He is an electronics engineer and he is going to tell us something about building offensive web security framework in Python. So can we have a big round of applause for him? Thanks. The intro was sweet. I was an electronic student, I graduated. So the thing is, I submitted this talk after some long time, I got a notification that so and so talk got selected. And I was like, I looked at the title and did I really submit this long title? I was not sure if people would actually turn up because except this word, nothing else makes sense for most of the people anyways. So just before starting one more thing, I was just looking over through one of my demos. The network we are on is not completely secure. So someone is trying to spoof some packets. So if you are having any tunnels or VPN stuff, your company stuff, better not to do that. There are people who are sniffing on this network. So just be careful. If you have a VPN, it's cool. Yeah, let's get started. So a bit of who am I? So I was, when I submitted the proposal, I was a student, now I work at Yodly. So these are the things that I do. This is my first developer conference. I usually speak at security conferences. So I don't wear a mask, please. So we get branded like this all the time. When you think of a hacker or someone with a security domain, you'll think someone like this. These are the images you get when you Google for a hacker. So more or less the agenda for today is I'll just give a brief introduction to one organization which is OWASP. And then we'll see if we really need a security tool. I mean, there are lots of tools out there, right? We have Veracode, we have what not. We have IBM AppScan, whatever. Do we really need something more? What might be the answer? Yes, because I'm giving a talk, right? So then we'll talk about some of the modules. The aim of this talk ultimately is whosoever developed this tool are non-programmer folks including me. So the thing is we, the security community, we want you people to come in because we don't know most of the jargon link. The code we write is not extremely optimized. The code we write is, let me tell you, I really hate to write unit tests. So that's not a sign of a developer. So more or less the catch is at the end of this talk, you must be able to build, you must be at least be able to conceive an idea of a security framework or somehow some Python script to test your tool, test your software kind of thing. What is OWASP? I mean, how many of you have heard of OWASP? Okay, how many of you, I mean, most of you might be developers, right?  Seriously, I should change my organization then. Okay, so somehow this is an open source organization. What they do is they promote open source tools, they give some standards. They do lots of good stuff so that you can use their products to keep yourself secure. When I say products, it's not commercial, it's completely open source. Few things you might have already known are OWASP and OWASP zap. Top 10 might be pretty famous because everyone checks for top 10 nowadays. Like that was not the case few years back, but now everyone checks for it. So how many of you have ever heard of a cross-aid scripting or an SQL injection, wow, which is beauty, right? Okay, so how many of you have been at the defending side of an attack? Like, you were facing an attack, you were aware of it. And how many of you were on the defending side, okay? How many of you were on the side when you know the attack has been done? Now you have to clean up. How many of you are there? What is painful, defending an attack or cleaning it up? Exactly. So the thing is, prevention is always better than cure. So secure your apps first before anyone else breaks into them. It was kind of interesting with the Go! I've ever talked that their whole API is public. It's really not good, trust me. Yeah, so what is an ideal security framework? Why do you need a framework in a company? Okay, so one of the things is, there are lots of tools, okay? You develop your software, awesome, your QA team test set, fantastic. So now, there are lots of good tools out there, both open source and proprietary, which are useful for testing your product. Let it be source code scanners, let it be web application scanners, the black box tests like IBM app scan and stuff. Let it be source code and like veracode and stuff. So one is that the other thing, these tools are not really updated all the time. So no tool is a silver bullet, okay? No single tool solves all your problems, all the web application problems. One more thing, and the other thing is you can run all the tools, but it usually turns out to be pretty manual.  You run tool two, it gives a report. You run tool three, it gives a report. Now what, what? Everything sits in a folder or what? It's nothing, you have to see the actual result. But the problem is time. As you say, when you do releases like three to two to three releases a day, you don't get time to go through reports of all things. Like if you run veracode on just a shitty code, it will give you some minimum of a thousand vulnerability saying this and that. So you should have an idea of, you should be able to classify like not you, your program or your tool or framework should be able to classify the findings. Telling you that boss, this is important, go have a look at it. Go fix it, again run that. So one more thing was, yeah, scheduling capabilities. Yes, it's good to have a framework which actually finds, when it finds rated vulnerability, it mails you or it sms you something. The last one, yeah, people like tools are not built for that kind of purposes. I get a lot of messages saying that. So from a developer perspective, if we see for such a dream framework, what are the main modules that we'll always have? So most of the talk will only be talking about Python. So the first thing, if we classify our tests into plugins. So one test is one plugin kind of idea. So we should have a core engine which actually takes care of running the plugins and then saving the output and all the stuff. And then we'll have Requestor.  Why is it so important? We have URLlib, we have the beautiful request module. Why should we have a separate Requestor module, a separate one more module in your framework? Why not just import request, request.get wherever you want? Apps are not really simple, my friend. So what happens is one thing is session awareness. So there are cases when you have to do tests after logging in. So it's not that every time you import request and then do all the 45 requests which actually logs you in and then do the actual test. It shouldn't be like that. That part, the logging in part and all the stuff should be taken care of your framework and not by your actual plugin code. So, and then there should be some plugin API. So for this, like when you write these plugins, you should have some API exposed to the plugins. So you can actually write that, okay, do request to this. Now check if there is something in this, that kind of stuff. And then you should have a UI, that's the whole point because you should be able to view things quickly, right? And then you should have a proxy. Why a proxy? Because lots of tools do lots of stuff and you never know. Like 99% of the security tools will never tell you what they're doing.  So they might have missed something or the test might have crashed something. So you should know what all the tool did. And the last thing is, what are the interesting things these days? So the thing is a vulnerability comes out, a new one, okay? Something in Ruby on Rails, let's say. So the company doesn't have time to patch it immediately. So what they do is they deploy a virtual patch, which is kind of a WAF. They put on a firewall and they think they're safe. So there are like, the ideal thing is if you deploy a virtual patch, you should actually test it for its effectiveness first. So we'll come to that on how to test that. So more or less with the previous methodology in mind, we actually, like Abraham was the one here, so he actually built a tool called offensive web testing framework. The interesting thing is, if you take only the first alphabets of each word, it will be OWTF, okay? So, and the main aim was simple, penetration testing to be pretty efficient. Penetration testing is what you all know, I hope so. And the next thing is to standards like OWASP and all that stuff. So the idea there is to have a checklist kind of thing, okay? So ultimately you should be able to like, okay, I checked for XSS, cool. There were no XSS. I checked for SQL injections, cool. There are no SQL injections. I checked my JSONP endpoints, nothing. My mom is calling. So, and then the framework was written in Python too. We'll just have a small video. So this is the interface more or less, the framework has. So you can add, I'll show you. You can add targets here. So this is more or less from a penetration testers perspective. So how we use the tool. So you can run some plugins. There are some 150 plus plugins, so. So you can see one of the plugins. It's a robots analyzer, robots.txt analysis through party size. How many of you think robots is bad? I mean, how many of you think entries in robots is not a good idea? Like, it depends, yes. So the thing is, there is a lot of information disclosure if you don't put it properly. So put all your sensitive content into one of the folders and disallow everything under that. So it's not that you put everything out and blacklist them individually. So what happens is an attacker can just have a look at the robots.txt and tell that, okay, he's hiding something, let's go there. So this is more or less the thing that does it. If you observe like four plugins, the same category, they do the same thing. Why? Isn't it redundant? The thing is, it's not actually redundant. There is a category, I mean, type of plugin here. So the semi passive category actually says that, okay, I'll just send a get request, get the robots.txt and analyze it. The passive thing, the framework will not send the request directly. It will actually ask a third party. There are many services which actually let you do some calls to particular URL. So the semi passive thing, semi passive thing makes a direct call. Passive thing makes call through a third party service. Grab will do nothing. It will just see the, like it will check for robots.txt file in your transaction DB, the all the transactions that you're already connected. So, and the last thing is the external plugin for helping. So you can select something. You can run something. You can do, so you can launch in groups as well. Okay, here is one of the web vulnerability scanners. This is another web vulnerability scanner. It's quite famous. Some of you might be using it. So the plugins are running in the background actually. So now, yeah, this is how the report looks like. If you click on it, so we ran one plugin, other two types of one plugin. So then we can see what's the actual result is. So based on the finding, we can actually rate our rankings on the side. So, see, that was the third. So it found all these entries in the robots. So this was the robots.txt that was downloaded from Facebook. Okay? See all these entries and the actual request that I mean was done for this. So if you see, you can actually rate it here. Those are different rating scales depending on what you found there. You can add your own notes. It's the same thing, but it was, this request is done directly. That was done through a third party thing. Again, the rating. So what helps is at the end of the run, you'll be actually having rated vulnerabilities. So you can actually filter out the only the high rated ones. So you see a info flag over there rating that the highest rated vulnerability for that site is an