You came from a CPA background, want to transition into B2C space, and you're also immigrant. On the top of that, you are also underpaid. What if I tell you, you're not alone? A lot of immigrants, lots of women are underpaid, but there's a way for you to jump into an even better company, change your industry, and really do the work you're truly passionate about. Today, I had a pleasure to invite our guest, Amy Yu, and she is support manager at TikTok, doing creator platforms, and she's going to share with you regarding her challenges, her journey, and vulnerabilities, and also how she conquers those challenges so that you can repeat her success as well. Hey guys, this is Dr. Nancy Lee, a director of product and feature in Forbes. I've helped 100 people land their dream PM job offer in fan companies and unicorn startups and continue to get promoted as a product leader. If an interesting partner management course goes to PMXL, her DIO, to learn the most effective way to become a partner manager, you should subscribe to the channel, hit the bell button to be notified every time I turn on your video every Tuesday. Hi, Amy, welcome to our show. So excited to have you join us. Thank you, thank you for having me here, Nancy. Awesome, so actually, I invited for a specific purpose because they actually made so many transitions and also conquered so many big challenges doing very competitive, like recession and comic. Can you do a quick introduction of yourself to the audience? Sure, so hi everyone, my name's Amy. I'm a product manager at TikTok in the San Jose office, which is their US headquarters. A little bit about my background, I transitioned to product management from a CPA background. Prior to becoming a PM, I was a consultant at Deloitte RIS advisory, got my CPA there, and then realized I wanted to work in tech as a PM. So I pivoted and I worked at the B2B SAS Deloitte startup for two years. And then last year around August, I quit my last job because I realized I was interested in the B2C space and in creator economy and the accounting tech space might not be in alignment with my longer term interests. And back then I also realized I wanted to land a PM job in the US because especially in the Bay Area because that is the tech capital of the world where some of the top talent in PM are working at. I wanted to be able to learn from the best. And in the meantime, I was also aware that we're in a recession economy, the job market is like super, super competitive. I was switching industry, switching country as an immigrant, as a non-US resident, and also potentially switching the size of company as well, moving from the startup space to the big tech space. So three barriers on my PM careers and I was actually quite overwhelmed. I was quite stressed out because I knew the PM hiring process was like really, really lengthy and very competitive as well. I really didn't think I could do it. Back in like August last year, it did take some time, but I did it. I made a transition. I'm now working in one of my dream industries in creator economy space. And to my surprise actually, my salary has increased a lot, which I didn't think was even possible even one year ago. It was quite a journey of career transition. I know a lot of women are actually very underpaid and a lot of us are actually not confident or comfortable in asking for more in our compensation or applying for that job that we're doubting ourselves, whether we're qualified for. I guess my intention of joining this discussion is to send out a message for the women out there to believe in yourself, to have faith in yourself. It doesn't matter where you are right now in your career. It doesn't matter how big your dream is. Don't be afraid to go for what you want because it is possible. It's not easy, but it's definitely possible. And I want to use my story to hopefully give some bit of inspiration or hopefully some perspective on how you can also bridge the gap and make the kind of jump or pivots that you want. Awesome. Amy, can you break it down regarding the challenges you're facing? And I love how vulnerable you are regarding you want to film these videos to really stand out to encourage, inspire lots of women out there, especially your salary increase significantly after your landed job, a take-off. So let's start from the top. What are the top three challenges and how did you conquer these challenges? Tell us your challenges first. So the top three challenges are if I look back on when I was applying for PM jobs back in, I would say, October last year, I would say it was definitely extra competitive during the recession economy because there were massive layoffs everywhere. So that itself is very difficult. But for me in particular, the three biggest challenge were one, switching industry. I came from a CPA background and I worked at an accounting tech company for two years. So most of the companies that were interested in hiring me were FinTech companies and other accounting tech companies. And it was very hard for me to land an interview in any industry outside accounting tech or outside FinTech in general. The second challenge was switching location. I was based in Toronto and I wanted to land a PM role in the San Francisco Bay Area, which is probably one of the most competitive job market in the world in tech because everyone wanna be in Bay Area, right? And the third challenge I would say is tackling the PM recruitment process. I'm sure a lot of people who are interested in becoming a PM is aware of how lengthy the PM hiring is, especially at later state startups and bigger tech companies. There might be potentially at least five rounds of interviews. For each round of the interview, there are many different kinds of PM questions that you need to prepare for. It takes a lot of effort and work and I felt like without a proper structure, it is very hard to stand out during the interview process. Not to mention, landing the interview itself is already competitive. So we all know the importance of building a product portfolio and actually I have a checklist of 13 different kind of project people can build on the site to create their own product portfolio to gain experience starting from today. I'm gonna each go to this website right here I'm also going to put it in the description of this video and we also have many different videos regarding free product portfolio tools. You should definitely use, we're also going to put it right here in the description and comment of this video as well. So Amy, I love you started talking about the transition and also very inspired by you in terms of the courage that you know to a past profession. Getting a CPA is very challenging. It's extremely challenging and you just switch your career completely because it just doesn't align with the long-term career goal. And I also understand, actually this is one of the biggest transition. CPA and accounting, you know, like tax return, I think it's very challenging. I feel boring, sorry. It's challenging, boring and challenging at the same time. And now you want to do like tech talk, creators, you know, economy, product. So how exactly did you conquer the challenge makes the transition? I would say one of the things that, the key things that has helped me is using leverage. I will share two stories on how I use leverage in accelerating my PM career. So first time was when I was pivoting to PM. When I decided when I want to become a product manager back in 2020, I had no prior PM experience, right? And I knew that to become a PM, you need PM experience and you need to demonstrate you can think like a PM. And I had a CPA background. So what kind of tech company will value someone like me? A tech company that serves CPA. A tech company does build products for CPA because I understand their users. I was one of their users. I can really emphasize really well what's the user pain point. I have that in-depth insider knowledge of their user's pain points. And user empathy is one of the most important PM competencies. I use that as a leverage to build a case study of some of the accounting software users. And I presented that during the interview with my last employer. And that landed my first PM job. So that was the first leverage that I used, which is my accounting background. Awesome. Second leverage that I used in terms of making the transition from accounting tech to creative economy is leveraging my creator identity. So something I didn't share earlier is I'm a standard comedian by night. That is my side hustle identity. I made funny videos on TikTok. I make funny videos on both Instagram and TikTok. So I am very obsessed with how to crack the TikTok algorithm. And I am very obsessed on understanding what helps creators succeed. Actually, last year, when I was doing a comedy festival in LA, one of the talent agency did a workshop and told all the comedians that they need to build a TikTok presence. They need to have a TikTok account. They need to upload their videos on TikTok because that's how comedians get recognized. TikTok can literally build a comedian's career. So I use that as a leverage by doing a case study of content creators on TikTok. Because I did stand a comedy, right? So I already knew a lot of creators who use TikTok. And they had a lot of challenges with, you know, continually using TikTok to, you know, build their brand, to build their audience. So I interviewed at least, I would say, 10 creators. A lot of them are comedians to understand their pain points. And then I used my PM thinking to synthesize the user pain points and prioritize them to identify a key problems to solve. And then I put together a presentation using PM framework to identify the best solution to solve, potential best solution to solve that problem. And then I- This is awesome. Yeah. So that I would say one of the most helpful thing for me in my PM career transition is using leverage. And that leverage doesn't have to come from your job. That leverage can come from the skills that you build outside of your job. It could come from your passion. It could come from like your nerdy obsession. It could come from your network. Awesome. So how do you learn how to build a portfolio the way you want it?  