Hey folks, Adam DuPay here and today we're going to be looking at the Poneble.kr challenge flag. So this is an interesting challenge and it's definitely one that's outside of my wheelhouse. This is going to be a little bit more of a walkthrough because I've already solved this challenge but the actual solving of it took me a lot longer. So let's dive right in. So the flag, you can see it's worth seven points so this means it's probably more difficult than ones we've seen so far and let's see it says Papa brought me a packed present. Let's open it. Download the executable here and interesting and the next line actually goes to further this but it's clear it says, I mean there's no FSH, it's not saying this is running anywhere, this is saying that this is a reversing task, all you need is the binary. So how should we at CTFers look at this? This means that the flag is somehow hidden inside this binary and we'll need to figure out a way to extract that binary and that extract the flag just from the binary so I already have it here. So whenever I'm faced with any kind of reversing task like this I first want to understand as much as I can about this binary and really what you're doing here is you're just trying to, the goal here is just trying to get more information as much as you can about what is this binary and what does it do and so the first thing I always run is the file command on any type of unknown binary. This is a very good habit to get into on any type of CTF challenge is just what what are you looking at and it's important to know about how file works so if you don't know how it works read the man page. Basically it's reading the magic bytes of the file and telling you information about it. So here we can see that flag is an elf 64-bit executable. It's been statically linked which means that libc everything is all contained within flag which should mean that it's a pretty large 328k so it's a pretty large binary and we know that it's been stripped so this means it won't have any nice debugging symbols. Also interesting in terms of thinking about the idea behind this ponible.kr here's our first look at a challenge without c code so we're going to have to be exercising our reverse engineering and our those type of muscles so the first thing I always run is flag and the next thing I always run is strings so strings if we look at the man page it basically it's incredibly simple it just scans through the the file and it looks for ASCII strings of a minimum of a certain length so it just looks for ASCII characters I think at least four characters long or an option and we'll show it to you so I love running strings on a binary because it tells me it it lets me know so what you'll see is you'll see a lot of the UI elements will be strings in this in the binary that come out and what you can do is you can look for that in the program so you can kind of get a feel for what the program does without even running it so strings here let's see so you just kind of have to take this with a grain of salt you're really just trying to get a feel for what's here I just kind of spaced through it and yeah we got a lot of weird stuff in here I'm not trying to read everything I'm just trying to let my eyes a little bit relax and just kind of like see if anything pops out of us so nothing right away ooh let's see our temp these could be stuff from libc so we have to be careful about not you know having too many preload yeah a lot of these are probably the linker libc that sort of thing so I think we may have hit the usefulness here oh that looks like to be some text ah interesting uh proc exec pro right fail interesting thing here info this file was packed with the upx executable packer hmm one thing to look for once you run strings look for flag and maybe see if we see anything I mean the other thing we know there's been a lot of smiley faces so search for smiley faces see if there's anything in there and presumably there's not I mean but you always want to you never know I mean this comes up in ctf challenges sometimes with forensics when they give you some tcp dump or some kind of crazy dump and honestly a lot of times you can solve that just by grepping for the words flag okay so that didn't show us anything so it looks like this upx thing is interesting um so it's some kind of packer and a packer what it essentially does is a packer will go in and um you'll give it your binary and it will take that and pack it and basically dynamically unpack it at runtime with all kinds of crazy obfuscation tricks um so this seems to be rather than necessarily a static reverse engineering where you have the binary itself and it's just complicated um it looks like we may have to do some dynamic stuff here so let's so the next thing I do so I run file I run strings and then I execute it to see what it does um so here we see it outputs I will malloc and string copy the flag there take it interesting and the other interesting thing is if we pop this through the flag so we actually do not see this string anywhere in the program um and so presumably so it's telling us that it's going to malloc the code and then it's going to try to string copy the flag there so the other thing I always like to do is to run the binary under L trace so L trace will hook all of the libc calls that will give you all of the uh libc calls that the binary is making so I can run L trace and uh that's the wrong way so it says it can't find dynamic symbols or dynamic strings and here this actually makes sense if we remember um if I had remembered oh of course this this um the binary is statically linked so it's not using the dynamic system call so we can't use um l trace on a statically linked binary but we can use s trace so we can see the first thing that happens is uh exec the e so this is our shell executing this it does some memory mappings it then reads the link to slash proc self exe which is interesting um it then is calling mmap so we could try to figure out what all these calls are um it's calling m protect on this memory region at what is this 400,000 it calls nmap again calls m