inforated bug. So this is the place where all the transactions get recorded. The transactions are recorded. So whatever tool you fire through the framework, all the transactions, when I say all the transactions, all the HTTP transactions go through a certain proxy. So the proxy stores everything for you. So you can actually do lots of stuff. So you can search. Oh, it was not Apache. It was IS, I think it was IS. So you have all this stuff. We can search among all the transactions. The thing is tools will no more be transparent to you. You will know what the tool is actually doing by seeing the request. More or less, this is how it goes. So the thing is there are few other facilities like workers and work list. So the idea is, let's say you're running a tool and this happened many times. The site actually crashed, but you are halfway. Like some of the tools take more than a day to finish. So we have something called pause thing. So what it does is all the tools, just for an idea outside our scope, so we run them in a separate process. We don't run them in our own process because if they crash, then we crash. What's the fun in having a framework then? So the thing is when we run them in a separate process, so when we think the site is down, what we do is we take a snapshot of the process, store it, which is ideally nothing but Linux signals. We just give it a Linux signal. It will pause there. So we'll keep on checking the target and the target is back up again. We'll just resume this process. This will go on again. So that's the beauty of Linux. So it's just a neat trick, nothing else. This is more or less the basic architecture of how the framework is, or WTF. So you have an interface and API server which actually serves the users, the API and the web UI. And then part of this server itself is a worker manager. These processes are actually the main units which run the plugins. So when plugins are run in this workers, the traffic is sent through a proxy server. And this gets logs in the transaction, by a transaction logger process that logs everything through a DB. So ultimately, anything and everything is available through DB at the endpoint. So that is how you saw the transaction log there. This is more or less the UI that I showed you. Some few of the Python libraries that we use. Tornado, I'll tell you why. PyKal, Common, SQLAlchemy for ORM. Remember, we are not performance freaks. We are not like GoIB for serving people. We want to build a tool here. So we use Selenium, Beautiful Superpassing. All this stuff are part of simple security testing if you do sometimes. So as I already told you, this is the classification of the plugins. So the plugins are actually classified based on their aggressiveness. So why classification and aggressiveness? I don't know, like if any penetration testers here, the thing is you need to have a written permission before you actually go on for a test. And the thing is you don't have much time once you get the permission and all your manager gives you is a URL. So the problem is before, I mean the time period between getting the URL and getting the actual permission, you can do certain non-intrusive stuff which are completely legal in India. So when I say non-intrusive, nothing. Just go to the site, see what it does. What happens is when you do that, all the requests in the background are actually recorded to your proxy server. And then all the grep plugins, all the passive and all the grep plugins which actually analyze all the transactions, they'll find something or the other if there is something. I'll tell you what they will find. So we already saw what all modules were there. So this is how more or less how the core audibility looks like. So we have this thing called core object. Do that object, all these things are attached. So don't hit me. This is not the optimized way to do thing in Python. You can do service locators and all this stuff. But this was built long ago. We are kind of, as you say, renovating again. But this is how it works as of now. So it has all these modules attached to it. So when you want to write a plugin, the thing is you only have to write a method called run and that, I mean you have to write a function called run and the function will get the core thing. So you can see that if you have core, you have access to everything. So it can do file IO, it has access to plugin API, it has access to requester, it can do, it can run commands directly using shell, it can access DB, it can access plugin handle. But it cannot access interface and API server, the thing is because it runs in a different process. So when a plugin runs, it runs in a worker process. So not ideally it runs here. So even though it has symbolic access, it cannot do anything because the process might have forked out long ago. So yeah, so here this plugin does nothing. What this does is it actually runs a vulnerability scanner. So you can see that it is actually calling code or plugin helper, plugin helper is the plugin API that we expose through core. So it actually is asking to run a command. The command is obtained from resources. So this is more or less how our resources are. So here you can see, as I said, the passive resource for this thing, at the end you can see that this is something using SSL labs and there is a parameter using triple add rate. So it's actually a position holder. So when you run this, when you use this resource in a plugin and the plugin is run against a particular target that is automatically replaced by your host name. So all you have to do is click on the link if there is any vulnerability you'll get it. So we are trying to make people more lazy. So that is our aim. So and then we have the same thing open SSL and hardblades can and whatnot. Okay, so many stale faces. Why a framework? Why not run tools directly? Can you imagine, like how many of you are Java freaks here? That's, no, no, no, like we should know. I'll tell you why. So this place, things get picked up. So there are lots of vulnerabilities get released on a daily basis. I'll tell you what you have to test for. So why a framework is simple? If a new vulnerability comes out tomorrow, your framework should be able to test it. So you shouldn't run to a security tool guy saying that, dude, I want this support. Your tool doesn't do that. He won't even respond. Trust me. So the thing is, if you built such a framework easily, what will happen is, let's say, how many of you are aware of this attack? Like anyone have ever heard of this attack? Wow, one. And that's like four, five months back, dude. So the thing is hardly it, because everyone makes it popular, right? Things slip by. So what this attack does is, all your JSONP endpoints are actually vulnerable. Why and how is the point? So in JSONP, what happens is, you give a parameter that gets returned as a function call in the response so that you can directly do a call, right? That is the main idea. So what all characters should be allowed in a JSONP, that thing? Ideally, A to Z, small capital A to Z, numbers 0 to 9 at max. Nothing else, right? So you are giving alpha numeric capabilities. I mean, you're actually taking the parameter from there to here. No other sensitive data. But the thing is, there is a subtlety in the flash player. So one of the guys found that you can actually build ASCII flash files. So he'll give a very huge parameter, okay? That is the actual flash file. He was successfully able to convert the bytes, you know the binary how a SWF flash file looks like, right? So he was able to convert it to an ASCII one, a pure ASCII one. So the thing is, when you put that in the get parameter itself, you'll get that thing will completely get, I mean, reflected back in the response in the first part itself. What if I load this JSONP URL in a flash player? The flash player will think, it's a valid flash thing because that is how he built it. So ultimately it will play the flash file. What's the big deal? You are just embedding someone else JSONP end point on your domain because you don't have access on their domain.  What will happen? Go on. What is cross domain.xml? Ah, yes, XSS, why? Because inherently beautiful Adobe Flash will allow you to make request to the domain from which you are being served from. So you actually broke the SOP thing there. You're actually making calls to some other site from your site just using a flash player and the JSONP endpoint. That was the attack. It's not pretty tricky, but checking it is pretty simple, I would say.  It will ask the transaction DB that, okay, give me all the requests which have a JSON response type, response content type. And then I'll just take each URL, first each of them, and see if my thing is actually getting reflected there. And if it is getting reflected directly, then the attack is possible there. So can you see what is happening here? Ultimately, you are testing a new vulnerability with just maximum of five, six lines of code. So you are actually increasing your coverage, I would say. So yeah, looking into the modules that we saw earlier, we have some interesting stuff. We have some interesting modules which we built across the time. We faced few challenges while facing them. One of it was an HTTP proxy. Writing a proxy, my friends, is not rocket science. It's pretty easy. If you understand what it actually does. So we actually picked up Tornado. In literal sense, I can tell you. So translating this into very common language, it's like we built a proxy using Django. Why? I mean, Django is an application server, right? How can you build a proxy using an application server, an application framework?  Simple, we did the same thing, but why we picked Tornado was the thing is, we did some pre-implementation research. So based on the speed, based on the support it does. And as I already told you, we are security guys. We don't want to implement all the request parsing code. We never wanted to go through all the RFCs which mentions all the byte characters and all the stuff. So these were some of our requirements. We wanted the proxy to have caching. Obviously, we needed the ability to manage the middle and SSL connections. Yeah, this was one of the big challenge again. So serving WebSockets and HTTP, serving HTTP, HTTPS, WebSocket, WebSocket secure on the same port, it's a bit tricky and yeah. So this was the benchmark that we did after building the proxy. So all Python proxies. So what MI stands for is multi-instance proxy. So on the left side here, the thing you have is request per second, average request rate, average request per second. So you can see how well the thing scored, a multi-instance R proxy scored. The main reason is simple. It's just because, I mean, the thing is, we actually did quieter research before trying to build a product, trying to build the proxy. We did a lot of checks on it. That is one of the reasons. So how the caching works, it's pretty simple. In multi-instance proxy, generally it has four separate instances. It actually uses the file system as a cache because everything else is slow. Why? Again, we will be running four or five tools at the same time and the traffic that they generate is pretty huge. So bottlenecks, even though optimization is not one of our most primary concerns, for proxy it was because if we slow down here, what happens is all the tools slow down. So ultimately you have a huge latency in your whole tool. So this had to be fast. We couldn't find anything other than files. So why when we have all the big caching names and all the stuff? We are poor security people. So all the tool we build, I mean, the tool we run, I mean, the tool we build should be able to run on a single system, on a attacker system. It shouldn't be like, I deploy it on somewhere, I have four or five servers