Hello. In this video, I will present the work broken mass implementation with many share on 32 bit platforms or when the security order doesn't matter. This is a joint work by myself, Olivier Bronchon and my supervisor, François Guéstandard. So how to design sites and security with masking? To obtain a secure implementation with masking, the design goes in two steps. The first one is to leverage proof in an abstract model, such as random probing or threshold probing security. And once we have implementation secure in this abstract model, we leverage reductions to obtain security with noisy leakage, which is closest to the reality. If done that way, the attack complexity can be defined by that. So on the left you have A with the attack complexity and on the right you have MI, which is the information that the adversary can obtain on a share from the leakage and D, which is the number of shares. And you see that the attack complexity increases exponentially with the number of shares. To have that equation, the right two conditions must be fulfilled. The first one is that all the shares leak independently and this ensures that the day D will be the one that's expected. And the second condition is the noise condition, which requires that the mutual information between the leakage and the shares is small enough to be amplified. This seems simple, but there is a lot of challenges when designing secure implementation. So the first one is that an implementation, a masking scheme, depends on the platform. So either we are running on software, on hardware, and there is a large design space to choose the masking scheme. Maybe it will depend on the cost of randomness, what's the best choice. And the designer attempts to optimize his design choices regarding to the cost versus performance trade-offs. So this paper tackles the problem of security evaluation. And here we will show a timeline of the secure implementation, where on the x-axis you have the time and on the y-axis you have the best current attack. So first, when there is a product, of course there is some attacks. The technical state of the heart attacks was so done. And they improve this time, so the best attack complexity decreases this time. And at some point, one has to deploy the implementation and say no, it's in the wild, I cannot touch it anymore. And at that time, you would like to know what's the current resistance of your target. But this time, attack still improves. The goal of this paper is to propose worst-case attacks or worst-case evaluation. And the goal of that is to anticipate future improvement of state of the heart. How do we do that? So what are the ingredients? Basically, we give full knowledge to the evaluator during profiling. During profiling, the evaluator has access to the source code, to the randomness that is used for masking. So what are the shares? What are the inputs? The plaintext was the key. He also has the opportunity to have measurement setup that is as clean as possible. And he has to have efficient technique to explore all information within the leakage. So why do we need randomness during profiling? Basically, it allows to simplify the profiling stage. And it allows also to give a good interpretation of the attack results. And that's what we do in the paper. And it also enables to give clear guidelines to the evaluator. Because we are able to understand what are the weaknesses of the target. We can say to a designer, OK, this is the issue, and that's what you should fix to have a situation implementation. So of course, if we are back to work to the previous figure from the previous slide, in a short term, there is probably a gap between the best possible attack and the worst case attack evaluation. But as attack improves, probably that this gap vanishes. So what's in the paper? We propose a new methodology to analyze mass-bit slice software. This methodology is really simple and it's based on Gaussian templates in Saskia with dedicated factor graphs. We apply the methodology to two implementations. The first one is AIS implementation following the guidelines of Goudarin. And the other one is for Clyde, which follows the same guidelines and has been used for the chess 2023-2020 CTF. These targets and these softwares are running on two low-cost MCUs that are Cortex-M0 and Cortex-M3. We use them because they are widely used by the lightweight crypto community for benchmark of these competition candidates. And it puts forward that security on these devices is at least expected. We also extrapolate the security of these implementation to larger mass-gain order. And we also discuss the impact of additional contour measures. Now we will detail the methodology used for this work and to analyze mass-softwares. So the methodology is based on profile attacks, which goes in perfect. So the first phase is profiling where there is a target and we provide a target with randomness, plaintext and key. The target to the target, a scope is attached and which records the leakage for each of the execution of the cryptographic primitive. Then, because the narrator knows the source code and knows the key, the plaintext and the randomness, he is able to derive all the intermediate variables or all the shares that are processed by the target. Based on these leakages and shares value, the evaluator can build a model that maps for a given share value, the leakage distribution. The second step is the attack phase where once again we feed the target with only a plaintext, no more the key and no more the randomness. And once again to the target, a scope is attached and it records leakages. The second step is to derive probabilities for each of the shares value from the leakage by leveraging the model builds during the profiling phase.  So, the methodology is based on soft analytical side-gen attacks or SASCAs. And here we will take a small example of what SASCAs in general. So, let's take the simple example where we have circuits c equals a plus b and d equals a times b and SASCAs goes in multiple steps. So, the first one is to build a graph where you have first variables, so here say a, b, and d and operations that are addition and multiplications. And then we draw edges between the variables and the operations. Then, from the probabilities obtained with the model in the attack phase that we described in the previous slide, we init all the variables with their distribution. And then we apply a message passing rules, which basically involves passing messages from operations to variables and then from variables to operations. And it's a iterative processor repeat that many times. So, what are the limitations and complexities involved in running SASCAs? First, multiplication, I mean the message passing rules for multiplication is expensive. Indeed, its complexity goes in 2 to power 2b, where b is the number of bits in the target variables. So, if you want to profile 8 bits values, so b equals 8, then the complexity of multiplication is 2 to the 16. And additions, it's less expensive because its complexity goes in b times 2b. So, SASCAs is a optimal way to recombine information if the graph is a 3, meaning that there is no cycles. If there is cycles in the graph, then this SASCAs becomes realistic. So, how do you apply that for a mask software? So, let's take a simple unprotected circuit that we want to protect. So, we have a times b equals c. The secure implementation looks to something like that, where you have shares of a, which are a0, a1, shares of b, b0, b1, shares of c, c0, c1. And secure multiplication, so the multiplication above is replaced by a secure multiplication. Let's say the ISW multiplication that takes the shares as inputs and outputs the shares of c. And for this methodology, we would like to keep providing an attack complexity who scales gently with d, and to reduce the UB sticks. A third solution to reach that would be to build a factor graph for the entire ISW multiplication. This may be a good idea, but there is some limitations, but let's start with the advantage. Which is that it can possibly exploit all the information from the leakage within these ISW multiplications. However, the number of nodes, number of variables processed by ISW multiplication is quadratic with the number of shares, and the number of multiplications is also quadratic, which makes this computational cost expensive and not scaling gently with d. Additionally, this graph to