What's up, good people? We are right here at the Panari Hotel at the launch of the premiere of The Born to Shine, a movie by Maya Productions in conjunction with the Greenview Skulls Kamu, wawone. It's Maya Productions. Ya, it's my production band. Ya mbo bipi. Mini kofiti? Nani? Mini kofiti piya? Nia mbeni. Ya mbeni kwa maikapum transki hafizuri nia, nia nga tuwa tuwa TV na. No ni mimi. It's my day. Nia mbeni ni sasa. Miza tumbeji na lako. Mini tuwa exo the director. Exo the director. Oh, exo the director. E exo the director. Oh, okay. We say exo the director knows like that. Ya. Maybe you can tell us a little about the Born to Shine, a movie. Born to Shine, hei. So Born to Shine, ilikwani aidiya, onjiwa actually Maya tumbe kuatukifanya nga movies for quite some time. And we are looking for something that is a build up, is a tini piya game, kwa industry. We didn't see it coming, but idea ilipopout to ya, what if I do the first musical in Kenya. Nika ibrain storm, I met my team, nika ibrain storm. Tukasim watata after shule because we wanted to kuangaliya shule, to kuantata after high school. But we are like, high school watu wengo mefanya. Mbisa Rafina ilikwa musical kidogo, na hini kwa high school. We were thinking of what's up when the lower kidogo. So to kind of grade 6, 7. So it was primary, it was really amazing. So to kind of shule green view, and green view when it will share the idea, they bought the idea. They were like, let's do it. And it was amazing. First time working with kids and how has been the experience working with them? Actually it was the first time we worked with kids. And actually kwa kwa kids ni interesting na inataka a lot of patients. A lot of patients in Manisha, watoto sikama wa tokubo. Wana shikavitu wa raka, but lasimo wende na pesiao. Always wakim visa. So in time to kodunashut, wakisao lines marami kita tukufanya, rudia, rudia na liza pulia. So we have to hold up to it, umtu endakafanya PR. But it was interesting, it was really interesting. Looking at the banner behind, of course, tuneza kuna the cast watoto in school uniform. Naja kuna wa torii watanzakusema. We have been like the comeback of Tahidi High. Actually it's Tahidi High. Actually this is not like, this is the first of its kind. It's a musical. Actually how to iwana imba. Like no one's business. Ah they have good voices. So it's amazing because it's one of its kind. It's the first musical. They are musical in the family of Kenya. And it's a musical movie. Yes. So we have talked with, I think, the principal of Greenville Schools Kamulu. Ya Greenville Schools Kamulu. Na alkuna sama PR. The first time, of course, they approached the students about the project. They were okay. But now, of course, they had to involve the parents. And kidogo, kidogo, maria kwa maria. And aparta ile rejection from the parents. Because we also have parents who want their kids to fully focus on their education. Kwenu ilu kwa wipi? Apolo challenge li kuwapo. Ya ku convince the parents, wa allow their kids to feature in a movie. But electorally say di asana na Greenville. Greenville wali ongelesha, all the parents, wakambia apart from education. Kuna hi talent. Na hi talent ndi wato naku liya skuizi. So kini mamto to your talent size. I think umedu me distrae fuchake. Because apart from education, I think talent to kila kitu sa isi. So we talked with the parents. And the parents were like, Ya, we can do this. And they signed the consent forms. We were like, Ya, we can do it. And today is the premiere. At the moment, manzee, it's been crazy because since truly release trailer, manzee wakapata offers, a lot of offers to make, wakapata view sasa, rush lake, to go in communication and netleagues. Ya, ya, ya. I mean it's, it's, it's, it's, it's kuna mtwe to Disney. Wa manzee kuri chout. I mean, people wa manzee kuri chout. Ya, ya, ya. I mean it's really amazing. KBC wali qikwa wakafanya, a review of it, it's really nice. Ya, ya, na tu kenda wai 254, ya, ya ya ya, and koshulu everywhere. Y Buddhist. And of course of this, is taking us back to a childhood kidango, we had, nii, ... for example, Matcha Chary, Yama wa Twingwell kua paiTe, kiyasa nalabdha. So for you, as a Maya production, would you consider maybe having it on TV, A ma kidongo, you're like, na na se ma kumepata yvar offer, but tuna drakatu kubreyngstone kidongo, We have this strategy to go to the next stage, but we have to make it exclusive to brand new, I am an avatuhan to do what we can do, because we about to start a tour. I told her, we had a tour to all the schools in Kenya, so we are thinking of bone to shine too, we make it a franchise. I am considering your working with children, did this project take longer to complete, or was it a shorter period? We were shot around two months. Two months? Is that long shot? Short? Because we were working at time lines for three months. It was really short. So we were shooting hours a bit crazy because we were working times at school. So we were shooting maybe two hours ago. We shoot in a kwa kama lesson. So we managed to collect that long. So the whole story about the acting industry in Kenya, what do you think is the future for example of these kids and a bond to shy? Oh, actually the future of these kids is great. Actually when we released the trailer, some TV stations that I mentioned, Waliansakuri Chout. So one attack, one attack, one attack, one attack, one attack. One attack, one attack, one attack, one attack. Hey, can you send a model log? We want to feature her. So I think the future is great. So we will discuss about that in the next episode. What next after the premier here? Can we talk about it again? And maybe also talk to the parents. Of course we will talk about it in the next episode. First things first. Kamawin Mzazi. And I'm Toto. Please, not your talents. Actually the talents are only for you. Me personally, I got my first like one million na talent nili peo one of minna zoska pesa kitambo minu dem sewa nivi lehaza, we don't show it but I've been with Maya Productions I'm the CEO of Maya Productions so prulenda kushikaido kitambo na seizi ambiyam tu ati talenta iwi pi so come on you parents na you care about your kid actually everything in a go digital everything in a go digital lasimu na cha talentam tu toa ko do sekiyo fichiaa ke 5 years to come habunam tu taku kisumbu na watu taku wangatu apa online so come to here you go online I think so and to all then watuwa industry please support Kenyan content apa kenya kuna watuna wana jituma wana fanya a great production nili saaputin do apa tangi so I'm so proud of all the sponsors mii atatukua jwati sponsors when they come through we love bonshain I want to be actually last week to have sponsors waki wakia kusponsat event wana fightia I want to support how much can I pay I want to support it as in I was like hmm this can happen actually to me was a ticket so totally sold out we haven't spent even a cent of that money mii atata all the sponsors will care everything atata jalipata adami zdiwata nipisangapit me shika but I know we got money maybe on behalf of maybe our viewers after premiere ama atukisha upload izi video atapu anatura jelab dahi movie nezaipata actually we are ata kiku release the movie right now because there is a premiere at Mombasa coming we want to go all the reasons we want to go to Kisumu because right now I think my sponsors want to go for now wakitaka ni cinemas 2 cinemas we are ready to quickly release atata wa ita kakani adesal miyana come this is my managing director mambo hi this is my managing director Maya and make sure everything is running I am that guy my name is Taira Sonyango this is my business partner manze tumefrayasana kufanyai movie Bontu China is becoming bigger than us which is awesome sini wa dogo lakini wenda maju bana wana chwa maju wana nana maju ndega ni ni tuna panda so manze is a pleasure tiki angali ya unafu raha exo previa me tumbia nzito usha sema minnes ma ni kuna doza angu ma tiketi zisha ko solda the tickets are actually sold out if anything we still have more people who want to come in we already have a crowd inside and there is already like another half a crowd that is on their way actually atadukitok kufanya because now they want to come and buy at the gates and we don't know what to do about that and maybe unadjust sometimes the acting industry the movie industry may be in our country dogo inamata tizu watu ame omeongi amengi I don't know what you can say about it ni nana sema haina hella kama ina do niko sababu ajuku ajuktafta do there is money out here filmina lipa entertainmentina lipa nona there are ways to crack these guys are genius somehow is cracked distribution billa ku go through normal distribution channels which is awesome so we are here to start something new nona like sour atua bimbeleza we are coming to take over come out ways to take over basimaju and of course kunaile debate that the film industry is not the safest place for children and their growth what do you have to say about that is a very good question this movie born to shine shows what you do to a child and how that can affect them mentally nona so if you don't spread a positive message via film whereas nona this is powerful we are using media nona this is music combined with film at the same time if these mediums are not used if you can't do a movie like this there are people out there wana fanya vitumbayambaya moving byambaya very badly rated movies now atua wana access so that's why people like us have to come in a space like this and do a movie that actually can get the next generation to change their mindset and actually be better I am asking that because we see some of the child stars in Hollywood to become drug addicts and all that how are you safeguarding these kids from growing into that first of all this is not Hollywood yeah so there is a way we are doing it first of all we have to ensure that all the legalities are done so kuna consent your parents and everything so we are not doing a view to bill approval nona we are very serious about that the children's wellbeing is so important that if we play around with that first of all we will be of course we will be breaking the law nona so we will ensure that when it comes to legalities when we come to the left right and center and we want to make sure we can help to go through this journey nona but of course it is in their parents they can best willing we can be both but the busy force anytime anytime now now I am going to email a twitter Sehamba bro Akito, director I. Xso follow mi on Tik Tok Wei sp crouchfikali Tik Tok Yona reizu kutukutu miya So Tik Tok jaki gives you numbers Kwawewe, makwa m Kyushu minhayon Kwawewe, makwa m Kwawewe, makwa m J E N G That's it Tik Tok Paket Tiki so mae We follow Maya Productions Kwa Tiktok. Maya Productions Kenya at Tiktok. Thank you sir. We are still right here at the Paneri Hotel for the premier of Born to Shine by Maya Productions in conjunction with Green View Schools Kamulu. We are right here with NCA Karani from Utawala, Karibusana. Yes, Santisana is indeed the place to be here. Actually, for this auspicious occasion, I would like to give an answer. Actually, today is a day really, I really thank God for, yes because I can see my dream being actualized by the way even young people, particularly at Tawali, we cannot even imagine the afterings. Ya, this is something, yes, and mimi nimefanya, kindogo tu si kuana jua, okipe ya mu tuivi, kintukidogo iwi, anaruka mbiasana.


