Hi everybody That was a big all right, so let's start off with the questions We'll get to the bio stuff later everyone on three. I want to hear it yelled out one two three Thank you everyone ought to be getting that so this was actually trivia 100 from the 2006 qualifier round of caps of the flag They were very clever next year's question was was very difficult We had a hard time solving this So of course that and then the following year any guesses if you weren't already didn't already know Any guesses hack blank planet. Thank you. Yes Yes, we were all wondering next year. What would they have done if if they ran it this year Ken Shoddy did not end up Running running it this year, but it would have been interesting to see now Of course the point that this does bring home There is a lot of inside jokes if you came across this out of the blue It might have been a little bit more difficult not knowing sort of the prior history in hindsight It's stupid easy, but it helps to sort of be prepared That's really what this talk is about a lot of this is meant to be Sort of background the kind of the inside story the inside jokes how it runs what it is So when you're wandering through the capture the flag room, you know, it's going on if you want to participate You want to compete hopefully we can we can go some hints that cover that too So I'm sorry for texts. This is me and my computer at home right now. That's what I use It's not It's probably no surprise. I prefer Linux over windows these days though Steve Jobs takes more of my money The age old debates I got to go with the eye ever important ever ever important issue over verunder I'm sorry. That's the only way another big Debates where I fall on I'm afraid for the ruby lovers out there. I just like the python so No applause, but no booze. I'll stick with that In terms of Pepsi versus Coke Neither I'm sorry Thank you Probably more relevant though to this talk. I'm actually a member of this team. It's pronounced last place It has ridiculous etymology and meanings that we came up with after the fact actually We really just kind of came up with that I think and tried to fit it to it The team looks like this. That's me in the back. I Like my anonymity apparently now just that the shot that we got there's two guys not pictured I'm gonna do a brief run through the rest of the team members because hey We we want a couple years and I want to show off the guys that made my CTF experience so great This here is Plato probably the only the first last and only lawyer To ever win captured the flag and I'm not talking about like he had a JD This guy is a lawyer in his day job, which is pretty stinking sweet when you think about it Team captain Atlas if you were here for the last talk and you heard the kenshota guys talking They said Atlas was the one guy that came in the individual just got his mind blown came back and you know Really learned a huge amount. I mean four years ago. He really wasn't doing the security stuff all that much And now he's just phenomenally good. He really applied himself and threw himself into it led this team Put this team together built it and then we not only had a solo win But then we won two years in a row after that This guy right here is actually in the front row So make sure to pat him on the back in the way out I'm borrowing his black badges up front Mizzendo played the network sniffer played defense to kind of whatever talk a little bit more about the roles later But you'll notice that everybody out here had a specific function right and it kind of mattered You didn't just all show up and do random stuff Now we've got shrewkin who besides being a phenomenally good sys admin and kept the services going is the resident IRC troll It's in a very important role that everyone needs on their team to have somebody in IRC hanging out Keeping things lively when you're been up for 48 hours straight Fury or maybe his twin. He has an evil twin acting on defense here Doc Brown is our reverser actually the nops or us website that the Kinshoto guys mentioned There's a link to it later has is actually primarily doc who did a lot of the write-ups and he did a huge amount of work and put that together he took all our team wiki and notes from a lot of the past competitions put it up online and then we're for a guy over here who doesn't get Mentioned a whole lot also an extremely good reverser exploiter really need that skill set You don't have a poo shown in the slides here He was out for this particular picture was an ex-marine. So besides actually being you know an actual technical guy Was also physical security which you should never underestimate the aspect of physical security in a capture the flag And then also J rod was also not in this picture another good exploiter as for me Defense offense reversing. I've kind of done it all which I take it to mean I'm just not very good at any of them, but they keep letting me be on the team So I won't complain so Capture the flag itself It's been billed as a lot of things the ultimate hacking game ultimate legal hacking game Reverse engineering exploitation as the kinshoto guys were up here explaining last time This is really their response to in a world of web app security They wanted this to be binary exploitation reverse engineering hardcore stuff that in some ways is a hard skill set to develop these days Because a lot of the security research nowadays in the web world kind of misses out on this the binary history in the background And so they want to make this just you know lots and lots of binary fun DD tech Which is putting on the competition this year claims that they have the same focus and so Presumably right now going on is the beginning of capture the flag for for this year doing the same kind of thing very Binary exploitation based not a whole lot of command injection across that scripting SQL injection I miss it, but I get made fun of for being a web weenie so Timeline if you saw the last talk there were sort of a couple different eras or epochs of capture the flag the first five years it was put on basically by the goons the bofh and There was a lot of different formats. It was really a lot of kind of finding their place They didn't really know what the best format with the best structure for this event what this thing could become They just had a bunch of servers. You could bring your own server. You could just show up It was very chaotic Not particularly organized a lot of the winning tended to be winning kind of just because you gained the system or figured out Maximize it not so much because you had the best technical prowess and so there was there was some attempts to fix that The ghetto hackers came along and after you notice. I don't know if you can even see this slide sucks I'm sorry my timeline software not so good But the ghetto hackers won They're towards the end and you know, it's then they came and actually put it on This is and not uncommon theme that the people who have been winning for a little while I'll decide to go put it on because they think they know how to do it as well or better So the ghetto hackers came along and they really made a bunch of improvements and revelations Caesar's got a presentation you could pull up online a black guy. We spoke about how they design They brought in game theory. They brought in a lot of thought and planning and design They introduced the idea of a qualifier round the idea that before Defcon a couple months in advance You would have a qualifier round sort of figure out who the teams were then when people would show up Only those teams would participate in the capture the flag, which is why we have the a CTF or OCTF In parallel meant to sort of resurrect the old school free-for-all kind of anybody can show up and join which has you know advantages and being a bit more open but less structured less Kind of cutthroat less probably less technically demanding I hope none of the DCF or nine guys get mad at me for saying that but I think it's probably a safe bet Then of course we have Ken Shoto Ken Shoto has put it on the previous four years They've really become refined it They took the sort of architecture in the game design if again if you saw the last presentation You heard a lot about that and they took it to an art this year We have DD tech who nobody really knows they're still kind of keeping mum on who they are in their history They're obviously very familiar with capture the flag But don't sort of none of the major usual players that play have any idea who they are So it's kind of interesting to see the mystery man They they swear that this weekend their identities will be revealed to some sort, but we'll see how that goes So here's the qualifying round this year if you were to do the qualifying rounds It was June 5th 2300 Greenwich mean and it ran straight for 48 hours So one of the differences between the qualifying around the finals is that the qualifying round it just goes straight through So you sleep you don't sleep But however you choose to do it you need to sort of be putting your points in the whole time It is fun to sort of watch and figure out who is in what time zone based on when they flatline like they Well, they were sleeping then and they were awake and you can throw the teams. Here's the top 15 teams Depending on the the year the top seven nine teams will make it through the qualifying round and then join the last year's winners Yep You probably can't read the font. It's really small. Feel free to grab the slides online later Actually, the raw data is online as well You can go pull it up and animate the graph to your heart's content or play with it if you like But you'll see there's just there's a lot of ups and downs a lot of backs and forth There's a couple of strong players and so these teams It's important to know it's a Sun Zoo quote. I'm sure it's relevant. It's got to be It's a security talk. So we'll talking about knowing our enemies. It probably says something like that, right? So those those 10 teams that we had that qualified the 10 teams including last year's winners I'm gonna do a brief bio rundown because when you walk through like you see the team name If you're not sort of in the kind of click if you've not been following or reading or