represent ISW multiplication contains a lot of cycles. So what's the efficient methodology we propose? It goes in two steps. First, for each of the secret variables, so a, b and c, we build them from their shares. So let's say here with a two-shot example, we have graph that will... we have XOR operation that recombine a1 and a2 to obtain a. Same goes for b0 and b1 that gives b, and c0 and c1 that gives c. And this small graph, we call them encoding graphs, and there is one for all the secret variables. The second step is to link these secret variables, so a, b, n, c, by operations, which is here a multiplication, for example. And this is called the unmasked graph. So what are the points of this methodology? First, regarding the complexity, it's quite nice because the number of variables to profiles remains linear with d because only the shares needs to be profiled. I mean, the shares have the input and output of secure multiplications. Then, the number of multiplications is also constant with the number of shares. The encoding graph contains no cycles, meaning that information on a is obtained without any heuristics because the encoding graphs are trees. And finally, once again, regarding complexities, because a variator can solve all the encoding graphs independently, it allows to have some trade-off between, I mean, to have trade-off not to load everything in memory at once. The drawback is that with this methodology, we cannot exploit lower order flows, and that's what we call order preserving. This methodology has been implemented with Scalib, which is a Python library that we developed with my colleague Guy Tancasius. So what is it? It's a Python package that you can install simply by running pip install Scalib. There is multiple tools for site and analysis, and it's optimized to run on a single or multiple threads. In this project, we use it to compute signal-to-nose ratio for each of the shares, to run Saskia, and to run a key animation. So what are the concrete results of our methodology on the investigated implementations? So first, we look at concrete attacks. On this graph here, you have on the x-axis the number of traces used by the adversary, and on the y-axis you have the medium key rank, which is the remaining entropy of the key. So we see that if you increase the number of shares from 3 to 6 here, you also increase the attack complexity n. And here with 9 traces, you are able to break the 6 share implementation of AES running on Cortex M0. If you move on a Cortex M3, then things get better, and with 2000 traces, we are able to break 5 share implementation. And then for client on Cortex M0, which is the chess 2020 dataset, we are able to break 8 share implementation with 12,000 traces. So with these numbers, we are able to extrapolate that. So each of the concrete attacks from the previous slide is a bullet on this graph. And because we know that the complexity of attacks is exponential with D, we can extrapolate the trends. What do we see and what do we have as conclusion there? So first we observe that by comparing AES running on Cortex M0 and Cortex M3, we see that Cortex M0 provides more information per share, hence it requires more shares to be secure. Or for a fixed number of shares, the security is lower on Cortex M0. Then we can compare AES and client running on both on the same target, Cortex M0. And you observe that client provides a better security than the AES. This is probably because client has a lightweight S-box that so requires not that much computation in a bit like settings. And this is because the client S-box has been designed to be mask friendly. Overall, you observe that in the best case, so AES running on Cortex M3, we need at least 16 shares to reach forte bit security. What does all this implies for performances? So here we look at client running on Cortex M0 and we look at security versus performances. For the performances, we take a recent paper by Belayet published at Europe in 2020. So we observe that if the designer targets 20-bit security, so N equals 2 to the power 20, then about 12 shares are needed. We require, I mean, the throughput is about 3 kilobytes per second. Then if the target is 30 bits of security, then 18 shares are needed and the throughput is 1.2 k bytes per second. And once again, if you increase the security you want to have, so 40 bits of security here, you need 24 shares and the throughput still decreases. Yet we observe that by slightly paying additional cost in performances, so between 20 and 40 bits of security, there is more or less a factor 4 in performances. So you get 20 more bits of security. So what can we tell about masking on 30-bit software and what should we do? So first, the main issue we observe is that there is a lack of noise on these devices. Indeed, this is not the big issue. Our attack is not able to exploit these weaknesses, yet the attacks are quite efficient. So the issue becomes from the other part of the equation, which is MI. That is the MI per share is too large. This is illustrated with a graph on the left where on the x axis you have the number of leaking points and on the y axis you have the mutual information. And we see that the mutual information is quite large. We also observe that the noise is mostly algorithmic, meaning that the noise really depends on what you put in your registers, what's the layout of your registers and what instruction you apply to them. Overall, reducing this MI would lead to a significant gain in performances. So the natural solution to anticipate all that is to take a general contour measure that's represented by a factor of gamma, which reduces MI. To do that, the data complexity becomes something like this where we have gamma that is raised to the poor D thanks to masking. So that parameter gamma allows to cover many contour measures that can be physical such as noise addition or algorithmic such as shuffling. And based on this gamma we can define a quantitative target for their effectiveness. And in the paper we present many of these graphs where on the D axis you have the number of shares within your implementation. On the Y axis you have the gamma and the color represents the data complexity to the N. Y means that N is very large, so there is high security. Black means that N is low and so there is low security. So on this graph we can see that for a given security target if you are able to decrease mutual information per shares by a given factor gamma then you need a given number of shares to fulfill your desired data complexity. From all this, now we will be back to our goal of estimating the worst attack data complexity. And a usual question is to know what happens when you want to to profile on a device and attack on another device. So how do we evaluate that? We profile on a device I, we evaluate MI with that model on device G and then we estimate the loss or the reduction of mutual information that it implies. And so we have this kind of grid and we see that for some pairs there is a large loss but for others there is no I mean or a small one such as 0.9. So for what does it implies for side channel evolution? Basically the cross profiling does not provide any large or significant security gain. Indeed there is some pairs where the gamma is large and other when it's small. And if you want to run evaluation on one device, profiling on one device and attacking on another device you expose yourself to a risk of false sense of security. As example you could be profiling on one pair where gamma is very low and maybe adversary will pair with where gamma is very high. So overall evaluator should profile and attack on the same device to avoid these risks. Now let jump to the conclusion. So what are the takeaways of this presentation and of this work? We've been presenting an efficient methodology to attack or evaluate masked implementation. We've been putting forward that the main issue for protecting this low cost MCU with the lack of noise and you require a large number of shares to protect this device. One solution would be to reduce the number of operations that need to be masked by leveraging dedicated mode of operation et with this work we also present Scalib which is a Python toolbox that contains a lot of optimized tools for such an analysis. So thanks for listening. Here is some useful links and one related work that exploit the same methodology and apply to the well-known ASCAD dataset.