But most people doing that, they are not learning a job from TikTok to paying them a lot of money. What makes yours different? That is a very good question. Actually, I would say the most challenging part of building a product portfolio is really prioritizing what to include in a product portfolio. Like knowing what's important to include in a product portfolio because there's just so much to learn as a PM. There are so many skills. There are so many key core competencies. How do you showcase your skills within constraint? Like within, let's say like a short, in a very concise form to potential hiring manager because they have short attention span. They don't have time to learn the entire life story of your career, right? What I found really helpful was, so I joined product manager accelerator by Dr. Nisley, which is your program. And one of the most useful module for me was when the product portfolio module because it kind of refreshed my knowledge as a PN on some of the PN foundational thinking and PN foundational skills. And two is like, how do you structure your response for your product standards question, which is the product case question? During Dr. Nisley's PM accelerator program, one of the modules is about how to tackle product sense questions, AKA product case questions during PM interview. Dr. Nisley has taught us a framework, which is the modified version of the circle framework to tackle questions like, how would you improve X product? And I did get asked that question during my PM interview at TikTok, which is how would you improve our content platform for creators? Wow. Yeah, I did get asked that question. But you nailed it. I got asked that question, but instead of using the modified circle framework to answer it on the spot, what I did was I showed them my whole case study because I used the framework to build a case study of creators' pain points. Since that's something, you know, I was very passionate about. So I used the modified circle framework to showcase my way of thinking on a slide deck and I walked through, I walked a hiring manager through, you know, step by step. This is how I prioritized the problems to solve. This is how I prioritize the potential solutions. This is how I analyzed the competitor space. This is my recommendation and also this is a go-to market strategy. And I found very structured way of thinking that I learned from the PM accelerator was really, really helpful in organizing my responses because I have a tendency to ramble a lot, like outside of, I would say outside of an interview, I'm someone who talks a lot. And I'm someone who talks a lot. And without a structure, people can easily get lost on, you know, following with me or keeping up with me. So I definitely need to learn how to communicate and how to like present my thoughts in a very structured and easy to follow way. So Amy, I love how you share all the insight how you plan a job at TikTok doing those pivot. You also mentioned the second big challenge, which is as an immigrant non-U.S. citizen, learning a job in the U.S. actually very, very challenging. And to be frank, lots of people also want to move to the U.S. They just feel like, oh no, they need to be the sponsorship and no work experience in U.S. A lot of the failure is impossible. Like someone like you and many of the students have made it happen, even if they're all immigrant, never working in the U.S. Can you share with us how you challenge your own immigration challenges moving to the U.S.? That is a very good question. And it was definitely not easy at all. So my advice for those wanting to, you know, relocate to the U.S. that require revisit sponsorship will be, first of all, I would say try to find out what kind of companies are open or able to sponsor a visa. Because from my experience, a lot of the startups, they kind of prefer not to hire people who require visa sponsorship. And that kind of helped me kind of re-strategize my job search approach, not spending too much effort in applying for those companies. I think one of the ways to identify potential company that can sponsor a visa will be like, one, looking at other immigrant PM who got their visa, what kind of company did they work at and ask for their experiences. And two, as a rule of thumb, I would say like, usually it will be mostly later stage of startup that will have their ability to have their own immigration team to help to support the visa application process. So that it could also be an indicator on, in terms of the ease of lending a U.S. job. But in the same time else, I'm also aware that by speaking to some of the PM friends that some of the big tech company actually took back offers after knowing that the students need visa sponsorship. So I would say this doesn't apply to all companies. I would suggest recommend you doing the research whether there are any companies that have that kind of risk, right? Cause you don't want to putting so much effort only to be told that just because you need a visa you cannot have this job, right? That would be quite discouraging. Actually, I learned that advice from Adam Lee which is also a student's from alumni from the PM accelerator program. He has a very, very helpful blog on Medium that talks about his process of applying for visa. The second thing I would say to increase your chance of lending a job in the U.S. will be going back to my point of using leverage. So when I was applying for TikTok in addition to the leverage of understanding creators the other leverage I used was my bilingual competency because I knew that TikTok has a lot of engineers based in Asia and the ability to speak Mandarin is actually a very big asset as a PM when you cross functionally and cross time zone especially with the Asia team in Singapore and China. So I would say try to identify jobs that require a niche skill where you happen to have especially in a very competitive job market like everyone wants the best job possible it is so hard to set yourself apart because you will be competing with not just other people who want to become a PM but also other PMs who want a better job who already had PM experience in the U.S. And startup founders, their startup founders wanted to become a PM because they were like oh, I want to go back to a structured way of living they have already founded a million dollar startup before and they want to become a PM. That's how competitive the job market is. So you have to be strategic on building your brand on like setting yourself apart. Yeah, and I do like you talk about regarding the niche so let's also define the niche for the audience the niche doesn't mean that it's smaller company for example, Amy Joint Tech Talk which is really big company the niche could be the type of skills you have could be the type of product you build in the past or any kind of transfer skills that the combination of three different skills you have and you're the only person or maybe one of the few hands of people now hundreds of people have those combinations three different skills and that could be you. So thank you for sharing with us this is very insightful. How exactly you pass those interviews? Now you know how to find the right company and use product portfolio so how exactly pass those PM interviews because you said it earlier like millions of people or thousands of people they are all product manager or including layoff product manager for Google, Meta, Amazon is very competitive so how did you exactly actually pass those interviews? So that is a very good question for me I use two things one is I kind of do it differently from everyone else tell me more which is I took the initiative to build a case study to present to the interviewer which I could imagine probably not everyone would do that because usually how you tackle like the product sense question product execution question, product strategy question is you draw a whiteboard and you start writing things on the spot, right? And I took a step ahead which was I built a case study because I already thought through I saw I was think through what might be asked during the interview I think through if I were working already as a PM like how I will tackle this kind of problems using the PM framework so that when I was asked those question in during the interview I already have something ready to talk about and better I could show to the Harry manager that I had the initiative and the passion to already interview customers and to understand their needs I did my research I was really dedicated and passionate about the space and I did have a lot of insights and understanding of the problem space so that's something I did differently from a lot of other people the second one was definitely try to identify what was my weaknesses for usually for PM interview question there's behavior question there's product sense there's product execution product strategy and a technical question, right? So I'm curious, what's your weakness? My weakness? One is being concise first of all for a kind of interview question being concise like how do I prioritize my responses in a way that is concise and can't say more was less say more was less, right? And the second I would say knowing how to structure my response to the product sense, product execution product metrics, product strategy question in a PM accelerator program it helped me reduce that overwhelm and it made it seem more manageable because the structure of the PM accelerator program is like there's weekly live cases training where Dr. Nancy taught teach the different modules in kind of like a rotational manner so you can drop into the live training based on your weakness and there's also weekly office hour where you can ask very targeted questions of where you're struggling with, right? And I remember when I was in PM accelerator program I kind of prioritize and structure my study a little bit by prioritizing the areas that I was the weakest which is like I made sure I study all the PM interview modules on questions that I knew I didn't have a lot of confidence on just to learn the way of thinking and then I would participate in the live case training to learn how to for example do customer segmentation and also like to catch if there's any gap in my way of thinking and also for any area that I felt a little bit more uncomfortable with like I could observe how other people do it and also observe how Dr. Nancy Lee give feedback to the students on how they can potentially improve their response which I all found really, really helpful and then during the office hour if I had any areas of weaknesses that I felt really uncomfortable with or that I felt like not confident in myself I could always ask for help Dr. Nancy and the mentors which I found really, really helpful I love that you share so much regarding how exactly you prepare for interviews so now let me ask you over all questions so what's the most important shift that pushes the next level? So during the PM Accelerator program Dr. Nancy taught us a mindset called Bring the Bridge which in Chinese saying is like Tuo Fu Chen Zhou which is like you just cut off my backup like I cut off my backup by quitting like just not turning back like just not going back and just took that leap of faith I was hesitating a little bit on whether or not I would join PM Accelerator because I was already living on my savings and I need to be careful with where I spend my money and it was not a cheap program and what I found so helpful was the PM Accelerator program was really prioritization it's so important because sometimes people tend to procrastinate and get paralyzed when they have too many options when they have too much information and when there's too much out there and they don't know how to differentiate the signal versus the noise what I found so helpful was joining the PM Accelerator program was to help me filter out the noise like it helped me just like filter out what is not important and I just do not even waste my time do not even waste any effort on things that would not result and instead channel my energy and my time towards things that are actually more effective it was a really helpful cohort and community of people like minor people who a lot of them are in similar career phase as me and going through similar process and some of them have been a little bit ahead that could share such valuable insights normally if I wanted to get mentorship or peer mentorship or peer support I had to seek those out on my own for example I need to reach out to people individually and say women in product I had to network I could still make connection but then it's a very hit or miss and it would definitely take longer time so I would say like a lot of people who are on the fence about like whether or not they want to join a bookend or a structure program like PM Accelerator my advice is like I see paying for a PM Accelerator program as an investment in my career not an expense after joining this program I was able to land a job offer that was a significant salary raise that in any industry doesn't align with my long-term passion and also be able to hugely, I would say hugely accelerate my career at a pace that I couldn't imagine even a year ago in that sense I feel like I am investing in career capital rather than just an expense because I'm building my asset I'm building my career