I think that in spite of the efforts to maintain what we call the liberal order, international order, I think that the deep currents are going against it. And I could provide a rationale why this is going to happen. And it's inescapable. And I think what we should try to do is to undertake damage control. I think what is happening in Europe, but it's happening also in other parts of the global economy is that increasing worries are linked with job losses. And people are saying it's because of technology. It's not because of a global competition. But this is still questionable. The second, and I think it's the bigger worry, it's secured in many respects, including physical. I mean, the fear of people of what can happen tomorrow. And take the case of Europe. Not EU institutions are asked by citizens to come to the rescue. The pressure is on governments. And this is going to continue in years to come. And this is the case. And I even imagine a price slide with a trade-off between safety and openness. Both are public goods. During hard times, the people value more safety. And here, I think, lies the origin of the inward-looking syndrome, which we see in Europe, but also in other parts of the world. Closing borders. Governments being more intrusive in people's lives. So I can provide it. But I don't want to continue on this slide now. But let me react to some of the comments I heard here. I think that liquidity is never enough. When something hits the global system, then it fades away like water in the sand. It's the liquidity trap, which can operate very, very intensely. Let's not delude ourselves. Second, I'm asking myself, because Monsieur Le Dillon, he has talked about the ETFs. And I would extrapolate, and I would talk about capital markets. And I'm asking myself, when it came to banks, the land of last resort function was performed by central banks. Who's going to perform it? In capital markets, we do have a precedent with the long-term capital management. It was the Fed, which brought together the big guys on Wall Street and said, look, we have to do something. Because if nothing is done, the system might collapse. And in my view, this is going to happen again. Non-bank actors, which provide increasingly banking services, are also pretty dangerous. Now, and I would raise the big question, big questions, because I think one should put on the plate issues like, is the system more simple than it used to be?  This is a route to disaster. It's not more simple. We have financial innovation, which is continuing. Toxic products are put on the market, are used in theory, in spite of what it believes to be a more effective regulation and supervision system. And the irony is that there is pressure to deregulate. I find it ridiculous. It's happening not only in the United States. And I hope very much that Jamie Dimon and the other people, I mean, it's resisted. But it's happening in Europe. To allow banks to, I don't understand why the Vickers reform in the UK is not replicated in Europe. I don't understand why. So another big question is, how much right is in the balance sheets of banks? We don't know. Why in Europe governments and central banks are reluctant to undertake the bailing in procedure to apply? That's very dangerous. So it's like we have an ongoing crisis management. We're not coming to grips with overwhelming reality. And then there is another big, and a very big question. For whom does the system work? Because you could say, look, we reform the system, we'll make it to function better for the benefit of the entire society. If it doesn't work OK for the benefit of the entire society but in an even way, even that's acceptable. If we do not face another crisis not looming at the horizon, even that is acceptable. We should not hope for perfect evens. But if we're going to go from one episode to another episode of crisis, although you could argue, this is the way capitalism works. We have to accept it, too. But it depends on how the crisis hits and how many people are impacted, and so on. But if the system is perceived by people that it doesn't function for the benefit of most of the citizens and we see that it's not functioning for the benefit of most of the citizens then, what do we get? Enormous social strain in society. Income inequality but also the number of losers and pressure put on the political system. Extremist parties coming to power. I mean, this is the crux of the matter. It's not about the ETFs and the non-banking actors which provide banking services. The questions, I believe, should go much more profoundly down. And in my view, we don't have adequate answers. Some of the people who used to be at the very top like Mervyn King but there are other people, too. They even raise fundamental questions about not only the architecture, but the logic of banking, fractional reserves, and so on and so on. I mean, we don't want to address these issues. We are afraid of addressing these issues. And if we are afraid of addressing such issues, we'll continue along the same lines. And God forbid a new episode of crisis hitting us. What's going to happen? Nationalize the whole banking sector? It might happen. This might happen with a new episode of big crisis. So with all due respect, it's not only about the ETFs or where the crisis will come from. It's about what next? Can we intervene? What are the tools? And the anger and the fury of people? I think these are the questions which we do not address. I mean, it's properly currently. Now, in operational terms, does this mean that the die is cast and we're just along for the ride? Does it mean that central banks should be quickly withdrawing their current support for financial markets? I believe that the BIS underestimates the power and the effectiveness of macro potential tools. We did have capital controls years ago, decades ago. I believe that they were effective. I think we succumbed to an ideology that we should have completely free financial markets because that's the way to make the system function.  Because those who were pragmatic, that philosophy was espoused by the IMF. That was imposed on Asia. I mean, the Asian economists were collapsing. And Mr. Kamdesu was suggesting to people in 1997, 1998 to continue with opening the financial markets. This is what we should not be blindfolded. We should ask the right questions because otherwise, we're going to be overwhelmed by events. And I think the BIS, I think, is right that we should not continue to pour money into the system of liquidity. But I think the BIS underestimates the power of capital controls. I think we should re-think. I think we should re-energize the Bratton Woods arrangements logic. We need, because you mentioned, Mr. Buddha, you mentioned the need for the EU to work together with Americans, the Japanese, and the Chinese. The Bratton Woods arrangements were policy coordination in action, clearly, with a clear logic. But we don't want. You know what's the mantra? And I heard it the other day. There is no way to have policy coordination. There is no way. If you start with a working assumption that there is no way to have policy coordination, you're not going to get it. What shall we wait for? For asteroids to hit planet Earth or aliens to come and to force us to work together? I mean, this is the sheer.


Urban development can lead to increased flood risk in cities due to changes in hydrology and meteorology, as well as increased vulnerability caused by urban concentration. These effects are better understood than the relationship between urban growth and floods due to microclimate changes. Climate variability and change could further exacerbate these risks. In the Mekong River Delta city of Kimdo, Vietnam, we simulated future scenarios combining climate-driven sea-level rise, predicted river-level increase, urban growth, and microclimatic changes. Our results suggest that under a combination of these factors, flooding could increase significantly. To mitigate this risk, detailed research into adaptation measures is needed to ensure effective investment. This article was authored by H. T. L. Hong and Apatharana.


Coming up on DTNS, why Activision Blizzard threw GeForce Now under the level 100 mount? Why you shouldn't buy that gift card your boss asked you to? And a portable speaker with a TV remote built in. This is the Daily Tech News for Wednesday, February 12, 2020 in Los Angeles. I'm Tom Merritt. And in a remote location in San Francisco, I'm Sarah Lane. In an undisclosed space in Salt Lake City, I'm Scott Johnson. I'm in my bedroom and I'm the show's producer, Roger Chang. Yeah, Scott, Sarah really is in a different location. You're trying to like pretend you're not in Salt Lake City. What does she get to have the cool bunker? Yeah, I want to have some sneaky, spy-like sound in cool place that I am. Not really. I'm just in my same place. We were just having a good conversation about oat milk, PR 40s and horror shows on Good Day Internet. You never know what you're going to get, but it's always fun and it's always good. So get the show, become a patron at patreon.com slash DTNS. Let's start with a few tech things you should know. Well, we thought it might happen and it did. Mobile World Congress has been canceled for the first time in its 33 years of running. Spanish health officials said that there was no reason to cancel, but GSMA CEO John Hoffman told Bloomberg, the CSMA has canceled Mobile World Congress Barcelona 2020 because the global concern regarding the coronavirus outbreak, travel concern, and other circumstances make it impossible for the GSMA to hold the event. On another coronavirus note, Reuters sources say that Foxconn expects to have 50% of its Chinese production back by the end of the month and get back to 80% Chinese production by March. Let's hope so. Reuters saw a document indicating EU antitrust regulators plan to investigate emerging markets in tech and consider preventative measures to help smaller rivals to big companies. European competitor commissioner or competition commissioner rather, Margaret Vestiger. Marguerite Vestiger. Yeah, there you go. We'll present the paper in March. Meanwhile, Facebook postponed Thursday's launch of its dating service in the European Union due to concerns from Ireland's data protection commissioner, US federal trade commission voted five to nothing to ask for public comments on whether the rules for influencer endorsements should be tougher. Right now, they're just guidelines, but FTC chair Rohit Chopra wants to make current disclosure guidelines binding and possibly include civil penalties, which might include fines. WhatsApp has a lot of users. The company announced it now has 2 billion of them, up from 1.5 billion users two years ago. That makes it second only to the Facebook app itself, which