My name is Emily and I'm an incoming freshman here at Purdue University. I will be studying elementary education and I'm here for summer start with everyone else. So our check-in process is a little different this year. When students arrive, they'll come to one of the designated parking lots for our touchless check-in process. They'll start with some temperature screening that's being done by the EMTs and our Purdue fire department. Then they'll come to our staff that will hand them their PUIDs and their room keys. So they will be able to check in out here instead of going to one of the residence halls and then straight to move in. I'm happy to be on campus. I'm happy to be here and we'll do whatever it takes to make sure we stay on campus. And as of right now, it's running really smoothly. It's a little smaller than what I expected, but I think that's most freshman. I think it'll be perfect.   It's funny because when your youngest leaves, your friends and family are like, are you so sad to see them go? And oddly, I'm not because that's what you prepare your children for. You prepare them to be independent and be able to manage on their own. And it's super exciting. I look forward to what she's going to do with her life. I think she's going to be a great school teacher. She has the passion and the love of kids. And I just look forward to how she's going to be able to pay up forward and contribute back to the community as a teacher.


Who is your funniest teammate and what's the funny story about them? My man Cody Ford, big tiktok man, yes, but the kind of guy to get in the coat tub with his phone in his pocket. Antoine Woods, Micah Parsons is one of them. Have you seen the clip of Micah Parsons when he talked about how he loves feet? It doesn't surprise me. He talks recklessly. You got T.J. White, he gives more of the dead paying humor. George Pickens. Like he'll come up the field and be like, did you just see what I did?


team here in beautiful Portland Oregon. It's been really great sharing this city with everybody for the for the past nine, ten days or so. You know, we've got a lot of people to thank for pulling this off. When Patty and I first started talking about potentially hosting a DebConf here in Portland, which was several years ago, my baseline requirement was that we would not even consider putting in a bid until we could first organize a piss up in a pub. Over the past couple of years we've succeeded in doing that. We've had a lot of piss ups in law of pubs in the course of putting on this conference. There's been a great local team who's really come together for this. In this closing session we just want to thank everybody who's involved and we want you to thank them as well. So we'd like, first of all, if you're part of the local team, if you would come up here on stage and make yourselves known, we'd like to thank you for your work on the conference. That's Pietro, Allison, Vagrant, Tony. Come on up everyone. Everybody take a bow. They didn't even rehearse that. I'd also like to thank the members of the local team who are not here up on stage with us today, Case Cook and Kirsten Cook. I'm sorry, Kirsten Cook. Case was really in charge of bringing the network together here this week, planning all the facilities work, and yet he did most of this. Well, so he was in Portland up until about the week before the conference, then went to LinuxCon, came back after the setup was already in progress and has again had to run off to another event this weekend. So many thanks to him for all of his work. He's been tag teaming with Matt Taggart on that, so Matt, you should also stand up as part of the local team. And many thanks also to Brian, Nick and Brandon Murray who were our day trip hike leads. They also can't be here today, but they did an excellent job not losing anybody in the woods. So Patty didn't have to kill anybody for losing a person, or however that works. There's a lot of other teams that have been involved in DevConf both here during the conference and preparing for it remotely, and we really want to acknowledge their contributions as well, which includes the front desk team.   So there we go. We also have the visa and registration team. If you were part of the registration team, if you're not already on stage, which I think some of you are, stand up, be recognized, and come up on stage. The registration team this year has included both Natty and Patty. And there are gestures indicating that Patty should move on to the... Oh, people are hiding behind me. I don't know which ones. A big thanks as well to Norman Garcia who wasn't here this year, but helped out a lot with the visa and the registration stuff remotely. So many kudos to Norman and to Giacomo Cappanazzi, or Cate as he's better known for all their work on that. I'd also like to thank the DevConf chairs. We have one of them currently on stage, Maure, and Tasia is hiding in the audience. And where's where's Teen Show? Yes. And I think people are going to have to start squishing a little bit on stage because we'll see just exactly how big of a group effort this was by the end of this talk. Next up, I want to thank the Bursaries team. I know there are some Bursaries team members still in the audience, and they should stand up and be recognized for their work as well. You know, it's a... We've had some interesting BOF discussions this week. No, no, on stage, David. Come on. You too, Martin. But it's always an interesting process trying to figure out how to best allocate sponsorship money so that we can bring as many people as possible here. And they've done some great work. Philippe Van Wiel is not here. He had to take off already, but kudos to him and to all the other members of the Bursaries team who have been at DevConf this year and may not have come to DevConf but still helped us with that process. Our bookkeeper is already on stage, Martin Kraft. Thanks for keeping all those numbers straight. Our admin team, of course, has to keep the lights on on the