And well, for the second leg of our conversation here on the breakfast and plus TV Africa, we have Monday Thamiz, who's a sports analyst, who joins us from Aquabomb. Monday Thamiz, it's good to have you join us and happy anniversary.  Well, I'm voting to join you guys today as well as Aquabomb celebrates its 35th anniversary. It's been a fantastic ride so far. Well, I'm not 35, so I didn't really know what happened back in 1987. So what history speaks for itself, Aquabomb is developing, is growing, and certainly is the center of attraction as far as I'm sure is concerned. Yes. I'm going to talk sports. Why not? So let's talk about the games for the support girls now and the friendlies we're talking about with Algeria. What do you make of the composition? I mean, we're looking at the composition of the players for this friendly games in terms of, you know, the midfield and also the wingers. All right, all right. It might not be a start-studded formation. It might not be a start-studded composition as you want to put it that way. But I think it's time for us to get to Bill and Ian team. Joseph Poussaro is a new manager, is a new coach, and he wants to try out something new for himself.  Now we have a Portuguese manager who, for me, has some level of pedigree as far as modern-day football is concerned. We've seen the lines of the inclusion of the new names, Oñedica, and we've also seen some new players, Terry Moppe, not really new, being featured for the Super Eagles in that 10-year old Trashing of South Tomy and Princip. But I think it's a great composition. It's basically a game where we are going to know how good these players are, especially the new names, the likes of Ibube Duro, who is joining from Rivers United, not forgetting the man who plays in Portuguese League, the Casa Pia Man. His name is Godwin, Godwin Simon, who's been doing fantastic in his play dates in Portugal. So it's a new composition. I'm thinking that we are ready to make the country proud because adorning the jersey of the Super Eagles of Nigeria, you know that you're not playing for just your name. You're playing for the pride of the whole nation. And financially, it's good for your CV as your club will get to respect you more. So I'm thinking this new names, although they're new, they're going to do something remarkable for Team Nigeria or the Super Eagles of Nigeria. But a lot of people are saying, what are we playing for? I mean, none of them is going to the World Cup, which is, I think, 58 days from now. And you can just see that these people are playing to try to build momentum to ensure that they play as a team because football is a team sport. And you have to play with unity. You have to play understanding the formation. You have to play understanding the team so that you can produce a great performance when it matters. But for now, I think they're just going there to have fun. But many people will also say, let's go out there and revenge. Let's go out there and revenge the loss that we had against the Algerian side in 2019 at the Cup of Nations. I don't think it's a game where we get to revenge anybody, but it's just a game where we get to watch and ensure the Super Eagles of Nigeria and also criticize them if they are not producing the performance we expect from them. All right, if you've answered our next question here, the importance of this game. But I'd like to ask you, firstly, does Nigeria really need a new team? Was it a question of the team not being good enough to qualify Nigeria to the World Cup or Nigeria and having the right tactical direction and the right coaching to be able to get itself past Ghana to the World Cup, if you look at the former team. That's number one. Number two, I saw a very interesting post on Twitter over the week. There was this eye emoji. You know what they do? Eye emoji, two eyes, eyeballs. And a picture of Madoka Okoye doing his warm-up in camp. That got me laughed, cracked up. What I thought of Madoka Okoye's return to the Nigerian team and the reaction of football fans of the Super Eagles. So those two questions here. All right, football is an unforgiving sport, especially in this part of the country. We get to exaggerate on that. If a player makes a mistake, we talk about it time and time. Players, great players in this world, great goalkeepers, the likes of Ike Kasih. I remember his ending part of his career. He was devastatingly bad. The likes of Piches Maikyo, even Edwin van der Saas, these players or these goalkeepers have gone through a very difficult time in their careers. And I think we should just let bygones be bygones. Madoka Okoye is a growing goalkeeper. And you know one thing about goalkeepers, they get better as they're growing older. So we should just give them time. He's still a man for us. I think so. Madoka Okoye, Francis Azor. These goalkeepers can still make us proud if they are determined to do so, if they're determined to put in the work to learn more about goalkeeping. I think we should still give them a chance. There's no point to criticize that. I don't want to even go back there. I think it's a new era for him on the new coach because players tend to do better under a new management. It doesn't mean that they were bad for the old management, but they want to step up their game to ensure that they maintain their jersey or they maintain their number one shirt with the national team. And my expectations for this game, we heard yesterday that Real Friend DD will not be playing in that particular game because of an injury-sustaining training. He wasn't really fit. Joseph Asairo, I heard him speak this morning. He wasn't really fit. He's been struggling. Lester City are having a shambolic season. So mentally and of course physically, it has shown that Real Friend DD will not be fit for that game tomorrow. So I think it's a chance for the new names. I think it's a chance for the likes of Raphael O'Neill who he plays for. Yeah. OK, so quickly because we will be calling it a wrap in no time. Let's look at the NBA now. The NBA coach, Imme Udoka, who's been suspended for fraternizing for the session of 2022 and 2023. What are your thoughts? And some people have stated that really, a moral compass with all of this discussion, it's been generating a lot of buzz, but I'd like to share your thoughts on this one. What do you make of this action, the suspension of the coach? All right, just like I said in our previous conversation, that football is an unforgiving sport, basketball, sports in general, people tend to forget what you've done, especially when you get involved in a scandal. I'd like to remind anyone listening, anyone watching this particular one, that Imme Udoka is the first coach for the Bolson Celtics since 2010 to qualify for the Bolson Celtics to the final. It's the fifth coach in 25 years to win or to make it to the NBA finals in its debut season. And of course, you know, already the first Nigerian and a first Nigerian to be an NBA coach, people will forget his achievements, he did it in just one season. And I don't want people to forget that. We're all humans, we get involved in some immoral things. No one is perfect. And it's quite a shame that on the 35th anniversary of the Acquibom Day, an Acquibomite somewhere in Boston was handed a suspension for the 2022-2023 NBA season. And according to reports, they've already, of course, lined up a replacement for Imme Udoka for this season. But hopefully, hopefully because it's clearly, his job is on the line, he's in jeopardy right now. And we might not see him coach at the NBA, but we just keep praying and hoping that as just as many people who got himself involved in scandals, how they got out of it, hopefully he gets out of this particular one. Like I remember Ryan Geeks, Ryan Geeks got in a scandal as a Manchester United player. They had to take the father of, one of the fathers of the carpenters in the UK to go and sell for the issue. So it's not the first person to do so. He's a prolific, prolific NBA coach. And we saw that last season. It's just quite a shame that this happened to him. And I had to be against someone who was being in the Norleywood, someone who's been in the mainstream of entertainment in America. His partner, I wouldn't say his wife, because they've just been engaged for the past seven years. They're not married, although they have kids. So she prefers to be called a partner to email Docker. Neil Long, she's a big name in the Hollywood industry and what a shame this is happening to email Docker. But I still have so much belief in him and I hope he will come back strong. All right. Interesting way to see how things work in other parts of the world. As far as our standards are concerned, you know, values are concerned there. So I think we can learn more relief or two in our old climbs here. Monday, it's great to have you join us. And interestingly, email Docker is also from a dear good-acquired boom state as well. And even though he's American, great things he's doing in the United States. We hope he pulls through. Is he in Nigeria at first? He's from a team of local government every boys in America. Absolutely, yes, indeed. So we hope he pulls through, wish him all the best with his partner as well. Monday, thank you very much for your time. Jose Pesero has said that he wants Nigeria to win the next African Nations Cup just very quickly. Do you feel that is possible? Just to drag you back to that conversation. Do you think that's possible? Well, we've not seen the best of Jose Pesero. What he tells us that Nigeria could win the next Nations Cup and the next major tournament. We should just watch and see. We should underrate him. We should just give him the chance because he has come out to drag about his confidence. And I like that. And I think he needs a chance to show what he has come out to say he will do. Thank you so much. Have a fantastic weekend. Do have yourself a great weekend. It's going to be fun here in Aqabam.  I can imagine. I know how they party down in New York. Thank you so much for your time. You know that coffee. The Aqabam and the Afam, it's going to go down today. Absolutely. All right. All right. Spare some for me. Maybe when I come next time, I'll have my own share. Talking about birthdays, Aqabam is not the only state that is celebrating its birthday today. A wonderful cameraman right here from Placid, Africa, Richard also has his birthday today. So Richard, from messing with myself, wishing you a happy birthday, many happy returns. And we will eat rice and chicken today as well. Yes, indeed. God bless you so much.  All right. Well, that's the site of our conversation. And we appreciate you for being with us all through the week. We will return on Monday. But if you missed out on any part of the conversation, you're always on social media, on Facebook, Twitter, and Instagram. And you can also subscribe to our YouTube channel. It's at Plus TV Africa and Plus TV Africa Lifestyle. My name is Messier Bukbo. Have a great morning. My name is Kofi Bartels. We'll return on Monday. Have a fantastic weekend.


