Good morning, everybody. JR Fisher here. It is Wednesday the 19th of May 2021. Man, the month or the month, the year is going by fast. The month's going by pretty fast too, but the year is just flying by. Wow. Good to see everybody here today. If you're new, don't forget to subscribe. Hit that subscribe button and ring the bell. Turn on all bell notifications so you're notified each and every time I go live. I want to welcome everybody in here. Let you know you could use that chat box there. James has already hit it up in there. I've got 75 James and Clowdy, so we're not too far off, not too far off, but I bet you're gonna get some humidity. We don't get much humidity here in San Diego, but I will in Austin, Texas. I know that for sure. Okay, everybody. Today, I'm gonna talk about some unknown secrets to actually create unique blog ideas. I know you guys are trying to come up with ideas out there.  It can be very challenging to do. I know I have to come up with something every single day. Every day for you guys, I owe that to you. You supported me. You've helped this channel. As a matter of fact, I'm down. In case you want to know where we're at, I'm trying to hit that 5,000 subscriber mark and I'm only 37 people away. Only 37 people, so I'm extremely close to that. I can't wait to get there. And you know, I'm sure there'll be another goal after that, but I'm 37 people away from that. And the only way I'm gonna get there is by giving you guys good content, helping you out, helping you start running, grow your online business. Thank you so much, James. Let me know that you can hear me there. Guys, do me a favor, too. Smash that like button. Give me a thumbs up if you don't mind. That would really help the YouTube algorithm. The only thing I do on this channel really is help you start running, grow online businesses. That's it. Nothing else. Nothing else. I'm not here to sell you anything or market anything. I'm here to actually help you.  Okay, so I'm going to give you ideas for ideas. But if you have a question, anything about making money online, this is the forum for it. This is the place you want to be because that's all I'm going to talk about. That's all I'm going to cover is in here, how to make money online, and that's it. All right, here. So let me get into this stuff here. And I know it is very challenging. It's very difficult to come up with new ideas every day. I mean, it's hard to do, but we got to do it. Now, you may have a lot of slots on your calendar to fill, okay, to where you got to come up with these ideas. And if you don't feel inspired and it's boring, it's really tough to do. And but the bad thing is you're going to bore your readers too. You don't want to do that. And these can be true also for videos, not necessarily just blogs, but it can also be vlogs. So it can be both of them. Canadian entrepreneur, thumbs up. Thank you so much, my friend. I really appreciate it. People are streaming in now. Everybody's waking up. Everybody's rolling over in bed now, right? Everybody's waking up. I got a message today from my builder in Texas. My house has come along. It's a matter of weeks away, which is really cool to me. So I'm really excited about that. So the first thing I want to tell you guys is to stop working. Stop working. Stop it. Stop working and start thinking. Okay, I don't know about you, but I spend a lot of my day sitting at my computer, okay? When I'm not in a meeting or working on some type of video or something like that, I'm responding to different emails and stuff I got to do and looking at analytics and sending emails and digging into keyword research, doing all these different things. But I'm not stopping and thinking. I need to stop and think. So I literally have to tell myself, stop everything you're doing and think about stuff. You have to actually sit down to be creative.  That's not the truth. The truth is you have to sit down and try to be creative. A lot of people say, well, I'm just not a creative person. I'm going to say, well, then you haven't tried because everybody's creative in their own way. Okay? Some people have it a little bit easier for them, but we can all do it. We can all come up with stuff. And you can do this with your employees. You can kind of brainstorm. So any thoughts on products for ideas? Yes, I do. I have one at the end of this fall. I'm going to tell you about this product and it's going to help you get ideas, which is pretty cool. But do some brainstorming with other people. Collaborate. It can be with people in your office. It can be with people online. It can be with people you do business with. So set aside some time for these regular marketing meetings. It's so very important to do that. And that's the first thing I would tell you to do. The next thing I would tell you to do is dig into social. Dig into social. There is a lot of stuff going on into social. Now, I think a lot of times we go into social because we want to be entertained. We want to read the funniest thing or watch a silly video or something like that. But what I want you to do on social is use it for data mining, really. Go in there and look at what other people are doing. Look at what they're saying. Look what's on their mind. What are they talking about? Look at Pinterest and Quora and TikTok and all these things. Twitter, Facebook, LinkedIn. There's so many platforms now. When somebody says, I can't come up with any ideas, I'm like, well, you haven't looked very far because there's a lot of ideas out there and you can take what somebody else is doing and make it better. You can make it different. You can put your own twist on it. You don't have to be the originator of every single idea in the world. I think that's impossible. As a matter of fact, I don't really think there are any new ideas. I think it's just people changing up what's already out there. They're improving on what's already out there. So digging into social platforms I think is extremely helpful. Let's see here. I think you need a second lunch outing to clear your mind. Yes, sometimes. Second lunch outing wouldn't be bad, though I don't need the extra calories. I can tell you that. I'm about six feet tall. I'm about 211 to 12 right now, which is too heavy, but I work out every day and I'm working on it every single day and it's an ongoing process and sometimes I slip and sometimes I fall. I talked to a friend of mine from high school yesterday, a good friend of mine, very successful guy. He's six foot four, but he's 285. He's put on a lot of weight and he's worried about it because it keeps going up. That's something we got to work on. So that lunch there, the second lunch may not be what I need, Paul. May you might check out California Newport and Deep Work. California Newport and Deep Work. Not quite sure what that is, James. If you could expound on that a little bit in the chat section, I'd like to hear about that. I know you have good ideas, so I do want to hear it. So finding a take on something that's already out there is a good place to start. You can look at something that somebody else has done and you could do a blog post or a video, but if you agree or if you disagree with one of the experts that's out there, you can also get their name in your blog title by doing that. So that's very helpful. Do something like that. So that's the first two. The next one I think is super important and I'm doing it right now and I don't know if you can notice me doing it, but that's listen to your audience. Listen to your audience. I try to do that every day. I try to listen to you guys every day. I get really good ideas from you guys. I get really good comments from you guys and finding that audience out there on social is really important, but don't try to go out and find your audience. Put out good content and they'll find you if it's any good. That's how that works. That's how I got almost 5,000 subscribers on this channel is by just putting out content and people said, hey, yeah, I want to listen to that. I'll listen to that. You can see where you're getting stuck on your post too if you listen to it. What information they're volunteering about your strategies and what you're doing. In fact, sometimes you can even get requests for more information that can turn into an entirely new blog post that you've already done something on. So you can look at that and I'm reading one of the comments here. I've got it on my screen. It says here, I'd like to see the same article done from photos of the not so famous hell that's like oh meter thing is going for them. So they were talking about this thing called oh meter and the guy responded. He says, good idea. Sean at any rate, we still think celebrity captions serve as good models. So he's kind of disagreeing with his audience. I don't know if I would have said that. I would have said, hey, that's great. We'll get some regular people in there. But you know, having a post like that's really important. Your audience is giving you feedback and never, ever, ever, ever ignore these things. You don't have to agree with what every comment goes. I don't agree with every comment I get from you guys. But I respect every comment I get from you. I step back and I think, okay, is there some validity to this? Is this something I should listen to? And in most cases, yeah, the answer is yeah. In most cases, you guys come up with really good stuff and you're very helpful to me. And man, I appreciate that, because I can't come up with everything, right? All I can do is share with you what I'm doing, what works, what doesn't work, that type of thing. Some more of that. It's good tea. Yeah, I'm really fancy on my tea in case you don't realize it. I use this tea called Lipton. That's it. Just Lipton tea. And I think a whole box of those things. A whole box is $10. You get 100 bags or something like that. Well worth the deal. Let's see. What do you guys got to say? Paul's got something to say. I bought a bunch of desk calendars that were based on books and found great ideas for $3 a copy. That's a pretty cool idea. Do you track and have a feel for past posts that allow you to do more like that? Yes. What I do, Paul, is I will go in regularly into my YouTube channel and I will sort by the most view. And it's interesting. It's interesting what people are interested in. A lot of times I'll do a video and I'm like, eh, this is so-so. And that's one of my most popular ones. I think one of my most popular ones right now, and it has been running this way for months, is how to make money from your laptop. And I don't know what it is about that title. And that's not the exact title, but it's something along those lines. So I do. I do a lot of videos on how to make money from my laptop. My laptop has made me millions of dollars. You think about that. People say, oh, those things are expensive. Those Apple ones. Yeah, I mean, it was, I don't know, three or $4,000, but it's made me millions. Is it worth it? I mean, I think it is. I think it's well worth it. When you pull out your laptop and you can sit at any cafe in America or anywhere in the world, I can sit on a cruise ship and type like this, which I don't type like this. I type like this. But when I'm typing and making money, I mean, gosh, no, it's pretty cool. So I get that people are interested in going, hey, I've got a laptop. Maybe I can make some money. Anybody can. Thanks for the YouTube tip. Yep, Paul. Yeah, I do that on a frequent basis, as a matter of fact, because that changes a lot, you know, what they're interested in.  