website and all the other technology that's required to get the conference off the ground. So Jörg Jaspert and all those folks. Jörg is not here this week, but kudos to him and everybody else who worked on the admin side of things. And of course, the conference would be nothing without talks to fill it. So we have a talks team which includes both folks who selected the talks, scheduled the talks, and dealt with all the ad hoc proposals. So if you're part of the talks team in any way, come on up. The website team as well, which is, I know a number of people have been involved in working on the website, including Allison who's already on stage. We also have Valesio who helped us with some of that artwork. So Valesio has left already, but thanks to Valesio as well as to Leandro and Mato. I'm going to mangle his last name Marjanovic, I believe is the name. And he has not been here, but he's also a member of the local team who helped us with artwork and designed the logo that you see on all of our bags and t-shirts. So thanks to them. Next, let's thank the video team. Yeah, if we can point the cameras at the video team without causing some sort of causality loop here. Video team doesn't mean anybody wearing a yellow shirt. If you're wearing a yellow shirt, please come forward and be recognized. Yeah, you know, the video team always does a great job at these things. We pose them an even more difficult challenge than in past years where we in fact had three simultaneous rooms being videoed and broadcasted where we traditionally have only had two. So we're expanding our video work even more. And these great volunteers have managed to come up with that. And it's really tremendous work they do. And we're very grateful for it. And we'll have some statistics on that a little bit later on in the slides. We should note that people actually took their place while they're up here. We had people actually fill in to take their place so they could come up here. Right. So despite, despite asking the video team to be up here, we have more people who as we pull the video team up, more people have backfilled at the cameras in the soundboard, which is exactly the kind of can do attitude we expect from Debian. As well, let's also recognize Igar's is who is let's let's point the video camera at the guy with the other camera. Staff photographer, the official photographer of DevCom 14. And the last team I wanted to thank was the sponsorship team. I don't know if any of the members of the sponsorship team are here in the, oh, sorry. Yeah. So, so I also want to thank the sponsorship team who did a tremendous job this year, raising money to put this conference on. Obviously, it wouldn't be possible without without an awful lot of money and resources. And if there's any member of the sponsorship team this year who helped with fundraising, who's not already on stage, or if you are on stage, please stand up or wave your hand so that we know who you are. That's anybody who did anything talking to sponsors this year. So once again, thank you, everyone for coming. And I do hope to see you in Argentina. I'll just leave you with this little tidbit, which will make Mark of Hill 100% better, I'm sure, which is those who like sausages and dev comps should not look into the creation of either. Thank you very much. Again, but thanks to everyone who has come who has made this possible. And we would like to see all of you next year in Spain, in Cáceres, Extremadura. Yes, talk meisters running around, graphics, video, everything. Talk meister. So clearly more about like half the room is standing up. So it's quite clear that this would just not be possible without the help and effort and care that everyone's given. So please a huge, huge round of applause for everyone. So while Valesio did have to take off, he did send us off with this little video, a reminder of years past, a reminder of everything we've done this week, and hopefully some of that looks familiar. If you can remember back that far to three days ago. A lot of memories have been made here, and a lot of memories are still being processed. And if you saw up there, there's a lot of faces on those photos from past dev comps that we see here today, up on stage and in the audience. We also see a lot of new faces here today that weren't in those, and that's both of those things are really great to see. So we've got a few numbers for you about dev comps, dev comp 14 in particular. This is dev comp 14. We had 309 attendees this year, which is great. 106 of whom were sponsored. We had nine days of events, 87 hours of which were recorded as video, which is 1123 gigabytes of video files. There's only one trip to the emergency room this time. Does that only happen when we have dev comp in the US? I'm not sure. I'm assured that it happens in other countries as well. We took 180 attendees on the day trip, and we got 181 attendees back from the day trip. We are not sure how that happened. 110 dollars is the cost of the new pair of shoes Patty needed after she wore the old ones out during the conference running around. We served 1,927 cups of coffee and tea through the conference, which of course is about right for fueling 87 hours worth of video. We had 22 sponsors that we wanted to thank, starting first with our platinum sponsor Intel. It's been really great having their support this year. Of course, this year dev comp 14 in Portland is in their backyard, so it was very great to have their support for dev comp 14. We also have a number of gold sponsors. Matanel, Valve. It is okay to hold your applause until I go through all of them, by the way, if you prefer. IBM, Google, HP. A new sponsor on the list this year was Dropbox, and next are Silver sponsors, which include such well-known names around Debian as Catalyst, Creditif, Ubuntu slash Canonical, Arm, Cumulus, and Jaguar Land Rover, as well as Univention. And finally, our bronze sponsors, Logilab, Galois, DigitalOcean, Citrix, Labs, Second Quadrant, Bitnami, which I believe is the last