protect again with this 6c1 um calls nmap m unmapped that's interesting unmapped stuff it calls uname to get the uname that's interesting uh it calls brk so presumably this is the call to malloc so it's telling us that it's going to call malloc and it's going to copy the string there and we can actually so brk is what's used so malloc is a libc function and malloc calls brk to actually allocate heat memory from the operating system so you can look up the man pages for all of these fun things to learn more about that then it calls arc protect arch set fs another break another break um then it calls fstat so fstat on one um it does another nmap and then writes out one i will malloc and string copy the flag so this is the right and then we have exit group so um it took me a long time of messing with this program but one of the things um i want to do here so now what i want to do is i want to run it in gdp right just to kind of get a sense for what it does um so we can see it runs we can run it totally fine um but actually debugging this is a bit of a pain and so we can actually boot this up and look at the disassembly and hopper so hopper or your favorite disassemblers so this will give us an entry point where it's going to first call this function and um hopper doesn't understand that this is code or a procedure um so i think all of this is probably code um so and this is probably some kind of a procedure anyways i had to play with around with this for a while but it's going to call in there it's going to do stuff it's um essentially what we're looking at here is the output of the upx packer so one idea would be to look for a upx unpacker i'm sure those exist online run it on here something that gets that uh the other thing it would be if the we know the flag is in memory at some point well let's just break point um somewhere and try to hook that try to see what the memory looks like at that place to try to find the flag so one thing we can do here is we can break on right the problem is that right function is not defined and the packer is actually somehow this code is encoded in here and it's going to unpack it at run time so even us just trying to hook that right function in libc is not going to work but there actually exists a nice way gb break point on syscall we know because we ran it in ftrace we know that it calls let's go up we know that it calls exit group and we know that it calls right so we can actually gdb and this actually is something i didn't know about gdb until this challenge and this is why doing ctf and ctf challenges is so fun because you get to learn things as you're as you're trying to break these things so i believe it's catch exit group is that right let's see gdb so always read the help help catch uh okay so catch syscall exit group catch help catch oh i misspelled it spelling okay good so now we have a catch point so now we'll break when it calls exit group so now here we are we've broken right before the program is about to exit which presumably means that the flag is somewhere in memory so what's the so gdb has this find command to look through memory but we kind of have to already know what we're looking for so one nice thing that we can use is we can create a core create a core dump so core dump writes out the current state of memory registers everything so that you can debug it later the good news for us uh file man exit yes i want you to make a core dump gdb create core dump so there's a way to do this um oh interesting huh interesting so you can just write out raw oh i did not know that see that could come in handy generate core file there we go so we can do learn more about it help generate core files save a core file so we can do generate core file um flag core can't do that without a process to debug want to generate this core file there we go okay and now if i run file on flag core i will see that it is a um interesting so it's l 64 bit core file so now at this point the binary has been unpacked so i could look at the main file and try to read what's going on but i know that i'm just trying to get some strings out so if i run strings now on this flag core i now should get the the output after the upx unpacker steps in so we can see hey there's core there's flag uh this sounds like a delivery service i will something and we can see we get a bunch of junk in here so one of the things to do is presumably we can use our knowledge that all of the other flags have been pretty long um so i can maybe set it to uh it seems not enough 13 maybe 15 would give us some nice ah there we go so what i would start doing is start trying things as flags so the first thing actually things is this sounds like a delivery service this looks like the flag right so you try this you'd find out that it failed it would be very annoying and you'd look through more and you'd look for more more things and more flags but you'd actually see this upx dot dot dot question mark sounds like a delivery service and that actually looks more like the flag because that actually makes sense so we put that in and we should see that this is the flag and we should be very very happy at this point um so this was a really interesting challenge it got me to learn about how to break point on system calls in in gdb and how to use gdb for all kinds of fun stuff so it's fun to always play with these unpackers because they make you learn more things about how these tools work so there you go this is how you break the flag challenge of pwnables.kr see you folks later


How dare you ask me to cook and clean so they don't want to cook or clean? Sometimes you'll meet a woman that'll say, I don't mind doing any cooking or cleaning.  She's cleaning up. She's looking at you.  She's keeping score. And so this is a violation of the social contract because they're entitled to your meat, which you can measure. Then she tries to couple this with equal partnership. You're literally giving up tangible resources to her if you actually measured what you get back to her. I can almost guarantee you it's a 90-10 relationship. You give the most, she gives back very little.


