Hello everyone, my name is John Hammond and welcome back to the YouTube video and today I want to be showcasing one of the web category challenges from this year's Google CTF That was online this past weekend. The Sun is like right there So please forgive me if I have apparently a halo on the side of my head But before we dive in I need to put out a disclaimer. I had not solved this during the competition during the capital flag itself I'm not that good. First of all And I didn't spend a whole lot of time on this. It's funny I think my friends and I opened up the Google CTF and we looked at it for like maybe an hour or less and then we're like Okay, we should probably go prepare and keep building challenges for the CTF that we're hosting next month So secret spill there, but admittedly I did not spend a ton of time on this So I'd love to showcase more Google CTF stuff for you, but honestly, I'm not that smart I'm still learning and especially for capital flags that are like this. They're legit Man, I still have a lot to learn too So I will be showcasing this with the help of write-ups that I have read and I do want to use that to footstomp and emphasize Don't hesitate to read write-ups. We're all trying to learn. The whole point is to get smarter and get better So I have looked at this more when I was going through it the first time in my perspective I'll showcase the kind of the rabbit holes that I fell down And then when I put it away and I didn't go through the solution now that I know that through the write-up I wanted to share that with you. So that's my disclaimer. Anyway, let's dive in. This is pasteurized This is literally the easiest like lowest point value challenge that Google CTF had I still wanted to showcase it for you because there might be some kind of cool and neat and interesting tricks So let's fire it up. This challenge says it doesn't look secure I would even put the I wouldn't put even the little a secret in here My source tells me that the third parties might have implanted it with their little treats already Can you prove me right? So we have this URL Clicking on this it looks like pasteurized and I pronounce it pasteurized because I realize that's kind of the The gimmick of this challenge where you can create a new paste And we could theoretically just type in anything here. So please subscribe sure I'll submit that and That will apparently render out my input on the page And I guess that's kind of the idea the number numeric value for that specific note or paste that we've gone in here We could share with tj mic interesting And we can go back. Okay, so I can add in anything we particularly want here So since we had that option to share with tj mic That's oftentimes very similar to like a okay report to admin or maybe tj mic is the admin and If we can input pay input data onto a page and it might be shown again Potentially this web challenge is setting us up for a cross site scripting attack if we are reporting it to an admin maybe we might do some Interesting dynamic like browser stuff getting things on the client side of his browser And maybe he will render a java script and some of the client side code that will execute due to cross site scripting We could grab some information from his perspective like grab the admin cookie or view the admin page Or do some other drive by stuff and bring him along to other pages That's all the neat and interesting things we can do with cross site scripting So as a thought for that I can try and Enter some html tags like h1 Like a big header and see if that gets rendered out or reflected to me and looks like that does that did increase the size here And we could share that with tj mic just to see what happens. It says tj mic will appreciate your paste shortly Okay I see a little captcha down here Where my face is let me try and hide that so you can see look looks like it does need to be Kind of put together in the web browser so Doing some tricks might get in the way if we try to automate this or do some other things without avoiding that captcha anyway Since we know we do potentially have some code that could come through here We could try interesting things like a script and then let's do an alert one and script see if we can run javascript code and that Didn't do anything seemingly Which is weird. Uh, so we could do kind of our actual normal stuff. Let's look at the source code and really see what's going on here Looks like they actually even reference the source code of this web page. It's hidden It's not going to be displayed on the web page, but that might be something we could access or go to So let's Go that let's download that. Okay. Uh, I'm just going to W get this. Let's let's hop on over to my terminal I had created a little folder ctf google ctf web and then for that challenge. I've already downloaded the source Let me clear that out. So You get a fresh perspective. There we go. Uh, let me move that source to a source.js Because looking at it in this browser here, it looks like it's express And like no to running javascript server side in the background So let me go ahead and open that and sublime text and let's look through this code So we are using the express framework that back inside of javascript Looks like it'll be able to do some parsing things requiring utilities, which is seemingly local recapture UIDs that mo that must be the note kind of id or title that we saw and the data store. Okay recapture stuff Choo Choo is running the express engine Looks like it's going to use ejs for kind of templating and pages Getting static pages. They say recapture need these interesting and just a data store Okay, this just looks like kind of the schema or Functions as to how we're putting things in the database of what notes we have guessed It's probably us and public has got to be just about everything so That's peculiar nothing Weird there that I see that we could I guess get in the way of but I mean that's just going to be the database That's just just the data store itself We create that database and then we have this little escape string functionality Which looks like it's going to do some replacing Oh to remove those less than and greater than symbols that we might use for some html But it looked like it rendered that out that was weird Did it do that when we use the h1 tags? So we render out the home page If we post to it We need to verify that we actually have a note to use And we create the note id u u id we saw that earlier Out of the database etc. Etc and redirect it to the note id Properly escape the note. Okay, so can we not Bother with some of these Does it Does our xss payloads or a cross-site scripting will that kind of get in the way? Yeah, okay, so we run that escape string thing over here and that will Replace out our less than and greater than symbols. That's frustrating and annoying Share your pace with tj mic. Okay, so that's us reporting and sending it to the admin And he will just straight up go to the page. Okay, cool And there's the source code link. We've got that and then just run Good enough So let me actually look at the page itself that uh once we shared a note. Why didn't it display our script tags? Let me let me start with the with the hello Or the h1 header tags I'm gonna view the source here. I hit control u on my keyboard Oh, it's using dom purify. Did we see that in the source code dom purify purify Purify that's not on the source code. It's all client side. So dom purify is kind of like a big well known Sanitization library it'll like help try and purify and and clean her out and make sure there's no unneeded and unnecessary and evil and nefarious code Oh, and there's some client side stuff here fix Something funky in the source code that could lead to cross-site scripting. What is that b137 like bite 137 1337 Can I go to a specific character in sublime text? Like what is 1337? Is that literally where the weirdness is going to be? I guess I can like hex edit it Let me let me hex edit source.js and go to uh 1337 what is that what is python Oh, no, yeah, what is 1337 in hex? That's kind of what i'm asking. This is probably a stupid idea This is probably not literally what's so useful whatsoever five three nine This guy Yeah, that's not that that's not what that b stands for I don't I don't know and I don't need to worry about it But something could apparently lead to cross-site scripting. Okay interesting Oh, so this is the replace or that escape string function coming in action here We can see our greater than and less than symbols were replaced with these hex codes We have our node id and it uses dom purify to sanitize it and clean it. So that's interesting So that will prevent us from using Some of the other things that we tried to use like our script alert one script script script, please And renders it out on the page With this That doesn't help. Okay, so that's in the way um Maybe we could do peculiar things because if this is what's actually being put in the page If we can't use our greater than and less than symbols, could we do anything funky to like break out of this string? and get our Inserted javascript code like leaking into this section of code