Hello, everyone. I'm Sam Lemley, curator of special collections at Carnegie Mellon University Libraries. Welcome to the second episode of Coffee with the Curator, a video series in which I share some of the many fascinating artifacts and books that are held in Carnegie Mellon's special collections. In this episode, we'll be looking at an early cryptographic technology or instrument called cipher disc. These are relatively common in printed books of the 16th and 17th centuries, but they're not very widely known about. Ticking together right in their thousands, though, I think they illustrate a really rich and fascinating history of cryptography, particularly as it was practiced in the Renaissance. To narrow our focus, I will be looking at a set of cipher discs that appears in one of my favorite books at CMU, and that's this book here. It's titled De Fertivis Literarum, which basically translates as On Secret Writing. It was written by Giambattista della Porta, who was an occult scientist in the Renaissance in Italian. It was originally published in 1563, but as you can see, this is a copy of the second edition published in London in 1591. So I'll return to that book in a moment, but I want to point out first that there's actually an interactive component to this video that requires downloading a PDF, and I'll link that here. So this PDF is a reproduction of one of the cipher discs that appears in della Porta's book. And to work with it, you'll need to print it out, of course. You'll need scissors, a needle and thread, or a brass fastener, and some patience to put it together. So we'll return to that in a moment. So the topic of ciphers in cryptography is especially important at CMU, which, you know, because special collections hold a growing number of books and artifacts from the history of cryptology, which is basically the science and study of ciphers, cipher systems, and cryptographic machines. So by way of one well-known example, we have two enigma machines, one three-rotor model and another four-rotor model, both of which were donated by Pamela McCordick in memory of her husband Joseph Traub in 2018. The story of how the enigma machine was deciphered, first by Marian Rajewski of Polish Intelligence in the 1930s, and then later by a British team of crypt analysts that included Alan Turing at Bletchley Park, is sort of well-known, right? We've all read books or seen films about that story. But the enigma machine sits at a long and fascinating history that's sort of riddled with inventions, prototypes, and devices that were designed to shroud or disguise sensitive information. We tend to think of encryption as a fairly modern strategy, but there is a history behind it. And, you know, things like block ciphers and pseudo-random number generators, which are very much sort of of the moment, actually sort of owe a lot to some of the early technologies like we'll be seeing today. So in this episode we'll be revisiting one of these early ancestors of enigma, and it's actually not a machine at all, but this book, right? And I hope to convince you by the end of this episode that a book can function like a machine, right? It can be a kind of instrument. So we'll start just by looking at the book itself. You can see that CMU's copy of Della Porta's book on secret writing is bound in vellum, which is a kind of treated calf or cowskin that can be distinguished by the texture and color. And if you look closely, you can actually see where the hair follicles, the animal's fur was right before it was scraped away when the vellum was prepared. The book is a quarto in size, which means that the individual sheets of paper that make it up were folded twice before being bound together, making four leaves, which is where the term quarto comes from. And this is actually a fairly recent acquisition to CMU. It was purchased last year in the antiquarian book trade, and it joins our other books on the history of cryptography, which are many. So John Batista Della Porta, who wrote this book, sort of worked at a sort of transitional moment in the history of science. And what I mean by that is that while what Porta understood by the term science in his 16th and 17th century context, at least it resembled our own kind of modern ideas about what qualifies as scientific investigation, the strategies and precepts of experimental science were still in the process of being invented in the 16th and 17th century when Porta was working and writing. And this is one reason why I find Porta so fascinating. He sort of sits between worlds and works and writes at the cusp of what is typically seen as the beginning of modern scientific inquiry. He was born in 1535 and died in 1615. So he's almost exactly a generation older than Galileo and Kepler, for instance. And I think this is quite sad in some ways. Porta knew by the end of his life that the winds were changing. He knew Galileo personally and recognized him for the sort of brilliant upstart that he was. And you can't help assuming when you read about Porta that he knew which way things were headed. His brand of science was sort of on the way out. Porta practiced a kind of scientific investigation that was known at the time as natural magic. And he wasn't just a kind of dabbler in the field and there were many dabblers in this field. He was almost its high priest. His first and most successful book was kind of the sort of reference work, the Encyclopedia on Natural Magic. In fact, it was titled Natural Magic and it was published in 1558 and again kind of in a vastly expanded form in 1589. And as I said, it was almost certainly Porta's most popular book. It was sold incredibly well. The idea, the guiding idea behind Porta's sort of natural magic was that scientific learning in its most advanced state amounted to a form of magic that required a kind of occult knowledge and spiritual insight that only someone like Porta could offer. It had studied for decades. That's what it required. Of course, Galileo and Galileo's successors rightly scoffed at this kind of mystical science. But it's also what makes Porta so fascinating. In many ways, Porta represents the last generation of scientists that could claim an almost universal knowledge of the natural world, even if that universal knowledge was somewhat flawed or incomplete. But nevertheless, Porta believed that intense and prolonged scientific investigation could reveal or disclose a kind of theory of everything, unifying all the various branches of learning into a single crystallized truth. And in search of this singular truth, Porta wrote broadly across disciplines, including works on optics, psychology, horticulture, chemistry, and of course cryptography. For Porta, scientific knowledge was as much a source of wonder as it was of certainty, which I think is a sentiment that was very much of his moment. So Porta even established an institute that was dedicated to drawing out the mysteries of nature and science. And he actually called this group that met at his home in Naples the Academia dei Segretti, the Academy of Secrets, which is widely considered to be the earliest scientific institute in the Western world. So like I said, this academy would meet at Porta's house in Naples through the 1570s, but it was actually eventually closed by the Inquisition. So in retrospect, of course, we know that science took a different path away from Porta's ideas of universal secrets and natural magic and toward Galileo's mathematical certainty, mathematical science. And after Galileo, science became increasingly specialized and compartmentalized, which was kind of the opposite of the science that Porta wanted to build