Immunotherapy has become increasingly popular in the past few decades due to its ability to treat various diseases, including cancer, infectious diseases, inflammation, and autoimmunity. Nanomaterials have been used to enhance the effectiveness of immunotherapies by improving the stimulation of immune cells, targeting specific areas of the body, and reducing side effects. Recent studies have shown promising results in treating these diseases with nanomaterial-based immunotherapies. This article was authored by Xiangru Feng, Wei Gua-su, Zhengmin Li, and others.


So, a firewall has a role of blocking traffic coming into or out of a computer or a network. If the firewall is running on an individual computer, then it blocks what comes in and out of that computer. But in larger organizations, it makes more sense to run a firewall on a network device like a router so it controls what comes in and out of the network, which covers many computers, not just a single one. And there are different types of firewalls, but a very basic approach is what's called a packet filtering firewall. The other one, stateful packet inspection, we'll see is just an extension of packet filtering and the two types of proxies often used for special cases. So a general type of firewall is a packet filtering firewall. And what it does, it filters packets. So when someone's sending something into our computer, what the firewall software does is looks at the packets coming in and makes a decision. Do I allow it in or do I not allow it in? So do I accept or block the packet? So there's a decision there, so it does some filtering of those packets. Those that are allowed in, okay, those that are blocked are done for security purposes. And similar is going out. So what packets to be filtered? The administrator of the firewall, you, has to create a set of rules to say which packets to allow in, which ones to block. And that's what we're going to go through today is a set of very simple rules that were built up for a firewall for some common cases, but it can be much more complex than that. And the rules for the packets that come in, what the firewall software does is it looks at the packet and makes a decision. And the key things that it looks at in the packet are the packet header information. And the packet information, which is commonly used, the IP address, both the source and destination can be used. So in IP packets, the header contains the source IP address and the destination IP address. So the firewall can look at those field values and make a decision. Do I want to allow this packet coming from this particular source address, or going to this particular destination address? Because the addresses identify, not necessarily human users, but identify computers on the Internet. And sometimes we can relate those IP addresses to human users. So we can make a decision based upon the host of the source or destination, or we can generalize and not just say, allow packets from this particular address, we can say, allow packets from this range of addresses. We don't have to say a specific address, like this subnet, anything from this subnet. The other packet information, many of the packets which our common applications use, using either TCP as a transport protocol or UDP as a transport protocol. There are other transport protocols, but TCP and UDP are very common. And they both support port numbers. So they're both in the TCP header and the UDP header have a source port field and a destination port field. And port numbers identify applications. So it's common that a server application will have a fixed, well-known port number. Clients may be dynamic ports, but most servers have a fixed, well-known port number. So as a result, if we see a packet with a particular port number, we can identify what application is being used in these communications. For example, web servers use port 80. So if the firewall sees a packet where the destination port is port 80, then the firewall knows or makes the decision that this packet belongs to communications between a web browser and a web server. If it's a different port, then it knows it's not web browsing. Maybe it's an email communications using port 25 and there are many other ports. And often policies are designed to accept certain types of applications and reject other types of applications, allow the students to browse to websites, don't allow students to access a game server where a game server may use a different port number. So port numbers can be used to identify applications. We had a quick example yesterday and we'll return to it which used ICMP. ICMP we think is a transport protocol. It's a very special case though and it doesn't use port numbers. So that was a special case yesterday where we didn't have port numbers. On that, are we using TCP or UDP or ICMP or some other special case transport protocol? How do we know? In the IP header, there's a protocol field or protocol number field. And that field tells us, does this packet use TCP, UDP, ICMP or something else? So again, if we want to allow TCP traffic but not UDP traffic, we can use the protocol number field in the IP header to make that decision. Or like yesterday, we don't want to allow pings to work. Ping we know uses ICMP. The protocol number for ICMP is number one, so we can filter based upon the protocol number. So they are five key fields in the packet headers which are commonly included and used by packet filtering firewalls. You could look at other fields and firewalls will look at other fields, but these are the five ones which are the most common. One of the issues which will arise, we'll maybe discuss today and even next week is that a challenge for firewalls is that in large networks, they need to process many packets at a time. There are millions of packets per second coming into the network or going out of the network. For every packet, the firewall must look at the header, make a decision. If the firewall is slow in processing each packet, then the packets are slowed down as they go through the firewall delaying the packets through the network. So one other thing is to have the firewall operate very fast in making a decision and it can be fast if it's looking at fixed predictable headers. There are some other things that we can use to determine whether to accept or not, the direction. So a firewall for on a network device, usually there are at least two interfaces. The one coming from outside, from the external network into our network and the one inside which heads out. So the interface that the packet arrives on may be used to make a decision whether to accept or not. So we'll see some examples of these, especially the first five. So what we do in the configuration of the file is we write rules. And a rule contains a set of conditions, usually using this packet information. Does the IP address equal this value? Does the destination port equal this value? So they are our conditions. We may use the concept of wildcards where we don't have to match a particular value and can match a range of values. And the rules say if these conditions match for a particular packet, then we'll take some action with that packet. And the two common actions are accept the packet, let it go through, or drop the packet. Sometimes we use other words, block, reject, accept, allow, but the concept we either accept or drop packets. And complex typical firewalls will be have a more than one rule, they have a table of rules, a list of rules. In the examples I'm going to start with we're going to assume any rules are processed in order. But that may not be the case in some firewalls, but that keeps things simple, we process rules in order. So let's go through examples, we'll build up some very simple rules to do some control of our traffic into our example networks. We covered an example and we'll recap on what it was yesterday where the firewall was running on a particular computer. Computer 12, let's say it was my laptop in this subnet, and the firewall was some software that I'd installed on my computer. And in this case I wanted to set up my firewall such that if computer 35 tried to ping me then the firewall would block that ping from getting to my, for being processed and as a result I would not reply. That was the aim. Maybe we didn't say and I assumed yesterday, but let's just recap and remind everyone how does ping work? What is ping? We can draw a picture to show what we mean by ping. Let's say we don't block the traffic, then with ping the idea we have computer A or computer 35 in our example network and computer 12, my laptop, the way that ping works is if we show what happens over time, computer 5 if it pings computer 12 the protocol used is ICMP. So what computer 35 does is it sends what we call a ping request or more precise an ICMP echo request to the destination computer. When computer 35 pings computer 12 it triggers an ICMP echo request to be sent to computer 12. When computer 12 receives it it processes and sends back a response, an ICMP reply. And what ping normally does is it repeats, the computer 5 repeats that ICMP request every one second. So sometime later it does that again. Most of you know this already because you've taken the network lab and you've seen ping operate request. So computer 35 in our scenario has a address, it's actually <IP_ADDRESS> in our example network and computer 12 is in fact <IP_ADDRESS>, they're the IP addresses. So that illustrates the packet flow in ping. So what we wanted to do was on computer 12 itself is to set the firewall such that ping wouldn't work. Well, what do we mean by ping wouldn't work? Well, if someone pings computer 12 it will not reply. If we don't send the reply then of course 35 will not know anything about connectivity to computer 12. Computer 12 cannot stop computer 35 from sending the request. We cannot stop them from sending the request but what the firewall does is once it receives the request the firewall sees it and drops it, so it deletes that packet, before the ping software processes it. So inside computer 12 there's the firewall software and the ping software. If the packet gets to the ping software it will send a reply but what the firewall does is intercepts that packet before it gets to the ping software, drops it so that the ping software doesn't even know about it. So what our approach was in creating the rule was to say, okay, we want to drop this ICMP echo request. So the characteristics of this packet, if we looked into the detail of that packet, if we try and draw the structure of the packet, I will not draw the Ethernet header. We don't necessarily know what network layer, what data link layer technology was used but often would use Ethernet as the MAC layer protocol. I'll simply draw the IP header because ICMP runs on top of the Internet protocol and then the ICMP header. So that's our packet structure. Simply it's an IP header, an ICMP header with some fake data in there, that's what's used in a ping request. The key fields in those headers are in the source address, the IP source address is if it's sent by 33335, that's quite simple. In the IP header, the destination address was going to 111.12. What other field in the IP header is of interest? Look in your slides, the picture of the IP header. There's another field there that's of interest here. There are mainly five, we're going to deal with five very simple fields in our headers. In this case we actually only need three but what's a header field in the IP header that's of interest to us here? The protocol number, in the IP header there's a field called protocol which is the protocol number. It tells us what is inside this IP packet. The field we'll just call protocol, protocol number. The field, the value indicates what's here. What is the value for ICMP? Let's look it up. On my computer there's a file in the protocols. There's a file in the ETC directory that's called protocols and it lists for different, we think here, transport protocols, the corresponding protocol number. IP is zero, ICMP, which is used by Ping, is protocol number one. IDMP, another one which is used for multicast group management, is two. TGP is six. UDP, 17, and there are many others. These are the transport protocols in use. You should remember three of them. So I'll assume maybe in the exam that you can remember that ICMP is one, TGP is six, UDP is 17. We come across them very often so just remember those numbers for the protocol number for transport protocols. Because in our firewall we want to stop Ping from working. We know Ping uses ICMP so we should filter on protocol number one because this ICMP request message would have protocol number one in the header. There are other field values but these three tell us that computer 35 is sending an ICMP message to computer 12. Now what we really should do is we should check the message type. With ICMP it's not just for Ping, it's used for other purposes as well. So we're being broad here and we're going to say in our firewall we're not going to allow any ICMP messages, even if it's not for Ping. So