has 2.5 billion users. And I'm shedding one single tear, no more or no less, for Andy Rubin's essential phone company announcing it will shut down, citing an inability to find a clear path to deliver its project gem smartphone to customers. I liked the essential phone the first round. I was skeptical about project gem and apparently there was reason to be. Essentials phone will continue to work, but it will not receive updates and Newton mail, which essential acquired will shut down on April 30th. Doesn't mean your Newton will work ever again. It's inessential. All right. Let's talk a little bit more about that, that remote control speaker that I was talking about at the beginning of the show, Scott. The big question is, is it a speaker with a remote or remote with a speaker? You decide Sony announced a remote control that is also a portable speaker, or is it a portable speaker with a remote control built in? Again, the question just keeps banging at our head. The SRS, excuse me, LSR 200 has a pair of two watt speakers and a center unit tuned to human voices. Speaker sits in a charging base attached to the television. It connects to the base using 2.4 gigahertz wireless and can play audio simultaneously with the TV speakers, so you can take your audio with you. The remote on top, excuse me, the remote on top includes the usual number of up and down buttons that comes to Japan in February 22nd for 20,000 yen, which is about 180 US. We were talking earlier, like the big use case would be, I'm watching the game. I don't want to pause and get behind. I got to go to the bathroom. I'm going to go do that. I'm going to take this with me. And while I'm gone, I can hear the play by play and hear what's going on and still go take care of my business.  Yeah, but, but you're right, Scott. This is it. The perfect example is something like, you know, a good show or yes, an important sports event or something where, you know, pausing pausing is more available than ever for a lot of people who watch TV now. But then if it matters that you're five or 10 seconds behind and you're on Twitter or, you know, something like that, then this does come in handy. I like the idea. Like a lot of times I'll head into the kitchen to put the dishes away because we're watching TV while we're eating dinner or I'll run in to get some more water or something. And I can just barely hear the audio coming from the living room, which is right next to it. That'd be nice to have a speaker in there that I could take with me, but I guess I'd have to pick it up and then take it with me. I guess it's more if you're cooking. That way you can hear what's going on on the game. I'm attracted to this idea, but I doubt I would use it a lot in practice. So I'm not sure it's worth, you know, close to 200 bucks. I would have used this in the 80s and 90s when everything was, there was no on demand. Everything was just live when you caught it and that was the only way you were going to get it. And I would, I can think of a million use cases when that would happen in this particular case. I think it's neat also that this sounds kind of cool, but I don't know that I would use it so much in our on-demand world we live in now. Just too much. It's really only compelling for live stuff where you're like, I don't want to pause because I don't want to fall behind in the game. Right. And the fact that it's the same device that you would pause with and you're taking the remote with you, if you're with other people, are they irritated? You can just do it with any speaker to be honest. You don't need the special remote on top. That just gives you the opportunity to like turn it up or change the channel. But why would, I don't know. I also like how Sony just put no thought into what we'd call this handy contraption and just called it the SRS LSR 200. Yeah. This obviously came out from the same people who named televisions. Moving on now. Agari's quarterly fraud and identity deception trends report found that gift card phishing schemes. Maybe you've heard of them. Maybe you hadn't. Accounted for 62% of all business email compromise attacks. So an attacker could get control of a business email account and then use it to pretend that they were someone's boss and ask a subordinate to purchase gift cards, especially during the holidays. Multiple employees are usually messaged at one time. Then the amount collected in a tax can be anywhere from $250 to $10,000. Make a lot of money this way. Gift cards can be cashed out immediately and are also difficult to trace. So it requires some kind of phishing or something else to get into the account to begin with, but then that's how they cash out. If they're like, yeah, we don't get a lot out of trade secrets. We can't convince anyone to do wire transfers because that's where you get the big money. If you can do that, that requires a little more sophistication. This one's easy. You just comb through the boss's email till you figure out who his employees are. And then you say like, hey, we really want to reward Tracy for all their hard work. Buy, buy me a hundred dollar gift card from Amazon and send me the code, right? And then you do that to like 20 different people and suddenly you got 2000 bucks. Yeah, it'll add up pretty quick. I always wonder why gift cards, most of them have expiration dates on it. Is it because they don't want to get, I don't know, fraudulent toward the back end, like three years later or something? That is part of it. There's also an accounting reason because that money isn't income until it's spent. I see. Depending on how you account for it. And so the expiration date will help you say like, okay, at this point, we're going to say that that money was spent and we can count it on our balance sheet. Okay. I feel like I learned a little something new today and that's fantastic. But anyway, I'm all about having less of this sort of stuff happen. My mom got, got dinged again this week for something that's not related to this, but it had to do with some credit card stuff. And she almost got a major fraud thing happen. And I'm to be honest, super tired of it. I also hear the lot of, you know, there's a lot of campaigns going on, campaign stuff going on right now. A lot of those aren't actually real. I just, I hope people are careful this time of year and don't get hurt. Yeah. That's when I hear people talking about like, oh, you can get those discount gift cards online. They're like, I'm sure there are plenty of legitimate versions of that, but it's, it's rife with fraud out there. So be careful. Yeah. I'm trying to, and I'm sure there are a lot of people in the audience who are like, Oh no, this is actually a common practice. I cannot think of any time where someone may have emailed me and been like, Hey, do you know this? Let's get this gift card going for Tom. I've got it. I've got a good job. I think I'd be like, that sounds doesn't sound like you. Jackie Hearn, Jackie Hearn, who does the book keeping for, or the, the booking for cord killers. We, we, some of Brian and I were emailing each other and like, Hey, wouldn't it be cool to get Jackie a thing? Yes. Let's get the thing was I bought it and I sent the code to her and send the code to anyone else. So yeah. It's all right. Malware bites put out its state of malware report. And for the first time, uh, detected 11 threats per endpoint for max in 2019 compared to 5.8 threats per endpoint for windows. That's an increase for the first time of max over windows. Uh, they attribute this in part to just a general increase in max market share. There's just more people using max out there. So there's more end points, which means they become a richer target. You know, the, these numbers are per capita essentially, but, but once you've got more people using them, more bad guys want to go after it. Uh, malware bites also says Mac OS has not cracked down on borderline malware like adware as hard as it has on other serious types. So maybe that's why you're seeing not so much the really damaging malware on the max, but you're seeing a lot of adware and pups and stuff like that. Uh, and also, uh, this is based on malware bite software users and there are more of those on the Mac platform than there used to be. So that's, that's going to give them a bigger data set to draw from as well. Uh, but I think it probably has to do with the fact that there's a lot of adware. Uh, in fact, adware called new tab was the top detected Mac OS threat. Uh, and all but one of the Mac OS threats detected required a user to be tricked into downloading and opening something. Uh, the only one that didn't was a zero day vulnerability in Firefox that has since been patched. So these are adware. Uh, they're not super serious malware. Uh, they're not great, but they're, they're adware or they're, they're pop ups. Uh, but, uh, interesting to know that if you are using a Mac, you still have to think about your security. It's, it's, you know, it's not security through obscurity by a long stretch anymore. So for, for the uninitiated out there, can you tell them what end point specifically means when they just means, uh, your laptop. All right.  You're the end point. Okay. That makes sense. Uh, I'm, uh, yeah, be careful. Like ads and stuff is bad. It's much better than or adware rather. It's much better than having your system files all messed up or something from something way more malicious. But, uh, you know, nobody wants 11 threats compared to 5.8. Let's get it together. People come on Mac. Come on safari. I guess who's to blame. I don't know. I think the one that really pay attention to is this all required you to download and open something. And then, you know, for decades now, I've been saying, don't open attachments. Don't click on links. You don't know where they come from. Uh, and, and that's the best way to protect yourself. It's not wrong to run something like malware bites as a backup. If you want to just make sure, uh, but best, best practices will help you avoid most of this stuff. Well, US national security advisor, Robert O'Brien noted, uh, he's not really from Ireland. I made that up. Told the Wall Street Journal. We have evidence that Huawei has the capacity secretly to access sensitive and personal information and systems it maintains and sells around the world. The evidence is being shared with allies, including the UK and Germany has not been made public just yet. The journal says the US has been aware of the back door since 2009 when it was observed in 4G equipment, but did not say if it had observed Huawei using the access. That's an important part, I guess. Network equipment from all companies must have a way for authorities to access the network for lawful purposes, but without the manufacturer having access as well. This US, sorry, the US says Huawei