and sought during his life. But the posthumous decline of Porta's reputation shouldn't suggest that he was peripheral or somehow insignificant in early modern scientific circles, far from it. In fact, his reputation was almost at its height in the early 17th century. So after Porta's academy was forcibly closed by the Catholic Church, a second academy founded by the Roman nobleman Federico Cezi took its name from one of Porta's books. And this is a fairly well-known academy. But Cezi's academy was called the Academia dei Lincei, or the Academy of the Link's Eye, which was named for the mythological figure of Linceius, who was sort of known for his exceptional eyesight and exceptionally acute vision. So the Academy of the Link's Eye took its emblem, actually from an image of a link that was found on the title page of the first edition of Porta's Natural Magic. And this was in part because the links, like Linceius, the mythological figure, was believed to be a particularly observant animal. And of course, careful observation was the sort of foundation of the scientific method. So I think that's kind of interesting to realize that people like Galileo and Cezi were consciously borrowing from Porta's sort of older vision of science and crafting this new sort of observational method that we've sort of inherited in modern science today. So returning to the book, though, when we page through it, you can see that it's laid out in a fairly conventional way for books of the period. So after the title page, you get this sort of prefatory letter, which dedicates the work to Henry Percy, who was an English nobleman, and it's signed by the works editor, who was Giacomo Castelvertro here in Latin. And he was editing this printing of Porta's book. There were other printings, as I mentioned, but he likely edited this and had it printed without Porta's permission, right, about which I might have more to say later. But I want to pause on this letter because it reveals the kind of person that would have bought and read this book in particular. And you know, this is the kind of thing that we can learn from the material that's printed before and around the text of an early printed book, right, namely who was buying it and what did the author or the editor, the printer, what did they hope to accomplish by distributing it to readers. So the editor of this book, or at least this edition, Giacomo Castelvertro, was an Italian convert to Protestantism who had fled to England to escape anti-Protestant persecution in Italy. And after he arrived, he quickly sort of gained favor at the English court and was eventually appointed as the Italian tutor for James VI of Scotland. In fact, just a year after this book was published. And this was fairly good timing. It was a significant position to gain because, of course, James VI of Scotland would become James the First of England after Queen Elizabeth's death and the end of the Tudor monarchy in 1603. So he was a fairly well connected guy. Interestingly, in his letter to Henry Percy at the beginning of the book, Castelvertro explains that he funded and sponsored the printing of Porta's book on cryptography because copies of the first edition, which was printed in 1563, had become so scarce. So plainly, there was a demand for the cryptographic techniques that Porta's work describes. There was kind of a simmering curiosity about methods of secret communication. And Porta's book was unusual in its kind of detailed treatment of the subject. If you wanted to learn about how to communicate secretly to use ciphers, to use cryptography, this was the book to buy. So the first point that we learn from the letter prefacing Porta's book is that Castelvertro's motive for getting this published is partly commercial. He recognized a demand for a increasingly difficult to find book. And he sought to meet this demand by funding a new edition. So the second interesting thing about this letter is its intended recipient, right, Henry Percy, who was the ninth Earl of Northumberland. He was sort of a wealthy and influential figure in Elizabethan England, and also a kind of strange character who much like Porta kind of towed the line that separated magic and science in the period. He was even known as the wizard Earl for his well-known experiments with magnetism, electricity, and alchemy. So, you know, I think Henry Percy's association with Porta's book not only underscores Porta's reputation for arcane and occult learning in the period, it also tells us that Henry Percy and his associates, right, his circle, were the were the intended audience of this new edition. You know, that was ushered through the press by Castelvertro. And certainly Castelvertro addressed to Henry Percy in the hopes of sort of garnering his favor and sort of joining the circle. So thereafter, right after the introductory letter, we have an introduction to the reader's electorates. But after that, you know, you get an index, which is helpful. Just page through this. It's alphabetized, which is nice. But then the book begins. And it sort of treats its subject in sort of useful categories and runs through the definitions meant to kind of demystify what Porta calls the art of secret letters or the art of secret writing. So you can see that chapter one here of book one is titled, you know, What Are Secret Letters? What Is Secret Writing? I'm going to see skip ahead a bit to get to the interesting bits of this book, which will be spending the rest of this sort of episode exploring, which I'll try to explain. So most of these appear in the middle of the book. I have them marked. So there are three of them. Here's one. Right. There's another. There's the third. So we're actually going to spend our time looking at the this one here, the third one. So you can see that it's made up of kind of two concentric dials or these circles, right, which are made up of cells. The inner circle has a modified Latin alphabet. That's obviously scrambled. It's in no apparent order. And then the outermost circle has cells containing Roman numerals from one to 20. So, you know, the observant among you will notice that there's this sort of void at the middle at the center of the dial, a kind of blank circle. And it seems like something is missing, right? So what is this thing? How is it used? What was it meant to impart to the reader? So it turns out that Porta's book is not only a book about cryptography. It's also a cryptographic instrument. And this is what's known as a cipher disk, right, which is a kind of paper in ciphering tool that revolves to encode a message. And one thing I'll just talk about, you know, what's going on in the page here briefly. One thing I love about this particular cipher disk is the figures that surround it, right? You can see that there's these sort of two sort of animal female figures with, you know, lion legs, lion heads at least, you know, and these, of course, these strange hybrids or sphinxes, which I think, you know, they're so appropriate in a book on cryptography, given that the sphinx was the riddler of classical mythology. And so I think it's kind of fitting that they're guarding Porta's cipher disk, cipher instrument on its side, you know, they're kind of guarding its secrets. So to return to the question of how this thing works, right? So it turns out that there's some assembly required paper instruments like this that appear in books are known as volvels, which is a term that comes from the Latin verb volvere or rolere to turn. And I hope for an obvious reason, right? They actually revolve, you spin them. So some volvels are incredibly complex.  