Hello students! This is Shayna, your teacher at EspressoEnglish.net and I'm excited to present the first Ask the Teacher lesson, which means I'll be on video answering your questions. So today's question is, what's the difference between these two questions? Does she have a car and doesn't she have a car? This is an excellent question because there is, in fact, a difference between these two forms of the question. The question with does, does she have a car, is neutral. I don't know if the answer is yes or no and I don't expect the answer to be yes or no. It's simply a regular neutral question. The version with doesn't, doesn't she have a car? I would ask it like this if I assumed or expected the answer to be yes and I'm only asking to check or confirm that I'm correct and make sure I'm not mistaken. For example, if I saw this person driving a car two weeks ago, then I could ask, doesn't she have a car? Because I assume the answer is yes. But maybe I'm mistaken. Maybe the answer is, well, she used to have a car, but she actually sold her car yesterday. We can form questions with any negative auxiliary verb when we assume or expect the answer to be yes, but we still want to ask to check if we're mistaken or when we're surprised that the situation appears different from the way we assumed it to be. For example, the question, can you speak Spanish is a neutral question. The answer could be yes or no. I have no expectations about the answer. I really want to know if you can speak Spanish. Now let's imagine I have an American friend who lived in Spain for 10 years and one day I asked him for the translation of a Spanish sentence and he says he doesn't know how to translate it. I would say, what? Can't you speak Spanish? Because I assumed that since he lived in Spain for 10 years he would have learned the language, but maybe he didn't pay attention or didn't make an effort. So I ask, can't you speak Spanish? But maybe I'm mistaken and the answer is no. Here's an example with the verb have. Let's say my brother is going on vacation. I could ask him, have you bought the tickets, the plane tickets? That's a neutral question. He might say, yes, I have or no, I haven't bought them yet. Now let's imagine it's the day before the trip and my brother is completely stressed out because he doesn't have the plane tickets. I would ask him, haven't you bought the tickets? Because I'm just surprised. I'm shocked that he didn't buy the tickets earlier than the day before. I assumed that the answer was yes. Yes, he had bought the tickets, but I'm surprised to find out that the situation is different from what I expected. So again, you can start a question with a negative auxiliary verb like doesn't, isn't, aren't, haven't, can't, shouldn't and many others when you assume that the answer to the question is yes or you expect the answer to be yes, but you're asking to confirm or to check if you're possibly mistaken. This actually reminds me of another way to ask a question when you're assuming that the answer is yes, and that is to use a question tag. Here's an example of a question tag. She has a car, doesn't she? This is actually a statement. She has a car with a question attached, doesn't she? Again, I'm expecting or assuming that the answer is yes, but I'm asking just to confirm. There are actually two ways to use question tags and it depends on your tone of voice. If I use a question tag with my intonation going up at the end, that means I'm really asking a question to confirm. She has a car, doesn't she? Now, if I say a statement with the question tag, but my intonation goes down at the end, that means I'm not really asking a question, I'm just making a statement that I expect the other person to agree with. Here's an example of that. It's a beautiful day, isn't it? Notice my intonation. It doesn't go up at the end, it goes down. It's a beautiful day, isn't it? This means I'm not really asking you if it's a beautiful day or not, I'm just making a statement that I expect you to agree with. Here's another example of a question tag like that. Imagine I went to a restaurant with some friends, but the food at the restaurant was terrible. The next day, I could make a comment to my friend. The food wasn't very good, was it? I'm not really asking the question, I'm just making a statement that I expect my friend to agree with, because it's obviously true, the food was terrible. Remember, to use a question tag, the verb in the question tag is the opposite of the main verb in the statement. For example, she has a car, doesn't she? The main verb has is in the positive form and the verb in the question tag doesn't is in the negative form. You can also reverse it. The food wasn't very good, was it? The verb in the main statement wasn't is in the negative form and the verb in the question tag was is in the positive form. So that's just a quick introduction to question tags. Let's review the three forms of questions that we covered in today's lesson. There's the normal question, does she have a car? Ask this question when you really want to know the answer. You're neutral, you don't know if the answer will be yes or no. Then there's the form with the negative auxiliary verb, doesn't she have a car? Ask this question when you expect or assume the answer to be yes, but you're just asking to check or confirm. You can also do this by using a question tag. She has a car, doesn't she? Again, we expect the answer to be yes, but we just want to confirm it and make sure we're not mistaken. And finally, you can make a statement with a question tag that's not really a question. It's merely an obvious statement designed so that the other person will agree with you. For example, it's a beautiful day, isn't it? And when we use the question tag in this way, our intonation goes down at the end instead of going up like a normal question. That's all for today. Thanks so much for watching. I hope you've enjoyed today's lesson and please keep sending me questions so that I can answer them in future Ask the Teacher lessons. See you next time.


or any organization with a high cost associated with compromised data, organizations faced with regulatory compliance, yeah, yeah, whatever. I like to say that app armor is an appropriate technology if you are hosting something on Linux and you care. So what it's doing is it's creating a firewall of sorts around each application to say what it's allowed to access. And if you can control what the application can access, then you can prevent the exploitation of vulnerabilities because the attacker, they might be able to pop the program but once they've done it, the program only has access to what the program is supposed to have access to and they can't do fun things like, for instance, spawn a root shell. And another important feature of this is that because we're controlling what the application should do instead of what the attacker can do, we don't rely on signatures. So it doesn't become out of date tomorrow afternoon. So the benefits of this kind of thing is that IT has enhanced productivity. And that enhanced productivity, that's an odd effect and it's because if you're constantly scrambling for security patches, in the middle of a night or in the middle of a payroll run is a terrible time to have to apply a security patch. It's very expensive. And if you have App Armor in place or something like it, then you can say, well, okay, we have this security advisory but we don't really care because it can't really be exploited. So we're gonna wait until the end of the month when we're scheduling an update before we apply this security patch. Oh, and bonus, someone else will have tested the patch for us because they deployed it and complained to the vendor. It enhances your software reliability because it is much easier to specify what a program should be doing than it is to make sure that you wrote the code correctly and that's only what it does. And it grants peace of mind. It makes me nervous to deploy something in the field and not know whether it's safe. So developers and IT can sleep at night that their machines are that much safer. So that's the marketing fluff. Getting into the details. This is the box of arrows diagram of App Armor. Down at the bottom, the foundation of it all is Linux 2.6 and the 2.6 is important because that introduced a new feature called LSM, the Linux security modules interface. LSM is an API where you can plug modules into your kernel and you've been able to have modules forever in the Linux kernel but now you can have security modules that have enough power to be able to control access on the entire machine. So plugged into this modular interface is App Armor and above that is the user level software for managing it and over here would be your programs and each one of them has a security policy wrapped around it which we call an application profile because it profiles the behavior of the program. So if you're gonna put yourself in the business of saying no to everything, it's really important that you do a decent job of it. One very important issue is complete mediation. Complete mediation means that every possible path of access has been blocked so that the security system is actually controlling whether someone can go through it or not.  So it's important that you can completely mediate. And in the case of Linux security or application security really, complete mediation is only achievable if you do it in the kernel. If you try and do it at the application layer or the library layer, then the attackers can sneak around you, they just won't call your library, they'll call the kernel directly. So this kind of technology must be in the kernel. On the other hand, security people have different ideas than kernel people about some things. And so it's kind of a problem if the security people say, well, we wanna be in charge of this kernel now. Well, some other people might have some disagreement with that. And so LSM deets things, so the security people can write a module the way they want to. And the operating system people, well, they don't have to worry about it because it's just a plug-in. The other critical issue is to make the model not annoying. There's two ways of modeling access control. The common one that people in Windows Land are accustomed to is misuse prevention. And that's where you come up with a blacklist of things you can't do. Anti-virus software does this. You can't do this or this or this or this or this or this or this. 70,000 virus signatures later. They're still listing because there's always a new way to write another virus. The opposite of this, the dual, is anomaly prevention. And that means you come up with a white list of things that you can do and everything else is blocked. That's much more secure because the fact that the attacker thought of something new has no effect. You blocked everything except what the application needs. So great, it's secure. But you have to have a complete white list because if it's incomplete, you're going to stumble over your own shoelaces when the security system stops the application from working. And that's what AppArmor is particularly good at. That's what we do is we use white list approach, but we provide a bunch of technology to do a really good job of rapidly and precisely generating the white list. So zooming in a bit, this is an AppArmor policy and application profile for NTPD. So people who are familiar with configuration security, the sort of things that Bastille Linux does know that you should close off all the network ports possible and be very careful about root privilege demons run it with open network ports. Well, NTPD, the network time protocol demon is such a demon, it needs root privilege because it's gonna change your system time. It needs an open network port because it has to talk to the network time server. And you can't turn either one of those things off or it stops being NTPD. Oh, great. So