here Maybe we could try and just include a double quote to try and terminate that string Let me try that I have a lot of view sources open that I don't need so let me close out some of those um, we'll just do a please sub I guess Yeah, so we would end that string and then we would have a semicolon to denote a new command And then I guess I'll like I'll comment out a message to see if that goes through as well We have the source code. So we really only should see the oh, I hit share with mic my bad We really should only see those um greater than less than symbols replaced, but They also escape our double quotes Okay, so Looking at this code And we're still in the phase of me trying this myself me me experimenting with this when I Did not know the solution and was going through it cold. I thought like maybe I should be finding some weakness in Dom purify, right? Because if that was the library that they were using there, maybe there's like a dom purify exploit or cross site scripting vulnerabilities And so what you can see me literally like some of my old Revisited links where I would take a look at some of the potential vulnerabilities Maybe they could have some cross site scripting in some older vulnerable versions like 2.0 2.03 And I was like, oh goodness. Maybe this is a lead. What do I have to work with? So I thought like What version of dom purify are they using in this challenge? Checking out the version of dom purify just looking at it on the web page I see github cure 53 dom purify blob and maybe that's 2.08 and that's not very That's not any of the research that I had done previously I'm looking for a version less than that that might potentially be vulnerable to this thing and maybe that's still a complete Guess due to my research I also did things I just would search for version and I would do like Other version checks to see if that was really what it was in case they didn't have that note here in the header I don't think I actually saw that 2.08 originally and I just searched for version And when I saw that reference of 2.0 12, I was like, well, okay. I'm way out of luck. That's not going to help me literally whatsoever so at that point playing the game real time and I have the classic millennial dilemma of my weak and low attention span After after an hour of like maybe fumbling with this and I didn't have a lead I was like, all right. I should go do something. It's actually productive for me personally Not that this isn't But I was like, I should be building things So I put this away and I waited for some write-ups to come out because I'm always looking forward to google ctf write-ups Or any any bigger or legitimate capture the flag competition and try and see what really cool techniques and stuff is in place here so again, I say that with my disclaimer and my Full frontal honesty and transparency full frontal is not the right word for that Uh I I looked at these write-ups and I saw Really what could have been peculiar and interesting there and it's funny while I was looking through this I completely glossed right through the solution this escape string Little function here a little thing that they're they're putting together is odd and interesting This comment who wants a slice? It's kind of taunting. It's kind of weird And it doesn't really match any of the other comments Maybe you could use that to like pick it out needle in a haystack, but uh What they do here aside from this replace line And I know this replace line kind of sticks out to you naturally because that's just Kind of what you look for and most common capture the flag stuff or when I do a lot of php stuff like php challenges Javascript is kind of an oddball thing for me to see when I look at express or know it But I know a lot more cool legitimate ctfs are using these here. So Put this away put this away. We know that that'll work mentally It'll be replacing our less than a greater than symbols, but this json on stringify with our inputs This is an oddball thing and we could research kind of what this does or we could step through it It slices out seemingly the first elements or like the first character in that Iterable that lists that string particularly and then it'll go to negative one So up to the very very last character in that If we were to tinker with this if we were to play with it, maybe we could see it do some peculiar things So let me put that over here and I'll put Another terminal over here and I'll just run like node, right? So I can work with javascript locally on my side if you don't have that on ubuntu I think it's sudo apt install node js, but let's just create a string like hello And there's our string now Let's try to use some of that syntax that they use where they use json stringify unsafe We could see the normal operation for it json stringify Hello, and it will just take It'll be like a string of the string. So it's including these double quotes here And if I actually had a I guess another Quote in here. Hello, john You can see that's going to just be escaped. So Great, that's the gimmick and tweak that we fall into But then they slice it right so they go ahead and slice from the first character all the way to the just about last one So those Surrounding quotations are removed and all you're just left with that escaped backslash or quote if you were to use it So that would get in the way for you That's important to note This is the normal functionality kind of the what we've seen but if we were to do some research on that json stringify On the stringify You can see some references here documentation The json stringify method converts a javascript object or a value to a json string Now this is interesting because they know that javascript object Not just a value when we're looking with our string that we supplied like hello or our note or anything That's going to end up being just a regular value. That's going to be a string Interestingly enough if you were to pass it an object and this is like literally the first example they show you It's not going to end up Putting those double quotes in there. In fact, it'll do weird things where it has the curly braces that denote an object in there So if we were to tinker with this Let me try and just put together an object. It'd be like A can equal Please sub or whatever. So now I don't include the dot slice here removing the first and last characters But you can see the very first character is an open curly brace and an ending curly brace for the last one So if I were to slice this out We don't actually have our double quotes escaped out That's useful for us, right because now we could end up Maybe potentially passing an object to this little note application and it could Actually have our double quotes in there and escape out that string that we were trapped inside in the java script That was visible on the web page. So I Tried to do this originally. I knew that I could pass after kind of again Illusion is over, right? Our our artifice is gone. We we've broken down the fourth wall We know that we could potentially be Can I please go back? Okay. Thank you We would be sending in data through A variable here in the form with a post method And it's going to be named content. So Knowing that I could maybe pass an object or an HTTP object through to it How could I do that that syntax usually means that you'll have to supply some like curly Or square braces around or just following after the name of the variable that you want to make an object So I would do this with curl like just to see I originally just wanted to test this So let me break out of node and let me go ahead and curl over to this url That will return the page for me, which is nice and fancy But I do want to go ahead and post to this And it needs to actually have the content being supplied, right? So I will specify with tack d to denote the variable that I'll pass along Content or the data right that we supply content is the name of that variable And we'll just include for sanity check. Please sub and this will redirect me to The note I could very very well pass along Content with these open and close square braces. Now. I know that I'm passing an object And that seems to take it and it'll redirect me again to a new note in curl. You could follow redirects with tack capital l But I think that keeps the post method in place and I off the top of my head. I didn't know how to just post to the first page and then not post to the second one So I thought okay curl won't won't won't be a good one for me Let's just fire this up in python as kind of my my usual knee jerk reaction user bin environment python I will go ahead and import requests and I will Use requests dot post on that URL. So I'll grab that I'm using requests because I know I'm going to be using some Internet or web functionality making get and post requests to web pages. So I'll pass the URL there I'll include data as a dictionary And content should be the name of that variable But remember to pass an object we need to include these curly braces here or square braces. Sorry So I will go ahead and set that to please sub And now let's capture that as a variable and then go ahead and print Out the response