And I think it's no stretch to describe these as one of the first mechanical calculators, right? They commonly appear in works on astronomy and the Renaissance and can be used to predict or calculate the position of a planet, for example, at a given point in the year, you know, and other things like that, that sort of are a seed to calculation, right? So what Porta has done is adopted that technology to make an encrypting device for his readers to use. Of course, we've already noticed that this cipher disk, this volvel is incomplete, right? And if you turn to the end of the book, you'll see, you'll see why, right? So the centerpieces were actually printed on a separate page at the back. And I call these indexes or indices because they indicate the position or the setting of the cipher disk. So yeah, they were printed separately. And they were actually intended to be removed to be cut out very carefully by the book's buyer, by the book's reader and actually mounted at the appropriate points in the book, right?  And I love that these have been labeled, right? One, two, and three, I think by the printer. And that those numbers tell you which volvel, which cipher disk they belong to. So keep that in mind. We'll have our own example of a functioning cipher disk to work with later. But I'll turn back to the one we were looking at earlier that's missing that centerpiece. Now, of course, in some ways, it's kind of disappointing that CMU's copy wasn't assembled in 1591 when it was printed and purchased. Because that tells us that this book, you know, wasn't exactly used as intended, right? It's early reader or early readers never engage in the kind of ciphering that Porta's book invites and demands, right? And we'll have to sit with that disappointment because we can't unfortunately cut up this copy and put it together ourselves. What we can do, though, is make copies and assemble our own facsimiles of Porta's cipher disk to learn how it worked. So to do that, as I mentioned at the beginning of this video, I've scanned this page that I just showed you and created a printable kit that you can download here and I'll link that again. So once that's assembled, this is sort of what you have. This is what it looks like. So you can see that the centerpiece rotates. I've used a brass pin here and the kit that is in the PDF also includes a blank index of these symbols, these strange sigla that are around the circumference of the index, the centerpiece. Those cells are blank, so you can actually make up your own alphabet of hieroglyphics or symbols to work with. But we'll use Porta's cipher disk, his alphabet of hieroglyphs, to demonstrate how it works. So to begin, you cut out the index, you tack it to the center of the cipher disk, and then once that's done, the center disk should rotate freely. So make sure that's loose, sometimes they get kind of sticky. So let's give it a try. So looking at the book itself, Delaporta actually gives a number of examples. So there's his hieroglyphic alphabet and you're meant to use the cipher disk to decipher what's written sort of in this ornamental frame. So this one is quite long. It's also in Latin. I think few of us read Latin, so we're going to make up our own shorter secret message. So the way this works is that for every letter in the message, either the original plain text that you want to encode or the encoded message you want to decipher, decode, you advance the wheel one step clockwise for clockwise for each character or letter, starting at position number one, which is there. So starting with the index at one, notice how there's a little hand at the center that shows you where it's pointing, which is quite helpful. So we'll decode the first symbol and I'm going to put up an enciphered message here. So let's begin. So we're at one. That's where we start. The first symbol is this sort of open circle, which leads to a number of possibilities, right? We have F, H, and I. So let's just let's just jot all of those down for the time being. This will kind of have to work through the variant readings of the cipher text. So what did I say? So we have F, H, and I. So it's going to be one of those. And notice that in repeating that hieroglyphic, that's sort of adding security to Delaporta's cipher system. When you repeat symbols like that, generally the cipher system is more secure if you're encoding your plain text under sort of repetitive symbolic alphabet. Okay, so that's the first. It's going to be one of those. That's the first character. And we advance the wheel one step. And the next symbol is again, an open circle. Okay, so it's either it's the S, R, or E. Okay, it's going to be one of those. All right, so we'll rotate it again until we're in position three, right? Let me make sure I'm lined up here. Yeah, so we're in position three. The next symbol is, oh gosh, an open circle. Okay, so we're sticking with that repeated figure. So it's either G, position four, I'll put that down here. L, V, right? And notice that in Delaporta's modified Latin alphabet, at least on this disc, there is no U. And, you know, this is probably too much information, but the V also functions as a U in the Latin alphabet because there was no U originally in the Latin alphabet. So if you want to encrypt a U, you would use the V in its place. Okay, so that's the third letter advancing once more to the fourth position, which is the fourth letter. Okay, let's go ahead and find it. It's this little shape there. And luckily here, there are only one of those. So that can only be L. All right. Last letter, advance once more to position five. It's a five-letter word. We're looking for an open circle in a square. So there it is. Oh, right? Okay, so now we have to sort of figure out which reading of these three letter blocks makes the most sense. So I see something here, right? So the encrypted message is just greeting us. It says hello, right? So the cool thing about ciphers or Porta's cipher and cipher disc is that they work in either direction, right? So say, for example, you wanted to encrypt the plain text, which is hello, hello. You again start one, and you do the same thing just in reverse, right? So with the wheel of one, you look for H. There's that open circle. So you would encode that as an open circle. You advance it one step. You look for E. There it is. Sure enough, another open circle. Advance again. You're going to look for L. Another open circle. Advance again. You look for O, right? Or another L, sorry. You have that strange symbol there, which I'll attempt to draw. Okay, and then finally, one more position. You're looking for the letter O, and you get a box enclosing a circle, right? So that's our original string of sort of hieroglyphic letters. So that's kind of how it works. It's nice in a way that the same instrument is used to encrypt and decrypt, right? Now one disadvantage of this system is that after you encode a message, you or someone else who receives that message has to reverse the process using the exact same cipher wheel, like the only way to read in ciphered messages using the cipher system quickly is to actually have a cipher disk on hand. So that's kind of an inherent flaw in the system, right? If the cipher disk fell into your enemy's hands, right, she could potentially decipher it just as easily as the recipient. So that's Porto's cipher disk, and I invite you to visit the online exhibition that accompanies this video. I'll link that here. There you'll find more information and instructional exercises on how to use Porto's cipher disk, and of course, you can print out your own facsimile and use it however you'd like. Thanks, and I look forward to the next episode.