now if there's a vulnerability anywhere in NTPD, then someone can pop my machine and get a root shell. And NTP is not the only thing. I was all kinds of this stuff and can figure it away all of the open ports. Well, yeah, but that limits your functionality and that's why you had a computer in the first place. So what this AppArmor policy does, the profile says that whenever NTPD runs, instead of having all 27 of the POSIX.1e capabilities, it can only have these five for things like sys time. It needs to set the time, so we'll give it that. And it can only access these files where this is an absolute path name. This one here has a star in it. So at Etsy NTP slash drift star, so wildcard, it can access a bunch of files. And the access modes are read, write, and execute. So as a result, if someone pops NTPD, they can't get a root shell. There's no bash here at all. They can't go and steal my password file. It doesn't have access to the password file. They can't really do very much of anything except change the system time. So that's one program. How do you secure your system? The server analyzer that comes with App Armor scans your box, finds all the open network ports, finds the programs listening to those open network ports, and then tells you what App Armor profile, if any, is wrapped around that program. So if you can get your system to the state where all of the open network ports lead to App Armor profiles, then it's the case that those App Armor profiles now completely define anything that a network attacker could do to your machine. Yeah, at this point, you're a long, long way from having written policy for every program on your machine. And you're also at the point where the attack surface, the exposure of what an attacker could do to you is hugely down from what it used to be of every time you pop a root program, you get a root shell and you can own the box. Having picked a program to profile, you then have a template generator. This is a static analyzer that reads your program and emits a halfway done profile. Because of that little theorem by Alan Turing, it cannot do a complete job. So it does its little best, does a halfway job, and then you have to go watch the program actually run. You put it into automatic learning mode. The policy for that program is set to be complaint mode where rules are not really enforced, but violations are logged. So you run your program through its paces and every time it does something new, it logs it. And then you show this big log file full of events to the interactive optimizer, which looks at the log file and goes, oh, it accessed this file, should I allow that? Or better yet, how about I allow that with some wild cards in it so that it captures a whole bunch of other files too. And in this way, the interactive optimizer can turn a log file with tens of thousands of events into dozens of questions, producing very short policy files. And finally, there's a visual editor mode. There's a sample, which is a VI syntax mode that highlights different sets of the policy with different colors to show you what's important. And in particular here, file rules that permit right access are highlighted in yellow. So if you wanted to look at your machine from the point of view of what files could a hacker corrupt, you look at all your profiles and you look for the yellow lines. So that's a whole lot easier than wondering what an attacker could do to your machine based on all the software you've got on it. Some important properties of this policy file to consider. First is that it's not a new paradigm, it's an overlay on top of existing discretionary access controls. So the files that your program or you can access remain the same according to Chimad and Chone and those mode bits and read, write, execute, all that stuff has to pass first before App Armor even sees the question. And then it goes through the App Armor policy and decides whether, well, okay, the discretionary access said it was okay and the policy says it's okay, now you can access it. The other thing to notice is that there's no new jargon. All of the language is familiar. So path names are absolute path names using shell wild card characters just exactly the way you would use them in the shell. So the squiggly brackets, they mean what you think they mean. Same with the square brackets. Star means what you think it means, so this will match any file that starts with LD- and has a .so in the middle. That happens to be any of the dynamic loaders that happen to be in the lib directory. Home star.plan would give you everybody's plan file. Double star. That's not exactly shell syntax. That's the rsync syntax. And that means an arbitrary number of path elements, so including the slashes. So this rule gives access to the entire public HTML directory tree. And you can even stick suffixes on there so you can write star star .html if you wanted to give access to all the HTML files, but perhaps not all the purl source. We provide a collection of foundation classes, building blocks, and the way that works is App Armor lets you write a pound include into a policy, so you can go pound include that stuff over there. And stuff over there is components of common elements of software. So for instance, the name service package is all the rules you would need to have proper interaction with PAM so that the program can do authentication of users. Console is all the rules for dev TTY things so that say a console program like Bash can talk to the keyboard and such like. App Armor includes a special feature called sub process confinement. Most access control systems think that the smallest granularity of access is a process because that's the smallest thing that the kernel tends to consider. But we can get below processes and this is important, especially for web servers where the classic way of running a CGI script on a web server was that Apache would fork and exec a Perl interpreter and then run the program which is really cute but Perl is like a five megabyte executable and that works once but if you wanna have hundreds or thousands of transactions per second it ain't gonna happen. So they came up with mod Perl, puts a Perl interpreter inside the Apache process and now when you wanna run a Perl script it just opens the 100 line Perl script sucks it in and interprets it and it can do that much faster than you could if you had to do a fork and exec. So that's great for performance and terrible for security because now you're running all of your web applications in not just in the same security domain but in the same address space. And all of that is also true of PHP but more so because there isn't even an option for running your PHP scripts externally. So app armor adds a module to Apache and we call mod change hat. So this reflects that Apache is going through different software roles, Fireman's hat, Policeman's hat, Mayor's hat. So the mod change hat in Apache calls app armor and says hey I'm changing my security context of this thing over here and in that way you can actually run individual PHP pages inside their own security domain. This is unique it's the only way I know of to defend against bad PHP code. We also use this same feature for a privilege separation in SSHD so that if there was a bug in SSHD it would be confined to the profile that is everything needed to do authentication of users and nothing else. Only after it passes authentication does it pop out into a more general profile where you can do things like exec shells. Performance overhead is very small. When we measure it at the application layer it tends to be in the zero to 2% range biased mostly towards the zero end. To get it to show up as 2% you have to be running very very small Perl scripts so that the overhead of just saying hi I'm with app armor starts to become a significant fraction of the total run time. So for the most part it's performance neutral. We include a set of standard profiles for Linux services. Apache, PostFix, Send Mail. The usuals that you turn on to have open network ports. And the app armor tools are there to help you customize them to your environment. App armor's integrated into the SUSE YAST interface. There's a button that says hi I'm app armor. Configurable reporting and alerting. And a command line interface for those of us who are a little bit allergic to mice. So this is a demo. What I'm gonna do is demonstrate attacking a vulnerable piece of web application code on the web server running on my laptop and then go back and fix it. And then we're gonna build an app armor profile for Apache while we're at it. So here's our local website. And digital airlines is running this web application. And it's just a cute little web app that looks up people. This is a genuine vulnerability. It's ancient but it's genuine, I didn't create it. The hack attack is to put some shell commands on the URL line and the program is dumb enough to actually execute them. That, well it has unfortunate consequences. So I'm gonna put this back using the same vulnerability because that's the fastest publishing method I could find. Now let's go build a profile for Apache and for this web application. This is FOSDEM so I'm gonna use the command line. So you say build me a profile for whatever program and that happens to be the path to Apache on SUSE Linux. It's already done the static analyzer and now it says okay run your program and I'll watch. So let's get another shell here. I do a restart on Apache and you see a whole bunch of traffic running down here in Syslog. This is tail running on Syslog and those are learning events going past as App Armor learns what happens when Apache does a start. We're gonna go visit the homepage and this is the stuff for serving a webpage and we run the web application and it learns what it takes to run the web application. Don't run the hack attack.  Just generally don't teach bad things. So let's do another restart on Apache so that App Armor can see what happens when it stops. So now we have this log file full of bunches and bunches of events and you could get a clever geek to go turn that into a policy but that would be tedious and that's what happens with security is if it's tedious people just don't do it. So instead we're gonna ask the App Armor software to generate policy for us. So we hit scan, scans the log. The first thing App Armor wants to know is it saw Apache launch this PHP child process and it wants to know whether, excuse me, PHF, whether it should be part of Apache's policy or to have its own profile externally and I'm gonna choose P for external because that's more secure. Then it has a bunch of POSIX capabilities that Apache asked for so we're just gonna give it all of them. Apache wants to read into the Apache configuration directory. Well that seems perfectly sane. It wants to read deep into the Apache configuration directory and it occurs to me that that's a big furry tree. I don't know what all is down there and I certainly haven't accessed it all so if I just give this rule explicitly then my profile will break later when my Apache does something a little different. So I hit the glob key a couple of times and now the suggestion candidate three says okay Apache gets to read everything in Apache 2 Star Star, the whole sub-tree of the configuration tree and it's read mode and it's Apache so why not? So we'll allow that. It wants some MIME types, NSS, name service and App Armor notice that this event is satisfied by the pound include name service package and so if we choose that then all the other name service things that are about to come up and hit us they go away. It doesn't bother to ask us about those things. Some PHP things, some group things, DA login blue arrow dot gif okay that's somewhere in the web docs tree and I don't wanna specify all those pages so I'm just gonna let Apache serve all the web pages, seems reasonable. This one is interesting. No actually I