capital that can yield, benefit, you know that will yield income that will yield so much value in the future let's say you decide to pay for a course to train up a PM skill like you want to evaluate a potential return on investment based on like the long-term benefit because I wanted to join a program where not only tackle interview questions but also like, you know strategize how I look for a job that's the best fit for me and also learn foundational PM skill like even improve my PM skill that will benefit me in my future job you want to make sure that you build your core competency and I feel like if you learn on your own you can still do it but you will be probably walking as opposed to sprinting or running if you have a lot of time let's say you have several you give yourself two years or several years you can definitely do it at your own pace but if you say you're aiming for you're aiming for let's say efficiency you're aiming for you're trying to shorten the amount of time on this transition then I would recommend investing in like a more structured program where you can get structure mentorship and a faster feedback loop from your peers as well so that way you grow faster So Annie, so tell us what advice do you have for someone who wants to start the PM career? So my advice for someone who wants to start their PM career will be one is build foundational PM knowledge and PM way of thinking because product manager needs to think in a different way and consultants and marketers you're working in cross-functional teams with both business and technical stakeholders and your customers you'll be working with a lot of different persona you will need to learn how to prioritize what to build, when to build why is it important to build you need to be able to make a lot of decisions based on limited resource limited data and I would say it's very important for product manager to learn for example, design thinking to learn the PM foundational skills on how you can identify the right problem and prioritize the right problem to solve and also work with your cross-functional stakeholders to identify the best solution to solve that problem that aligns with your company's objective in terms of building the PM skillset and knowledge there are several ways I would say like one of the most efficient way is joining a program like PM accelerator joining a bootcamp because it's like very systematic training on the PM foundational knowledge the second advice I would give is try to build hands-on experience if you didn't come from the PM background because for most of the PM job they look for relevant PM experiences and if you didn't come from the PM background it's really important to build a product portfolio where you can demonstrate to a hiring manager that even though you didn't work as a PM before you have actually had hands-on experience as a PM either through working on side projects or volunteering for nonprofits or participating in a hackathon where you got to ship an MVP you want to make sure that you don't just have the theories that you learned from say books or courses you also have applied them in real life and you have learned something from those hands-on experiences as well so those will be my two pieces of advice This is amazing and thank you so much for sharing with us, Amy actually you share so much details I think people can just follow your same path to transition and also land a high-paying job in B-PAC companies in the US as well thank you so much for following thank you so much for sharing with us and of course I will also check out your comedian center comedian jokes for sure and we're also going to put it in the description of this video as well and we're also going to put your following through our YouTube channel awesome if you like any free tips we've provided today feel free to like this video and for regarding portfolio people ask these questions whether we use it, what tools we use feel free to go to the link in the description on this website you can download the 30 different projects you can build and identify those top five free tools and you can immediately get started and it's time to take massive action towards your career dream as well thank you very much for joining us today make sure to like, share and subscribe to the channel we'll see you in the next video bye guys


Live from the Sands Convention Center in Las Vegas, Nevada, it's theCUBE at AWS ReInvent 2014. Brought to you by headline sponsors Amazon and Trend Micro. Okay, welcome back everyone. We are here live at Amazon Webster's ReInvent 2014. This is theCUBE, our flagship program, where we go out to the events and extract the synth and the noise. I'm John Furrier, the founder of Silicon Am. I'm John Michael, Stu Miniman from Wikibon.org. Our next guest is James Hamilton, who's Vice President and Distinguished Engineer at Amazon Web Services. Back again, second year in a row. He's a celebrity, everyone wants his autographs, felpies. I just tweeted a picture of Stu. Welcome back. Thank you very much. I can't believe this is a technology conference. He was falling over himself right now because he's so happy you're here. And we are too, because we really appreciate you taking the time to come on. I know you're super busy, you've got sessions, but I always could do a CUBE session on, kind of what you're working on. Certainly, amazing progress. We were really impressed with what you guys have done over the years last year too, but this year the house was packed. Your talk was very well received. Cool. Every VC that I know in enterprise is here. And they're not telling everyone. There's a lot of stuff going on. The competitors are here. And you're up there in a holding court. Talking about the future. So, quickly summarize what you talked about in your session on the first day. What was the premise? What was the talk's objective? And what was some of the key content? Gotcha, gotcha. My big objective was, the cloud really is fundamentally different. This is not another little bit of nomenclature. This is something that's fundamentally different. It's going to change the way our industry operates. And what I wanted to do is to step through a bunch of examples of innovations and show how this really is different from how IT has been done for years and gone by. So the data center, obviously, we're getting quotes after quotes. Obviously, we're here at the Amazon show. So the quotes tend to be skewed towards this statement. But I'm not in the data center business. Seems to be the theme. People generally aren't in the data center business. They're doing a lot of other things. They need data centers to run their business. With that in mind, what are the new innovations that you see coming off that you're working on, that you have in place, that are going to be the enabler for this new data center in the cloud. So that customers can say, hey, I just want to get all this baggage off my back. I just want to run my business agile and effectively. Is it the equipment? Is it the softwares or the chips? And what are you doing there from an innovation standpoint? Yeah, what I focused on this year, and I think it's a couple important areas are networking because there's big cost problems in networking. And we've done a lot of work in that area that we think is going to help customers a lot. The second one is database because databases, they're complicated. They're the core of all applications. When applications run into trouble, typically it's the database at the core of it. So those are the two areas I covered and I think that's two of the most important areas we're working right now. Yeah, so James, we've looked back into people that have tried to do this services angle before. Networking has been one of the bottlenecks. I think one of the reasons why the XSBs fell to the 90s, it was networking and security, grid computing. Even to today, so what is Amazon fundamentally doing different today? Why now is it acceptable that you can deliver services around the world from your environment? What's different about networking today? It's a good question. I think it's a combination of private links between all of the regions. Every major region is privately linked today. That's better cost structure, better availability, lower latency. Scaling down to the data center level, we run all custom Amazon design gear, all custom Amazon design protocol stacks. And why is that important? It's because the cost of networking is actually climbing relative to the rest of the compute. And so we need to do that in order to get costs under control and actually continue to be able to drop costs. Second thing is customers need more networking bandwidth per compute right now. It's East-West is the big focus of the industry. Because more bandwidth is required, we need to invest more fast. That's why we're doing private gear. Yeah, I mean it's a fascinating statistic because it's not just bandwidth. Why you said you do have up to 25 terabits per second between nodes, it's latency and jitter that are hugely important, especially when you go into databases. Can you talk about just architecturally what you do with availability zones versus if I'm going to a Google or a Microsoft, what does differentiate you? It is a little bit different. The parts that are the same are every big enterprise that needs highly available applications is going to run those applications across multiple data centers. That's so, the way our system works is you choose the region to get close to your users or to get close to your customers or to be within a jurisdictional boundary. From down below the region, normally what's in a region is a data center and customers usually are replicating between two regions. What's different in the Amazon solution is we have availability zones within region. Each availability zone is actually at least one data center. Because we have multiple data centers inside the same region, it enables customers to do real-time synchronous replication between those data centers. And so if they choose to, they can run multi-region replication just like most high-end applications do today. Or they can run within an AZ synchronous replication to multiple data centers. The advantage of that is it takes less administrative complexity when it comes. If there's a failure, you never lose a transaction where in multi-region replication, it has to be asynchronous because of the speed of light. Also there's a jurisdictional benefits too, right? Say Germany, for instance, with a new data center. Yeah, many customers want to keep their data in region and so that's another reason why you don't necessarily want to replicate it out in order to get that level of redundancy. You want to have multiple data centers in region, 100% correct.  I think about replication solutions. You used SRDF as an example. I've worked with that. I've worked for EMC for 10 years and just doing a two-site replication is challenging. Doing a multi-site is differently. You guys, six data centers and availability zone are merging. You fundamentally have a different way of handling replication. We do. The strategy inside Amazon is to say multi-region replication is great but because of the latency between regions they're a long way apart and the reality of speed of light, you can't run synchronous. If data centers are relatively close together in the same region, the replication can be done synchronously and what that means is if there's a failure anywhere, you lose no transactions. Yeah, so there's a great line you had in your session yesterday that networking has been anti-mores law when it comes to pricing.  