as it's caching servers and I have some messaging queues and all the stuff. We don't have all that equipment. So it has to be on one server ideally. This is how SSL MITM works more or less. So the thing is, you create your own certificate authority, you ask your browser to trust it and then you use that certificate authority to dynamically intercept all the SSL sessions. So ideally in an SSL session scenario, this is what happens. Some of you might not be aware. The thing is, when you go to an airport, plug in your charger somewhere, if you see a stray charger, plug it in. If your root debugging is enabled, what happens is, it will install a self-signed CA on your mobile, okay? And then, my friends, you will use the Wi-Fi thinking that, oh lord, I have good certificate store. There is no issues. I have SSL enabled, like TLS, I'm good. You'll browse, but you'll never know that your traffic is already being intercepted heavily. So be careful when you use stray charging ports and all the stuff. This happened really, that is how I'm telling you. Supporting HTTP and WebSocket are the same thing because if you can relate it to, Tornado has different classes for handling HTTP and this thing, WebSockets. So how to write a single handler is just by this. So we have this magic thing called new, which actually gets called even before you're in it. New is actually the method which will return you the instance. So there itself, we check for a WebSocket kind of request in it and then if it is such one, we'll return our WebSocket handler. If not, then if it's not a WebSocket request, then we'll return a normal HTTP request handler. So this was one of the cool things that we found. The second thing, which is interesting to implement in your framework is botnet mode. Why? Some of you might be working in finance industry. So they're quite stringent people. If you do two, three aggressive requests, they'll block you. It's no fun in testing them, right? So the thing is in botnet mode, your request or the request made by your tools will be spread all over the internet. So the algorithms has to be really good in order to detect a sequence there. So it's a quite cool thing. The extension of botnet mode is Tor mode, which actually uses the Tor network itself. So after a particular period of time, it will renew the IP directly. This is one cool feature if you are planning on implementing a framework yourself. This one is WAF bypasser. Again, it's one of the tools that, like one of our guys wrote, one of our devs wrote. This is actually integrated into OWTF as a module, but this is available individually as well. So you can see here, you have fireballs everywhere, right? So while development of this tool itself, a zero day was found. How many of you know what a zero day is? Cool. Zero day is something which is not reported to anyone and not fixed, okay? So here in this video, if you see, he's actually running a WAF bypasser and he's actually specifying that, okay, this is a post request with username key and the value, he's specifying that, okay, first here, what he finds is pretty interesting. So it will actually run against all the encodings, all the possible stuff, all the possible permutations and combinations and it will tell you what all HTTP requests were detected and what all HTTP requests were not detected. So it will based on a string or based on some search on the response, it will tell you which of your intrusive requests were detected by the WAF and which were not. Then you can see A code was detected, but at the same time A code, A was not detected. So there are cases when you might think that, okay, the virtual patch is there, but it's fine, it's not actually. So here he just tried code and it blocked it, okay? And then he tries A code A or something code something and he tries that ideally it shouldn't detect. So he doesn't detect. So the WAF didn't detect. You can see, right, when WAF detects there is a different error message most of the times. So it is actually again defense in depth if you want to show the same thing for both the things. One more thing, if you are planning to build a framework again, you already saw in the video that I had to go through each and rank the findings. So that was again making us do work. Again, lazy mode applied, we wanted a tool which will parse other tools, the tools we run, all the reports and then based on the severity that they give will rank them. There are two ways in which the ranking is done. Like these are the tools that are supported. So programmatically, this is how it is. So it has one huge parser class. It has all the, it has abilities to parse everything. I mean, all these formats. So ultimately adding a new support to a new tool is nothing but just adding a small, I mean extending the base parser class. The rankings, it does in two ways. One, some of the tools give their own rankings. So they have info, something, something levels. So we kind of normalize it onto our scale and then we give, suppose if they are giving on scale from one to 10, but we have a scale from one to five. So we normalize it down. So this is one way. The other thing is, let's say the tool doesn't give any, this thing, any rankings by itself. So what we do is we have a signature file which has some matchings, I mean, which has some hard coded stuff saying that, okay, if this is found, then the rating is high kind of stuff, simple things. So it does it. So one of the last interesting modules is an Ajax spider. Why do we need an Ajax spider first of all? So the thing is, most of our stuff these days, most of the web applications are pretty complex. They're pretty dynamic. The attack I told you previously, the JSNP attack actually occurs only on JSNP endpoints, right? So if your coverage on dynamic web applications is complete, only then you'll get hold of such requests. So you should be able to like, okay, the one thing is you hire a person, make him sit and make him click on all the links manually in the browser because you cannot do it directly using requests. The content load is loaded dynamically a lot of JavaScript has to run. Or you use an Ajax spider. But the problem with Ajax spider is most of the Ajax spiders are pretty naive. None of them are good. So they break on a lot of stuff. If you want to write one, these are the three things you require. You need a browser driver, preferably something like Selenium. Use some headless browser like PhantomJS, use Chrome or whatever you want. Use a graphing library because you need to know from which state you end up at which state. That is pretty important if you want to traverse the application. And then you need to have a DB driver to store everything. So how it works, pretty simple. So how Ajax spider works, it's go to a page. So here in the graph, each node is a DOM state. I hope you are familiar with what DOM is, all the backend developers.  So you have the arrows, I mean the edges actually connect different nodes. So ideally what happens is your edge will tell you from what DOM node you end up at what DOM node and the edge will also contain information telling which element and what action you did to go from that state to this state. So through this, the thing is from any state you can go anywhere, literally, almost all of the states, not end states like this. These are terminal states. Yeah, so this happened. The reason I built Ajax spider was pretty simple. So one of the applications had session tokens in the URL itself. You cannot reuse URLs in that case. So none of your traditional spiders work, none of the existing security tools work because the token is in the URL itself. So the crawler actually what they do is they start, even though they get all the cookies are, I mean they try to log in and then they get the cookies are even though they do a request to a URL, the URL is not valid because the session token is not there or it is old, so that kind of thing. That scenario, you need to have the whole state graph. There the thing is just remove the session token, complete the rest of the URL, complete the DOM states, then you can actually traverse the whole application. That is how Ajax spider is implemented. Once Ajax spider is implemented, it is awesome. You can actually, you have everything. Again, your coverage is complete. So you cover everything from JSNP endpoints to whatnot. So one thing is your crawling should be good or you should be a scumbag. I'll tell you what scumbag spidering is. We usually used to do scumbag spidering in OWTF. The word might sound offensive but it's pretty simple. So when we proxy all the tools through our proxy, we collect all the requests, right? So indirectly we have every URL that every other tool collected. So it's a superset of what all the tools know. And then if you don't want to build an Ajax crawler, use one which already exists. It's crawljax, it's pretty cool. It's written in Java and you can try if you want to. So before building another such framework, just a big heads up, please don't. It's a big pain. Why?  And the community is more or less like, it's not useful for us any longer. So the main idea is contribute to something which is already existing. Like there are two other good projects called Golismero and there is one more called Faraday IDE, similar projects. So contribute to one of them, add the functionality that you think is missing to them. That way you add a functionality, you'll get what you want. The developers, okay, cool. People are using it, we are getting some requests. They'll keep developing the other functionality. So don't start building a new tool just because you want a new feature. That's a pretty bad idea. So use the existing ones. Yeah, even if you are building a security tool, please follow all the standards. We paid a pretty hefty price because we not followed this thing initially. So ultimately it's a software, right? Other than that, these are the things I spoke of. Everything is on GitHub. Whatever I spoke is open source, completely free. If you want to seriously build an AJAX crawler, it's quite difficult, but it's quite, I mean, learning process, because comparing DOM states is not easy. Just imagine there might be a date field, okay? There might be some other CDN link which actually changes. So there might be lots of things which change. So comparing two DOM states is a difficult job. You should see the, like, if you have some time, go through the research paper of crawljacks. Like that is pretty good. Like most of the tools which run on Java use crawljacks for AJAX crawling. No one has implemented their custom stuff, not popular security tools. So, yeah, crawljacks, and this is one of the alternatives to OWTF. It's a pretty good project as well. So I'll take questions from here. Anybody has any questions, can I ask? No, friend's Facebook account. Hello, my name is Jai Singh Shukla. Before humans, I was reading the OVA documentation for Python language. They have done, they are preparing in between half of, half of what are documented on the GitHub and half of what's still remaining in a to-do list. So according to you, what are the Python bugs developed or made in there most commonly and you find that this would be not there? Because OVA's are pretty much to-do list and there are some of them very goodly described. So according to you, can you suggest what are the Python bugs and security flow? The super native bug that every developer does is trust everything that you get from the client side. Regarding that, if you are, but then the documentation, there are like... That is a secure coding guide, right? Yes, yes. So that you have to code it securely things. So it depends on how, you should always be aware of what data, so there is this thin boundary between trusted and untrusted data. So