I'm giving myself ideas or my audiences. I guess my audience is because I did a video and they liked it. They started watching it. So they gave me more ideas. The next thing, number four is check out your personas. Okay. Check out your personas. Who are your personas out there? Personas are a really cool marketing tool that will help you keep your ideal audience in mind while you're working on your marketing campaigns and materials. So some of the things here, I made some notes. Think about the age of your audience. What gender is your audience? Mine is mostly male, but I have a decent amount of female. It's about 80, 20. The age of my audience is 18 to 24. The majority of my audience is 18 to 24. Then it spreads out to 35. But that's it. That's where it cuts off. Now I know some of you guys listening here, we're well over that age. However, that's what my overall audience is. Maybe you guys are just young thinkers. I think that's true in Paul. I think that's true in James. A lot of the people are regulars in here. Eric and also Jenny, you guys are young thinkers. But think about their location. What is their income? What's their education? Do they have kids? Are they married? What are these things about them? If they have a job, what kind of job do they have? What is their career path? What industry are they focusing on? Social skills. What do they have there? What's their typical day like? What hours are they available? What tools do they use? What tools would they need to use for me? Some other things. Look at their values and fears. I think that's really important. What do they value in their personal or professional life? I know my audience values really good actionable information.  If you buy this course, you'll see how to do it. I'm just going to give it to you. I'm just going to give it to you. And if you want to get more information, you can always buy a course from me, but I'm not going to tease you with information. I hate when people do that. What's important to them when they're considering a product or a service? What really counts to them? Is it time? Is it how quickly it works? What is it? What objections do they have? What problems do they have? What drives their decision-making process? And they're all going to have goals and challenges too, right? What are some of those goals? What's the potential career goal if they're in a job? But most of my people aren't. Most of my people actually make money online. How do they prioritize these goals? How are they setting them up? What challenges impact these things? How could you help them achieve some of these goals? How could you do that? If their goal is to make $10,000 a month, what could you do to contribute to that? And that's what my goals are. That's what I do. What questions do they ask when they're seeking solutions to problems? And then you get back into, let's see, do you do same for emails and see which get more open? I do, but I don't do it as much, Paul. And the reason I don't, I think this sounds cocky, but I think I've got a grasp on what makes people open emails and what makes people click. Though the last promotion I did, I had a big image in there of me sitting at a desk and I had some canned foods and I had a book and all that. And I was curious if that helped or hurt. So I took the image out in one of my campaigns and lo and behold, it did better without the image. And I think maybe the image gave them too much information. By saying I had a video and they could click here, it made them go watch the video. So I think that helped a whole lot. Also negative information. What's the negative information? Are there customers you don't want? I know there's customers I don't want. Are they too difficult? I had one the other day that was just too difficult.  She had spent $1,000 with us and I gave her money back and I said, I don't want you as a customer. Do you have the nerve to do that? Are you strong enough to do that? Is it too expensive to acquire some of these customers? Not enough budget to do it? Or is it the wrong industry that you're focusing on? So you've got to look at all these things. And I could go on and on and on about those. But bottom line, you've got to really focus in on these personas, these people who are watching and listening to you. I think it's super important. And I think that was number four. Yeah, I got number five up here now. This is a pretty interesting one. And I've learned a lot on this one. And that is, check out your competitors. Check out your competitors. That's number five. Innovation doesn't always require a blank slate. You don't always have to start with nothing and come up with everything. You can often find unique ideas by looking into what's already been done well. Look at what some of your competitors have done. That's why focusing on your competitors' posts and videos can really be a really helpful source for new ideas for your content. Don't be afraid to look at that. That's not copying. And it's funny. I watched a video last night as a food blogger. And they were at Oscars Steakhouse in Las Vegas. They had posted the video about three hours prior to me watching it. And after I watched it, it had other videos you may want to watch. And it had four other videos of people who were food bloggers who had just done a review of Oscars Steakhouse in Las Vegas within the past eight hours. So there were five people that did Oscars Steakhouse in Las Vegas within an eight hour period. They were all different people. They weren't associated with each other. So I think maybe some of them are looking at their competition or they wouldn't be there. This is too coincidental, right? It's okay if you're doing something similar to somebody else. Maybe you're doing it better. Maybe you're doing pretty much the similar thing, but you have a different personality. You have a different twist. You have a different take on it, okay? So it's okay to look at your competitors. You can use Ahrefs' Content Gap Tool, which is a good one. It identifies your competitors' top ranking keywords. You can do that. And maybe those keywords will work for you. You know, if it's already working for them, of course, maybe it's going to work for you. You know, if you don't have a keyword research tool, that's not a problem. You could do this manually too, just with less precision. It's not going to be as accurate. But take a look at your competitors' blog and see what they're posting about. See what videos they're doing on YouTube. And then think about how you can build on that and make that that concept more creative better. You can give more to the audience, okay? And now we're down. I guess I need to do a drum roll. I can't do a drum roll on this desk because it shakes the computer. Hang on one second. Okay, just reading through some of the comments there. Make sure I got everybody. Number six. Are you ready for number six? This is all for you, Paul. I think it was you that asked about tools. Get a tool called blog post idea generator. Blog post idea generator, okay? And you can Google that. I'm not an affiliate or anything. I'm not trying to make any money off it. But sometimes you get in a rut, okay? You can't do any more digging into comments.  That doesn't mean you're at a loss. You just need to use a tool sometimes. And that's exactly why a blog topic generator exists. And these do exist. And I'm sure there's a bunch more out there. But this is a really good one. It's called blog. Let me put it in here. Blog idea generator and I'm going to say, where is it? Where is it? Where is it? There it is. Google it. Google it. Okay. And that will really help you out, I think. It's put out by HubSpot. And it's just, it's an awesome place to get started, get you going. It'll let you input up to five nouns, okay? And then it gives you five blog post ideas or more if you enter your email address. So it's really that simple. That's all you got to do. And it's a tool that will get you these ideas without you having to rack your brain. Paul says, I'm currently reviewing about 10 people to see similarities. I found it interesting how so many people are using the same tactics and strategies. I'm blown away by how everyday people become successful. Yeah. And do that all with the grain of salt. What I have seen and I've gotten sucked into it myself is I will see a bunch of people doing the same thing. Now, there's a couple of ways to look at that. And I also check the results of it. Is it that it is so popular that everybody wants to do something on that idea? Or is it they're all just copying each other and they're not even getting any results? And I don't know. And sometimes it can be one or the other. It can be one or the other. Just be very careful when you do that. Because sometimes it's just that everybody's copying each other and they're not getting a good result. So if I were to do that with videos, well, let's take Oscar's Steakhouse. And you can look on YouTube for this later on. But how many views are the videos getting for Oscar's Steakhouse? And you've got to temper this with their audience. You know, if they've got an audience of 3,000 people on YouTube, they're going to get a whole lot less views on their video than somebody with 300,000, you know, subscribers on YouTube. So look at that and kind of temper that stuff. Pulse is thanks for the tip. No problem, buddy. So that's what you got to do. Now, if you go through and you got to admit it, guys, put it in the chat if you admit it. If you did all six of these, you would be able to come up with ideas. Right? Am I right? If I'm right, put that in the chat box there, okay? Now, some of you aren't listening live. I get that. You can't always be live. But you can put something in the comments section, which is below the video. I am literally 37 people away from where I need to be at that 5,000 mark. I'd love to hit it today. Wouldn't that be great if I came back tomorrow and I had 37 more subscribers? That would be awesome. But I only want real subscribers. I don't want fake ones. I don't want people who are going to subscribe and never come back and watch a video. I want people who want this content, okay? So I need 37 more. What is that? I've got 4,963. Is that right? I think that's right. From 37, from 5,000. From doing math live, you should never do math live. Don't ever do that. Don't ever do math live, right?  