Everybody watches what you do. You buy from the ODMs. You're changing the supply chain. What's your vision as to where networking needs to go from a supply chain and equipment standpoint? Networking needs to be the same place where servers went 20 years ago and that is it needs to be on a more law curve where as we get more and more transistors on a chip we should get lower and lower costs in a server. We should get lower and lower costs in a network. Today in ASIC, which is the core of a router is always around the same price. Each generation we add more ports to that and so effectively we've got a more law in price improvement happening where that ASIC stays the same price and we just keep adding ports. So I got to jump in and ask you about open compute. Last year you said it's good. I guess I'm a fan but we do our own thing. Still the case? Yeah, absolutely. You're doing your own thing and just watching open compute which is like a make or fair for geeks. Open compute's very cool. The thing is what's happening in our industry right now is hyper-specialization. Instead of buying general purpose hardware that's good for a large number of customers we're buying hardware that's targeted to a specific workload, a specific service and so we're not, I love what happens with open compute because you can learn from it. It's really good stuff but it's not what we use. We want to target our workloads precisely. That was actually the title of the article I wrote from everything I've learned from you last year was hyper-specialization is your secret sauce. So you also said earlier this week that we should watch the mobile suppliers and that's where servers should be in the future but I heard somebody sent me a quote from you that said that unfortunately arm is not moving quite fast enough to keep up with where Intel's going. Where do you see, I know you're a fan of some of the chip manufacturers, where's that moving? Yeah, when I met with watch, arm and understand where servers are going, sorry not arm, watch, mobile and understand where servers is going is power became important to mobile, power becomes important to the servers. Most functionality is being pulled up on chip on mobile, same things happening in server land and so. You're saying it's mobile's a predictor of the trends in the data center. Exactly, exactly right. Because of the challenges with the form factor. It sounds like the form factor the importance of power and the importance of, well, density is important as well. So it turns out the mobile tends to be a few years ahead but all the same kinds of innovations that show up there we ended up finding them a service a few years later. All right, so James we've been at Wikibon to have a strong background in the storage world and David Floyer RCTO said one of the biggest challenges you had with databases is they were designed to respond to disk and therefore there were certain kind of locking mechanisms in place. Can you talk a little bit about what you've done at Amazon with Aurora and why you're fundamentally changing the underlying storage for that? Yeah, Aurora is applying modern database technology to the new world and the new world is SSDs at the base and multiple availability zones available and so if you look closely at Aurora you'll see that the storage engine is actually spread over multiple availability zones it was mentioned in the keynote it's a log structured store. Log structured stores work very, very nicely on SSDs they're not wonderful choices on spinning magnetic media so what we're optimized for is SSDs and we're not running it on spinning disk at all. So I got to ask you about the questions we're seeing in the crowd so you guys are obviously doing great on the scale side you get the availability zones which makes a lot of sense and certainly the Germany announcement with the whole Ireland, EU data governance thing and also expansion is great but the government is moving faster than some enterprises and so we were talking about that last night but people out there are saying that's great and it's a private cloud the government's implementing a private cloud so you agree that's a private cloud or is that a public? It's not a private cloud if you see Amazon involved it's not a private cloud our view of what we're good at and the advantages the cloud brings to market are we run a very large fleet of servers in every region we provide a standard set of services in all those regions it's completely different than packaged software what the CIA has is another AWS region it happens to be on their site but it is just another AWS region and that's the way they want it. Well people are going to start using that against you guys start parsing well if it's private it's only them then it's private but there's some technicalities you're clarifying that. It's definitely not a private cloud the reason why we're not going to get involved with doing private clouds is product software is different it's inefficient when you deliver to thousands of customers you can't make some of the optimizations that we make because we run the same thing everywhere we actually have a much more reliable product we're innovating more quickly we just think it's a different world. So James you've talked a lot that scale fundamentally changes the way you architect and build things. Amazon's now got over a million customers and it's got so many services just adding more and more Wikibon actually Dave Vellante wrote a post yesterday said that we're trying to fundamentally change the economic model for enterprise IT so that services are now like software when Microsoft would print an extra disk it didn't cost anything. For when you're building your environment is there more strain on your environment for adding that next thousand customers or that next big service or just do you have the substrate built that's going to be able to help and grow for the future? It's a good question it varies on the service and usually what happens is we get better year over year over year and what we find is once you get a service to scale like S3 is definitely at scale then growth I won't say it's easy but it's easier to predict because you're already on a large base and we already know how to do it fairly well other services require a lot more thought on how to grow it and end up being a lot more difficult. So I had some more questions before I go into some of the personal questions I want to ask you so I'm looking at these booths right here it's Netflix guys right there love that service awesome founder just what they do is this great company and I know they're a big customer but you mentioned network so at the Google conference we went to Google's got some chops they have the developer community rocking and rolling and then it's pretty obvious what they're doing and that's trying to compete with Amazon because it's too much work but they're going after the front end developer rails what not PHP and really nailing the backend transport you see in the peering really going after to enable on Netflix this next generation companies to have the backbone and not be relying on third party networks so I got to ask you so as someone who's a tinkerer mechanic if you will of the large scale stuff you got to get rid of that middle man on the network what's your plans you going to do peering Google's Aussie telegraphing they're coming down that road do you guys meet their objective same product better what's your strategy yeah it's a great question the reason why we're running private links between our regions is the same reason that Google is it's lower cost that's good it's much much lower latency that's really good and it's a lot less jitter and that's extremely important and so it's private links peering, customers direct connecting that's all the reality of a modern cloud and you see that do you have to build that in almost like you want to build your own chips I'd imagine on the mobile side with the phone we can see that everyone's building their own chips you got to have your own network stuff yep is that where you guys see the most improvement on the network side getting down to the down to that precise hyper specialized we're not doing our own chips today and we don't in the networking world and we don't see that as being a requirement what we do see as a requirement is we're buying our own A6 we're doing our own designs we're building our own protocol stack that's delivering great value and that is what's deployed private network is deployed in all of our data centers now yeah I mean James I wonder you must look at Google they do have an impressive network they've got the undersea cables is there anything that you look at them saying we need to move forward and catch up to them on certain pieces of the network I don't think so I think when you look at any of the big providers they're all mature enough that they're doing at that level I think what we do has to be kind of similar if private links are a better solution then we're all going to do it it makes a lot of sense does it you know deep packet inspection you know throttling traffic that just creates uncertainty so that I'm a big fan obviously that direction alright now a personal question so I talked to your wife last night and get to know you over the years here and Stu's obviously a big fan there's a huge new generation of engineers coming into the market open compute I bring that up because it's such a great initiative you guys obviously have your own business reasons to do your own stuff I get that but there's a whole new culture of engineering coming out a new homebrew computer club is out there forming right now my young son makes his own machines assembling stuff so you're an inspiration to that whole group so I would like you to share just some commentary to this new generation what to do how to approach things how you what you've learned how do you come up on top of failure how do you resolve that how do you always grow so share some personal perspective yeah it's interesting I know you're humble but you know interesting question I think being curious is the most important thing possible if anybody ever gets an opportunity to meet somebody that's atop of any business a heart surgeon a jet engine designer an auto mechanic anyone atop of their business is always worth is always worth meeting cause you can always learn from them one of the cool things that I find with my job is because it spans so many different areas it's amazing how often I'll pick up a tidbit one day talking to an expert sailor and the next day be able to apply that tidbit or that idea solving problems in the cloud so just don't look for your narrow focus your advice is talk to people who are pros in whatever their field is and it's always another James a friend of mine stay curious Steve Toddy actually called that Venn diagram innovation where you need to find all of those different pieces cause you're never going to know where you find the next idea so for the networking guys you know there's huge army of CCIEs out there some have predicted that if you have the title administrator in your name that you know you might be out of a job in five years what do you recommend what should they be training on what should they be working for to move forward to this new world the history of computing is one of the level of abstraction going up no never have the has it been the case those jobs go away the only people that the only time jobs have ever gone away is when someone stated a level of abstraction that just wasn't really where the focus is we need people taking care of systems as the abstraction level goes up there's still complexity and so my recommendation is keep learning just keep learning all right so I got to ask you the big picture now ecosystems out here Oracle, IBM these big incumbents are looking at Amazon scratching their heads and it's hard for us to change our business to compete obviously you guys