All right, we're back and This is our co-worker. So we felt that we had to Give him a quick introduction because you know, where would we be if we didn't give him this introduction? So, you know, this is a statement that Lee asked me to write that he asked me to Prepare him before this talk. So this is the direct quote from Lee So he says what did you just say about me you hecking cowboy? I'll have you know I graduated top of my class in the hashtag University I've been involved in numerous secret pull requests of the hashtag code repository and I have over 300 GPUs in my basement I'm can I'm trained in gorilla password cracking tactics and on the top contributed a hashes.org in the entire US You're nothing to me, but just another dictionary I'll wipe you out with the precision mask attacks like the which I've never been seen on this earth Mark my hecking words. You think you can get away with these pull requests? Think again cowboy as we speak I'm contacting my secret network of GPUs across the USA and your IPs being traced Right now.   I can crack your password at any time I can use it in over 700 ways and that's not even including my FPGA Not only am I extensively trained in password-free combat, but I also have access the entire arsenal of the crypto miner Undergrottable used to the full extent what your miserable password off the face of the continent your little hacker Please welcome the password King Lee Welcome to hashes smothered covered and scattered modern password cracking as a methodology My name is Lee Wangenheim. I'm a security consultant here at Optiv I hack things for fun as well as for a job. If I wasn't getting paid to do this I'd be doing it on my own anyway I've got about five years of infosec experience mostly focused on the offensive side of the house And currently I'm helping to run the crackers that we've got here at Optiv So why does this matter because it only takes one password and as we know People tend to use weak passwords Some examples that we've seen or on actual gigs are using default passwords for Cisco devices Microsoft SQL server. I've even seen iDRAC accounts used using the default root and Kelvin You know and everybody's familiar with the fall 2019 or I guess now it would be summer 2020 you know, this is a real issue and We run into it more often than not and once we've got one foot hold into your network We can use that to move laterally as much as we want Some of the hardware that we're using So we used to use CPUs and rainbow tables CPUs Not really working and not really worth it anymore They've kind of been overpassed now that the modern GPU rigs are out there We used to use a lot of rainbow tables to look up, especially in NTLM and more common hash types However, those have been kind of supplanted by the new GPU cracking machines The reason behind that is it's actually faster to use a GPU to crack the hashes via brute force attack than it is to Try and do a rainbow table look up because again, you're you're burning CPU cycles doing rainbow table look ups versus GPU cycles with the new Modern GPU setups We do sometimes use cloud using the AWS Boxes the new GPU boxes Those are pretty handy there. They are expensive However, if you do need to throw a lot of power at a hash or a series of hashes I can be Beneficial to to go ahead and do that Sometimes if we're on site and clients don't want their hashes leaving or if we're on a Wi-Fi gig or something like that We will use, you know a laptop Typically a gaming laptop will do better But you know you use what you have, right? um If you do happen to still be running a mining rig in 2020, um, you know for some of the GPU mining rig GPU Crypto algorithms such as like Ethereum, you can use those And you know, you can always, you know make a little bit of your money back. I don't Do any more money. So I don't know exactly how useful it is in today's world So talking about AWS some of the engagements that we do run here at Optiv are More of an enterprise security assessment, which is where we'll have a company provide every hash Throughout their Windows domain and then we will throw as many resources as we can over a certain amount of time usually about two weeks of Just letting the crackers run And we'll try and crack as many of their passwords as we possibly can that's That kind of engagement is sort of where this methodology really was born out of As well as some of the tools that we've built internally that I'll be talking about later Have have come from so This is sort of where the cloud is as of 2017 Unfortunately, we don't have too many updated Stats, but it's just about the same So it used to be About 14 cents per gig a hash hour And now it's close to three cents per gig a hash hour. Now. We do have our internal crackers Which you can see are running at about point seven cents per gig a hash hour And you know, we built those for about twenty five thousand dollars So, you know, if you're working for a large consulting firm that has the Capital to invest in their on-site cracking machine You can absolutely save money by doing that However, if you're either like a small-time consulting firm or you know, you're you're doing this as kind of like a Single contractor or something like that, you know, absolutely Look into some of the the AWS Machines, so the the p3 16 is currently the largest instance That you can get with GPUs So and So, yeah, that's gonna be kind of the best pain for your buck if you're looking to throw a lot of power As well as using a new tool that will touch on in a little bit called hash topless Which allows you to do distributed cracking by attaching multiple versions of those multiple instances of hash cat together and Hash topless kind of access an orchestration engine handling the binaries and farming jobs out across all of those different Those different platforms, which will allow you to Combine both your in-house and your cloud technology cloud instances and really start throwing massive amounts of power You know, you just do have to to keep in mind that you know, everything will come with a cost hash topless is free AWS instances are definitely not So this slide is Shamelessly borrowed from the tear hash corporation. They run the Brutalis or they produce the Brutalis machines So currently you can see there Their largest one is running 448 NVIDIA RTX 2080s. So if you're looking at Running against like running a brute force attack You're talking Doing the entire eight character key space You know instantly So eight character passwords are absolutely in 2020 dead I gave a version of this talk in 2019 and said that they're dead The same was true in 2018. It's definitely true now the the amount of power that Firms are able to throw at brute forcing, especially in TLM hashes It is just absolutely incredible at this point and so really you want to work on You know instructing your your individuals to have you know Strong 12 character passwords as you can see the exponential growth is just incredible. So you have From an 11 character password to a 12 character password It goes from a two-week crack time on an NTLM hash to a three-year crack time And you know, this is obviously assuming that that Password is not going to be in any sort of a word list or Any sort of the mask that that we can create So Just so that we're all speaking the same language I'll go over a few key terms some of which you've probably heard me using Previously in this talk and you know, I'll continue to use throughout the talk So masks are the makeup of a word broken into its character set. This is pretty important This is so for instance if you had a password one with a capital P And then all lowercase letters and then one the mask is going to be, you know, capital letter Seven lowercase letters and then one digit This becomes really important when you're talking about Attacking large numbers of passwords as you can sort of guess at the makeup of people's passwords For instance, if I told somebody that they're gonna make they need to make a 12 character password That has a capital letter lowercase letters and digits the vast majority of English-speaking individuals are going to create a password that starts with a capital letter Has, you know, 10 or 11 Lowercase letters and then has trailing digits, you know password one summer 2020 You know, we've all seen all of those on engagements. It's Very very common very rarely will you see them shift where the middle characters have your uppercase Or things like that. It's it's kind of attacking that human psychology and the human Linguistics of how we form words, especially in the English-speaking. I did read a very interesting article um Written by a linguistics professor that kind of taught attached on differences that you'll see in Asian languages Especially and also some of the Cyrillic languages as far as password creation and the different masks that we'll see Unfortunately, I haven't worked too many Well, I haven't worked any Engagements that that really leaned heavily on on I on anything other than the the typical English character set So that's where my main focus is especially when it comes to password cracking Hybrid attack is where you're going to be on brute-forcing. So again brute-forcing is just guessing every possible combination of Inside the character space so a through Z character digits zero through nine and then all of your special characters So if I have a character passwords, I would start with, you know, eight a's And then seven a's and a b and then continue to work my way through as I've tried every single Character set that we can against those hashes until we get a match So a hybrid attack is going to use that brute-force attack And then you would take a mask and either a pen or pre-pen. So if you had say Company