when 35 sends an ICMP request to computer 12 that request would have these three values. The port numbers are not used by ICMP so we don't care about port numbers. So given that's how Ping works what we do in our firewall we create a rule that says if the source IP is 33335 and the destination IP is 11112 the protocol number is one which really means ICMP. I don't care about the source and destination ports, they're irrelevant here. If a packet comes into my firewall which matches those conditions then we take the action to drop the packet. We discard it. As a result when computer 35 tries to Ping my computer the firewall gets the packet, it gets to my computer but the firewall software drops it before it's processed. The Ping software doesn't get a copy and of course no reply is sent. As a result Ping effectively doesn't work. So the rule in our case has these five values, the three ones of importance, so the source IP, destination IP and protocol number. What we'll do is go through some other examples and try and derive the rules that we could use to achieve some aim under some slightly different conditions. Any questions before we move on to some other rules? It's common in quizzes or the exams that you need to write some rules or given some rules, explain what happens. So we'll use some examples to do that. Okay? Easy. Good. Then we can move on. Let's try a different scenario. In this scenario I assume the firewall was running on my laptop, computer 12. That's okay maybe if you have just your home computer but running the firewall on individual computers is not so useful when you have a network like an organization with many computers. It means you need to run the firewall and configure the rules on every computer. So for larger organizations it's more common to run a firewall on a network device like a router. Configure the rules on that one router with the aim of protecting all of the computers inside the subnet. So that's what we'll use for our next example. We'll shift the firewall from a host to a router. So we've got the same network scenario. But let's move the firewall and I'm going to put the firewall on this router. It's a normal router but it also runs a firewall software. Just to be clear on this diagram, this router is connected to two subnets. One subnet on the left is <IP_ADDRESS> and on the right <IP_ADDRESS>. The way that the subnetting is done is in fact the two subnets on the left 1.1.0 and <IP_ADDRESS> are in fact subnets of this larger <IP_ADDRESS>. So this is a case of subnets within a larger subnet. The router has two interfaces, the interface on the subnet on the left and interface on the subnet on the right. So it's got, imagine two cables plugged into it and as a result two IP addresses <IP_ADDRESS> and <IP_ADDRESS> are the IP addresses of router A which will run our firewall software. And we're going to assume that the subnet on the left is our subnet. It's the subnet which is internal, the one that we want to protect. So what we're trying to do is protect this subnet and all of the computers on that subnet. Well in this case I only show two computers but let's assume there are more than two. So the green subnet is our internal subnet. The rest of the subnets in our simple internet are the rest of the world. So that external, the green is internal. And imagine that there are many computers internally, not just the two show. That's our scenario. Let's consider some different aims that we may want to achieve. Let's say the first one. Let's say we have a secure shell server internally. My aim or my policy is I want to stop, let's get a good example. I want to prevent outsiders from secure shelling SSH into computer 11. That's my aim. I'll explain secure shell in a moment but computer 11 inside let's say it runs a secure shell server. A secure shell server allows someone else to connect and log into that computer. When everyone has done that before, maybe in the lab you secure shell into your friend's computer. You run the secure shell client and connect to the secure shell server on your friend's computer. So we'll imagine that computer 11 runs a secure shell server. Maybe if you're on computer 12 you can log into computer 11. That's okay. But we don't want anyone outside to log into computer 11. Because it's just used for internal purposes. So what we want to do is set up the firewall so that it will block people from outside secure shelling into computer 11. So what we need to do is write a rule where the conditions will summarize as five conditions. Source IP, destination IP, filter based on the first these five conditions, protocol number and the source and destination ports. So when we create the rule for our firewall we will specify what those five values should be to match the packet of interest and then we specify the action to take. So if a packet matches those five conditions then we specify an action. Fill in those values, write the rule yourself. You have the aim, write the rule that will achieve that aim. Computer 11 has a secure shell running on it. When someone let's say on computer 36 wants to try and log in to computer 11 our firewall should stop them from doing that. So when they try and log in their application say on computer 36 sends a packet to computer 11 and it gets to the router RA because that heads into the subnet and there's a firewall software on that router. So before the router sends it on to the destination the firewall checks that packet against the rule. So we're trying to write the rule such that when that packet gets to RA the firewall will drop it. That's what we're trying to do. So what characteristics does the packet have to have that matches someone trying to secure a shell into computer 11? Let's consider the five key packet filtering criteria and first let's look at the IP addresses. If someone here we have the outsiders. If the outsiders want to secure a shell into computer 11 consider the packet that they send to computer 11. What will the destination IP be? The IP address of computer 11. So here the first criteria if the destination is computer 11 that is <IP_ADDRESS>. If someone tries to secure a shell into computer 12 we don't want the firewall to do anything with that. Our aim doesn't say anything about computer 12. So we need to specify computer 11 as the destination. Who should the source be? We want to stop outsiders. So how do we specify that? The computers are generally identified by the IP address. So what should we set the source IP value to be in our firewall rule? What's the value? You wrote it down I think. The source. What if computer 36 tries to secure a shell into computer 11? What's the source address? What's the source address? 3336. What if the computer 35 tries to secure a shell into 11? What if it was computer 47 down the bottom? What if there are 1,000 computers on subnet 3330? Well what's the source address? A couple of ways we can deal with it. Any source address will be the first approach. It doesn't matter what the source address is I don't care who the source is. If it's going to computer 11 and the other criteria meet, block it. So we could say as a broad solution, let's say the source address is any value. I don't care what the value is and a common way we can write any value is to use star, meaning matches anything. So I could set the source address to be star. If a packet comes into our firewall and that packet has any source address, including 35, 36, 47 of course, it will match this condition. If the packet is destined to computer 11 it will match this second condition. Yes. Right, what about computer 12? We don't want to stop computer 12 from accessing computer 11. That's internal, he's not an outsider, he's an insider. Will it match here? Yes it will match, is it a problem? No it's not a problem because computer 12 would not send a packet via the router. Okay, so there's a bit of a trick here in that computer 12 and 11 are on the same subnet. So when they communicate, they don't send via router, there's no need, they send direct. So if computer 12 tries to log into computer 11, the packet doesn't even go to the firewall. The firewall only controls packets coming from outside into our network or going from our internal network out. It doesn't control packets within the internal network. So that case we can cover by using the star. We could have been more complicated here and you can write expressions like the source IP address does not match 1110 slash 24. So we could be more specific and say a negative like it not equal to 111 dot anything. That could be another solution but star is sufficient here. But what if computer 36 is trying to access the web server on computer 11? We don't want to block that. We only want to stop them from accessing the secure shell server. So we can't leave it at this. So we need to identify packets belonging to the secure shell connection. What transport protocol does secure shell use? TCP. You need to know that up front. But many applications we use, email, secure shell, web browsing, database access. Many of them use TCP. Often you'll start to remember everything uses TCP except for a few special cases. So we can specify the transport protocol to be TCP. What number does TCP use? We saw briefly before it's number six, meaning TCP. Now we could say any transport protocol but let's be precise here because we know secure shell uses TCP. Maybe to be more secure we could say any transport protocol star here. I think it wouldn't hurt. But many applications use TCP so we need to be more specific. So we need to consider the port numbers because port numbers identify applications. So destination port should be the port number associated with secure shell which is 22. So in the IP header shown here if the source address is any value the destination address is <IP_ADDRESS> and currently the protocol number is 6 for TCP. And in the TCP header we're looking at the source and destination port. We want to identify secure shell in the services file on my computer it lists the port numbers. It lists that secure shell uses port number 22. Note that it says that secure shell allows also UDP. So in fact you can use secure shell over UDP it's not very common. So really to be secure we shouldn't specify the protocol number to be 6 TCP we could say star. But in this case it's okay to say 6 just to keep it simple. But importantly port 22. So if the destination port is 22 source port let's say someone opens their secure shell client on computer 35 they send a packet to the secure shell server. Destination port will be 22 source port will be what? What port will the secure shell client use? Not 22. Commonly with clients they get a dynamic port number. When the client starts the operating system gives a port number above 40 something thousand. There's a range of port numbers which are for clients. And the next time the client starts it may get a different port number and then another one and another one. So we can't predict what it will be but we can still use star. Any source port just as an example we'll come back to those rules. If I secure shell into another computer that's the ICT server. I secure shell into there and then look at my connections. I just secure shell from my laptop into 10 10 6 dot 11. And next that shows me that there's a connection. My laptop address is 10 10 108 204. The foreign address or the server was 10 10 6 dot 11. The server port number was 22. I connected from my secure shell client on my laptop to port 22 on the server. What port number did my client use? This value here 55600. If I connect again or to a different server then it will get a different port number. We can try. I'll exit connect again. A new connection is established. The old one is still there. It's closing the old one but the new connection connect to the same IP address port 22. My laptop used now 55601. It's going in order. It's incrementing. So here client port numbers commonly change. Server port numbers are usually fixed. So when computer 35 tries to secure shell into computer 11 the packet that it sends that first packet that it sends to connect. And it will be 35 that initiates a connection. They send the first packet saying I want to connect into computer 11. That packet the source address will match will be one will be 33335. Destination 1111 protocol TCP source port will be some dynamic value 55000. Destination port 22. So when 35 sends that packet and arrives at the router the firewall looks at the packet and compares the packet values with our rule. And it will match those five conditions. Since it matches those five conditions the firewall takes an action with that packet. What action should it take? Drop. Drop or reject or block but don't allow it through. Action computer 6 tries to secure shell into 11. Destination is still 1111. Destination port is 22 using TCP. It will match the rule. The packet will be dropped. Anyone else outside tries to secure shell into computer 11 the firewall will drop the packet. That very first packet from the client trying to connect to the server is dropped. As a result the