Who's tried to do that stuff? But I think it is interesting what Paul said is that very ordinary people become successful.  What is ordinary and what is successful? And I think everybody starts out ordinary, right? Unless you're born into royalty, I think we all pop out ordinary. And what is ordinary? Ordinary means you just really haven't tried a lot of things yet. That's all ordinary is. Ordinary is not who you are. It's just where you are. You understand that? Ordinary is not who you are. It's just where you are. And you can change that at any point. I think it's interesting how ordinary people, I watched Dame Drops, which is a great channel. Check it out if you want. He does food reviews. But he was a guy 15 years ago who decided to turn on his camera and sit in a parking lot and eat fast food and give his critique of it. Who would have thought of that? Who would have thought of doing fast food critiques? And he has grown immensely. Immensely. He's worked so hard. He's a really great guy. He had his mom in a video a day ago. And I thought that was awesome. She was really sweet lady. So I can kind of see where he's coming from. But he then got into TV commercials. He got into Popeye's TV commercials. He got into Burger King TV commercials. He opened a restaurant in Connecticut. He opened another food stand at the stadium there. And now, and now they gave him a Netflix show. He was an ordinary guy, but he worked hard. He put in effort. And of course he's got merchandise. He's got hats and t-shirts and all this kind of stuff. But he was just an ordinary guy who put in an extraordinary amount of effort. So if you're ordinary now, it's only because you haven't put forth the effort. Ordinary is where you are, not who you are. Ordinary is where you are, not who you are. Put forth the effort. Maybe I'll put that on Facebook. I think that sounded good enough to me. It sounded good enough to you? Put that on Facebook. Let's see. Who do we got? 224 Narandrand D, Affiliate Marketing How to Work. Affiliate marketing is awesome. I do a lot of affiliate marketing. And mostly my affiliate marketing is done by people selling my products. I have a lot of my income by people posting my products.  I do it through share a sale. So if you're interested in that, I am on share a sale. You can check that out. I also do click bank. I have products on click bank. I don't promote other people's products quite as much. I mean, not like in Amazon. If you look in the description there, I have some links for Amazon for different products that I use, like these lights that are all around me, which you cannot see. But I do that. The one that came to mind is the single mom who has two kids who did an exercise video and wet her pants. Loved her success. Yeah. And yes, she did the product about how to not wet your pants. He was a bladder control one. Paul, I think that's what you're talking about. Success is the progressive realization of a worthy goal. Man, you're well spoken, James. I wish I could speak that well. Yeah.  There's the key. You're working. So many people don't want to work. I know we were editing one of my wife's videos last night and she started editing and I said, well, I've got some ideas and my ideas turned into us editing about four or five minutes of the video and it took two and a half hours. And because I just, I had all these ideas I went to put in there and I knew she was looking to be going, oh my God, do we have to, do we have to do all this? But the thing is that video is going to be really, really good. You can find that on her DIY channel in the name of that video and it's not up yet, but you do want to, you do want to check out this video. It's pretty good. And it is Thread Up. It's a video on Thread Up. If you don't know anything about Thread Up, T-H-R-E-D-U-P Thread Up. So look on her channel for Thread Up and it's a fashion trial and thing, but it's really, it's kind of funny some of the stuff we did in there. I used to like how Bobby at Flage City did his channel with affiliates and cookbooks. Yeah. And he's changed his stuff a lot now. I saw it today, Paul. He was actually doing one Taco Bell and the ingredients in Taco Bell. And I got to tell you, I kind of glazed over. I'm like, yeah, okay. Taco Bell's got some additives and unnatural stuff. No kidding. It was like, you know, he used to do more where he would go in stores and show you products like at Trader Joe's or whatever in the labels and what was in the foods. And he's at Taco Bell doing a series on Taco Bell. And it's like, we know when we go to Taco Bell, the food probably isn't the best for us, but we don't want to watch you do Taco Bell. I don't, I didn't want to watch him do Taco Bell. I turned it off, wasn't interested. So that's another thing you also got to look at, what does your audience want? You know, I tuned into him to find healthy foods to buy, not for him to tell me that unhealthy foods are unhealthy. I know that. I know that. And I'm not picking on Bobby right now. I'm just giving my input. I'm not interested in knowing that unhealthy foods are unhealthy. I know that. I get that. I know they got a lot of calories. They got a lot of salt. They got a lot of sugar. They got a lot of preservatives. I can read the labels too. But he had some really good insights on other stuff before and he had stuff that was helpful to me. Knowing that things are bad for you at a fast forward food joint, it's not helpful to me. It doesn't help me. It's like, I already knew that. Like, I don't need you to tell me that. So yeah, that's my opinion on that. And guys, I really appreciate you being here. If you haven't subscribed, please do so. Hit that subscribe button. Don't forget to ring the bell. Turn on all bell notifications so you're notified each and every time I go live. And give me a thumbs up. Guys, 37 people away. Share this video with people you think would be interested. I want to show up tomorrow and go, we hit it. We hit 5,000. That's what I want to do. But if not, guess what? I'll show up the next day and the next day and the next day and I'm off Sunday. But I'm not really off Sunday. I'm off video on Sunday. There's only day I don't do a video. But I'm still working. I do some work on Sunday. But the thing is, guys, I want you, I want you to get something out of these videos. That's what's really important to me. That's why I show up every day. So if I hit my 37 more tomorrow, that's great. If not, I know I'll get it Friday or I'll get it Sunday or Monday or next week or next month. I'll get it. I'll get mine. Will you get yours? Do you have that attitude where you're going to get yours? I was watching Dane drop this morning and he's terribly overweight. Go figure. He does fast food reviews and he was going for a walk and he was telling people, I'm going to try to go for a walk and I'm going to try to get in better shape. And then he caught himself. Then he says, no, I'm not going to try to do this. I know I can do this. I'm just going to do this. Do you have that attitude? Do you have that attitude? I mean, he caught himself and I catch myself every now and then too. I say, I'm going to try to do something. Trying is not anything. Saying you're going to do it. Definitely. That's what you need to do and you need to put it out there in front of people. He put it out in front of people. Now, if he doesn't show up for his walks, he looks bad. I listened to Quan Tron and he has a cooking channel and he was getting out of shape. Go figure. These guys are cooking and eating and he was getting really heavy. So he started another channel called Chubby QT. Chubby QT and he started exercising. He hasn't done a video in a week but exercising. That makes me kind of think he isn't exercising. When you put yourself out there, you put yourself out there to be judged. I do it intentionally. I do it intentionally because I want to be judged. I want people to say, okay, did you make any money on that campaign? Did you do this? Did you do that? When I talk about exercising, it makes me exercise. I know I'm going to go exercise today. I just talked to you guys about it. I'm going to go do my push-ups. I am now, and I've really been working on this guys, a year ago I was doing this thing where it was like 40 seconds push-ups, 40 seconds push-ups, 40 seconds push-ups, and I had a rest in between of like 30 seconds to a minute. And I could do probably 85, 90 total between those three blocks of time. Yesterday, not yesterday, day before yesterday because yesterday I did lower body, but day before yesterday I did 130. So with those three blocks, I think I did 44, 43, and 43. And each time was only 40 seconds. You got to do it 46, and they got to be good form. You got to touch your chest or your belly. My belly touches more of a chest to the ground and come back up clean all the way to the top. And I was able to get to 130. That makes me feel good. It makes me feel good that I can do that.  God, that sounds old, but I'm 61 and I can do that. And I know a lot of people who are 31 can't do that or 21 can't do that. I like being able to do what a lot of people can't do. I like being able to make millions of dollars online and a lot of people can't do that. But the fact is they can do it. That's a wrong statement. The fact is they choose not to do it. They choose not to go through the pain of getting there. And I'm like, if I feel pain, I'm like, this has got to be good for me because it hurts. That's how I look at it.  