can't, oh I can move the, yeah there we go. Yeah sorry video hacking. So here App Armor notice Apache accessing libice.so.6.3 and the first suggestion is why don't we wildcard the 6.3 so that when we upgrade that to 6.4 it still works. The second suggestion is you're probably gonna access a lot of libraries in there so why don't we just wildcard the word ice and give you all the libraries. So you can choose anyone you want. Security minded admins 10 towards number four because they're going oh but if I allowed access to a whole bunch of other libraries that would be dangerous. Well yeah kinda but not very and this is a whole heck of a lot tighter than anything you've ever used before. So going with number five is still actually quite secure and much more flexible so it hassles you less about well what about some other libraries. So I tend to recommend a liberal use of the glob key. Here's another interesting case where it's accessing modcgi.so and if you hit glob with extension it wildcards the modcgi part and leaves the .so alone allowing you to grant access to all of the files of this type very quickly. Here's another one and another one. Some other stuff, some logging things, some mime stuff, some SNMP stuff and I globbed it up because I don't know what it's doing in SNMP and I don't wanna find out I'm just gonna give it read access to all that SNMP stuff. Little more logging and the PID file and we're done. That's how long it takes to build a policy for a major service. This is the colorized syntax view. Those color choices work better if you have a black terminal but it's highlighting in yellow the couple of rules that have write access. The black stuff is boring ordinary read access. The purple stuff is wildcards and green means someone else's profile so you should go look at that too. Notice that I didn't restart Apache. It just overlaid the policy on top of Apache as it is. So now we can visit the home page, we can run the web app and you can try to run the hack attack but your home page is intact because app armor blocked the access where PHF the first thing it tried to do was run bash. Had it been a bash script it would have had to have execute permissions on bash but it would still be confined by the profile for PHF and so among other things wouldn't have had access to write over index.html. So that's the security impact of app armor. You can create profiles in minutes for major services that block attacks. Not my mailbox, my presentation. So in a similar way you could build a profile for a client program like game. I use game for my instant messaging. It's great. It talks to IRC for my developer friends. It talks to Novell group wise for the suits that I have to interact with. It talks to Yahoo instant messenger for talking to my wife and my mom but it's been known to have a vulnerability or two. All sorts of vulnerability issues where if some nasty IM person tried to send you a message they can own your IM client and then own you. And so I like to run game with a profile wrapped around my game client so that if someone tries to hack my game client because I'm chatting with strangers they find themselves in a cute little profile that can only basically run game. They don't get right permission on anything interesting. They don't get execute permission on anything interesting. And the same thing applies to your mail client in case there's a buffer overflow and handling the headers of some obscure format of RFC 822 which has been known to happen. Or your web browser in case there was oh say a bug in the WMF handling. The major alternative to App Armor in the open source space is SE Linux. So this is the biased competitive view of App Armor versus SE Linux. The first case is that the full power of SE Linux appears only if you relink your application with LibSE Linux. And that's cool for open source stuff like MySQL. It's something of an issue for proprietary software, Oracle and SAP. They don't have much of a sense of humor about requests to recompile their software. This is a network computing review of Red Hat Enterprise 4 which includes SE Linux and it says yes, these security policies, they're very nice. They work on the configuration out of the box. They don't work if you change the configuration and it's incredibly difficult to change the SE Linux policies yourself. This is why. This is a summary of the seven page manual on Red Hat about how to create an SE Linux policy for an application. And this is the corresponding App Armor procedure where steps two, three and four correspond to this stuff over here. In steps one and five, the server analyzer in the visual editor mode don't exist in the SE Linux version. So there are 16 steps to our three steps. That would be a cheap shot if our steps were huge and their steps were tiny, but they're not. Our steps are run the programs and answer the questions and their steps are edit this configuration file and debug that other thing. Here's equivalent policies for the Woo FTP daemon. The first thing to notice is that the SE Linux policy is four times larger, simplicity as the sole of security. And then you go and blow it up and look at it. This is a fragment of the SE Linux policy and you discover that it's a new programming language. It has ifs and elses and stuff and brackets and there's a book on this from O'Reilly. You can probably get it out front. It's about this thick. The App Armor policy is those absolute path names with the read write execute and the shell wildcard. So if you know how to use Bash and Chimad, you're pretty much trained on App Armor. To deploy it, you generate your security policy using the gen-prof command that I demoed. You just deploy your security policies onto the production systems and configure your reporting and alerting. And hooray, we're safe. You wanna do an update on software. This is an issue, version 2.1 of that thing you're using might access some new files. So you wanna put it back into learning mode for a while to catch those cases. If you QA your software on a test machine, then you'd go do that on your test machine. As you're QAing the software, you'd put it in learning mode and it would learn stuff. And if you don't, you're daring, you just stick it straight into production. Then you just put your production machine into learning mode. Oh, that's dangerous. Yeah, you're as dangerous as you were before you had App Armor. Except you have this intrusion detection system running that's saying, ah, someone did something surprising. And if you don't do any of these things, you just upgrade the software and leave it in enforce mode. App Armor will block the funny new access. But it will also log it in such a way that if you just run the learning tool to say scan the log, it'll go, oh, hey, there was this new event. I think it was an intrusion, but you can do what you want and just say allow and it updates your policy. So App Armor is now included in SUSE Linux. It shipped with SLEZ9 SP3. It shipped with SUSE Linux. It will ship with SLEZ10. It shipped with SUSE Linux 10.0 and it will be in SUSE Linux 10.1. And App Armor is now open source. That happened in January. So you go to opensuse.org slash app armor is the home page for the project. Open SUSE is an open source project for building productive useful distros. And so the app armor stuff that's on open SUSE tends to be the stable releases of App Armor. Follow the links from there over to Novell Forge and you find the development releases of App Armor where we encourage people to come help us develop this, add new features and do stuff. So on this open SUSE page, you find binary packages, source packages and the mailing lists. If you just wanna put it in production, get the announced mailing list. And if you wanna help develop the dev list, you're familiar with this routine. Stuff we need. Application profiles is the most important thing. App Armor is very easy to use to build profiles for applications but only if you know how to use the application. And as I saw in some presentation this morning, there's like seven packages in a typical distro and we certainly don't know how to use all of them. So if you have an application that you wish was more secure and you like to use it, please come help us generate a profile for it. Go get the free App Armor, put it around your application and build a profile for it and send it back to the mailing list, please. Distribution porting. We want App Armor to be ported onto other distros. It's nice that it's an advantage for SUSE but it's also nice if other people, if the open source community enriches App Armor. So there's a port to Slackware underway. I'm not sure how complete that is. I've been talking to the Hardened Ubuntu project. They seem very interested in our building packages and I'm explicitly interested in porters. I don't have any yet for Debian, Gen2, and Fedora. If you wanna port App Armor to those platforms, please see me after the talk. Near term stuff coming with SUSE Linux 10.1. There will be a tunable file for setting local configuration things. You're gonna add variables so that instead of having to write slash home on your policy, you'd be able to write at home so that that can expand to a bunch of strings for wherever you NFS mounted your home dears. There will be booleans so that you can set a variable or a boolean value to turn on or off features that you may or may not want in your users. Longer term, we wanna add network access controls. The goal is to have syntax similar to IP table so that you can specify all the usual firewall things but per application. And the issue there, why we've been working on it forever and haven't done it is that there's kernel semantics issues that make it hard to get it right, especially for inbound packets because you have an inbound packet coming in. It's in an interrupt context where the packet was just shoved into the kernel and it's about to be delivered to a process but you're not sure which one. So that makes it rather challenging to decide what policy to apply. Deny profiles. App Armor uses the whitelist approach that I was advocating so firmly. We're gonna add a blacklist so that you can have a combination where you can say, well, yes, we allow everything in slash var, dub, dub, dub, htdocs, star, star. Oh, but not key files, so you write another rule that says that stuff but no key files if you wanted to keep your key secret for some reason. You had them in the web docs tree. A default profile. App Armor uses a blacklist approach for which programs should be profiled only the ones you said and everything else runs unconfined and that is good for configuring the network threat model that I described earlier where you've confined every open network port that leads to an app armor policy and great now network attackers can't get you but what if you have local users and you don't trust them? So things like the default profile would allow you to set a policy that says, well, if I haven't bothered to set an app armor profile, this is what it can't do. So you could, for instance, easily write a default profile that says, well, nobody can access Etsy Shadow unless they are running inside a profile that says that they can. So that allows you to enhance security for particularly sensitive spots in your file system. We have a better static analyzer that's in the pipe. The static analyzer I mentioned before is really just LDD. It figures out what libraries the program is gonna access. The new one does full decompilation on x86 executables, fishes out the open system calls and then tries to backtrace from there what the argument to open was and if it's a static string, we'll put that in your profile. Smarter learning mode, right now the learning mode isn't very bright, it just logs everything and that creates some bandwidth issues for syslog and we're gonna put some more logic into the kernel module so that it will go, oh, no, I've already mentioned