What's good, Josh? More Ross back again with another video. So I'm literally just getting home from the homie dub and Nisha's teen year anniversary wedding of our renewal ceremony, just getting home from that. It's like 118 in the morning and I'm chilling.  So I'm kind of cruising, you know, I'm I'm listening into some R&B, just vibing out, not not even really thinking about anything other than getting home and, you know, just kind of relaxing, winding down, of course, some videos for you guys. And I see this Mustang and this Audi like race past me. Now, you know me. It don't take much for me to get a little itch for the need for speed. So I'm like, all right, let me put my baby in sport plus mode and I'm going to try to catch up to these guys. So I ended up catching up to him and I want to say the Audi from without from where I was looking at look like he was winning and I'm a priority. I think I have the footage of that from the dash cam look like the Audi was beating the Mustang. So I'm like, all right, cool. What else, you know, I'm saying I'm not going to be able to catch up to him in enough time. Anyway, my exit is coming up. So Mustang keeps going straight. The Audi takes the exit ramp. I'm end up taking some right behind them. So I decided to catch up and I'm going to show you all the footage from the dash cam and I just want y'all to be the judge of how things played out. Honestly, I thought I was going to lose to this particular audience. If y'all know what particular audience this is, I'm not well versed in all the audience like that. If y'all know which one this is, comment down below. Let me know from the dash cam footage. But I will say this, I thought I was going to lose. But I surprisingly, I didn't. And God was a good sport, too. We we we did a couple of runs and I'm going to let the footage speak for itself. But yeah, y'all, y'all let me know what type of Audi that was because not gonna lie to you. My baby, she did a thing. She showed out tonight just randomly, by the way. In footage, you seen it? My baby did a thing, man. My baby did a thing. The one thing I will say is I was trying to make it as fair as possible. So when I'm doing the three horns, like the three blowing of the horns or what not, I'm trying to make them as spaced out as possible so they can kind of time it, you know, as well. And I even allow them on one of the runs to blow the horn themselves. I barely even heard it. And they were ahead of me of just a little bit. So I just wanted to see what I can do when they they have that advantage of obviously knowing when they're going to press the horn or when I want to make it as fair as possible.  But my baby hooked and she was able to catch right back up. So that was pretty cool. And they were cool sports about it. We gave each other the thumbs up and we went on separate ways. I think there was another car that was recording this too. So it was cool, man. That was a cool, cool little moment. I like those little moments. It's not too much traffic. You end up seeing somebody got the need for speed to you know, you have a little bit of fun. But that was that was a good way to end off the night, man. So yeah, more car content, impromptu car content if I catch on my dash cam. I definitely will be posting that for you guys. And I know some of you guys like the dash cam footage of being, you know, sometimes getting into the need for speed type situations. So being able to look out for that this year, some more car meets are also on the way. I think I'm going to be trying to do a cars and coffee event with my mom. And my mom is definitely one to show out her last last call challenger. She got a scat pack.  She loves that car. So I definitely want me and her to go to a car meet more like a coffee and cars type thing and show out our lips because, you know, hey, man, she got one of the last additions of the challenges, bro. In that moment is clean. So we definitely have a pop out. So comment down below. Let me know. You want some more car content? Appreciate all of the support you guys shown on the channel. I'm still young, speedy. You to listen to the world. Appreciate you. See you on next one.