if you are transferring data from one domain to other, you should actually filter it properly, carefully, I mean, cleanse it and then put it on the trusted domain. It's not that you'd consider any, like there are cases when developers, so I'll tell you what people mistakes do, from the programming side, I usually do Java code reviews, so Python, I don't know, but the general things that they do is they put some cookie, okay, and they think that cookie is okay, it's not user-manipulated. And you can do lots of stuff just using a cookie or similar things, saying that some developers say that we'll use referrer header for kind of checking if there is, I mean, if it is a cross-site request for your thing. So these are all the understanding of the developer. So ideally, the security team should be aware of all this and yeah, developer should also be aware of what all the catch is here. Secure, yeah, the data thing pretty much is that I could say that you should be careful on what data you're putting where. One of the bugs that I found interesting was, you know this thing, right, sub-process. So one of my colleague was telling me, there is sub-process, okay, and there is one particular method of it which actually escapes the arguments. So you can only run one command. You cannot do an injection there. Okay, that's good. But what happened was ADB was there. ADB was using this shell. Python was actually cleaning it up, but ADB was not cleaning it up. So ultimately what happened was, you could do a shell injection, but in the context of ADB, not in the context of the Python process. So it's more or less, you should know where the data is going and how the other program is treating it. Thank you. Anybody else has more questions? So you mentioned about running the proxy server, right? Is this proxy server being run on your local or? It's run on the local host, the same place where to. The proxy server will be started when your tool starts. It will end when your tool ends. That's it. Okay. I'm coming from a static code analysis background.  Yes, yes, that's what I say. How do you, what are the best practices that we can follow to avoid these false positives? The one thing I learned in my brief three month at the Stintech, one of the company is you can never force developers. So it has always, it should always be on your side. So what we do in our organization is we have scripts which actually filter out some positives. So based on how your application is actually coded, you can implement filters. So in the period of time, you'll get to know what are the actual false positives, then you can actually filter them on your side. But forcing the developer never really worked for us. Like they'll repeat it. And yeah, they are on hard deadlines as well. So I think we should be the ones taking care of it. Okay, any more doubts? Here. Yeah. Hey, so I'm not very familiar with the security techniques here, I just developed code. But this is very interesting and I, every developer would want his code to be secure enough. I am looking at this tool as a way of abstracting my efforts of building a secure, secure code. How easy or how informative I have to be to use this tool? Okay, initially when this tool was built, it was actually for penetration testers, I would say. So most of the lingo that you will find in there, even the classification that you see is the OASP checklist classification. But with a bit of knowledge transfer, I think it will be same for any user. So a simple thing put, if I say, if you're the same thing, if the Rosetta Flash attack was found on one of your JSON pain points, the ideal fix for it is to just add a space before the thing you are reflecting. So Flash Player invalidates the whole stuff and all the things. So. Yeah, so I remember you mentioning Metasplite and all that.  I don't do that very actively. Yeah. So the thing is we have one external plugin, which actually suggests for fixes also. So it won't be a generic solution. Because it doesn't know what language the server is using all the stuff. It will actually provide you to some manual resources where you can find information, more information about that particular vulnerability and how to fix it. How is it, how it has mitigated and all the stuff. Yeah. Do you also have a documentation? Yeah, the user documentation is there on docs.github, docs.odwtf.org. It's user, I would like if people contribute. Okay, so time is up, so you can catch up later. Sure. So anyone wants to talk anything security, security plus Python, I'm free, I'm all yours. Other than that, please contribute. One of the things we miss is contributions. Like we are all security folks with a bit less time on our hands. It's not that programmers have a lot of time, but still, please help us. Thanks. So please give a round of applause to Bharadwaj. And I would like to give this small gift to him from the PyCon team.


Hi folks, this is Dr. Don. I have a problem out of Chapter 5, Part 4, on the normal distribution and the central limit theorem that a number of folks have struggled with, so I thought I would go over it. It's about a manufacturer that claims the lifespan of its tires is 48,000 miles. This person, you work for a consumer protection agency, you're testing the tires, you're told to assume the lifespan of the tires are normally distributed, that means the population is normally distributed, you take a sample of 100 randomly and you test them, you get a mean lifespan of 47,867, you assume the population standard deviation sigma is 800. Three parts to the question, the first is, assuming the manufacturer's claim is correct, what is probably the mean of the sample is 47,867 or less? Part B is using the answer from Part A, what do you think the manufacturer's claim? The claim that the lifespan is 48,000 miles. Then Part C, assuming the manufacturer's claim is true, would it be unusual to have an individual tire with a lifespan? Now those, I emphasized individual tire here and mean of the sample there, because those are key things you need to pick up on when you're reading this. You're given the clue that the population is normally distributed. From looking at this, given the fact that you're given the mean of the population's standard deviation of the population and a mean of a sample, that should clue you that this is a normal distribution problem. So I want to show you how to solve it using StatCrunch. Always like to start these problems by making a sketch. We're told that the population of tires' milages are normally distributed, so I created the bell curve there, of course. We're given a mean of the population mu of 48,000, and then we're given the mean of the samples of our tires, x bar of 47,867, which is down here on the lower side. We're asked to find out the probability of getting 47,867 or less, which is everything to the left of that value. So we're interested in this area under the curve in red here. Again, we're given the mean of the sample x bar of 47,867, the mean of the population of tires of 48,000, and the standard deviation of the population of tires sigma of 800. Recall when we're dealing with normal distributions and we're trying to find probabilities, we first have to find the z-score. In the z-score, we find from an equation like this, x, the value that we're concerned with, minus the mean mu divided by the standard deviation sigma. Now this equation applies to an individual x when we're looking at the population. When we're looking at a sample, we have to look at it in terms of x bar, the mean of the sample, and we have to subtract from it mu sub x bar, which is the mean of the sampling distribution, and divide that by sigma sub x bar, which is the standard deviation of the sampling distribution, also called the standard deviation of the sample means. That in turn, we can come up with the equation x bar minus mu sets for a normal population, and when we have a sample greater than 30, we know that the sample is normally distributed, and the mean of the sample, mu sub x bar, is equal to mu, the population mean. The standard error, sigma sub x bar, is equal to sigma, the population standard deviation divided by the square root of n, the sample size. So that's how we would manually solve that. We can do it very quickly using StatCrunch. Let's go do that now. Have StatCrunch open here. We go to the path, StatCalculatorNormal to bring up a normal distribution calculator. Recall that it comes up in the standard normal distribution, which has a mean of zero and a standard deviation of one. We're going to work with the population mean of 48,000, and because we're working with the sample first, we need to take the sigma, which was 800, and we're going to divide that by the square root sqrt, open 100 for our sample size, and then we put in our x bar of 47867, and we click compute. It gives us an area under the curve that probably we're looking for of .048, which is approximately .05. If you recall, we had two ways of deciding if something is unusual. If it's two standard deviations or less, then that's not unusual. And if you recall from the empirical rule, two standard deviations means that 95% of the data is within that, so that leaves approximately 5% that would be left over out here. So that kind of tells us, just by looking at the probability, that this is not unusual because it's about 5%, which is not unusual. But let's find the z value just to double check that, and I'm just going to open up another calculator here. This time, the way I like to do it, we've got our standard normal with a 0 and 1, but the mean and standard deviation, I take this probability and I copy it, and I paste it over here, make sure my direction again, we want the left tail, click compute, and that gives us our z value that we were looking for. This minus 1.66, which is less than 2 as we talked about, so that's not unusual. Now let's do the last question, what is the probability of getting a single tire from that population with a mileage life of 47, 8, 67? We can do that using the two calculators I have there. I'm going to make this go back to just the population sigma of 800, click compute again, and you can see now that the area under the curve is 0.333, which is obviously not unusual. And to get the z value, I'm just going to copy that again, ctrl-c, and I'm going to paste it over here, ctrl-v, click compute, and you can see that is minus 0.166z score, obviously much less than two standard deviations, therefore it's definitely not unusual. So that's how to do this quickly using stat crunch, I hope it helps.


Well, when tourism spokesman for two top ice fishing destinations in the upper Midwest go head to head in January there could be a lot on the line. They're fishing lines anyway. Tanner Cherney at North Dakota's Devil's Lake and Joe Henry at Minnesota's Lake of the Woods are facing off in a walleye fishing competition January 3rd that will be carried live on Facebook. There's nothing fishy about it. The goal of the walleye war is to have a little fun and to highlight the two lakes that are popular destinations for anglers. Henry says ice fishing is part of the regional culture and he and Cherney plan to have some fun showcasing the sport and the lakes. The Facebook fish off should all be fun and games until someone loses a walleye.


Hey Barb, this is Megan with Oxmore Toyota. I just wanted to send this quick video greeting just to personally introduce myself. It has come to my attention through Toyota.com that you're in the market for a new 2016 Toyota Camry. I'll also see where we sent you an offer for a $25 prepaid Visa card when you come out and test drive one of our vehicles. When you can, go ahead and give me a call. You can reach me at<PHONE_NUMBER>. And I look forward to hearing from you soon. Bye!