that, so I won't, and that will reduce a lot, the bandwidth going into syslog. Smarter data structures. Some of this kernel code has pretty linear data structures that aren't the fastest and so app armor performance is great until you have 10,000 profiles. I've never seen a sane reason to have 10,000 profiles, but we did it anyway just to see what it did. So there's some work to be done here. If you're like a senior computer science student and the professors have just been teaching all about keen log structure, data structures and hash tables and things, then there's some work here to do. And that is the presentation. I am the architect, I'm Crispinette Novell. These are sales guys, Clive and Frank. Frank is the product manager, Clive's the marketing guy and this is the commercial product homepage, novell.com slash app armor. The open source one is opensusai.org slash app armor and we have about 10 minutes left and I'd like to take questions. Yes, sir. Yes, there is. Well, your own and someone else's suggests that there's some identity going on and really they're all being served by the user ID, HTTPD, right? So the notion that this is mine and that is yours on a virtual domain server doesn't exist. What you could do is app armor reacts to the path name that was being executed. So if you had a dedicated Apache process or program dedicated to each virtual website, so it wasn't called Apache, it was called apachebob.com or apachevoo. No, you can't really do that. No? It doesn't really scale very well. Okay, well then I guess you can't. But that's the approach that app armor uses is if you create a hard link to a program then you can apply a different policy to that same program. Yes, sir. The question is can you put an armor around a shell script or a pearl script and yes you can. App armor knows when it sees a file that has hash bang, whatever your favorite scripting language is at the top of the file, it puts the profile around the script and not the interpreter. So just out of the box, generating profiles for bash scripts and pro scripts is automatic. If by some mistake you happen to try and create a profile for bash, that would be very uncomfortable because then you couldn't use your machine anymore. So app armor will actually stop you and say no, no, no, you shouldn't be creating profiles for bash, that's bad. On the other hand, you can use the hard link approach I was mentioning in answer to his question. So if you wanted to have say a role for a log analyst and log analysts is like junior sysadmin, you just hired him, he's an intern. And you trust him enough to be doing the log analysis but you don't want him to be resetting the Oracle database because that really annoys the CEO. So you create a hard link from log analysts to bash and then you make skippy's default login shell be log bash and then you create an app armor profile for log bash that says oh, can run, you know, rep on var log messages but can't run shutdown or mess with Oracle. And so you can give someone fully root privilege. Oh yes, and you have to make his UID zero. So you can give someone full root privilege and yet have a restricted shell that confines them as tight as you wanna be to what they can do. The policy controls whether they're allowed to do that. And in fact, it even lets you allow them to execute bash but it's still running under the log bash profile. So yeah, you can execute whatever shell you want as long as we said you could but you still can't mess with Oracle. Yes sir. That's what it does now. It has to pass user mode policies and the app armor policies. We are contemplating adding user oriented security so that a different policy would apply if some user was running the application. I'm very cautious about adding language features because a lot of the power of app armor is its simplicity. It's fast and easy to generate these profiles because the language is so simple. And so whenever we add a feature, I'm very, very careful to make sure that we preserve the property that the profiles are understandable and they're easy to generate. The question is can a user create a policy for their own application? If I think I understand what you're referring to, there might be a policy for game that is system wide and a user might think that the policy is too loose and want to have a tighter one. So that's a feature that we're thinking about adding. I'm not sure how well motivated it is because I don't know very many multi-user systems that someone runs game on. This is my laptop and my wife might have an account on it but she doesn't really use it. That's an interesting application. I think it could be done without adding new features especially if it's the case that it is your computer and you have root on it anyway that you could set up a special account that using the log bash hack is capable of compiling software but only in restricted trees. Yes, sir. The question is is there a logging mode where the log records are generated for access is what even when they're allowed. And I actually can't remember whether that's in the product or will be in the product. But it tends to be very noisy. Logging at that level produces a lot of bandwidth. You may like it, you may want it but I'm not sure you'll like it. Yes, sir. The question is I want to be able to log whenever someone accesses a certain file and that is a feature of the default profile that we would add. If we add the logging feature and the default profile feature you put them together then you can write a rule that says yes, log it every time somebody reads Etsy shadow. Yes, sir. Oh, sorry. Down here. The question is about shared memory. We do not have any access controls on shared memory. I tend to disbelieve that this is a useful construct because programs that share memory really are the same application. They just have multiple processes and trying to write a reasonable policy that expresses what memory you can share and what memory you can't. I don't know how to do that such that it's this clean. So I'm happy you're just having a policy wrapped around those programs. Oh, resources. We thought about adding abstractions for U-limits to app armor policies. We haven't done it yet, again for the simplicity argument and when we went to look at it it turns out that U-limits actually works. It's relatively obscure because people mostly don't care but Linux has a feature for that. Very patient gentleman in the back. The question was about an append-only access mode. No, we don't have that and yes, we want it. If you'd like to come implement it, that would be terrific. The question is about app armor's reliance on path names. And app armor, let's see. Linux resolves sim links before they get to app armor. But hard links are after app armor. So that allows you this nice hack where you can have different policies for different programs of different names just because they're hard linked. Other namespace schemes like plan nine style namespaces basically are competitive with app armor. The plan nine namespace notion is another way of achieving a lot of this value. And exactly how to resolve all that I'm not sure. I've not really seen very much use of elaborate namespaces in the Linux space. If it happens, we'll have to deal with it. The, oh, there we go. No, I didn't run the change hat demo. The way it works is the change hat API, there's two levels to understand. One is the API and the other is the Apache module. The API says that there are two security levels. There's the outer profile and then there are hats. So you can only change to hats that were defined for your profile. And when you change into a hat, you provide a token, a secret key. And you don't actually share it with anybody because you just have to match it on your way back out of that hat. So you can just get it, read it from dev random if you want to. And then to come back out, you have to match that secret key. And if you don't, we kill the process because there's no sane reason to have the wrong key. There's a special case that if you provide a secret key of zero, then there's no way out. So that gives you a one-way transition into a policy. The Apache module basically takes the URI request, the essentially the URL of what you're asking for, and goes and looks for a hat of that name. This is specific to Apache, yes. Other programs need to have a similar kind of module, yes. And we have a such number, PAM, that does essentially role-based access control so that you can have a per-user policy that your shell gets different permissions from his shell. Is that it? Thank you very much.


Good morning, John. In 1911, in a very early science fiction novel, Hugo Gernsback became the first person to predict personalized news. When he wrote, the morning newspapers were transmitted to the sleeping subscribers by wire at about 5 a.m. The newspaper office, notified by each subscriber what kind of news is desirable, furnished only such news. More than 100 years later, that future is more than now. Our personalized news sources would more accurately be called information and entertainment feeds, and they contain everything from pictures of your cousin's baby to the unfiltered thoughts of the President of the United States. But in Gernsback's future, it was you who decided what news you wanted to see, and that idea on its own may be troubling. But now, who decides what ends up in your feed isn't you. It isn't even a person. It's a computer program, and increasingly a program that built itself in ways that no one fully understands to satisfy not your needs, but the needs of the platform. These machines are given desired outcomes, but how they get there is up to them, and their goals are tightly held industry secrets. But here are two things that are very clear. One, the information in your feed and how it is served to you can have a lasting effect on who you are and how you feel. And two, the business model of social media relies on selling that power for a profit. Due to a failing in Facebook policy and enforcement, Cambridge Analytica was able to create psychological profiles of tens of millions of Facebook users. We have somewhere close to four or five thousand data points on every adult in the United States. And then they could create not just advertisements, but news stories, and even entire news outlets, specifically to amplify and exploit the fears and anxieties of voters. This was a violation of Facebook's rules, but not of any laws, because in the US there are so few laws regulating these companies.  But as artificial intelligence gets better, even small amounts of data will likely be enough. Smaller and smaller signals are becoming clearer and clearer. Machines are now able to tell with 91% accuracy what a man's sexual orientation is from profile photos. If you're wondering why Facebook is worth half a trillion dollars, it's because of its ability to capture your attention and because of what it knows about you.  This is not a secret conspiracy. It's their business model. Facebook isn't the product that's being sold. Facebook is free. You are not the customer.  On the social internet, your attention is their dollars. And for them, that means that anything that gains attention is good. And whether they decide to have any regard for truth, for the stability of society, for the health of their users is at the moment entirely up to them. And while some of us will dive into these issues to at least understand, most people won't have the time to do that. And ultimately, we need Facebook. It's socially expected, it's necessary, and it's a useful platform. We're trapped. So the only thing to do is remember and to help others learn. If you don't control the feed, the feed is controlling you. John, I'll see you on Tuesday. John, our new media literacy series on Crash Course with Jay Smooth is so good and fascinating.  It might be a little less cut and dried, but it's going to be a lot more accurate.