response from the server never comes back because the server never receives the first packet. So there's going to be no follow up packets. If the client retries it will be dropped again. As a result there will be no connection set up between client and server for the secure shell connection. That achieves our aim. Questions on how blocks secure shell. There are a few issues there. The source IP we set it to any value because we want to capture all of the computers outside. You need to know the port number to identify secure shell. We're assuming that our default action is accepted in this case. The default action is what happens if the rule doesn't match. Once a computer 35 tries to access the web server on computer 11 destination port will be 80. Everything else will be the same. It doesn't match this rule. It doesn't match any rules. We only have one. So we take some default action and at this stage we're assuming the default action is accept. We have a default action and let's assume it's accept or allow. We only have one rule in this simplify wall. Let's keep going through examples. Still assuming the default action is accept let's stop our computer 12. Let's say computer 11 belongs to me. Computer 12 belongs to you. I want to set the firewall so you cannot access websites on this network 3. Maybe computer 35 is a Facebook web server. Computer 36 is another Facebook web server, m.facebook.com. So I don't want you to access those websites anything on network <IP_ADDRESS>. If you're computer 12 you cannot access any website on network 3 then write a rule that will implement that aim. Aim stop computer 12 from accessing websites on network 3. So use a new picture and try and write a new rule. So in this case we're going in the opposite direction. We want to stop someone inside computer 12 from accessing something outside. So we'll have to deal with that. We're still using the default action of accept but we'll come back to or could we do it another way, a default drop? Yes we could. There are some trade offs there. But given we want to accept everything but stop 12 from browsing web servers on network 3 maybe there are many web servers. Even though I've drawn just computer 35 and 36 let's say we don't know how many other computers there. There could be hundreds there. We don't know. We just know that this is network 3 and we don't want them to access anything there. So we need to consider our five conditions. Because IP, what value? Now we want to stop computer 12. So think we want to stop computer 12 from sending out to network 3. So computer 12 sends a packet to some web server on computer 35. Well the source should be that of computer 12. If it's coming from computer 12 and it's destined to who? Well we could write multiple rules. We are not restricted to a single rule. We could write a rule that says if the destination is 33335 do something and then a second rule. If the destination is 33336 write their conditions and then a third rule because there may be more than two computers here. That becomes a little bit tiresome to write a rule for every possible computer and not possible if we don't know how many are actually there. But we know with IP addresses we've got a way to capture all computers on a subnet. We can use the subnet or the network address. The address that identifies all computers on this subnet is 3330 slash 24. This is a special case address that says everyone here. So we can use that as the destination. So this is sort of like a wild card. It means anything that starts with 333. But we take advantage of the fact that IP addresses are assigned to hosts and to subnets. So we capture an entire subnet. Protocol web browsing. Transport protocol still TCP. Protocol number six meaning TCP. Source port. What port number would my web browser use on computer 12? We don't know. It's a dynamic port number. The source port could be 48,162, 60,500 or anything between about 40,000 and 65,000 at the common range. So it could be many values. So we set the condition. It could be anything. Destination port is of interest. Web servers port 80. The rule doesn't or the aim doesn't prevent computer 12 from accessing a secure shell server. We should be able to secure shell into computer 35 but not access the web server. So we do that by specifying the destination port of the web server port 80. Action again drop. Computer 12 opens his web browser, types in the address of <IP_ADDRESS> as the destination. A packet is sent from computer 12. It gets to the router RA. The firewall looks at that packet. Source matches the first condition. Destination 3335 matches the subnet. It is on that subnet. Transport protocol used by your web browser is TCP, matches the protocol number. Source port, any value matches. Destination port, your web browser sends to port 80. The five conditions match so that packet is dropped. It is not sent out to the internet and therefore it will never get to 35 and nothing will come back. Any questions on how to block our access to our web server? Let's say your computer 12, you really want to access the website on computer 35 or 36. You know this is the rule, how are you going to bypass the firewall? SIT has set up the firewall like this. You realize now there's a rule that blocking the access with this rule, I really want to access it. How are you going to bypass it? Sorry. Use a virtual private network, some proxy server or intermediate server to connect to. Yeah, there's one way. We'll talk about that when we talk about VPNs, how that works. That's one approach. It requires you to have a VPN server. Maybe there's an easier way. Change port, okay, but my web server uses port 80, doesn't it? I can't tell the web server to change the port number. It's maybe the Facebook web server. It listens on port 80. SIT is blocking access to port 80. How can you access this website? Change your IP, okay, so you are computer 12. If you could change your IP address and the rule is blocking specifically computer 12, you move to computer IP address dot 13, then it wouldn't block, all right. What SIT could do is say block all of the 1.1.1 addresses which are assigned to students. So that doesn't help changing the address. You could use a fake source address, all right, so set your address. You can do that quite easily. Set a fake source address to be <IP_ADDRESS> and that would defeat the rule and bypass. But again, routers are often configured, they should be also configured to say block anything that comes from a fake source address. I think that is not 1.1.1. What else? There's another way. Use a different protocol specifically. You could use a different transport protocol, UDP, but unfortunately our web servers don't communicate using UDP. Some applications may support it, but probably your web server doesn't. There's another one. You're very close. Very simple. VPN, we said, that's not so simple. You need to set up the VPN. Something you can do straight away. Change, we tried to change the protocol, change your IP address, change what else. Someone said change the port. It's related to that. What about HTTPS? HTTP servers use port 80. HTTPS, the server uses a different port number. With HTTPS, the web server is configured to have a secure connection. The web server listens on port 443. So what you do, open up your browser and type in HTTPS, colon slash slash 33335. Same packet is sent except the destination port will be 443. It will go through the firewall because the default is to accept anything that doesn't match this rule. Well, how do we stop that? So when we talk about stopping access to a web server, it's not as simple as just port 80 because many web servers also support actually HTTPS. And therefore we should block port 80 and port 443 because they are commonly used by web servers. So we need to be careful when we set up a firewall. There are many special cases that we could consider that someone may try to use to bypass those rules. Before we look at changing the default, we need to go back to some details about how this connection actually works. Let's say the rule wasn't implemented. And in the same way that we drew the ping packets, in the normal case, ICMP requests, reply. Let's try and draw the packets associated with accessing the web server. It'll become useful later. So we have our, in this case, it was computer 12. Let's say it was accessing one of those computers. This is the client, the browser. And 35 is running the web server, port 80. Browser port we don't know, not so much of interest. What's the first packet, assuming the firewall is not used? What's the first packet sent from browser to server? Does anyone know how web browsing works? Not discover, you've got too much DHCP on your mind. What else? How do we connect to a web server? A TCP syn. In fact, web browsing, the protocol used for web browsing is HTTP. With web browsing, we actually send a HTTP get request to get the web page. The web server sends back a HTTP response with the web page. But before we can send that first HTTP get request, we need to establish a TCP connection. So the very first packet sent will be a TCP message to establish a connection that's called a TCP synchronize or a syn message. TCP involves a three-way handshake to start up. So the packets we would actually see if we captured, the browser or the client, the TCP client sends a syn message. I want to synchronize our sequence numbers. The server sends back a response, the TCP message saying, okay, I acknowledge your synchronize message and similar, I want to synchronize with you. So we say a syn act.  This is what we call the TCP three-way handshake or the TCP connection establishment procedure. We set up a connection before we send any data. Then once we've set up the connection, we send data. This is TCP data. What is the data? It would be a HTTP request. There may be a TCP act that comes back. The green one is actually TCP data, but the type of data is a request. And then finally the HTTP response. Again TCP data but containing the web page normally. It may be a final act to complete. So this is commonly the exchange of messages we'll see when we're accessing a website. We first set up a TCP connection from client to server and that involves sending a syn message, a special syn message. There's no data, getting a syn act back which acknowledges the syn received and syn's from the other direction. The syn means synchronize. We actually synchronize the sequence numbers we're going to use in the connection. It also lets the server know we're about to connect. And then a third message which is the TCP act. Those three go together. Then we send data from client to server. The HTTP request for the web page. Maybe there's an act saying thank you for the request or the data. Then eventually the web server sends the web page back in a HTTP response, maybe a final act. If we drew the secure shell connection it was a secure shell client connecting to a secure shell server. It would be similar but not using HTTP messages using secure shell messages. There would still be a TCP connection set up. Every application that uses TCP would look similar for the first three messages, then some data. When we enable the firewall, what does it drop? So this is 12 connecting to 35 but now we turn on the firewall with our rule for Router RA. Which packet is dropped? Our firewall rule was if the source is 12, yes, consider this first packet. Source is 12, true. Destination is on subnet 333, true. 33335 is on that subnet. Destination port is 80, true. Source port is any value, that's true. Transport protocol is TCP. So this first TCP SIN message is the one that is dropped. If the firewall was enabled the browser sends the TCP SIN, it gets to the firewall, the firewall condition matches, the rule says drop. So the TCP SIN will never get to computer 35 and if the SIN never gets to computer 35, the SIN act is never going to come back. It doesn't know anything about the connection. So in fact the rule only needs to drop the first packet in the connection and hence we stop the entire connection. It gets a bit more complicated if we want to do some more allow packets in. We'll see that next lecture. So just be aware of how TCP SIN or the TCP connection establishment works because that's going to be useful to see what if we want to do the same but the default action is dropped or maybe even easier. What if we want to have a default action of drop but allow computer 12 to access the servers on network 3? There's your homework for the next week as well as your assignment. Write a rule such that instead of stop 12 from browsing to a 3.3.0 allow 12 to browse, default drop. Drop everything but allow computer 12 to browse to network 3. See if you can write that rule or rules and then we'll look at some other examples next week and discuss some of the design issues with firewall table rules. So to summarize, I'll write it for you. I know all of you have a lot of free time so I'll give you a bit more homework in addition to the assignment. Allow 12 to browse to servers, default drop. Write the rules for that.