from that. So r dot text and I'll hit control b to run this I'm using the build view plugin and sublime text so I can go ahead and move this into another tab I hit shift alt and 2 to open that other tab and I'll go ahead and mark that as HTML so it's a little bit easier to read and work with here You can see over on that side We do have the page returned to us and down below checking out the source code that should be rendered out on the page please sub has these Double quotes here and we're we're properly broken out of the original quote. So knowing that we could maybe Start to inject our own javascript. Let's put a semicolon here Over in our please sub payload and obviously we want to be running real javascript, right? So let's use just an alert one for kind of a proof of concept. So it would look like a Semicolon there and then our code being injected and we'll have to remove out these other Double quotes. So let's have a forward slash forward slash there to comment that out if I were to run that Now we should have that in our page with literal javascript and I have the note ID So I can go visit it in my browser to see if that will actually work for me Let's go to slash that location and I have a little proof of concept javascript alert box Fantastic, okay. Now we have our javascript in place So that means we could do the real cool regular cross-site scripting stuff when we were to send this over to tj Mike or the admin what you would normally want to do is capture their cookie That's like the first thing you could always easily reach for like low hanging fruit Maybe you'd have to do weird things to like read the admin page or drive him to someplace else to turn on a setting Who knows? Let's start with just simply grabbing his cookie see if that's where that challenge leads us Again removing the illusion We've read write-ups on this the competition is now over that is all we have to do is grab his cookie Normally I would do this with sort of a Bring your own box or by ob external server that any internet Object or other other server online could reach and access So I use a digital ocean droplet for something like that or something you could host up with google cloud or aws Or is your whatever you want. I'm actually just going to end up doing this with hook bin I've seen Hook bin hook bin.com is right. Okay. I've seen request bin. I think something weird happened to them I've seen other ones that do this sort of thing, but this will just be an online service that will wait to catch Capture and then go ahead and inspect HTTP requests. So you can use this as a really good way to just gather some External cookie or something if you're doing a cross site scripting attack. It's hook bin.com I'll go ahead and create a new endpoint. So I'll take this guy This is our link and once we have something that requests that link We should be able to see all the capture data here if we were to refresh this page So what I'll do is I'll use my kind of insert section for javascript I'll go ahead and create a new dumb object for an image super duper easy Right. I'll use a new image and then I'll take that object with the dot selector and I'll supply the source here So src and then we want to include a string value here But we can't use our double quotes because we're already inside double quotes And we know that this will escape out our double quotes So let's just use single quotes here because javascript will handle that nicely Let's paste in that link and then let's go ahead and actually Supply a question mark to supply some other variables in there like a get request So I'll say c equals so c could be a cookie or whatever value name you really really want Maybe c keeps it nice and easy for you and let's just append on or add in with the plus sign the document dot cookie So when I view this in my browser, maybe I have some cookie set and we would see that request go through in hook bin Maybe I don't maybe we don't see anything But when we send this to tj mic or the admin we'll get his cookie So that is kind of all we want to do with this attack. Let me go ahead and post this request Looks like that has came through we see our code properly injected here our new image source going to that location commenting out the rest of it And I'll have this node ID that I can copy and access within my browser So let me hop over and go to this location I will actually fire up the network tab so you can kind of see this come through If I go ahead and paste this in I make a request to that There we go And do I make a request to this location? Looks like I do that's hook bin right there And that was a successful query. It looks like that responded or didn't actually give me anything back totally fine Maybe it was just like a true thing But that was able to go ahead and post some data there So we know that this should work because our local test did run just fine here If I were to go ahead and report this to tj mic We should be able to see his result his cookie his data over on that hook bin If we go back to the hook bin if I refresh this page. Do I see my request? Yes, I do perfect So this came from me accessing it locally You can see my web browser there and my query string that c variable didn't actually have any cookie or anything associated with it No problem. That's fine. We have our proof of concept. Now. Let's go ahead and share this with tj mic Looks like that all went through and tj mic will appreciate your paste shortly So let's hop back on over to hook bin refresh this page and see if we have anything new I see something come through which might be a different Responder and it is I can see the headless chrome user agent there and we have our query string our secret ctf express to troubles Nice that's a good flag. So that's it. There is our flag. That was the technique that was all that we needed to do We could go ahead and submit that. I know the game's over now But cool, whatever we made 50 points on the easiest challenge that google ctf had But hey, hopefully that was a cool learning point and maybe you had some fun with it If you hadn't seen this sort of thing before That was a peculiar thing for me Admittedly, I wish I had spent more time on it. You know every time a ctf comes by and we kind of regret Oh, man, I wish I Did more for that. I wish I tried harder I wish I kept banging my head against the wall because it would have been really really cool To get that in the moment, but I don't want that to take away from the value of reading write-ups So with that shout out and kudos to all the incredible people that do release write-ups for these sort of things You guys are also incredible prolific valuable members of the community. Obviously obviously you all are But seeing everyone sharing the knowledge and helping everyone grow is a super cool thing So shout out to everyone that wrote a write-up And I'm very excited to read more of those for different challenges on google ctf And maybe I can showcase another if you guys thought this was valuable I don't want this to be completely useless because obviously write-ups out there already exist But maybe it's cool to see a walkthrough in a video format of it And uh, see everything every single step and every single action that has to be taken and done For all that to work and see more of the thought process in real time. So I hope that's cool, but All right, that's enough of me jabber and thank you so much for watching I hope you guys enjoyed this video if you did please do do the youtube algorithm things You know, I'm super duper grateful if you could hit that like button If you could maybe type something in the comments, whatever I'd be grateful If you could please subscribe Thank you. Thank you. Thank you If you want to go above the call if you want to go way above what is necessary I would be incredibly flattered if you could drop a donation And I always appreciate your support patreon paypal those are links in the description I just kind of tweaked up some of the patreon tiers. So I'm I'd be I'd be super duper flattered to see your love and support So thank you. Thank you. All right, everybody. That's the end of the video. I'll see you tomorrow for some other cool stuff Take care. I love you. Bye


A research team used Hubble to study the region of supernova 2013 GE in the NGC-3287 galaxy, 3.3 million light-years away. They saw the light of the supernova fading over time from 2016 to 2020, but another nearby source of ultraviolet light at the same position maintained its brightness. This underlying source of ultraviolet emission is thought to be a surviving binary companion to SN 2013 GE. The discovery is a first for a particular type of supernova, one in which a star is stripped of its entire outer gas envelope before exploding. Normally, hydrogen is found in the outermost layer of a star. When no hydrogen is detected in the aftermath of the supernova, that means it was stripped away before the explosion occurred. The cause of the hydrogen loss had been a mystery until these Hubble observations provided the evidence for the theory that an unseen companion star siphoned off the gas envelope from its partner before it went supernova.