Carbon national security threats such as illegal, unreported, unregulated fishing in the maritime domain will improve food security, Chief of Navastar Vice-Admiral Immanuel Ogala said on Thursday in Lagos. Ogala made the declaration at the handover of six glass reinforced plastic riverine boats manufactured for the Federal Ministry of Agriculture and Rural Development by the Naval Dockyard Ltd. Ogala said the boats would be used to access riverine communities to monitor and support agricultural activities and ensure food security. In aid to civil authority is protecting the nation's waters from all these illegal activities. Prominent of them is illegal, unreported, unregulated fishing which has been impacting negatively on the nation's food security. What we are doing here today is one of those efforts, particularly in the area of collaboration with ministries, departments and agencies. We have been doing this over the years, we have been collaborating with the Ministry of Agriculture, we have been collaborating with the State Ministry of Agriculture and fighting against these illicit activities. Now in the dockyard here, we also, I mean as part of this collaboration, construct goods and build vessels that we can use to further this collaboration. What we are doing here today is a significant achievement sponsored by the Ministry of Agriculture which is for the dockyard to construct goods which are now handed over to these coastal states, particularly Lagos and Akwaibong state that are here and that are also greatly impacted by this activity. Just like the Chief of Naval Self-Asset, the Federal Ministry of Agriculture and Rural Environment is very, very aware of all this that is happening and we are ready to collaborate with other states and stakeholders to ensure that these irregular activities that is happening on our waterways are reduced to the very, very minimum and to ensure that we work in collaboration with every other state order to regulate our poster and waterways. The Naval Dockyard Limited has a lot to offer the mission in terms of local content, where we have issues with building badges, with boats, we build offshore structures and also partner with other maritime players, also partner with the dockyard and do some construction and fabrication activities here. So a lot can be done, this is a strategic national asset that has been in the custody of the Niger Navy and this is an asset that the FRAC government must continue to ensure that it is viable and continue to support not just Niger Navy but we support the maritime industry, we support the oil and gas industry, we support the state government, so it's a very


The spirit of the Lord, the spirit of the Lord If you rise to heaven, if you rise to heaven's place


Okay. Our next talk is on Java. Actually on a specific form of attack on Java. Script. For the evil side of Java. For the script kiddies. This is Injun. He is originally from Siegen, which is part of Chaos West. I think he now lives in Bremen, if I'm correct. Please, let's have a big hand for Injun. Come on. All right. It must be filled up to the last place, because I can't see a thing. Just to make it easier for some of us. Is there anybody who is not a native German speaker here, then shout, no! Then I switch to German, because it's a little bit easier for me and probably easier for you. You're okay with that? Okay. No, let's switch to the language. Okay. The presentation today is, so to speak, a thing I did in a very short time. I wanted to give an introduction to cross-site scripting. And because I wanted to make it more funny, of course, I changed everything. I completely changed my normal file format and tried to make it as a demo. And what do you have to do? You have to bring the whole thing to the browser in this Java scripting thing. That means that what you can see in the background is actually my Firefox. And you can attack exactly the way I'm going to demonstrate right now. While I developed the demo, I actually used cross-site scripted myself once or twice. So the thing seems to be really dangerous. The meaning of the presentation is actually to give you a very basic introduction. And if someone has never seen it, then maybe it has this build effect. That would be totally cool. If not, then not. And in the end I'll give you two or three more photos. If you really want to build a web application, so a website or something like that, with a database on the back or something like that, then there are one or two words that you should have in the background while you're programming. At the university I actually had a photo. They had these two words as often on this photo as it was. So that you can somehow notice it. The people are not present today who could have read it. But I think they still have the two words in their heads. Good. We don't have time for questions or questions. We'll do that in the lounge. I'll just stand there a little bit. You can just come by. Otherwise, if you don't understand anything at all, just go in. That's the professional stage where I was the sound engineer. The sound engineer was the sound engineer. Good. Why do I do that? That's what I just explained in principle. I had to keep an eye on it. It should be an introduction somehow. And then I just engineered my slides over. And I really wanted to do something with 3D. And I thought, I know. For cross-site scripting I need the third dimension so really deep.  I keep talking. Otherwise, cross-site scripting is incredibly easy to avoid. A weak spot, like all the others. And still in the 2017 list of the Open Web Application Security. Now I forgot how to say it. Projects, exactly. On place 3. Still relatively often. And the string that we have right away. You can just throw it into every search field. Maybe something comes out. You can just play around. That works then. Good. Can we start? Yes. Good. Thank you for this incredible feedback. Good. The first thing I have to explain briefly so that we are all on the same page. What is this weird WWW? I will use the term server right away. So we have to find out briefly what a server is. I wrote that down there. The web server is what provides us with the website. You have to imagine that a little bit like in a restaurant. I'm sitting here in my restaurant. I want to have something. It comes from the kitchen. That means my server is like the kitchen. Then I order it via a protocol. That is usually in the WWW. So the defined protocol is called HTTP. That is in this case the cell phone. I give my order to it. That is called a request. It goes to the kitchen. It says the kitchen. The kitchen. So my web server mixes it up. And then it lets you transport it from the cell phone. If we have something like TLS, which is very secure and switched on, then there is a certain chance that the device will not change without the cell phone being connected. If not, then everything can happen in between. But that is not the topic. My food usually comes in the web in this form. It is called Hypertext Markup Language. That is the document format. Everything is written in it. That is something like the plate or the table here. And that is delivered to me. And I have to process it by eating. That means I take it in me. So I am in this picture of the browser. And I then swallow everything that comes there. And Javascript is on top of this HTML mountain. That is something that dictates my behavior as a browser. So I can then, in principle, the server, if he puts a Javascript on his website, brings something else to do.  You notice that under circumstances maybe something critical is already being connected to Javascript. Because of course that sets out that the whole delivery chain from kitchen to here believes that the medanix will build in what breaks my browser. Or that brings strange things to be fabricated. Well, now there are a few insurances in the whole browser that only allow certain things. But there were also weak points. You can try to be careful in general. It would be unpleasant if I didn't deliver the stuff that comes from the kitchen, but that comes from someone else. He put something in there or something like that. And I definitely don't want that. And the kitchen and the whole delivery chain could actually do something against it. And today it's a bit about how an attacker can put something in the kitchen in the pot and then deliver it to me. Or rather the real example that I bring today is that it breaks something in the pot. So, I'm the little one, the web browser and the kitchen in the back. The cook is the server. That's how we put the basic items. And then we can take a closer look at what I actually want to tell you today. Cross-site scripting attack. You can simply take that word literally. Cross-site means it goes beyond the band. In principle, attack communication with the victim communication is crossing itself. The principle, there are several types of attackers. There were types like cross-site scripting attack. Reflective, stored, what we have as a demo today. CSRF, so cross-site request forgery would also be a special version. It works, but in large and all always in the same way. That the attacker sends something to the server or sends it to someone. The server then processes it in the kitchen in a way that doesn't prevent any strange things in my food. And then it delivers it