name, right? so you or if if you knew that they had something like a five-character password and You wanted to try adding like the year to the end of it. So you would do like brute-force all character sets for Five characters and then add the year on the end of it as the map at the hybrid attack So the the the year would be your Year either a pen or prepend and so a word list is much different than a password dump So a word list and this is a very important distinction A word list is the candidate of words that you're going to either run by yourself by themselves or be modified with rules So these are going to be dictionary words. This is not supposed to be a password dump So the difference being a password dump is going to be Passwords that have already been cracked whereas a word list is going to be You know basic words like summer or spring And then you can use those words and then modify them via rules in hashcat to create different candidates for for cracking if you take a password dump That has like summer 2020 and apply rules to it in hashcat Sometimes those rules will either append or prepend Different character sets. So you might get summer 2020 2020 Using summer 2020 in a password dump As a word list. So that would be the distinction there So this is one of my favorite quotes if your only tool is a hammer then every problem looks like a nail Obviously mark twain And so that's what we'll touch on here in a minute This is the kit that we use. I'll go into what each of these tools does In the next few slides So hashcat it's now the de facto standard as far as password cracking is concerned It supports just about every hash imaginable I believe they fixed it, but there was one time that I did have a weird zip file that I did have to use john the ripper on But I've never really encountered anything on An engagement that hashcat can't really do John the ripper was the de facto standard, you know, five to ten years ago. Again, it uses the cpu cracking hashcat is You know using gpus It's very very well maintained constantly updated and lots of improvements super easy to set up and To integrate with other tools Also, there's so much information and documentation out there about using hashcat So if you ever have issues you can always look it up And and you usually find the answer Hashtop lists. Um, this is what uh, we've been using to kind of integrate our distributed cracking operations So this is uh, a wrapper for hashcat. What it does is it manages agents jobs board lists and hashcat binaries so basically You log into a web portal Via hashtop lists and it goes and connects to all the different Hashcat instances that you've connected to it You feed it a list of hashes and you tell it to crack and then it goes and farms all of this out To those different hashcat instances And does all of the the work for you basically The other great thing is if there's a new hashcat binary that comes out You can push an update to all of your distributed instances via hashtop lists Um, so for instance if you have a bunch of aws instances Spun up and you want it to you know quickly spin it. You know spin up new ones or push like a new binary You can do that very very easily within hashtop lists. Um We don't use this a lot. This is really more for those big enterprise engagements Only because the cost of running a lot of distributed aws instances Does become prohibitive Especially if we're just looking for You know cracking a Kerberos hash or Things that we can typically do On our internal cracking machines Hash ID, um, so this uh used to be a lot more useful It's not like the most useful anymore This is if you're having trouble identifying what kind of a hash you've caught So, you know, you you find a list of hashes on a client gig And you're not quite sure Um, what what you've got um, you can use this Um, the the nice thing about this is it is offline compared to some of the online out Um systems that you can drop hashes into so if you're trying to keep sensitive data Uh off the internet, uh, you can do it. Um You can uh, if you know if you hash ID isn't working for you, uh, you know, and you've got a new kind of, um Hash that you're not sure on uh, if there's open source code on github You might be able to see what kind of a hashing algorithm It's using so, you know, if you get it off of a new web application Um, you know, you can always Uh Try and create your own hash And see if you can also, um, self-register, uh, so if you somehow get into like a database back end Um, and you're able to self-register on the web application You know, so you could create a password of password one Um, and then go try and crack that password that you know the the password And try and figure out what kind of a hash it is from there by by throwing different kind of hashes at it PW spy is a tool. Um, that was built internally for optiv, but it is open source Some of the cool things that it will do is, um, it will go out and find the most common masks for you So if you're cracking, you know, again 20 000 passwords and you've cracked Say 40 of them on your first pass through You can have PW spy analyze those patches for you And it will go ahead and Tell you, um, which masks that you can then plug into hash cat For potential more success. Uh, so say they're having you know, the client has Um, a 12 character minimum. So you find everybody is running, you know uppercase Letter, uh, you know 10 Um lowercase letters and then a digit or things like that Uh, it will also identify weak passwords. So, um, you can kind of tweak that with some of the settings in there By saying, you know, only words or only words in a digit or or things like that It will break out the different password lengths that you have It will also pull out different base words. So, um, if You know, if you're doing a thing An engagement and you find that people are using Seasons or the client name over and over again to create passwords You can, uh, absolutely use this and show that as evidence to your client to say, uh, You know, maybe you should put a blacklist policy in for for different password Terms, um and things like that. Uh, the other thing that it will do, um is it will, um Analyze and find reused hashes. So if you find, uh, multiple people are using the same password This will identify that so you could then point that out to the client.   Uh, it's open source and, uh, um, I've had a lot of people, uh, reach out and, and, um, Suggest edits or or find bugs. So please if there's anything, please feel free to either put in, um, A poll request or whatever on on github or reach out to me via twitter or, um Uh, through github. So some of the techniques that we use, um, so this is how we kind of hone our skills. So how do you begin? What's the best way to crack a hash? Well, so this is a loaded question to me. Um, I get this a lot from our internal team. Um, it Kind of drives me a little bit crazy because it's kind of like asking what's the best and what's the best way to Use nmap. Um, there's no one right answer. So Basically, it's kind of an experience and just, um, Depending on the goals of your engagement. What are you looking to do? Um, so are you after one hash or are you after multiple hashes? Um, you know The the algorithm that you're going after is very very important So, you know, and until I'm hash, you're going to be able to throw a lot more power at than, uh, WPA Two, uh, only because it's a much faster algorithm. So You're going to be able to throw more rules and more word sets Uh, one thing we've done, uh, in the past with with client engagements is if we're on a wireless gig and you know, Say we only have a day or two on site Um, and we know that they're using a pre-shared key Uh, what we'll do is we will have the client provide us that key and create, uh, that hash in either an ntlm or an md5 Um, and then run it against our rule sets and our word list to then demonstrate the impact to that client that says Hey, um, you know, we didn't have enough time to crack the WPA to uh, while we were on site However, um, we would have cracked it. So, you know, if you have somebody sitting in your parking lot and they capture um, they could potentially come back and And uh, get into your network that way. Um, and this is, you know, how they how we did it uh, so that's one way to to kind of Work with your clients So where do you get hashes? um You know always, uh Looking for hash dumps. Um, if you can get onto a linux box and you have root access and you can dump at sea shadow Um comp files are always great Uh back end databases that you can get into Um, mimi cats if you encounter like an older windows system. That's not um fully patched Web applications a lot of times, uh, we'll expose hashes Um, you know, either via misconfigurations or just having their database exposed We run a lot of responder or magnum metal six on internal gigs. I'll do a demo of that in a little bit Um dc sync and ntds Um, you know, these are some of the common ways to find hashes there's thousands of ways to find hashes um You know if you're on a wireless gig and you capture a pretty shared k handshake You can open up wire shark and get the psk hash out of there There are just many many different ways to get hashes. Um, these are some good ways to start If you're kind of looking to get into it Um, I would highly recommend kind of building a local lab Um setting up, you know responder Uh on your local lab or setting up a database making some hashes And then just going ahead and and trying to crack them. Um, you can also just create a bunch of um, You know ntlm hashes or md by five hashes via some scripts So make a bunch of passwords that that you know, uh and test it out in in hash cat So that's a good way to get started So developing a methodology, uh, so this