If you're a cat allergy sufferer who happens to love cats, we have good news, there are a handful of hairless cat breeds and cat breeds that don't shed much that may help alleviate your itchy eyes and runny nose, or at least save you money on lit rollers. Unfortunately, there are no truly hypoallergenic cat breeds. That's because an allergenic protein called FelD1 is created in cats sebaceous glands in their skin, as well as in their saliva, dander and urine. Since all cats have these things, they all produce FelD1, and that means you expose yourself to them every time you touch any cat. One of these cats may be the perfect pet for you, whether you suffer from allergies or simply don't wish to accessorize your all-black outfits with cat hair. Here are the cat breeds that don't shed, or, at least, shed less. Sphinx The Sphinx is a naturally hairless cat, thanks to a genetic mutation and a top choice for people hoping to lessen their cat allergies. Teresa Kager with the Cat Fanciers Association says some Sphinx have a little peach fuzz like fur on their body. Like all hairless cats, they will require some basic grooming. Kager explains that like people, all cat skin secretes oil, and gently wiping their body will help reduce this oil. She says these kitties make great snuggle partners. Cornish Rex Though the Cornish Rex's hair, this cat's coat sheds less than other breeds, Kager says. Their fur is curly, very short, and lies close to the body. The Cornish Rex is also a very playful breed, so they could be the perfect choice for someone who wants an active playmate for themselves or their other pets. Devin Rex The Devin Rex is another curly-haired breed with a short coat. Kager says these cats will develop a very tight bond with their owner, and they love attention. Of course, all that love will mean more hair, saliva and allergens on your clothes, so if you're especially sensitive, consult your doctor. Burmese The Burmese is a small cat with a short, fine coat that naturally has less hair than other breeds. According to the Cat Fanciers Association, they have a lot of affection for their people, wanting to be by their side as much as they can, but without being overly demanding. Some Burmese will even play fetch with a toy. Berman One look at this breed's fabulously fluffy coat probably has you imagining hair covering every clingy surface in your home, but the Cat Fanciers Association Allbreed Judge, Hope Gonano, says the breed is relatively low shedding, thanks to its non-matting coat which requires minimal grooming. Additionally, Burmese are intelligent, gentle and affectionate by nature. They respond well to training and can adapt to living with children and other pets in your home. Exotic Short Hair Often described as a short-haired Persian, the exotic short hair's thick, dense coat is shed minimally, says Gonano, although they do require some combing to properly remove any dead hair. A calm, relaxed breed, exotic short hairs are affectionate and can adapt easily to an apartment setting or country living. Russian Blue Another minimal shedder, Russian Blues generally shed over a two-to-the-three-week period just once or twice a year, Gonano says, and are easy to groom. They have a soft, dense double coat that is a distinctive silver blue. A medium-sized breed with a graceful, muscular build, the Russian Blue has a gentle temperament and is known for being easy to train. Siamese According to Gonano, Siamese cats have low maintenance coats that can be cared for by brushing with a fine tooth comb.  With large ears, distinctive blue eyes, and a sleek, slim figure, the Siamese comes in seal, chocolate, blue and lilac point, and loves being around and chatting with their people. Hello. This video is sponsored by Beemix Pets. Are you looking for high-quality cat collars at an affordable cost? Check out BeemixPets.com. Use coupon code KittenLife to get 20% off. Oriental Short Hair Because of their connection to the Siamese family, Oriental Short Hairs are similarly easy to groom, says Gonano. Long and slender like the Siamese, Oriental Short Hairs differ in their coloring, which can come in over 300 colors and patterns that include ebony, white, bicolor and tabby. A loving, entertaining breed, these kitties like to be the center of attention and can become sensitive if ignored or left alone too often. Dinskoy According to the International Cat Association, this elegant breed can be found with four different coat types that come in a variety of colors. All but one coat type usually results in hairlessness, making the dinskoy a great low shed option. Some dinskoys have patchy fur or short peach fuzz that can be very soft to the touch. They are sociable cats who enjoy being the center of attention. Bengal The distinctive Bengal is known for its stunning coat whose vivid spots and leopard-like marbling will remind you of this cat's wild cousins. This same coat, which is velvety soft to the touch, sheds minimally. According to the Cat Fanciers Association, Bengals are curious, athletic and affectionate. These cats love to play and are great for pet parents who enjoy an engaging and intelligent companion. Bombay The sleek, black coat of the Bombay makes this cat look like a mini panther. And luckily, as the International Cat Association notes, their short, tight coat sheds very little compared to other cat breeds and needs minimal maintenance. No brushing should keep their shiny fur in tip-top form. The Bombay is a smart, inquisitive and outgoing companion. This friendly and easygoing cat can do well in busy homes with a family to keep them entertained. Peterbald According to the International Cat Association, Peterbalds may be totally hairless or have a variety of coats ranging from short peach fuzz to slightly dense and velvety, but all varieties are low shedding. This adorable cat has an inquisitive look thanks to its large, bat-like ears. Peterbalds are known to be very smart, vocal and incredibly affectionate.  Ossacat The gorgeous spotted coat of the Ossacat is low maintenance and sheds minimally compared to other breeds. Kager says this breed has a tight coat. The International Cat Association recommends a weekly brushing with a rubber brush to remove any dead hair. All Oshikats have a spotted pattern that comes in a variety of different colors including brown, chocolate, cinnamon, blue, lilac and fawn. Energetic and devoted, Oshikats are happiest in an active home with pet parents who are fond of regular playtime. Singapura, the International Cat Association says the Singapura, the smallest breed of cat, is also one of the lowest shedding cat breeds. This cat packs a delightful personality into their petite package. All Singapuras are a single color, they're short, soft, brown coat sheds lightly to moderately at most, and requires very little grooming. This intelligent and curious little cat is equally happy to play or to curl up close to their person. Minskin A cross between the Sphinx and Munchkin breeds, Minskins have a sparse coat with patches of dense, soft fur often on their face, ears, nose, legs and tails. According to the International Cat Association, their minimal coat sheds very little and comes in all colors and patterns. Minskins are generally outgoing and love being around people and other animals. Though they have short legs, they are very athletic and playful and have no trouble keeping up with their longer-legged counterparts. Korot The Cat Fancier's Association notes that the Korot silver-tipped blue fur consists of a single coat that lies close to the body. Thanks to this short, tight coat, the Korot tends to shed less than other cats. You'll appreciate their soft, low-shedding coat as this cute companion loves to cuddle and will stick close by your side. Korots are playful and intelligent, but also love to chill. Colour Point Short Hair A close relative of the Siamese, Colour Point Short Hairs have a short, sleek coat that requires little grooming and sheds minimally. Colour points are talkative and affectionate so if you want a feline shadow who follows you around the house, this breed is a good option. They are also highly intelligent, and some even enjoy games like Fetch. If you enjoyed this video, kindly press the like button. Also don't forget to subscribe with notifications on, so that you don't miss out on videos like this. Thank you for watching.