ṯĂṁ ṢĂđāhara ab dhidwār ṢĂă pkĀ أ Benjamin ṢĂđāhara ab dhidwār ۔ ۔ ۔ ھ Aur isco gle  blame  Rivers isn't seeing this mistake. జĂ ropolitan পরભ���jung & Williams স� leaks যারুઍ�保ском�, ড�rail�� downs উ  subjective, this is happening personally now so this government has Evolution ofcen  journey and saying byysis we что isis coming couldn't understand ive already lost a lot and has gone work ive already paid all the pensions to go to work ive already Bua ive already paid all the pensions to go to work Do Va ive already paid all the pensions to do ive is independent ive already paid all the pensions


What is going on guys welcome back to the channel critical overlord here So Jeepers Creepers were born that official news that are exclusive news that came out from them that big website They decided to put up for it ended up being the announcement of Emron Adams and Sydney Craven being in the film now a lot of you Were disappointed and you know, I guess I am a part of why you disappointed Not necessarily because I brought on the disappointment But because you already knew these people were gonna be in the film Not only that they actually announced the Wallace and get I think they announced Gary Graham too in the film Which again who those of you who watch me you already knew that so then for them to go out of their way to make a Freaking website that counts down to just have that simple announcement and you do get also another thing that I talked about I told you she had done you got your interview with Sydney Craven and And you know it was one minute of her talking about her character of Lane and talking about how Lane potentially actually has some connections to this area that the Creepers in assuming it's still Poho County So I'll get into that really quick to tell to share my thoughts on what I think that's about But you you got nothing else you got nothing else you got a new logo I guess if you care about that But you didn't get any any other cast mentions you didn't get any mentions of Peter Brook you didn't get any mentions of These other people that I've told you are in the movie, but what did happen after that was Cast members and crew members started posting images up on their social accounts and Timo actually went out of his way to post a picture of him with D. Wallace and Gary Graham There was other images that started coming out of the Creeper on set and I've seen your guys's comments about all of it I've seen you guys again continue to put reference Power Rangers the makeup isn't what I'm gonna be honest the makeup in these images that came out doesn't look awful It's the fact that is this appropriate makeup for a terrifying Creeper Depiction that's what I think the real big issue is hence why some of you are referencing Power Rangers And it's just like we need to see how it translate on screen also the Creeper does look relatively small But I know that the guy portraying him you know that image Yeah, we have to see it on screen the guy playing him doesn't look as small as that Isn't as small as he looks in these images or one at least one of them anyway Because I know someone made a comment about he looks he looks short The guy playing the Creeper isn't as short as that image might have you thinking he is So that's why we need a trailer. There's just a lot of Frustration I feel building with the lack of not seeing everything play out in motion with the trailer You're just getting these behind the scenes one-minute interviews You're getting steals from behind the scenes Nothing really in the appropriate context nothing in the appropriate lighting I mean Sydney Craven did share what I would assume is official steals of her character Lane in the Creeper's new house of pain and In the interview you actually do get to see footage of her Doing certain things around the set as Lane But jumping into what she could be talking about as relates to her having some type of connection to this area Because she makes a comment in the interview her character realizes. She's been here before So I know in the original film Tricia was said to have been maybe going through like a breakup of sorts Where she was in a rough spot with this guy Policy track-team guy or something dairy made a comment about I was just thinking maybe She was pregnant and let's say she gave up the baby babies older babies now returning to her Hometown not by in not with purposeful intent, but just by pure coincidence And that's why these premonitions lead her to the conclusion. She's been here before just throwing out there Maybe this is Trisha's daughter. Who knows because that 23 years ago, Trisha She's when they were on their way home. She just seemed like something was bothering her regarding that guy And maybe it was a little bit more than just a breakup. Maybe it was because she thought he got her pregnant and That's something she could have shared with her parents when she actually made her way home She could have had the baby for whatever reason the baby grew up out of the country and now the baby's back Assuming these people are actually gonna keep their accents that we're hearing that they have Insignis Craven's new interview. She's she's clearly got her accent But we haven't seen anything for the actual film to let us know whether or not these accents are going to be Altered or are they gonna talk as if they are from the States? It's just hard to make it out what is going to be only because we haven't seen any footage of anyone talking on screen yet so You know, that's that's what we got yesterday. I know a lot of you were disappointed nobody was really Wanting that