is really where our password audit kind of came out of Um, so we wanted to create a repeatable process for other people on our team to be able to follow And make it as um easy as possible for a new consultant to just kind of get spun up and start working Um, these are going to be much more analysis based than um, you know hands on the keyboard Uh, this is going to be a lot of Look, you know letting the cracker run Using your various rules and masks and all of the stuff that we've discussed previously Looking at the results and kind of figuring out where you want to go from there looking at what Their hashes are doing looking at what the passwords they're using are Are they a secure company? Are you seeing, you know, a lot of crazy hashes that you know, you're not able to crack Or are you seeing a lot of like really simple? um passwords Uh, the other uh thing we're going to look for is, you know common words easy wins again I keep coming back to summer 2020 uh password one uh company name Uh company name and the date that it was founded is a really popular one um Street names, um, if you're in an area if you're doing a client and there's You know a local sports team, um, you know, I'm From ohio. So uh in my area, you know, you find a lot of ohio state or buckeye related Uh passwords, um, you know, you could uh Extrapolate that uh across the country, you know new england. You could do patriots or whatever um a lot of um Uh, we'll find a lot of times clients will do Uh will claim that they do their own password audits, but they're not really doing it effectively. Uh, you know, they might Um run hash cap with like a base word list or like a rock you and Or something like that and say that they they covered it. Um, you really for these, um, these enterprise engagements You need heavy hitting cracking rigs, uh, either built in house or or setting up the the cloud And I would say even just one amazon Uh p3 16 is not gonna, um, really You know past muster for this you're you're gonna want to throw Um a good amount of resources at these, uh, especially if you're talking, um, you know, 20 000 or or more Um, you know passwords that you're trying to to recover So what do we do? Um, again, we go for quick wins. Um, so we run, uh internally we have some proprietary word lists that we use. Um It's kind of been tweaked over the years. It has Um, a lot of data from all the different breaches where we've extrapolated common base words. Um, things like that And we'll run those without rules. Uh, and then, um, we will slowly start adding things that increase the time of cracking But also increase your, uh, possibility of cracking more passwords. Um, so we will continue, uh, to run new and new newer and newer attacks against the same, um list of hashes and, um, You know as you'll see in a second. It's kind of the law of diminishing returns, but um as we Move through the process We tend to be pretty successful we do, uh In-house we have the capability to do a one to eight character brute force. Um, that takes about 24 hours on our internals crackers Um, so we can brute force the entire ntlm key space Within a day, uh, so that's usually about the first day of a password engagement. Uh, and then we will, um, run our words Our word lists and then our rules against things after um, you know, we How we'll then use either, um, pw spy to create different masks Or just use common masks things like that Um, and and you know, just kind of moving on and doing more and more advanced attacks, um as as we Get closer to the end of the engagement So this is sort of what, uh, this is actually real data and this is what our password recovery over time looked like on a recent password Assessment so as you can see, um, you know within the first few hours, um, we Cracked the majority of the passwords we were going to crack and as we moved through You can see the the longer, um password recovery attempts um did, uh yield less results, um, but out of um I believe this was uh over This was about 18 000 passwords Our hashes that we were trying to crack and we um cracked almost 14 000 of them Um, which is pretty good. Uh, you know, that's um That was enough to show an impact to the client and this is Uh, you know, over about two weeks of letting the crackers run and then doing a lot of that analysis on the back end And tweaking the rules to to match What we were seeing So how to help your future self? Uh, this is really important. Um, so you want to have, uh, your pop files, um We'll typically separate out pop files based on, um Clients, but we also keep a master pop file. Um, that's a historical record of your cracked hashes It's useful to see if you've already cracked that hash on another engagement So if you're seeing summer 2020, um, you're not going to burn cycles trying to crack it again I will just try that hash. Um, this obviously doesn't work, uh against salted hashes But it will work against, you know, ntlm Uh, or or any of the, you know, nd5 or or things like that Um, do be really careful about bloat. It can slow down the hash the process, um Because it's going to check it against the existing pop file So, uh, for instance, we did have a pretty overzealous analyst on the team who uh, decided to add the entirety of the, um, linkedin Uh dump into our pop file Um, and at the time of the dump linkedin did not have any password restrictions So you had a lot of four character passwords or just plain text passwords. Um, which is pretty useless against Um, you know enterprise networks that are running either, you know, an eight character with complexity or 12 character with complexity Um, so you do want to be careful of that, uh, because you're going to be running each hash against that pop file Uh, and again, you're going to be burning cpu cycles on that Um common masks. So we keep a list of in-house tools That includes the masks that we can copy in, uh, to our hash cat commands As well as creating new masks, um, as we see fit on the, um, the engagements, but You know, the the common ones would be, you know, uppercase letters at the Beginning and then trailing lowercase letters with digits at the end So now we're going to move into a demo. I'm going to show you sort of, uh, what a typical engagement might look like You know on a client network Okay, so for this demo I have a, um, responder lab built, uh, using virtual box on my windows machine So what I've done is I have set up a domain controller, uh, a firewall appliance, a kelly machine and a windows 10 machine So you can see all of the machines are up and running um What you see here is, uh, ip fire is running, um, to route everything together Windows server 2012 is currently running, uh, to act as the domain controller, uh, and the dns Um, obviously kelly, which is going to be our attacking machine And then the win eval is going to be your windows 10, uh, simulating a client, um, Computer Okay, so closing that out We just want to verify it once again that we are on the same network so we can see, um Both of these, uh, hosts are actually, uh, network together on the same subnet So we'll go ahead and start up responder here Uh, so when you start up responder, um, you have to feed it the interface that you're using So what responder is doing is poisoning the l l m n r and n b t n s, uh requests that windows Machines will set out This happens if windows can't resolve a host name using dns We'll send broadcast traffic out, uh, asking for, uh, that information uh, so responder kind of steps into the middle between a domain controller and the um, uh the windows machine and, uh, we'll We'll, um Respond with, uh, the information that they're requesting But it will then ask that, uh, windows machine to send its authentication to it Which the windows machine will provide and then responder will capture those hashes You can usually accomplish this by trying to access something that doesn't exist such as like File share does not exist or or something like that inside your your network libraries And that should be sufficient to generate the l l m n r broadcast traffic and we'll see an example of that here, uh, so I open up the Folders and I go to server does not exist Uh, and you can see the poison answers are being sent and we're capturing ntlm v2 hashes Now this is important As we, uh, could start capturing the ntlm v2 hashes you'll see there are multiple hashes being captured These are actually the same hash, uh, just due to the nature of ntlm v2 They are salted, uh, so you will receive, um, multiple hashes When you are going to crack these, uh, hashes what you'll want to do is take those, um Take one hash per username, uh, that way you're not spending, uh, excess time trying to crack the same hash For a user that you've already, um, cracked or, uh, for a user that you're not going to be able to crack Uh, so once we've got that hash we can just copy it over into, uh, a text file Which I do here, uh, so you can see, um I drop it into a hash dot text And you could do this, um, for as many of the, um Uh Usernames and passwords that you capture, um, you know Hopefully you get something juicy like sometimes you'll you'll be able to get like da creds or or things like that Okay, so now that we've got hash dot text created, um, we're going to go ahead And start up, um, hash cat so ntlm v2 hashes are, um, mode, uh, 5600 So to to accomplish that in hash cat, uh, you feed it the tag m flag, uh, and then 5600 Um, then you feed it the, uh, file name and then, uh, in this particular example, um, we're using, uh, A little bit of a contrived example, uh, just for brevity Um, so we're going to use, uh, fast track dot text because I I happen to know that this, um, uh particular, uh, password for this user, um Again because I've created the lab, uh, we'll be in that Now if this is