All right, so you can see this everything looks good the sound looks good Let's start Yep at that loading bar at the bottom right is an indicator that is definitely fast Thor than PS4 It's time I'll keep my farewell brief never was much with words Once you board this ship, there's no turning back The next I wanted for class to breathe touch will be that of the casket this And step away now and let no one judge you very well then sail safe and strong Meowdy-doo World oh Monster on the world. Oh, I played on ps4 or R2 Let me tell you that's why I couldn't get into it because I Never got past the tutorial. I was like on the second Rathalos footprint quest and I had had it I was like that's enough. I can't do this game anymore It's taking too long to get to the good part It was like it was for me like in Final Fantasy 13 was for a lot of people. They're like they couldn't get past the tutorial Put the FPS at the top right we're going female this time chat We didn't mail on the ps4 and we had a pompadour and it was epic Well, these are presets. No, right? face Q&E Actually, I might go with a preset. I'll go up. How do you change the preset? I can't just click this Yeah, absolutely. Well, how do I there we go now? I can click them. I'm gonna start with this one Oh, wait, I gotta use the arrow keys in 2018 Okay, you can we can see the wrinkles. They got the female pompadour. Oh, it's hard to resist It is really hard to resist the pompadour chat. Oh Yes, we might have to go with the pompadour chat We're gonna go with the anime Bulma Sian Arrow keys again. I can drag this. Never mind. You can drag it with the mouse She's part of yakuza Huh? Yeah, it was a hitbox thing. You were right or R2 No Confirm eyebrows. I want fuzzy eyebrows chat Fuzzy I want like freakin Give me I mean like like somebody's like please somebody trim those things. They don't have thick ones We're gonna go with gentle The gentlest eyebrows one can imagine Those she's a Vulcan chat. She's not a Vulcan. There we go. I love everything Including my face. So what's the difference between eyebrows and brow type? Oh Hugh Hugh Hugh can't even unibrow, man Can't even is Sian Sian, David Sian see why and you can do it see why a n It didn't work aqua try aqua Try aqua There it is be body bop ba ba bop. So we're on page one this one now These kind of all look the same, huh? What way Forever confused Way That looks weird. We want anime eyes chat. They don't have them. Oh my goodness we can Why do I make mutant characters chat, why can't I make someone that looks human eyelashes? Hugh Hugh Hugh saturated, huh, that's my good. I so take Take take me Why would you do that to me? No, I I Don't mind Hello, if I get her mouth open like all the time, but I think I can this is going to be It's not just I don't see the differences in the noses. I just can't see it What is that? What is that smell mouth? I need to continuously open mouth chat. There's an Open I want I want to constantly. Oh No, wait, oh, she's just randomly doing that.  I'm thinking she's got the mouth open We're wanted men.  I love when characters is just like Facial hair I'm not lyric chat. I wouldn't do that. What you got. Oh, oh That's just showing me with the area.  Yes Mmm, I'm okay. Thanks. That was fine there size There we go. Ah Maybe a light stash. Oh, what about has spoken? Tink. Hmm. What else can we do on top of that? We could do one of these Some blush Which I could just pick the same color head for the other one that'd be nice It's kind of overkill.  Oh, we can't change it right? Hold on Open mouth. Come on over your mouth. Huh? They're not changing chat. Oh space Ha, it's gonna be oh wait. There's multiple ones I don't know it's gonna be a close one between three and five I Really like that one and that one and that one This that was okay, but that was excellent. All right, we're gonna have three three wins chat clothing Does it matter? Not really change default color. They have a blue. You just change the style. I don't care This doesn't matter. That's gonna be going away. Anyway voice Can't you sample from this? Say a space It's not the same. It's not the same. Am I crazy? I hear no variation at all Except for that one there. Yeah, that's not a more anime Default armor has a chain mail no armor leather I Went with Leather before enter your name I Type where Cat oh my goodness Do I really care? Think that's who I had before was a guy with a closed eyes Meowdy-doo There isn't a random button in there because I don't really care about the cat that much. I Do want a white one? No This was just go with him again. I really don't care Kind of like the default I can't turn around Oh, yeah, click it first Normal tail you can't decide on weapon. Welcome the monster hunter There's too much choice at the beginning, especially if you're new Like I was very very very very Very set on just sticking with bow even though chat kept telling me to switch and I experimented one day I went to the practice range and I experimented. I just stuck with bow That's the key man.  Otherwise, you're gonna be it's just It's still much choice. No, I did hammer and domlas What's your theory the elder dragons must migrate to the new world for some reason? Well, if I had a voice, I would tell you but I don't speak and the research commission for 40 odd years the guilds itching for an answer They say the fifth fleets got the best shot of crack in this case And I operate in teams of two. Have you sat down with your partner yet? Yeah It's coming chat wait for it. Meowdy dude is coming really soon That roast look good the man the food in this game it rivals final fantasies not as good as fine fancy 15 But it makes you hungry Yeah, fine fancy 15 food should have won like a lot of awards. They really outdid themselves That food looks real. It looks straight up realer than real. All right. Here we go We gotta learn the controls now That a different type of keyboard layout or something Okay, w Okay, space. Oh, it makes sense All right, synchro. You have a good night, man. Is there some for FOV? I didn't even look I didn't even look for anything for FOV I can climb faster than you actually so far. This isn't too bad I'm the controls. I'm talking about. Oh Nope Ow by giant rock monster with the beard That's that got the ship. I know right Hydra Meowdy do new world meowdy do so far on no performance issues Yet this angle though. Why why are you doing this? Got it? And Ended home. That's not working right now. Oh, this is a cut scene Best if we make our way to


Good afternoon everybody. Is that way too loud? So it's 2.20. We're going to go ahead and get started. First of all, thank you for coming to this session. It is called Making Security Makes Sense to Your Users and Your Plans. So I do have a quick question for all of you. How many of you are actively building WordPress-powered websites for clients? Ooh, that's a good show of hands. And how many of you are putting all of your clients or most of them on monthly recurring maintenance programs? A good portion of you. Okay, that's great. So my intention with this talk is to provide you with useful tips for growing your business and providing extra value to your clients in regard to security for yourself and for them. So a little bit about me. My name is Adam Warner. I am the open source community manager for Site Lock. It just so happens we offer security services. I'm also the co-founder of a company called Foo Plugins, which as you can probably guess what we make. And I'm also passionate about website security and there's a very specific reason, business reason why I am that way. And I'll share that with you in a few minutes. I'm a fan of Fractals, a proud dad, and if anybody wants to discuss the number 42, I'm happy to do that. So today's focus again is going to be to communicate the importance of security to your clients. Why you want to do that, how to do that, and how to have your clients grasp an understanding of a somewhat technical topic in easy terms. And how to build security into your projects from day one. So I'm going to cover a lot of these things. And again, my goal is to make your job as a freelancer or an agency owner more streamlined and more profitable. So starting with securing your site, the benefits of securing your own site. I think all of us who build sites can agree that website security is an important subject. It's something that we should all be doing as a baseline. And it all comes down to reputation. This is the first reason to secure your own site.  And I'll talk more about the why and the how in just a few minutes. And security becomes especially important when you're the one providing the website building service.  