built equipment that secretly preserves its access to this function without carriers knowledge. Huawei denies the accusations. Yeah, it's important to know what's going on here. There are ways for the carrier to access its own equipment, and there are built-in ways for the carrier to be able to allow law enforcement to access that equipment. The way it's supposed to happen is those ways are secured, just like you logging into your laptop, you can log in, but other people can't. The equipment is supposed to be secured so that only the carrier can authorize law enforcement to access it, and the manufacturer couldn't go use that. What the US is attempting to say here is, okay, but what if they didn't? We think we have evidence that they didn't, and they've said they've had evidence but haven't shown it to anybody. Now they're saying we're showing it to allies, but they're not showing the public, so it doesn't help any of us understand what that vulnerability actually might be. Well, that's interesting. I mean, they're always in the news with issues like this, and I'm, I mean, I don't like the idea that any company may secretly have a backdoor that they're not telling us they still have access to, but if they deny it, isn't it easy? Isn't this like the easiest thing in the world to say, well, here it is right here? Like, can we just, like, if they're denying it and it's a bigger deal or grows past this. There are good reasons not to make something like this public. There might be security and confidentiality agreements, but if you're really pushing for people to not use this equipment because of a danger, it's to all of our benefit in the modern security world to make that vulnerability public. And yes, I am suspicious of something like this that hasn't been made public, but I'm not, I should say skeptical maybe, better than suspicious. I would like to see more evidence because it's easy for anyone to say one thing and when you look at it go, well, wait a minute, that's not really a backdoor. That might just be incompetence. That might be a vulnerability that's there that should be patched, which we definitely know those exist on Huawei equipment. Sure. All right. This next story may blow your mind. Get ready, everyone. A new feature of Google's Gboard keyboard called Emoji Kitchen, lets you combine emojis into one and then use them. The combined emoji is a sticker in your messaging app, including WhatsApp, Telegram, Snapchat and Messenger. Google designed the combos by hand. Well, somebody worked hard on it. You can tap on an emoji in the keyboard and it will suggest pre-designed combinations that you can use. The feature starts rolling out to Android users today and I am jealous. I, as soon as I found out these were pre-designed, I got a little less excited because I just wanted to go through and like make some unholy combinations of things. Right. But you know. A witch holding a flag or something. But maybe that's why they don't have to do that. Like, come on. You got all this machine learning. Google, you couldn't just do some machine learning emoji combos going on? What the heck? It's funny. Emoji story. Emojis, I'm fully on board.  It is not. It's in the right context. I find it very funny and you can get very clever with emojis. So this is just taking it one more level. I don't know how much I would ever use it. I don't use most of the emojis that are available anyway, but but I like the evolution. To me, this is like the me emoji thing or anytime you add more features into texting apps and that sort of thing. And you push them out. They're usually this sort of thing, right? Like more, more emoji functions, more stickers, more animated stuff.  That stuff's fine. I just has never interested me that much. I love the idea of what an emoji is, but I'm so old school about it. I still just sort of, you know, semi-colon close parentheses. Just know I'm grinning at them and then I'm not actually searching around for quote unquote the perfect emoji to express how I'm feeling. So I'm probably not the target here, but at least this is interesting. I do wish like Tom it was more, I don't know, mix anything with anything and just give you the power to do it. The fact that these are curated is a little bit of a bummer. Yeah, Google, use it. Use one of your data centers. You can make every combination of emojis possible, darn it. Use the cloud, Sarah. The cloud is probably better pre-designed. I'm just mad because it hasn't shown up on my phone yet. Although I just accidentally sent a smiley face to my wife trying to see if it was there. So it might have made her day. Yeah, exactly. Hey, folks, if you want to get all the tech headlines each day in about five minutes, go to techheadlines.com. Bunch of gaming news today, and we happen to have the host of the instance, one of the premier Blizzard podcasts on the show today. So let's talk about Activision Blizzard removing its games from NVIDIA GeForce Now. That means Overwatch and Wow, because Blizzard, but also Call of Duty, because Activision. GeForce Now, you may recall if you've been listening to the show just officially launched its game streaming service last week. It had been in beta for two years just fine for the two years, but a week after launch, gone. NVIDIA, of course, says it hopes it can work out a deal to bring the games back, but it doesn't sound like that is going to happen. Scott, what's up with this? So there's been a lot of hymning and hawing, which is a popular sport in the world of Blizzard fandom. People like to just sort of pile on Blizzard. I've tried to sort of pull away from that a little bit and look at a broader perspective here. I think it's a bummer, especially because it was around during beta, which would normally indicate, hey, if you're playing things on battle net, then good chance when this thing goes live and you want to be a founder member and pay the 499 a month that you'll be able to continue to do it. And that just isn't the case at least a weekend of the launch. The reason Call of Duty is not included. This is just an important piece to clarify is it is also part of the battle net launcher. It's part of their partners tab, which is really just Activision games. Normally if that thing was on Steam you could run it just fine because this thing will run steam games, epic games, you play games and lots of stuff in between, including standalone games that don't need any sort of gaming service or store. The fact that they pulled that probably has more to do with what you're going to tell us about next, which is their deal and their connection with Google and made possibly a long running partnership. Yeah. So there's there's a lot of speculation that this might be because Activision Blizzard wants to move all of their games to Stadia. Google does have a multi-year partnership to bring Activision Blizzard eSports, both Overwatch League and Call of Duty League to YouTube, and Google Cloud handles Activision Blizzard's game hosting and streaming. So there are existing relationships between the two companies. But of course, you know, these companies are big. So just because they have a relationship with one division doesn't mean they automatically have a relationship with another, but it's not beyond the realm of possibility that during one of these deals you should talk to our Stadia folks and they get a conversation going. We don't know anything about that happening. What do you think the chances are of that being behind this? Well, I mean part of me thinks that that is the reason because it just everything sort of points this idea either that or they're just sort of holding onto their cards until they kind of know what's up. They really don't lose anything if they went ahead and just stuck with the now service or any other service like GeForce Now. I think the disadvantage to them is they're not communicating anything and it's not their product. So they don't necessarily have to, but given that their game was working during the beta, I think it would behoove them to be a little more transparent and talk about it. Just maybe even a post in the forums. Like, yeah, we know a lot of we were used to this. It's in a bit of a holding pattern right now. We promise to let you know as soon as we can, whatever the message is, I wish they would do that. But as far as this being the way, I have one other concern and that would be if they're going to use Stadia as the back end for how people will stream their games, that's going to require people being able to log into their, into a virtual machine or an actual machine on a rack into their battle net credentials and launch those games from there. And because that's how it works with everything, you know, this now service, that's how it does it with the other services. You got to log into Steam to use it and that sort of thing. So they're going to have to allow for that. As far as I know, at least the current rollout implementation, Stadia does not have that. So will they, when they do their bigger rollout at the end of this year, probably something like it? You know, will Blizzard be a part of that? I don't know. But none of those things have been made public or have been talked about at all. So my main concern is that, that they're actually nowhere near a deal that means you'll be playing these anytime soon on the cloud. And that's the bummer is people are going to have to wait to find out what's going on here and in typical Blizzard fashion that could be 2021 before anything really happens. So there's also the fact that the Blizzard turns of service kind of confusingly forbid you from using a cloud service to play the game. That's really meant to prevent bot nets, right? That's, I mean, Blizzard games have been on GeForce now legally for a couple of years in the beta. So it doesn't have to do with the terms of service, does it? No, because the, well, I mean they may have to adjust those terms of service to be a little less broad about what cloud gaming is. But in this particular case, like when I was using the service earlier today, I needed to log into Uplay in order to play a game. And I did that. It's like it's a machine just not here, but I'm still interfacing with it. It's like my monitor has a really long cord to a machine in a room somewhere. And I put in my credentials and I say everything's good and I hit OK and I put in my code and boom it's as if I'm playing on that machine. It really shouldn't be any different and hasn't been during the beta period for the Blizzard games. They just are not allowing it. And my thinking is either one of two things. Either they really are, you know, making camp with with Google on this and that's the plan moving forward or they don't know what they're going to do yet and they're holding to see what their best option is because