ACM is a method that's been used for a long time using participatory action research methods, but there actually hadn't been developed a manual on how to really put ACM into practice. So when we started our project and we're trying to figure out exactly what this ACM was, which we'd heard so much about, we ended up having to go to various people and look for information from other places to figure out how to pull it together to train our own facilitators for their field work. And so what we ended up doing is using ACM with a gender approach and through the project we realized that we ought to be putting together a manual that would allow people who were interested in ACM to get an introduction to how to do it with some really straightforward forward graphics and descriptions of and experiences from the past that included a lot of work that's out there but hasn't really been put together in an ACM manual but then also to include the gender focus. So it's not about looking at gender as a problem in a community because ACM approaches problem-solving around natural resource management, but it integrates the gender focus into the problem-solving itself. So every step of the way you're looking at how to integrate women, how to involve women, you're observing, monitoring, and promoting discussion and feedback around the participation of women while you're working on the other the solving the principal problem that the community has decided to focus on. This manual emerged from a project called Gender, Tenure, and Community Forest in Uganda in Nicaragua funded by the Austrian Development Agency. We started using ACM because it seemed like a really good way to approach community problems in using an approach that's as non-intrusive as possible where you go into a community and really focus on facilitating processes within that community to talk about problem-solving but at the same time we're bringing in by bringing in the gender focus we have to take an approach that's very sensitive and very that allows the community to take up the issues in the way that is a safe for women and appropriate in those communities. So ACM was a way to start talking about women's participation in projects ensuring that women were invited to the meetings to develop the discussions around the problems in the community and again provide safe places for those kinds of discussions to take place. In both countries we found that the legal frameworks were really good for women and promoted women's participation in Nicaragua they have legal framework that's excellent in all elected offices there have to be 50% women but when we got down to the community level and working in indigenous communities in this case we found that the actual participation was much more behind the scenes so decision-making in public spaces was still very male-dominated and in many communities actually what we found in Nicaragua is that it wasn't even men versus women it was really a small elite within communities that were making decisions were deciding who would come to meetings and who would participate so the issues around gender were really embedded in bigger governance problems in community so the ACM process by facilitating spaces where these issues could be brought up and discussed openly helped has helped the community start figuring out how to address some of these problems it's difficult and challenging especially again I'm focusing on Nicaragua because that's the part of the project that I coordinated but we're working in indigenous communities where traditional authority is very important and going into the community through traditional through the authorities is very important so then trying to encourage those same authorities to be more open to open up governance to be more inclusive can be very sensitive issue and it takes a lot of deep knowledge of the of the region and the communities themselves in order to be able to do this which is why it's so important to work through local partners and not come in as an external North American coming in and saying you guys need to work on gender that's not what this is about and so this is the kind of method ACM is the kind of method that allows something like this to happen


Here's another thing revenge fantasies.  Why do you think we do that? I don't know man


This is a time for every human being to build themselves into a higher possibility. If you get one problem, let's see how to handle that.  If you shift this focus, we will go through any kind of time. When time to act in the world becomes open, you will be in a great advantage. If you committed to enhancing your life, lifestyle will happen. Right now there is just so much suffering. You open the TV or the internet or everywhere, how does one cope? Is it the same way meditation and praying or is it staying present or your breath? The things you often talk about are those things relevant? Is there something else people should do right now to just cope and not lose hope? Young kids are telling me, we will never get a job. What is going to happen to my life? It's like, what would you say to such people? See, one thing is a whole lot of people in the world go about like they are immortal.  So this is one thing that's upsetting people. We need to understand if we have to stay sensible, we must be consciously aware. Every moment of our life, if we are aware that we are mortal, we will organize and plan our lives and the little time that we have and the energy that we have in the best possible way.  We want to complete our time and die, that's all. There's no such thing as we will not die.   That goes for everybody. We are all mortal creatures, we are all dying kind, all right? Now with the virus it's staring in our face, but it was always staring in our face and we were missing the point. Having said that, this is not to be insensitive to the deaths that have happened, loss of dear ones, loss of economic losses, loss of jobs, everything. But we need to understand this. This is a time when mortality is so obvious to everybody. This is a time to understand our focus should be on the nature of our life and the quality of this life. Right now, most people's focus is on their lifestyle. So everybody's crying about the loss of lifestyle. I'm saying if you have life, it's good enough. Lifestyle is just of our times. If all of us were here a thousand years ago, maybe all of us would be living in huts. Those people that you think in Mumbai are very poor, maybe we would be in same kind of squalor and we wouldn't mind, we thought it's fine, all right? So right now somebody else is living in a better house, comparing myself to that person, now I suffer my home. This need not be so, do not be committed to lifestyle. Your commitment should be to make this life as beautiful as possible. If you shift this focus, we will go through any kind of time. We must understand this compared to previous generations of people. There were world wars, there were famines, there were terrible events that happened in the world and including in India, all right? This generation, we have not seen anything like that. This is a bad one, but still it's a soft ball. If you behave responsibly, it is not going to hit you.  Today, unfortunately in India we have this problem because I've been talking to so many people, I'm saying this. People think war means it happens on the border. No, it is happening on the border, it is happening on the border because a few brave men and women are standing there and because of their efficiency, it is happening only on the border. If they don't stand there, it will be happening in Delhi. If our soldiers are not doing their job well, their soldiers, the enemy soldiers will be walking on the streets, all right? And you know all the terrible things that have happened with the past invasions, don't forget that. I'm saying that way as a generation of people, in terms of comforts and conveniences, no generation ever had these kind of comforts and conveniences. No generation had survival better organized than this generation. We just have to make sure nobody starves. That's all. Rest of it is only loss of lifestyle. Don't make big fuss about it. This is a time for every human being to build themselves into a higher possibility.  In every way, please use this time to upgrade yourself. When time to act in the world becomes open, you will be in a great advantage. Rather than sitting and crying, right now WHO is saying that it is not just this pandemic, there is going to be a mental pandemic and there's going to be a suicide pandemic. See, our problem is if we get one problem, we want to multiply it into many. No, if you get one problem, let's see how to handle that, don't multiply it in your head. Yes, it is a serious issue, it's not a joke. Yes, there is tremendous losses for everybody, but focus on being committed to your life, not to your lifestyle, then you will see everything will change in many ways. See, if you committed to a lifestyle without being committed to enhancing this life, inevitably one way or the other, you will move into crime. Maybe crime outside of the law or crime within the law, but inevitably you will move into crime once you're committed to lifestyle. If you committed to enhancing your life, lifestyle will happen according to our competence and in the times in which we live. See, we must understand our lifestyles are all not made by us. Our lifestyles are of the times. See, right now in twenty-three, twenty-four hours from India, I'm here in United States. If it was hundred years ago, coming to United States means probably forty-five, fifty days up and forty-five, fifty days down, all right? But people are saying this, twenty-two hours of flight is too long. Repeatedly they're telling me, I said, what is too long? I'm glad it's only twenty-two hours.  So I'm saying we are having as a generation of people, we have the best of everything, never before humanity has had these kind of things. Now, if we commit to enhancing our life rather than just enhancing our lifestyles, we can become the best generation ever because our survival issues are largely settled. We must understand this, three hundred years ago, if you want water in the morning, you had to walk down to the well or river or pond to carry two buckets of water. Today, how many young men and women are even capable of carrying two buckets of water a mile? Physically capable, they're not anymore, I'm saying. So you open the tap, water comes, hot water comes, cold water comes, everything happens and you're cribbing and cribbing and cribbing, please don't crib.  You must understand that since you and me started talking, everybody who's listening and all of us including you and me are forty-seven minutes closer to our grave. If you think about it once in a way, it causes paranoia. But if you listen to the body, every beat in the body, it is clearly saying it is mortal, all right? Always it is reminding you it is mortal. If you are conscious every moment of your life, well, you wouldn't want to waste one moment doing something that doesn't mean anything to you. You would do only what truly matters to you. If all of us were doing only what genuinely, genuinely matters to us, we will be living in a fantastic world, pandemic or no pandemic.