one I have. Finally, a thank you to our infrastructure sponsors who continue providing the support for dev comp on the back end from year to year. Finally, just one last bit of statistics here that didn't make it into the slides, but as part of the video work for this conference, we had 11 active international video relays over both IPv4 and IPv6, each of which pushed over 150 gigabytes of traffic this week. So dev comp, you know, we talk about how the video team is important to this because it really is, it's not just the people here in the room, but these videos are archived, they're watched live, and they're streamed all over the world during the conference. So that's really great as well. So now without further ado, we hand it over to the dev comp 15 team. We released the rest of the dev comp 14 team from the stage. At above about dev comp 15. So this is going to be a very short summary for those of you who were not there, and those of you who were there, but we're not paying attention. Dev comp 15 next year is going to be in Heidelberg in Germany. We are very eagerly awaiting you. Heidelberg is a very beautiful city. It's UNESCO World Heritage site. The old town is really, really nice. I really recommend it. It's easily reachable from the Frankfurt Airport, just one hour train ride. And yeah, so you are not going to have problems with public transportation there. We are going to have the conference in a youth hostel, which is everything will be in the same place, one building or the conference rooms. We will have exclusive views of the building, no external visitors. We will have lots of different hack labs, hack spaces, meeting rooms. A lot of adult sessions will be possible. We will have a local bar where you will be able to buy lots of different types of products that you will find in the back. There's also a disco and lots of musical instruments, so we expect lots of music next year. One of the things that has been increasingly a problem during the upcoming, well, maybe not a problem, but an issue is that a lot of the developers have children and it's hard to leave their children behind. And if they are here, like Manuel, sometimes they are crying and the developers don't get to enjoy the conference. So we really want to help with childcare. We don't have any set plan yet, but we really intend to help with that so all the developers can attend. And the people that run the hostel are really very nice with us. They really like us, so we expect to have a really great experience there. The dates have been announced. The conference itself is going to run from August 15th to August 22th. Those are Saturdays, so from Saturday 15th to Saturday 22nd. We have the dates for the camp set with the hostel. We haven't yet finalized the exact format of the conference, but those dates are there if we want to have the camp. And we intend to have an open weekend for people that are maybe not into the camp but might be interested in coming for the weekend on the 15th and 16th. We have many ideas around the conference, like, well, the opening weekend, workshops, hack time, taking into the ideas from this year and also adding new ideas. And we also want to hear your ideas. So if you have feedback of things that you think might be interesting to do and to try out, like having sprints or inviting interesting speakers or any other ideas, we want to hear your feedback. We already have a website. It's very preliminary, but it's there. We have a local team IRC channel, but we expect most of the important ORGA things to go through the DevConf team channel. And the same for the list. We have a local team list, but we expect most of the organization stuff to go through the team list. And so if you want to participate, we really appreciate your help. And last, this DevConf has been great. So we want to thank the organizers of DevConf 14 for having such a great DevConf and we hope that next year it can live up to such a high standard. We have one last thing to make it official of the handoff of DevConf 14 to DevConf 15. Marga, I present you with poetry. Who is a chicken? With that, the DevConf 14 teams duties are officially concluded with the exception of just a few more quick announcements regarding the closing. No, no, the final report is your job. Our ceremonial duties, shall I say. Just a few quick things. Any feedback at all about the conference? We do have an email address set up feedback at devconf.org. So any feedback you have about how this conference has gone, we'd like to know. Good, bad, or otherwise. This building closes at 6 p.m. today and so we are wrapping up in this room immediately after this closing talk and the hack labs. I don't know the current status of those if those are already being torn down, but the rooms will be available until 6 p.m. but you may or may not have anywhere to plug in either ethernet or power, so just be aware of that. Finally, the front desk is going to be open after this talk until about 5 p.m. and you can buy water bottles there. If you didn't get enough of these Debian random water bottles and you'd like to take a few more home, those are still available for sale. This is what they look like. You should already have one. And as well, we still have leftover water from the day trip that's bottled water. So if anybody wants to take one or more of those, I believe they are in the back of the room by the recycling bins. So feel free to help yourselves to those so that we don't have to carry all of that home. And let's see. So if you want to recycle your lanyards, we also have a place at the front desk where you can recycle those. You are of course welcome to keep those as souvenirs. If you have your fill of lanyards from other conferences and are not interested in carrying it with you, we're happy to take those back and we will reuse those in future years. And I think that's it. Other than I have to say something here about seeing you next year, so we'll see you next year in Heidelberg. Okay, that's enough. Go Hack!