It's hard. And I know if something's hard, it's good for me. If I'm doing push-ups and I'm sweating and I'm really working hard and I'm out of breath, I'm like, this must be good for me. That's how you have to look at it. That's how we get ahead. Let me see here. I come here for the no fluff, no BS information, and the engagement. Thank you, Paul. Huge engagement in this tribe. Thank you so much. Peace and blessings, everyone. See you all tomorrow off topic. Can you use Cartra to do a funnel that leads to your Shopify store? 100%. Now, there's a couple of ways to do this, Paul. And you can do this in a WordPress site. You can build everything in Cartra, and you can take the code from Cartra and stick it in your WordPress site. Put the HTML code in there. Another way you can do it is you can build it in Cartra, whatever your funnel is, where it goes from one stage to the next. And the links in there can actually lead to your Shopify store or to your WordPress site. You can do both of those. That's the cool thing about Cartra is you can put it anywhere. And the cool thing about the code is you can use a short code. They give you a short code. So you can do this whole page with all these products and all this stuff.  And the code is only this long. This is a little string. And that string will actually make everything operate. So it's built in Cartra, but it shows up on your site, site or Shopify or whatever you want to do. Let's see here. James says walking is the best exercise. It's a great exercise. I think it's been downplayed. I know as a kid, I used to laugh at people who were walking on my men. They aren't even running. It's not doing them any good. Yes, it is. It does you a lot of good. It's less stressful on your joints. You've got to walk further, right? You can't walk for 10 minutes and expect to be in shape. That's not going to work. As opposed to running for 10 minutes, you're going to get more out of the running. However, if you walk a couple miles, three miles, five miles, and I was doing five miles on my treadmill until I burned it out. But I have a bike now, so I do it on the bike. And I'll spend an hour on there, an hour on the bike. You've got to put time in. That's a lot of people are like, well, I just want to do 20 minutes a day. 20 minutes a day will help. 20 minutes a day will not get you in shape. 20 minutes a day isn't going to cut it, okay? When I do a workout with my wife, it's usually 45 minutes to an hour. And then after I'm done with that, we take the dog for a walk, which is a couple miles. And then after I'm done with that, I get on the bike. It takes time. It takes time. Some of you may say, well, I don't have time. You have the same amount of time I do. This is how you allocate it. Don't kid yourself into that. In a future video, can you cover putting a letter in front of an affiliate offer, try to DDP 10-second push-ups, only up to seven? Well, that's the thing is you're trying. I think so many people are worried about hitting a certain number. And my number is I want to beat myself. Whatever I've done before, I want to get better at it. I know there's a limit to how many push-ups I can do in 40 seconds. Because after a while, you can only do so many push-ups in 40 seconds. And I think I'm at that limit now because right now, the other day, I was at 44, 43, and 43, which means that's more than one per second. And I think that's probably where you're going to be at. Now, my next thing may be to do how many push-ups I can do without stopping no time limit. That may be my next thing. When I was 50, I could do 100. They weren't good form. I did a video you can find it on YouTube. I think it's Mr. 100 push-ups or something like that. But I did that when I was 50. So I need to work on that. James Green, walking is good for your mind as well as your body. That's very true. And James, when we go for our walk, my wife and I discuss all kinds of things. We discuss our new home. We discuss our pet. We discuss our lives. We discuss all kinds of things. And that's a conversation that we have that's uninterrupted. I'm not looking at my phone. I'm not on my computer. The TV's not on. Same thing for her. We have to focus on each other, which I think is important to focus on each other because all couples will grow. But you have a choice whether you're going to grow together or apart. So we try to grow together. We try to help each other out, do stuff for each other, and make each other's life easier. If I can do something to make her life easier, help her out. That's what I want to do. That's my goal. And I think she does the same thing for me. So anyhow, I think I'm over. Oh my gosh. I'm at 9.37. What am I talking about here? I'm just rambling on. Too much. Too much. Guys, thank you so much for being here. I'm going to go ahead and switch my screen here so I can see what I'm doing. If you haven't subscribed, please do so. I need 37 more subscribers. Please give them to me. The internet gods, the YouTube gods, give me 37 more subscribers so I get to that 5,000 fame bit. That's what I want. And then I've got my next goal and I'll let you know all about. Okay. We'll have a celebration when I get to that 5,000. How about that? Thank you so much for being here. Please subscribe. Please ring the bell. Turn on all bell notifications so you're notified each and every time I do a new video or I go live. Guys, I really enjoy you people. I really do. I enjoy you being here. And even if you're not here live, I know I get a lot of your comments afterwards. It means just as much to me even if you're not here live with me and you post on there a question or comment or suggestion means so much to me. It really does, guys. Keeps me going. Under creating and ideas I've learned to keep under creating and ideas. Okay. I've learned to keep a pad handy for ideas in car and by bed. That's really good. And a lot of people do that. My wife does that. She has a pad of all these things she wants to do. I do it all one here and I do it with voice notes. I put my voice notes in there. I don't care if it's a grocery list or whatever the heck it is. I use voice notes and that works for me really well. Guys, thanks a lot for being here. I'm going to go ahead and get out of here.


So, hi everyone. First off, I'd like to have a show of hands. How many of you have heard about or used Tor? All right? How many of you run a relay? Yeah. So my talk is about the safety of the Tor network. And it's going to be three different topics. We're going to look at network diversity. We're going to look at the relay operators and we're going to look at malicious relays. My name is Runa Sandvik. I work for the Tor project. The Tor project is a nonprofit. We have somewhere between 15 and 20 employees and contractors right now working full-time on Tor and other projects. And we have volunteers all over the world. We're also hiring, so if anyone's looking for a job, come see me after. The goal of Tor is to promote free speech, free expression and privacy rights online. And we do that by developing Tor. We also do a lot of education and outreach. Over the past two years, we've done a lot of training for journalists. We've met with activists. We have done a lot of work with survivors of domestic abuse. And so we do a lot more than just developing this tiny piece of software. So, sort of like the background for my talk, over the past two years, I've had the opportunity to travel a lot. I've met with a lot of interesting people. I've met with activists in Beirut. I've met with journalists in Istanbul. I've met with university students in D.C. And a lot of them have the same sort of questions about Tor and the Tor network. How safe is the Tor network? Who are the relay operators? What about malicious relays? How much network diversity is there? And what about the CIA, NSA, Prism, and so on? So if we're going to just comment on one straight off, the CIA does not run Tor. Tor is not a CIA honeypot. Tor was originally developed by the U.S. Naval Research Lab. But that was before 2000. Since 2002, Tor has been completely free and open source and developed by the Tor project. So before we start kind of go deeper into these topics, I kind of start with a quick introduction to onion-reading. So there's two ways that you can run Tor. You can run Tor as a relay or you can run Tor as a client. When you run Tor as a relay, you will set it up on a computer or a Raspberry Pi or whatever it is, your toilet. And you can decide to run it as an exit relay or a non-exit relay. You can decide whether or not you want Tor users to exit onto the public internet from your computer. In the case that you're not running an exit, you'll be running what's called a non-exit. And that non-exit could also be what's called a guard relay, which is the first server that users connected. So running Tor as a client, you download Tor onto your computer, you open it up. And your Tor client will then, first off, download the list. It's called a consensus. Download the list of all the relays in the network. And out of those roughly 4,000 relays right now, it will pick three guard relays. And for the next two to three months, it will only choose between those three when it chooses the first hop. So after choosing that guard relay, it will choose the middle relay and the exit relay. And after that, Tor will set up a connection between your computer and the guard relay and negotiate a short-term session key. It will then connect through the first server to the second server and negotiate a second short-term key. And it will do the same for the exit relay so that when the whole circuit, which is the connection from you to the last, from you to the destination website, is set up, the data that you send, for example, I want to visit twitter.com, will be wrapped in three encrypted layers. So you send off the packet from your computer to the guard relay. And the guard relay will then peel off that third atom most layer and see that, okay, the packet came from you and it's going to somewhere else in Tor. So it will send the data off, it will send this blob of data off to the second relay. Second relay will peel off that second layer, see that the packet came from somewhere in Tor, it's going to somewhere in Tor, but that's all it knows. So it will send it off to the third exit relay, or the third relay, the exit relay, which will then peel off that final layer, see that it came from the middle relay and see that it's going to twitter.com. So in this model, there is no single hop that will see what you are doing online. Now the challenge here is that if someone, the same person owns the guard relay and the exit relay, that person can see what you are doing online. That person can see that you are using Tor to visit twitter.com. Another issue is the exit relay. The exit relay operator can't look at any traffic going from her relay to the public internet, and I'll get back to that later on. So at the moment there's roughly 4,000 relays in the Tor network, pushing around 2,500 megabytes a second in aggregate. And you would think that 4,000 relays, we have like 600,000 daily users, and you think that 4,000 relays is a good number. But if you look at this graph, it shows that out of those 4,000, only 1,000 of them are exit relays. And only 1,000 of them are guard relays. So when your Tor client is trying to choose which servers to send traffic through, it only has 1,000 or less options for the first hop and the third hop. So I figured a lot of you will probably want to know about how Prism or other spying programs affect Tor. And Tor was originally designed to protect government communications, to hide where you are and who you're talking to.  