one of their options could be battle net supports this natively. It could be that you install battle net anywhere and battle net acts as a cloud platform for their games. That wouldn't shock me. And nobody is really talking about that, but that's entirely possible and it keeps it all under their own umbrella still. Nobody else is getting residual money. They could charge for it to say hey for another four bucks on top. Wow or whatever you may be able to access your Blizzard games from no matter where you're at and mobile and desktops and windows and Mac and everything else. That's entirely possible. But again, we know so little that any one of those three options could be happening. Well, that reminds me of one of Google's stated aims with Stadia was to say we also want to provide the service for game companies to white label and roll out their own versions of and that's where Blizzard having a deal with Google Cloud starts to make a lot of sense with Google Cloud's like hey, would you like a white label version of Stadia to provide to Blizzard you know, to Blizzard folks who already own the game would just add that on to your package that they could be the first to do that. I'm not saying it will be but that theoretically is possible and would explain all this. I just don't understand why this happened the next week you would think at launch they would be like well we're losing the Blizzard games but it's out unless Nvidia talked about like can you just wait a week so it doesn't happen the same day as the launch. I mean it's entirely possible they did who knows because nobody's saying but this is also another problem right now people have with Blizzard. Blizzard's not being very communicative lately. They've had a lot of problems in the last year and a half they don't really get out in front of it that's what's going on. So this just feels like one more of those. I don't think that's exactly fair because this isn't necessarily a Blizzard thing this is more of an Nvidia thing and they're dealing with Blizzard not the other way around. So I think people should back off from that just a little bit but yeah I wish they'd get out in front of it talk about it and say what their plans are and if they do a standalone client that does this and it's part of Battle.net which is already on other platforms great that sounds great like just tell us what you're doing or at least give us an indication of what we can expect. A couple other things before we wrap this up. Microsoft launching a beta for Project XCloud it's game streaming service through Apple's test flight. So if you're an XCloud beta tester you can try the service on your iPhone or iPad it's the first game streaming service to show up for an iOS device since on live because Apple has a lot of restrictions on what you can do with your device. Those restrictions apparently lead to the fact that Halo the master chief collection will be the only game available to the 10,000 preview testers. The app is limited to XCloud so it does not include Xbox game streaming feature just XCloud playing Halo the master chief collection. Small the only thing I would say about that is it makes sense to me that they would keep a very narrow test. People shouldn't read too much into the fact that it's only one game I think they just want to have the most basic test they can do on the game that is going to be the biggest thing on the platform start there and then build it out. And finally in a sign of the true of E3 Jeff Kealy is not going to be there for the first time in 25 years so that's it right yeah that's it that's the end of everybody no it'll be fun Jeff's got his own stuff going on now he's a very busy dude this doesn't shock me he's been there for a long time it's time for him to move on do something else thanks to everybody who participates in our sub Reddit lots of gaming news there as well as tech news that you care about submit stories and vote on others at daily tech news show reddit.com you can also join in the conversation in our discord which is a lot of fun to meet some of your dts peers you can join by linking to a patreon account at patreon.com slash dtns let's check out the mail bag I think that's a great idea Tom Marcus in frigid Minnesota sorry to hear that Marcus hope you're staying warm says friend of the show Paul thought had an interesting premium article on his site claiming that windows 10x is much more ambitious than Microsoft is publicly suggesting his views that windows 10x is essentially a new windows NT making meaning a different platform that retains app compatibility and will eventually replace windows 10 this would mean that all the benefits of windows 10x won't be limited to dual screen devices emphasizing dual screen devices is a way to make a splash while at the same time exposing the new OS to a smaller group of users prior to windows for replacing windows for everybody at a later time the article is a fascinating look at how the new OS works and the goals of the platform in the long term that has historical precedent throughout the smart guys been following this for a long time makes perfect sense to me that after all of the trials and tribulations of windows 8 and the Metro tiles and the universal apps that Microsoft would say you know what let's just use dual screens as a way to make an entirely different operating system we won't replace windows 10 we'll just let people start to decide for themselves if they like this one better because it's got these cool features because they've been wanting to make a simplified version of windows that's more universal with apps for a long time this could be the way to do it makes perfect sense to me thanks for the email Marcus thanks to everybody who contributes to our mailbag and also shout out to patrons at our master and grandmaster levels including Martin James Bjorn Andre and Tim Ashman also thanks to the one the only Scott Johnson Scott what has been going on in your world yes you can go over to frogpants.com and find it all in particular I put up a new comic in my series called Fred and can it's just Monday if you want to learn more about a guy and his expired can of cream corn and why they have conversations with each other the only place to do it is fredcancomic.com and are also linked on frogpants.com and as always if you want to poke me in the public find me on twitter at Scott Johnson I love that comic so much folks we have new patreon reward merchandise to celebrate six years of DTNS Len Peralta created some special six-year anniversary art you can get it on a sticker a poster a mug or a T-shirt get the details at patreon.com slash DTNS slash merch our email address is feedback at dailytechnewshow.com I mentioned that we like your emails keep them coming we're also live Monday through Friday 4 30 p.m. Eastern 21 30 UTC is when we do this show join us if you can and find out more at dailytechnewshow.com slash live back tomorrow with Justin Robert Young talk to you then this show is part of the frogpants network get more frogpants.com club hopes you have enjoyed this brover


people as he made history in this country, so that I could go to one lady, Janet Cieposke. 1974, 451 meters village, Francis Musiochi. History that he has made is the only athlete who has become a professor in Kenya. He is currently a lecturer at Kenyatta University, here in Kenya. This is Musiochi. Ah, Musiochi is there. Now Charles Assati, in the 1972 gold medal. Kim Ayo, happy to be here. And 2800 Mr. Barcelona Olympics. Gold medal. Those days, those years, the President of the National Olympic Committee of Kenya, a member of the International Olympic Committee, and Ambassador, and he is a Lieutenant Colonel in the Defence Forces of the Republic of Kenya. I know you have supported some of them, but at least now you can see they are still going strong. And you can see their faces. Very happy people. Very well known, you know, very well known, wherever they are. And we want to wish them well to continue naturally kind of athletes who are coming up. So they are doing a wonderful job, and we want to thank them for whatever they are doing, wherever they are. I'm sure you will not mind taking a photograph with them.


Everybody four syrup being 2023 Bowman sterling baseball hobby four bucks number six picker team style got Bradley e with the angels and Cardinals Charles a Yankees Corey s blue jays Eric s Brewers Gabriel C. Diamondbacks Gregory M Cubs Pirates Jeff B with the Mets Joe H. Orioles Keith J Dodgers Mackenzie with the White Sox Mark has the Red Sox Matthew B nationals and Rockies Michael C Mariners Michael B different Michael B here So Michael B you was Nats Rockies Michael B is Tigers Minku with the Giants Rick G. Guardians Robert P. Padres and Rangers Russell F. A's Ryland with the Braves Scott T. Rays Steven U. Reds Tim H. Phillies Tom C. Astros Royals Marlins and twins. Good luck everybody four box number six Let's get decadence filling up here decadence hit draft style High-end pop century Here bring the Tampa he buy the cannons. Oh, no buy the cannons Jake is live trolling right now. It's crazy. What an honor. Yeah, Jake, how many dubs you gonna get tonight? A lot of dubs No, dude, we didn't very bad it was Matt Dylan Jake and I do we were getting just destroyed There's one of it was one of those nights. We play four games, and I don't think we made it past like the first five ten minutes Corbin Carroll Redemption here after after Al-Shamir is to 199 for the Mets and redemption is Drew Jones Prospect auto speckle parallel diamond backs. That'll be number to 99 Grats diamond backs. Let's go and holiday scooter and shaker Tampa buddies. Oh boy. Let's go man Not these two Wave auto Brooks Lee to 125 really good box here.  