you don't know What's going on? You don't really know who's who what's what and so I'm more entertaining to know Ah that team's got a vengeance against that team and so and so so to give you a little bit of that sort of Baxter and who's what? We'll start with School of Root. They not only won last year, but they've also won in 2004 Are incredibly good. They crushed the competition last year. They were first place They actually didn't have to participate in the qualifiers this year They had a buy as previous year's winners chose two anyways and at the last minute they won It's uncertain How much they were holding back as the previous year's qualifiers they had an automatic buy into the finals So they didn't have to participate but they did and at the very very end they won it was sort of a Not arrogant but demonstrating that they could have been ahead earlier possibly but they chose not to they didn't want to impact The final or the qualifying round so that the winner of the qualifying round gets to choose the next question So if somebody who's already got a buy gets a question right before anybody else does they would impact the game And so it's sort of the sporting the gentlemanly thing to do if you have the buy to not influence the game And they were very good at that until the last few minutes of the game when they saw the one that nobody had solved just to show That they were that much ahead so it'll be interesting to see how much ahead they are They're led by Chris Eagle who is you You heard earlier in the other talk if you were here a what did I put binary ninja and pirate rolled into one? He's just wicked good They came up with that interpreted machine that he wrote in you know They their own brand new virtual machine that he reversed in a weekend and wrote an interpreter for this is just mind-boggling How good he is it's scary I Yeah, he's extremely good He leads a great team and then John Boss is the other team captain of school of route Who sort of heads up the organizational side of it because as we get into it the roles really matter You need not just good technical, but you need good organizational You need the other stuff Chris Eagle also released last year just after Capsule flag was over and he had crushed everyone finishing I might add with guitar here at the end They were shown off their head so far. It was they told everyone they didn't want to appear direct But they were a little bit ahead so they could take the time off It was a pretty good move for somebody so far ahead, but after it CTF was over. He released Collaborate a really cool IDA plug-in as a result of kind of the need of doing collaborative reverse engineering And so this is some of the some product that's come out of basically his experience And he also wrote a book that went along with that the software went along with so capture the flag I sort of made a difference Kind of beyond just this fun little game In that team awesome with second place in the qualifiers mostly first-timers I know a couple of guys on a team. It'll be interesting. They led the entire qualifiers But the very end so the question is how much was school of root letting them and how much were they not? So it'll also be interesting to see because they did well on qualifiers But teams that in the past them on qualifiers and not done well in the finals So watch the score It'll be interesting to see if these kind of top teams and the qualifiers are also the top teams as you go Through capture the flag sexy pandas have been around for a while They're also known as the pandas with gambas osu tatake sexy pandas wooby wooby pandas Sexy pondas and then the Latin name for a panda, which I'm not going to bother trying to pronounce they have Not only are sexy pandas as you can see they look like very sexy pandas done extremely well They participate a lot of international CTFs. They're mostly They're Spanish-speaking Jants and most of these folks we kind of know each other you get to see me after a year And they do extremely well They tend to have a strong start and then die off But if they can keep their the level of Profit up or you know scoring up they will be extremely dangerous And they were in third place again in the finals. So plus is actually the one of many Republic of Korea teams. There's a lot of South Koreans that Have been showing up in capture the flag just the last couple years doing extremely well I think there's there's at least like four teams that are either entirely or partially made up of folks from South Korea So there's a very strong showing. I think they like play starcraft like an Olympic sport over there so it's My guess is that may have something to do with it. It sounds like a pretty cool place for a bunch of hackers, so Primarily undergraduates from the University again, they were fourth to capture the flag shellfish has been around forever University of California Santa Barbara these guys are led by Giovanni Vigna and They put on their own capture the flag called the ICTF, which is a lot of fun It's a great capture the flag to participate You can do it remotely primarily for academic groups, but others can participate usually they won 2005 and have been around A lot of the qualifiers are extremely good very very nice folks song of freedom another one of the Korean folks a little bit quieter Don't know much about them then when asked for any kind of logo or bio their the response was no comments So it's not at all surprising that folks like their privacy. A lot of skaters dropping from raffle copters these guys Aside from the awesome name But you like my my logo I made that now here's the cool part That made that two hours that it took to do that worth it. Thank you except keynote can't loop So otherwise you would be continuously falling and coming back They have a much cooler logo on their shirts if you go nowadays I wish they had given that to me and I didn't have to make this but they were really interesting because back in 2007 three guys from the this team sort of put together a team to do the qualifiers and just blew everybody away And the qualifiers which is really pretty impressive because the qualifiers not only because that are 48 hours straight But have a widely diverse set of challenges and so to have just a small team do so well is extremely impressive And again, they're here the finals now So we'll see how they do they've also picked up a couple members And I think if you know these guys are friends of them or interested in a slot every now and then Teams are willing to pick up kind of Ronan and have them join their team if they're under eight people Which is usually the table limit So if you really are polite and careful and can demonstrate your skills somewhere you might consider asking I make no guarantees or promises Most folks tend to keep their teams the way they want it because you have no idea if it's a spy from another team or not When they come and has to join you so the routars are a French-speaking team originally just all French They're now French-speaking. I'm not even going to try to read the names It would not be pleasant But Hanzo's the team captain and again They have an the distinguished honor of having been in the finals the last three years in a row the only other two teams to do that being the pandas and School of Root so again, they're very very commonly here and very skilled Wow hacker I've been around for a couple years another one of the Korean teams and It's about all I know about that SAP eds showed up at the last minutes this year. They made it because of a couple of the teams dropping out and There are a group a combination of a couple other groups that I'm not going to read it Be in the slide notes if you want that kind of join together some friends online there from all over the place It's great to see a lot of internationally mixed teams not folks just that you know or friends locally But a couple of these teams are really draw from all over the place. They are also behind a really really awesome I've probably the best capture the flag right up ever came out this year It's a comic book style right up explaining how they solved one of these binary challenges and it was a lot of fun It's linked to in the slide notes. You can pull up that All right, I've talked enough. Let's go back to a challenge This one I'm gonna warn you is a little bit more difficult that said the rewards are that much greater I have a Frisbee valued at far far under a thousand dollars much closer to a dollar at Target, but I'm not saying That is it goes to the if you can't see it in the back It's the skull and crossbones with heart-shaped eyes. It's very sweet that goes to the whoever can answer the next question. So Take your time If you've already seen this, please don't answer. You're on your honor here. It's no fun if you've already sieved it Anybody got any ideas? We'll kind of talk through it a little bit. So x86 EBFE. Oh, we got a possible answer Your answer was beef Always a safe bet incorrect in this case. However, it's specifically because PPC instructions are never two bytes long Well, yeah, let me anyways. Yes incorrect Incorrect. So EBFE let's start talking through it is somebody tell me what EBFE is I heard somebody say but he didn't count Anybody else Jump dollar minus two. Thank you. So this will spin your CPU. It says jump to myself And again, this was an actual question during a capture the quite flag qualifiers granted You had online access and manuals and docs which helps and I'm asking you to do this from memory That's why it's worth a Frisbee So who knows their PPC instructions I'll even take the mnemonic Somebody want to give me a mnemonic for a PPC instruction that is equivalent of a jump negative two and x86 Do they have jumps in PPC code anybody? This is a hacker convention guys. Come on. We got a hand up. Well, yes It is a branch instead of jump. What might the argument to the branch be? You're kind of thinking along the right idea But maybe it's not based on the end, but the beginning of the instruction instead in which case it would be zero Oh, we have a winner Excellent. All right, you want to try to oh All right, thank you. I promise I won't drag it out next time so long. So game mechanics I mentioned there's two halves