to me. Because I want to see the website at the end of the day. So far, of course. Wonderful, I can now click and click. That's great. Well, how does something like that actually work? And we'll go through this web call and do a cross-site scripting attack. Because the reason why I did that in this Impressed.js is that it is practically already stored with JavaScript. And then you can do cross-site scripting yourself. And that looks better. And you can tell me if it actually was not that bad at all. Good. So we have a common thing. This is a sign-in-web-formula. Usually it can be something like a posting in a forum or something like that. The only requirement I have is to send something to the server. I have tried to do it easily. And probably you could not read the script there. But in principle, there is not my username but there is this HTML control sign for I bet there is a program now. Then there is a very harmless program that should just pop up a message and then it will be closed. That means I just enter a sign that came to my mind that could have an interesting result. That's definitely not my username. You can already see what you can do against it. You can check if someone really is scripting and alerting. That's just a relatively unusual name. Maybe nobody wants to say that. Well, I gave it to you. The password is in this demo, it doesn't matter. That's why I just throw it in. That's a very common formula. You saw that in HTML. You got it delivered like that. That's something like, I don't know, something like that. I now have a variable name password in the input field with a value, which is down here. And up here in the username I have basically this strange thing there as data. And these data are now moving from the attacker browser. That could also be yourself. They will send it to such a HTTP request. So my order, or the order now in this case from the attacker. And there they just land as variables somehow in there and are sent directly to the server. So magic is never really there. That means that this is the specific message that the server is easily delivered by my attacker. What does the server do with it? The server processes the stuff in such a program here. That's actually a bit of Java or something like that. It's a bit of an example of what you can do with it. So a relatively common framework with which you process data. How that actually happens is actually pretty much the same. It's important to note that there are some parameters that you normally save briefly in the main storage. So you notice how the hot packs go into some variables. And then comes the important step. You want to save it somewhere. That's what I do here with my self-sufficient function sign-in user. There's exactly the same username that my attacker just entered. My absolutely creative password. And then it's just passed directly into the database. Let's see if that works too. Ah, that doesn't work so directly. I wouldn't even show it. But the password is shown. You can see that this script isn't shown. Because it's a script. At this point, it's not directly displayed. That's the place where I myself have cross-site scripted. I'm going to open the cross-site scripting right away. That's what the thing is now saved. In principle, as an attacker, I've put something in the kitchen storage. Just a small, poisoned can or something like that. That's pretty dangerous. Now comes the moment where I want to have something. The kitchen goes back to its storage and gets the ingredients out. And I get a website that can show me as a user. With such a username, for example, it could be something like the administrator who urgently wants to have the list of all the users. That would be nice if he could show himself as a user. And I could manipulate his browser in some way. That means it looks the same as before. He builds it in a website. Here you can see this markup of a website. He's making a list with this output, a list of users. And of course, if he asks that out of the database, with the username in this case, it's completely free. He adds the string to the place that I assigned as a user name as an attacker. And of course, also a password. That means he builds a website together and packs a cramp. Now you could have a certain idea of what you could do right at this point. But I don't want to do it myself. Well, that means he makes a list and that's how this website looks like. He builds my server, or you could look like this, he builds my server, there are all the users inside. And one of these users has a strange name. In this case, the hypothetical administrator who wants to look at the user list right now. And he gets something like that shown. It worked wonderfully. I was a bit scared. What's happening now? In principle, you can see nothing is shown here. And I was a bit scared, it was very explicit. But my browser just took what was here as a script. Because he sees this whole markup and the one markup said here's a program for it, please immediately. And luckily there was nothing in the script like explosions, starting the Third World War or something like that. But there was a message on the cross-site script that says this is harmless, but I didn't want to destroy my computer myself. I do that often enough. In this case, we can just click away. Everything is fine. But in principle we now have a script in the browser. That might be dangerous for the first time. We'll come back to that. Don't look at it yourself. Well, what did we do? We had an attacker who had a strange user name or whatever it was for an input or how you really enter something he might go directly to the database who was in the situation unfiltered to throw data into the database from the server. The server just unfiltered and unfiltered this thing out of the box and then gave it to the victim again myself in this case. And the victim then started to behave strangely, to pop news or to call websites or whatever. In the end you can actually do everything that the user could finally build in javascript, send data, send data and so on. But if there is a certain sandboxing procedure like your own browser tries to protect you in big and big, that's not good for now. The question is, what can we do against it? And the incredibly depressing answer is, actually, that's not at all difficult. The problem we had at that point is actually that we didn't adapt or that there are some unknown content that we just threw into such a HTML context. It was in front of the database context and before that it was somewhere in the attacker context and we just took it and just unfiltered it into it without thinking about it. Certain things that could be stored in my database have a special interpretation in HTML. Namely, especially these tiny things. And that tells me that it's incredibly easy. If I have something in my database like a tiny clamor, then I actually want it to be a tiny clamor in my browser and it doesn't start interpreting it as a special sign. In the end, I simply have to convert all special signs that are there, so special signs in the target context, in the case of HTML, into something that corresponds to a normal sign. There is actually just a database that you just have to use. Maybe you noticed that at this point I didn't just take out the username I just said, code that again for HTML and then we're done. And that makes such weak points so incredibly depressing because that should actually belong to programming such as, I don't know, drinking, living or something like that breathing and similar things. Good. If you want to have help, I'll give you a quick review. There is an open source project, an open web application security project and they provide you such a code for everything you want to have, for example. They also provide you with these top 10 and then you can read again what you could do again, something like input validation.  Who is already called script? Are you still with me? Have you ever slept in? Yes, they don't call again. Good. So, so to speak, the pre-setting. The stuff is not directly dangerous, but what can go wrong? We have a lot of data. We have a context in which we don't know what happens. It's easy to avoid. In the end there are a lot of mistakes that have any side effects. For example, no one would come up with any important industrial systems with such a strange web interface like cross-site scripting. Since the first windpark operator does it, there were some people in 2017 who analyzed these web interfaces and also found cross-site scripting approaches and then actually controlled wind power. It was a bit large-scale, because of course we write software once and roll it out everywhere, then you have the weak spot everywhere and then you can switch out or wait for this energy lecture yesterday. I also come from energy informatics, then you know that this is not good. So, there are a lot of things that the attacker can do and it's much nicer and much easier. It's just incredibly easy to lift up, so it would be nice if at least the top 10 of the O goes through, then you know what you shouldn't do. Now I'm too far. Okay, so output encoding and if not this last picture completely convinced you that you need 3D, where you can recycle your graphics, then don't try any strange 3D-photos, because it does a hell of a job. But it's nice. Thank you very much.