are pretty clear in your positioning what's next outside of the current situation what do you look at that needs to be built out besides the network that you see coming around the corner and you don't have to reveal any secrets just philosophically what's your vision there I think our strategy is maybe a little definitely a little bit different from some of the existing old school providers one is everyone's kind of used to Amazon passes on value to customers we tend to be always hunting and innovating and trying to lower costs and passing on the value to customers that's one thing second one is choice I personally choose to run my SQL because I like the product I think it's very good value some of our customers want to run Oracle some of our customers want to run my SQL and we're absolutely fine doing that some people want to run SQL server and so the things that kind of differentiate us is enterprise software hasn't dropped prices ever and that's just the way we work enterprise software is not about choice we're all about choice and so I think those are the two big differences and I think those ones might last yeah that's a good way to look at that now back to the IT guy let's talk about the CIO scratch his head saying okay I got the facilities budget and it's kind of the I talked to one CIO he says I spend more times in planning meetings around facilities power and cooling than anything else on innovation so they have challenges here so what's your advice as someone who's been through a lot of engineering a lot of large scale to that team of people on power and cooling to really kind of go the next level and besides just saying okay throw some pods out there or what not what should they be doing what's their roadmap you mean the roadmap for doing a better job of running their facilities yeah there's always pressure for density and power is a sacred resource right now I mean power is everything power is the new oil so power is driving everything so they have to optimize for that but you can generate more power sure, sure, sure in space so they want smaller spaces and more efficiency the biggest gains that are happening right now and the biggest innovations that have been happening over the last five years in data centers is mostly around mechanical systems and driving down the cost of cooling and so that's one hot area second one is if you look closely at servers you'll see that as density goes up the complexity and difficulty of cooling them goes up and so getting designs that are optimized for running at higher temperatures and certified for higher temperatures is another good step and we do both so James there's such a diverse ecosystem here I wonder if you've had a chance to look around anything cool outside of what Amazon's doing whether it's a partner or some startup or some interesting idea that's caught your attention at the show yeah, yeah in fact I was meeting with Western with, pardon me, Hitachi data systems about three days ago and they were describing some work that was done by cycle computing and several hundred thousand cores we've had cycle computing going on oh wow last year we had a fun so Hitachi's just showing me some of what they gained from this work and then he showed me this bill and it was five thousand six hundred and seven dollars for running this phenomenally big multi-hundred thousand core project blew me away, I think that's phenomenal just phenomenal work James I really appreciate you coming in Stu and I really glad you took the time to spend with our audience and come on theCUBE again great pleasurable conversation very knowledgeable stay curious and get those nuggets of information and keep us informed thanks for coming on theCUBE James Hamilton, distinguished engineer at Amazon doing some great work and again, the future's all about making it smaller, faster, cheaper and passing those costs you guys have a great strategy a lot of your fans are here customers and other engineers so thanks for spending the time this is theCUBE I'm John Furrier with Stu Miniman we'll be right back after this short break


10 Greatest African Achievements the Europeans Took Credits For Hello and welcome to our channel. In today's video, we'll be discussing some of the greatest achievements of Africans that were later attributed to Europeans. It is important to recognize the accomplishments of African people and give credit where credit is due. If we consider the origins of math, the understanding of celestial movements, medical techniques, and other notable accomplishments, it would be easy to assume that Europeans or Americans were responsible. However, this is far from the truth. The reality is that Africans have achieved a great deal throughout history, often with little recognition. The Great Pyramid of Egypt, for example, have been attributed to Europeans, Arabs, and Babylonians, when in fact they were created by Africans. After a careful and thorough investigation, Africa Reloaded aims to shenlight on lesser-known aspects of Black history, culture, arts, and lost civilizations. In this episode, we will discuss some of the incredible African achievements that have been wrongly credited to others. While the list is extensive, we have researched and to give you an idea of the incredible accomplishments that African people have achieved, even in the face of adversity. I am James, your host. Stay with us to find out more. Please take a few seconds to give us a thumbs up before we begin. The Construction of the Pyramids Construction of the pyramids in ancient Egypt is often viewed as a feat of engineering and architecture that was only possible with the help of advanced technology. However, the construction of the pyramids was achieved through the hard work of tens of thousands of skilled laborers and craftsmen. These workers were mostly Egyptian farmers who were conscripted to work on the pyramids during the flood season when farming was impossible. Despite their contributions, the credit for the construction of the pyramids is often given solely to the pharaohs and their architects. The Discovery of Diamonds in South Africa Discovery of diamonds in South Africa in the late 19th century was a significant event in the history of diamond mining. However, the discovery of diamonds was not made by Europeans, but rather by a South African farmer named Erasmus Jacobs. Jacobs found a shiny pebble on his farm in 1867, which was later identified as a diamond. The discovery of diamonds in South Africa led to a diamond rush and the development of the diamond industry in the country. Despite the significant role played by South Africans in the discovery and development of the diamond industry, the credit for the discovery of diamonds in South Africa is often given solely to Europeans. Mathematics This is an essential field that has contributed significantly to scientific discoveries and technological advancements. However, the Western world tends to overlook the contributions of ancient Egyptians to mathematics. The ancient Egyptians developed algebra, geometry, and the use of fractions with the rhymed mathematical papyrus being one of the earliest mathematical texts dating back to around 1650 BCE. It is time to recognize the critical contributions made by ancient Egyptians to mathematics. The discovery of oil in Nigeria Nigeria is one of the largest oil producing countries in the world, yet the discovery of oil in Nigeria is often credited to Western oil companies. Oil was first discovered in Nigeria in the late 1950s by a team of Manchurian geologists and a British company, but it was the British who claimed the credit for the discovery. The oil industry in Nigeria has had a significant impact on the country's economy, yet the role of Manchurian geologists in the discovery of oil is often overlooked. Medicine The knowledge of medicine was also widespread in ancient Africa, where societies had developed extensive knowledge of healthcare long before the arrival of Europeans. The Yoruba people of present-day Nigeria had a well-developed healthcare system that included traditional medicine and surgery. However, the Western world tends to credit Hippocrates, a Greek physician, as the father of medicine. This is despite the fact that many of his medical teachings were based on ancient African knowledge. Astronomy Ancient Africans also made significant contributions to the field of astronomy. The city of Timbuktu Mali had a university that taught astronomy, mathematics, and other subjects. The Dogon people of Mali also had extensive knowledge of astronomy and cosmology.  This belief was confirmed by Western astronomers centuries later. It's time to acknowledge the significant contributions of ancient Africans to astronomy. Ironworking Ironworking was developed independently in various parts of Africa, including present-day Nigeria, Tanzania, and Zimbabwe. The Knot culture, which existed in present-day Nigeria from around 1000 BCE to 500 CE, is known for its impressive ironworking skills. The Bantu people of present-day Tanzania were also skilled ironworkers, as were the people of the great Zimbabwe civilization, which existed from the 11th to the 15th century. However, the Western world tends to credit the ancient Greeks with the development of ironworking. It is time to recognize Africa's contributions to the field of ironworking. Navigation Ancient Africans were skilled navigators, with evidence of seafaring dating back to at least 6000 BCE. The ancient Egyptians had a well-developed knowledge of navigation, which they used to explore and trade with other civilizations. The people of the Swahili coast in present-day Kenya and Tanzania were also skilled seafarers and traders. They established trade routes with various parts of the world, including China and India. However, the Western world often credits the ancient Greeks and Phoenicians with the development of navigation. It's time to acknowledge Africa's contributions to the field of navigation. The Discovery of the Rosetta Stone The Rosetta Stone, a steel inscribed with a decree issued at Memphis, Egypt, in 196 BC, was discovered in 1799 by a French soldier. However, it was the British Museum that ended up with the stone after the British defeated the French in Egypt, and it was British scholars who deciphered the hieroglyphics on the stone. The discovery and decipherment of the Rosetta Stone was a significant step in unlocking the secrets of ancient Egyptian hieroglyphics, yet it is often credited solely to British efforts. The Invention of the Printing Press Johannes Gutenberg is often credited with the invention of the printing press in the 15th century, which revolutionized the way books and other printed materials were produced. However, the Chinese had already developed printing technology using wood blocks as early as the 7th century. Similarly, the Koreans had developed a printing press using movable metal type in the 13th century. Despite these achievements, the credit for the invention of the printing press is often given solely to Gutenberg. It is important to recognize and acknowledge the many great achievements of Africans throughout history, which have been unfairly attributed to Europeans. From the development of advanced mathematics and medicine, to the creation of complex societies and impressive architectural feats, African civilizations have contributed immensely to the world. Sadly, for too long, Europeans have taken credit for these accomplishments, perpetuating a narrative that erases the agency and innovation of African peoples. By acknowledging and celebrating these achievements, we can begin to rectify the historical record and honor the ingenuity and creativity of African cultures. Thanks for watching. Please like, share, comment, and subscribe to Africa Reloaded.