It's all it exists, but I sang a auto young kill Fernandez Rockies And as a good one, dude, that would be amazing Shane gilded basketball gilded football Do you imagine a if women Yamaha that girky gilded I'm so excited for 2324 basketball products start coming out The next is a wave auto liver piglet oh pirate circuit 125 It's a brown Josh young as the parade. You didn't lay one to the parade today Y'all are you got the presidential suite I've got her Henderson Auto drew Gilbert for the Astros apparently they're saying that happens to lane a lot for some reason in your common arrow Yeah, I don't know Maybe they saw the company credit card and we're all right The floor is 60 ceiling is like 600 I think it's all detailed Corbin Carroll Wave the 125 auto pirates to Mar Johnson nice card. It's the nice autos today We need like a super low number a big get a triple or a double something like that here black lava number to ten Rookie Jonathan Aranda seven out of ten. There we go Tampa black lava for the rays Sterling silver autos and it's in Paulino to 100 Red Sox very good back. It's Michael Harris past Latino It's one ninety nine rookie Burleson for the Cardinals and autograph Willie Faunas Mets Colosson Naylor World Series Winner 2024 life depends on it go Well, Jake's dead Sean probably as well It's so like nothing's happened in the offseason yeah, so what's that can happen like Poseidon Paula Dodgers auto. I'll say Dodgers Say Dodgers Yeah, let's go scooter. Let's go Jones Let's go man Tampa heat That definitely not Tampa The clan of hands out for the year like no way Jake the offense came back down to earth a second half Look, I just don't think a team with Yanni Diaz hitting Second third or fourth is gonna it's gonna do it a Gold auto Anthony Gutierrez for the Rangers number to 50. That's a very nice one could be braves I mean good dude could be Rangers again. They don't really lose anybody Could be right. I mean Rangers are gonna have Scherzer for a full season now They're not who the Rangers even losing They're not losing anybody from the core They could they might I know of all these sign of what two or three year Their core is still there. I guess you just you supplement that you got Scherzer You're gonna have to grom theoretically at some point Orioles, I don't know man They need to bring in like they need to make a splash signing the re-signed clarity Resigned flirty and they need to have some sort of like flat splash signing. What about the Bautista injury? That's not that wasn't like tj. Was it? Yeah, it was Many diamond 150 rookie Jordan Groshan's Marlins All right, I'm back on the Red Sox we're getting on moto we're getting no Tony. I Didn't say the time Marlins auto Gabriel Gonzalez Mariners Costs this James outman even if common arrow and and meat are like really good. I Don't I just don't see it because they're pitching depth was what bit them They were good until like Their decent relievers went down. Okay. The debt that it's told me it's shot the plan is shot Josh Winkowski World Series MVP next year got gold of 50 Kumar rocker for the Rangers Two golds for the Rangers in this box and then in opulence auto is rookie Corbin Carroll Diamondbacks Numbered five of 99 Big one diamondbacks dude. That is so sick looking that is very clean Gabriel C with the diamondbacks That's pretty I think I've moved to Boston I would go rent some tiny apartment in the Boston area Every Red Sox home game before Tony was there Got an auto chased a lotter for the Guardians Take a seven month leave from work Chase the lotter guardians get some like dishwasher job up there or something sure Like I need to work mornings because I need to be out of here by noon every day Just case there's a day game work the the 4 a.m. Shift at the old at the old 7-eleven or something Next up is a speckle to 99 Jordan Beck for the Rockies and auto you have some Mercedes Twins Dude Beck is awesome Eight year olds know you are Tigers trade bias the Red Sox and Tigers in World Series next year The Tigers are gonna lose their best pitcher Well, I mean It's at least most reliable pitcher. I guess I'll say it that way and toes auto Daniel Montesino for the Padres What do you mean main character? Well, I just you know Padres being character. What? It's a two-person show Three person when Jake is here Gotta have hope you do have to have hope but that's also a dangerous thing your heart's gonna get broken I have a little bit of hope for the Red Sox. I'm not gonna We'll have to see what old Craig Breslow is allowed to do. Oh, yeah Hey, 2013 World Series winner Craig Breslow At all. Hey, no, it doesn't matter who's GM if the Yeah, but it doesn't matter who's GM if If the ownership doesn't want to spend money, then we're gonna be like the same place We'll be young kind of Building team who's too popular Sean? Oh Wave the 125 auto is Jacob Berry for the Marlins. Oh, man I think we got a triple and it's purple jerseys. Oh, come on. I think we got it We do we've got triple auto Rockies young kill Fernandez Deon Jorge and Adele Amador Wow Three of 25 They're all I think Fernandez and Amador are the top two Rockies prospects and Deon Jorge is another top 10 Rockies prospect And I think they're all top 100 as well That is sick. There we go Rockies dude. I was saying the Rockies are like so slept on in this Matthew be you with Colorado? That's gorgeous Sick, that's like the base triple to 25 right there Looks so good Sean can't say a word for us. I do and what is Enrico talking about right now? Sean just said a few words actually Sterling silver to 100 rookie is Max Meyer Marlins And auto here is Simon Juan for the Mets One Yeah, it's all the motion I'm not gonna give all these slices out You've got slices like it's candy gonna make this last and make this thing last see this. This is Six series six series for payments for dollars gold tech gold sterling tech is Bobby Witt jr. To 50 For Kansas City gold sterling tech and an auto is gonna be junior coming arrow Tampa Bay Tampa heat Tampa heat right there. Come on Let's go. Jake is getting this guy amps right now. He's been in the shop all day snoozing He is bringing the Tampa heat. He's bringing he actually is Tampa heat is definitely like a minor league soccer team It's a minor league soccer. What's the what's that Tampa soccer team called rowdies? Yeah, they do stink That's interesting Autograph Gutierrez for the Rangers good Rangers break here had the gold one of these earlier as well into gold What was the other gold Rangers card I forget That's awesome Matt such a cool card man Rockies are slept on I get it though. It's the Rockies. I understand why but man They got some talent. So 199 is Gonzalez for the Mariners Gabriel Gonzalez Shrouded I would be peace and quiet and Rico. You're the only person that's ever said that and A speckle auto to 99 for the Rockies Jordan Beck a little cherry on top of the break for you That is a good one too. He's like their number five prospect. I think We're in Beck have a break not a loser That's really don't like that. I feel like you would I Got some definitely hasn't See in Creed Yeah, we were playing Creed yesterday Very away right here Chat in disgust All right, here we go numbered cards. That was a great four bucks by the way the best one of the day I think overall for sure And it was the last one until later Here we go Gonzalez Alec Burleson Alex Ramirez Jordan Groshan's Max Meyer Jordan Beck Bobby witt on these sterling a tech gold the 50 a gold Kumar rocker are on the black lava to 10 Autos now Anthony Gutierrez Junior Cominero Simon Juan Daniel Montecino Yossir Mercedes Chase Delotter Gabriel Gonzales Jose de Paula Willy Farris Drew Gilbert young heel Fernandez wave Brooks Lee to 125 twins auto Barry Marlins there Piguetto Pirates and Tamar Johnson Pirates. This is a really good break overall There's a lot of nice hits in this one Paulino to 100 Red Sox Beck to 99 Iraqis Gold Gutierrez Rangers, that's a nice one. He's kind of slept on to I think Rangers has a good prospect still Even after ever car. I think Evan Carter technically graduated now He's maybe not even yet. He's the only played like a few weeks of pro ball until the post is like 22 games I think he's still technically a prospect Drew Jones on the redemption prospect auto speckle parallelly number to 99 congrats Diamondbacks, you know, it's pretty cool You also got a Corbin Carroll opulence auto to 99 Holy cow and triple auto for Colorado Fernandez Jorge and Amador 8 of 25 What a break. Thanks again everybody. We're moving on to some mixers


My name is Medea Benjamin with Code Pink. I've been in Congress every day for the last three months, but today I want to address the occupant in the White House. You know, that Joe Biden used to cultivate an image of himself as this nice, kind Uncle Joe, because he had suffered such losses himself. Now, he is no longer the Comforter-in-Chief. He is known as... So when I say Genocide Joe, I want you to lift your hands. Genocide Joe, Indian people, have risen up against the 75-year-old, brutal Israeli occupation. Instead of sympathizing with their plight and seeking a real solution, you have reiterated your rock oppressor, Genocide Joe Biden, in these last terrifying three witnesses, the precious Palestinian children, when we have heard their soul-wrenching cries trapped in the rubble. Instead of demanding that Israel immediately stop this atrocity, you bypass Congress to send more weapons. Genocide Joe, the bloodline and the overwhelming majority of countries came together at the UN to put an end to the slaughter, and instead you vetoed the UN resolution.  Please don't wonder why you've lost the support of the young people, the Muslim community, progressive Jews like myself. Time will not heal this wound. Come November, we will remember because Genocide Joe. But to counter these policies and those of Congress people in the pocket of APEC, just living a beautiful, enormous, multi-generational, multi-ethnic, groundswell of support for the Palestinian people, be appeased or bought or contained or stopped that will only keep growing and growing until Palestine is free, free, free Palestine.


And the Trevor News was kind of a bummer because we don't know what's going on and we're gonna keep our eyes on it. But Gronk and I don't give an F, everybody, because we do what we do every week. Here is the Thursday night football, no sweat, same game, parlay. That's right, no sweat. Gronk and I cooked it up. Alvin Camaro, 25 plus rush yards and anytime touchdown, that sounds great. And I went heavy, Travis Etienne. So that first one was Gronk's leg. And then I said Etienne, 40 plus rush yards. And then I doubled down and said he's gonna have an anytime touchdown as well. So, you know, two guys, four props, one parlay, zero sweat right now. Travis Etienne, Alvin, Travis Alvin. It is about the run game because we don't know what is going on with the quarterback stuff. So all Fandall customers can join our same game parlay, ride it with us. It's been a lot of fun on these Thursday nights. You can get bonus bets back if it loses or simply build your own. So don't miss out a chance to join in on all the fun on Fandall America's number one sportsbook.


Hi, my name is Stephen Klafke and I'm the Chief Deputy County Attorney in the El Paso County Attorney's Office. I've been with the county for just about 10 years now and I've had the honor of supporting every elected office and most of the county department. One of the interesting things recently that happened for me was I had the privilege of being appointed the Interim County Attorney by the Board of County Commissioners for just a little over three months while they conducted a nationwide search for a permanent appointment. I'm actually a native of El Paso County. I was born and raised here and only left for a short time while going to school.


