates don't apply to offline playing. Now I did load in and out about 5 or 6 times on offline mode and he appeared here once so it's pretty rare. But what I did check when he eventually did appear here offline, can he drop legendaries and can he drop legendary grenade mods? Well it seems people he can, but I wouldn't say any more efficiently than anywhere else playing offline. So it does seem as though people your best bet in getting that perfect grenade mod is to do this online. I was getting a grenade mod roughly every 2 or 3 runs and that's without any luck artifact applied. So give this a try people and try and get that grenade mod you want. What you can also do people to get anything you want is join my discord linked within the video description. I have dedicated sections for playstation, xbox and pc for trading so if you come here with a certain item you think is worth trading you may get something you need in return. So yeah my discord is linked within the video description. By that note guys we have come to the end of the video. If you guys enjoyed it leaving a like really helps out. If you are new around here and want to see more by the land 3 be sure to subscribe and if you never want to miss a video upload you can turn notifications on by hitting that bell button. But guys thanks as always for stopping by hopefully you enjoyed the video and hopefully I will see you on that next one.


So, what you owe the 1099s are obviously internal to deal with your taxes, the accounts payable aging detail that's typically internal to help us to organize and pay our bills, the accounts payable summary, this internal bill payment internal so these are all typically stuff that we use inside the business although we did make this vendor balance summary report into a pie chart. You could do that. It's probably not the most popular pie chart, probably the least popular pie chart that we made because people are first interested in sales and then probably interested in who owes them money like accounts receivable and then maybe even in their expenses categorized out and then maybe their accounts payable.


Hello and welcome to the Capitola planning commission meeting of October 6th In accordance with California Senate bill 361. This is a hybrid meeting with commissioners and the public attending both in person and remotely via zoom Information on how to join the meeting using a zoom application or landline or mobile phone along with how to submit public comment During the meeting tonight is available on our website city of capitola.org and on the published meeting agenda As always this meeting is cable cast live on charter communications cable TV channel 8 in the city of capitola And on channel 25 throughout Santa Cruz County This being this meeting is being recorded to be rebroadcast on the following Monday and Friday at 1 p.m. Meetings can also be streamed live on YouTube or on the city's website Our technician tonight is Eric at Johansson and with that we can Start with the roll call Here come shun on your mind here come shun our Westman here come shun our roof here chair will here Okay oral communications. Are there any additions or deletions to the agenda? Yes Thank You chair will this evening We're requesting that the public hearing for item 3c That that item for 401 capitola Avenue conditional use permit and parking variants for a bar-and-lounge Poor room be continued to the November meeting You will have to open a public hearing and close it for that item since it is on the regular agenda We also received additional materials. We received comments from the The business owner as well as two public comments that were sent to the planning commission as well So additional comments those will be included in the next packet in November as well Okay, very good If there are no more additions or deletions to the agenda we'll move on to public comments This is a time for anyone At in the public at large to speak on issues that are not on the agenda. You have up to three minutes and And can either speak here on the microphone or On zoom or do we have any anyone who wishes to speak on items that are not on the agenda? I See that we have four participants via zoom and no hands are raised Very good, we'll move on then to commission comments. Are there any comments by the commissioners Seeing none we'll move on to staff comments item D staff comments No comments this evening just actually one reminder that when It's due to our hybrid meeting we've been getting some comments about Public not being able to hear at times So just a reminder to always speak into the microphone and that reminder goes for the public as well when you come up to The podium to please speak into the microphone. Thank you Very good item E consent calendar. There are Two item one item just one item on the consent calendar 216 central Avenue Anybody wish to pull that from the consent calendar either the commissioners or members of the public? I just have one comment I would like to ask staff When this item comes back to us Can you give us information that makes it clear why this is a historic building? I Know it was at one time, but it's been moved from where it was currently located and so I would like to Historian or someone to you know validate why we're still considering it a historic structure Thank you, and with that I'll make a motion to continue this Airplane mode You have so I hear a motion to approve