So imagine this for a second. I'm on Google and I search web development in Boston. And I come across your site and I get the chrome warning that this site may be unsafe or this site may be hacked. What is that going to do to my reputation as a web development provider? And what kind of impression am I going to have as a user who's looking for a provider? It's not a good first impression. The answer is obvious. I'm going to leave your site immediately and move on to the next one. I don't send you a contact. You don't have the opportunity to even give me a proposal. Or even worse, I'm going to associate your brand forevermore with a negative thought. So they build websites, theirs is hacked. They must be really great. So if you're not already, I urge you to invest some time in implementing even the most basic website security best practices for your own site. Not only for your reputation, but so you can become familiar with those best practices so you can then educate and provide those to others. Pardon me one moment. So with that, I never recommend anything to my clients that I haven't used myself. Or a better way to put it is I would never do that again. I've failed clients before because of not doing proper due diligence on the plugins, the themes or the services that I'm recommending to clients. I've learned my lesson so when I talk about becoming familiar with security best practices and products and services, I'm talking about eating our own dog food before we start offering or suggesting those services to other people. And finally, securing your own site protects your business as I mentioned. And I have that very specific story for you. About 11 years ago, 10, 11 years ago now, I was working full-time but I created a site called IndyLab and it was a WordPress multi-site installation and if you're not familiar with multi-site, it's basically a WordPress installation where you can have sub-sites underneath individual sub-sites. Like WordPress.com. You can go there and sign up for a free website. That is on a version of WordPress multi-site. So this site was for creatives. It was for musicians, photographers, artists of all kinds who come and get their free site, their free blog. And then I monetized that site with offering specific features for X amount of dollars per month. It was going really well and it continued to go really well and so well in fact that I was probably a few weeks away and maybe a month away from quitting my full-time job and going full-force into this one. Until, and you can probably see where this is going. I woke up one morning and had an inbox full of emails from my customers, free and paid, wondering why their site was showing adult stuff. I don't know why. I assumed why. So I started digging in. At the time that this happened, there were separate forums for WordPress multi-site called WPMU and there were no security companies that could just come in and clean up a hacked WordPress install. At least I didn't know of any. So I got on the forums, got some advice, was told what to do in very specific steps, did those, everything was great. Two days later, everything was cleaned up. E-mailed back all of those people who had emailed me. Everything was good to go. Don't worry about it. It's a temporary thing. Things happen. Two days later, same thing. And then I continued on for weeks, literally weeks, trying to figure out where that backdoor was that I had missed. I couldn't figure it out. So working full-time, managing other things. I called it quits. I refunded everybody their money and I closed the business. And then I got really depressed, right? Because I failed. But, so overlining, I then became very aware, acutely aware of website security and the importance of it to protecting my business that I was trying to build. I wasn't doing really freelancer agency work, but it was an online business that needed to be protected just like every single website on the internet. So now let's talk about the benefits of securing your client sites. You've got your own site secured. Awesome. Now what about those client sites? Are you now actively implementing basic website security steps? Anybody when you build a client site, are you including security steps in there, whatever they may be? Awesome. Kudos. So let's talk about why securing your client sites is important to your media and your long-term business. One, it's in your best interest. Pretty obvious, right? Has anybody ever received a frantic phone call or email at midnight on a Saturday from a client saying something's wrong with my site, it's showing Viagra ads? I think we've all probably experienced some version of that, right? The inopportune support request. So I feel that it's our responsibility to have technical contact, the one who built the site, the one who knows how the internet works to fix whatever problem they're experiencing, right? So that means we get up in the middle of the night, we start digging in, we start troubleshooting. Now that's not sustainable, especially if you have a spouse or kids who want to lead any kind of normal schedule. So securing your client sites before the handoff and whatever steps you take can save you time, money, and headaches. And even if it's out of the project scope as providers, it's our responsibility to at the very least educate our clients or potential clients and urge them to take the basic steps in security. So another pretty obvious one that gives us all peace of mind. So it gives you peace of mind knowing that you can sleep through the night on a weekend.   So I mentioned educating clients. Let's talk about that for a second. This is the hard turn. Educating your clients and potential clients, it isn't just the right thing to do for your business. It's the right thing to do, period, in my opinion. It's all about spreading awareness, right, and making the internet a safer place. When I said it was the right thing to do, I'm speaking from a global human race perspective, right? The internet is such an incredible tool that we have the luxury of living with, connecting with others and building businesses. But just like walking through a dark city at night, it's critical that we all become more aware of our surroundings and the potential threats that lurk in the shadows, right? So our responsibility, again, is the ones who know how the internet works and know what the risks are. We're going to learn those at a word camp or a word press meetup or on our own to spread that awareness as much as possible. So who's responsible for security? How many of you think it's you only? No one good? How many of you think it's the client? Okay, no one? How many of you think it's the web host? Okay, few of you? Well, the short answer is you're all right. It's all three, to varying degrees. You're responsible, the client is responsible, and the web host is responsible. So you can think of website security and who's responsible by thinking of it as an apartment complex. Your website host is the infrastructure of the website complex. They are responsible for making sure that the parking lot lights are on, that the gate is working and not broken, that the security guard is at his posts, that the sidewalks are shoveled in the winter, that sort of thing. The buildings of that apartment complex are what we as website builders, freelancers, and agency owners build for our clients. We're making sure that those sites adhere to all the building codes. We make sure that they have SSL. We make sure that it's a good user interface. We make sure that the navigation has good structure for SEO. We make sure that the content is structured as it should be. The individual website owner, on the other hand, is the person that owns an apartment in that building within that complex. And it's that person's responsibility as the website owner to make sure that their doors are locked when they leave, their windows are locked when they leave. So the short answer again is all three. We're all responsible for the security of a website. And your clients need to understand that as well. So if you're educating your clients from the first phone call or email, as I suggest, you're already starting to set yourself apart, which then can increase your value. So you can expand that into educating what website security is as it pertains to the business goals of your clients. And you can quickly position yourself as an expert and become a partner again in that business and more valuable to your client. Security, education, and awareness does start. And I urge you to do this from the very first contact, whether you get a contact via a form on your site or a phone call, this reply should include something about securing the website. Whatever that is. So ensuring that even if you don't move forward with a proposal, they know that security is important to you, so if they have a bad experience somewhere else, or if they do get hacked sometime in the future, that they will keep you in mind. Next is additional revenue. So the last benefit of educating your clients is that it presents these additional revenue opportunities. You can demand higher prices or residual income. You can demand higher prices because you've already started to position yourself as the go-to and recommended resource, the one who cares about the business growth of your clients and the security of their site. And the key here is to provide immense value that no one else in your competition space is providing. And then to communicate that value proposition to that potential client in order to make an impact. And when I talk about residual income, that's where monthly maintenance programs come in and even add-on services in regard to security. So a monthly maintenance plan an example would be daily security scans. And then at the end of the month you report what has been found, what hasn't been found, how many scans were done, that sort of thing. If you're talking about add-on services, that could be a one-time malware clean. If they come to you with an act site, you can clean that site up or get a service to do that for you. There's many out there, but there's a few out there that are really something I would recommend. So you can do the one-time clean. You can even set up services which I'll get to in a little bit. You can offer, you can make residual income from affiliate commissions. If you want to handle any management of any security service dashboard for your clients, you can simply refer people and make a commission on them. So the benefits of communicating the need for security effectively. This is the nuts and bolts of this talk and what I really want to communicate to you all today, because