This is the Human Action Podcast, the weekly show looking at politics and events through the lens of economics with your hosts Jeff Deist and Dr. Robert Murphy. We welcome everybody to another episode of the Human Action Podcast. I am one of your hosts, Bob Murphy, and with me is Jeff Deist, who is calling in. He's on vacation in an undisclosed location in Florida. Jeff, do we have you? Yes, in cold rainy Florida where spring break, spring training during spring break has been canceled due to the Major League Baseball Strike. And I feel you have some strong feelings on that. I do. I do have some feelings on that, but I won't issue them here. Okay. So it seems like maybe the thing we should talk about today or at least start with our conversation, things that have changed slightly since the last time we talked, Jeff, situation in Ukraine and world energy markets, of course, is still in the news, folks. And one of the developments has been that President Biden has now announced that the U.S. and I think the UK also, they are going to embargo or, you know, not accept imports of Russian oil. But Biden conceded that some of the European allies, that might not be a path they can follow us down on. And so just to explain the logistics here, so what's happening is the U.S. actually and for those of you who are older and you may have grown up in an environment when the U.S. was always this huge importer of oil and oh boy, we got to wean ourselves from foreign oil. That actually because of the fracking and horizontal drilling revolutions that happened in the last decade or so. Actually, the U.S. is much in a much more solid footing in terms of being able to produce the oil. It's still a net importer, but it's not nearly the degree that it used to be. And the numbers I checked, the U.S. basically doesn't get any of its crude oil coming from Russia. So the U.S. saying we're not going to accept imports from Russia isn't a big deal. In contrast, Europe gets about 40 percent of its natural gas from Russia and about 27 percent was the figure I saw of their crude oil. And it's not even evenly distributed. Like so Germany, for example, is very dependent on Russian natural gas. And so that's why when you see the comments from various leaders in the EU, they're saying things like, yes, we look, you know, we deplore the Russian aggression in Ukraine and so forth. But right now it's not realistic to, you know, it would be far too painful. We're not we're not there yet to be able to completely abstain from Russian energy exports. Well, it seems to me about the first casualty is always truth in any war. And we're seeing just absolute economic illiteracy presented as fact. So yes, I did some digging last night and it appears that only about 8 percent of U.S. imported oil comes from Russia. So it's a little easier for us to be morally upright because we don't need it as much, you know, relative to some of our European counterparts. Now, maybe they've made a mistake in a sociopolitical sense of, you know, buying or requiring that much oil from this cronyist state of Russia. OK, but that's sort of a different question. But I guess what bothers me is this idea that we need to politicize this immediately. But Jen Psaki, the White House's press secretary, this Dunderhead Elizabeth Warren, who somehow made her way to the U.S. Senate, you know, basically saying, well, this is oil company greed. They're using this opportunity to crank up their profits. And Jen Psaki, which is just, of course, absolute nonsense. Jen Psaki is trying to say this is Putin's oil hike, you know, so we need to absolutely demonize an entire nation based on their leader of sorts. And so that's what's so depressing here is that in this day and age we can still get away with this kind of rhetoric. Yeah. And by the way, just to reconcile in case some of you in the audience have cognitive dissonance like Murphy, you just said there was zero percent and Jeff said there was seven or eight percent. The distinction is because I ran this to and I was looking at these numbers, Jeff, if it crude oil, you know, narrowly, I don't think we get basically any from Russia. But petroleum imports, that's what they call seven percent. And so petroleum, the way the EIA defines these things is a slightly broader category than crude. So in case folks at home think that Jeff and I are making up numbers, we're saying the same thing. It's just the definitions that these reports use differ slightly. Yeah, you're right. So I saw a funny thing, Jeff, where it was one of those memes with the guy putting on the clown makeup. And it started out saying, you know, inflation is actually is not happening. And then it was inflation is actually good for the workers and bad for the capitalists. And then the next, the final pain was the inflation is Putin's fault, you know, so that just the various stages of how the Biden administration is dealing with rising prices. It keeps going through all these ridiculous loops. Well, I guess what mystifies people about oil is a commodity relative to other commodities is that it experiences such huge fluctuations seemingly overnight. I mean, when you're driving around town, you see gas prices even during normal times go up or down a few cents and then they'll maybe trend one way or the other for a while. But Bob, other commodities don't do that. If you're buying bread at the grocery store, for example, that may contain wheat and flour, you know, it may go up over time, but it never goes back down. It doesn't go up and down. And so what what makes oil such a unique commodity obviously needs to be refined before it works in your car. But what why are there these wild swings? Why is it so politically or geopolitically sensitive? Okay, that's a great question. And why don't I first just make sure the listener realizes just how dramatic these price swings have been. So the benchmark, the European, the Brent crude oil. So it was earlier this week, I think it's come down a little bit since then, but early on this as we're recording so that this would the week of March 10th. So earlier this week, it had got up to about 140 a barrel and it had been in the 70s just in early December. Okay, so that's almost a doubling just in a few months, which is, you know, pretty extreme. And then natural gas, the situation is even more dire. The figures I saw the natural gas prices right now in Europe like the Dutch hub is one of the benchmarks they use over there, that that's tripled since October. And it's up by a factor of eight since last April. Okay, so again, it's like if you the number that was last April, you'd have to multiply it by nine to get the current natural gas price. All right. And so that partly underscores some of the folks at home who may follow this stuff.  And it's not just, oh, is the world economy rebounds after COVID. So the natural gas prices there are just levels far higher than anything anyone's seen, whereas oil, it just kind of rapidly returns to the pre pandemic levels. So to answer your question, Jeff, it's, yes, oil tends to be very volatile. I think it's a few things. So one is that it's a global market and so events around the world can affect it.  Okay, so it's, I think that's that's part of the issue. And so that's why whenever there's a geopolitical event, then speculators were, you know, rationally and often correctly think that, oh, that's going to mean higher oil prices, at least in the near term. And so then they bid the price up right away, you know, speculatively, which I don't know if we want to talk about this, Jeff, that's actually a good thing. Like that's what you want markets to do if oil is going to be relatively more scarce. In terms of the fundamentals a month from now, you don't want that the full brunt of that to hit consumers in exactly one month, you want them to be eased into it. And that's what speculators do when they push the price up in anticipation of disruptions that may not have yet hit, but might hit a few weeks down the road. You want the speculators to push the price up so people economize now, other sources have time to get up to speed and, you know, and so forth. So that's that is the market working. But in terms of why is it so volatile? I think it's partly because they have they have a pretty narrow margin of error there to match the quantity supplied and demanded. And I think there's a lot of political reasons for that.   In 10 years from now. Well, and we've had a real Marie Antoinette moment on the left the last few days, this let them eat cake, let them buy EVs. Of course, electric vehicles are not cheap. And replacing the batteries in them is especially not cheap one, which affects the resale value of them mightily. And I've also heard the commentary it on the left say things like, well, you shouldn't be driving. You shouldn't be using 30 gallons of gas a week anyway. Who even does that because they tend to have no conception of people who might live in rural areas, for example, where the distances are far.  They don't like big trucks. Not all big trucks are just a status thing.  I mean, this is this strikes me as a bad look for the left. But what's interesting is I think this might be an opportunity just like COVID was an opportunity of sorts. This might be an opportunity to say, look, people, given the state of the world, capitalism is unreliable. There can be wars. We need to wean ourselves off this dirty, nasty oil, which is the source of so much conflict on earth. And we need to be moving towards green renewable energy sources. And, you know, Bob and I could do a whole show with safety and Ammus and others about how unrealistic that is. If you really expect people to be able to heat and cool and drive and have things brought to them on trains and trucks over the next 50 years. The idea that we're going to do away with fossil fuels is almost unbelievably naive and almost sadistic in the sense of what that would mean for people's standard of living. And what we really mean is people's standard of living in the third world. But this demonization of oil is real. And I think that this idea, well, it's your patriotic duty. Who cares if you have to pay a little bit more at the pump? We're at war. Well, actually, no, we're not at war. Russia and Ukraine are at war. Last time I checked, the other thing that irritates me, Bob, is that the Bakin shale formations up in sort of along the Canadian border up in the North North Dakota region of the United States. This is a little known fact, which was not trumpeted at the time, but back in 2013. As we were really starting to realize what the Bakin shale formation meant in terms of just quantities underneath our soil, the Obama administration, the energy department put out a press release that basically said, you know, we got about 60% more oil than we thought we had. We meaning within US borders. So now shale is not as good. It's a little harder to process and turn into usable oil and then into refined gasoline. But you know, this idea that we have to be dependent on this chaotic world supply is just nonsense. I mean, as a factual matter, we have enough oil and natural gas within the United States to be utterly self-sufficient and still export. Now, I'm not an autarkist. I think we should get oil from wherever we can get it cheapest. But this idea that we're beholden to geopolitics because of this, and so we need to move away from fossil fuels towards so-called renewable sources because of the sort of the dirty politics of oil, it just isn't true, Bob. Yeah, I'm glad you hit that point, Jeff, because that's something that I, as you know, Jeff, I spent several years working for the Institute for Energy Research and got hip deep in this stuff. And that was one of the eye-opening things to me. And again, folks, part of it is just the technological innovations of perfecting both fracking and what's called horizontal drilling, you know, where they go down and then they can make the pipe go horizontally and go find the oil deposits that way. And so those two, the interactions, those things, I mean, U.S. natural gas production like basically doubled over the course of a few years. I mean, just to give people an idea of just how significant that those innovations were in the industry. And that's why the situation changed so much. And there's assessments of things, you know, like especially if you consider North America as a whole, looking at just the fossil fuels they have and just, you know, standard industry estimates, even relying on government estimates, as you say, Jeff, you know, the Obama administration, so this isn't something you got to go to the Heritage Foundation to dig up. And I mean, there's, at current rates of consumption, there's literally centuries worth of coal, natural gas, oil, and so on. They're varying degrees of being able to be developed. And so economically it doesn't make sense, you know, if Saudi Arabia can bring a barrel of oil to the surface more cheaply than they can in Alaska, then you'd go ahead and do that. There's this notion that, oh, yes, the world is running out of oil and therefore, you know, we got to wean ourselves from it is wrong. You know what it reminds me of, Jeff? So this, I think it's not just the left, too. I think it's also there's some strands of this in the neocon wing on the right where they think that, oh, yes, how can we stick it to these Middle Eastern dictators, these people overseas is we got to make it so that we're not relying on their exports because that's the only card they have to play against us. So that's why at home, you do see there are some people like James Baker and so on, people that you normally wouldn't think of as a, you know, hippie leftist that are all in favor of a big carbon tax, for example. And so there's a movement on the right wing for a carbon tax. And of course, in their way, you know, they say, oh, we'll have to be revenue neutral and because we're smart and, you know, we consult with Arthur Laffer and so on. But I think that's partly what drives them is geopolitical concerns. But what's weird about that is it's they're saying they're hobbling US fossil fuel development in order to make us less reliant on foreign fossil fuel development in their eyes, which makes no sense.  