the consent calendar is there a second We have a motion by Commissioner Westman a second by Commissioner Christensen Correct That's a request to continue so could I have a roll call vote on the consent calendar? Yes, please Commissioner Christensen I'm sure not new man. I'm sure now Westman Comissioner Ruth. Hi Joe. Okay. I Okay item three public hearings. This is a portion of the meeting that's intended to follow a series of Protocols starting with the staff presentation planning commission questions public comment and then Deliberation and decision our first item on the public hearing agenda is item a 3720 Capitola Road and 1610 Bulb Avenue. Do we have a staff presentation? Mr. Chairman, I'm going to recuse myself Thank you, Commissioner Newman so they'll be for us Good evening chair Wilk and planning commissioners this evening before you I have a conceptual review for 3720 Capitola Road and 1610 Bulb Avenue This application is for a conceptual review of a future annexation and whether or not this Application meets the findings for a community benefit application The community benefit being proposed is a senior living facility And to be clear the property at 1610 Bulb Avenue is located in the county of Santa Cruz And as part of this project the applicant would like to go through an annexation to bring it into the city of Capitola Within our chapter 17.88 Incentives for community benefits They have been established to incentivize applicants to locate and design Projects in a manner that provides a substantial benefit to the community These incentives are intended to facilitate the redevelopment underutilized properties consistent with the vision of 41st Avenue Corridor as described in the general plan The city may grant incentives only when the community benefits or amenities are offered that are not required a Community benefit must significantly advance the general plan or incorporate a project feature that substantially exceeds the Senate the city's minimum requirements Within our community benefits allowance if a project it has to be located in a certain area of Capitola to even qualify and if an applicant brings in a community benefit the result is that they can get increased floor area in this part of town from 2.0 to 2.5 and Increased height from 35 feet to 50 The first step in this process is to go through a conceptual review to make sure that the Planning Commission and the City Council can make Findings for a community benefit 1610 Bulb Avenue is located within the County of Santa Cruz and is zoned as a residential property The parking for the elderly care facility is not an allowed use within the residential zoning district Therefore the applicant must bring that property into the project and be part of the City of Capitola if the proposed project is Supported by the Planning Commission the applicant can then begin the application process to be annexed into the city a Letter of support from the city is required for the annexation process to begin the City Council will be reviewing this application that they're hearing next week in order to Qualify for an annexation a property must be within the city's sphere of influence this is the map from the general plan and the property is within the sphere of influence and Basically within the sphere of influence we have looked We can we ensure that urban services can be provided to that area should those the areas within the sphere of influence If it's within the sphere of influence, so this property is Next I'm going to this kind of a joint effort on the presentation. We have the architect Greg Irwin He is representing the The applicant and I'm going to hand over the presentation He's got two slides in which he's going to go over their proposal and then from there. I'll continue with my presentation So at this time Greg if you could unmute Okay, Greg. You are now unmuted. You're welcome to Give the details of the next two slides Although you we cannot hear you It'd be a good idea to have applicants be present now that we're back in person. It would help Lee Corey is are you able to speak on behalf of Greg Irwin or Raphael? But you'll have to unmute Greg can you hear us Greg? Can you hear us? You're now unmuted Lee Corey, can you hear us? In the chat they're saying there's no sound on their end. It's we miss Larry Laurent. We do Maybe we should go on to the next item while they're trying to figure this out. Yeah, we could continue this For a few minutes and do the other items on the agenda Yeah That sounds like a good idea so At this point, we're going to continue and move on to the other items on the agenda. I am going to ask Greg Irwin to please send me an email with a phone number in which we can reach out to him directly In order to get comments Thank you Okay, so we'll postpone that till the end of the agenda and move on then to item the 529 Capitola Avenue, I have to recuse myself Very good. Thank you, Mr. Chair. We ready to go. Yeah, go ahead Okay, so this next item before you is 529 Capitola Avenue Proposal is for an ADU over a garage Which a two-story ADU does require a design permit? Property is in the coastal zone, but not in the appeal area, so it's not appealable and I just wanted to point out that it is in the mixed-use neighborhood zone even though it is Being used as a single-family residence Just some existing photos street views This is an existing 1380 square foot one and a half story In 2019 