But Tor can give you location anonymity. If you're here at DEF CON and you're using Tor to connect to Twitter, Twitter will see that you're the one logging on, because you have a username and a password, but they won't know that you're here. So like I mentioned, if the same person owns the guard relay and the exit relay, they can see what you are doing online. And recently, after Snowden-Leedle, all of these documents, we learned that there are countries polluting, there are countries working together on other spying programs. So now the issue, the concern is not so much who's running the relays, but who owns the links, who control the ASS, who controls the internet exchange points. It's not necessarily about the relays. So this kind of all fits into whether or not we should consider different threats, if we should reconsider the threat model for Tor. And so this is a paper that is, it will be published later this year, that a group at the US Naval Research Lab worked on. It's called Users Get Routed, Traffic Correlation on Tor by Realistic Adversaries. So they took Tor the way it works right now and looked at what happens if you're sending your data through relays that it happened to be controlled by the same entity, by the same ASS or in similar internet exchange points or by countries that are now known to work together on different spying programs. We are sort of considering how we can approach this. We're sort of trying to figure out if changing the way Tor selects relays is something that we should actually do or if users are safer now, than if we were to choose a different algorithm. So that is ongoing research right now with considering, I guess, when you're using Tor. So that sort of fits in with the topic of network diversity. You probably can't see that table, but so all this data is public and this one is from compass, c-o-n-p-a-s-s.torpod.org and it shows the likelihood that you will have your guard relay, your metal relay and your exit relay in different countries. So at the top of the list, there's a 25% chance that your first server will be in the US. There's a 23% chance your metal server will be in the US and there's a 34% chance that you will exit in the US. And below that, there's a 29% chance that you will enter in Germany, and the metal relay will be in Germany, but only a 6% chance that you will actually exit in Germany. And the top of the list is US, Germany, Netherlands, France, Sweden. So we have 4,000 relays in like 150 different countries. But Tor will look at the relays that are offering the most bandwidth when choosing which relays to use for its path. It doesn't look at the countries, it looks at the bandwidth, and so the more bandwidth you offer, the more bandwidth that users will actually pick your relay. But that means that we may not actually have as much diversity as we would like to because all the relays are in countries like the US and Germany where bandwidth is free and where hosting providers are actually happy with us setting up relays.  I wanted to see if I could answer the question of has the NSA ever set up a Tor relay? So I looked at all the data, all the consensus documents that's been generated since 2007. It's all on metrics.torproject.org. And I tried to figure out, you know, who owns the IP addresses? That was sort of my starting point. Who owns the IP addresses for all of these relays? And I did not find any government entities running relays. That means, well, one, they're not running any relays in their own data centers. But also that maybe they're not running relays at all. We now know about all of these spying programs. We know they have access to links to internet exchange points. They have connections all over the world. Why would they need to run relays? Right? They have access to all of this information in a number of other ways they wouldn't necessarily have to run relays. A couple of sort of interesting observations or relays that did pop up was TBreg.  So TBreg was the nickname of a few Tor relays that were running inside China. And were running as Tor exit relays inside China. And over the course of a year, TBreg had 20,000 different IP addresses associated with it. Now, I don't know who inside China would have access to, well, one, be able to set up a Tor exit relay. And two, have 20,000 different IP addresses in a year. But my guess is that government, university maybe. But we don't know. We never actually caught this relay doing anything malicious. And after a year, it sort of just fell off the grid and we haven't seen it since. A couple of years later, Trotsky popped up. It was the name of a number, a couple of thousand relays in Eastern Europe, all running on sort of dial-up or at least offering very, very, very little bandwidth to Tor. So there was, it wasn't an exit. There was no contact information given as to who were the relay operators. And at that point, we decided to take it out of the consensus because we believed it might be a botnet. We haven't really been able to figure out whether or not it was a botnet, but we only saw Trotsky for two, three weeks and that was it. So when I said take out of the consensus, we have a way, and I'll get back to that later, we have a way to, when we see that there are relays misbehaving, we have a way to mark them as bad and then take them out of the consensus. It means that when client downloads the list of the Tor relays, they will just not choose bad exits for its circuit. So Orbot is, yes, Orbot is the Tor for Android. So you can run Tor as a client on your phone or your tablet and you can browse through Tor. You can also run Tor as a relay on your phone or set up a Tor hidden service. And I saw a number of nicknames, a number of relays with the Orbot nickname popping up in the Middle East. There are a lot of users with mobile phones, with smartphones, and apparently a lot of them set up relays a couple of years ago as well. So there are a lot of different groups sort of running relays. There are those who run relays on a Raspberry Pi. There are those who sort of try and run bigger groups of relays in the case of Orbot or Trotsky or TBreg. They may or may not actually be malicious. Then there's the groups that are sort of supporting the Tor network in a completely different way and in a very, very good way. So who's sort of TorService.net? Some. Okay, so TorService.net is a German nonprofit whose only goal is to increase network diversity. They will take donations and spend that money on relays for the Tor network, primarily TorExit relays, which is when you saw the list of, you know, there's a 23% chance that you'll exit in the U.S. or in the Netherlands, most of those relays actually belong to TorService.net. So when you're using Tor, you are more likely to end up using a relay owned by TorService.net or one of the other groups that I'll show because they're running so many relays and because they're offering so much bandwidth. So you're more likely to use relays that are run by people that we trust rather than some random guy in, I don't know, the U.K., for example. The Chaos Computer Club is sort of similar. They also run relays offering a lot of bandwidth. I think if you create a list looking at which relays offer the most bandwidth, Chaos Computer Club would come up as number two. So another group is BFRI in Sweden. They just set up, I don't think they have non-profit status yet, but they've just sort of managed to get everything together and they're able to accept donations and spend, just put the money towards actually running high bandwidth relays. Another group is Noise Tour out of San Francisco. They will also take donations. Some of these groups, I'm not sure about all of them, they will also take donations in Bitcoin. So if you can't run a relay, then maybe you can just donate to someone who can actually set it up for you. So malicious relays. There are, I guess, three groups of malicious relays. The first one is malicious but not intentional, meaning that someone set up an exit relay and they have, you know, they have open DNS or they have an antivirus that is blocking certain sites. And while they may feel safe using that, having that on a tour exit relay means that users will also, tour users will also sort of end up with the same filter. So if they can't visit Google.com then, you know, any tour user will be unable to visit Google.com. In those cases, we try to contact the relay operators. So when you're setting up a tour relay, you can sort of put in your contact information if you want and if something is actually wrong or we're asking you to upgrade your relay or something like that, we know how to contact you. So we will try to contact these relay operators and sort of ask what's going on and see if maybe they can reconfigure their computer to not censor users. The second category is straight up malicious.  