to this game right capture the flag has the qualifying round Which these some of these lightning questions are coming from the qualifying round if it seems intimidating Well, it is but I mean don't worry about that too much because you learn you figured out That's the whole point of it I've learned more doing capture the flag than I have preparing for it or getting ready for just in the competition because of The fun that you have it get folks that you enjoy doing stuff with and it doesn't matter where you Participate in the quals doing the quals is an absolute blast. There's no reason not to do it's over a weekend So even if you're working, I don't care you can fit your schedule usually and you can do it It's a lot of fun The skill set has to be a little bit different as I mentioned qualifiers runs for 48 hours straight. So It's more of a Jeopardy style board and I'll flip ahead to this real quick. I'll go back This was the one from this year DD tech actually added even more problems than normal So you've got one through 500 in six different categories So 30 different questions binaries challenges forensics all sorts of off the map the categories were Pursuits trivial crypto badness packet madness binary leetness potent punnables and forensics But ignore the categories because I think it was a packet one and the crypto and a crypto one and the binary one That the sort of categories are kind of general rules of thumb rather than a hard and fixed thing generally speaking These were just there was binaries. There was network captures You were doing all sorts of interesting bizarre stuff. The write-ups for these are all online If you go into the links at the end don't cheat though It's kind of like playing a video game and looking up the answers are like that's no fun You don't want to ruin ruin it for you try it yourself do the problems first and then see see what you can learn first And then you know use the help only if you need it. So the Qualifying around like I said, it's 48 hours straight. It's independent. It's remote You can be anywhere when you're running the capture the flag you log into the server you get the account 200 plus teams Participate early 200 plus teams scored points certainly somewhere ghost teams or duplicate teams or others But it's definitely a lot of people like I said, there's no reason not to it's a lot of fun you don't have to even Play-to-win you can play just to get all the questions and have fun and enjoy it There's there's certainly nothing wrong with that The winner of the qualifying round like I said the top seven to nine teams depending on how many are allowed in depending on the year Gets into the gets into the finals here at cap at Defcon the CTF the hours I say 10 10 6 Friday to Saturday is Friday to Sunday at Defcon for the final the main capture the flag Nah, that can change like I said today. They hadn't started. I don't think one when I go into the speaker room So things were a little slow to kick off, but that's to be expected with a new team doing it so That's flexible take it with a grain of salt that the interesting thing is though Even though the capture flag hours end the work does not so the teams will go up to the hotel room They go up and they'll keep working on the stuff because you've got the miners You've got the server image to work on afterwards. So Q&A qualifiers finals is an actual live server It's defending attacking live other people and this is sort of the more interesting piece This is where everyone's like well, I'm just gonna bring my server that's X or Y I'm gonna do this and so before you kind of get into that it helps to understand How it's set up. Oh, right the the spoils you get the entry to CTF if you get in the top and the qualifiers the winning team With the actual capture the flag gets a black badge. Here's the two that our team got from a couple years ago The uber badge of course the infamous Defcon uber badge. It's admission for life. It's street credit It's you get a leather jacket you get dates with people of the opposite sex You didn't you didn't get that with oh, we're both married, so I guess we didn't do that either But I thought that was a part of it supposed to be part of it Oh well So at the main event though did my voice crack. I'm not 16. I don't like look like it still but I'm not At the main events every team gets their own identical server So like I said in years past things were more chaotic everything was a little bit random in this year You see if you saw the topology last time every team gets a VM. It's snapshot. You're in a jail It's been free BSD. It was Solaris one year. That was painful. It's been back to free BSD. I have no idea what they're new I think it was probably free as everybody. It's free BSD 7 to interesting. They've upped the version this year So right now the teams in there are doing free BSD 7 to playing with with some binaries You are usually the network upstream now a lot of this is sort of general Generalities you have to be very prepared for changing things on the fly the rules will change every year In fact, the rules this year if you go into the capture the flag room grab one of these guys It's got the updated rules. They're very different from the rules. I'm going to describe to you from years past Mostly the same style of gameplay, but the scoring system is a little bit different There's no longer breakthrough points for the first team that solves a problem. It's a zero sum game There's only the same total and it just shifts based on percentages in terms of who's done what So there's some of these differences will be very interesting to see how that that affects the gameplay Because it's always about kind of gaming the system, right? You always want to have the optimum plan of attack You want to be prepared to do a lot of things you've got flags Hence the capture the flag part, right? These flags can be anything typically though Yeah, they've been base 64 strings of a fixed length and so you can recognize them There's a lot of it that goes it goes on again behind the scenes in terms You have to track who stole what flag from whom because you have to know when they got it where they got it from What service so when you get points if you do a breakthrough point You have to kind of figure out all the stuff if you're tracking zero sum game You have to try so all that is very carefully set up and running a CTF is way harder than participating And I'm very glad to have participated and no desire to run it if I can help it because that would be a lot of work But stealing these flags and then submitting them is the way you actually get your points The other way you get points or rather you keep your points is your SLA So every team is required to keep their services up I can have perfect security when I unplug my server It doesn't help me much at actually maintaining a service and so to keep people from doing that sort of taking the Nuke approach your points are all some total all your points for me They're stealing a key from overriding your over a key under somebody else's keys all of that is Multiplied by your SLA. So if you're up for 90% of the service checks you make you get 90% of whatever the bucket of points you got SLA matters. This is sort of the biggest. It's not like an inside trick or secret This is just really really important. Keep your services up If you've got defensive techniques and tricks that you think of how you can Rearrange the server great test them very carefully never ever fail a service check because that will screw your score very very quickly So roles Thank you a Successful CTF team has a lot of different roles. I mentioned earlier. Yeah, it's pretty lame. I mentioned earlier a lot of people a Lot of people I think they're just gonna be to reverse engineering and that's like all it's gonna take I mentioned my team has a bunch of different skill sets. You really have to have the complete sort of picture You've got to have a leader. You need somebody just to organize the team I mentioned Atlas and and our team is an excellent leader Yeah, the herding cats This should not be your best technical person This should not be the guy who's the best reverser should not be the guy who's the best exploiter because that's a waste of his talents It needs to be somebody who's organizationally good who can motivate a contract who can keep communication going It sounds stupid and silly to say like teamwork is really important and really mad It really is if you don't get your people working together, you're never gonna win your network administrator It's the guy who's not only setting up your firewall But also monitoring the network and maybe a split role teams can obviously implement this differently But all these skills that are gonna be used He's the guy who's watching all the attacks that come against you He needs to be working with the defense to let them know new attacks needs to be working with their verses to let Them know when he sees a new attack to help them to figure out do to others you've got all work together Of course, you've got the reversing and exploitation. I didn't Google image search exploitation. Sorry decided that would be a bad idea This is the main skill set it really is like I said, this is a binary Exploitation so if you want to do this you've got to have somebody on your team You may have that one rock star who's your good exploiter and that's okay because you need all the skill sets But somebody's got to do this you need your sys admin Somebody's got to keep your services up that SLA. I told you is is crucially important Keep your system running and you don't know what you're gonna get you may get slurs You may get freebies you may get something bizarre and you need somebody with a lot of experience and all this stuff So defender is similar to sys admin Plays us it looks like the same. He's on the server. He's monitoring is keeping out The difference though is the defender's goal is purely to frustrate the opposition His goal is to think of all the nice. No all the not nice things you can do to your people You want to be dropping long live connections? You want to be moving binaries around that the scorebot checker won't use when it logs in Anytime when you can figure out a behavior