if you take nothing away from this, please take this part away and use it in your own businesses to communicate to your clients. This is a diverse reaction to any mention of security. Their eyes glaze over, they recoil and disgust because they think it's too technical or they think it's too expensive or they think it's not needed for Mama Joe's cat blog, which is not true. So how do you explain the subject of website security in terms that your clients will easily digest and understand, and that's where you can use that apartment complex analogy or you can communicate these three things more both. So if you break website security down into its most basic questions then it's much easier to understand. It makes it simpler to communicate the importance to business owners and the concepts that are more familiar to them. So the first of these three things is why. Why websites get hacked. Hackers don't discriminate between the types of websites they attack, even if it's just a simple five-page cat blog it's still an attractive target. And why is that? It's because if your site is compromised it can be used as the open door for the attacker to spread their malware across other sites on that same network and then of course spreading it to the internet as a whole. So the first hacking tactic that may come to mind is known as defacement. We had a presidential election here in 2016 and there was one candidate whose campaign site was hacked and it was a defacement hack and there was a big banner with that person's slogan in it and you could put a query string in the top of that site and you could change that banner, that slogan to say whatever you wanted to. And if you look at presidential election campaign hack examples you'll find quite a few of them some tame, some not so tame. But defasements are not the most popular hack that happens. What usually happens is why websites get hacked is because it's for some sort of financial gain. So hacks can be as serious as aquifax. Anybody remember that one? 143 million Americans and people from other countries all of their data taken. And do you know why that happened as an aside? Because the server the software on the server that that site was hosted on was out of date. They'd know it for four months and they didn't update the software. So it was vulnerable. So financial gain. That's one example of financial gain. The other is that a hacker could run a script on your site that redirects all your visitors to some other paid site that includes their affiliate ID. So imagine I release a script into the wild and I get to Rich's site and I redirect his visitors redirect and then I get 10 more visits from my affiliate ID and then from there I get a thousand and someone makes a purchase and I make easy money. Or they don't even have to make a purchase they just get paid per click. So really financial gain is the real reason. And when you tell that to a client who doesn't know about website hacks or how they happen it usually starts to turn on the light bulb. And the second thing to communicate is the who and the how of hacking. So when we think of hackers there's some angsty anti-social team in the basement who's mad at his parents and has a hoodie on and he just wants to do it to get back at someone. But although there probably are those types of hackers out there the overwhelming majority of website attacks and successful hacks are performed by automated bots or scripts. So in other words the term malware comes from the words malicious and software, so malware. It's scripts that are designed to go out and find vulnerabilities. Website compromises can happen in many ways so to keep it simple it all comes down again to those vulnerabilities in various access points. Access points can include outdated software, weak passwords or newly discovered vulnerabilities in already up to date software that have been matched yet. So when do website attacks happen? Again, all day every day. There's an average of 44 attacks per day or 16,000 attacks on the average website per year according to our security report that we recently did. And this was supposed to oh there it is, it's animated. So this is an example from North Security a real-time representation of attacks that are happening. You can see, all day, every day. So the benefits of implementing those five simple website security best practices that I mentioned. So after you've communicated the why, the who, the how and the when it's time to start building security into your project proposals and your costs and continue to educate your clients. Or both really. So at the core of a 360 website security plan are these five things. And they're not to implement.  One are taking regular backups. Regular backups means your files, your database weekly, monthly and storing those backups off site in more than one place. Ideally two, ideally three, depending on how important your site and your data is. And make sure you have clean versions of those backups. You can test those backups on staging sites. Number two, updates. Keeping the software up to date is critical. This includes WordPress core software. It includes the plugins you use. It includes the themes. And if you're anything like me, I have a little bit of shiny object syndrome where I have installed everything under the sun in terms of applications from my web hosting provider if they made them available and then I let them sit on my server and never use them. All those files, all that code is sitting there ready to be exploited. So if you have anything on your web hosting account, on your server that you're not using, get rid of it. And that comes, that applies to plugins and themes too. I recommend at least a month of doing an audit of the plugins that you're using and that you're not using and deactivate anything you're not using and delete anything that you're not using. Number three, strong passwords and unique passwords. If anybody has their laptop open, I welcome you to go to have I been honed.com forward slash passwords. So I know passwords are not easy to come up with, especially strong and unique ones and they're not at all easy to remember multiple strong and unique passwords but this really goes for any single account you have online and even offline. Your local Wi-Fi in your house your local machine strong and unique password any single login you have online should have a different and unique password from anything else. And now we say, well how do we keep track of all those things? Password managers one password last pass, key pass dash lane, there's a bunch out there. So did anybody put their password into have I been honed? Anybody? Anybody? Okay, well this is what happened when I put mine in. I put my password in that I used to reuse and says that this password's been seen two times before previously appeared in the data breach. So that's an example of why it's important to have unique and strong passwords for every single login. I could have just as well kept using the same password for all my sites but now it's out there for the world to see. Okay, back to those five simple security best practices number four firewalls and CDNs. If you're not familiar with what a firewall is there's two versions of a firewall or two explanations of a firewall. There are network firewalls which is typically what your host employs to keep their network of computers safe from each other and also from the outside world and then there are web application firewalls. And basically a web application firewall there are several out there to choose from. It puts a layer of physical and virtual security meaning the traffic that's headed to your web server and your actual web server over here. It needs to go through the web application firewall first and what a web application firewall or WAF does, that's hard to say three times faster. It blocks automated mock traffic immediately before it gets to your web server so it's a really good layer of protection right off the bat. And all you have to do is set it up once and you're good to go. And what you have to do is track this as continuous monitoring of your site or your client's sites and when we talk about continuous monitoring if your site is hacked and you're not aware of it for X number of days or weeks a Google could detect that it is hacked and then blacklist you from their search engines. It happens all the time they want to protect their product so the sooner you know that something's wrong with your site or your client's site or you can get it corrected to keep other bad things from happening to that business that you're partnering with or to your own. Let's talk about the benefits including security and the project scope. Just like discussing security from that first client contact including that conversation and the importance of security through the project scope with individual line items can benefit your reputation in that of your business. That professional image including that focus or even requiring security to be built into all of your products can go a long way in building that reputation that professional image and also trust. It can build trust in your company and your brand if they know you're not committed to just doing one job passing it on and moving on to the next but again that partnering that growth of their own business you're going to be considered a trusted partner by doing this which brings me to the next section. Including security as a service we talk briefly about this focusing on that first contact and the talk of security in your project scope all the way through the proposal sets you up to demand that higher price for the initial project. It also sets you up for