a pretty extensive renovation and remodel was done to the property adding those Dormers and then on the photo on the right. I'll point out the the shed which was An issue that I'll go into a little bit During our plan review. We had to look at its status as a historic building a Brief overview of the project is to demo the mentioned garage or shed Construct the two-story building ADU over garage The property as I mentioned was listed on the historic structures list So I have a slide. I'll get into that and then two other topics to talk about There's a bit of an atypical parking design and the applicant is requesting a deviation from standards for some upper-floor windows So just getting into the historic status With the 2019 edition the city contracted with a consultant identified that the garage was existing as of 1927 so it is older than 50 years which Means we are to look into it if it's an identified property And they also did not fully or thoroughly investigate the garage at that time So we were able to get the same consultant prepared an addendum And they found that the garage does not meet any criteria as a resource. So that issue was closed Getting into the proposed site plan Existing residents in purple and the ADU over the garage is in orange and then the parking space I mentioned is in yellow A couple things about the parking space in the garage in particular. I mentioned this is in the mixed-use neighborhood. So Curb cut limitations that are typical with R1 are not applicable here as well In order for this property to provide Parking in a driveway. It is only 40 feet wide a new curb cut on Capitol Avenue really isn't ideal in any way Given how close it is to the intersection Property being 40 feet wide and accommodating tandem parking spaces doesn't allow To 10 by 20 spaces to fit so property does need some creative parking solution and Which is why we we ended up with this. So this is a parallel to Beverly Avenue parking space with a flared access which lends to its ability to be readily used on a daily basis and This is just floor plans Ground floor is 21 by 24 Accommodates an interior stair to parking spaces and then as the stair approaches the landing There's room underneath for a washer dryer and then the second floor is just a One-bedroom ADU I've got the arrows here that are pointing toward the south Which is the windows that the applicant is requesting the deviation for Elevations it's 22 feet height Matches the board and batten siding same standing seam roof material that's used on the primary And then the roof slope matches the dormers on the primary and then I've got the the arrows here again This is kitchen window and the living room of the ADU So Specifically I've got the code section here that does call for opaque or clear story windows on the second story We're facing adjacent property After the development and design meeting staff did go to the property and took a real world visit to see what the impact was There are some mitigating conditions just in with Landscaping and the fact that the nearest adjacent building is 20 feet away. So we came up with a condition that Does pay respect to the code But it does allow the applicant an ability for some clear windows and so we're recommending anything below 60 inches Be treated with an opaque coating in a window or they could have the option at building permit to increase sill height These are the photos that we took at the site visits are going left to right You can see the the building is removed from the property line. It's approximately 20 feet away and then the middle photo You can see there's a Mature hedge and vine that do provide some privacy and screening although this isn't the exact vantage point And then the photo on the far right Is just an acknowledgement that the applicant is doing opaque windows to face the the building to the west Which is that would have the greatest privacy impact so With that we are recommending approval with the With the condition and findings as reported in the report I'm available for any questions Are there any questions? I just have a question Brian on consistency of policy In the last several years There have been four new homes built on Emerald Street Three of them required clear story windows on the back facing the adjacent lot And then last year we approved one on Emerald Street that has a four by four window Overlooking three different lots their backyards and now in this case We're requiring opaque or the windows to be at 60 inches So I'm just concerned that we're inconsistent in applying this policy so the poll the objective standard is Tied to the ad use so it's one of it's it's clearly defined in our code as a standard for ad use I Believe the home on Emerald that you're speaking of is a single-family home not the ad you which we don't have We don't have standards for single-family on the second floor. So you are correct. We have not you we have not applied that consistently Privacy from an ad you is the same as privacy from a single-family home. So I just don't get it Before the objective standards came into effect Yeah, it was something new that came out of the the update to the ad use standards which happened between the code update and we had our code update and then we had our ad you And then the final code update. We are doing a cleanup to our code currently that we're hoping to hear Before the end of the year It might be January though