What is going on everybody? My name is Alex Friedberg and today we're going to be walking through case statements in SQL a case statement allows you to specify a condition and then it also allows you to specify what you want returned when that condition is met So we're going to be using this employee demographics table that we're looking at right here We're going to walk through the syntax of how to create a case statement And then we're actually going to some use cases at the end So let's start off by specifying what columns we want. Let's say we want the first name We want the last name and We want the age Now let's just get that information Now for our case statement, we're going to be using this age column. So we actually want the age to be in there So let's specify where age is not known and Run that so now we have a pretty good look at it and let's just order by age Just to clean it up a little bit So now let's start building our case statement. So we're gonna say case and Then we want to say when Now we need to specify what condition we want to look for. So let's do when age is greater than 30 Then then what do we want to be returned? So we want to return that they are old Else so that means anything that is not over the age of 30 We want to return young and then you need to specify that you were done with the case statement And so you'll write and at the very bottom. So this is our first case statement. Let's run it and see what we get So as you can see a new column was created and if the person is over the age of 30 So 31 and up they're given old and if they're not over the age of 30, they are given young Now we can do as many when and then statements as we want So if we want to we can also do when the age is between 27 and 30 Then we want to return young and Anyone else we're gonna call a baby So now we have Ryan Howard as the baby anyone between 27 and 30 they're considered young and Anyone over the age of 30 is old Now something to note is that the very first condition that is met is going to be returned So if there are multiple conditions that meet the criteria only the very first one is going to be returned and let's Demonstrate that real quick. So if the age equals 38 then return Stanley because that is Stanley And let's execute this real quick So right here, I'm specifying that if it's 38 it should return Stanley But he is right here and it still says old and that's because this condition was already met now if we were to put this right here It should work correctly And let's try it out So now because this condition is met first it is going to return Stanley down here So now let's get into our first use case. Let's start off by copying this and Then commenting it out. I only did that because I don't want to rewrite it because I'm lazy Let's get rid of that and let's look at this real quick. We are going to join on another table that we have really fast That's going to be sequel tutorial if you've watched my other videos than you Know this table and we're gonna do that on employee demographics employee ID is equal to employee Salary that employee ID Okay, so let's just look at everything in these tables really quick Now we are gonna be focusing on the job title in the salary column, but we want their first name and last name as well So let's start building that out. Let's do first name last name Job title and salary and Let's look at this really quick. So now we have our employees and here is the situation We had a fantastic year this year selling paper and corporate has allowed Michael Scott to give out a yearly raise to every single employee But not every employee is going to get the same raise because our salesmen are Genuinely the people who made us our money and they're gonna get the biggest raises Well, other people really are gonna get that big of a raise So now let's go through and create a case statement to calculate what their salary will be after they get their raise So let's start off by saying case and when and We want it to say when job title is equal to salesmen So when they are a salesman, what do we want to happen? So this is where the calculation occurs So we're gonna take their salary and Then we're gonna add their salary Times how much their raise is gonna be so the salesman did really really well and we want to give them a 10% raise this year now when their job title is equal to Accountant Then and we'll take their salary We will give them Let's give them a 5% raise still very generous there we go and When the job title is equal to HR then It's gonna be the salary plus the salary Times and then we're gonna do point zero zero one Alright, and else we are just gonna do salary plus salary oops Let's do a parentheses Times and let's just give everyone else a 3% raise and then we'll write end now. Let's take a look at our results So here's what we have so far. We have our first name our last name our job title and our salary That is our current salary and then we're gonna have our salary after we get our raise So I'm gonna actually write that up here. So let's do as salary after raise And let's execute that So let's look at these raises really quick So we have 45,000 and since he is a salesman he gets a 10% raise, which is a raise of $4,500 so 45,000 plus 4,500 is $49,500 and as you can see down here, we have HR who is making $50,000 is now he's making $50,000 and five cents. So everybody got a raise So that is our case statement. I hope that was helpful I find myself using the case statement a lot when I'm wanting to categorize things or label things and that's kind of what we did in the First example and you can even do calculations like we did in this use case. So I hope that was helpful Thank you guys so much for watching. I really appreciate it If you learned anything from this video, be sure to like and subscribe below and I'll see you in the next video


The Nigerian Labour Congress NLC has suspended their planned nationwide strike over a scarcity of the Niren note. The Labour Union announced a development at the end of its National Executive Council meeting it had within the week. Record that the Labour Union had earlier disclosed that it would begin an indefinite industrial strike from Wednesday, March 29, 2023. I think that it would picket branches of the central bank of Nigeria, CBN, across the country. According to the NLC President Joe Agiro, the Union decided to put the strike action on hold after receiving briefings from a state's councils in 36 states and the Federal Capital Territory, FCT. The Union would resume planned protests if the Niren note remained unavailable to Nigeria by the end of two weeks. Yes, there is compliance by CBN but the NLC, after its next meeting, doubted the sustainability of such that compliance. And we don't want to be calling you back after two days for another action. And we felt that we have to monitor this compliance for the next two weeks to see whether it is sustainable. Because they have rushed to move money to commercial banks. And some of those commercial banks are getting empty again. Cues are returning in some of them. So it will be very naive for the Congress to hurriedly call up the action. We want to loosen up for another two weeks with committees set up at the national level and in all the states of the Federation to coordinate the level of compliance. There are some banks that equally didn't open for weekend. And by this press briefing, we equally wish to advise the CBN to play the role of regulators. They should play their regulatory programs because they can sanction banks.


The Linux show starring Nick Carter, master detective, presented by ACME, America's great producer of fine quality paints. This is the story of a man known the world over, as one of the most daring and resourceful characters in the history of detective fiction. A man whose name has become a symbol of the triumph of right and justice over the sinister forces of crime and lawlessness. A man recognized as one of the great masters of deduction. Nick Carter, master detective. Today's exciting case, the unwritten letter. Another exciting chapter dramatized from the life story of Nick Carter. In just a moment, we'll hear how Nick Carter investigated the strange murder of a man who died with a blank letter in his hand and captured a killer through an interview with a corpse. All work and no play makes Jill a tired housekeeper, but any homemaker can have enjoyable leisure time to spend as she likes, when she depends on the three great Linux home brightners, those efficient new shortcuts to the care of woodwork, furniture and floors, Linux clear gloss, the modern brush on finish, Linux cream polish for fine furniture, and Linux self-polishing wax, the amazing new quick drying wax product. Yes, the three great Linux home brightners are the modern way to save household drudgery. They'll do your work in record time and do it with spick and span thoroughness. So start now to enjoy new leisure. Ask your hardware, paint or department store for the three great Linux home brightners, the efficient shortcuts to new home beauty. Now for today's exciting case from the life of Nick Carter. Breakfast is over in the old brownstone mansion at the corner of fifth and fourth, and Patsy and Nick are on their way into the master detective study to begin the morning's work, when suddenly... Oh, bother, I might have known there wouldn't be any peace today, just when we needed. Nick Carter's office. Miss Bowen, Sergeant Matheson. I hope this is a social call, Sergeant. We've got a whole morning's work ahead of us. Yeah, ask Nick if he'd like to be interrupted. Nick, Sergeant Matheson wants to know if you'd like to have your work interrupted. Ask him for what? For what, Sergeant? I don't think Nick'll settle for anything less than murder. Ask him how he'd like to be haunted this morning. Haunted? Yeah, that sounds interesting. Let's have the phone, Patsy. Hello, Mary. Uh-huh, gotcha, hey, Nick. What's all this about haunts? Some dame called up this morning from an old loft building down in the village. 23 Blaine Street. She claims she's being haunted, not at night, mind you, but during the day. Uh-huh, daytime ghosts. That's the new one. Yeah, she claims they rumble at her all day long. I'm just on my way down there. Want to come along? For spooks that rumble by day, you bet. Meet you in front of the building in 20 minutes. Right. Right. Get your hat, Patsy, and put in a call for the car. You and I have a date with a ghost. This is it, Patsy. 