really Adam, Adam Bresson. And I've actually been doing PHP for about five years in my SQL. Last year I spoke on Palm Security as well, which my grandfather got really upset with me about because about a month afterwards the stock dove because all the viruses came out and stuff. But I had nothing to do with it. I had set the record straight. He's watching this on the web. So now I'll feel really good, you know, and he'll put me back in his will and stuff, which is really important. All right, so we're gonna start off with talking about what we're gonna learn today so that if it's not something you want to learn or it makes you sad or it hurts you in some way, you can walk out. We're gonna learn PHP basics and uses. PHP is a web programming language. It's very simple. It lets you make dynamic web pages. It's free. It's not by Microsoft and it's not ASP. So these are all very good reasons to use it. Yeah, that's how we're out of a plaza! Yeah! Yeah! Yeah! All right, we're gonna talk about how to secure, I feel so tall right now. We're gonna talk about how to secure PHP installations and how to use encryption with PHP so that you guys can protect your PHP scripts and the information you store. We're also gonna talk about how to make a link and email grabber, which is the data mining. So I give you guys code. You can expand it, make it look really, put your little elite conversation in it, you know, put your little hacker name on the top of it and run wild with it, wild with it. We're gonna talk about how to make a live search engine, a lot like Asta Levista, but it's really fast, it runs in PHP, it's super quick. You can basically search any web pages you want to and get information on them. We're gonna make a port scanner with PHP. Do you guys know what that is? We're gonna emulate TCPIP traffic using PHP sockets. It actually has a full implementation of sockets in it. You can do, you can actually set up sessions and communicate directly with a socket any server in the world. I'm gonna give you guys some ideas for your own expansion of this code. I know that this is just for you. This will make you feel good about yourselves.  Send it out on the internet, let the world see it, get the feds upset. And the last part we're gonna learn today is how to last an hour in a hot conference room without dinner. Without dinner, there won't be any dinner served, unfortunately. Oh my gosh. There we go. All right, quick overview. From the PHP manual, PHP is an HTML embedded scripting language. Much of its syntax is borrowed from C, Java, and Perl with a couple of unique PHP features thrown in. Basically what they did is they, when they originally created the language, they just wanted to be able to put, you know, use variables on a webpage to be able to customize it. So they wanted to be able to set it up so that you could put any name on the page, any information, draw it out of a database. That came second. They want web developers to write dynamically generated pages. Let me show you guys an example of a dynamically generated page. Casey never saw one before. He said sarcastically. All right, the beauty of PHP is that it outputs HTML. So you can dynamically shape web pages. Its output is just HTML. And you get to use the variables and the structures in it and the different aspects of it to make customize HTML. In addition, it can build images with the GD library. This is like one of the coolest things in the world. It has a built-in library that you can create your own images, much like Logo, for anyone who used to use that on the Apple 2e. Woo, Logo rules! Then it became a weird Christian bookstore. But yeah, so you could build your own graphics and images using PHP. It interacts directly with 15 plus databases. It has native C support for 15 databases. Not like an ODBC, although it has that module in it. Direct interfaces to very popular databases, FileMaker, Microsoft, and MSSQL and Postgres. It competes against ASP and JSP to give you guys some example. It's in use now on 1.75 million websites, which is a lot for free technology that has basically no commercial company behind it until about seven months ago when the two people who wrote it decided to form Zen, which is the commercial company. Typical uses, e-commerce. People love using it for e-commerce because it's so well suited for things like a shopping cart.  Everyone's happy in the world. I created a commercial website two years ago called recommendo.com. This is not a pitch. Jehovah starts with an I. And so recommendo actually uses the customization. It uses MySQL to do the database work on it, creates the pages from templates. The whole site is literally five pages and I use PHP to customize it with includes and modules and things like that. I'm gonna start with the basics of PHP. Can I just get a show of hands here because this is like what you do when you talk? How many people here have coded PHP before? Fantastic, that's so awesome. When you go on Yahoo's job board and you put in PHP, there's like 10 jobs. When you go to like guru.net, I found like maybe like 30 jobs there, but I knew that there's a larger community of people out there using it. And so we're gonna use a few features that you probably weren't familiar with before. I'll stop for questions if you guys have them, but make sure they're relevant to what I'm talking about. At the end of it, if you want, we can sit down and talk about how to do all the fun stuff with it, how to do database, how to do fake transactions, whatever you wanna talk about. But if you wanna ask questions, make sure it's relevant to what we're talking about. Okay, since you guys have some experience with PHP before, I'll go over the basics for those who haven't. Basically, you announce PHP in the webpage. So you start with two tags, beginning and ending tag, much like JavaScript and much like JSP and ASP. It's less than question mark PHP, question mark greater than to close it. All PHP lines end with the terminator, that's the semicolon. Semicolon doesn't get much work out in life, but it gets much work out in programming languages. PHP is compiled at run time, so you get to control its speed and execution directly. What's nice about that is it's not a byte code language like Java. It's actually compiled as you run it. So you say you can use the world famous four next loops to put pauses in the middle of your program, have it accomplish things and have it seem like it's waiting. But you get to control the program flow, which is important. PHP doesn't output anything until you tell it to with print or echo. It's not like ASP, which has some basic procedures in it and things that will automatically output to print. You have to tell it to output the data. I use UltraEdit to code PHP, and this is a plug, because this is like the coolest software in the world, and the second most thefted software in the world next to Winzip. I thought you'd like to know that statistic. But it has a PHP word file, which is context highlighting and tag finishing for you too. Quick technique, how to do output. You use print or echo. What is the difference between print or echo? You don't care. They both do the exact same thing. Except that when you use print or echo, you're really using a function, so you have to use a quotation mark, and it depends how it processes the variables when it outputs it. It always outputs a standard out. It's usually the browser. Print F, neat function. It prints formatted text according to regex expressions. So if you want to format your text, and you want to put commas in the numbers, or the right amount of decimal points, you can do it from that. You can escape in and out of PHP. For example, you could use at the top, the title tag in HTML, and you could do start PHP, dollar sign foo, and PHP, parentheses home page. They love this. When you do a page for a business website, and at the top it says you sign in, and you're like, oh, my user name's Adam, and then it says Adam's webpage after it. That's darling, isn't it? That's why. That's like a lot of PHP and ASP. It's like, oh, that's so sweet. That's so darling. All right, quick technique, how to do variables here. Okay, I'm looking right now. Is anyone asleep? Is anyone asleep? I just started. Okay, you do not need to declare variables. PHP has automatic memory allocation and typing do do do. That's like the coolest thing. You don't have to type your variables. You don't have to declare them at the beginning. PHP takes care of all your typing for you. In fact, there's a whole series of commands that let you get the type for a variable, that let you change the type of a variable, and touch poke and prod variables. It's fantastic stuff. You initialize a variable simply by using it as an expression. For example, dollar sign foo equals Adam. Oh, where do you get that value from? It establishes the variable foo as a string with the value of Adam. Use get type to determine the type of your variable. It's either boolean, integer, double string, array object, resource, null, which is new in PHP 4, or a known type. Yes, sir. Yes, you can. In fact, you can actually declare variables with a function and automatically say it can only hold doubles, or it can only hold integer numbers. And then, like I said, as a PHP 4, you can actually have it be null, not just empty, but null. And it's using a lot of database support, yes. Right, you can use, right, yeah. They accept a few, I ran into that problem. He's saying that when you start your PHP, you can actually do less than question mark, and you don't need to put less than question mark PHP. But I found some server incompatibilities between using that, like on Windows sometimes, it thinks it's ASP, and it sends it to the wrong, like when you use iSappy with, what's the lovely Microsoft web serving product? Blank now, blank. Yes, IIS, when you use it with IIS 5, sometimes it'll try to process it as ASP. And then it, like, Microsoft gets mad and they report you to the feds. We have this kid in. That last part, I'm totally lying about that. Quick technique, arrays. Arrays are the coolest part of PHP to me, because you can do a lot of stuff with it. You basically can read the contents of a database into an array, sort it, play with it, manipulate it, send it home to your mom, because it's been bad. You declare an array simply by saying, dollar sign foo equals array, parentheses, and you give it values. It defines the variable foo as a two-element array. When you refer to that variable, how cool, how quaint. You just do dollar sign foo, element one, element two, element three, yes. Excellent question. He asks if you run into buffer overflows when you, because PHP takes care of your typing and memory allocation.  So that would be an example of it.  It has a really neat sort function called NATsort in it, PHP that lets you sort your array naturally. So instead of one, two, three, four, instead of zero one, zero two, zero three, zero four, and also you could shuffle and randomize the elements of array.   