and when we do that we could look we could look at that. Thank you any other questions of staff Not it's now time to move to public comment. Does anybody member any member of the public wish to comment on this particular agenda item Excuse me could you excuse me Dennis could you announce who you are and then write write your name on the Okay, I am Dennis Norton. I'm the representative for the family La Torre family is here as long with along with their neighbors and Including the ones adjacent to that property. I remember Doug Messini saying someday I'm gonna take a chicken coop to the planning process to see what happens. We just did it That's basically what that building is is that it was a cow barn or a chicken coop or maybe maybe I don't sure they had tractors in but maybe they could park a tractor in there But if you've seen the condition of that you We we agree with the conclusion of staff and and the Historian Leslie deal that this the structure is not saveable Although we will save the wood on it the wood will be recycled in that in that project there We agree with all the condition approval with the exception of number 12 on here and what number 12 is asking for is to Underground the utilities to this the the house is serviced from across the street overhead and has been through history and A recent remodel there was no condition to put that underground on that underground What we're gonna do is we're taking it from the existing meter on the on the main house and we're going underground to this to the ad you and so that is the most economical way to do this and It's quite impactful cost-wise for for this applicant to to actually put underground from across the street to their to the existing house there and I don't know I've seen another ADU that's been required to to underground the main house This is a new condition that I've ever seen so I'd like you to look at that if you could please and the members of the family are here in the neighbors to speak with you also and I think it's a good project and The barn will be the barn chicken will be recycled and thank you Thank you go ahead you have an estimate from PG&A for the undergrounding. No, we haven't yeah, you have a ballpark It's gonna be probably from across the streets probing and be with with carrying the street up there probably in 30 35,000 Thank you I have a question also Dennis so will ADU in the home still be just on one meter is that it over yeah It'll stay on one meter and he's going to during the process upgrade that meter to a 200 amp So that'll give it enough power and we that's kind of what we've been doing with other places They're do a 200 amp on the main and then do a hundred amp on the on the accessory dwelling Thank you. Well, I've got a question I maybe want to direct it towards staff since we're focusing on this utilities thing. Why was item 12? added Yeah, I actually think in conclusion. We're on the same page With the applicant Or with what Dennis is saying we even we added language saying and or meter So the expectation is that any new utility lines would be underground So from the meter to the new the ADU is okay So just to clarify. I think we're we're close here We're saying the same thing Thank you. All right. Thank you Dennis Are there any other public comments members of the public wish to speak on this either on anybody on zoom? There are six attendees on zoom None with their hands up Okay, we'll move this then to planning commission deliberation any members of the commission wish to speak on this item Well, I think it's a good project. I have no real issues with it Undergrounding is a good thing a good policy and a good direction to go as much as we can but It may be a little excessive We're getting closer It may be a little excessive in the context of this project Just spend that amount of money other comments. I would move approval. I have one question Courtney So just to be clear for number 12 you're going to revise that or are you going to admit it omit it completely? Yeah, our intention was that the And I did talk to the applicant about this so they were going to pull from the existing meter on the house So that the condition is intended that that Conduit be placed in a trench to the ADU but that the existing drop from capital av can remain Okay, okay, I Have a motion from Commissioner Ruth and a second by Commissioner Newman are there any other discussions on this item? I have one comment. I guess and that is Mr. Norton mentioned the chicken coop and it just did seem to me that The idea of having to go to a historian to get this approved Seemed unnecessary that somehow I realized I talked to Brian about this and I understand the logic behind it But it just seems to me that we use consultants More than we could and something like this could probably you know, maybe a quick phone call the historian or something said hey You know, we're just gonna tear this down, right? Anyway, that's just a comment and doesn't affect my opinion So with that we have a motion and a second. Can we have a roll call vote, please, Louis? Sure. I'm sure not Christensen. Hi. I'm sure the new man. Hi Come channel with I Westmines recused chair will I pass unanimously unanimously Thank you Good luck with your project. Are we ready to move back to Capitol Road and Bulb Avenue? I want I Want to check with the applicant Whether or not they can hear us on zoom Because if if the applicant can't hear