It's the end of the day, so everyone's like chatty and ready for beer. Yeah, so we'll be starting in about a minute here. It's mic, so it doesn't matter. All right, well, I guess we can probably begin, and then people can come in as we get started. So my name is Ryan Wheel. I am based in Montreal, and I've traveled, I guess, from Canada, and here I am at Drupal Con, so welcome. Today I'm talking about my session rather as called Shut Up and Take My Money, Using Stripe Checkout in Drupal 8. And this is how we built a simple module for Drupal 8, but also an easy solution for getting payments into Drupal and managing that process. We'll talk a bit about how you could potentially do this with other payment gateways and things of that nature. So first, what is Stripe Checkout? It's a payment gateway, but the checkout aspect of that is specifically for using embed codes to do this, and there's a reason that we want to do this, which we will see in the next slide. Just a quick visual of what this looks like is we have here just a credit card input form, and you see that it pops up over top of our Drupal 8 site. You also see that it has the currency code in this case, which is Canadian dollars, which is where I live, so we're building this for our own website because we want to charge people money, obviously, and we don't need a shopping cart, so we're going to look at these reasons. So Stripe is a nice gateway because it has multiple currency support. They support European money, US dollars, Canadian dollars, BTC as well, bitcoins. It is very easy for PCI compliance necessity, and this is something that has recently become more of an issue than in the past, which we'll talk about on the next slide. The benefit of doing this method is our site never sees the credit card details at all, so that's handy. The pricing, this is, of course, subject to change. I'm not affiliated with Stripe, so I just grabbed this because in the past people have asked me about this, but typically it's 2.9%, and then a small fee for per transaction stuff. And then Pay Now buttons are in fashion again, and the reason for that, drumroll please, is PCI compliance has been changed. So for those not familiar, PCI compliance is where the credit card industry, credit card payment card industry is what PCI stands for, is a consortium of the banks that process transactions, and they have standards that we are supposed to be meeting, so if you're ever collecting money on a site, you are subject to this. Now, what that implies is that you do a quarterly scan on your site to ensure that there's no security issues with your site, and then they have you answer a survey. So there's quarterly scan and a survey. Now, the survey has been updated, and so for circumstances where you're taking the credit card number into PHP and actually touching the credit card number, you have to go through a very detailed survey of like 350 plus questions, and in the case of web companies, a lot of what the questions asked doesn't necessarily apply to you, so most of your responses to those questions will be, like, do you have video cameras in this particular context, and they'll say no, and they'll say why, and then you have to say, well, we don't have on-site things, and things of this nature, so they've made special categories to deal with web agencies, and this is great, but we, of course, want to minimize the scope of this for smaller sites. Additionally, there is some changes in terms of the liability. It gets pushed down to the merchant now, so that's something that's somewhat new, and you must also document who is responsible for compliance, so that means, like, you need a paper trail to say, like, the client is responsible, or I am responsible as an agency. There's this great white paper that I've got in this URL posted here on the slide. It's produced by three Drupal developers who are mentioned at the end of the presentation. It's a really wonderful document. It explains everything. You can go through that and find out which category best fits your situation and then what the compliance needs are for that, so that's worth looking at. It's good to keep in mind that in the world of, like, Drupal 6 and Drupal 7, a lot of the times we were taking the credit card numbers and processing them ourselves, which actually puts you into one of the highest categories of, like, documentation needed, and that implies that you have network maps of where everything is located, as well as, like, your security procedures, as well as, like, your employees all having to have acknowledged that these things are all documented and everything. It's quite complex, so it's really worth taking a look at this. So in order to simplify this, what we've done is we've said, let's just use an HTML embed code and let's let Stripe manage all of that themselves. Now this isn't really specific to Stripe because most payment gateways do offer some form of solution like this. The benefit with Stripe in this case is that their interface is kind of pretty, so it's nice in that sense. It's also nice in the sense that most of their API documentation is written for developers specifically and provides wonderful examples. So we'll take a look at a couple of those things. And this way we can do, like, a simple implementation and we don't have to worry about it. So we're going to need a field that we can accept, we can put a number in and then that will render as a payment button. So this is what the payment button looks like. It says pay with card. You can override this, so that's a possibility. If we went into the documentation on Stripe's website, they actually do this wonderful thing where they inject all of your personalized settings into it.  So in this case my currency code is in there, which is Canadian dollars again, and then the data amount you see is 2,000. This is actually an integer because of course floats are really kind of unwieldy when we're dealing with money because we're dealing with fixed units and if the sense change because it's a float that can be quite dangerous. All of these things, most of them are static. We don't often change the name of our company. We don't want to change the icon very often. We don't really need to change anything, but maybe sometimes we might want to change the currency code because in Canada we often do a lot of business with the US. So that was one of the needs that we looked at when we were wanting to implement this. But of course the main thing that's changing time after time is going to be the amount. In my mind we thought about what are our storage needs, how much can we reduce this to a single item that changes and really the main thing that changes is the dollar value or rather the sense. So with that we thought we could just use an integer field and then that manages all of the storage for us and we don't have to go and create this monolithic module. We can use an integer field and that might be able to take care of this. It's a little side track diversion here. There is of course commerce that's being developed for Drupal 8 and it's a I believe it's like a major rewrite so there's some fantastic stuff happening in there. But what we found in circumstances where we just want to bill somebody is that we're often like undoing the things that are implicit defaults in a shopping cart situation so for example if you were wanting to bill someone in a cart based solution you would have to pre-fill the cart and then you would have to make sure they don't change what's in the cart and then you have to push them through the purchase process. So it's a little convoluted and it's a lot of detail and it's a lot of undoing assumptions so that's kind of like overkill so we decided on using nodes and again this is just mostly as an example but we are planning to use this in our site so the reasons we use nodes, nodes have always been well supported in Drupal going I started doing Drupal in Drupal 5 and everything was nodes back then, nodes are still good now. We can allow and deny access using a hook which is handy so we don't have to worry about creating custom entities so again like we have basically no storage yet defined at this point so we don't have to worry about even dealing with the database at all. If you're doing a migration you can migrate into nodes very easily because all of that stuff exists. You can also do custom entities but this was our, we have a minimum need so we're going to do the minimum first because we want a viable product and then of course we can support other entities with like trivial changes later on so nodes can do anything it's what we know in Drupal so now with that in mind let's like start to drill down our requirements here we want to feel that renders a payment button so it's going to pop up that interface now once that happens we have to know a little bit about how Stripe works and this would be quite similar to how the other gateways work with their iframe based solutions essentially what we're doing is we're taking the user somewhere else and saying can you go put your credit card over there and then that gateway comes back to us with the token so all we're dealing with is the token when they go and do that step nothing actually happens except that their credit card becomes a token reference at the gateway so at that point nothing's happened and then we come back with this token in our Drupal site and we can then make the actual charge using the token and we can see the result and deal with it there so now there's a couple limitations that we had to work around which is like okay well how do we mark something as paid and we realize that one simple solution is that if we approach it as though this field is actually a balanced due that if the balanced due is zero that means that it's paid so that's one little hack that we did so that we don't again have to create a storage interface for dealing with database things so really this is all just like a field formatter and then we actually use make use of the revision history of the node in order to change that value when it comes in and then we log stuff into the revision history so again like no storage requirement really really simplified and then important note that we because Stripe actually and all the gateways do this they kind of make use of you can use them as a back office so you can have your address information and sort with them you can do all of that stuff on their side and then you can access it using the API so we don't need to collect addresses we don't have to worry about like transaction logs and all that because that's all at Stripe and you can just export it so again we're simplifying things down to just like okay we really just need to render a button and then when it comes back we need to take the token and charge it so now that we've got that in mind we've got to like learn how to do Drupal 8 so the steps that we went through to figure out like how we can do this was to look at the core implementation you can use Grap to like look for things in the code base as well as like review the tests we looked at change records when we found that functions that we were used to using were no longer in existence the examples module handles a lot of things like how to create config forms things of that nature and then the really big surprise was that we realized this kind of the concept already exists and that's in the YouTube module and that uses a field formatter to render a link field with a YouTube embed code so again it's like really similar it's like we've got a core field and we're using an embed code and we're just like rendering it differently so that's to minimize our needs so now we've got it narrowed down to a really simple list we've got to make a settings page so we can put our API keys there we need to have a field formatter so we can render that HTML embed code and then we need to have a hook theme implemented to actually put that embed code on the screen then when the token comes back from Stripe what we've got to do is go to the HTTP library that Stripe provides again they've like been wonderful in like just creating this whole package that in this case you can just go composer install in the directory and that will fetch the library but you can also just like download it and put it there and then we're going to use the example code that Stripe provides in the documentation so now we've just got six steps so this is great let's take a look at how to if you've ever created forms in Drupal 6 or 7 I think going way back even further than that forms are simply arrays and they're easy to implement there's been a change to where the forms are located you can put those in the source form directory there's a form base that you can extend because we're now containing that in an object and form state so this is like the reply that comes back the form when you click submit is now an object as well so this is all pretty familiar but there's some slight details that have changed and of course there's also like how do we register the path to this page so if we look at this page here we've got a path defined at the top sorry it's quite small on this resolution but so we've got a path to a configuration page and then that points to a particular form that we've defined in the system and we're addressing the form using the namespace that was defined so this is sort of stuff that's coming to Drupal from the symphony world and we're just making use of it here there's also a preview in this one of another URL this is going to this also defines our callback