Chelsea, I need you to give me a call about that meeting later. Absolutely. Thank you. Yes. Hey, Chelsea. Here's a data compilation you asked for. Wow, Mark. That was quick. Not bad for an intern. How'd you land this internship anyway? Well, obviously my superior skills. Goes without saying. What else? Networking played a big part. Yeah, how so? Well, my first step was to go on LinkedIn and do a search for companies in the area that I might be interested in working for. I found this company then found Jim Cooper's name and I saw that he was going to represent the company at a job fair. So I went to the job fair and introduced myself to him. I told him how I found him and the company on LinkedIn and we talked for a few minutes and we scheduled a follow-up interview. And after the interview, he hired me. Very good. I think you're going places. And the first place you're going is back to your desk to do the weekly supply order. Gee, thanks. They say it's not what you know, it's who you know. And that's pretty accurate. When it comes to job searching, the network of people that you know may be just as important as your skills and experience. Experts say 80% of the jobs aren't advertised, so networking is critical to locating those hidden jobs. To find out more, just log on to the website.


Bloodsport for a B movie, you know a low-budget B movie has impacted so many things in pop culture which is just pretty crazy Hello and welcome to a long-awaited episode of Tales from the VHS vault It's been a long time over a year since we've done one of these Yeah, and we thought we'd bring it back because we actually had a fan request us do one further down in the year So we kind of got to get back in the rhythm of it, too This is gonna be a little different than our usual reviews. This is more of a Retrospective discussion of almost how these movies influenced our lives and pop culture in general for us 80s and 90s kids And today we're gonna be talking about blood sport. Yeah 1988 I remember when this first came out my mom was like she saw it in the TV guide and it turned into like this big This big thing in the house like okay, oh blood sports on week We got to watch it. We got to watch it as an event. Yeah, it was like a big event Van Damme, this was like his pretty much his breakout movie, right? He had been in all those kind of smaller roles and stuff beforehand So oh man, I remember sitting on the floor like in the in the living room there watching it And oh, it was just a powerhouse just incredible movie I had never seen it you introduced me to it because like you said you saw it first with your mom You had taped it off TV, right? So it was all grainy and shitty and the version I remember watching forever I think I taped off your tape version. So it's even shittier, right? I forgot that you did that because it was off of TV all the swears and stuff were blanked out Mm-hmm So when I first saw the real version it kind of like took me by surprise others cursing in this I'm so used of waiting for that. I ain't your pal. I ain't your pal and he stops for no reason, right? Instead of dick face And I wanted my own copy like a real copy of blood sport on VHS I remember for some reason it was really hard to find yeah It was like new at the store at the local store is a HMV at the time or the bay and all that kind of stuff Zellers Zellers my mom had my aunts even hunting around their local Yeah movie stores looking for a version of blood sport. I remember that I remember that yeah And I finally got one and it was a used VHS. There was an old rental So it's a it's a clamshell cut box style and that's still the one I have till to this day But for some reason it wasn't easy to find brand new known It's still kind of hard to find actually I just Recently maybe what a year or two ago had just found my copy Why does blood sport have such a long-lasting impression on us and pop culture in general brought the whole Sort of karate genre back from the dead right yeah cuz Bruce Lee movies were very popular in the 70s And he kind of put that genre on the map I think here in North America then Chuck Norris came out and did doing all his stuff But I think that Chuck Norris almost became over-saturated his movies are more action With a little bit of karate right yeah, this movie just kind of it just punched you right in the face It was just all Martial arts showcasing different countries right different styles hit it against each other so you could see the different Styles how the styles worked against each other which was really cool Yeah, it was probably the first time we really saw something like that in a North American movie I think it was probably very common in the Hong Kong style probably martial arts movies But it's kind of an eye-opener for us kids saying oh, there's different kinds of martial arts It's not just karate. Hey, yeah, and they didn't hold back right it. There's a lot of blood in this movie Yeah, it's a lot. There's a lot of violence It's a good story whether it's true or not is to be forced debated We'll get to that later, but it's a good underdog story You know this white kid who was trained by his Japanese Shido-shi, yeah, whatever the hell that means Who cares of Bruce Springsteen is a Shido-shi almost against his will because he didn't want to train him right cuz he's not Japanese yeah, who ends up coming up and winning this big Kumate this martial arts tournament, so it's an underdog story in a way Yeah, and it just kind of shows you too that you don't need to be a specific Race breed or creed to do the specific martial art. Yeah well, yeah exactly Yeah, you know anybody can do it as long as they're trained properly blood sport for a B movie You know a low-budget B movie has impacted so many things in pop culture Which is which is pretty crazy mortal combat video game is basically based off of blood sport Inspired by that kind of different styles against each other karate tournament Johnny Cage is Van Damme Just look at him. It's he's Van Damme. Yeah Yeah, even like kind of like the finishing moves to not that brutal But there were kind of like finishing moves in blood sport well Johnny Cage does the splits Yeah, yeah exactly and then when the first UFC came out it was like oh my god We're watching blood sport for real Yeah, different styles against different styles pretty evident that I think blood sport inspired that kind of real life Martial art tournament because I don't know if there would have been a UFC one without blood sport That's up for debate, but it's like they didn't come out too far apart really when you watch that first UFC It's pretty ridiculous. Yeah Boxer with the one glove like it's like a video game.   It's not forgotten. You told me to review any movie that works So it's like even though we're a horror movie channel It's hard not to put these other influences in the show to kind of like show that yeah We do love other things besides for blood sport is definitely one of those movies like Christ last time we shot After we're done shooting and just chilling out. We put on blood.  I just finished watching the final fight there on YouTube the other day Yeah, it doesn't get old. No doesn't get old lightning in a bottle, right? You have the right actors fight choreography is really good can't not talk about the music Yeah, the music the soundtrack for this movie is incredible I don't think it would have as much impact if it didn't have as good a soundtrack Yeah, it's definitely an example of a soundtrack making a movie and you know again that soundtrack Influenced our channel. There's been moments in the channel where we throw in music That's very similar to yeah blood sport just to have that that late 80s martial arts movie vibe And blood sport was apparently modeled on the real Frank Dukes Whose story is extremely debatable? Nothing can be corroborated So it's almost like the perfect bullshit story You can't prove anything but you can't disprove anything either Frank Dukes came up with the idea for blood sport And he's apparently was based off of his real life Exploits exploits as a tournament fighter and even at the end of the movie when it says like Frank Dukes fought this many Matches and this many knockouts and you look at the number you're like How can you fight that many fights in one tournament? Yeah? Yeah, it's not even that many people in the tournament And then he's gone on interviews saying oh no It's because the tournament was different you fight the same guy like maybe five times in the tournament So actually it's there's less people but more fights, but even then That's still 300 and some odd matches in the span of a weekend. Yeah, like that's a lot If you take one hit in half of those fights you would be done For the next day you wouldn't be able to compete the next day There's that documentary put up your Dukes, which is actually really good And you learn a lot about How much of a bullshitter? Frank Dukes really is hard to corroborate any of this stuff like he has all those Russian generals Telling those stories. You don't know if they're real Russian generals. It could just be actors Yeah, so Frank Dukes Well Frank Dukes claims to have won the won the kumite tournament, which is an underground fighting tournament But he also claims that he's like a secret agent for the CIA And all this stuff that like none of it can be proven and it's and it's so Easy and fun to go down the Frank Dukes rabbit hole. I've done it so many times Yeah, and the reason being is because deep down inside I kind of want it to be true You do you want to believe this guy because you've invested so much in the blood sport movie Please Have that footage that he always says exists of him winning the kumite Just someone please release that so we can all just put this to bed But we know that's never gonna happen, but deep down inside. You just want yeah it to be true How come there's no pictures at least is that picture of him holding that trophy?  I was at this Christmas party and there was this guy there dancing and he was kind of dancing like Van Damme and kickboxer Yeah, I don't think on purpose either you just bad So I go to him like man Are you doing that a purpose you're kind of dancing like Van Damme from kickboxer and he was a younger guy, right? Mm-hmm, and he had no clue what I was talking about not only did he not know a kickboxer is okay It's funny. Don't know a kickboxers, but he didn't know who Van Damme was. Oh, well, it's like the guy's a Movie star you don't know who Jean-Claude Van Damme is yeah, and that kind of made me sad You know I'm that's why I want movies like blood sport kickboxer to live on and like inspire these new generations That's right. Yeah, because they're good movies. Yeah, and even when you take the fighting out of those movies, too Like the training montages and all the the drama and everything that they showcase is actually pretty good, too Training montage is a staple of those 80s movies and it's something that I wish would come back You know it of course, it's a little dated and it may not work in every modern movie But there's something so special about this training montage is like yeah bring it back And you got the music and everything it's akin to the 80s like action movies where they got to get their guns, right? You know they're getting ready ready. Yeah, Van Damme and blood sport inspired many many people to take up real martial arts That's right. Like we took Dejudo For like a year because all I want to be like that even though Van Damme didn't do judo But still it was like inspired us to take up something. We didn't stick with it, of course But I'm sure there's tons of kids who took up some sort of martial art and didn't stick with it purely because of movies Like blood sport. Yeah, yeah, and I'm sure there's a lot of people who stuck with it We've become great martial artists because of blood sport. It was a huge thing when we were kids Every I think every kid did something we played blood sport in the basement sometimes it has set up our own kumata That's everything and prepare the platform for the final Match and then you try to lift those Yeah, the pillows up on each end to make it have that Never actually got all that hurt and then tape tape the soundtrack off of the TV by just holding one of those shitty ghetto blasters up to the The speaker of the TV and record the soundtrack on to that and then play the tape back with the music as you're Pretending to yeah, I can the kumata.    And until next time keep drinking