to be it a lot of us also had the countdown still running when that news came out That came out before the countdown was over some like why is there a countdown? But the news came out before the countdown was over. Also, why are some countries having a different time for their countdown? It's just like nothing was on nobody was on the same page Nobody was on the same page. Also, it seems more than very clear now that this movie is not coming out next week See this how we didn't get a trailer. We didn't even get to know who the rest of the cast is we are going to just get slow increments of things coming out and it's gonna build up to what I can only assume will be hopefully a March 2022 release and They've had mentions in these email subscriptions that you can sign up for on 23rd day calm if the website is even active anymore where you'll get exclusive news Con competition invites other official announcements Just like how many of these things that are about to come out Do you guys already know about since I've already told you about it? And these things are not Official just because they've announced them. They've they've been official from your own crew members stating that they're in the movie All you did yesterday was just make an announcement about it The when it became official was when the people participating in this project were going out of their way to post it on social media That is that that is the point at which it became official. It became official right then and there You guys simply just made an announcement yesterday So for them to say that this is the making it official Yeah, maybe to some people who aren't aware of the things that have already been disclosed online prior to this announcement But a lot of people felt let down only because of the fact this stuff was already online and basically Already official they had already announced it themselves the crew members and other people involved with it Sydney Craven didn't directly say she was in a Jeepers Creepers movie But everyone who had participated in the project was interacting with her So her participation was already pretty much locked in. I Don't know why they only put out that but that's that's them You know in usual situations like this you would want to get ahead of these leaks that are already out there But in this case they I Seen a lot of you make this mission. They don't seem to care I guess they're gonna keep rocking with this mentality of dropping stuff that we already know Hopefully that's not the case But let me know what you guys think about this down in the comments section below haven't already of course Make sure you subscribe turn on postification and miss a video in the description I have links my social media accounts on my Facebook Twitter and Instagram you can message me there Of course, there is any movies news reviews I'm gonna cover in the future and with all that in mind guys. I will see you in the next video


Hi, this is your host Soplin Bhartiya and welcome to another episode of TFR Newsroom. And today we have with us Ori Bach, Executive Vice President of Product at Salt Security. Ori is great to have you on the show. Thank you so much. I'm really happy to be here. Yeah. First of all, congratulations for joining Salt Security as Executive Vice President of Product. As before this interview started, we were talking about, hey, what we used to do before that. So I would love to talk a bit about your background, your experience in the ITN, especially security space. So my career started in a way that's not necessarily original for somebody from Israel. It started in the Israeli Defense Forces. I was recruited into one of the technology units and the skill set that I acquired there was actually very attractive for the growing startup industry. And I worked for a number of companies that dealt with cybersecurity and risk management. And through that, I really became in love with great technology that can help companies avoid being breached. And I found that that is like a very powerful thing that you can do for people. If you look at the security landscape today, landscape is changing, workloads are changing. Where we run our workload is changing. How we run our workload is also changing. The whole developer pipeline is also changing. So can you talk about the evolution of security from the evolution of the whole IT landscape? I think that's a great question and one that's often missed. So I think the biggest change, if you kind of take a step back in terms of how software is being developed, that it's being assembled and generated more than it's been written. And with the use of AI, with the use of cloud technology and microservices, a lot of the work that's being done today to create software is creative work. It's assembling different things or asking different engines to build code for you. That is fundamentally changing security and in a good way because being able to use best of read components, being able to ask a machine that doesn't make mistakes, doesn't make human mistakes, it may have other limitations to write code for you is actually a great opportunity to build better software and more secure software. And now I would like to know what attracted you to join Sol Security? I've always been attracted to companies that deal with disruptive technologies and I think with Sol it's the first time that's actually more than one disruptive technology.  