URL that we're going to see later on in the presentation so you can see that that's defined there and later on when we talk about it we've already defined both paths that are necessary for this interaction to occur so this is just a snapshot of the code I'm not going to go into a lot of detail here but effectively what we're doing is we're implementing a custom configuration form and we've used examples here that others have implemented there's core modules that implement settings forms so there's some methods that you should always include and essentially if I go to the next page you'll see here there's our form array that's really familiar to us and then at the end we're just returning the form to the system and that allows it to render and then here at the end is the return values of the form so this is basically where we're setting some configurations so we're using the configuration management for our API keys and a path to an icon so that's all very simple and once that's in place then we can go into the system and we can take a look at in this case it's under the configuration section in the web services section because this is kind of third party content and we've got just like our fields that we've defined in that previous form and then a path to an icon we've added a checkbox here for content security policy it's an added security benefit that is recommended by the payment gateway so so that's how to create a settings page really straightforward not very different than what we've dealt with in the past now for creating a payment button we have two different things we need to do one is to create a custom field formatter this is a plugin which is something that resides within a module in Drupal 8 and plugins are kind of scary at first but they're actually remarkably simple they just need to exist in a specific directory and you see here that's the source plugin field formatter directory if you're looking to build a field formatter you can go through the whole code base and find an existing one and simply copy it into the same directory within your own module and the things that you'll need to make sure you're aware of is the comments at the top of the file the annotation and annotations are code so double check your comment before you just if you just copy an existing plugin into a similar folder structure you should just have to update that annotation and then you can modify the code as you see fit so that's what's really happened in this case is we've looked at the integer field formatter and we've simply gone in, updated the annotation changed some names and we've also added some field level settings and we just again throw those into config management so all of our storage that we have to deal with is all configs so that's really great and then once we've done all of that we need to make sure that we've taken care of it on the front end side and that's going to be in a hook theme and that lives in the stripe checkout dot module file so now this is just a snapshot of the field formatter again I'm not going to go into a huge amount of detail here just to show you again we're using our Drupal 8 namespaces so if you've got like this function is missing you might want to find out what namespace to load so that it is present and then we've got our class that we built and it extends the field formatter so again just taking look at other examples and this is how they implemented it so we'll do the same and then we define the name of it and once we've done that we've got a settings form and that's where we actually provide for the currency so that you can go and say our little hack to support multiple currency is that we've just provided two fields in our template so one of them or content type sorry so one of them is for US dollar in our case and one of them is for Canadian dollar and if there's no value provided in the field at all we just don't even render the field which is the default in Drupal anyway so in order to get that separation we've provided some variation there for that so going onward at the end of this we've got the view elements method and that's basically we're going to load all of our variables into that and that's what's going to be provided to the hook theme that we're using and now I'm jumping ahead into the stripe checkout dot module file and here we've got stripe checkout theme as our first function and that pulls all those variables into another function that we've specified here and then that function follows and we then load all of the settings that we need using config management and on the next page here we see that that's our HTML embed code that we saw earlier so this is what had been provided by stripe and we're loading it into an output variable and then we're passing that back so this is just again a standard hook implementation really similar to what was done in Drupal 7 would be fairly straightforward to implement for another payment gateway if you're not necessarily wanting to use stripe and then actually at the very top of this particular slide you can see that we've added the content security policy header and that respects the value of that checkbox that you saw in the configuration so now the big part of this is actually creating the callback and again stripe provides wonderful examples of this we need to get our values and fetch those back from the nodes so the callback of course needs a URL and that was referenced back in the earlier slide where we defined the path to the config form so those are both in that same routing file that replaces what used to be hook menu when we were trying to define paths the callback function typically lives in the slash src source folder within your module and that's new your name for this can be anything really because you define you link the name to the path in the routing file so basically we're giving it a name that we choose and this is where it goes so again to remember what we're looking at doing we're trying to load this callback function when stripe replies with the token we take the token and we take the node and we look okay it was $20 or $100 and then we make the charge using Stripes API calls and that's all provided by the Stripe PHP project if the charge is successful we mark the value of the balance do field to be zero and then we update the node revision table if that is present on that particular content type just worthy note here is what the Stripe PHP project looks like and they maintain it regularly so the last update was seven days ago this snapshot was taken today so you see that it's very active and Stripe manages this themselves so as a developer I don't need to worry about this I just know that it exists and composer will install it for me or I can go and fetch it and just put it as a sub folder within this module you'll see at the top of this we've got a node file that's referenced and that pulls that stuff into here and then we've got our class that we defined and really all we're doing here is we're taking back the Stripe token and making sure that token exists if it doesn't exist then we just fail out and that's gone so that's not a big deal we're not going to worry about processing a charge that didn't exist toward the bottom here we've got the actual charge code and this is again just an example that came from Stripe and so we've got the value of that field and we just make sure that okay this is the value of the field and we've got this token and we charge it and then we pop an error if there was an error and otherwise we update the node to set that value to zero and we move on so we're basically just after the callback has run we're redirecting the user back to the same node and at that point the cache will be reset because we've actually updated that node since they were last there and thus they'll get a fresh version of the page with the value set to zero and it will say thank you so okay so in the user interface this stuff looks like a couple config steps and then a step to create a node so that we can actually do a charge again we can set the currency node on the field level and then at that point we should be able to use this so if we go to the manage display tab on our content type you'll see here that we have three integer fields we've left the label as the default the format we're selecting the Stripe checkout formatter and then you'll see here that we've got some configuration and this again all lives in config management so all we're setting is use the node title and it will take any text field that you supply so you can just configure that to your heart's content and then we set the currency code so these should match whatever Stripe works with and as long as it's enabled in your account it should be fine in my case my account supports USD and CAD and those are great so when we move back to the node now you'll see that we've got three fields here and I filled in again an integer format so we could go a step further and try to do this as whole numbers but we just left it as sense and we put a suffix on it that has the sense symbol so that we know when we input stuff that it's like if we put a hundred zero zero that's a hundred dollars when we save that this is what we should see it sometimes takes a second if you're on like a 3G connection but it renders the payment button and that button actually is loaded from Stripe so that is an external JS that's happening there and then I've added a second field called total and that is just a free format text field so we can put anything in there the reason that again we do this is because we need a balance due that we can zero out we still want people to know what the history of the transaction was it's all recorded in Stripe but it's nice to have it so that if they come back and say okay what was that I need to print this out or whatever they have that in the case of Stripe you can actually have them because they manage the entire back office aspect of the system you can have them email the client by default so it will actually have your node title in there because that's what we used as the description and if we were to click that button we'll see our node name here if we we see that the node name is if we come here we see first the icon and the company name that are in our settings page then we see the title of the thing that we're charging so this is the node name and there's an option in Stripe to ask for the address info it's not enabled by default but I do need to have things for regulatory purposes you know you do need to know what the billing address is in most cases so in this case it's a two step form and that way we've got all of that data gathered we don't really need that data in Drupal but we could always fetch it later using the API on the second screen we see the credit card number standard info here so we've got month, year and then of course the CV it's usually CVV but it goes by different names CVC number in this case and that is the three digit code on the back of the card I think sometimes there's an option as well to accept just the postal code or zip code and that will appear on this one if you don't use the address request thing the remember me function is specific to Stripe so if people were using that then they could potentially save their credit card with Stripe and then they don't have to re-enter this but of course there's a login step for that as you would expect last note on this is that it shows the currency code it doesn't show the currency code for Americans so if it's in the United States it will just say pay $100 but if it's anywhere else it will say pay 100 euros or whatever so again when we return to the node so we've now gone we've submitted that the token came back it went through the callback the callback accepted it charged the account and then redirected us back to the node it now says paid thank you and that's a translatable string so we could put whatever we want in there and you could actually translate there's a fun feature in the multi-lingual system now where you can translate from the system language to English so you could actually override that as well in that manner if you wanted to Stripe back office looks like this so we would see our successful charge for today rings us up to $100 and on the side you have all your operations that you can perform so you can look at who your clients are and all of that stuff and at the bottom there's events and web hooks you could go and look at all of the individual transactions and then there's like a view button that would expand and you could see the same thing but if we go to the events and web hooks we can see this one has replied with charge.succeeded and it gives us actually the JSON object that was used to make this transaction happen so if you get failures you can just go and look at the JSON object and that would explain to you what happened you could see like if some other strange characters got inserted in there for whatever reason and that's just that's standard with Stripe that's kind of like you know how I said earlier they are very developer focused they don't really hide this stuff from you they're like okay it's a pretty interface and it has just the numbers and all the basic stuff for the client but for a developer you just have to click view more and it's going to give you all of that so I mentioned the content security policy thing this was something that I had been surprised that I had not encountered in the past but you know it's one of those things the content security policy header that you can provide to PHP will