23 Blaine. Golly, what an ancient building this is. It looks as if Peter Stuyvesant built it. There's Mary coming down the street. Oh, good morning, Nick. Morning, Mary. Morning, Miss Bowen. Hi. So Nick wouldn't settle for anything less than murder, eh? I notice you've beat me here. I take it all back, Sergeant. Let's go in and meet the ghost. Who was it called, you, Mary? Oh, some dame named Madam Sear. Uh, that's her name there on the letterbox. Madam Sear. Medium. Well, if that isn't the payoff. A medium afraid of ghosts. And in the daytime. Door's locked. Must be a bell button under Madam Sear's name plate. Ring it, Patsy. Okay, I will. Oh, Nick! To the level of peace. Better get in there fast, Mary. Get your shoulder against the door. Go shooting guns together, Nick. All right, again. What force should you... Careful. Watch out for the debris, Patsy. Right. Come on, Mary. This isn't holding out to be the scullion. Nick! Hold it! Said I wouldn't settle for anything less than a murder, Patsy, huh? Well, you were right. There's a man on these steps. And he's been shot to death. I'm not ready to examine the people in this building yet. I want them to be taken to a room and kept there. Right. York, get him out of here. Yes, sir. All right, all right. Yes, follow the detective there. Go on, follow him. Okay, Nick. Now what's the score? I've searched this man's pockets. His name's Joe Cain. Address and business, unspecified. Uh-huh. We shot through the chest twice with a 45-caliber slug. Died instantly. Yeah? What are those bruises and scratches on the face mean, Nick? Cain was killed somewhere on the stairs. He dropped and rolled partway down. Anything else? Two clues. One fairly unpromising. The other. Very odd. Uh, go ahead. He's got a racing sheet in his pocket. Schedule of some small racetrack in a town-up state. Uh, I've never heard of the place, or the horse is listed. Then again, Nick, we don't know too much about horse racing. And, uh, the odd clue. In Cain's hand was clutched to a large blue envelope right here. Uh-huh. Apparently, the reflex of death made him hold tight. What's odd about that? One thing. There's no address, stamp, or mark on the envelope. There's a sheet of paper inside with nothing written on it. Well, for the love of peace. An envelope without an address? A letter with nothing written on it? But what does that mean? I wish I knew. But I've got a hunch, if we could answer that question, we'd know who killed Joe Cain and why. Well, we know one thing, Nick. It's got to be one of the people in this building. We covered the front door. No one came out while we were going in. That's right. We've already checked the roof. It's sealed shut. No one went out that way. And the back door is bolted on the inside. The windows? All barred with heavy grates. The killer's got to be one of the people inside. Good work, Matty. Now, what about them? Well, there are three floors in this building. Each one is occupied. The first floor, Madame Sear, the ghost fear and medium. The one who called you. Yeah. The second floor, a guy named Charles Dower. Business is yet unspecified. The top floor is Hal Trask. He's a printer. Madame Sear, Charles Dower, Hal Trask. Right. He makes three. Plus the janitor, a guy named Olson, who was sweeping around the upper stairs. I see. All right. Let's go in and have a talk with him. And York's got him in Madame Sear's studio. You're going to question him separately, Nick? No, all together. Right. I've seen him before. I've seen him alive. Either you're afraid to answer or none of you has ever seen him. Now, which is it? You. You, Mr. Olson, aren't you? Yes, sir. Ever seen the dead man before? No. No. No. No. No. No. No. No. No. No. No. No. No. No. No. No. No. Yes, sir? Ever seen the dead man before? No, sir. I don't see much of anybody in this building, sir. That is right, Mr. Carter. We are all quiet. We all value our privacy. Hm. None of us prize into these secrets of strangers. We do not peek at those who walk the stairs. We keep to ourselves. Madame Sear, you telephoned a complaint about Ghost this morning? It was a revelation from the other world. I am ashamed of my first fear. I no longer complain. And that's a trask? Uh, yes, sir. Printer, sir. Glow press up on the top floor. I never seen a dead man before, Mr. Carter. I see. Mr. Dower? Yes, sir? Hello. Aren't you bad luck? Charlie Dower served two terms in Atlanta, specialist in card marking and tin horn gambling records. No wonder his business was unspecified, Maddie. Hey, what a memory you got, Nick. I'd forgotten, Dower. He's been out of circulation five years. So here we are. Unknown, Mr. Cain, murdered on the steps of this building by one of you four. All of you claim you never saw the man before. And I have the problem of finding which one of you is lying. Well, not me. All right, quiet, quiet. Well, what's the program, Nick? All these people would stay inside the building. I want to search for the murder weapon. Although I doubt if you'll find it in an old rat trap like this, could stay here hidden for 100 years. Yeah, we'll try. I want the squad to check the history of the building and every person in here. We'll do it. Patsy and I are going to take the car and run up to Taunton, who we're back in a few hours. Right. Why got to Taunton? Because it's the home of the Taunton racetrack. Joe Cain's tip sheet was a schedule of today's races. Maybe we can find out something about murder up there. Just another few minutes, Nick. At times, at Taunton, half a mile. Right. Why have you been so glum all the way up here, Nick? I've been mulling over the case, Patsy. I don't like it. What don't you like about it? The whole thing is a phony ring about it. Three crooks or semi-crooks, all operating in that building. All probably lying as hard as they can. Yes. How did Cain get into the building? The door was locked when we tried it. Either he rang one of the bells, which means the tenants were lying, or he had a key, which means Olson the janitor was lying. That's true. In the second place, what about that blue envelope containing an unwritten letter? Why was Cain carrying it? Well, invisible ink, maybe. Secret message. Carried so that we jump to that obvious conclusion? No, no, no. I doubt it, Patsy. Oh, slow down. Here's Taunton. We'll go through it before we see it. Seems pretty quiet. We're a racetrack town. Uh-huh. I haven't seen anything faintly resembling a track. We'd better ask that youngster over there. Hi, Sonny. Oh, hi there. Yes, you, son. Come over here a minute, will you? Yes, sir. Mr. What's on your mind? Which way to the racetrack? The which? The racetrack. The Taunton racetrack. I don't know what you're talking about, lady. You live here long?  Here, take a look at this. Taunton racetrack. Handy cabaret. Hey, Mr. This is some kind of a gag. There ain't no track in Taunton. We never had a race in this town. Yeah, you're being taken for an awful ride by someone. You're telling us. Nick, this is weird. Thanks, son. Let's get back to the city, Patsy. True enough, we've been taken for a ride. And believe me, it's carried us miles closer to the solution of this case. Nick, I wish it explained. Don't act so mysterious. I'll explain soon, Patsy. But I want to hear now. You will just as soon as I've spoken to Matty. And that's the janitor a few questions. Here we are, 23 blame. Hope Matty's inside. Sometimes you can be so aggravating. Patience, Patsy. Come on inside, now. Nick, oh, for Pete's sake, am I glad you're back. You got a fresh lead, Matty? Fresh lead, fresh trouble. That's what I got. Well, I'll iron it out as soon as I've spoken to Wilson the janitor. Olson's my trouble, Nick. He's just committed suicide. A non-existent horse race, and now the suicide of a key witness. How will Nick straighten out this tangle of events? We'll see in just a moment. The up-to-date way of doing a thing is usually the best way. And you certainly find that's the case when you beautify your floors in linoleum with Linux self-polishing wax, the modern way to perfect floor care. One practical test is all you need to know that here is a quick drying wax, which is really different. Linux self-polishing wax made from a new formula was developed by leading research chemists to give new beauty, new protection, new skid resistance to all your floors. And Linux self-polishing wax contains the greatest possible amount of real carnauba wax. For that handsome, satiny finish only real wax can give. What's more, the underwriters laboratories have proved by test that any linoleum, hardwood, or rubber tile floor is actually less slippery after Linux self-polishing wax has been applied. Best of all, Linux self-polishing wax takes only a jiffy to use, for you simply wipe it on without tiresome rubbing. And it dries quickly to a beautiful luster that's a joy to behold. So choose genuine Linux self-polishing wax one of the finest products of its kind. Ask your dealer now for all three great Linux home brightness to give your home new beauty the easy Linux way. Back to our story. A complaint about a haunted loft building brought Nick Cotter, Patsy, and Sergeant Matheson down to an ancient office building in time to hear, but not witness, the murder of Joe Cain. Curious clue to the murder was an unwritten letter in the dead man's hand and the race track program for a non-existent race. Then the janitor of the building, Sergeant Matheson, announces suddenly is committed suicide. Now Nick, Patsy, and the sergeant examine the dead body. It's pretty careless of you, Maddie. Oh, honest, Nick, how was I to know? I was down in the cellar with a squad looking for the murder gun. When all of a sudden, we hear the shot. We never thought that was true. You'll find a weapon in Olson's hand. Yes, I understand.   Probably thought we were hot on his trail. Maybe, but I'm not so sure Olson did kill himself. Why? Why not? Too pat, too convenient. I've worked on thousands of cases, Maddie. And never yet had a killer give up so easily. But it looks legit, Nick. Bullet wound in the right temple, gun in the right hand. I happened to know Olson was right-handed because I saw him sweeping. There are powder burns around the wound. The gun was fired at close range. Why, the body looks as though it had fallen naturally. Maybe, but I doubt it. I'm going to take the gun back to my lab for a quick check. Have a man sent over the fingerprints with the entire crowd here, Maddie. Right. Oh, any of those reports come in yet about the building of the people? I expect them any minute. Now, wait here for me when you get them. That's it, and I'll be back in half an hour. All right. Oh, and by the way, Maddie. Yes, Nick. How much would you like to bet that Olson never was janitor of this building? Oh, all right. All right, Betsy. There you are. Every print on this gun dusted and brought up an all-up and sharp and clear as crystal. Now what? Now we compare. Let's have that sheet Maddie sent over. Here you are. Thanks. What are you looking for, Nick? Oh, I found it already. It's checking to make sure. Found what? Don't be so mysterious, Nick. Look for yourself, Betsy. Every print on this gun belongs to Olson. You can't miss it. Yes, I see, Nick. Well, doesn't that prove suicide? Think hard, Betsy. What happens when you shoot a .45 automatic? Well, I, uh, it fires a bullet. And then what happens to the gun? It stays in your hand, I guess. Gently, quietly, without a fuss? Oh, no, no, it kicks. Exactly. And would you explain why Olson's prints on the gun are sharp and clear as crystal? Obviously, if he'd held the gun and shot himself, his prints would have been smudged and smeared by the recoil. But