us on zoom then the public can't hear us on zoom and Therefore I think if that's a scenario we should probably continue Greg if you could unmute or Raphael Or Lee we're wondering if you can hear us I'm going to give a call to the applicant. I just got their cell phone Based in Costa Mesa We can hear you So is your volume Oh, yeah, I've been using it all day, so it was fine all day long No one on the team can hear anybody Okay, this is what happened to me last week, so okay, I'm thinking we should Well, I mean we've had a chance to Yeah, I can hear you too we just can't hear the council chambers for some reason Public Okay, no actually it's helpful Lee, can you hear us Lee? Can you hear us? Is Lee in the same No Lee can you hear Hello, can you hear me? This is chair you I I haven't heard any of this and I wasn't getting Yeah, we're not getting on the live stream or You can't hear this Can you hear I hear you Katie. I think I'm hearing you through Greg Stone. I think the issue is the city council's audio is input is not working I can hear you Actually, can we go through the agenda? Okay, you know guys one thing we could just do is You turn our mics off and dial in by Connect but we connect with you five minutes to do directors report it. Oh, I see what you're saying Yeah, what can we do? So you hmm, so you'd rather do directors report and comments and then then go back to Oh Well, let's do that then let's move on to item four Can we go ahead and do the directors report? I mean we have four four one Capitola Continued blackjack and I don't have to hear that either You're right, right? Yeah, so you want to be here for the directors report? Yeah, absolutely. I wouldn't miss it There is no directors report I Does anybody have any last-minute commission comm communications you want to that Here now that we're back here. We're gonna put the pledge allegiance back on. Yes. That was I Noted that If that's okay with did we did we want to vote on that do we want is that something that? well, I think Policy to have it for us to do it we were skipping it when we were zooming because we had such difficulty with none of us being able to Right, right time But I think that Technically we're required to have it on our agenda I know I asked Jamie that Jamie Goldstein that he said it wasn't required. Let's just do it He's gonna just do it We can just do it And it always makes me chuckle through it Don't say why I Can't look at him What did you want to be recused while we talk this briefly and just give them another few minutes to try to hook this up And then so the last two things left are the two things I'm recused from 401 and 529 We already did 529 For the adjournment, oh, yeah, yeah, so let's do the adjournment first So Wait a minute you so wait a minute so you don't want to be part of this 3720 bulb with capital rodent Bobeth on this one You're accused oh I'm sorry. I was thought you're Thank you, Ed Okay, so why don't we go ahead with item C then which is 401 Capitola, which I must recuse myself from Capitola Avenue the staff is requesting that this item be continued to our November 3rd meeting And I would actually like to thank the staff for making that request because it seems like we've gotten an awful lot of new Information in the last day or so and I think this is an important issue So can I hear a motion to continue it to the November meeting? We have a motion We have a motion and second Can we have a roll call vote? Okay, all right, we'll have a have a vote to continue this item Only three of us So this items continue to our next meeting and now we'll see if we can go back to item B on our agenda and Can't we go on to item B You know I do think there's something to be said about having a process where the public can easily Participate in here and be involved and this seems like tonight. We're not quite there. Maybe we should continue this This is one of the bigger projects. We're going to do This year in Capitola and I think an important one for a lot of people Yes, do we need a motion to continue we do I'll make a motion to continue this item To our next regularly scheduled meeting Second, I would just like to add this is a big project. I think it's important to have the applicants present not on Zoom. I Agree with Commissioner Ruth. I think that it is a big project for Capitola and We're accustomed to having the applicants be here Or at least at least a representative Easter representative who can answer our questions and questions from the public So we have a motion. Do we have a second? second Motion from Commissioner Westman and a second from Commissioner Ruth We have a roll call vote to move this to Continue this item till our next meeting. Sure Commissioner Christensen. Hi. Come on a new man. He's recused Comissioner Westman. Hi Comissioner Ruth. Hi, Joe. I apologize gentlemen. We just don't know how to handle this And we'll hope to see you again soon And with that we'll move on to item number six, which is adjournment if I had my gavel I would adjourn this Meaning is adjourned nice to see everyone


In Galaxy, the tool is the primary method of performing analysis, but sometimes Galaxy doesn't have every tool you need. In these videos, Dave Bouvier, Matthias Berndt, and myself, Alex Ostrovsky, will show you how to create your own Galaxy tool wrapper, starting from a Bioconda package, all the way through the deployment onto a public Galaxy instance. Please enjoy.