that's definitely a human and not a bot you want to kill it You want to be actively involved in maintaining the security of your server and this would be especially interesting as you know The zero-sum game of scoring how that impacts the number of points when defense matters more in years past It's almost been easier to ignore defense. You were better off not doing anything on defense to keep that SLA up But we'll see if that changes a Gopher or go furs are critically important do not underestimate How nice it is to have somebody to get you food because hackers do not live on caffeine alone I'm afraid to say for maybe 24 to 48 hours, but beyond that you need a little bit more than I Said earlier you have to have teamwork My team has never been the best at reversing never been the best at exploitation never been the best at dirty trick Okay, we were pretty good at dirty tricks. We'll get to that next But we weren't the best in just about any area. We worked together really well Team size is kind of a controversial topic School of route the guys that won last year have a big team not everyone is necessarily good or it Involved in the same degrees But in some ways a big team can hurt you you need people coordinating working together more than you need small It more than you need you know Just a lot of people to throw different problems that said you probably can't win with like a five-person team no matter How good those five people are because there's something like 20 binaries you get at the start of the game and you're doing the Network monitoring the sysad me you're doing so all these are the roles that you've just got to have a number of people So a quick word on sort of CTF etiquette I'm a really nice guy I promise I am but I have been rather rude to people and asked them to leave the table because You don't know if they're a spy or not. I've since buys against other teams I would not be surprised and I know for a fact other teams have done it to us too So if somebody says hey, I don't want you watching my screen They don't take it personally when you're in the room and everyone is going on it gets pretty competitive So just as a word of warning you don't shoulder surf these guys or try to see you're doing I know it's really interesting That's why I love to do it. But like I said, just just don't take it the wrong way when they ask you to leave Alright another lightning round. It's a little x86 instruction heavy So who's got their intel manual on a on the laptop and wants to pull it out? I'll settle for the mnemonic. You don't have to assemble it in your head this time implement the following in one instruction What does this look like? I don't have a frisbee for this though. So maybe we'll Give you a water cup. It's not It's not it's the tricky part is it's it's it's not an in-app description of what's going on with clothes I guess would say but not quite it. There's there's so what will be yeah What will be put into ebx at the end of this? So the interesting thing is so we're shifting one by ecx and ending it so what's the only possible results? Can I have? 14 bits in ebx At the end of this I cannot how many bits could I have an ebx at the end of this? I can only have one bit There will only ever be one bit at a time in ebx at the end of this We're gonna skip this. It's not interesting. It's not all like this either. I like this stuff This is a bit scan right so it's actually a nice long C loop that comes down to just hey I look for the last one and put it in this other register. Isn't that neat? Okay now the fun stories This is where I hope I don't burn bridges It is a hacking competition folks. Don't be surprised if there are some hacking involved in this competition Let's let's all say it together again security is only as strong as The weakest link excellent. So what's the weakest link? Humans obviously but specifically what is it that we do or related to our usage of systems? It's if you want to hack a system. What's just the simplest stupidest way in besides asking? Let's do it physical security. Yes, come on What's under the keyboard Their password. Thank you. Yes your password almost always one of the weakest links of the passwords So there's been different ways to get root access to your server at the beginning of the CTF when you actually come in And you get access to your VM before everybody else does it One of the ways was that you got a text file and it's in the root of your system that had your password It was your database password. It was the password you logged into the score server with and it was with your root password Most teams managed to get this right and change the root password It's a rather important step in securing your box changing your password from one that someone else can read right Not everybody does School of Root actually owned somebody that last year and I got to give them credit because they could have literally owned every service Immediately because they had roots somebody else's box and they chose not to that was a very gracious thing to do They have a lot of self-control. Let's just say that I'm not sure I would have been so strong But one of the things you could do with this this password once you've changed it What good is it right? I can log into the score service you well, that's nice. I can see your score What else well? I can change your overwrite key one of the little buttons in the score service has changed my Overwrite key where you can change the key that you use to overwrite other people's flags to indicate you were the one that Exploded that service and overwrote their flag right that's kind of handy thing only one overwrite key can be active at a time If I click that button your scripts must be updated or you will not get any overwrite points So for a little while on Saturday back in defcon 15 school of roots overwrites went like this And then they noticed and figured someone hit the button And so then it went back up again and 50 minutes later I pushed the button again and another 45 minutes went by no one noticed and it flatlined again And then they noticed and I did again and so for about like three to four hours They were denied a bunch of overwrites because mainly they weren't paying attention Primarily because they didn't protect this password, but also it was like the little things you really got to get this right You got to protect your passwords. You got to remember. What could I do that's nasty with the score server? To be fair we asked before we did this now one of the other things that's interesting Like I said, they don't like the web weenies in this they like the binary exploitation there's usually one or two web services just to toss a bone here and there But one of the other teams had a really clever idea We were stealing people's passwords that they'd left unprotected the other team set up their web services that they were running with Cross-site request forgery attacks So if you just visited their web service your browser would go to the score server on your account and reset your overwrite token And I have no idea if this worked This may have been successful against half the teams that were there and we'll never know because that's not the kind of thing You can find out you have to go back and look through the grass for some more flat lines and overwrites So sometimes even though web security isn't really designed to be part of it You can kind of make it part one of my favorites is last year the badge Hacking that occurred is who is here for the awards ceremony last year and heard what the badges Or not you're all either ashamed to admit it or you weren't a whole lot here Well, the the winning the winning badge was you could wave and do a password and you plugged it in it was it was cute But the second place bad that was my favorite.  Oh, yeah And they clipped a resistor so these things work from like way far away They just be walking around the conference with their badges transmitting this code and so you see laptops popping it out. There's There's a recording last year these DV cams they were using where one of the Macs suddenly got a little antsy and You after your witch talk it is But if you if you go through the web video archives one of the recordings gets a little Hard to watch because the camera suddenly shut off. I don't know why One of the teams and I got feel a little bad for the guy in the wild hackers who had an HP laptop because this his computer was Unusable for most of Saturday. There was a couple guys who had these hacked badges just dying with this guy So I feel a little bad But again, it goes in the capture the fly it goes in dirty tricks it goes into cool hacking the moral The story is you better shut off every interface on your laptop go into your bios and disable your Wi-Fi Don't just do it in the OS tape Electrical tape over you could actually put your finger over with the other badge I was took it through in the laptop centers. I mean you better shut off everything you can To do it so I guess the essence of judo of which I know nothing But I've heard is using your opponent's strength against themselves, right?  