So you can do that, yes. Yes, I'm missing quotes there, you're absolutely right. I'm very bad. I'm just pointing out here that I did it in my presentation. You're supposed to do quote, X1, quote, comma, quote, X2, quote. Oh God, I'm worthless. All right, how to handle flow in PHP. Your while loop, it's the greatest, it's the strongest, it's the coolest thing in the world. I'm gonna get up and flex over it. Oh, while loops are the greatest thing in the entire universe. They execute while a given, until or while a given condition exists. So like until I equals 10, keep executing. It's much quicker than a for next loop and more flexible. They have a new construct in PHP 4, which is basically like for next else, which uses while. They also have if, else if, and else, which is conditional. You guys probably know this from other programming language. If conditioned, then do this. Else if conditioned to, do this. Else do this. PHP has switch and case, which is really cool. So like a great example is it, so you could say on day, do these things. And if cases Monday, do this. If cases Tuesday, do this. It's kind of a modified if and else if and else. But it really looks very clean when you code it. You have break and exit. Break pops you out of a while loop or a for next loop. And it's useful for searching and sorting like if you're doing a bubble sort. And then also exit, which terminates the script. So this is how you can implement basic security in PHP. So basically you can check the session or the user credential at the top of the page and then exit out of the script so nothing else goes on. Yeah, I'll show you a while loop there. Oh, you don't need it done. It's implied, but you can use done. Quick techniques that it has. Oh, bye, I'm sorry. I'm really sorry. Go, go, get out of here. All right, MySQL, free database. Just like Microsoft and SQL, except it lacks transaction support, which is not a problem because you can actually emulate transactions using PHP. Postgres SQL, SQL more robust. It actually has transactions in it. It's usually free, but it's less supported. Like two reasons why you should use MySQL with PHP. Number one, almost every single company that provides PHP web hosting offers MySQL and not Postgres SQL. And number two, as a PHP 4, that MySQL commands are natively compiled into the programming language so that it's much faster, actually. It has an ODBC connector so you can connect to Bob's XYZ database as long as it uses ODBC. And PHP, as I mentioned before, supports over 15 plus databases natively through modules.  We're gonna talk about securing PHP and using encryption. We're gonna talk about data mining, which is basically grabbing assets off other people's websites from PHP for a PHP server. And we're gonna talk about web security. Before I do, I'm gonna show you guys a basic PHP script now at my website. Yes, this is running on Windows. So everyone can go, oh my God, why is he using Windows? That's so bad. Windows is so horrible. All right, all you social engineers, look at the name I named for my hard drive. What is the significance of that? Could it be a reference to Jack Kerak's On The Road? Who knows? It's crazy. Okay, I use PHP with Xtami on Windows. I don't actually use IIS. And it's a good thing because it runs much more quickly. Oh yeah, I like that. Okay, I crossed the country. I've been gone for a month. I decided to end my road trip in Las Vegas. This isn't just for show. This is something I've actually done. And I made this website so my parents knew I was alive along the way. So what I did, I was that sweet, come on.  Yeah, that would be okay if she weren't dead. No, I'm just kidding. I'm just kidding.  So I took a trip across the country in US-15. I kept a website along the way. And I wanted to very easily, I wanted to be able to update my website when I'm on the road. And I wanted to do two important things. First, my mom should hear all the stories about the happy people I met and all the national parks I went to. Second, my mom shouldn't hear all the other stories about the people I met along the way. You know what I'm saying? Those people you meet, you know their first name, and you're in a bar and they're like, let's dance. So you're like, okay, let's dance. I'm in the middle of nowhere.  So the key was to actually prevent those stories from getting to my mom. So what did I use? PHP. I used it mostly because it was cheap and free and easy. So this is my website. This is where I went across the country. Doesn't look too harmful or anything. Okay. First thing I did was, these are links up here, hidden links at the top left and top right. This is the link to the super secret stuff that I don't want my mom to hear. So of course I, uh-oh, whoa, there it goes. I'll tell you, Windows is a beautiful thing. So I protect this with the following code here. Let's switch. PHP is very, very efficient. I point this out to everyone. And I will be using UltraEdit, which in the spirit of my road trip, I got for free. Okay, here's the basics of it. I know it's gonna be hard to see from the back because it's really, really tiny and small. Basically, PHP can do HTTP authentication. So what you can actually do is use a database of user names and passwords.  You can actually do, darn, darn, I clicked the wrong file here. Let's do, let's see here, this one, okay. At the top of the page, so does everyone here, since Microsoft employs most of us, the reason is because they're right, you can't hate Microsoft that much, right? They make us all, okay, everyone hates Microsoft. Basically, you do the PHP HTTP authentication. You can use the database to do it at the top of the page. And I have it here, secretly also in my little gas section, actually. There's a difference between PHP on Windows and Unix, ladies and gentlemen. Right, when you run it on Windows, you have to actually, you don't have to declare the variable, but when you make a comparison on a variable to see if it has a contents or not, you have to use is set. But when you run it on Linux, you can just say if parentheses variable, then do these things. So I set up a little section here where I could upload my file from the web. So I wouldn't have to actually set my laptop up and go crazy with it. And I use PHP to actually do things like, stepping over here. I use PHP to set up which leg of my trip I was on. So if I was on the US 50 section, or if I was on the Route 66 section, it would show a different map to people. It would show a different set of my journals and it would show different information, hopefully not the secret stuff to my mom. So that's a typical use of PHP. Now we're gonna get into the atypical use of PHP. And let's start this up again. Do, do, do, do, do, do, do, do, do. Okay. Securing PHP and encryption. This is the general model of how you'll see PHP implemented. Time check. Anyone raise their hand and give me the time. 6.35, we'll be done in 15 minutes. All right, on the left side you have Apache. You run the PHP as a module. Please don't run PHP as CGI. Please don't, when you were talking about buffer overflows earlier and memory allocation problems, basically every single CGI spawns its own process off the Apache, off the Apache kernel. And it's just a mess for PHP.  So you'll have SSL and you'll have Perlin there too. And then you can see I have PHP and MySQL. When you install PHP on Linux, make sure you do the dash dash with Apache switch. That's how you compile it as a module in Apache. Installation on Windows. They have a nice new setup program for PHP that they just debuted with PHP 4.0.5. But normally you just unzip it to a directory. Like I said, two things. Don't run it as CGI. And don't run it on Windows 2000 as an ISAPI module. Securing installation. Verify that PHP is running under the nobody Linux user. PHP 3 didn't do that by default. You had to set it. Always clean HTML out of form input. Make sure, please, that you take the actual, you can do a strip HTML.  Never let a user directly execute a system command based on input. This is practical sense for most of us, but you can actually use exec to execute commands on a Unix box from PHP.  Right, bad idea.  Filter uploads. Filter uploads and partition your directories out. One very handy trick I found is that you should not put all your scripts in one single directory because once they know that that's the location of it, they can reference your scripts directly. And some Apache configurations actually output PHP as text if you reference the file directly. So then they can look at your passwords, et cetera. And always run the latest build. There's a vulnerability in 4.0.1. I have to point this out because it's really, that it basically forgets to encrypt your data and you can't use SOC, it's right. And there was a small mistake on there part. A few words about MySQL and PHP. Use PHP includes to partition your databases, username and passwords. What that means is include simply takes a file, sticks it into the middle of your executing application. So put your username and password in an include file and then step it up and take your PHP file that contains your username and password, put it above the www tree. So that it's just a precaution so that one time when you forget and you name your index.php page, index slash slash.php and decides to do a directory listing for you, that they can't find out that file that says name of my database, username and password. Set up your security properly to limit full access to certain user names in MySQL and set up separate read and write users. Yes, pardon me? Oh yes, you can actually, like I said, you can execute UNIX commands from PHP. So you mean, is it insecure in that you could set yourself as root and go ahead and execute a few things? Yes, you could. If you had control of your own server and it, but most of the commercial installations that you'll find out there in the web hosts like PHP web hosting, which is a plug for them because they're awesome, they're 10 bucks and they have unlimited databases and everything. They usually will lock it down so you can't execute system commands from PHP. You just want to change the user that you're running the command on it? Yes, you can do that from exec is the command and you could run set UID on it and back up your SQL data. All right, use encryption to hash as there are two types. Encrypt and encrypt and encrypt decrypt uses Cypher key data and mode to encrypt by directional. So you can actually encrypt and decrypt and then there's one way encryption in PHP, which is MD5.  Or did I just swear, right? It generates a message to I just 32 character representation of strings of any length. It's useful for storing passwords. It's useful for creating hashes. Always store passwords and credit cards with an MD5 hash of it. PHP has global variables, it reports every time. You run PHP info to dump all the global variables and port ones, HTTP refer their last location, their browser and user agent, remote address, their IP address, which is something I use when I set up that security on my website. I was telling a story earlier, one of my friends thought it'd be so cool to try to hack the HTTP authentication, because apparently that's all the time he has in his world is to go into my website and read about where I've been. And so what I did is I set up a little script there to every time he tried it, to email me the passwords he would try and his IP address, so I could watch him every time and then I'd call him on the phone right after he did because I had to email to my little, like my Panasonic phone, I go, stop trying to hack my website. Stop it. I'll tell you what's there. You know it's all stories about your mom. I can do that every single time. And then, H-U-B cookie verse, which is an associated array of all the cookies that are past. Okay, data mining. Just like our little, just like our little DigDug friend would. Okay, we're gonna basically use pattern matching, regular expressions to grab data from websites. Now this is a code example. You guys can write it down or afterwards.  I'll email you guys out my presentation or any of the code you want. I'm gonna step through it really quickly for you guys. This is it. This will let you grab links or email of people's page. The first step is set the URL. The second step is PHP can read HTTP and FTP by default. How cool is that? So the first thing you do is you grab a file which is the URL, the file command recognizes HTTP and then you implode it. As you see there, I implode it on nothingness so I grab everything out of it and then I use a pattern match here. You'll see here. H reference equals, which is a link for everyone who programs HTML. On the page, get the number of matches, then run a while. This is the while and list construct which I think is kinda cool. It'll separate everything out into a list and then it will grab all your matches for you and then it will print them out for you. See, those two lines are tied there. Set your desired URL. Quickly grab the contents of a page, match all AAH references for links, cycle through the matches and then print them formatted with the URL. Well, hopefully this is just the germ of an idea because what I'd like to see people do is to use regular expressions or P-regular expressions which are POSIX compatible to match email addresses. I'd like to see the URLs be written to a file which would be very handy to have. So you go about your work day and you come home and you find an entire website's links cataloged or any other asset for that matter. You can match images, you can match email addresses, you can match references to their mom, whatever you wanna do. Pass an array of URLs to open and pattern match while through them. So maybe you wanna match several, maybe you want it to go out and do a report on several of the top websites and you wanna go to hp.com and search everywhere on every one of their pages for email addresses. Write them to a little file for yourself and have them. You can do that with the magic of PHP. You can also follow URLs off of the HTTP so you can go three or four levels deep. My live search engine that I designed, these are pretty basic PHP concepts. Once you step beyond the regular database and variables and arrays and things, basically I do two arrays there. I wild through the arrays. I grab the contents of a URL. I'm essentially reading the entire chunk of a web page into a variable so I can play around with it.  