All right, everyone, good morning. Our next presenter is my fellow co-chair, Frederick Coutts. Frederick is a steering committee member of Stiffy Inspire. And today, we'll join Fred as he pulls back the curtain on the unsettling truth of software security and invites you to reconsider your approach to trust in the cloud. Please welcome Frederick Coutts. Thank you. So before we jump into the topic, first, I want to thank everyone for coming over. Like, the community, I think, has been absolutely fantastic. So that's one of the things that we really tried to focus here was, like, how do we bring a container together that's safe that people can come in and participate? So, again, thank you, everyone, for being here and for those who are not able to be here. Definitely hope to see you in the future. You're also part of our community, even if you weren't able to make it. So please don't feel left out. But let's jump into an interesting topic, which is one that I find interesting. So when we talk about security, we often have to ask, what is our goal with security? And very often, we have this concept of we're trying to hit confidentiality by trying to keep some piece of information secret or integrity that's not been modified or availability, which conveniently spells out CIA. Easy to remember. But this is like a classic, like the renaissance of art where people are really starting to think through these issues. But the thing about it is that the thing we want to really focus on, like, why do we have security, is not security for the sake of it. It's always in the context of something. And I want to really get down to the root of what that something is. And it's really about establishing trust. And so, like, in the background of this image, you can see a bank there. Like, there's trust that's put in the banking system. There's what happens when that trust in the banking system has been eroded. We saw some events occur earlier this year that are indicators of the damage that can occur when that trust is not there. So the same thing happens with us, with companies, or with individuals, is what happens when that trust is eroded. And part of the path is that when we want to perform some task, when we want to perform some thing, we have to establish that trust. Like, this little cap here that is climbing up, and it's testing the branch to make sure the branch is not going to fall underneath of it because it doesn't fully trust the idea to test it. And then it's like, yeah, I can go up this, and then it continues up. Eventually, it runs up 1,000 times. And then it knows it can take that particular path, but may not be comfortable with other paths. And so the same thing happens when we are looking at any given system. It's not just security. It's like, why do we have quality assurance? Why do we have all of the testing that we do with it is because we want to establish trust that that particular thing is going to do what we think it's going to do. And so let me ask you this particular question. Give it a little bit of a pause. Like, when we say trust, what do we really mean when we say trust? And this is a really deep, like you can spend an entire lifetime, or 100, trying to answer this question. But we need to start somewhere. And we got, I don't know, 12 minutes to get it right. So we'll do our best. And so with trust, one thing that I hear quite often is, well, trust is a property of a system. Like, we build a system to be trusted. But if we think about this, like, we get down to what trust is, there's no single thing that we can say, like, OK, this is like, that it's not really something like it's a property. It's not a property of a system. You can't build something and say, this is the trusted thing. Because trust is very, it's based on other properties. Those properties are based upon our decisions, or our observations. They're based upon us looking at the world and making that decision. Like, that tree that we saw before, did that tree have trust inherently built into it? Or was that a decision by the cat to trust that that branch was not going to fall down? And is the cat always right that it's not going to break on it as well? So this is actually really well put together by a person named Dorothy E. Denning. And by the way, if you ever want to read some really good security, some really good security work, go look at Dorothy E. Denning's work. Like, one of the hot things that's coming out, that's been coming out for the past couple of years are like Lattice-based languages and systems like Q. She was doing that in 1975 and was publishing about it, Lattice-based models for developing security authentication and authorization. But in 1992, she challenged the US National Standard for evaluating trusted systems, which are known as the rainbow books. And one of the things that they said was you could build a trusted system if you follow these particular set of tasks, if you do these things. Like, you run these kind of tests. And she was able to change the whole industry with this particular comment about trust not being a property of the system, but rather an assessment by us. Given evidence, we make a decision. I also wanted to thank Ava Black, because she's the one who pointed me towards this direction. So in short, this is probably the most important slide that I'm going to show. Here is trust is a decision. You decide, and when you're going to trust something, what you're going to trust to a context you're going to trust. And there was a, and I'll have a little bit more on this in a bit, but there was an individual named Mike Wursell, who recently became the executive or part-time executive director for the Confidential Computing Consortium, which is a fantastic group that you should go look at if you're interested in how to protect workloads. But in short, he wrote a book where he really covered what is a trusted system, or not just a system, what does trust really mean? And so when you look at what does it mean to trust something, you have something that is where you have the context. And what context am I trusting this particular thing? So my relationship with a bank, the context is going to be my banking at this particular place. I'm putting my money. It's not the same relationship I have with a doctor, or the same relationship I have with a close friend. It's also time-sensitive in that I'm going to trust it for a specific period of time. I think of your bill systems when it puts out a scan, how long do you trust that scan for? If that scan was done in the past day, you'll probably have more trust in it than if the scan was done a year ago or two years ago. So the trust is also time-sensitive, but it's also asymmetrical. The relationship I have with my bank is not the same relationship that the bank has with me. So the same goes with us as customers. Our relationship we have with software is very different than software has with us, or one API, one service to another. The relationships are all asymmetrical. So we want to model all this stuff in, but also be aware of what happens when we put too much trust or too little trust into something. So too much trust. 1985, during 1987, there was a system called the Therac 25. Software bug resulted in a radiation overdose and ended up killing people. So our decision to trust this system too much and not tested appropriately led to catastrophic results. And very tragic results. So simultaneously, I decided not to post what company it was, but there was a major breach about a decade ago where they saw analysts saw the event in their observability platform. They saw the attack going on, but they had so much information overload from the system not producing good results that they decided to ignore the results because they didn't trust that the system was giving them something that was useful or actionable. Attack continued and was catastrophic for the company. So too little trust can also be catastrophic. And so in this scenario, you can see all the events coming in and cats are flying everywhere, like how do you catch them all? And so we also have to be aware of information overload that does cause that alert fatigue. It just is one example. And so the question then becomes, but now we don't know what there's this concept of trust that it is a decision that we make. The question is how do we reason about it? And again, so to repeat, we have to set up a trust framework. That framework is contextual. What is the purpose of this thing? What are you trying to defend? If I create a snakes game that's multiplayer and stick into a $5 instance in the cloud, it's gonna be very different than if I'm trying to protect, let's say, financial information in the bank. So what is the context? Because the context also dictates how much you're willing to spend, what is the value of the thing you're trying to defend? What is the value of to the attacker of that thing that you're trying to, of what they want to grab from your systems or what they want to bring down? So once you understand the context of that particular thing, again, for what time period? Time sensitive and asymmetrical. Again, trust in computer systems by a crowd. Highly recommend reading this. Or at least read the first chapter. The first chapter is absolutely fantastic. But what we wanna do is we wanna start to do this for our systems and start asking, like, well, let's ask about the basics. Like the thing that you're building on, you have all these CI-CD systems. We're talking about building all these amazing attestations and zero trust on top of it. But can I trust the foundation that I'm building this thing on? Like think of how many systems are compromised because of patch management or somebody clicks an email and all of your security features just go out the door because now you have ransomware in your system, literally from someone clicking an email. And so you have to start with the basics. Establish trust in the thing that you're building. That's why baselines are also important is because they help establish that trust in that thing that you're building. And trust in the process, not in the actual individual thing, but trust in the processes themselves. And so once you've developed that framework, think about from a thread model perspective, like if I'm developing a thread model for something, the question then is not a question of, well, I'm not gonna trust anything in there. Well, clearly we're trusting something because we're running and using it. The question becomes, what is it that we are actually trusting? What is the reason that we're trusting that particular thing? Why am I trusting my single sign-on system to do what it needs to do? And also ask the question, what happens if it fails? And you wanna build a culture around this of people being, of asking this question about is our process good? Is our process enabling us to facilitate that trust in a healthy way? And is it making it explicit? And what happens if that trust is violated? What are the consequences to the system? What are the