It was unbelievable. It was actually I think Saturday this at Sunday morning I think if I'm remembering correctly was actually Saturday morning It was the first night the competition Chris Eagle came back and he had solved it This is just ridiculous this hard problem built Basically for him he had solved Except he left it world readable So we were having shells in their boxes. We had his patch binary. We have no idea what the vulnerability was I haven't gone back and looked at it It was a huge amount of changes he had made to it his patch copy was secure And I don't know how it worked But I know I was secure too because I was running his copy from his machine that he left what readable so again Keep your keep keep track of those little things They will get you one of the almost ones that would have been really cool Was a couple years ago when you actually had dial tone submission the keys were all numeric And you actually submitted them on a DTMF which was really fun When everyone was scrambling to fries for wind modems and voice modems trying to be able to script the stuff because no one Wanted to spend dialing thousands of numbers into the phone system all day to the phone They gave you but one team actually figured out and I love to find out how nobody that talked to remembered Find out which team it was but these guys actually got to the admin interface of the VoIP adapter And if they had managed to like you know redirect traffic and get other people's keys to them and then we submit it That would have been the ultimate that would have been a great hack as it was They only were able to change the IP address on a causal denial of service that had to be fixed and then you know Eventually got resolved, but they did get breakthrough points So even though it was a kind of you know hack that was against the infrastructure Which is often against the rules the moral of story is if it's a cool hack if it's a good hack It's probably gonna be worth some points the other part is again if you ask if you go to the organizers They'll usually let you do whatever it is because they like cool hacks, too. They want to see this stuff go on So this year I wonder if somebody from DD tech is in here probably not they're sure very busy with that But the qualifiers they put on this year had a problem. It was forensics 200 It was meant to be solved by getting a VIM swap file So you had to actually get the swap file and figure out the changes to the file and the original file source to figure Out some changes there was another problem that was solvable the VIM swap file It was not meant to be solvable with VIM swap file. They were fixing a web service and Editing it on the server live with VI and someone from one of the teams happened to go grab The swap file get the source code to the prop it makes it much easier when you have the source to a web service for some reason I just it's strange how that's happened. So again, it's not always the way you expect it to be solved that it gets solved So there's a lot of ways you could ruin the competition we know this denial of service attacks are generally just disallowed It's just not fun. I know it's a hacking competition and if it's clever, it's worth it do it You get points ask always ask because you'll get the points, but just play nice That's all I ask once someone was ejected once for trying to cut someone else's network cable with a Leatherman and that's just He was totally busted too Collusion is another area by the way that you could really just make this not fun Thankfully it doesn't look like it's happened yet, but you could very easily collude swap keys with somebody else to make It look like you got a service you didn't so I've just told you now how to ruin CTF. Please don't please don't do that That would that would not be fun. So Great, you want to actually do this right? What do you need to learn to actually get these skills to practice? What's the best way to learn to practice not a problem? You just need to learn a couple of skills once you've mastered those You're set. You just it's a small set. You'd be just fine There's a there's some links. There's a lot of sites online Go back to Atlas's presentation from a prior CTF He talks about from script kitty to hacker and three sleepless nights It was really longer than three nights, but it was it was a good title But it really was over the course of you know Just this couple of month period from the qualifiers from that year on to the finals where he just Through himself into this and got really really good He instantly got job offers from this afterwards too because this turns out to be a handy real-world skill set Who to thunk it reverse engineering exploitation go figure So you can't do this. It's really about putting the effort putting the time in in terms of tools and techniques There really is no right answer.  Oh, look now. They're requiring that we use SOPA or XML to submit our You know to submit our keys and so you've got to have some sort of familiarity to do this stuff There's a lot of changes that get thrown in the mix to do this if you're really really good I've seen the C is my script C is my scripting language shirt if you're that good more power to you There are people that are that good to see but generally speaking Having a number of people just really good to kind of the quick and re-descripting is really gonna be important If you're not good at reverse engineering, you won't win It's hard to score points if you can't actually exploit stuff And there's always a few there are cool little gotchas committed injection other little things But generally speaking you got a crack a debugger You got a crack Ida and you've got to actually sit down and reverse this stuff And again, this is can be tedious can be time-consuming can be a difficult skill to learn But it's totally worth it again Not everybody in the team has to do this because there's a lot of skill sets go back to those other roles if you're the defense guy You're the system and guy you're the network guy you these are vital rental roles But you're just never gonna get points unless you can can pull up Ida and do this although as shown in the last talk Ida is very often easily fooled and easily broken So a couple of web links a lot of the resources for this the first link is capture dot the flaw egg I wish that was easier to pronounce I'm sorry. It's captured the flag with a period between capture and the and the FL on the AG I was just Trying to be too clever apparently that's gonna be where these slides are up at that's gonna be where it's just a whole Much of other stuff going up there So if you are interested in capture the flag that will have everything you're gonna need to know links to all other Right-ups from all the other teams will have links to binaries will have images from capture the flag years past So you can play with these binaries yourself Right now it just has the presentation, but very shortly Aka when they get back on a network. I trust it will be getting more stuff Did you take that biz the guys that are running the show now? I'm really looking forward to seeing what they come up with this year and hopefully the contest is going live now And we can all walk through and watch the score as you what's going on again Make sure you read those updated scores and try to figure out how would you find loopholes? How would you play? What's the strategy teams are using walk around and watch from a distance in front of the screens to get a Feel of what the teams are doing Knops are us was mentioned in the last talk to that's the one that has all the write-ups Knops are us has write-ups for two or three years worth of qualifiers and Finals so you can find lots and lots of good stuff up there if you get stumped if you want to go see what types of questions Reliable get into next year's qualifiers go back and see that shall we play a game is done in the style of War games. Yeah, that's the thing With a little backdoor interface to a whopper and you can play video play games with it But it has write-ups for just this year's qualifying round so you can see those there's a Couple of the links that the one I want to do in a highlight is our snake Oh, I wonder if he's actually here to this weekend Has a great blog post that was called hacking with all the jail time that turned into this great reference because everybody linked Their favorite caps online capture the flag games There's a huge amount of sites where you can go to do web security testing capture the flag testing of a lot of Other types of capture the flags to you can practice all this stuff again practice the hacking with all the jail time It's a great resource as well. So if you want to pick three books to write I hope Chris Eagle doesn't hate me for all the dirty tricks. I've pulled on him And so I hopefully I'll try to pimp his book It is the Bible for Ida reverse engineering Chris Eagle I can mention the captain of school of root and just a phenomenal exploiter Reverser was the author that's released the book last year This is going to be like the standard one reference book for Ida for the foreseeable future. It's extremely good a couple others That are very useful as well our hacking art of exploitation and show coders handbook because again This is a binary exploitation kind of skill set so fine print Creative commons licensed all the images you pulled the slide notes were from flicker integrative commons And that's about that questions will be off in the other room. Thank you all for coming out


We have to understand exactly the problems that are in the area. So, if you want in this big design space, it's just one specific protocol. How can we make it better? Which means faster while keeping it secure. In order to be able to do that, we have to start from basic principles. And the good thing is that computer science right now is quite mature. In terms of being able to precise, define problems and their properties. It's just that, and I'm talking and I'm saying this both based on my own research and in that interaction with people that are actually working in computer science and trying to formalize problems. Bitcoin is actually quite interesting to formalize because it's even from a completely theoretical point of view, it looks at problems that we looked at for many years and it looks at them from a different point of view. So, this by itself is fascinating from also a theory point of view, not just a sort of real world practical point of view. So, yeah, I would expect like a lot of very nice research also in theory to be motivated by what Bitcoin does. And that would be like in game theory, that would be like in distributed systems and in cryptography. My hope is that Greece would be a tremendous place to actually try cryptocurrencies. That would be, but I have to say also at the same time that a lot of a lot of people in Greece, they're still like quite behind from adopting or be willing to experiment. I mean, and it's sad to say that in many aspects like Greek society is still quite conservative and I really do hope that actually with events like that that do happen in Greece and they bring like a lot of people that are at the cutting edge of research in Bitcoin, like we will inseminate the area and the students that are attending like will actually be the sort of the carriers of these new ideas like in Greek society.