That's right, sexy. I'll go through and loop through the whole page and look for the word sexy there and do a pattern match. So at the bottom, an array of URLs to check out, initialize the index variable, loop as long as there are URLs yet to read, which is in my URL array at the top. Read an entire page into a variable, dump the number of matches that contain the pattern, space or plus space. In this case, I look for the word or on the page and print the result as a formatted URL with number of matches and loop through it. Ideas I have for this, link to a database of submitted URLs and then read into an array. That's what Ocelavista does. This is pretty much what they do exactly. They let people submit their security and cracking URLs and then they live search, except lately they've been kind of modifying it so there's about like a day or two lag where they actually perform the searches using a cron job and then they keep the index there. It's useful for news and info searches. You like that? News and info searches. You wanna save your matches into a database and you can maybe create a simple index just like Ocelavista does. Just make sure to refresh it. Web security. Oh, this is one of those phrases when you mention it like everyone's ears perk up and they start to think about the dump. Okay, I gotta point out there's a guy up here. I don't know. He's not wearing a shirt. I can't look over on this side. I'm a little distracted. Like I know it's hot in here but we all have to cover up. But you know what? I'm just taking my shirt off too now. Yeah, come on. It depends how much applause and dollars I get shoved in my drawers. Okay, PHP with socket read rights can monitor websites and servers. There's a company out there called InternetSeer. Has anyone heard of this company? They do free monitoring of your website to make sure it's up and they charge you. They monitor it every hour but they charge you if you wanna do it every 15 minutes. That's kind of a cool idea but you can make your own in about five seconds. Yeah, three maybe even. And we're gonna look here and you can basically search your server for exploits. This is pretty exciting to me I think. GRC.com does it with, they're using com objects to go out and check your ports and it's really, really slow. It's not slow just because it's Microsoft, it's slow because it requires like tremendous server overload to do it. I'd like to really try and that's one of my goals maybe for the rest of the year to write an open source security scanner using PHP but I invite everyone here to do it because they're inspired. All right, Windows and web scanner. I do something very simple at the top. I set up an array of the ports I wanna check. Port 80, web, port 443, SSL, web and port 139 which happens to be the net BIOS port. Oh, what's that for? Okay, I equals zero, I set up my index variable and I wild through it and I use the shortcut as was pointed out earlier. Fsock open, Fsock open opens a socket. Now it's a shortcut because it actually takes care of the negotiation. Based on what you feed it, here I'm feeding it www.yahoo.com. Have I fed it ftp.yahoo.com? It would take care of the initialization, you know the little hello string, hey I'm so happy to see you and takes care of closing it for you. It's a good little shortcut. I feed it a port from my array and then I just simply output whether the ports open or the ports close. This is lightning fast when it does this.  You initialize the index variable, create an array of ports to scan, start a loop through the ports, open a socket to the ports with Fsock open, set up a report output. So if you wanna write to a file, if you wanna email it to your friends, like I did with mine, and oh, that's the other thing I did. After he started like hacking into it and he tried to guess my password, which by the way, it's not that sophisticated of a password. I'm not using like letters, numbers, and crazy symbols.  Right, I started to email him the reports that my website sent me of him hacking into it. That like stopped him real quickly. So I loop back through the end. Ideas, loop through low-range ports. So maybe you wanna go 1024 and below. Maybe you wanna look for sub seven. Maybe you wanna look for a Napster running. Idea, output results to an HTML formatted email. Send it to the webmaster. That's what internet seer does. In PHP, it handles MIME types and you can actually generate HTML emails with it. So it's really cool, you can send out reports to people. Output your results to a text file and loop through several URLs. So modify my code and instead of just looping through the ports, do a higher level while loop and loop through different URLs. Also scan a range of IP addresses for vulnerabilities. Wow, what does that mean? Well, you're in the Uberhackster track. Figure it out for yourselves. Okay, the last one is the TCPIP activator. That's right, one night only TCPIP activator. First you start with an FSOC open at the top and then you go ahead and say, oh, can you connect if not die? You can feed any strings via PHP to the desired server. You could emulate a browser of your choosing. You could emulate an entire web page that's being sent to a page. Plus you can use it to read, like I said, and communicate in raw sockets using the sockets implementation in PHP. So I simply here send a variety of useless information out of a file and I grab useless information off their server. Open a socket to a host with timeout. If no access to the port and the execution. So that way you pretty much die if you can't open a web connection. Form a standard HTTP start request and loop through the file that you want into the end. Grab some of their lines, display them and you can write to it with F put and F get. I use F get and F put here. You'll see I put the header there and I get the information off their web page but you can also put information to someone's. You could send it to directly to their IP address if you want. You could spoof your browser version by writing the correct Mozilla version in the header. Everyone here knows that internet explorer calls itself Netscape when it actually goes to a web server. Either that's really cool. It's another innovation from Microsoft. Write that one down. Another idea is through the timeout feature create a mini TCP or IP server. Since you can control the execution of your PHP scripts set up your own little PHP web server. There you go, it'd be fairly undetectable. It wouldn't show up as Apache if someone were to query it. You can make it show up as anything you wanted. Test the number of simultaneous HTTP or FTB connections your host can handle. Very cool. Or you can just try to flood it and see if it shuts down. And lastly, send malformed headers to the page. This is the conclusion. Thus ends our fun, our trip here. I talked about data mining and web security today. How to secure PHP. Tune up your PHP installation and use encryption. Please, please, PHP is new. It's happy. People are loving it. People are starting to get that PHP vibe. You hear people whispering on the street. Hey, you hear about PHP? So let's not create a bunch of really insecure, crappy scripts that have a lot of holes in them so that you can go get your latest server for $1 because you changed the form header and variable from page to page. Please use security. Please filter out HTML. Please don't set the user ID to root and then delete an entire directory just because you want to. Data mining. How to use PHP's regular expressions and the fact that it native writes HTTP and FTP to collect URLs, email addresses, and anything else you want. Make it pictures of the star of your choice. All throughout the web. Web security. Create a simple port scanner and that scans for Windows or web supports. I did an example of both. And then also TCP client server. What's next? I'd like to see a full featured TCP IP server handling multiple sockets and streams. It can be done. PHP's really fast. Run it on your box at home. PHP version of grc.com shields up. You guys know who Steve Gibson is, right? He's in this latest flap with Microsoft over, right? The raw sockets implementation in Windows XP. He's like this kind of, my personal opinion of him is he's kind of this glory hound. He's kind of like, you know, just happy that someone's listening to him. He probably is holed up in some room somewhere. You know, his mom didn't love him when he was a kid and he's happy because everyone raises their hand and goes, I've been to shields up. It's so cool. Okay, I hate him. I hate him. So if he's in this room, I want to spot him right now. Okay, you can improve the speed of searches and execution in my script.  I don't, you know, check to see if there are other processes running. I don't lock down the database or do any of those things in it. This is very simple. PHP front ends to TCP IP clients like Windows Messenger and Amster. Windows Messenger is the MSN Messenger that comes with Windows XP. It's like the integrated net meeting meets. Hello, sir. Okay, take your seat. It's the integrated client for it. There's a product called PHP Groupware, which is an open source Groupware product that's intended to compete with Exchange. It's kind of in its infancy, but it's a really cool project. It's at phpgroupware.org and they basically did a Napster emulation in PHP using the raw sockets in PHP. Very, very cool. And you can get it there. It's at SourceForge too, because it's so cool. Resources for further exploration. PHP.net, it's the main website for PHP. The commercial company is Zen Technologies. Zen started by the two guys who recoded it. They used the Zen engine for free in PHP 4. And PHP homepage has a full language reference and it has kind of an integrated user community. So you can get a lot of your questions answered. PHP wizard.net. They have an application there called PHP MyAdmin, which lets you basically admin your MySQL databases from a web-based interface. So don't code that on your own because it's already been done and it's awesome. And they also have code examples there, including a PHP chat client. PHPbuilder.com, which was just purchased by internet.com.  But it was a really great reference source. They would have weekly articles on kind of pushing the boundaries of PHP. So PHPbuilder.com is a really good site. And devshed.com. They have a lot of great articles from beginner to advanced. They have a complete walkthrough how to set up your own PHP, Apache, MySQL, and SSL implementation. They have a lot of different information on using Postgres SQL as well as MySQL. All right, I wanna take a time at the end for questions. First, were there any questions about my presentation? Okay, yes, one. Yes, yeah. That's a good point. That's a good point. If we're doing a commercial website, you might wanna have a company that handles your credit card processing for you so you don't have that liability on your website. And if anyone has $100,000, I have a couple really good concepts for companies. So I'm gonna wrap up. Thank you guys very much for sitting here. You can eat now. Anyone who has any questions about PHP, please come up here. My name's Adam. Thank you very much. Ah! Thank.