they aren't. Nick. Uh-huh, you get it now. Olson was murdered by the same person who killed Joe Cain. And the gun was wiped clean and carefully placed in Olson's hand. That's why the prints are so clear. Oh, that just mixes the case up more than ever. Oh, no, Betsy. It's becoming clearer than ever. Let's hustle back to Maddie. I only hope there haven't been any more murders while we were gone. Hey, Nick, you're fantastic. How did you know, man? How did you know? About the murder? Oh, no, no, about Olson. The reports just came in. You were right, he was lying. He wasn't the janitor of this building. Golly. The janitor of this place is a guy up on the corner. He takes care of this whole row of buildings. And everybody in here was lying when they accepted him as the janitor. I don't think so. This is a dark little place. And the real janitor probably doesn't spend more than a few minutes a week here. Just about. They're all pretty careless. A few times he was seen wasn't enough to make an impression. So when Olson said he was a janitor, he was accepted. But the killer? The killer was lying, naturally. Hey, wait a minute, Nick. How did Olson get in here? Oh, Joe Cain let him in. Joe Cain? The dead man? Yes. When? Probably a few seconds before we arrive. Olson followed Cain into the building. Uh-huh. How did Cain get in? Pretty sure Cain let himself in. How? With a key. Nick, you sound as though you got the whole business washed up and finished. I think I'm pretty close to it. You know why Cain carried that blank leather? I do. And about the non-existent horse race? Yes. And why Olson killed himself? He was murdered. And I think I know why. Well, then would you please talk? One more little test, Maddie. And the murderer will talk in person. What's the test? We've got three people in. Madam Sear, Trask the printer, and Dara the gambler. Yeah. All of them claim they don't know Joe Cain. Well, one of them's lying. And I want to find out which. How? I'm going to make some arrangement with Patsy. And then we're going to meet around Madam Sear's crystal globe, all of us. Holy smoke. More ghost stuff, so to speak. The body of Joe Cain is going to walk into the room. And we'll see who recognizes it. Oh, that's silly, Nick. They all saw Cain's body. There's a tremendous difference between recognizing a living man and a dead body, Patsy. Totally dissimilar people look identical when they're dead. We've had hundreds of cases of husbands identifying dead strangers as their wives in the Morde. And vice versa. It's true, Patsy. I see Nick's point. Those suspects who really don't know Cain will not recognize a living imitation after having seen the body only once. But those who knew him. I get it. I get it. And let's get moving. We'll meet the dead body at seven tonight. We've gathered together in Madam Sear's studio for a last attempt to solve this murder. You do well to trust the world of the medium, Mr. Carter. It is capable of miracles far beyond your mere earthly efforts. Quite. I've requested Sergeant Matheson to have present the only surviving occupants of this building, Mr. Trask, Mr. Dower, and Madam Sear, of course. Miss Bowen, my secretary, will act as witness. Sergeant Matheson will preside. And I'll ask the question. Will you all be seated, please? Everybody down, folks. Come on. I presume you work best with the crystal in the dark, Madam Sear. Oh, that is correct. Lights out, please, Maddie. Right. Thank you. And now, Madam Sear, with your help, we will try to recreate the murder scene in the magic crystal. First, there must be silence. And silence you shall have. The crystal is cloudy tonight. There is much antagonism in this room. The veil can be parted only with difficulty. The clouds begin to vanish from the glass. I see faint lights, faint forms swirling in the blackness. I see a figure. It is a man. It is the dead one. He walks through night followed by shadows. There is one shadow I see with a gun. Sergeant Matheson, I hear it again. The spirit's talking. Oh, for the love of Pete. Oh, do you hear it? The groaning and the rumbling of the dead. And this is what made your telephone this morning? It is heaven's name. Protect me. You hear it. Don't you hear it? Wait. Listen. Someone's coming to the door. Which is the other world coming to us in the name of the dead man. Yes. Joe Cain, all right. I thought he was killed. And that, ladies and gentlemen, winds up the seance in our case. Lights, please, Maddie. Oh, but... No excitement, please. Quiet. The show's over. Is it our? Madam Sear, please be calm. It's not Joe Cain. The alien actor appropriately costumed and made up. What? They both recognized him. They were both lying. Madam Sear and Mr. Dower. Trask never batted an eyelash. He told the truth. Yes, Patsy. And I'd add. It's because Mr. Hal Trask told the truth about not knowing Joe Cain that he'll be executed for his murder. He'll never prove a medic... Oh, no, you don't, brother. A very clever crime, Mr. Trask. And for an unusual racket. Yes, Patsy. You were right. Trask told the truth. He did not know Crain. Dower and Madam Sear lied. They knew him. They'd seen him in the building frequently. But they didn't know he ran the globe print shop upstairs. We figured it'd be better to say we never saw him before. Naturally. Both of you are afraid of the police. Try to keep clear of murder by lying. You didn't know that Joe Cain's racket was printing phony programs of non-existent horse races and that he used these to induce innocent victims to book bets with him. Betts which he pocketed and disappeared with. You're right, Cotter. Cain had a hot racket. We heard about the dough he was making. It was a good thing.  A big piece.  And you've acquired a one-way trip to the chair. In just a few minutes, Nick will be back to give you the final details of today's story and tell you why the murdered man carried an unwritten letter. Dust, finger marks, and accumulated polish all are likely to make furniture look dull and cloudy. So naturally the first step in furniture cares to remove that cloudiness and then give your furniture a beauty treatment with the finest polish you can find. Well, Linux Cream Polish for fine furniture does the whole job at once. Yes, that's right. Linux Cream Polish cleans as it polishes. That means you cut the job in two, save half the time, half the work. That's why so many thousands of modern American women are swinging to Linux Cream Polish, which cares for household things the easy way. See that your fine furniture keeps its good looks with Linux Cream Polish, which restores its original gleaming beauty in one simple process. Because Linux Cream Polish dries hard, it even cuts down future work, for it leaves no oil on the surface to attract more dust. So make it a point to use Linux Cream Polish, which cleans as it polishes. You'll find all three great Linux home brightness, Linux Cream Polish, Linux Self Polishing Wax, and Linux Clear Gloss, the longer-lasting brush-on finish at hardware, paint, and department stores everywhere. And remember that your dealer is headquarters also for ChemTone, the miracle wall finish that brings quick new sparkle to walls and ceilings. ChemTone covers in one coat, dries in one hour. And now let's hear from Nick Carter himself. Nick, I understand the motive for Joe Kane's murder, but what about that unwritten letter? Well, get the picture again. Traskin Olsen decided to rob Joe Kane. They'd heard he was making a fortune out of his racetrack fraud, but neither of them knew him. So, obviously, they couldn't take a chance of Kane arriving in his office while they were rifling the place. So Olsen remained downstairs to watch, while Trask went up to rob. But how could Olsen watch for Kane if he didn't know him? By a simple thug's trick. He placed a large blue envelope in the globe print shop letterbox. All he had to do was watch that. He knew whoever took the blue envelope out of the letterbox would be Joe Kane. When Kane arrived and picked up his letter, Olsen quickly followed him into the building, first signaling upstairs in the buzzer to Trask. Olsen followed in case Trask couldn't get away in time. And, evidently, he couldn't. Right. Kane saw Trask leaving his office. He pulled a gun, the .45 automatic. Olsen closed in from behind. Kane was killed and rolled down the steps. I doubt if Trask ever got a really good look at Kane. Then, as we pounded on the door below, they thought quickly. Trask pretended to be the proprietor of the print shop. Olsen grabbed a broom and played janitor. Golly! But later Trask realized Olsen's pole would be uncovered. So, the first chance he had, he murdered his partner to keep him quiet. He tried to get rid of the gun by planning it as a suicide weapon. But how about the ghost that Madam Sear thought you heard? We heard them, too, when we kidded her into staging a seance. Well, that's the strangest thing about the case. If it hadn't been for Madam Sear's ghost, we'd never have entered the case and never have broken it. And if it hadn't been for the ghost, there wouldn't have been a case in the first place. Why not? Because Madam Sear's ghost was a distant rumble of a new printing machine Joe Kane had just had installed so he could print more of his phony race sheets. I had an officer turn it on to haunt seance. Well, Nick, I hope you have as exciting a story for us next week. What's it going to be? Well, Ken, next week we're going to meet the champion apple pie maker of the East, who, fortunately for me, also happens to be an old friend of mine. She came to complain that her landlord had broken the walls without her permission. Unfortunately, when we arrived, we discovered that the paper hanger had not only hung the wallpaper, he'd hung himself. Sounds like a strange story. What do you call it, Nick? The case of the hanging paper hanger. And now an important message from Nick Carter. Remember what happened after World War I, the inflation and the boom period, then the crash, and the worst depression America has ever known. Now, let's not permit that to happen again. Let's resolve to buy only what we need, paying ration points in full, paying no more than ceiling price. Let's resolve not to profiteer on our own services or produce. And let's buy and keep war bonds to protect America's future and our own. Nick Carter, master detective, is copyrighted by Street and Smith Publications Incorporated. Lawn Clark is starred as Nick. Charlotte Manson plays Patsy. Original music is played by George Wright. Any resemblance in these programs to actual persons living or dead is purely coincidental. The entire production is under the direction of Jock McGregor. Master detective is presented at this time and over these same stations each week by the three great Linux home Brightoners. Linux self-polishing wax, Linux cream polish, and Linux clear gloss created by ACME, America's great producer of ACME fine quality paints. This is Ken Powell speaking for the thousands of Linux dealers all over America and saying, so long until next week, this is the Mutual Broadcasting System.