notify PHP what sites are allowed to run javascript on this site and any other external resources so that's that checkbox that we added sets it to only run javascript from this site and from Stripe.js when from the Stripe server when you hit a page with that button so if you had like a bunch of YouTube embed codes and like other stuff happening on that page if you had that enabled it would only load stuff from Stripe and from the local host it would like when you come back to the page you're processing that button is no longer present and the cache has been reset so you would then see all of that stuff of course those codes are still present on the page even when the button is there but they just don't run so if you look through the documentation they recommend this and it's kind of a helpful feature if you are working with a group that maybe has too much stuff going on and you want to just minimize it you may want to not use that checkbox and define your own because maybe you want to have analytics running and you would like to see where people drop off or something like that so it's just a recommendation there's also a recommendation and this really applies to any like Drupal 6 or 7 site that you're doing as well if you have like live API keys you can put those into your settings PHP file that way they can't be changed in the user interface so that can be really helpful that way if your site was to get hacked they can't go in there and change it there's a lot of nefarious things that can be done when someone finds the API keys so you may of course risk like charge backs or something if someone writes their own API implementation to ruin your life we provided this on the module page for this module we've actually published this module to Drupal.org on the module homepage we've provided the code example that you need to just copy and paste into your settings PHP file in production and that way you don't have to have that in your development environments either you can use your test API keys in your test zones and then you can put that into your live environment so that your developers may not even have access to it themselves so that can be also an awesome thing the third recommendation for additional security because we're super paranoid and Drupal 8 is still in beta until a couple weeks from now so there's this awesome module I found called config read only that's made by Pierre Willanen and somebody else needs a couple patches but what it does because we're using the new the settings form that we define we're extending the configuration system base class this is a very cool module because what it does is it says I know that this form is a config form don't let anybody ever change a config form so the system knows what types of forms they are and you can restrict them by using this module it's kind of like a simple hack but it's really awesome because you could do things like lock the whole site down and the only thing that can happen is content editing and block editing but you couldn't even move blocks around for example so you could actually lock your whole layout and lock your stuff down for payment purchases as well so that's a nice little hack that you can do to ensure that your D8 site that's in production you push it all up to production and everything's locked down in production except for content editing so less risk now there's a couple settings at Stripe that we've enabled in order to further lock things down some of them are also just for convenience so the convenience one is that we have added multiple bank accounts for multiple currencies and that way if it's just coming in in US dollars we don't necessarily convert it at that time we hold that in a US dollar account and then we can transfer it at our leisure and see values fluctuate wildly sometimes I think it's very important that you set the gateway to decline when people screw up the number on the back of their credit card it's also important to decline on the postal code or zip code failing this can be a way to prevent yourself from getting dinged on fraud because there's always reputation considerations when you're looking at charge backs, generally speaking you don't want to do charge backs like refunding people the more you do, the more the gateway is going to dislike you the same type of circumstances though, you had NSF checks if someone were to write you a check and it were to bounce there's extra fees that are associated so I'm not exactly sure what the fees are for Stripe in that circumstance but generally you don't want to be doing charge backs so in order to minimize that you want to discourage people who are trying to test cards that have been stolen from using your site as a testing bed for seeing if those cards are valid and that's a pretty common case in our case one of the reasons we went with using nodes as the basis for the entity type that we want to use this field for was that there's a hook access and that way we're actually not giving people access to this at all so we don't have a risk of these types coming in and testing out they're like stolen database cards I haven't found this setting in the Stripe backend but most gateways allow you to restrict to one IP address so I need to read the documentation myself for that because I would like if you can lock it down to one IP address and there's no PHP module in the PHP input format in Drupal 8 that doesn't exist anymore there's no way to create PHP code so if you lock the payment gateway down to just one just to one IP address and they're not able to do any PHP work on that address that means you effectively can't do anything even if you have the API keys so that would also be another way to lock it down even further and then of course it's kind of obvious but don't use the live API keys for testing like use your test keys, make sure everything works, the reason that they exist is like for this reason yeah so I mean there's always a good it's always a good idea to do a test charge when you finally do go live using a live account but you know you don't want to be doing that all day long I've heard of people using like the they're not really temporary credit cards the ones that you can like buy at the post office and charge up with like 10 bucks or something I've heard of people using these as an alternative to using the test API and it's like why would you do that it just waste money so since we've created this module we've had some feedback and feedback is always super welcome so there's a few things that we have on our to-do list and some of those are like implementing this change that went in last week which is the T function and the correspondent this T the T function is sometimes a method when you're working with classes so those also need to be cast as a string now in order to have them work due to some of the safe markup stuff that's happening so so we have an update to do for that we would like to support other entity types right now this method the way that we've described it it really works with like one node one charge I don't know if it'd be worth doing an unlimited like ongoing charge because you know we haven't really we don't person we don't have a use case for that there's also a possibility of course of like doing address collection in Drupal and then just passing through the the postal code or zip code along with your API request so that's a that's a different method if you were looking at wanting to collect more of that stuff in Drupal or to just have it on file commerce guys made this really awesome address module that supersedes what used to be address field and it's very generic and it has all this wonderful stuff in it so that would be one potential patch that we could look at accepting so that would be really great API errors are always worth catching so in some circumstances it's not obvious like that for example the currency code was typed wrong or something and it throws like a an error you wouldn't see very often but it's still an error so catching errors is always good and then of course you can never have more tests so now if you're still working in the Drupal 7 universe there's a couple things that might be helpful if you're looking to immediately reduce your PCI scope and you are using Stripe there was some work done on making check out one of the options for that so that has been committed as of a few months ago there's also a D8 module called payment which is the successor to the payment module in Drupal 7 I imagine that this kind of proof of concept module will eventually make its way into payment module payment module does a bit more where it can handle it has a storage back end essentially and you can plug it into things the Drupal 7 one can either stand on its own and just be that or you can you can charge money on nodes like this in Drupal 7 you can integrate it with web form in Drupal 7 and you can integrate it with commerce in Drupal 7 so those things are really great because they're generic and the payment module does exist in Drupal 8 and there are some examples so we're kind of hoping that now that we've got like minimum viable products for our Drupal 8 site that we can then turn around and you know make something a bit more robust now that we've got our heads around how to do stuff in Drupal 8 and then I've already noted but Braintree, Authorize.net and others have their own versions of like a hosted solution and again that's just where like all of the code and all of the stuff that touches the credit card is hosted by your gateway not by you and that way you never, never, never touch the credit card so this same approach could easily work in Drupal 7 we did have a request to do this in Drupal 7 but it's not on our radar at the moment because we're sort of pressed for time so yeah some special mentions kind of need to be made my colleague Anna Kalata was responsible for creating the Field Formatter and like kind of reverse engineering the YouTube module as we found it was a great example to work from and then of course we've listed out the YouTube module authors because it was a really great example to follow and they had published this a long time ago for reference because I know people are like are we ready to use Drupal 8 yet we haven't changed anything since May 19 like anything and it still runs against Drupal 8 head the only thing that we've changed since like January in our projects has been to update the menu links because those are now multi-lingual and they're now proper entities and we had another change that was again not for this module but another module where we had to update some paths because we were referring paths have changed in the past few months where they used to be like they are in Drupal 7 where it's like node slash 19 is what you would put in a reference field but now it's slash node slash 19 and that's just trying to standardize I think with what's done and common in symphony so PCI compliance paper authors this is like a fantastic resource and they all deserve like honorable mention because like it's you put yourself at so much risk if you just do like it's like you want to grab a D7 module and like someone punches their credit card into your site and you're taking it into PHP there's a lot of potential issues that could arise from that and it's important to know like what what kind of danger you're putting yourself in especially if you're dealing with smaller sites where they may not be charging a lot of money but if they are not updating for security and things like that there's they're running a huge risk and the liability is now on them whereas it used to be on the credit card company to manage that so really really really happy that they were able to publish that document and they keep it up to date so that's wonderful alright so I guess we'll open it up to questions if there are any I've tried to address most that I've heard in the past in the sessions so yeah and again my name is Ryan Wiedel so my contact information is there if you wish oh can you use the mic if you don't mind when you get the token is it on? oh yeah okay cool thank you when you get the token returned what is in that is it just a number it is the credit card token because you said you couldn't you didn't know how to figure out whether it was paid or not until the value was zero yeah so the token itself is just the card and there is one other thing that comes back with that I think it's the email address that comes back so you really just get the token and the email address and then you do the charge yourself you use the token to make the charge and you get a return value from that so the return value I believe contains a success statement and I think the email address as well and then with that information I think it has a transaction code as well and then you can use that information using the Stripe PHP library to make subsequent calls to get the rest of the data so if you need to get the address information that they input you can use that successful charge token to look back and see what else they provided to Stripe so you can retrieve any of the information the credit card information is limited to like the last four digits and a few things of that nature but not the actual credit card itself so basically anything that was in that API call I kind of cut this screen but you can retrieve anything that's in this JSON object so any other questions? alright well thanks for coming I know it's the end of the day so we can head out a couple minutes early and we can get a head start on the beers so thanks again