You know, like they were making the problem worse than if they had just minded their own business. Well, the EV push is really something. I mean, obviously we know about the subsidies, but the battery issue is is really a problem. I mean, the range on these EVs, especially when you start getting into trucking, where they travel long distances, especially when you start talking about electric airplanes, where the range is going to need to be, you know, quite large, quite far. It really is something. Look, Eddie Rickenbacher, the flying ace was involved heavily in the automobile industry, the nascent automobile industry in the US in the 1910s. And at the time there were hundreds and hundreds of tiny manufacturers all battling it out to see whose car might make it. And they were very much, I mean, the idea of having it be battery powered electric versus combustion engine was very much an open question in the 1910s. No one knew which was going to win out in terms of affordability, efficiency, range, you know, marketplace preferences, et cetera. So this isn't something brand new and they struggled. I have a wonderful biography or excuse me, autobiography of Eddie Rickenbacher and they struggled mightily to string multiple batteries together to try to figure it out. And so this range issue has not been solved. And I'm not saying it's unsolvable, but I recently rented a big full size SUV, sort of like on that big Cadillac Escalade size three row thing, whatever.  I mean, that is really something that's a significant market advantage. And I don't know how far they're going to go. But what I fear with the majoritarian process we have in this country with everything going through Washington and virtually all environmental regulations now preempted and going through Washington that the climate change people are going to prevail. And they're basically going to start squeezing combustion engines with the cafe standards, the corporate average fuel economy across the range, across the fleet of a particular manufacturer's vehicles. They're going to squeeze that so much higher that that EVs will effectively be legislated into our lives rather than chosen by the marketplace. And I think we've already seen that to an extent. And I'm not down on EVs. They have instant torque. When you go from zero to 60 in a combustion car, that zero to 10 is much slower than 10 to 20.  And that's a market advantage, I suppose. But I fear that this war, this oil thing is going to be all sort of used as fodder for what I consider a very anti-market and very anti-human environmentalists left. Yeah, I agree with you, Jeff. And I'm glad you emphasized that it's not that we are saying, oh, fossil fuels are good and wind turbines for sissies or something like that. It's let the market decide. And yes, there's pros and cons of the various technologies. And in certain areas, for example, little niche markets where it's really windy a lot. And so, yeah, the wind turbines make a lot of sense that, hey, nature's doing it automatically for you for free, as it were. And you just got to harness it. But there's downsides. So with electricity production, the wind doesn't always blow, the sun doesn't always shine. And so that's a problem with winded solar and why you need so-called dispatchable energy sources. And that's why even places that rely heavily on so-called renewable energy sources still have back-up natural gas generators, for example, just because there's times when the city's needs cannot be supplied purely from those sources. And I say, Jeff, with vehicles driving, that say what you will, but gasoline, it's a very dense, energy-rich liquid. And it's just a very convenient way to power things. And the other thing, too, is it's not merely solving the battery issue, but then just getting the infrastructure in place. So it can't be that if everybody had an electric vehicle tomorrow, there wouldn't be enough charging stations.  And so it would take time. It's sort of a chicken and egg problem that people can't transition too quickly into all having EVs, unless the infrastructure to recharge them for long road trips also goes along with it. But you're not going to build a station that caters to EVs when the market doesn't have that many right now. So it's that sort of issue as well. But again, we used to have a horse and buggy, and then we switched over to automobiles. And the joke I use is it didn't take a manure tax to force everybody to switch over from this silly technology of relying on horses and how dirty that is to driving cars. People voluntarily did that and the market switched over of its own accord because it just made a lot more sense. And so likewise, when it it's interesting, Jeff, I don't know if you've noticed this in the energy debate where the advocates will tell us how great and how cheap, you know, electric vehicles are and everything. And oh, yeah, they passed the market test. Don't listen to those old fuddy duddy conservatives who are warning about economic pain. They're always, you know, the sky is falling. And yet it's critical that we have all these government policies like a huge carbon tax or outright mandates on the percentage of renewables to force people to use the technologies that they're telling us already passed the market test. So it's like, well, you're actually admitting no, they don't pass the market test. And so of course, you know, they'll bring up the Trump card of climate change and say, well, that's the wild card that doesn't actually, you know, people aren't taking it into account. But still a lot of this rhetoric it when they so even I guess one by point is even on their own terms, if they're admitting that the government is going to have to force us down our throats to get everyone to switch over to wean us from foreign oil, especially from that dastardly Putin, then if people need to be forced to do it, it's because it's less convenient for us. You know, other things equal. And then so that's going to be painful. So you might say the pain is worth it, that the cost is worth it. But still, I think it's very disingenuous when the left often tries to bill it as, oh, this will create green jobs. You know, as if like, it's the government just outlying the way we do things right now is going to make us wealthier because now we got to have all these workers adapt things to the new requirements. And so I mean, if that were true, the government could just randomly ban. Hey, anything that's purple, you can't use anymore and look at all the jobs they'll create as we make things now that aren't purple. So that's I just picked that because of my shirt. So, you know, that that's the level of the economic illiteracy that we're dealing with here where something that causes us to work harder to get the same result is is viewed as good because it creates jobs. And no, actually, economic progress occurs when we get more stuff or the same amount of stuff with fewer inputs. That's that's what efficiency actually is. Well, I wonder how we might more localize energy production and energy source. I mean, that's that's the libertarian argument, I guess, against big corporations and far away fossil fuels. In other words, oil needs to travel from places where it can be found and brought out of the ground more cheaply to places where it's needed for cars. So oftentimes that means pipelines, oftentimes that means ships. So oil, the oil we use sometimes it comes from the US, but it also comes from from vast distances. So if you take a country like Mexico, Mexico has vast oil reserves off its shore, and it could be a very wealthy oil exporter. You know, like the Middle Eastern countries, but it's expensive to get that oil up out of the seabed. So that's that's a big process. And Mexico has basically a state owned and operated oil company called Pemex. So it's in the sense it's akin to the old Gazprom, which was in a very cronyist way privatized in the former Soviet Union. But so you have these companies and even the ostensibly Western private ones, the big oil companies, which have to deal with so many countries and jurisdictions. And then they have to run these pipelines across so many hundreds or thousands of miles or even under the sea, that you get into all kinds of libertarian property questions of eminent domain and, and, you know, problems like that apart from, you know, the environmentalists don't really love that, although I think pipelines are generally not bad for wildlife. So you get into all these kinds of questions and you start to say, well, isn't it a little strange that I need to run my car in Phoenix off of oil that came from so far away? And I suppose it is a little bit strange, but the thing here is some libertarians argue that, for instance, nuclear power wouldn't exist in a truly free society because although nuclear power is pretty green and pretty clean, when and if there is an accident, the harms from the radioactive fallout are so great that the nuclear power plant could never pay or even insure itself against those harms that it would inflict on society. So in some sort of Rothbardian tort system of regulation, you know, the costs, the potential costs of a, of a, you know, problem with a nuclear plant, a meltdown or something like that would be so, so high that you couldn't even insure against them and thus no even super huge firm would ever grow to the size where it would undertake nuclear power. I wonder, Bob, if there is an almost libertarian case against the fact that we have, you know, become, become so dependent, for instance, on the Middle East, you know, because of our anti-environment, our anti-drilling and also our anti-refining attitudes here in the United States. In other words, we want oil, but we don't want it in our backyard. Like, if you go down to Romp, also in town of Lake Jackson, Texas, which was basically started in swampy Gulf, Gulf South Texas by Dow Chemical, a place nobody wanted to live, they created a bunch of chemical refineries and oil refiners because that was considered kind of a less desirable place. And so, but today it would be very hard to create a Lake Jackson, Texas, almost impossible, I would argue, within the United States. So because of our attitudes, we sourced a lot of oil offshore and we don't, we refine a lot of oil offshore. And so as a result, we end up with this unbelievably Byzantine patchwork of global oil production. And that makes us a little bit more susceptible to wars, for example, and, you know, just to supply chain disruptions and transport disruption. So it seems to me that we've had one market intervention on top of another, all the layers to the onion that have gotten us to this point. We're in the United States. I mean, why, why couldn't we have oil that we use in our cars come basically from the nearest state and nearest refinery in the US? Yeah. Yeah. Good point.  