We will try to contact the operators when we can when there is contact information given. But if they're found to actually be just malicious and they don't have contact information we will just take them out of the list. The third category is passive sort of more malicious but not necessarily detectable in the sense that they will be logging traffic. So I mentioned that, you know, when you're using tour the traffic from you to the exit relay is visible to the exit relay operator. It means that the exit relay operator can see what people are doing online. They won't know necessarily who's doing what but they'll see what people are doing which websites people are visiting. And in some cases people set up exit relays just to log all of this information. That is not something that we can actually detect and that is a risk. Just a risk to be aware of. But I would say that it's probably safer to use tour than not these days. So a question I often get is how bad can it get?  My answer is that it depends. I know that's usually an answer that you'd hear from a lawyer but it really does depend on what you're doing and for how long you're doing it and whether or not you're actually logging on. Say, you know, you're using tour to access Twitter.  Now, if you choose to accept that certificate and log on, you're giving your like the adversary, the attacker, your username and your password and you have lost. And that is true regardless of if you're using tour or not. In the other case, if the person is just logging traffic and you're not logging in anywhere and you're not communicating any sensitive information then that person will just get lots of random data lots of websites that you're visiting but not necessarily a way to tie that back to you. Another thing to note is tour when creating those circuits when choosing those three relays and using them to visit all of the websites that you're visiting tour will choose a new path for your traffic every 10 minutes. So if you're visiting Twitter and you spend, I don't know, 20 minutes on Twitter and then you open a new tab in your browser tour will create a new circuit for you. Whenever Twitter has to open a new TCP connection to pull a new content, tour will open a new connection for you. So I'm not sure how to like best answer this question of how bad can it get but it really does depend on what you're doing. But I think in a lot of cases it's probably better to use tour than to not to use tour and the threads that you see on tour are pretty similar to this, you know, we're using the open wireless network at Starbucks or elsewhere. So we have a couple of different tools for sort of finding these malicious relays. The first one is called the consensus tracker which we created somewhere between the time we saw TBreg pop up in the consensus and Trotsky. So consensus tracker is essentially just a script that every hour it will look at the list of relays and figure out which relays are new which relays just join the network and it will just send us an email and anyone can subscribe to the list and see the list of new relays joining the network. So the information we get is sort of the IP address, the port which ports the if it's an exit relay which ports it allow exit to a content information if that has been set just sort of like basic info. It doesn't really check for maliciousness but if we suddenly have like 1,000 relays pop up in Syria it's at least something that we can monitor and keep an eye on. So a couple of years ago we created snakes on a tour or SOAT as a Google summer code project. The goal of SOAT was to have a set of tests that would allow you to check for fake SSL certificates any sort of like tampering with DNS any other types of censorship and it sort of worked for a while it was written in Python 2.5 and it is no longer maintained. So for the past probably 2, 3 years we've been working on another project called UNI the open observatory for network interference which if you run what's called UNI Pro the clients it will check for censorship essentially and hopefully in like 6 months or so UNI Pro will be able to do what SOAT ones did so that we can more actively check for malicious relays or misbehaving relays. So the tool we have right now is the tour exit SSL checker and it is one thing it checks for fake SSL certificates it will take the list of exit relays and a list of URLs that you have given it say twitter and gmail.com and it will connect to the exit relays and download the SSL certificate and then it will do the same over non-tour and compare it to and if there is a difference it will give you a warning. So yeah, we only check for SSL certificates right now we hope to be able to check for other types of malicious behavior in the future so there's like 3 I guess 3 topics that I sort of wanted to touch on that I hope that you will leave this talk with 1, I want you to use tour it seems like a lot of people are already using tour in the case that you're not please do we always say that anonymity loves company so the more people that use tour the better off you are if you're the only person at DEF CON using tour you sort of stand out if you're one out of 12,000 people here using tour you're better off so the more people use tour the better 2, run or fund a fast relay not a lot of people here run relays I'm not sure why if it's like a bandwidth if you just don't know how if you're worried that you'll be an exit relay but no matter what the reason is you can always fund a fast relay fundingtourservice.net we're back we are I think you know the routine everyone else in the audience what are we going to do now I have the mic can I just get really close then no just talk really loud that was a good answer you all know the routine what are we going to do oh yeah do we have any first time attendees awesome you sir come on did you can I say that sure you can say that alright to our first time speaker and our first time attendee I got a lot of time for questions I sort of wish I had started with that um you can run or fund a fast relay and help increase network diversity or you can run an exit scanner or help us improve the ones that we already have and help us find new relays so at this point being first time speaker at DEF CON and sort of talking a lot faster than I usually do I have a lot of time for questions so if you have questions you can line up with the microphone up front I got half of that do you want to try and repeat it okay is it is it safe legally to run an exit relay if the people using your exit relay are doing illegal things running an exit relay is um in some cases it can be a bit risky so it means that any tour user 600,000 users a lot of them will be using your server to access the public internet so it means that anything that they do online will be seen as coming from your computer from your IP address over the past years there's been stories about people in Germany having their doors down and their computer is taken or a series of DMC takedown notices and similar we have spent a lot of time trying to educate law enforcement teach them what tour is how it works when or how they would encounter a tour when investigating people um and that's worked out pretty well we have sort of helped them understand that when they do hit an exit relay it is tour it doesn't actually log any information there is no information to be found there about the tour users but at the same time if you feel that that is a visc then running a non-exit is probably the safer option so we have a blog post called um tips for running an exit relay with minimum amount of harassment which sort of just lines out series of steps and things to consider if you want to set up an exit relay sort of you know running on a dedicated server don't have your personal photos and GPG key and whatever else chat logs on the same server that you're running a tour exit relay do not encrypt that drive in the server that is running the tour exit relay if you have a server with a non-encrypted disk running only tour as an exit relay and tour is not logging anything there will be no information on that server for law enforcement to dig through so I would say if you consider setting up an exit relay that would probably be the first um for sort of page I would send you to read up on whether or not it's safe legally I'm not a lawyer so I can't really answer that question that's right like sanitary tour yes list of it's a service that allows you enter an IP address and see if server X was running as a tour exit relay at time Y so in the case that you do run into issues with law enforcement you can use that service to sort of point them to this to our page sort of explain to them that you were actually running an exit relay if you do run an exit relay if you run into problems you can also email us and we will send a signed letter just confirming that yes you were running an exit relay at that point in time so there's hidden entrance nodes via bridges has there been any look or work into having hidden exit nodes in a similar way so having hidden exit nodes so question is about bridges the image that I showed of how tour works that mentioned the guard relay we also have something called bridges which is similar to the guards just that they're not listed on the internet you can't find a list of every single bridge which means that if you're in china and you need to connect to tour and tour is being blocked and you can use a bridge instead I don't think I'm not sure if we have even considered hiding the exit nodes would really be a good defense it sort of seems to me like it would be just a bit of an arms race you know would hide them, someone would find them and it would continue from there what about what about running relays in the cloud and how for instance if there are just a whole bunch of cloud based like Amazon AWS based relays what does that do to your network diversity okay relays so with Amazon specifically you are allowed to run a bridge running a relay is also allowed as for their terms of service but you will be paying too much money for bandwidth so you just don't want to do that and an exit relay is not allowed in their terms of service but if someone were to suddenly set up thousands of relays to join the network I'm not sure it would help the diversity too much so Tor will only pick fast relays to use for its circuits so if you have like a thousand slow relays joining