So, let us start what we are discussing last time. So, last class we just broadly discussed about the idea for lower bound proof, right? We stated that every for any stochastic K arm bandit where the rewards are either bounded or some sigma sub Gaussian, we said that the min max regret has to scale like some constant times square root Tk. And last time we just discussed that idea, let us now try to make that formal in today's class. So, recall that at the end of the last class, I had told one result which said that for any measure P and this is greater than what? So, we are going to crucially exploit this result in doing this. For the proof of the result, I need slight notation to make, so let me define those notations. So, there is an environment, there is a learner.  So, what is that I mean?  X1, X2, XT, these are random samples you have observed by playing a corresponding arm. At A1, A2, these are the arms you have pulled. And maybe like this arm pull itself is random, because this arm pull is going to be induced by what you have observed so far. So, now, if you are going to look at the distribution of this quantity, which consists of actions and this distribution on this will be induced by the environment and your corresponding policy. So, let me, nu is your policy, sorry nu is your environment and pi is your policy. In this sequence, we are going to observe by interacting by the interaction between the learner and the environment. This is going to be randomly distributed and this distribution will be induced by this quantity is nu and pi. Let me call that induced distribution to be nu pi, is that okay? So, this quantity has to be randomly, random which is has to be induced by nu and pi, right? Whatever it is, let us call this. Now, we also know this, right? How to write this? For example, nu pi of a particular realization, let us call this A1 X1 A2 X2 all the way up to A capital T XT. How is this probability is going to be defined as? It is going to be product of and then what and then P of A T of XT. This is the policy and this is the probability of observing that sample XT when you are going to play arm A T. So, this P A T XT is coming from your environment.  So, it has introduced this. Right now, we are kind of assume that the same throughout, right? If you are going to every time you are going to play this action A T, your sample is going to be coming from the same distribution. So, that is where that underlying environment is there. Now, we want to understand. Now, similarly, let us say there is another environment. Let me call it as nu prime that will under the same policy pi that nu environment will also induce another distribution which I am going to call it as P nu prime pi. So, that is going to be what again that is A 1 X 1 A 2 X 2 A T XT. This is everything is going to remain only thing it changes is here pi XT because my environment has changed. Our first claim is a lemma DPV. So, since I am going to fix a policy pi right, I am just going to and only my environment I have changed in this and this is my E prime. So, I have fixed a policy pi and now I am considering two environments one is nu and another is nu prime. So, I am just denoting by them and now I am going to consider the divergence between these two quantities. We are just going to argue that this divergence is is going to be nothing, but and nu prime here is another distribution which is P i prime. And what is this expectation here? This expectation is taken with respect to the underlying environment mu whatever that distribution that environment mu indices this expectation is with respect to that environment. Now, why this is true? See now, when I am looking at this induced distribution P nu pi right, here this quantity is a 1, a 2, a t these are nothing, but actions right. These actions are coming from one of the k actions, but this x 1, x 2, x t these are the reward samples correspondingly coming from different arms, but these are continuous valued ok. So, here I am looking on this distribution nu pi on this quantity where some components can be continuous right. So, this distribution is defined on a vector where some components can be continuous and some components are discrete. So, for this I have to define appropriate divergence between them. What is that? So, that divergence whatever it is we have already defined for a continuous random variable right. How we have defined the divergence between two continuous distributions in terms of I wrote it in the last class, if one distribution is absolutely continuous with the other then we wrote it in terms of the integral ok. So, now that integral has this term log d P v d P v. So, this has meaning like what P mean by d P v this is I also said in the last class this is random decoding derivative, but let us not get into that we will just think it as like just P by P prime I mean P nu divided by P nu prime and now calculated at the corresponding points. Let us compute this quantity I mean just imagine that these are nothing, but the distribution value taken by P nu at this quantity divided by P nu hat taken at this quantity that is the meaning of this. And now if I just plug in these two quantities here right this is nothing, but d nu is nothing, but d nu pi this quantity divided by d nu prime is nothing, but this three quantities. If you take the log there and then simplify what we are going to simply get is t equals to 1 on capital T log P of A t by x t divided by P of t prime divided by x t. The factor corresponding to the policy cancel out because I am using the same policy in both the bandit environment ok. Now, this is for one realization if I look at the expected value of this quantity. Now, expectation with respect to what my nu the underlying environment nu this is going to be nothing, but expectation of this t equals to quantity log of T A t x t divided by P prime A t x t. But this quantity here this is nothing, but I am taking expectation with respect to the distribution that is induced by environment nu. This is exactly equals to this quantity in the numerator is nothing, exactly equals to the divergence between nu by T nu hat. So, what we have defined the divergence between two quantities if you recall I defined it as and then we have defined it as what B of P omega right. So, this this is this expectation is nothing, but exactly that, but with these two distribution P nu and P nu prime. So, that is why this is divergence and this now divergence is nothing, but this quantity expectation of summation of the logarithms of these two ratios. Now, in this both x t is the random quantity A t is the random quantity ok. Now, what you could do is this in this case now I am going to write this expectation over two parts. The first one I am going to condition on the A t and then I am going to take the expectation over the other part. So, what I will do is this expectation is this expectation of this one t equals to 1 to t g 1 A t. Can I do like this? This expectation I can write it in this I can do it over two steps. First I conditioning on A t and then find it expectation and then I will take the expectation of that quantity again. What is that? . This is same this is nu again nu whatever this nu is going to induce the distribution on this underlying environment. It does not make much difference right like let us see this if I just to do. So, this anyway there are only finitely many terms right. I can also write it as summation t equals to 1 to t expectation of nu over this log and then you can you can write this as this expectation over here. So, in this case you are only conditioning each term, but yeah this is fine. So, for every quantity we are conditioning that A t part there. Earlier also whatever you did you could have just taken that inside that summation inside ok. Now what I am doing conditioned on this A t I am looking for expectation of this quantity. Once I condition A t what is the randomness there? Only x t and what is x t? Now conditioned on A t these x t's are coming from that particular arm right. Now what I am doing? Now what is the randomness here? It is only going to be corresponding the randomness is due to the corresponding arm right whatever the arm you are conditioned upon. Now these are this is corresponding to the distribution of that arm under nu and this one is the corresponding distribution for the same arm under this nu arm nu prime. And now you are doing the expectation with respect to nu that is with p distribution p. What is this quantity is going to be? This quantity is going to be nothing but divergence between the distribution corresponding to arm A in the first environment and the distribution corresponding to another arm the same arm in the other environment right. So, this is nothing but. So, now this distributions are completely absorbed the randomness in the samples x t. Now this nu is only talking about how is this distribution over now it only remains. So, this quantity are completely absorbed that distribution in the reward samples and now this expectation is only over now the randomness in the arms pool 80 ok. Now another step. So, now I am just going to simply rewrite this in this