consequences to the organization, to you, to your customers? So you wanna ask what that consequence is and that gives you the blast radius. And the whole concept of zero trust that is a little bit unspoken is that you wanna focus on the blast radius because if something is compromised and you have a huge blast radius, like that's the entire thing we're trying to push against is not having an incident cause a massive breach. But if we have small blast radius, like things are gonna happen, things are gonna break, people are going to get in, the blast radius of that particular attack or that particular failure is the thing that we want to keep small. So what about zero trust then? Like as we have this concept, then one of the reasons I decided to give this talk about trust is that too many times I see people jumping into a architecture and saying, oh, it's zero trust, we're not gonna trust anything. It's like we're clearly trusting something and I'm trying to get people to think about what trust really means. Like why are we trusting something? What is that particular thing in the framework that was mentioned? And the reality of a zero trust is we should really actually rename it to zero implicit trust. Like this is really what we mean. There's clearly something we're trusting, the thing, but we wanna make it explicit. If you have implicit trust somewhere in your system and you're not exposing it, that is a area of risk because that means you're not analyzing it properly. You're not saying what is the blast radius of this? What is the impact of this thing goes wrong? So when you hear the word zero trust, interpret it to this, interpret it to zero implicit trust. So basically the implicit is implicit. So in short, I do wanna point out that all of these graphics were generated by AI. And so thank you AI for generating all these amazing cat photos. And finally, I didn't wanna leave out the dog people and there was a really amazing cloud native Corgi sticker that was given to me a long time. So this is a nod to the cloud native Corgi, cloud native Corgi foundation, CNCF. But in short, I do wanna thank you all. I do implore you to think about this particular question when you leave and when you're looking at any particular system. Even if you're not in security, you should still be asking this question about trust because trust is not just about keeping malicious actors out, trust is also about how do you design a system so that it does what you expect it to do? How do I trust it to do what I wanted to do? And that applies not only to computer systems but also to our relationships with each other. So again, thank you very much. So our next presenter is Denny Shannon. And Denny's is a senior director of engineering at Rancher by SUSE. And today she will share some key learnings and findings and explore how the cloud native open source community, technology and processes have welcomed us to get closer with Kubernetes Nirvana. So again, please welcome Denny Shannon.


This video was taken from our live at five show over on patron if you would like to come and join us on patron for all The exclusive videos and live shows every day the link is in the description James says would you use would you and he's actually spelt it? Would you take said to be a 12 million personally would take him but only as a squad player definitely think we can do better for a first choice right back Go on give you this one boss. I think he's excellent. I think defensively. He's not great But attacking fullbacks very rarely are great defensively That's well, it depends who we could get if we could if we could get a Young right back who was excellent like Hikini who's just about to finish his two-year loan at Dortmund in the summer Go back to Madrid if he was like available Then he's fantastic whether everything could get him is a different thing But someone like him is a fantastic play right and left both feet really good But I think when you look around I like Max Aaron's at Norwich, but is he better than Sidney be? Don't know a potential he's probably gonna have the potential to because he's a young lad and he's very good So I don't know because the issue that we would have you saying take him as a squad player, which is fine But then I don't see shames Coleman leaving the club in the summer I think she must be a for a guy. I think he'll be like Baines basically He'll be here as a backup So then if you've got Sidney be and she must then what happens with John Jo Kenney we sell John Jo Kenney site Then that's fine if you say in if you say in our right back area is okay It's good enough to challenge for European places and higher up. Then that's fine, isn't it? You don't want to waste money, but you know, there's there is good right backs Around good young ones who could you know the pivot tell you that I think the way to look at him is he does play a lot of games for us He plays more than Coleman and I Don't know maybe with a preseason under his belt with us. I mean not saying he's not fitting stuff But maybe a bit of preseason if the manager think he's got the the hallmarks of what he wants Then he might you always say He's a French right back in the French squad a lot. So for 12 million quid an international right back You already knows how the way we play knows our fans. He's a good. He's a big physical lad There's me from a business point of view. I think it makes sense to bring in someone like that Which someone and then I I personally think that I think there's a thing in the echo today to my John Joe and saying how They're monitoring them all the time They've got you know everything about his nutrition and there's all his stats and everything and they keep an eye on brands is big being over to watch him and I think we mentioned this yesterday. I'd leave him there for another year I I think I think another year in Germany would do him the welder good I really do rather than coming back and do you honestly put it? Well, let's flip the question, right? Do you think John Joe Kenny would be evident start right back next season if he came back? No And if I was John Joe Kenny, I wouldn't come back to ever having been a start and right back for Schelke and go Oh, I'll try and get in the team. I'll be like I Think if we if we look at John Joe Kenny and say, you know what with another 12 months in Germany or 18 months at the moment in Germany he potentially could be our number one right back because of the growth Then fine, do you know what I mean? Then let's do that because we're protecting our investment in them And by then someone might look and go well, you know what by then Seamus Coleman will be 32 We can let him go. Yeah, you know and then it should be then is the one whose place is under threat Yeah, you know what I mean, but I know we're half the problem is half of the problem is the idea of Letting Seamus Coleman go that's half of the problem is like you 32 you're thinking He's still got a couple of he's got another team in him And it's that thing of like he's been an effort player all his career Do you really and I think that's that's like the fear fact that you're always get but then it's the flip side of that and going Well, if you let him go on too long It's it's that thing of people start disliking them. Do you believe he's good enough to be our right back number one right back But the weird thing is I'm still a little bit Skeptical about the city said he'd be being I know he's just a start right back now But I'm still a bit skeptical about him being a start right back And that's the thing was saying isn't it you've got Seamus Coleman and saying is he gonna be a squad member? I still think he is good enough to be a squad member then you've got John Joe and then you've got said to be I think Personally I'd leave John Joe for another year. Hmm. If they truly believe his developments have gone the right way I think another season would do no harm of first team football. Hmm, and then for 12 for 12 million quid, I think said that's you're almost can't leave him there That's low enough. I think we you go 27 that he's worth it's worth a gamble. Yeah, it's not even a gamble. You've had him for a year You know all about him. You know his personality, you know everything about him He seems to love it at everything at this and football has always loved playing so you never but he seems to like it ever You'll probably go into the Euro's as the France second choice right back. I mean, that's a big Accurate the face to his left back and And he's had so far you're five assists this season Probably end up with seven or eight assists and that's good from a right from a right form I Put it this way right and you might look at it slightly different to me, but you know when you see the team and you see Coleman playing at the moment you kind of go So showing your head said the bees Stand right back and I think everyone will let me ask you this then go ahead next season Yeah, would you be happy with him to be our first show? That's the thing though, isn't it? That's the thing and then that what's the knock-on effect of that What is the knock-on effect of him being our of us of being our starting right back? But what I would say is If we decide to spy him Then what we're doing by that is saying to him you can be our starting right back It's up to you. Yeah, but we want more from you whether it be what I've what I've noticed is like Saturday when To me Carlos looked at that game and gone we need to target to her and I don't think Defensively said the bees good enough and I think shame is there's a better fullback at defensively then said the beers So then what you do if you see what what could change completely? This is right. You can't get a very mobile sentiment feel that said even never asked to play defensively is a right back I was thinking about that that's a major bigger issue. That then is a plan. That's a that's your FIFA Chemistry thing isn't it? That's the point is the if you've got I Think that's why Dean hasn't been as good this season Because I honestly don't feel like he goes up as much because there's no gana to cover him. So And he also has not someone in front of me. No, no, but I think if you don't know whether it be Gabam and or whatever, but I think if we get a sentiment feel that who's mobile I think Say the bee doesn't have to worry as much and then then you are looking at your right back Has been an attacker all the time and that might that might play a part in it It's how it all links together. It's what the manager wants what I would say about shape John Joe So sorry as well is I don't think he has been as as an attack and Fullback as much this season because I think she'll could have sort of almost asked him to just play a little bit further back When I say that I mean as an actual right back You know when I've seen them and he might I think I think he taught he was telling me this as well It doesn't tend to get as forward as much like braiding so It's more be safe them or he does still go forward. Yeah, that's his game. Yeah, you took that out of him then it He wouldn't be I don't think he'd be as good. Let us know in the comments Let us know whether you'd have him Yannick has said say the beers an absolute steal of 12 million best core and value Provides European and French international experience. He does get caught out of position But he's guilty moving for quality quality moving forward quality moving I used to work well with the team But that's the thing when you were saying it before that was my first thought was in a midfield That's more more mobility live appeal do it with Trent Alexander on because he can't he's not great defensively They three midfielders one of them will go and sit in and back him up. So Yeah, I think I probably pay him to be honest