a live gig, um, that's where you're going to feed, um, some of the the more advanced, um Masks or rules or definitely, you know, stronger word lists, uh, things like that But you can always start with the the quick and easy ones and maybe you'll get lucky And if you do that's awesome. You haven't spent a lot of time However, um, you know, if if you do need to to use those heavier lists, uh, please feel free to, uh, and You know, uh, definitely use the the masks and such that that you've got working So we start a passcat here again using the mode 5600 Um, and then we feed it the hash hash dot text that we created, um and then We go ahead and feed it the, um, particular word list Which in this case again is stored as user share word list And then we're just using the fast track dot text Once hash cat starts, um, again this, uh, particular Um Kelly instance isn't hooked up to my gpu box. So, um, you'll get some warnings for open cl and things like that um, but, uh, you'll see Uh, the the warnings come through, uh, and then Just because I know that this, uh, works really quickly, uh, you'll see that this cracks. Um, and you can see Uh, password one is is our cracked password Now if, uh, we were cracking multiple, uh, passwords, um, you know, or take longer You would see those in your pot file You can also, uh, create a new pot file by doing, um, dash dash Pot file dash path equals and then name, uh, your your pot file, whatever you want Uh, and that that will, uh, create a pot, uh, pot file specifically for, um, that particular session with hash cat Uh, that's useful if you're running, um, you know, an engagement for a particular client And you wanted to separate out the hashes that you've cracked from them, uh, versus Uh, you know, the the other, uh, engagements that you've worked So you can see here, uh As the hash is cracked, uh, it will, um, append the, uh, password to the end of the hash file Which will, uh, be the exact same way it's presented in the the pot file as well So, uh, now that we've got, uh, our password, um, we can then, um, go ahead and Uh, use those credentials to go and, uh, log in via via windows doing, uh, any particular, uh, thing that we might want to do Okay, so with a little bit of time that we have left, I'd like to do a quick demo of pw spy, uh, as it's, uh, kind of a new tool that I've developed and, uh, It was originally released, uh, during, uh, 614 con 2019 However, it's gone through, uh, some pretty major changes, um, And, uh, I'm happy to announce that The newest version is now live on github, uh, for you guys to, uh, to go ahead and, uh, go grab a few, uh, so shoes So, um, again, uh, this was an internal tool developed, uh, mostly to help us deal with the massive amount of information coming from the, um, Uh, enterprise password audits Uh, so the intention was, uh, that you would take a pop file that you've created specifically for, uh, your particular client Or engagement And then, uh, you would, uh, feed that as well as the initial hash list, um, that you fed into hash cat Uh, and it would do, uh, the analysis for you, uh That's pretty much been accomplished. Um, there's still a few more bugs and things that I'd like to tweak, uh, however, um Let's, uh, get into it For this particular demo, I went ahead and grabbed some of the passwords that we've seen, uh, in some of the public dumps that, uh, are out there Uh, and I went ahead and created some ntlm hashes using those passwords and cracked them using the optif cracker, uh, to to generate the, um Pop file, uh, for this demo, uh, so that's what you're gonna see here So I'll go ahead and open a demo dot pot And as you can see, these are just, uh, some common passwords, uh, and they've already been cracked So it's time to do the, uh, the post session analysis on that So we're gonna go ahead, uh, and feed this file, uh, into Uh, pwspy Now, pwspy, um, if you open up the help options You'll see that, uh You can feed it both on pop file and a hash list. Um, the hash list is actually optional. Uh, you don't have to add that As well as, um, inside the, um Python script, you can turn on and off individual modules simply by commenting them out, uh, in the calls Those are down at the bottom of the script, uh, and I'll show you that, uh, towards the end of this demo so, uh In this particular case, um, because we're we're using, uh, like a publicly available passwords and we haven't, uh, cracked a bunch from a particular company So there's not going to be any reuse. Uh, there's really no sense in in doing the, um Hash list as well, uh, so we're we're not gonna, um Feed that in, uh, as well as some of the modules may not work because there's just not enough data, uh, such as the mask builder, um, and Um, Definitely the password reuse won't work because you need to feed that the pat and the hash list Uh, so we'll go ahead and, um, run Uh pwspy and we'll take a look at the, uh, the output So you can see here, uh, the output is a pretty standard, uh, script output complete with the, uh, you know, required ASCII text, um, for for any cool hacker tool, of course uh So this, uh shows you some of the, um The various, uh Modules, um that have worked Uh, so as we scroll back, um, you can see, uh, that We have the, um Common base words, uh, and the number of times that we've seen those Um, as well as, um There would be a password reuse, uh, and the masks, uh would go, uh, there as well, um, which would help you If you were going to do further attacks against, uh, this client Um, the other thing that it will do, uh, is it will, um Tell you, uh weak passwords, uh, so passwords, uh, in this case I have it, um, to set, uh, a set to just passwords that are just plain text So you can see all of these passwords were cracked and consist of only, uh, letters, uh, and no numbers or Special characters of any sort You can always make this more restrictive or less restrictive, uh by editing the python script One of the goals, uh for the future is to, uh add options, uh to define what a weak password would be and then, uh Is the last, uh thing that it will do is check the lengths of all the passwords that you have cracked And as you can see, um It splits those out and gives you the number of occurrences So there were some, uh, a lot of nine character passwords, some 10 character passwords This really, uh, becomes helpful If you are, um, doing, uh, again, uh, an engagement and let's say The client says that they've got a 12 character password policy And you can go ahead and check against that and make sure that you didn't, uh, capture any passwords that might not fit that policy As well as, uh, if you're, um, you know, gonna build your custom masks that might not be, um, output by this tool You would be able to, uh, use the, uh, Um, the password length to help you generate those masks, um, and, uh, as well So the last thing I wanted to touch on with pwspy is, uh I'm just kind of taking a quick look at the source code, uh, and showing, uh, where you would turn on and off those modules Uh, so if we cap the, um, file here Uh, you can see that, um, all of the function calls are down here at the bottom Uh, which I'm highlighting here, uh, and from there, uh, what you can do is, uh, go ahead and comment out any of those different modules And it will, uh, not run those So if you didn't particularly want to run, uh, you know, the mask builder or check for weak passwords or Password length for whatever reason, uh, you could go ahead and comment that out. Um, again, this is an open source tool Please feel free to fork and edit it as You, uh, see fit, um And, uh, I hope that, uh, you know, this Proves helpful to somebody or anybody, um, if you, uh Are doing especially, uh, large password assessments I'd like to thank you for taking the time to listen to today's talk Uh, there's been a lot of great talks here at the red team village and, uh, looks like there's a few more after me Uh, this has been a great defcon, uh, despite it being remote Uh, at this time, I, uh, would like to just once again reiterate that, uh, password, uh, cracking methodology It's more of a comprehensive, uh, approach than a one-size-fits-all There are many different ways and approaches to cracking passwords and And what works for one person may not work for everybody So keep that in mind as well as, uh, always remember that, um, password cracking is again, um, not One-size-fits-all, uh, you're not going to be able to do this, uh, by just scripting everything Uh, you definitely need to, to do that deep dive analysis, uh, really think about what you're going after Uh, and use that to guide, uh, the way that you go after your, your passwords in the future Um, hopefully you have taken, uh, something, uh, away from this talk, uh, and I will, uh, be in the red team village discord, uh For any questions, uh, I'm hx50 in there, uh, as well as, uh, on twitter, uh, you can find me at hx underscore 50, uh, and Once again, I, uh, would highly encourage you to go ahead and try some of these techniques out on your own, uh, Go ahead and create hashes, uh, you know, set up a, uh, lab and go ahead and crack, uh, crack your own stuff, um, You know, uh, I will, uh, release, uh, the Instructions on how to set up my lab, uh, as well as possibly, um, setting up, um, just, uh, OVA files, uh, that you can download, uh, as well as, um, Uh, you know, you can go on github and, uh, feel free to grab pwspy, uh, if you, if you so choose, uh, you can find that at, uh, github.com slash l. Wangenheim, uh, Under slash, uh, pwspy, um, and obviously, uh, that's quite the mouthful trying spell. So if you, uh, do want to try and find it on google doesn't help, uh, feel free to reach out to me. I'm more than happy to either just provide you the link or I can just send you the files, uh, directly.