Like, if you've got the name tag on, you're basically a walking billboard and people are going to come up to you and those are easy conversations. I don't understand where the problem is. So I'm a veteran and I have, and down here in South Florida we have a veteran's network and basically like plumbers, electricians, general contractors, all of this. And I'm trying to figure out how I can leverage that with what I do now, which is obviously, you know, other than my direct direct to my clients, but in my funnel tool, you know, I provide value and I'm providing veterans, you know, they still work with the same work ethic, same discipline, integrity as they did before. They just redirected their passions to a new profession. And I believe that can provide value as well. So how do you think I can use that to help with what I'm doing? So as far as like taking advantage of the fact that you have a connection with other contractors and vendors and things like that, you mean? Yep, that are all that are all, you know, that we meet monthly. We also have a website and all our vendors listed. I think things like that, and you guys feel free to chime in, but like on things like that, I would be careful with mass marketing that because, you know, yeah, they're, you know, they're your fellow veterans, right? Which thank you for your service, but they're fellow veterans, okay?  But at the same time, you know, that's not to say that, you know, like 99% of them, I'm sure are great, but what happens that one time that you referred them to a client and some really bad stuff happened, right? That's the thing that happens in my mind. And it's happened to me before I've referred contractors out, great contractors, nothing, but I've had nothing but great results. But then that one time it was a mess. And now the, now the, now the client is pissed at me and I got to where I just don't refer vendors anymore, you know, very few, like I'll do the inspector, you know, I'll do the lender, but as far as contractors, that's tough for me to, so I try to tread lightly there. I think I would use it in my back pocket just to provide more value, because if you don't have that up front, but then on the back end, they need a plumber and you just pull one out of your pocket, they're going to be like, wow, this dude is really helping us here. You know what I mean? So I think use it, I think keep it in your pocket and use it when you need to, you know, to make clients feel like they're VIP. So they're completely different from like what everybody else has been asking. I'm actually situated in Canada and I came across a YouTube channel just like looking at like sales strategies and things. I'm a mortgage broker in Canada and I'm very new. And I just wanted to ask a little bit of your advice. I watched your video on how new lenders can start cold hauling realtors and I've tried your strategy and it's honestly been working really well for me. The one thing that I am having trouble with is the follow-up. So after I do have the initial conversation where I ask them like, hey, is there anything in the world I could do for you? It's your classic phrase. Everybody loves it. I just don't know after, even after I pass all the objectives and they say, hey, you know what? I would like to work with you. They book a meeting. You know, we go over everything. I just don't know how to go back to them asking for business. And that's the one thing I'm having a lot. Well, what do you have in a meeting with them about? So I basically, when I have a meeting with them, I start to get to know their business a little bit more, ask them about their experience as a realtor. And then I have a five-minute presentation because I don't want to bore them with the same things they hear a thousand times where I just talk about exactly what the holds are in the industry, which are speed, communication, and the ability to get results. So a lot of tech-related workers are very slow or they don't communicate enough or they can get them. And I just go into that and they say, you know what? I appreciate that. Where you learned this, I tell them I just talk with a lot of realtors who are having problems. And these were the problems that have come up again and again and again. And this is how I've sort of solved those problems. It's just that I don't know how to go back to them after that and be like, hey listen, can I help any of your clients? Gotcha, man. I think I would kind of like, I don't know man, I'm not into like the list meet and talk about realtors and give me a five-minute presentation and stuff. Like here's what I want. I want to see what you can do with the client. I want to see if you give them the customer service they need. I want to see if you get the deal done. I want to see how your communication is between me, my client, the title company and everybody involved to get this thing done really smooth and that my clients are happy as can be about your services, right? And so that's what you need to sell them on. Don't do this horse and pony show about what they're looking for in a mortgage broker and give them a five-minute presentation. You go straight for the gusto here and you tell them, listen, I'm going to take the best care of your clients. I'm going to get the deal done very smoothly. I don't know if you, if you're, you know, because a lot of these people are very loyal to their lenders. So what you're looking for is somebody that's caught in a deal that they're having seats. And when people switch lenders, it's because they had a problem with the last lender. And what you're trying to do is find that perfect timing of somebody that's having problems and looking for somebody different to kind of, because once they find the one that does the best job, they're going to, they're not going to move. So that's the thing, if you notice agents are very loyal to their mortgage brokers that they've done business with for a while, because they know how they operate. And it's too risky to take a client and try out another mortgage broker on a deal where you're going to make $15,000, but you're risking that on this mortgage broker that may or may not do a good job, but you know this other guy's going to do a good job, right? So it's hard to switch when you got a good one. So what you're trying to do is trying to find the new agents that are still looking for that good one, right? So go after new agents. That's a good pull for you to go after. And also, you know, call the agents and ask them how it's going with their current lender. And if you're thinking about, you know, trying out another lender, right?  So just give me a shot. Let me prove it to you. And then that'll be that.  Like I see you're an established agent.  Do you have a lender that you work with normally? Okay, you do. Cool. How are they doing for you? Like, are you looking to make a change or trying to bail us out? You know, just understand their mindset behind the fact that once they get a good lender, they're not going to use another lender. So what you're trying to do is trying to ask the questions to dig into. Do they have, is that lender the one that they feel is the one? It's like getting married. Like is, is that lender the one? Right. And if it is the one, say, great, congrats on that. Don't try to, you know, do anything at that point. Say congrats on that. I'm going to put you in my, you know, in my database. I'll send you stuff. If you ever want to try out a different lender, I'm here, right? And then move on. Because you're looking for the people that are ready to try a different lender or a new agent that's trying lenders to see which, you know, you got to understand the mindset behind it, right? So just ask the questions you need to to find out if you could possibly, it's the same thing with agents when we're talking to prospects. You know, when I'm saying, hey, is there an agent you would work with? If you were to do something, I'm just the same thing. I'm trying to find out if they found the one yet. And if not, then here I am.  Like, if you've got the name tag on, you're basically a walking billboard. People are going to come up to you. And those are easy conversations. I don't understand what the problem is. It happened the other day and I felt after I left the store, I'm like, I think that lady like really was looking for an agent. And I just walked out the door. I would say that if they walk up to an agent and start asking you real estate questions and chances are they're looking for an agent. But what you want to do is just ask them. Say, yeah, I'm in real estate. Here's the answer to your question. What are you looking to do? Or how can I help you? Right. And then based on how you can help them. Oh, you're looking to do that. Well, where are you looking to do that for? Okay, cool. Well, let's are you working with somebody already? Well, let's work together. What's your information? Bam, take it down to your phone. Email, phone number, information. Okay, cool. Well, listen, you want to get together later? You want to get there tomorrow? We're going to look at the house or I'll email you some properties. I'll call you later. I don't know what you're going to say from there. It depends on what the situation is. But those are easy conversations to have. When they're coming up to you, I think what's tough is when you're trying to talk to people about real estate and you go up to them. And if people are coming up to you, that should be easy conversations.