fashion. Let me know if it is correct ok. So, now initially it was this is over some going from all rounds. Now I am splitting them in over different arms. Now first I am taking a summation of k equals to 1 to k and then in this summation I am only looking for those terms which when 80 equals to i and then I am going to do it for each arm. So, then this sum should be equals to the same as this sum right 80 equals to ks. I am just looking at let us fix 80 to be 1 arm then look at the divergence with respect to the distributions in the two distributions corresponding to that arm and then do it over all arms and I did it by bringing in that indicated term there inside the summation over t equals to 1 to infinity. Now we are done whatever we want to do right. Now we have just now now k equals to 1 to k keep the outer summation just like that and if you just take the inner summation inside now you are looking for a particular arm k yeah pk, but now then you are going to add the number of pulls of that arm right and what is that going to be? That going to be exactly number of pulls of that arm. So, this is now going to be expected pulls of n k t times divergence between pk and pk prime and that is what our claim was. That is what you have basically expressed through this lemma is the divergence between the induced the distributions in the two environment by my policy can be expressed decomposed into the corresponding divergence of the individual arms distributions in this fashion ok. So, now we are we have this indicator right k going from 1 to infinity. So, I have already said a to be k. So, now take that particular k let us say that at equals to k. So, if you just take now this is independent of t right then what remains is summation of this indicators with that expectation term here yes. So, this term basically I just skip this this term came because there is an expectation of when I put at equals to k this term was of a time. Now, whatever this total number of rounds you have going to play that particular arm or t p is there is nothing, but the expected number of pulls of that arm under this environment nu ok fine. So, this is one result now the rest of it once we have established it now rest of the things is going to follow just exactly the same way we discussed in the previous class. We are going to construct two distribution p and p prime such that they differ at only one point, but still they have a different optimal arms and then we are going to invoke our this results on this setup and we will be able to show that ok. Just to recall what we wanted to show we wanted to show that. So, we assume let k equals to greater than 1 and number of rounds is t is greater than k minus 1 then we said there exist a policy pi. Now, we said that for all policy pi for all pi there exist what we are going to show is for all pi there exist a mean vector mu which is such that what is nu mu this nu mu is equals to this this is going to be 1 upon 27 square root k minus 1 prime stick. What is nu mu here? The nu mu we are nothing, but an enuronment whose distributions have this means coming from this mean vector mu. So, this mu is a vector with k components each quantity coming from 0 1 each component coming from 0 1 that is why in that there exist a such mu vector from which you can define an enuronment on which your regret is going to be at least this. And now once we have this I have just demonstrated exist on such a policy right that means I can come up with a I have a class of enuronment over which your algorithm is going to make a mistake. I have. So, what I am saying is through this setup I will be able to come up with one mean vector that means one enuronment for which for any policy we can its minimax regret is going to be at least this much that means there exist a class of stochastic bandits right or environment such that on that this policy pi is going to incur at least this much of regret. We have just demonstrated like existence of 1 pi we are going to do that that means there exist a class such that this holds on that class your algorithm is going to incur at least this much of regret or this implies basically what this implies is basically RT star of epsilon k is going to be on. So, this mu k is that of all enuronments whose mean parameters are going to be in the interval 0 1 ok. So, now earlier we have stated this result saying that this holds for any bounded enuronment where the rewards are taking in a particular interval or sub Gaussian any sigma sub Gaussian right, but now the result we are going to show is what we are going to restrict ourselves to Gaussian distributions because we know that Gaussian distributions are also sub Gaussian ok. And for that we are going to show that as long as you can construct a Gaussian distribution whose mean vectors. So, where all the arms have a Gaussian distribution and the mean vectors are lying in the interval 0 1 I wish if we can construct and we are going to show that such an enuronment with appropriately defined mu values is going to satisfy this result.


Hi I'm Adam Sontek. I'm a developer at Boku, and I'm the developer Developer Relations Lead of the jQuery Foundation, and I'm here today to talk to you about a subject that's near and dear to my heart The caching of jQuery and DOM selections in two variables I'm too often. I see people just making insane jQuery selections and then repeating them over and over again or Sort of using the DOM as like a database that they look out create these complex selector strings pulling things together dynamically and It's expensive and it's ugly and it's hard to talk about so Today I want to talk about why caching selectors is Useful and can help make you a better programmer So let's take a look at a typical example. Let's say we had an image tag and There's a chipmunk in it now the typical Okay, I want to go change the source of this to be a different chipmunk jQuery approaches. All right, go grab it and Now change it to other chipmunk and then I later on it's someone else in the app Oh, I've got a add a border to it. So it's been activated somehow. So let's Activate it Magic hey, cool What's wrong with this? Why am I going and querying the DOM again? Exactly that's what's wrong with that. I'm going and querying the DOM again if I was using traditional native DOM methods like Document get element by D and I wanted to go get the foo element I do their foo equals document, get element, and if I wanted to do more stuff to it I obviously would be using a variable because because document get element by ID is so much typing that I can barely stand to write it twice So we got another chipmunk.jpeg and we're setting it with the native DOM And then if I wanted to set the class name, I would do it again Anyhow now this obviously still applies with more complex selections whether with jQuery or with diet native DOM methods so if we were looking at like a Nav kind of element here, and we had a bunch of animals in that and I wanted to go get the active one maybe I would go do Nav and then if I wanted to do something I Would and then let's say I wanted to go activate the next one. I would maybe keep on chaining So I get this nice long jQuery chain wahoo so What I'm here to encourage you to do is Save almost all your collections into variables or in onto objects or somewhere where they're more meaningful so What I'm proposing is their Active items and then when I want to go work with this afterwards. I'm gonna go do active items Now some people are actually surprised by the fact that this works But really jQuery is no different than any other function call It returns what it returns and you can then save that into a variable. So in the same way that if I have a String and I call a method on it and I have two variables and I have two variables and it keeps on working So it works the same with jQuery another mistake that I see people make when they're Getting used to doing this is they kind of think that jQuery is like a blanket that you always need to wrap things in in order to be able to call more jQuery methods So they'll have Rata Saved it a reference to a collection But then if they want to go do something they'll read jQuery it because you know better safe than sorry as it turns out That's not really true. So if you do this Is absolutely redundant You may also notice that all these variables that I'm creating where I save references to jQuery objects Are preceded with a dollar sign? This is just a convention that a lot of people follow in order to denote that the variable refers to a jQuery collection and you can expect all of the Methods that you're used to on a jQuery collection add class remove class siblings You animate the whole kit and caboodle Some people really like this and other people really hate this It's called Referring to it as Hungarian notation, which is the practice of naming your variables with a prefix that denotes the type This is it works really well for this presentation It works well for examples, but you can feel free to use it or not. It doesn't really matter So a lot of people say well my application seems totally fine and it seems totally fast Why should I bother start caching these selectors as long as I'm not As long as I'm doing fast selections, and I'm not doing making use of proprietary jQuery selectors like first it thing oh Or a check box Where I'm using Any sort of mod selectors that are supported by query selector all then I should be fine everything's fast. It's no big deal and Others if you may have heard that Selectors are like really really really slow and the main reason your app is having any Sluggishness is because you must have slow jQuery selector. So here's the fastest jQuery selector to use that era is sort of ending and As long as you're not repeatedly doing selections over and over again selections can tend to be pretty fast however, a lot of people fall into this trap of Repeatedly making bad selections.  