Pursuant to chapter 20 of the Acts of 2021 and extended again by chapter two of the Acts of 2023, this meeting will be conducted by a remote means members of the public who wish to access the meeting may do so in the following manner by emailing steve mccarthy at mccarthy s at mrstma.gov that's m c c a r t h y s at mrstma.gov. No in-person attendance of members of the public will be permitted, but every effort will be made to ensure the public can adequately access the proceedings in real time by a technological means. In the event we are unable to do so for reasons of economic hardship and despite best efforts, we will post on the Amherst website an audio or video recording transcript or other comprehensive record of proceedings as soon as possible after the meeting. That done, we'll call ourselves to order, call the meeting to order at 5.34 p.m. and do a roll call, Doug. Here. Hallie. Here. Dylan. Here. Gaston. Here. All right. Next up is public comment. If there's anyone here for general public comment unrelated to anything on the agenda. And please hit the. The right hand, the raise hand button at the bottom of your screen. I don't see anyone. Do we have anyone? We don't have anyone here. Okay. All right. So onto licenses and we're in annual liquor license renewal season. License renewal season in general. So what's. Okay, so it's just all. And you'll look for licenses this time. Um, Steve, are there anything, any of these who with like paperwork outstanding. Nope. So, so I am still working through and processing everything coming in. So I've been prioritizing the liquor licenses and. This is the vast majority of them. All of these have nothing weird going on. All paperwork's in. They're open. Okay. Everything straightforward. So we'll get these out of the way. And then next time we will get. Um, everything else, the common vixen, any remaining liquor licenses and. Auto dealers and so forth. Okay. So, uh, yes. Motion to prove the licenses as shown on the agenda for. December 14th, 2023. Thank you, Doug. Is there a second? Thank you, Dylan. Um, any further discussion? If not, we'll take a vote. Doug. Hi. Hallie. Hi. Gaston. Hi. Dylan. Hi. And I vote I that is five to zero and then the licenses are renewed. Great. Um, onto discussion topics. So. Discussion topic a marijuana regulation. Did Steve, have you heard back from town council yet? So I have not yet, I sent 2 inquiries at the same time, which was about the common vixen licenses and whether we can get rid of them and also the marijuana. I think they're putting them up because Brian Riley is the liquor, liquor, liquor law expert and the marijuana went to somebody else. And I have not heard back from marijuana yet. I did hear back from Brian on common vixen. He said that he believes just due to how the law is written and some of the other unintended externalities, it probably wouldn't be possible to, to get rid of them and not cause trouble for, for business owners. So I can forward that email along to you, but I've not heard back yet about liquor. Sorry, marijuana. Okay. Great. So we're just waiting for that before we can move on to the next step. Any questions about this or the process? Nope. Okay. Okay. So we're going to go back to the discussion topic. We have a discussion topic B, lunch cards and food trucks on trace, praise straight. How was the last weekend? Yes. From what I heard, um, it went well, no problems. Um, so I will be, um, double checking with staff as to how that, uh, how, um, that may be brought forward to the, the town council, if the board is still in support of that idea of making it more permanent. And there wasn't any, uh, any problems really with, with, um, disorder or chaos or traffic incidents or anything like that. So I think it was a successful experiment for the season. Great. Good. So perhaps we can do it again in the spring. Make it more permanent. Um, okay. If there are no questions on that, on to see Savannah's Amherst burger company closures. So I have received transfer applications for both of those licenses. Um, so those applications are moving quickly and they will be on the agenda for the 28th. Fantastic. Well, that's good news. Great. Um, any questions about that one? Just out of curiosity, said it was the out of town owner. Oh yeah. Are they in Western mass, or do they have experience in the valley at all? Yeah. Yeah. We both the owners are LLCs. Um, they're, you know, kind of founded for each restaurant. But my understanding is, is that the group that is behind it, um, has experience on the cell shore. And the Cape, but not so much in Western mass is my understanding. So. Just curious. That's all. Yeah. Okay. Right. Um, D APD update on liquor law enforcement. And the response from. Cap, is it captain Ting? Captain Ting. Interim chief captain Ting. Yep. Okay. Um, so he, he, uh, kind of gave an overview on, uh, what their enforcement priorities are and, um, how they do that. And, um, I did pass along that individual complaint to him. Um, so I hope that is a bit more illuminating on. On the things they do. Okay. Yeah. Oh, should I just mention? I don't know if this is related, but I was poking around on the ABCC website last week and they do, do, um, I think they have operations safe campus in the fall, which runs from September 1st until Halloween, October 31st, where they make a considered effort and they send, I don't know what they're called agents into the field to check IDs and, uh, make sure that everyone is compliant. So, um, I didn't, I don't know what they're called agents into the field, but I don't know what they're called agents into the field. I don't know what they're called agents into the field. Apparently they do want to run Christmas too. I don't know if it's worth. I don't know if the police, I'm a police are aware of that, or if it's worth letting license holders know that this is a seasonal thing. Um, Something we can talk about at another time. Some. All right. Any questions. Not this one. Nope. Okay. Onto our last discussion topic. Um, we're going to do December 28th and we have the rest of the licenses. Um, Steve. And I guess we'll do marijuana regulation update. Uh, not do lunch carts and food trucks until the spring. And, uh, what else? Rental regulation. Regulation. If we put that back on. Depending on how it goes. I will. There will be those two new applications as well. Okay. Okay. Thank you. Thank you. Thank you for your patience. All right. Any other, um, Discussion topics for the next. Meeting. Or I'm sure they'll be. Yes. Sorry. Go ahead, Dylan. I was going to say, uh, Steve. Uh, in March. The remote provision expires. Am I right about that? Oh. I, uh, actually. Um, don't know off the top of my head that, that, that would make sense. And, um, I guess the question here too is, uh, But what are people's feelings on remote versus in person meetings? We, we get further from the pandemic, assuming we have. Some option in, in the matter. Is that something we want to start thinking about? Um, not that we have to, you know, land on anything now, but. I don't know either one is fine at remote is easy. It's more convenient. It's definitely more convenient for me, but I'd be happy to do some version of a hybrid. Like once a month in person, I think remote. For restaurant owners is probably. A little easier if they're coming rather than having to leave. And come in, they can just go to an office and zoom. Do we have any way at this point to, to schedule one in person for a change of pace? Uh, I don't know, Steve. Can we do that? Uh, there's nothing, there's nothing stopping you. No.  Yeah. Once. Once. I think three years in, I don't think I've seen Marion in person. Yeah. That is funny. I don't think so. You treat. I think you try. Yeah. Okay. Yeah. Sorry. Doug, go ahead. So I, I saw Dylan in person at the gym last night. Yeah. I was just visiting somebody, but anyway, it's a whole separate thing. I just looked it up. Actually the extension of the remote meeting option is till March of 2025. A year to. You know, figure this out, but. No, no opposition on my part of in person. We, you know, it might be a while, but I could see the benefit of. Formalizing and doing an in-person when we vote for our chair and co-chairs. Beginning of a term. Yeah. Yeah. No sooner than that to Dylan. I'll bring treats too. I'd be happy to like, see if there's one in January that we think is convenient for people to 28th. I think that's a good one. For me. Yeah. I don't think I'll be able to do the 28th either. Yeah. We could do January sometime. What have we got coming up? So the 28th, the 11th. Oh no. We're doing the 1st and the 3rd Thursday, right? Steve. So the 4th and the 18th. Well, we certainly could move that around. Or we could do February. Fourth is good for me because. Yeah. I haven't started teaching, but I don't know if that's, if that's a good in terms of the flow of things. We'll just have met. Yeah. And Steve, how does that work for you too?  I appreciate that, Hallie. I mean, I can certainly make it work. I guess in terms of meeting dates. You know, we are going to be meeting the 28th. We're going to be meeting the 28th. I mean, we're going to be meeting the 28th. You know, we are going to be meeting the 28th so that we don't, even though we do normally do the 1st and 3rd, we could. We don't have to have to meet in the 4th. I don't know if there's anything that will be coming right down the pipe. Then. And I certainly won't really have any time to work on the, the, our more discussion items type things right, right at the turn of the year. So. Okay. That back a week or, or if you want to meet, we could certainly do that. I could certainly get the meeting work. You could put it back. Oh, her stragglers coming in. Like the 11th. Would that be fine? The 11th and the 25th. The 2nd and 4th. How does that. We're going to like then be right up against the 1st, the next month. I wonder if we get, get away with just meeting in January. That could work. Probably. Yeah. The 18th. Right in the middle. And then. January 18th. And then that puts us to February. February 1st and 15th. And then, you know, if there's ever an emergency or. Right. You can usually find consensus. On a time. Just so I'm getting it right. Are we thinking January 18th, 530 in person? Do we like that?  Right. Okay. Well, that's exciting. Doug, can you make that one? Yep. Yep. Okay. Super.  All right. Great. So. All right. So we will meet again in January 18th. Anything else to add to upcoming meetings or agendas? Nope. All right. Okay. Okay. All right. Topics not reasonably anticipated 48 hours prior to the meeting. Any topics. I don't have anything. No, I don't have anything. Well, that was fast. We're ready to adjourn. So is there a motion to adjourn? So moved. Thank you, Doug. Is there a second? Thanks Dylan. We'll take a vote. Doug. Hi. Hallie. Hi. Gaston. Hi. Dylan. Thank you. I'm going to turn it back to zero. We're adjourned at 547. Happy. Have a good holiday season. Everybody. You too. And see you on the 18th. 28th. 28th and the 18th. Oh, the 28th. Zoom. Gosh. See you on the 28th. Sorry. You on the 18th. If there is a quorum on the 28th, I may. Bow out. Okay. I'll be mella Kaleke mocking. And the time zone toys. I'll be there. I got you covered. All right. I'll be there. Okay. Do you want the 28th? Yeah. Have a good trip. Bye. Thank you.