So calculus is based on three important problems. We've seen two of them. Finding the slope of a tangent line and finding the maximum or minimum value of a function. Now let's take a look at the third of the three important problems of calculus. And that's this problem. Find the area of a bounded region. Now this term might be new, so for now let's define a bounded region as any portion of the plane that has an identifiable top, bottom, right, and left. For example, the region bounded by the curve y equals x squared, the x-axis, and the lines x equals 3 and x equals 5. Note that in this case, our top, bottom, right, and left are clearly identifiable curves. Yes, mathematicians use the term curve to apply two straight lines. However, it's not necessary that these all be curves. For example, we might have a region bounded by three curves, y equals x, 8 minus x, and 2x plus 5. Or we could have a region bounded by two curves, y equals x cubed minus x, and y equals x. Or even a single curve can bound an entire region, x squared plus 4y squared equals 16. So if I want to find the area of a bounded region, one thing we can do is to find bounds for that area. So I'll introduce the following terms. u is an upper bound for the area if the area of the region is guaranteed less than or equal to u. Likewise, l is a lower bound for the area if the area of the region is guaranteed greater than or equal to l. The closer u and l are to each other, the more precisely we know the area of the region. For example, let's take that region bounded by x squared plus 4y squared equals 16. And let's see if we can find an upper bound for that region. Now, since area is a geometric concept, the hardest way possible to answer this question is to not draw a picture. And indeed, answering a question like this without drawing a picture is a good way to gain street cred among bands of rogue mathematicians. But if you're not looking to impress bands of rogue mathematicians, we might want to answer this question using the easier way, graph the region. Once we have the region, it's a lot easier to figure out an upper bound for the area. Remember, the upper bound is going to be an area that the region is guaranteed to be smaller than. So let's throw down a larger figure. And if we can calculate the area of this figure, then we know an upper bound for the area of the region. And that's the problem. We have to know the area of the enclosing figure. So instead of using this figure, whose area we don't really know, we might use a different figure whose area we do know. So let's use a rectangle. We'll throw a rectangle down, and the area of this region is certainly less than the area of this rectangle. But maybe we can do a little bit better. And this rectangle seems to be a good fit. The entire region fits inside a rectangle that's 8 units wide and 4 units high. So 8 times 4, or 32, is an upper bound for the area of the region. How about a figure bounded by two graphs, y equals x squared and y equals 2x plus 3? Again, it'll probably help to draw a picture, so we'll sketch those two graphs. And we see that our line intersects the curve, and so we should find the intersection point. Since y equals x squared and y equals 2x plus 3, we can find the intersection point by setting x squared equal to 2x plus 3, and this gives us an equation we can solve. Getting all of our terms to the left-hand side, we see this is a quadratic equation, and so we can solve this using the quadratic formula. And we get x equals 3 and x equals negative 1. So we could try to find a box that the region fits into, and at this point, there's not really a whole lot of advantage in trying to get things too exact. So let's throw this into a fairly large box that has a width of 4 at a height of 9. And so this will give us an upper bound for our area of 36. Now, what can we do to get a better upper and lower bound? Well, one possibility is the following. Suppose I pick some points along the boundary of our region and then form a polygon by joining the points. The area of the polygon will approximate the area of the region. Actually, finding the area of a polygon is difficult, so in practice, we'll use rectangles because those are easier to work with. Now, before proceeding, we'll have to introduce a grammar lesson. Given a bounded region, we want to partition it into subregions. For convenience, for now, we'll identify partitioned points on the x-axis, and then use vertical lines through these points to partition our region into subregions. And for each of our subregions, the lower rectangle is the largest rectangle contained by the subregion. The upper rectangle is the smallest rectangle that contains the subregion. The left rectangle is the largest rectangle whose left side is in the subregion, and the right rectangle is the largest region whose, wait for it, right side is in the subregion. Now we have a whole bunch of rectangles whose areas we can determine exactly, and so we'll use our partition of the region to approximate its area. If we use the lower rectangles, we'll obtain the lower sum, which will be a lower bound for the area. On the other hand, if we use the upper rectangles, we'll obtain the upper sum, which will be an upper bound. We'll take another step that'll make our lives easier. Since using either the lower rectangles or the upper rectangles requires us to identify for each subregion, the lower or upper rectangle, it's easier, but somewhat less informative, to find the left sum found by using the left rectangles and the right sum found by using the right rectangles. We'll take a look at these next.