Steve Ballmer I know he's worth about 90 billion or whatever and he wasn't he didn't start Microsoft he came later not everybody's an entrepreneur who needs to start something from scratch most people are entrepreneurs and you can be inside someone else's entrepreneurial venture and that's just how the math is going to be so but I totally agree too many people think they can be the leader and the visionary the world needs also people that work inside of innovative industries


10 Reasons to Live in Panama If you are thinking about relocating to Latin America to teach EFL, there are clearly many countries to choose from. Here you will find 10 reasons why you should consider Panama as a serious contender. One important factor for many people is the weather and Panama certainly has that covered. The tropical climate ensures year-round warm weather without the threat of hurricanes that can cause serious problems in other parts of the region. The low cost of living in comparison to North America and Europe also means you can enjoy a comfortable lifestyle outside of the classroom. Other great benefits of moving to Panama include high-quality healthcare and well-established expat communities who can help you find your feet in your new surroundings.


My name is Reina, I'm from Pasco, Washington. I came to this church because I was going through a really rough time and I needed some advice. And if not advice, you know, somebody to listen to me. And there was somebody that I admired a lot and she comes to this church, her name is Solomia. I messaged her one day and I asked her about the church and if she's willing to invite me. And she was more than happy for me to come.  And there's nothing like that feeling to know that somebody out there was watching over you. And here I am. My life before coming here, it was kind of hectic, something like a novella. I grew up in a house with a lot of siblings. And with that it was kind of hard to feel special or to feel like, it was hard for me not to feel different. So with all that I kind of just pushed myself away. I kind of, you know, didn't want to become a burden on anybody else. I moved out at 15 and from there I never went back. I kind of just kept pushing and pushing, you know, as hard as life got. And it has gotten really hard for me. So when I was living on my own it just became really, really lonely. It became hard because I just had no one to go to. I had friends, but they didn't get me very far at all.  All that came from how I had to get it. It all became so much harder, all that stress. Any issues in my life was just piling up. And, you know, I got to a point where things just got too rough. I gave my life to Christ the night that Pastor Vlad was preaching about a wolf, a sheep, and a shepherd. As he spoke, I kind of realized that I was that wolf. And I also realized that now I needed a shepherd more than ever to kind of guide me and take me to where I'm supposed to be. Because I know that I'm strong, but I can only get myself so far. I could only imagine where I could be if I would have just gave my problems to God. I'm getting baptized today because I'm ready to move forward with my relationship with Jehovah. And I'm excited to have him kind of as a partner in my life and be his partner in life. And kind of hopefully I can have, be an example to others and bring them to church with me and show them what a life like this is capable of. Reina, do you believe in Jesus Christ as God's Son and your personal Lord and Savior? Yes. Do you promise to follow him with good and clear conscience for the rest of your life? Yes. Based on your faith, confession, and commitment will baptize you in the name of the Father, the Son, and the Holy Spirit.


Why is this type of event so important? This event specifically is, like I said, our main planning event. So this gives us the opportunity to sit down and hash out some of the more detailed events and scenarios and planning procedures really that need to go into the actual exercise. So this is the event that we use to get most of, if not all, the exercise planners in can work on our interoperability while we're here, making sure that everyone's linked up on the same ideas, same plan for the whole scenario to play out. When is this event, the exercise, and what's going to happen when we need it? Okay, the exercise is slated to take place in March of 2014, and it's designed primarily to work on the interoperability of all the West and Northwest African countries. Specifically, we're looking for them to work on their ability to communicate from one maritime operation center to the other, be able to pass information along regarding illegal arms smuggling, narcotics, illegal fishing, all those types of things that pose a threat to those North and West African countries. The ability for them to work together and counter them as almost an entire region of Africa. So that's the big purpose behind the exercise. And the majority of what we're doing here is, like I said earlier, building on the relationships. That's one of the big sidebars to the whole exercise, is just being able to work well together with countries whose culture is very different from ours, whose language is very different from ours, whose everyday operations are very different from ours, but by us working together in things like the main planning event, the final planning event, it furthers our ability to work with them on an everyday basis in the real world kind of thing. So we have planners from Morocco, we have planners from Mauritania, we have planners from Senegal and Cape Verde. All of them are exercise planners. They all come from either that specific country's Coast Guard or that specific country's Navy. So they have a lot of knowledge on how this has been executed and how this applies to a real world event. Today we discussed a lot. We discussed everything from the scenarios themselves, how to unfold, how the maritime interdiction teams will board vessels, why they're going to board the vessels. Right now they're discussing the ROE, the rules of engagement. We literally build the exercise from the ground up from what's going to be on the target vessel. Is it going to be illegal fish? Is it going to be illegal arms to the rules of engagement? Like I said right now, they're working on literally developing what the ROE will be for each MEO team or for each country. Can they go on territorial waters? Do they need to get confirmation from their maritime operations before they go aboard? All that stuff we developed here, the event exercises or excuse me, the event planning sessions and that's what we're doing is making this scenario as realistic and accurate as possible.