the network then we would have a thousand slow relays joining the network I don't think it would do much to users my question is pretty specific regarding are you aware of whether or not google fibers restrict you from running an exit relay or not google fibers terms of service would that restrict you from running an exit relay or not I don't know if anyone from google is here can answer that question then we would all like to know no servers at all if anyone from google is here then I'd like to talk to you I didn't hear the full if there are more malicious relays than none if there are more bad users than good users okay we don't know so you go to our website and you download Tor and the only thing that pops up in our Apache logs is that someone visited Tor we know that people are downloading Tor but that is that we have no information we don't know what you're using Tor for back in the day someone did a study to see which protocols were used the most and it was mostly web traffic but apart from that we have no way of telling what people are doing over Tor we were accidentally banned by Facebook yes the issue that was a month ago okay so it does happen so someone used Tor and from publicly available content from Facebook and Facebook accidentally blocked a ton of Tor exit relays so it does happen but we have no way of telling how often it happens or how many users are actually misbehaving in that way what about hidden services for hidden services dubbed by the media is like dark web, deep web is a way of hosting content over Tor so it means that you can set up a website and it will have the URL of like 16, like a random string of 16 characters and dot onion at the end and it will only be accessible over Tor and no one will know that you are the one hosting the site and you will not know who is visiting the site because everything is over Tor the content cannot be censored we cannot find out who is actually running Tor hidden services and so it's sort of just anonymous hosting in a way recently there was a paper published pointing out a number of issues with Tor hidden services and we wrote a very long blog post explaining all the things that we would like to see improved with Tor hidden services so when you set up the question was how do you establish trust for the consensus how do you make sure that the list clients download is a safe list when you set up a relay your relay will tell nine directory authorities that it exists and these nine directory authorities will then confirm that your relay has the IP address that you've said that it has the nickname matches if it's an exit it will make sure that you can actually exit and then these nine directory authorities vote on this information whether or not that information is correct if the majority of them vote that yeah it's correct it's valid then that really makes it into the consensus and once they have done that for all the relays in the network that list is then signed by every single directory authority and when the client downloads this list they will check that the signatures are okay I had a follow up question to that who controls the directory authorities and who controls the onion domain name servers the directory authorities are run by core tour project developers or people that we trust so there's a good mix of some of them are in the US some are outside of the US some are run by tour people and some are not but you have to be a trusted member to be able to run one the second question was about the dot onion domains no one really controls that you generate a domain when you set up a tour hidden service and that's that Japan is there diversity in the directory authorities to protect from court orders for a specific country um if the NSA served us with any type of letter to mark really is as bad and to effectively redirect old tour traffic to the NSA then we just wouldn't do it is there any way for an exit relay to figure out who the tour user is no so the only information that the exit relay has is that people are doing stuff that people are watching videos of cats so the only thing that you can do if you were to attack tour users would be to make sure that you are that first hop that you are the guard relay and that you are the exit relay and doing that when targeting a person seems really really difficult I mean I'm sure you have way better options to actually target people than to try and spend a thousand tour relays so tour is TCP only right now we have a proposal for UDP but I'm not sure what the status is I don't think we've done a lot of work on that for a while we have done more work on getting tour to play nice with IPv6 sorry hardware can you repeat that hardware integration okay thanks so we have a project called the tour router which the goal is to just take like a stock router and put tour on it and make sure that it sets up a wireless network where everything that you do on that wireless network is sent through tour and that it is also running as a bridge or a relay or an exit relay for example that project will probably be announced in about six months projects like the onion pie I know freedom box I've sort of worked on some stuff there's a lot of work being done we need more people to sort of help us test those projects but we don't have anything right now if you're running an exit note to filter traffic then you just might as not don't run an exit note at all like sure okay if you want to talk about child pornography specifically running an exit relay to filter content in general means that who are you to decide what people can and cannot watch online right if you obviously I think we all agree child porn is bad but what if we gave people the ability to actually decide what tour users can and cannot visit through their exit notes and I decided watching the videos of cats is not bad so suddenly I am censoring a number of tour users who wanted to look at totally legitimate things so we just decided that we shouldn't decide what users can and cannot watch it also means that we cannot be asked or forced by anyone to censor anything or give out any type of information we don't have anything filtering certain sites like child porn sites that are illegal where I am in my jurisdiction do you think it's worth running an exit under that situation are you guys desperate for exit notes we are desperate for exit notes but we would prefer exit notes that are not touching user traffic regardless of what it is there are absolutely no logs none so the question was do we have any logs at all and the answer is no we don't have anything when you visit our website to download tour we write just zeroes in the log or we write all zeroes if you are visiting the HTTP version of the site and one at the end if you are visiting the HTTPS version so you download tour and we don't know that you downloaded tour you start up tour and the only there are sort of two entities that will know that you are using tour they won't know what you are using tour for and the exit really won't know that someone is using tour to do something but they won't know who so there are no logs there is nothing to be subpoenaed we cannot be given any magical letters to forces to do anything we don't have any info battery users it's a good point the ISP yeah the ISP whoever the backbone provider is it's a good question if they actually look at that traffic do you know is that like a common thing for ISPs or service providers on a top level does a backbone provider log incoming connections to websites that are hosted by by people sorry if we want if we are going to put together a list of tour projects is that the question tour apps do we have a list on our website talking about products and services that we have and if you're not in that list then it is not a project that is maintained or developed by the tour projects no I have not seen any tour exit notes attacking browsers so for users running like the tour browser bundle what safeguards are in place to prevent the exit relay like a malicious twitter.com and sending some sort of malicious program back to their computer to kind of make a connection on the open web so if there are any restrictions on what kind of protections are there so the tour browser bundle blocks a lot of things by default like flash and java things like that but that is it if an exit relay is actually able to inject a very specific type of exploit into the user's traffic then there are no if you can do that without flash or java or getting the user to open an attachment then you win so he's waving at me saying that I'm out of time so I figured we can chill out room if you have more questions and we can kind of continue there thanks


Good morning everyone. This is Melissa Armo with the Stock Swoosh, and I'm here reviewing IBM. I had made an option call on this on Friday, and I called the 155 puts at expiring for a good three weeks. May 26th, and it gapped down today right in the money. What an amazing call that was. Really, really good. Loaded it was 152, so you were almost up $3 of the money overnight from Friday to today. This was a gap down that happened on Friday, and it didn't set up right as a short as a day trade, but it was as a longer term short because it rated well. But on the day, it just never set up right as a short. So you still have to rate the gap you have to get the entry right. The entry was not there on Friday for the day trade, but it was for the longer term trade, so I called the put. It's in the money today. It was another amazing, amazing option call that I've made, and it's all due to the point rating system. It's a 26 points. That's what tells me when a stock is good. Today traded to do a swing trade, to do an option trade, anything, everything. This 26 point system I created is the bomb people. It really, really, really tells you what a stock is going to do on the live day and the longer term in the bigger picture. So everyone was up in this this morning. Everyone that did the in the letter and everyone in the room because they gave it to the room as well. So congratulations to everyone that did it. Great job. Email me at Melissa at thestockswish.com if you would like to sign up for the options letter. It's $29.99 a year, or if you would like to do the golden gap class, which is May 20th and 21st and learn my 26 points. Email me at Melissa at thestockswish.com. Have a great day, everyone.