With our panel, Melissa Armo joins us now. She is the owner of the stock swoosh. Doug Flynn is a certified financial planner and co-founder of Flynn Zito Capital Management and Art Hogan, chief market strategist at B Riley FBR. Good morning. What a day to join us. Art, I'm gonna begin with you. What's going on in the markets? Is this inflation-driven? Is this budget deficit-driven? Or is it both? What's taking priority right now as you see it? Yeah, I think that when you look at what this all started with was three things. I think we had a market that had a parabolic move from Thanksgiving to the 26th of January. We had a jobs report that showed a little whiff of wage-priced pressure, so we started to get concerned about inflation and will that make the Fed move a little too abruptly? And the third thing is that we've got a market that was pretty wound up in a trade that was short volatility. And when that changed and unwinding that trade certainly threw some gasoline on a fire that started. So we haven't had a crash in quite some time. Two years and they usually happen on a regular basis. We're having one right now.  The bottom of our screen. House passes the budget bill. They just passed it. As you were speaking, Art, taking a look at the futures moving slightly higher on the news, almost up 150 points for Dow futures at the moment. Of course, that index plus the S&P 500 and the Dow transports are in correction territory and the NASDAQ is awfully close. So is the Russell 2000. Melissa, are you worried that this correction continues and we get a bear market? Or do you think the worst is behind us? Well, good morning and thanks for having me. I'm not worried about a bear market because technically speaking, we're a very long way away from that. And I don't know why everyone is panicking. We ran up straight for 14 and a half months.  The only people that are down is if you bought in January 2nd. And if you bought in January 2nd, you should have been out into that rally up at the end of January because when you get in late, you got to get out early. So people should panic when they're down. So or if the trend has changed and although we had a drop off, it only happened very quickly which created people getting excited about it. But the trend has not changed in the market. The fundamentals look good, the technicals look good and 2018 still looks to be setting up like it could continue higher. But the problem is wait for now. If you're a trader, don't buy back into the market. Even if we rally today, don't get back in. Wait until the institution step back into the market and I'll tell you what that will look like. It will look like a gap up in the pre-market and it will close green and have a big green day on that day. We're not setting up for that yet. And people jumped in this week a couple of days ago when we had that rally and they shouldn't have jumped in. We broke that low yesterday. Doug, if member turnaround Tuesday, we also saw the lows on turnaround Tuesday although it ended nicely. If we hit those lows from Tuesday, does this selling just continue? Well, you're still about 2% above the 200 moving day average which is sort of like a support level. And it's interesting that even with all of this that we haven't hit that. Normally that's a support level that you think you'd hit during correction. But what's really interesting to me is that, if you think about last year being up about 20% plus depending on which index you're looking at.  We just went up so far so fast that we're giving back the gains that we made this year. And you're up a lot. So I think that you've got support a little bit below this. You could see a little bit of dip down but we're not gonna, I mean, this is a normal correction. We've had them in 2016, we had them in 2015. We've just forgotten what they look like because it's been a while. And they last about four months on average, historically speaking, if anybody wants to know out there. All right, let me ask you this. Jerome Powell, the new head of the Fed, I would not want to be him at the moment. What does he do with all of this? Because we have a rising rate environment. We have the Fed taking back the punch bowl, pulling back and paring down the stimulus and we have a stronger economy. What does he do? Well, it's interesting. So to the extent that you look at what's happened in the normal market correction, unless you didn't tell that becomes something that's economic, the Fed probably stays the course. Does that mean they're gonna raise rates in March? I don't think so. Does that mean they're gonna raise rates two times this year? Probably. Do they continue to pair down their balance sheet in the systemic way that they are? Yeah, I think that continues. But unless we tell this turns into something economic, I think the Fed stays the course. I don't think that talk of the Fed having to go four times this year is actually going to play out because I just don't think inflation is really rearing its head. If you look at the readings on inflation, they just haven't popped up. Yeah, all right, well, the next congressional, first testimony from Mr. Powell will be the end of the month, February 28th. Art, Melissa, Doug, thank you so much for bearing with us this morning and covering the breaking news for us. Thank you. Anytime. And once again, the breaking news happening in just a little bit.


What is colchicin? Hey guys, my name is Boris. I'm a physician assistant and I wanted to share some pants review with you. So these are the note cards that I personally use to study for the pants. I don't know how many videos are going to be in this series, but multiple. So let's just pick a card at random and review a little bit of material for the pants. What is colchicin? I'll give you five seconds to figure out the answer to what is colchicin? What is it used for? Okay. Colchicin is an anti-inflammatory, anti-uric acid drug. So why would you give somebody an anti-inflammatory and anti-uric acid drug? What painful condition is it caused by a buildup of uric acid crystals within a joint space? Gout. G-O-U-T gout. So colchicin is an anti-inflammatory, anti-uric acid drug used in the symptomatic management of gout. Bonus question for this one is what do the crystals for gout look like? What do uric acid crystals look like? Negatively bifaryngent. I forget if there's any other buzzwords, but they're basically little needles that you can see. And so they could be described as negatively bifaryngent. They could just show you a picture and they're these little needle thingies. That's going to be gout. As opposed to its similar presentation, however, very different pathology, pseudogout is calcium crystals and they're more like these, I think they're pentagonal or hexagonal type things, but they look nothing like gout crystals. So those two are going to be usually, if it's a multiple choice question, gout and pseudogout or negatively bifaryngent and then whatever describes the calcium crystals are going to be often in one question. So you should definitely note both. So whenever you learn a disease pathology treatment X, Y and Z, you should also know whatever is very similar to it because that's what's going to come as a choice on the multiple choice exam. So definitely study, you know, the pathology, but also anything and everything that's very similar to that pathology so that you know the exact small minute details that make a difference between each of these different things. So one more time. What is colchicine? Colchicine is an anti-inflammatory anti-uric acid medication given to people with acute episodes of gout.