I also want to thank the organizers of EuroPyton and the volunteers. This is my first EuroPyton. It has been awesome so far and I really hope you are all enjoying it too. I am very excited to talk about how thinking in Python made me a better software engineer. This is a subject I really like, like the subject of thinking in a programming language and I really hope I can interest you too. So my name is Johnny Dude and this is my real name. I work at Toga Networks, I design software and algorithms. Python is my favorite programming language but I usually use it for prototyping. My team is responsible for C++ code for the most part and that's what I've been doing in the past decade. So I'm going to use C++ as a contrast for Python in some parts of this talk. This talk is divided into three parts. I will first go over some psychological concepts and then I'll try to show how it relates to the development process and I'm going to attend in about an experiment I did and its results. So first couple of psychological concepts and I really hope you can keep these in mind throughout the talk because I'm going to refer to them. Imagine you were sitting in a pub drinking wine with a friend and out of the blue your friend asked you not to think about a pink elephant. Ironically you will think about a pink elephant a few times in the next few minutes and this is called the ironic process theory. Try not to think about something makes thinking about it more likely. Next is the magical number seven. As Wikipedia describes it is often interpreted to argue that the number of objects an average human can hold in memory is seven. Give or take two. There is nothing we can do about it. We can however keep that space available for when it is needed the most because anything that occupies your working memory reduces your ability to think. This is an example of priming. By reading capital of France Paris should pop up in your mind. I almost said Paris there. Priming is a technique whereby exposure to one stimulus influences a response to a subsequent stimulus without conscious guidance or intention. So basically what it means that things that happen influence your mind as well consciously or subconsciously and it can be helpful at some times but very much like the pink elephant sometimes you may not want it but you cannot prevent it. Think most software engineers if not all will agree with me that task switching reduces their ability to think about their productivity time. Psychology research shows that switching between tasks of different types like reading and writing for example costs more in terms of productivity and can cost almost half of the subject productivity time. Last is fluency which is the ability to do an activity with little or no effort at all. People for example are fluent in walking. When you compare a walking meeting and a sitting meeting both you take the same time and conscious effort. So those are the things I'm going to refer to throughout the talk. Now let's see how it relates to the development process with some examples. Let's start by getting immediate feedback from the code you write. And this is very in development. I got the habit of using idle both as code editor and interpreter when I started coding Python professionally that was about 2005. There was no IDE back then and that was what the team used and real programmer didn't use mouse and window but it looked something like that. You evaluate and check each expression you write as you write it getting immediate feedback from the code you write. Now you find bugs earlier, you learn faster and you have confidence in the code by letting the computer execute it in its head and not in your head. So in this example we have a short function and it aims to find the biggest files in the folder. And this system function returns the standard output. We use it to call disk usage and split line will return us a Python list of lines. And split each line by tab to get a size and name, pairs. And then enlarges will give us the enlarges pairs and descending by size. We drop the size, return the file names. It seems simple but there is a bug here and it's a silly bug. And my point is it doesn't matter how senior you are, sometimes you will write silly code. So let's use the interpreter alongside writing this code and see how it works. First we define an example argument and then we execute a statement and we try to sample the result. Once we see it is okay, we move on to the next statement. And here we can see that the numbers are actually strings and not numbers. What does it mean to enlargest? If we manage to miss it, it would be glaringly obvious in the next statement that 96 is not bigger than 912. So we can fix it without task switching and with the same information in our working memory and move on. And the benefits are that you learn faster. Human and not only humans tend to learn faster and achieve higher degrees of expertise when they get feedback. The sooner, the better. Catching bugs earlier reduces task switching. And it is important here to note that task switching is not window switching. So when you write code you need to consider how it will be executed. And I do not consider actually executing it in another window as a different task or a different state of mind. Writing it blindly, however, and then finding the bug in the unit test forces us to task switch into a debugging mode. And remember this can cost half of your productivity time. And with immediate feedback you also gain confidence that your code works by executing it at least once successfully without spending extra conscious effort. Another example of confidence, when you learn C, you learn C loops and you learn not to get an index out of range. This is a must-have skill for C developers because an index out of range might cause segmentation fault and then you will need to debug it, which is painful, hard to do, and hard to forget. So you will spend years double and triple checking every edge case of every loop you will ever write until you are fluent in C loops, if ever. Executing it all in your head and despite all this effort, you will still have an index out of range bug once in a while. Okay, standard representation. Object representation is often underestimated. Can you tell me how old bread pit is? You should be able to find the answer quickly because you should be fluent in reading such data structure. If we want the list of strings optimized for filtering items matching a regular expression, we can use a line-separated text, just like most Linux tools do. And then we can use any Linux tool or regular expression library for high-performance matching. But it is not easy to read. A list is. And you don't get to wonder who is Numa Thurman. My point is, regardless of the implementation of your data structure, keep a standard representation for the user, which is often yourself. Then you can actually visualize it in your mind and think about it effortlessly. So I'll take it a step forward. What if we wanted a dictionary with keys that can be searchable by regular expressions? In this case, we can use the line-separated text for the keys. And those keys may be long, so we can use the offset of the key in the text as a dictionary key. It saves space and it saves CPU and hashing, but it looks like that. Can you tell me now if Mia Wallace is alive or dead? How about now? Again, regardless of the implementation of your data structure, you need to keep a standard representation for the user. In GDB, when debugging C++ code, we have modern Python scripts that allow us to pretty print the C++ standard library data structures. And the problem is usually when you write your own structure. If I write a structure like this, it would look like that. In Python, we have a wrapper. But in Python as well, I often see user-implemented objects without a wrapper or a non-standard one. And remember, if you say, I will write wrapper later, it won't get done. It usually won't get done. And if you don't use standards, it is more confusing than helpful. So if you can read it, you can visualize it in your mind and you can think about it effortlessly. Discuss it with other developers and you will find it easier to work with and less of a distraction from your main task. For me, it's more important than the plain readability. It's the ability to visualize and think of the data structure effortlessly. Standard API is also important. And a very good example for a standard API is the counter. You can read it immediately and be alone, but the number of walking dead. And the counter uses a very well-known data structure with a very well-known API. And the counter also tells you explicitly what it is. The only difference is the constructor. Using a familiar data structure and API is the base of keeping your mind free to think about many other things. One thing about the magical number seven is that it can hold entities of a limitless amount of entropy. So it is harder to remember nine random digits than two random words, which in terms of entropy holds more information. And in the same way, it is more... it is easier to remember a counter which is a dictionary with a different constructor than a counter which has no explicit reference to a data structure or an API. Speaking about dictionaries.  But if I say to you that I want to store something in a map, well, if you are a C++ developer, you will start wondering about things like why do we need a keys order or why not use a hash map or why is there no good hash map implementation in the standard C++ library? And even if you don't think about it consciously, your mind will prepare itself for answering such questions. Now, composability. And another silly example. Here I have a function who returns a list that contains a string of a number for a number in sorted numbers if the number is valid. And Python here allows me to explicitly describe it. And it also dictates how it may sound in the voice inside of my head or in a talk in front of an audience. C++ without diving into details does not allow composition of standard library iterators and algorithms. And in some cases it forces the user to create new copies and in other cases it forces the user to modify data in place. So it may look something like that.  If you think about a recipe, an actual recipe, like this one, you have mixed ingredients in a bowl, period. Pour the bowl content into a mold, period. And bake the mold along with its content, period. And those were three sentences with intermediate variable and a lot of useless, obvious information. A baker reading it may just translate it in his mind to bake the mixed ingredients because that is all they need to keep in mind. So this example showed a functional composition and it works well for me because I like to think functionally. But Python allows you to be consistent and write imperatively or object-oriented if you want. You can say I want this list sorted and contain only valid stringified numbers. And in the recipes case you can just say mix and bake. And by the way, this is like C++ because actual C++ looks like this, which is a topic for a different discussion, I think. But my point is this. It is easier to think with composable tools. And generally, Python tools and modules in the rich standard library are consistent and composable. And my favorite example is the unit-test mock library, which is written for the unit-test framework but works with any test framework. Simple is better than complicated. I skip the complex part and you'll see why soon. In C++, when you define a function, you can pass parameter by reference, by value, by row pointer and recently by rvalue and smart pointers. You have shared pointer for shared ownership and unique pointer for unique ownership. This is something you don't have in Python. Everything is shared object. Or like shared object. So if you have a project and you don't care about the micro-performance it's written in C++, you may think why not just use shared pointers everywhere? It's easier and as you know, simple is better than complex. So you tell everyone in your team, from now on we're going to use only shared object everywhere. And then somebody decided they want to use a unique pointer. Why? Because of the C++ core guidelines. It's a 450-page guide that any good C++ engineer follows. And now we have a problem. What if we want a function that receives a smart pointer but we don't care which? In this case, the C++ core guidelines have an advice and it tells us to use raw pointer and make it const, which means immutable in that scope. So you can put the const keyword before the type declaration, it makes the object immutable, you can put it after, it makes the pointer immutable, and you can make both. And then you read code and you see the const in the middle. And the C++ core guidelines actually have a section about it. It says don't do that. It works. It does something, but please don't do that. And then you remember that complex is not that bad. Complex is better than complicated.  