We'll see how this goes. OK, so let's just jump into this because we don't have enough time. We're going to run out of time. No, take your time. No, no, we're not fine. You think we're fine. We actually intentionally left this particular slide blank because this would be the part where we might talk of it. I think one of the nice luxuries of being in a group like this is probably most of the people in this room could make a more compelling argument for why in the age of surveillance capitalism that we need to be mindful about what learning in the open means and what we're exposing our learners to. But that is essentially the theme. And actually, I wish I could recall the phrase that Javier finished with in the previous session, that notion that when you are in these kinds of spaces, how do you meaningfully allow the participants to actually kind of co-create the spaces they're in and how do you be mindful of what these kinds of effects might be? So I'm going to leave it at that just because we're going to run out of time. And with that, I'm going to hand it over to Lucas. Great. So I'm Lucas Wright, and this is Brian Lamb. Just I'll take a little bit of time for those intros. I work at BC Campus and at UBC in Vancouver. So I have two hats on here. And Brian works at TRU, and you all probably know him. So what I'm going to do is go scattershot through a few slides and ideas about examples where we can engage students with shaping the web and openly participating, but at the same time, think about Amy Collier's idea of digital sanctuary and how we can deal with giving them resilience and helping protect the vulnerable on the web. I'll stop with the owl now. So can open textbooks help save the web? This year I've worked around open textbooks quite a bit. And what's interesting and what we've found this year looking at the analytics is that actually they're not just being used as textbooks. They're being stumbled on all the time in Google searches. So now when someone searches for ear irrigation, instead of just looking on WebMD, they're actually finding an open textbook around ear irrigation, which is interesting, as someone who spent a lot of time on WebMD when I shouldn't. Another thing about open textbooks is right now you're probably hearing a lot about inclusive access. So publishers are deciding that they can use OER, Cengage, Pearson, et cetera, but they see a model in it. And part of their business model that I didn't realize is analytics on those textbooks. So looking at how students access that textbook and coming up with reading analytics. This is just from an article around inclusive access. Gather data that could influence changes made to future editions of course materials. That data can also go to a lot of other places, as we found out recently. So do open textbooks actually provide a digital sanctuary for students reading data? Something I never thought we would need is to think about preventing someone from knowing all of our reading habits. Oh, I don't know this new fangled website that well. Here we go. You just scroll down and hit the arrow. There we are. Squawk away, ladies and gentlemen. Second of all, a really quick example is can we help educate students and mainly connect with students and help raise awareness around what it means to be a digital citizen and digital identity. So this example is from the University of British Columbia, the Digital Tattoo Project. The Digital Tattoo Project is a collaboration between U of T, UBC, particularly the libraries, as well as students. And students create articles. They do research on what their digital tattoo is. But this year, it's taken an interesting slant. They're looking at things like, what happens to my data when I put it in the LMS? Where does my data go? They've been interviewing Michael Geist. So by bringing these students together and connecting them, we're changing the way and helping them think about different ways of interacting on the web. This is the most awkward slide switcher ever for me. Sorry. That's part of my shtick. Can we create open spaces at our institutions where students can create and share? And the example here is the UBC Wiki. So at UBC, they downloaded a version of Media Wiki. And rather than having students participate in the great wide open, they have them create articles and contribute to articles. This is an article about pop tarts that a food science course added. I added this one because for this instructor, the UBC Wiki was training wheels for using the main Wiki or Media Wiki. In this case, the student talked about food science. The next year, the instructor had their same students contribute to Wikipedia. It worked really well. It was really exciting. But someone named the pink beast. I don't know if anyone here is the editor of the pink beast. Deleted two or three of the articles right away. And these were student assignments. So it's awesome. But sometimes the training wheels are quite useful for students to help experimenting in the open before going to the full open space. And finally, safety in crowds. Again, at UBC this year, there's been a bit of a shift away from just using Wikipedia for course assignments to having students participate in editathons. So having them work together as a group in a certain time and space and edit articles about science literacy, where they added female scientists to Wikipedia. This was done across five institutions in BC. Edit articles about women artists, female artists. This is a North American movement around women in art called art in feminism campaign. So by being in this single space and time they can support each other, help each other both understand the system, but also deal with trolling and deal with some of the challenges that come when we're participating in the open. All right, I'm gonna turn it over to you, Brian. So, Lucas actually prepared materials and worked through his points in an orderly and clear manner. So that was good while it lasted. Part of what this theme, when I was thinking about how we were gonna do this, actually came out of last year's OER 17, which was a really, actually every OER event I've been to here has been very meaningful to me, but it came out of last year with this really pervasive sense that this was kind of a watershed moment in terms of the open web and our learning on the web. And then right after OER 17, Daniel convened a few of us in Coventry for this really intense day long conversation and Audrey Waters was there. And the folks who did the safety and online learning workshop here last year, the towards openness folks were there.  Like we were just like, the environment we find ourselves in is just completely intolerable. What can we do about this? And we sat there and Daniel, if I'm misrepresenting, but my recollection was that we just kind of sat there in silence and kind of shook our heads. And I remember actually Audrey turned to me and she said, well, Brian, I've been to Thompson Rivers University. I've seen what's unique about your institution and the community you serve. What you need to do is think about how you can serve your community and let the wider world take care of itself. And that was a really kind of intense moment for me now. I'm not going to presume we did that, but I did want to kind of point to a few of the things we're doing here locally. So I'm not going to talk about consent forms, but it's actually really interesting stuff. So yes, I wasn't going to talk about splots, but a couple people actually asked me to talk a little bit about them. And it's actually fortuitous that we're here because actually, so splots are a co-creation between Alan Levine and myself. So all Alan did was come up with the concept of how the tools would work, all of the coding and all of the development and building and maintaining the sites. I came up with an acronym, although I haven't quite figured out what they stand for. So it's been a really great kind of 50-50 partnership to this point. And just to kind of boil down what a splot is. God, I wish I could just hear. I wanted to show an example of the writer tool. There we go. So essentially what a splot tool is, even though we haven't quite figured out what the acronym is, is the idea of creating the simplest possible learning online tool you can. And the thing that's notable about a splot is once it's kind of set up, you shouldn't need to provision accounts or collect any data whatsoever from the participants. So in other words, if you're creating a course blog, the students don't need to give an email address. They don't need to put an account anywhere. They don't need to give their name. You'll notice we default anonymity in terms of identity. The participants decide how they'll determine themselves. The other thing is, they