Hello everyone, and welcome back to another episode of The State of the Web. My guest today is Emily Schechter, who's here to tell us about HTTPS. You probably know of it as the thing you need to enable to make your site secure, but Emily's here as product manager on Chrome's security team to explain how it's so much more than that. Let's get started. So Emily, thank you for being here. Thanks for having me. I'm excited to be here. Could you start by telling us about what is HTTPS and why is it so important? Yeah, so HTTPS is actually just HTTP, but over a secure connection. And what HTTPS actually gives us is identity, encryption, and integrity. So what that means is if you type HTTPS Google.com into a web browser, you can be sure that you're talking to the real Google.com, not some fake Google.com. It also means that no attacker on the network can actually see or modify any of the traffic. And this is actually really important because the collection of sites that you're browsing actually says a lot about your intentions, your behavior, and your identity. And the web is actually continuing to get even more powerful as Chrome tends to add new features to the web platform. For example, the web now has the geolocation API, which means that sites can see where I live, where I work, maybe where my doctor is or my kids go to school. So I really only want that information to be private between myself and the site that I trust. So HTTPS gives us these guarantees and this is why we think it's really important for the whole web to be HTTPS by default. So it's been around for a while and it has kind of accumulated some misunderstandings around it. Can you kind of help dispel some of the myths around it? Sure, yeah, so HTTPS has actually been around for quite a long time, but for many years it actually was very expensive and very slow and really hands-on and confusing to set up HTTPS. But the reality is that people all over the web have worked hard to make that change and it's become a lot cheaper and a lot easier to set up HTTPS. People still now think, you know, some of these myths about how it used to be are still true, but the reality is that that has changed. So for example, it used to be really expensive to set up HTTPS because you had to buy a certificate from what's called a certificate authority. But now there are certificate authorities out there that will give you a free certificate and make it really automatic and easy to set up. One of the examples is Let's Encrypt. So this has actually changed HTTPS and made it much easier to adopt. So what is the state of HTTPS now? I look at HTTP Archive data and it says that adoption is around like 60% and when you go back and look through like seven years of data, you can see it's actually rising like pretty steeply. So what are the tools that you use to understand the state of HTTPS and what is it? So Chrome has a public transparency report where we publish data about what we're seeing in Chrome in terms of the amount of HTTPS usage that's out there on the web. So for example, what we're seeing is the usage in Chrome on all of the different Chrome platforms on desktop and on mobile is been rising over the years. And if you go on to the HTTPS transparency report, you can see Chrome platform, how the usage is increasing. You can also see not only this in terms of the pages that are loaded over HTTPS but also browsing time because as you might imagine, people are spending different amounts of time on different sites and we can see that across the different Chrome platforms is growing as well. It's also broken down by country which is pretty interesting because you can see how different countries all over the world are doing on their adoption of HTTPS. Some other things that are on the transparency report are HTTPS adoption actually at Google. So you can see Google is a big site just like any other site. It took us a long time to actually get this ramped up. And so it's pretty cool that the transparency report also shows how HTTPS has grown at Google for all of our different products. So what kinds of things is Chrome doing to increase HTTPS adoption? So I would say there are two main areas where Chrome has made slow changes over time to encourage HTTPS adoption. And the first is in Chrome's UI for connection security. So Chrome shows an icon in the address bar that indicates connection security and we've actually changed this icon over time to help users understand the lack of security in HTTP connections. So Chrome used to show just this plain circled I icon for HTTP connections and we thought that was actually a problem because it really doesn't indicate to people at all that there's no security with an HTTP connection. And what we'd actually like to get to for all HTTP connections is this kind of scary, red, not secure warning. But we think that if we just roll that out for all HTTP sites right away it actually could cause some panic, right? Because we don't want the web to seem scary. We don't want people to see this warning all the time. And we've also seen that people get what's called warning fatigue which is that if they see warnings too many times over and over they start to ignore them, they stop paying attention to them. So we want to be honest with users without sort of inciting chaos and panic. So what we've done is we've actually rolled out the warning slowly over time increasing. So we first started showing this gray I, not secure, in the address bar just for HTTP pages with passwords or credit cards. And then sometime later we started showing the warning also when users enter data or for incognito pages. And we actually just announced that in July of this year we're going to start showing it on all HTTP pages. So we've actually rolled that out over time. We've seen the amount of HTTPS usage increase. And because HTTPS usage has increased then we're not too scared about the warning fatigue that would have shown from the warning. And so what about the technical APIs on the web? Right, so another thing that we've done in Chrome 2 encourage HTTPS adoption and also to make the web more secure to require HTTPS for web APIs that are very powerful. So for new APIs that have come out like Service Workers, because Service Worker is such a powerful API we've actually required HTTPS to use it. This also goes for HTTP2 which really improves performance and it actually requires HTTPS. But we've also taken a look at APIs that already exist on the web and we've actually deprecated usage over not secure connections to HTTPS APIs that are very powerful. So an example here is Geolocation. There's also GetUserMedia which is about getting the photos on your phone. And so now sites can no longer use those over HTTP. This is like patching holes in security on the web. Exactly. That's great. So where do you think we're heading with HTTPS? Are we going to achieve 100% adoption and then we can all like go home or is our job not yet done? As we talked about earlier, HTTPS is still not at 100% yet there. So we still definitely have ways to go. I don't know that we're going to get to 100% because I think there's always some kind of driftwood sites on the web, things that people don't maintain. But I would like to see us get close. So if you know any sites out there that are still HTTP you should go tell them to turn on HTTPS. They said no then tell them to come talk to me and I'll tell them why they should. And users on the web can also vote with their feet. If their bank isn't secure, go find a secure banking website. Put your money somewhere else. So what are some of the knots that websites need to untangle when they need to make that switch from HTTP to HTTPS? Yeah, so migrating your website to HTTPS it's not as easy as just putting an S on the end of the name of the website. It's not as easy as just getting a security certificate. You actually have to look and make sure that all of the services it depends on also support HTTPS. So for example a large complex site might depend on many ad networks maybe analytics providers. And so the sites have to sort of take an inventory to first see what are all of these third party dependencies that I have and then do they actually support HTTPS and then if they don't they might have to go out there and actually convince them to start supporting HTTPS. So it can actually be sort of a project management type project as well to like make sure that you've sort of done spring cleaning up the whole site. Well Emily, thank you so much for being here and telling us about HTTPS and I learned that there's so much more to it than just the S at the end of the URL or at the end of the protocol in the URL and how it's actually like deeply ingrained with the APIs that people use. Thank you for being here. Sure, thanks for having me. So if you'd like to weigh in on the HTTPS discussion leave a comment below. We're gonna have links to everything we talked about in the description. Tune in next time. Thanks for watching. We'll see you in the next one.


Giancarlo Stanton did not see a lot of live pitching prior to joining the team. Are you at all surprised how quickly he's settled in at the plate? No, I mean, I'm not going to put anything past Giancarlo. And the one thing is for a couple of weeks, he's been working, you know, he's been able to hit and whether it's high velocity machine, breaking balls, you know, so he's been he's been preparing, he's been getting his mind ready for this.  And, uh, you know, obviously a lot of great at bats by him tonight. Five home runs in the fourth inning. That's not something that happens often. Can you just describe the mood in that dugout as that inning is unfortunate? Yeah, it was, that was a lot of fun. I mean, to see the guys, you know, obviously a tie game going into that inning and then, you know, everyone just started unloading with, with just really good at bats.  And here we go. And again, just really good to see everyone contributing. James Wagner, go ahead. Please unmute. Aaron, I feel like we haven't asked you this since like last year, but like is there such thing as too many home runs? You guys set a record for most of three games series. Three days. No, there's not. Who else? Errico, go ahead and unmute. What did you see from last night today? I thought he got better as the night went on. You know, I thought, I thought he found his split too in the middle of the game and really started executing some good splitters that became a factor. I thought early on a couple of mistakes hurt him and he actually got away with it with some mistakes. But I thought, I thought he got into a good groove as the night went on. He did a really good job fielding his position. A couple of good plays. Adam, a big cutoff that he made and threw the, threw the shed out at second for a big out when they were kind of putting a rally together. So it was good to see him, you know, as the outing went on kind of improved. And I thought kind of find his splitter a little bit too.


Imagine attending a webinar and being engaged for the entire duration. Think content that really inspires. Presenters that keep you online for longer and technology that just works. Well now you can run webinars just like this. Here at RedBat Connect we're all about digital events done differently. We're about helping you capture your online audiences and ensuring your webinars are a success from start to finish. So how do we do it? We go beyond the technology and focus on your content, your presenters and your audience experience. Let us help you design and deliver your webinar programs from concept to completion. From strategic advice to training your presenters and providing tips to engage before, during and well after your event. Tired of small webcams and out-of-sync audio? Present from our state of the art webinar broadcast studios in Sydney or Melbourne and experience high definition quality and TV quality panel discussions. Looking to stream your physical event to generate revenue and engagement? Well we've got that covered too. I'm Sarah, I'm the General Manager of Digital Events here at RedBat Connect and it's my job to ensure that your webinars stand out from the crowd. RedBat Connect, digital events done differently.


I manifested this. No, really, I'm gonna get right into it. The cruise they asked me to show what I would give my friends for their upcoming weddings. I'm gonna open these up and show you what I picked. First up is the five and a half quart signature Dutch oven. I'm gonna give this to my best friend and made of honor page because she deserves the world. Next up is the three and a half quart razor. This is going to another best friend who's getting married. She's getting married in Maine on the ocean. And I just think that like this color Marseille is perfect for the occasion. And she's gonna cook with this all the time with her new husband. I'm just that age where all my friends are getting married. This is gonna be for my friend Heidi. She loves to cook. And I can just see her making like a really good baked ziti and then she's gonna love it. The thing I love about La Coussée is say you're running late, getting a couple of gifts from the registry and there's no cute options left. You can just send them a La Coussée. Even if it's not on the registry, you know they're gonna love it.