And then you spend a week debugging a segmentation fault. Remember, the hard to do thing because of a line like that. Pass a shared pointer by reference, which doesn't make sense in C. And this is not funny. This is like the culture of the C++. Every time we read code, write code, or do anything with code, we just want to optimize everything in the most absurd and unnecessary way. And we also care about parameter passing. So we can use shared pointers everywhere, but we cannot stop thinking about pink elephants and every other option in the C++ language. And here Python makes it easier to think about other things by offering just one option. Yeah, I wanted to mention type hints. Not that part. That got me laughing, though, until I got to the 2039 part. Yeah, so now we're in 2019, and static type checking made a huge comeback in the Python community. So I had to try it. And it took me like five minutes to ask myself, do we really want to define types and structure before understanding the problem and the solution? And Python here reminded me that it is possible to do it separately. So I wrote code and added hints later. And then I realized something else that I didn't notice before. Type checking and describing processes are completely different tasks, which uses completely different systems and require attention to completely different details. So when we are writing in a statically typed language, we are constantly task switching between coding and type defining. And it's actually worse for statically typed languages because just by defining integer, it raises the question of how many bits would I like this integer to have? And it's important because what happens when you are wrong? Or you can say, let's just use an integer. It's the default. We don't need to think about it. We will deal with it later. So you can say we don't need to think about it. But can you actually do it? Okay, this is the last example for today, and it is a topic I am very familiar with. It puts everything together because prototyping is actually a way of thinking. Prototype is a model built to test a concept and to be learned from. You write it once, gain an experience in both understanding the problem and a solution. And this is a solution you are trying. And if you are satisfied with the result, you write it again with less thing to worry about and attention to finer details. Writing it again after it is organized in your mind will make sure it is more readable. And by solving all the sub-problems before, you have less thing to think about. And then you will have a little bit more space in your mind to think about future tasks and maintainability. And maybe find a bug or two you had no capacity of noticing before. But it does cost you a little bit more time. So prototyping should be a little bit faster. And coding anything the second time should be about twice as fast. For me, it takes about 25% more time. But this will eventually be profitable for the entire team's productivity because it will reduce the complexities of future tasks. Now, this is true for any programming language. But as I mentioned before, some things you can only do in Python. In Python, you can use a dictionary without considering its implementation. Implementation, sorry. You can define a function without caring about the arguments types or bits. You can think in the language you write and not work hard to translate your thoughts. And if your production code is in Python, you can handle the type checker later, separately. So along with many other things that have nothing to do with thinking, developing in Python is about four times faster than developing in C++. So prototyping should be at least four times faster. And there is an empirical study here, a reference downstairs. And it shows an example in one domain how it's actually faster. It is a nice old empirical research that I like. This is so counterintuitive, I often forget it when I am busy working. I have a task to implement something in C++. By adding another task of prototyping before I write the C++ code, I save the overall time I need to spend to finish the implementation. So my question is, how much of this speed-up do we get from thinking faster and not from fancy features and other technical qualities that makes development in Python faster, as you all may be aware? And that gets us to the last part. I want to tell you a story about a personal experiment that I did, and it is not a valid research, not even close. But it is something that you can try if you have free time. And for me, it demonstrated the power of thinking in Python. So in the beginning of this year, we were interviewing candidates at my workplace, and we gave them a well-known problem with a well-known solution. Find the shortest path in a text maze. On the left, you can see an example input, and on the right, you can see an example expected output. And what we wanted was to understand the difference in work times it takes to solve this in Python compared to C++. So I implemented it a few times in that order. And I measured the times. And as you can clearly see, it takes much more time to do it in C++. And I remember that empirical research that I talked about before, and it actually correlated source lines of code to work hours. So I counted the source lines of code, and I found no reasonable correlation. So I actually had to read the code and see what's going on. And what bothered me most was the last two implementations. So as you can see, I chose the question, and I consider possible solution before even writing the first implementation. So by the time I got to the fourth implementation, I was really bored. I knew what I was doing. I knew what pitfalls to avoid. I didn't use an interpreter. I didn't have compilation error. Everything worked perfectly well. And both of the solution looks very much the same. In fact, both versions had exactly the same algorithm, data structures, functions, and even names. And the only difference was the number of characters. So if it wasn't boring so far, I re-typed the solution and reduced the time it took me to write it in C++. And it still took me twice the time. So this is one example function from the implementation. And as you can see, I didn't use any fancy Python feature. I did use a generator, I think from Habit, but I didn't use its true power, its composability. So I just populated the set. And you have to understand that I am significantly more fluent in C++. So I should be doing the C++ implementation faster, and yet it took me twice the time. And the question is why? Why did it take so long? And failing to find a solution that relates to the development process, the question literally became, what was I thinking about? And these are possible answers that could fit a 30-minute talk. But we're not done yet. One more thing. It is fun to experiment. And you don't need to go out of your way to do it. So in this case, I just needed to understand what process will the candidates go through. And after the first two implementation, it didn't make sense to me. I had to implement it again and see what happens if I implement it again in Python. For some reason, I did it again in Python and then I needed to see what's going on with the C++ version. And so I was not performing a supervised experiment. I was just following my mood for very interesting results. So maybe you two sometimes choose different approaches. For me, sometimes I think like something takes me, it should take me 10 minutes of work. I don't need an interpreter or I want to use an interpreter even though it's 10 minutes. So I don't need to change what I want to do. I just need to measure and with time, I will get enough samples to hopefully answer the question of which process works best for me. Okay, so what have I been talking so far? I was talking about immediate feedback and its importance for acquiring fluency, reducing task switching and improving confidence. And in Python, it is just as easy as moving from the usual blind writing mode into an interpreter. In C++, I learned how to remove dependencies and work on isolated chunks of code so I can execute the code almost immediately, as often as I would like. I also make sure to have a standard and composable representation in API in every project I'm involved in. This helps the entire team understand each other's data structures and helps them even to debug each other's code. Also, Python here taught me the importance of good architecture and API design because it's one thing to read a book about it and another actually using a very good example daily for a while. I can say the same thing about composability. One second. I lost my notes. Keeping consistent and composable structures, objects and modules, help you become more fluent in the framework you work in faster. And it also keeps your mind free of things that becomes obvious. And prototyping Python. Even if you write in other languages. To prototype properly, you actually need to think without destruction and it doesn't usually work very well with most other languages. And if you write Python code, try rewriting it instead of refactoring it. It works for me. Maybe it will work for you just as well. Okay, so, let's see. If I want you to take anything from this talk, I hope you will start thinking about the way you work. Think about the way you think. Try to think in Python. I know it sounds insane. For me, sometimes I actually think about some solution or something and I can just write it in the same way I thought of it. And don't just think. Experiment. It's fun. So, please let me know what you think. It doesn't matter if you're a junior or a senior, if you write only in Python or in many other languages. If you agree with me or you don't agree with me, I would very much like to hear what you have to say. You have a link for the slides here. I have a thanks section for people who helped me write it and some inspiration and references that you can see. And that's it. Thank you very, very much for coming and for listening. A insightful talk. We have approximately one minute for questions for Johnny. Yes, let me walk to you. Thanks for a nice talk. One small question about immediate feedback. Is there a particular reason for not doing it in tests, like unit tests, instead of switching to the Rappel? Why would you want to write the same code twice? When you write a unit test, you actually think differently. Once you have finished written the function, as short as it may be, and my example actually demonstrated it, when you write a unit test, you need to switch to a different mode and think about what will I do when I unit test the function. The function doesn't even return the size of the files, so you need to think about how to test it. And if you find a problem with it, you actually need to switch to a debugging mode and think about how am I going to debug this function now. And you're in a completely different context and think about completely different things that you will need to come back to later. I hope it answers your question. You can experiment and then copy it to your code if you want. That works just as well. Thank you very much. Unfortunately, we run out of time for questions, but Johnny is available afterwards for more questions. Thank you.