don't actually have to learn WordPress. Now learning WordPress is a good thing, but maybe you just want to get these students writing on the open web. So that's kind of the thread that runs across all the different splot tools is minimal data collection and trying to just simplify the process and moving that along. So that's essentially what splotting is. I won't get into too many of the examples, but it's been used a lot at TRU. A huge advantage of the splots. And by the way, the splot writer theme is just a theme you can install into a WordPress site. So this doesn't require any major overhead to install this on your own thing. And Alan's done a really nice job of documenting it. It's fantastic for supporting course blogs at an institution because account creation is probably and maintenance is one of the biggest issues. And essentially too, we don't even have to do introductory workshops on how to do it. We pretty much create the site, spin it out and we just sit back and enjoy the writing. A link to one that's from apps for access justice course. There's a course on law at Thompson Rivers University where the students actually use the Naota logic platform to build actual legal expert system apps that essentially will guide you through a process. It's actually was inspired by, there's a tool in London for people to fight their parking tickets. That apparently a lot of times there were fallacious parking tickets being given, but it's such a process to do the appeal that they were getting away with it. So this tool apparently walks you through the process, submits your appeal and often will get you off. So they've created ones for things like dealing with spousal abuse issues. They actually have one as well to document annual cruelty. So this is a project of real apps for real students where they literally are helping puppies. Which is pretty fantastic. I was a little hesitant to point to this, but I think when I talk about our community, we have a very, very high proportion of indigenous students at our campus. And I just think, I can't go into it, but the Canadian history is we really have a shameful history there. And we have a gaping wound that is not even beginning to heal. And there's some interesting issues around what it means to be on the open web around indigenous issues. I'll just point to this paper. And the McCrew2CMS, which apparently reclaimed hosting is the preferred provider. I wanna chat with you guys about that. But I just wanted to point to this knowledge makers project just because there is still something to be said for students being able to tell their own stories on the web. So when you see things like saying, my grandmother attended a residential school in this territory, today I stand on that same land, a first generation published indigenous researcher. So there is still power in that basic concept of being able to tell their stories. I've only got a minute or two to go. So I'm just going to jump to, I'm not gonna be able to do it in an actual live demo, which is probably a good thing. The concept of cloning is very powerful in terms of supporting websites. So one of our students for this project, the knowledge makers, a student actually created a starter portfolio, embedded it with critical questions to aid the reflection process. And the students essentially could build on top of it and create their own spaces.  And this is the open ed tech co-op. We were calling it the co-op actually, but we weren't really a co-op because we were too lazy to actually incorporate as a co-op and it was actually Brian who had the brilliant idea to kind of just take that notion of ed tech co-op, ed tech collaborative and make it open ETC, which I think just kind of has a poetic ring to it, open, et cetera. It's something open. It has something to do with technology. And Grant Potter and Tannis Morgan have been my collaborates on that and it's just been such a blast to work with them. I know I only have one more minute to go, but if anyone wants, I can demonstrate this process later because this is something very slick that Grant Potter has done. Essentially, we can create pre-themed, pre-configured sites ready to run. And then when people sign up from an open ETC participating group, enter their email address, determine which of their sites they want created and hit the create site button and they will get, so you can install the splot writer, the splot collector, a set of pre-configured e-portfolios just by going to the site. So I don't even have to create sites now for students creating portfolios. This is a process that works really well and again, Grant Potter deserves the credit for that. So, again, another shout out to Brian. It was such a joy to work with him on this and he's also kind of to blame for the chicken becoming, I think the reason it resonated with us is kind of, I think as ed techs, we often kind of feel like battery farm chickens trapped in our little cages and just kind of with no room to move at all and the badass free range chicken ready to run really resonated with us. So thanks again to Brian for that and I'm stopping. Thanks. We'll take this work from the public. So actually, you know that I'm on my own work, so it's been nice to be here and I would like actually able to thank so many people for doing so many great things and actually, thanks for your collection of stickers. It's great, but you can have a seat by the means in here. I don't actually see anyone having questions. Oh, no, yes. Okay, let's start with the keynote. No pressure. I'm going to do that classic thing where I'm going to say, not so much a question, but a comment. But it will be a very short one. Now, I think the issue of anonymity is really, really interesting. I think the way that you've worked so hard to facilitate that. And I just think there's an interesting interface there with the way that so much openness depends on licenses that require attribution. So, I mean, I don't really know what I want to say about that, but I just think there's a lot more that we need to explore there about anonymity and attribution and when we need one and when we need the other. So I don't know if it's something that you've had, I think. Yeah, that is an excellent question. And I'll just kind of dodge it just to once again, they'll give a shout out to that paper on questions related to indigeneity and openness. It's a really interesting critique of some of the embedded assumptions around openness and that kind of naive information wants to be free ethos that, I mean, I think it inspired me at the time and it was partly what got me involved with communities like this one. But at the same time, I think as we go deeper into this and really start to look at the human dimensions of the work we're involved with, I think it's really great to have voices like that raising those kinds of questions, not just for those specific communities but for everybody. So when using Splat, how do you track your students if all of them can post something anonymously? So when people are gonna do graded assignments and you're using a Splat, I usually encourage the student, first of all, Alan actually coded in a little area where you can put a message in behind the scenes that will not be on the website itself. And the other thing you can just do is create a student in him and as long as your instructor knows what your pseudonym is, that tends to work. I mean, we've never done a Splat like that at a scale of hundreds and hundreds of students. Typically our typical groups have been around 20 to 50 students and at that level, it's very manageable. I'll let you answer a question. Can you talk a little bit about the infrastructure you're running the Splats off of for the, that grand potter? I'd love to hear more about that. Okay, so the specific tool is a plugin called NS Cloner and the free version actually runs beautifully with WordPress Multi-Site. I think anyone that's running WordPress Multi-Site for an institution, I highly recommend the plugin. Even the free version just lets you take any site you've built and clone it. And that's just such an incredible lifesaver when you're trying to not just, let's say you have a site that's kind of set up for courses and you have a discussion area and a drop box and once you've done that kind of work, you can really build on it easily. The NS Cloner paid version allows you to do pre-figured templates that can be public facing. So that's essentially the technology that that grant built on. And so obviously too, the cloud around stuff you guys were talking about this morning as a cloning kind of principle and moving stuff around across domains is something I think we're gonna be looking at. That was really interesting. We have to move on to the presentation. Thank you, Brian.