those ongoing maintenance plans and it makes those conversations easier. We've already answered this question how many of you are doing maintenance plan that look like the majority of you? Some of you are including security as part of that plan I urge you to include at least the five best practices before you hand over a site and if you're not you can easily roll security under the umbrella of backups and updates or call out again those specific levels of security that you'll be including. Add-on services again can include the one-time malware cleanup if they come to you with a hack you can get that done for them one-time monitoring or scanning you can do a risk assessment score through a scan you can do a site check up through a scan again there's a few different options so I'm not going to name one or the other just search WordPress security scan and you'll find what you need or you can do the setup of a web application firewall let's say they go out to any firewall provider and secure the account and then they say well I'm not quite sure how to change DNS I don't know what that means to route my traffic through here you can offer that as part of your setup too or an option in your project proposal so the benefits of automating maintenance and reporting it looks like most of you probably if you're already offering monthly maintenance programs you probably have some kind of streamlined system so you're probably already familiar with manageWP anybody use manageWP or something similar, infiniteWP others so if you don't know what manageWP is, I highly recommend this service or others like it it basically allows you as a freelancer agency owner to manage individual WordPress installs all from one unified dashboard and that means running software core WordPress software updates across 10, 50, 100 thousand sites at the same time plugin updates team updates, backups all kinds of stuff I highly recommend that service there's another one that's kind of new and I actually learned about this at a Joomla conference it's called Watchful and they do the similar thing to what manageWP does but they do it for WordPress and Joomla and I believe the last I checked on them they were working version 2 so because I'm a lover of open source I'm cross platform finally let's talk about the benefits of a summary of a presentation so my advice and my hope is that you'll remember these things to grow your business secure your own site first for your reputation management to build trust give yourself peace of mind learn the why or remember the why, how, who website security how websites get hacked who's hacking and why they're hacking communicate those business benefits effectively and I'm talking about the business benefits to your clients to their business about why they should know about security we talked about website security don't worry I'm not going to talk to your office it's only going to take 5 minutes but did you know and the benefits of that will lead you to including them in your project scope offering higher price or demanding higher prices or offering additional services and then if you're not automating your maintenance and reporting to your clients I strongly suggest that you do that and that's what I have for you so if you have any questions I'm happy to answer those we have about 10 minutes left before the break so if you do have a question what kind of backup the question was what kind of backup software do I recommend I've used a plethora of backup options in the WordPress world there is backup budding which is a very long standing and mature product if you search the plugins repository so in admin plugins add new search if you search for backup there's updraft plus is a good one another one is called backwp any other popular ones that anybody wants to throw at them but those would be mine yeah those three I've used those successfully and backup buddy is premium only it's a paid product and then the other two are free in the repository but they have paid versions depending on what you want to do with them any other questions yes sir so the question is which site or norton blacklist your site which one is more important so my answer to that is and I think there may be either confusion on my part but norton is a security software that's for your local machine so google is a search engine bing is a search engine yahoo sort of but so they're two different things because I don't think that norton can be blacklist a site on the internet people will still find it but on your local machine if it's detected as having malicious software it will probably blacklist your site so it's they're probably just as important because if you're people visiting your site are using norton then your site is going to be blocked oh norton site check I'm not familiar with is that a service is that something that's okay I'll google it yeah I'll have to look at that norton site check good question we'll all learn something new okay I wasn't aware they were offering website scans now it sounds like they're probably so it would make sense right because they're protecting your local machines and those of their users so if they detect it has malware on it which could be downloading software in the background when someone visits the site like a key logger or something to your local machine good question and thank you for further information yes sir so you're doing a good question so this question was if I put all those security measures best practices in place and I passed it on and everything's been updated and I'm doing my job of the maintenance program and the site still gets hacked what do you do as the provider right what kind of guarantee is that the question that's a good question and I think that comes down to the individual nature of your business but in the world of the internet the world of walking down the street security unfortunately isn't something that's 100% attainable all the time and my advice would be to also communicate that to your clients it's really about imagine this is your attack radius these are all the ways in which someone could come at you to attack you and putting basic security measures in place reduces that attack radius or cuts up that pie so it reduces your chance of something bad happening just like walking down the street I put my wallet in my front pocket and on it when I'm walking through a downtown or a shady area that reduces the chance that a pickpocket will come and pull my wallet out of my pocket that would be my best advice it really would come down to how you want to approach that but I would communicate at least that part to your clients and then maybe have a guarantee you know if it's if you find that it's a cost benefit and it's a value add if your site is hacked we will fix it for free and then you need the cost to get a one-time malware cleanup good question thank you yes sir are there any monitoring tools that you can use to see what's hitting your site yeah the question was are there any monitoring tools that you can use to see what's happening with your site there are a bunch of them I work for a company that offers one but I'm not here to talk about that I would search WordPress site scanner and you will come across several options in Google and site scanners what they do some of them look at your site from the outside and as a browser would see it or as a user would see your site and some of them you connect to your actual web server so they can scan the actual files on your server looking for malware that maybe nested or hidden in there and then can remove that when you're looking for site scanners WordPress I would look for deep scan or inside out scan or just scanners in general yes ma'am yeah the question is do I know anything about wordfence I do wordfence is a great product and just like us they're doing great things in the security space and I use wordfence on several sites so wordfence provides a lot of immediate reporting right to you within your WP admin dashboard which is great so knowing what I know as a user and I know several of the people within the company all quality in my opinion yes ma'am yeah the question is my hosting provider provides me with site log service and that happens because we do have a lot of partnerships with a lot of global web hosts and the question was is there different levels of service there certainly is so you could have what you call a light scan which just does the outside scan on your site which looks for things like SQL injections and cross site scripting or redirects things like that or you could have a higher level which includes that deep scan or you could have an enterprise site instead of us scanning 10 pages on your site 100,000 pages and you could do a monthly scan, you could do a daily scan you could do what they call the infinity scan which gets done and then it just scans again so the answer is yes there's different levels and depending on the host and the partnership it depends on what they offer their customers any other questions alright well thanks again for everybody for coming I appreciate it enjoy the rest of the week


Unreal Joe Byn can't even get a happy birthday song right while he was mumbling out of speech during Martin Luther King Day He attempts to sing happy birthday to Martin Luther King the third's wife, but totally botches it But congratulations today the honorees including your wife Who I understand his birthday today Well, look my wife has a rule in her family When somebody's birthday sing happy birthday ready? Happy birthday to you Happy birthday to you Happy birthday I'll Happy birthday to you Birthday I don't know what that was, but it definitely wasn't Andrea