So I haven't done a vlog update in a little while and I thought I would do this so today is 31 days of This guy Wow. Yeah, so I figured Marv and it's kind of impromptu This is not scripted because those are the only way vlogs are done properly It's also a thing that Tom really likes to do. Yeah, don't script anything I was gonna ambush him when he walked in the door, but I didn't quite have the camera set up I was gonna have him walk in the back door just set him down now speak to the camera That it's very early. I haven't had coffee yet So but what we want to do is share with you what has Marvin learned in 30 days Besides what we've shared with you such as the plunger thing you learn that yes And and I have used it on more than one occasion so far oddly enough Yeah, and the only prompting he said so far is me saying we're gonna shoot a video about what you've learned in 30 days Come sit over here So it's still a little bit ambushing, but I didn't have to set the camera up and put a light and you know Yeah, so I've had some time to try to think about all the all the things that I've learned and put a positive spin on them No, that won't be hard to do it all I I've loved every minute of being here so far That's a good start. Yeah, so yeah, what I guess what I've learned It's it's a lot of fun working here. I don't think anybody who's watched the videos would doubt that the everybody here is great and I mean, that's the personal side of it But just even like business side of it is just I've learned a lot about small business. I spent I Spent all of my career up to this point in academia, which is a very different world Not the real world is it? No, not at all. I'm not at all so meeting all these business people and You know learning that everybody has their own story and how we fit within their story is It's been challenging, but it's been a great challenge and I've really I've loved it so far and Marvis also learned that Large corporate companies sometimes have their head up their butt in special ways Like you know when they show up without the cable to run the cable that we're there to help them run and they meet Us there, but don't have the cable Marvis like how does this occur? Yeah, that was told Yeah, that was that was that was a foreign kind of a foreign concept to me Because in academia like they they like to do everything in-house so there may be a Department completely devoted to taking cables to where they need to be and that is that person's job And when no cables need to go anywhere that dude has nothing to do Yep So yeah, just things like that just sort of how I guess things can get overlooked When you're in a big corporation and you have all these things to worry about You know, you're not thinking about you're just thinking about we need to the cable needs to be run So we're not thinking about oh, yeah the cable needs to get there if we're gonna run it And I think I at least around here, you know, it's our job to manage those things and do those things So I'm happy to report and to say here that doesn't happen too often. We know what we need We often know what other people need Before they do yeah, so we can take care of that So learning kind of to juggle all that stuff too has been a good thing for me to learn Yeah, so it's been a lot of fun. He's now taking a lot of the burden of paperwork off of me and a lot of the burden of paperwork I might add I Haven't seen Tom push a single piece of paper since I've been here But I got a stack of it on my desk. It's also partly because we're paperless So yeah, that's that's one of our little things as we do a lot of that and that's actually something I want to I'm gonna cover hopefully soon is other IT people I see them doing different ways of document management and things like that and we have our Own ways that we do it and I want to encourage people to do it. You know, we focus on security focus on comprehensive document management and focus on a Storing things in a very sane manner. I guess would be a good way to put it We actually I was on the video the other day that was also live and one of my clients who is here with me on that live Video as I was on his show show he hosts on Facebook live But he liked that because he came from the corporate world where document management mattered a lot Which was the Ford Q1 and ISO world for manufacturing, but we I know that's where I was before in corporate So those document management methodologies those processes. You don't find them a lot in IT IT people start out of I'm really technically savvy. I'm really good at fixing computers and then turns into that and Marvis You know, we've indoctrated him into our document management process and he likes it too because I imagine documents are at least somewhat organized in academia, too They try to be yeah, they they tend to be and the in the actual academic side of it Yes But I would say there's room for improvement there. Oh, always. Yeah, yeah little sis is perfect It's the best we have today, but it never means that we've stopped progressing towards something better That's how I like to look at and I actually I wonder sometimes if that isn't something that keeps Companies from adopting a good document management or changing their document management program. They're afraid to change it exactly They they they think like oh well this company does it this way. We should do it that way It might that might not be the best way for you We we just kind of started switching here over to a new kind of document management system Within the last couple of days That I think is gonna work well for us. Just yeah, it might not be something that would work for another company though, right? And in part of the reason we're able to be a little bit more agile one We're not that big of a company with only a few people But the other side of it too is we use everything on open source software Which is a topic I'm gonna get to in a second here But a lot of that means Marvis like hey, can we add this feature and I'm like sure can we add this? I'm not the best programmer and most of my programming turns into a game of what did Thomas spell a variable?  But you know in a matter of hours I was able to modify our systems because we have all the code to them and add the features we wanted for document management and Basically, it's like a conversation system. We added so we're expanding how we do that and you know It's almost things but the topic of open source comes in because we've converted Marv over to Linux And how much Linux has used before 30 days? I had a Ubuntu disk that I would use if there were Files that were unrecoverable on a Windows machine. So I would pop that in Recover the recover the files and then and then image it back to another one So I had really that was that was it. That was all I had And now I'm my machine is a Linux machine. I'm learning About it every single day and I love it so far. Yeah, so we've brought him over to the Linux side So he's now actually full-time using it and reading business and work on it and sending out quotes and doing all the things that the job function entails and you know because we run everything in here and open source software It's been you know, we were here to answer questions for him But it's one of those intimidating things people are afraid to use but we're like we use it every day here You know our computers are open source the stack I run in the back that runs on a point-of-sale system runs our docket management Everything's open source stack and then the desktops we use our all open source and we're able you know people say oh I should use the software that my clients use and I'm like why why would I want to torture myself like that? Trust me. I fixed Windows problems every single day We had a crazy active directory problem with a server the other day We had another problem with another Windows server or SQL server decided not to start those are issues We fix every day I have plenty of hands-on experience day in and day out fixing Windows because reality is my very little very very little My job is fixing any Linux problems all of my job is fixing our support problems We have windows and all the tools we have you know We're picky about the tools we choose because they work in open source So it means I can use those tools to administer closed-source machines such as windows You know and the screen connect is one of our remote support tools no problem the whole Control panel MSP software use it's all web interface our whole point sales system web interface So it's the the platform that you run it on is really irrelevant And then everything else is just putting some quotes together which any document You know can do to put together a proposal leave your office works just as good as Microsoft office for that But it half the price and fewer of the problems So Marvin is a no problem adopting over to it once you tell them which softwares to use You can switch over to Linux and go wow this isn't hard, but we don't run QuickBooks So I will throw that out there for a lot of small businesses in Washington Can I switch to Linux which I get a lot of them I see what is the software choose and if they say I run QuickBooks like I'm sorry If you love QuickBooks and a lot of people do I'm not a fan of it But we support it we fix it all day with QuickBooks accounts for it as some percentage of the problems that we fix for our clients Because it's also based on a they're not the best programming I think so Outside of that most things if you have a web-based application you can probably switch over to Linux You can get rid of a lot of the problems and get started and I'll also can throw a link to video of getting started with Linux I have a video tutorial what it's like to get started and get loaded with it very good video I've actually I go back to it a few times. I've gone back to it a few times. Yeah Oh, and before you watch that video read the comments. I have not comments the updated description of video I use a couple words wrong and you're never is wrong is when you're wrong on the internet That's a true so people share with how wrong I am About a couple things I'm fine with that. I actually they were correct. I was wrong I interposed a couple words and I said a couple things like oh they released this every year And I meant to say every two but I said every year So so I could called out for saying it wrong and I did I have an errata at the bottom That's the correction of things I said no problems with that but it doesn't really affect the whole video It's it's it's people who are tech savvy love to be super correct And they should be and I should be more diligent and read from a script versus, you know, my head, which is sometimes accurate Thankfully when Tom said I would get paid every week. It was not every two weeks Yeah, so he was correct on that one and so that has been no problem. Yes But we just want to share an update vlog update, you know Marvin's using Linux So there's a change Marvin is adopted to our ways of how we do things and I'm drinking the Kool-Aid. He's drinking the Kool-Aid And eating some of the hot sauce. Oh that is that you know what that is the probably the biggest thing I've learned is how to eat really good food I mean, obviously you can look at me and see that I don't have a problem eating food But we have some really good food here So this is probably only going to expand but you know Steve also likes to go to the gym So maybe I'll hit the gym with him a couple times after eating his beef stew. Yes You can get like a beef cake after. Yeah Oh Also, our goal every day is to try to find something funny enough to have Marvin lose comp lose composure That's and it happens often enough. I'll tell you what there's some funnies. There's some funnies Yep, so that's it's been fun and Like I said, just wanted to give a vlog update as always also I wanted some thoughts on You know, I always like feedback feel free to leave some comments send me messages I love when people email me because I have my podcast Which you get emails from and I'm as my build-up subscribers on this channel I'm trying to figure out, you know, the channel I had someone say they're right that the channels kind of scattered as I cover a lot Topics, but really that's what I do. I do a lot of different things We as a company do a lot of different things sometimes we're fixing retail computers Which is not so exciting a lot of our day job is fixing quick books problems and fixing printer support Nothing I can really make a video about food is fun So I'm always encouraged, you know when people I clearly one of the popular topics is all any of the videos I do on firewalls, which I plan to do more of those. I did some videos on Being secure keeping your IP address private those seem to be getting popular But if you have said, you know, I'm always looking for different suggestions Someone said a couple of them that I'm not sure how to address which was how to Show how we do a new computer and I'm like just not a lot You know, there's not a lot we do with that But either way keep the comments coming that's what helps drive a narrative so we can figure out What I'm supposed to be doing because it's a lot. Honestly, I just guess a lot I'm like, hey, I'm doing this topic or when we do it for a client like hey I need this firewall setup with dual failover. I end up doing a dual failover video I see PF sense as a new box coming out I go review the new box because we like PF sense. So keep the comments coming and So you want to see as of right now? We're coming up on about 3,000 subscribers on our YouTube So I want to do a giveaway But I don't know what to give away because I cover so many topics Maybe I should give away the firewall But of course I said I'll give away the red firewall Also, my review of the firewall is not very good So I don't know if this is the best giveaway, but I don't know what to do with it either I can't really return it But if you have an idea for a giveaway what I should give away I don't mind giving away something and I'm excited about having 3,000 subscribers and but yeah Encourage you know, just encourage me to do more by sending comments and likes or all that fun stuff So this is going on Facebook But if you're not watching us on Facebook and you're watching us on YouTube Like and subscribe for more content and also suggest what the more content should be the buttons down Yeah, somewhere's a button. Yeah, we definitely give us ideas because then that's less work We have to do oh, yeah, and then we give you exactly what you want It's a sympatical relationship we have here folks Oh, and I also I did my video on where all my money went on my YouTube channel Come on yeah worth every penny a summary of that video if you don't want to watch it Is I spent all my money on people People are what drives a tech business so the But if you want more business topics tell me kind of if there's like a general business thing You want to know about how my business operates? I will more than happy to share any of that with you or how I've managed to stay business this long Because if I talk about it, I'll figure it out at the same time I think it's because of honesty integrity, but there might be more to the story than that I'm sure that's those are parts of it certain. So if you're still with us. Thanks for listening and see you next time. See you