And he said, well, that's partly because of regulations that prevent us from, you know, having pipelines. Like it's a lot safer and cheaper. So, you know, if we know it's got to go from, you know, somewhere in Alaska down here to a refinery south of there, then we just build a pipeline. But if, if for various reasons, because of concerns about the wildlife, you can't do that, well, then you got to put it on a ship and or similar thing with, you know, the keystone and so on that it's not that Canada is just going to say, oh, okay, I guess we're going to get out of the oil export business. Well, no, if they can't just ship it directly, then they're going to go ahead and, you know, go east or west with it and then load it on ships. And then they're going to take it down and then it'll get unloaded at a dock somewhere and then it'll get put on, you know, so it's, there's ways that it gets moved around. And, and yeah, just banning one particular method like a pipeline really doesn't, you know, doesn't, doesn't keep the oil in the ground the way that some of the activists think it will. And it ironically makes it more likely that there's going to be spills, just they might be in a different area. And you're right too, Jim, I don't want my remarks to be construed as a blanket endorsement of that keystone project because yes, there were some issued genuine libertarian issues of eminent domain and you know, they were going to go through and seize property from people that weren't giving consent. So I'm not, you know, rah rah about keystone per se. There's there's some genuine issues there, but certainly the the attitude of people saying no more pipelines because we got to get off of oil. That attitude and even if you were to push those policies through that doesn't therefore mean we're not taking oil out of the ground and using it just as you say Jeff just making it move around a lot more and increasing the likelihood of there being an accident. Another thing to just to add to all the different issues you you raised is I know for example like in California, they can't sell the same gasoline and nerve stations that they sell in Alabama that they're you know they have environmental regulations in terms of the quality and so you need refineries designed specifically for the California market and so that again that's part of this. What's making this this this market so discombobulated and having things getting shipped around that you know something on paper might make more sense like how come we don't just have a go from here to here. Isn't that easier, and then they can't do that necessarily because of these regulations. The question now is what does this mean for Biden. I mean I have to agree I saw that the MSNBC article yesterday said oh no these Republicans are trying to put this on Biden and it's Joe Biden's fault that fuel prices have gone up but as you were saying you know even before this this conflict between Russia and Ukraine. They were already talking about an energy crisis in Europe. I think oil prices per barrel were going up even towards the very end of Trump's term so I think that's that's true in a sense that this. This isn't Biden or his administration is doing I mean he can't control world events but what he can do is affect the regulatory environment here in the United States and I think we all know that he's not going to be pro oil or pro refinery. Right yeah I mean let's also not forget to mention the Federal Reserve and you know European Central Bank and other central banks to they certainly have contributed a lot you know without the torrent of monetary inflation they unleashed during the covid scare that that certainly has something to do with I think this this huge upswing and commodity prices. And you're right so it's it's not that Biden is responsible for all of these direct causes it's more you know what what steps could he take to alleviate the problem and certainly he's not doing those like allow for more US production. And then you alluded to it earlier we didn't really discuss it but like Elizabeth Warren coming out and you see a Robert Reich and all the familiar characters are using this opportunity to see the big oil they're just using this these events as cover to jack up prices and pad their bottom line and that's why we need a windfall profits tax. So just in general. Even if you thought that were true right so even if you thought that oil prices are set by the whim of the of the oil companies and they just wait for when people are going to believe a cover story I guess that you know in other words if big oil had jacked up prices to four or five dollars a gallon a year ago people would have balked but now that there's a situation in Russia they can go ahead and do it and people I guess are going to foolishly pay these prices even though they wouldn't have a year of I mean that's kind of the implicit model that these people have when they say they're you know the companies are taking advantage of this situation. But even if you thought that were true. Okay so yeah let's say big oil is this big greedy monolith and they just wait you know to stick it to people when they can how is imposing a big tax on them going to help anything right that it's. Taxing a company doesn't make them want to lower their prices especially if you had a model that you know this is this company that's very greedy and it uses. Events in order to jack up prices why wouldn't big oil say well we just got hit with this huge profit tax from Elizabeth Warren so now we got to pass it on to the consumer. And raise prices even more right so even in her own worldview it's not clear to me how raising prices raising taxes on big oil is supposed to help the little guy.  But beyond that I'm just not sure that Americans understand the extent to which let's say $10 per gallon gasoline would absolutely devastate the US economy and I'm not sure everyone understands how far flung.  That is car culture that people are so far apart and oftentimes you know inflation has driven housing farther and farther away from work center so what they call the inland empire in Southern California for example along the 15 freeway. There are lots of people who live out there because well up until recently not so much now up until recently you know you could get a house out there for maybe 400,000 or 500,000 instead of a million. And so those people drive huge distances every day oftentimes in their commutes to go to work and pay the mortgages on those houses and it's this is not something that people ought to be taking lightly or say well it's just a it's just a minor cost for most people. The less money you make, the greater percentage of the money you do make is spent on really basic things like gas and groceries and rent. And I don't know how the Democrats turn this to their advantage because I'm not sure that they can control where gas prices go or tamp them down between now and the midterm elections and I'm not sure that their narrative is going to work. I mean Americans like the idea of green energy. I think Americans in some senses due to propaganda like the idea of electric vehicles but they don't like them that much. I think this is this is a real problem. I'm actually very very worried about what this might mean for average Americans because everything you get everything you buy everything you consume at Target got there on a truck at least on the last mile. It may have been on a train it may have been on a ship it may have been on an airplane but you know the last mile was on a truck running diesel and I don't I don't know how you reengineer. You know transport in in the US quickly enough to electric or anything else to deal with $10 a gallon gas. Yeah I mean you're exactly right and unfortunately you know some of these people who have designs on you know a different vision of the future. They don't like the American way of life. They want people not going out of their house you know just staying in their own little cubicles and plugging into the metaverse and getting all their products you know delivered with Amazon. And even there I appreciate that still the Amazon trucks are running gasoline so that's or diesel so that's going to increase the price there but yeah I think there's I mean there's there's been a war on as you as you know Jeff I'm sure like on the left there has been for decades this notion that the American automobile represents you know a crass American capitalism you know consumerism and oh individualism you you think you're king of the road and you get to go with you instead of rubbing shoulders with the with the unwashed masses and man in terms of you know subways or something that for some people. The idea that this is going to permanently wreck the ability of people to have their own vehicle and take their kids to soccer practice and whatever they're going to think that's a good thing you know and so. I think it's a feature not a bug unfortunately for some of the people that are in positions of influence so some of this stuff it may be that the that that's what they want to have because it fits in with things they've been pushing for a long time anyway. Well on that pessimistic note perhaps but we're realistic effects we will tell you the cold hard truth here on the human action podcast we will wrap up this episode. So thanks everybody for tuning in and we'll monitor these events and Jeff and I will be back soon with another episode to keep you up to date. Catch Jeff and Bob next week for another show but in the meantime you can find a world of content like this at nieces.org.


Former APC chiftein Ahmed Gulag's murder has caused a stir across the country with reactions from different quarters. Despite the police report indicating the eastern security network, the emo state governor has come out to debunk the police findings, insisting that it was politically motivated. Osareghe Abon x-rays the controversy surrounding the killing. On the 30th of May, a chiftein of the all-progressive Congress and former aide to past president Goodluck Jonathan Ahmed Gulag was shot dead by gunmen in emo state. His killing came as a shock to many Nigerians. Barely 48 hours later, the police in a statement said Mr Gulag's killers were traced to their location within emo state on Sunday where they were shot dead during a gun battle with police operatives. The police report also says that their salons were members of the eastern security network or IPOB. So far with investigation, even if these persons have been killed, the investigation points to the ESN and IPOB. Reacting to the news, analysts have raised questions concerning the death of Ahmed Gulag and the quick reaction of the police. Some have mentioned it could be a political assassination. I'm still watching the development as a person because the first reaction we had was that the police had killed the person. Then we also got from the emo state governor that some arrests had also been made. Because if it was conclusive to say that all the assailants had been killed then that would have raised questions. Why would you just kill all of them under clues of matter? We need to move. The Nigerian police has not moved away from the rude and crude way of conducting investigation as is being done in other clients. I expect them to use forensic to conduct this investigation. The use technology tracks focus in the subpoena forms and messages and stuff like that and not rushing into conclusion. With the emergence of the police report, the IPOB has denied involvement in Gulag's killing, saying it has no reason to kill the former aide to good luck, Jonathan. If you are being accused, you have a right to say your own mind. You have a right of denial or acceptance. But it is a responsibility of the police to actually show unprovertable evidence to prove that IPOB or its other arms is responsible for the killing. He is of no threat to IPOB. So I wouldn't see why IPOB would have a hand in the killing of Ahmed Gulag. I think this idea of trying to rush into judgment and conclusion whenever this happens sometimes misleads us in the direction of our investigation. While further details are being awaited, they have been caused from eminent Nigerians not to ethnicize the killings. Osaugi Ogboa, Plus TV Africa.