This is the kind of thing that makes sad faces and Crying kittens the whole works So this is bad, let's say that it's bad But if you're not if you're not doing that, you know, if you're being a good Programmer or a disciplined jQueryist and you're saving all of the Li's outside of this thing Not so bad Why is it important beyond just this performance increase that? I start saving my collections. I Think that it's because Constantly querying the Dom to the sign that your application isn't really in charge. You're sort of just grabbing things and passing them around and Coming up with awesome selectors like Thing concatenated with my variable plus and then a space and then other thing and then this It's a hole and then I've got another very and your eye how your whole app starts to look like this and you can't talk about it Beginning to think of these element collections as sort of a low-level building block of your app rather than the entire thing it's an important step in Not Slathering on bits of jQuery and hoping it gets by but beginning to develop applications So what am I really talking about? Let's take a look at a sort of Sample and sort of very real application Which is this Display of animals forest animals in the winter time in the summer time It works pretty nicely. We got a cycle going on and there's it shows, you know the deer In the winter in the summer and the rabbit in the winter in the summer and it's really cute and Snazzy, so how am I doing this? Oh, I'm using lots of selectors check that out So first when the application kicks off I go and make a cycle plug-in on each of these animal slide shows and When one of these gets clicked I go read stuff out of the dom using an href I go find the Corresponding ID and find where it is amongst its siblings and then tell the cycle plug-in to select the one that I just clicked on and Then sort of along the way here in the document ready function I'm saying oh by the way I should initialize the first one is active and then I also have an event listener that says anytime the first slide show changes I'm gonna go and And update this active class on the menu so that the current one is highlighted Notice here. We have a lot of concatenation together of selectors So Every everything in the HTML here has like a lot of IDs and we're using hrefs and we're parsing the hash out And we're doing this kind of fun pars You know all kinds of hair brain stuff so that we can drive the interaction here using basically nothing but selectors So what what's problematic about this is that there's no Structured and if you and I were working on this important application together It's really hard to talk about and it's all about these collections that you're inside of one Handler go query the whole dom go find the cycle the element that we know of the cycle plug-in and and Call a method of the plug-in that we know is initialized. It's it's completely ad hoc. It feels to me what if instead of Just kind of having these random collections and just querying the dom all the time we Got what we needed to work with up front and then worked with it So let's take a look at a slightly different implementation of this same thing here So we've made two major refactors here The first is that we're not using anchors anymore as buttons because they're not really we don't want them to be links Again, and we've cut down on the number of IDs. We have all over the place So instead we have data attributes that we're using So that in our application we can grab the pieces of information out of the dom and then work with them later but only grab them once up front and again, we're using a similar approach in the refactored code so the first thing we do is we save and name some collections that we can then Use and talk about later. So we save a reference to the animal slideshow in the summer section and the winter section and then we Create another collection of the navigation items Way up front and then we have the summer and we have the winter and we have some animals Then we initialize our cycle and Instead of just making another ad hoc selection we say I want to add cycle functionality to the summer and the winter sections again Since we're also in the beginning of the code We're going to add this active class to the first animal, but notice that it's not just going and grabbing Nav li first and adding An active class to it. It's going to this already existing animals collection and grabbing the first one Which when we're talking about our code together again is a lot easier for us both to grog our Click handler is refactored and Only slightly to use the data attribute jQuery when you have data Attributes in the HTML reads them in so you can read them with the jQuery data API and Notice how all these method calls are on pre existing selections. So when one of the animals is clicked We execute this handler inside of the summer collection go and find the index of the animal that you clicked in the same thing for the winter and Again with our cycle handler instead of going back to the DOM we are going back to Collections we already have in memory and we're filtering them or Looking inside of them for more elements. It's not just I'm grabbing everything as I need it and Okay It kind of works We actually have something that's beginning to resemble an application because we've started to separate the beginning from the middle What's interesting also in terms of selector performance one of the things you always hear is always descend from an ID Which is it's just it's a good idea But the point is there's a difference between descending from an ID and doing and actually going and running queries a query selector all under the hood versus actually always referring back to your original collection and Looking for those and then looking for the divs inside of it It's it's all about That famous axiom keeping your code dry and don't Repeat yourself It's not just about writing code that is not duplicative of other code It's about not repeating actions that don't need to be repeated so if The beginning of our application is the time to grab the things in the down we're going to work with and then the middle of the application is the time to facilitate the relationships in between them using jQuery so what's interesting about this approach is that as you start to Organize this code more it starts to begin to resemble the client-side MVC approach that's becoming popular To say the least things like backbone and angular and ember where jQuery is not necessarily The lead dog. It's more like a swiss army knife that Everyone uses because it does a million things, but you don't put together the entire house with it We'll talk about some of those things in a future screencast how to start making this less of a Situation of let's go find out things about the dumb and sort of pick our way through it But rather to use the dumb to represent The application, but that's a story for another day in the meanwhile What do I want you to take away from this? It's that cashing your selectors is easy and it's awesome you have an easy way to increase the performance of your application and whether you're using a ton of selectors already or You have started to implement this approach where you feel like you have to but You're not doing it all the time because No one's forcing you to I would say Don't create twice what you only need to create once There will be situations where you might have to write crazy crazy selectors like what if you're writing some kind of browser extension and The only way to get the data to bootstrap the beginning of the application is to write like something like you know Find all the TDs and then grab their easy checkboxes inside of them You know something crazy like that Or worse You know, what's added? You know a positional selector in there too Even though that's again queries like draw again a selector like this Actually not as bad as it once was but Even if it isn't as bad as it once was Save it once and for the rest of your application. Just talk about the boxes that you're using so I hope that this has given you some perspective on How to think about saving references to your collections and more importantly emphasize that it's good For Your app and it's good for your Relationships with your colleagues and it's good for your development as a front-end engineer Until next time Thanks