I'll read your legends today. We're talking about Jurassic World Dominion Remember that movie that was supposed to come out this year? Can push back? Yeah, because we have some news! Finally Um, Total Film, it seems, uh, posted a picture It shows Claire Deering! Oh, so we have confirmation Claire's back! What's interesting about this is, um, I remember the first proper picture that they released on Fallen Kingdom was the Triceratops skull And of course, it was like, that was really important because it ended up being, you know, how Indoraptor died It's not like a behind-the-scenes, it's not like a clipperboard we've had in the past Um, it shows Claire Deering, uh, in a swamp Oh, I can't even say the word! Up to a neck in it! And behind her, what seems to be a bipedal dinosaur, um, but they have giant claws if you can see on the left of the image Now, there was speculation as to what this could be, it could be Amethyrozenosaurus Um, and I think that's pretty much what it has been confirmed because Colin Trevorrow himself tweeted this image and said Therizinosaurus and at Bryce Dallas Howard So it is confirmed that this is a Therizinosaurus But what's interesting is, for a start, Therizinosaurus I don't think was on any list on Injin or on any of the islands Um, and this sort of biome itself is like a mangrovy kind of forest Which, I mean, have we had swamps really in any of the Jurassic franchises? It doesn't really make too much sense But after watching, you know, Camp Cretaceous Season 4 If you remember, the final biome they unlock on that manta corp island somewhere Was a swamp, and in that swamp was Dolophosaurus And is it a coincidence that maybe a couple days after, you know, Camp Cretaceous Season 4 comes out We now get an image of a swamp? Uh, I don't know I think some people have just tried to like pinpoint different bits of the log And said, oh, that's the robot dogs that we saw in Camp Cretaceous I don't think that is the case And the reason why a lot of people didn't know whether this was, you know, Therizinosaurus But now it's been officially confirmed by Colin Um, was that, you know, Therizinosaurus Or at least scientific discoveries about recent scientific discoveries about Therizinosaurus Show it that having a big, floofy tail Um, or at least being feathered And that's why a lot of people thought maybe this isn't, maybe it's Spinosaurus And the claws don't really suggest that All I can say is, you know, uh, this is the Jurassic franchise And, you know, it doesn't have to be feathered It can be whatever they look like These are genetically mutated dinosaurs That look very different to the counterparts And I think it's probably what's gonna happen here One of my thoughts, originally, before it being Conjured, Therizinosaurus Was that it might have been an early Dominus As it would, you know, this is a breaking the trend For the first time ever in the Jurassic World franchise That we haven't had a hybrid You know, we had a Dominus Rex We had Indoraptor Um, I think Colin might have said at some point that You know, we're, we're done with hybrids No more of that Um, and Ben, you know, Camp Crescia has Scorpius Rex But, you know, that's, I think it's supposed to be kind of I don't, eh Kids surviving an island and Scorpius Rex And a guy who's like a hipster dude With tattoos who has loads of dogs Like, I don't know man Like metal dogs, it's weird And then you've got that like, I don't know Lost in space looking thing Is it really canon? Are we calling this canon? Maybe, I don't care Anyway, I don't care But we have a swamp biome We have a new dinosaur And we have Brice Delasoud Apart from above her head She's just completely dry So she isn't in there for a reason to dive in She's probably fallen in But one of the best things about this picture Was the comments that came from it I think somebody said I bet she was wearing high heels, isn't she? Now, when these images come out Sometimes they switch things Remember the first trailer for Jurassic World The Mosasaur, the eight Zara Or whatever she was called They left her hand in And then in a subsequent trailer They took the hand out You know, because it would have been a spoiler But this image just came out And I'm thinking maybe they'll put the fluffy tail in At the moment Or like, you know, later Maybe they forgot it But the thing is You know, this movie Dominion I think is completely wrapped Everything It's post production is complete It's filming is complete It's all ready to go And be shown at the cinema But of course we've got to wait For summer to come around For them to get the best Biggest box office ticket sales Because that's what it's all about And the end is making money But it could mean We're going to be getting a trailer soon And it's going to be interesting Because so far From the promotional behind the scenes Sort of things that they posted And some things that have been kind of leaked Show that they've recorded in Canada For snow They've recorded in Malta I think it was For some sort of Mediterranean chase scene With these new terror raptors Or whatever they're called Like the evil raptor squad That we've got going Where it looks like Chris Pratt's Chasing them down on a motorbike And there's going to be some crazy scene there We've also got now this swamp scene So we've got three different Areas that are happening Where it felt like in the last movie Or the last subsequent two movies Have been very stuck to one You know you had The island He's in a new blower And we're falling into a new blower Maybe the ship I guess could count And then you know The whole what's it called The mansion Lockwood Manor Whereas this one we're flying all about And then we've seen That there is a big transport plane Which is probably how they're getting around But Does MantaCorp even factor in To the actual plot Of Jurassic World It's hard to say Are we going to see Kenji's dad? Are we going to see Darius' brother? Maybe make an appearance As he's trying to find the kids on this island Because they still haven't escaped If I remember correctly God That whole season was a blur So I think they're still on the island I could be wrong And maybe Dominion's going to pick up with I don't know MantaCorp being a good thing And maybe it's got something to do With Alan Grant and all them And then that's how they bring Dallas Howard here This is the environments That they're creating Prehistoric life As a subsequent arm of Ingen I don't know It's going to be interesting But I don't think that this swamp has anything to do With MantaCorp or Camp Cretaceous It would be interesting If it did It would really throw one for a loop And now we can of course expect Therizinosaurus to make an appearance In Jurassic World Evolution 2 And of course The toilets Because I don't think we've had A Therizinosaurus Like official one Maybe in the old Kenna one Maybe very rare But not in the, you know The new Mattel kind of lineup But anyway guys I just wanted to showcase you that Maybe talk some theories through Because it's quite interesting To speculate on this sort of thing But Rumblings I feel You know With the movie coming out next year Maybe we'll get a trailer within a week I don't know It's highly likely I'm looking forward to it Maybe this weekend We'll see We'll see But if you enjoyed this video Leave a like Until next time I'll see you QDs later Oh bye-bye