I think the world is moving to applications and APIs and Sol is really focused on solving the challenge of how do you effectively utilize APIs without taking on risk. The second really disruptive thing about Sol is the way that it does it, the very powerful machine learning that's being put to bear to take trillions, trillions of requests of data and coming up with a small subset of insights that help people manage risk. And the third reason I think that Sol is extremely disruptive has to do with the fact we don't treat APIs as just another attack surface. We treat APIs as an opportunity for better security.  All of the data goes for APIs. Any attacker must go for an API if he's attacking an application, if it's an API first application. That's a great opportunity to actually improve security and not just secure the APIs themselves. As Exeter Weiss President of Product, what is going to be your role at the company? I see my role as really making our vision into reality and our vision is securing the connected world, making sure that as people adopt APIs they're not slowed down by security concerns. And this is a real thing. A lot of cool technologies were actually used in a negative way by hackers and it caused the industry to slow down and put a lot of fences around their adoption. We do not want that to happen with microservices and APIs. So that's our vision. The way to get there is really my job, which is understanding the evolving threat landscape and it is changing. It's even changed the last three months, six months. Make sure that we are evolving our technology to meet the growing needs of our customers and for me it's all about the automation. Our customers are telling us something very simple. We're not looking to have people spend a huge amount of time on security. We're not looking to have manual processing. You need to automate this for us. You need to make it easy and the combination of all the technologies that we're utilizing I think makes that into a real possibility. Then a lot of things are manual. They also go on a back burner because something else takes priority and then you really cannot do a lot of things manually. So yes, automation is a key. Earlier you also mentioned AI and today one of the hottest topic is generative AI. People talk about chat GPT. Can you also talk about once again going back to your point of automation AI. How is AI, I mean we have been using AI in security for ages, but once again generative AI is new. What impact do you see of generative AI on security now? We can look at it from two perspectives. One is generative AI is a workload that you have to secure and generative AI as a tool to enhance security. So what does it mean for security in general? And then we can also talk about what is all security doing in this space. I think for security it means two things. One that you mentioned which is that anything can be potentially hacked and the guys on the other side, the threat actors are so smart and so innovative in looking at every new technology and trying to figure out ways to manipulate it. I think the biggest risk with AI is that information that was historically kept on-prem is suddenly going to the cloud as we look to leverage those powerful engines like open AI and others. So that's definitely a concern that customers are talking to us about and they want to make sure that they are aware of what data is flowing into those powerful gen AI engines and that that data is secured end to end. The other is an opportunity and the opportunity is this. Historically we spent a lot of time trying to educate developers and other people about security best practices and to a large extent we failed. People still open phishing emails. People are still using passwords that are easy to guess. They're doing a lot of mistakes. I think if I especially look at what we're doing by being able to teach AI and generative in AI to write secure code, we are actually able to significantly enhance application security. Can you also talk about how you're seeing the API security landscape evolving and also if you can also talk about in the same way, how is API security a little bit different from when we talk about security in IT context? API security for me is going through a natural maturity cycle. Like any new technology and it is still new for some companies, the first thing that happens is that those companies realize that they lost visibility. So they have great visibility into their legacy applications and they've built some tools to make sure that they're secure. But the move to the cloud and the move to an API first architecture essentially meant that they lost that visibility. So first of all, really what they're asking us, hey, tell me what I have. Tell me what data is flowing through it. Tell me how people are trying to compromise it. I am seeing some companies kind of move away from that and moving to a more mature place and say, OK, we know what we have. We understand the risks. Now we really want to minimize them. And the way to minimize them is to monitor that attack surface, find out your biggest risks and make sure that those posture gaps are being addressed. So we're kind of seeing that natural maturity and we're seeing people. It's not just a technology thing. People, practitioners on the other side, are starting to gain a lot of competency in API security. So we're meeting people that are actually really smart about API security on the customer side. And it's great partnership because that shows us that the organizations are taking API security so seriously that they're hiring smart people and telling them, you need to be my group. You need to be my expert about API security. You need to know how APIs are being exploited and how we can defend against that. You folks also come up with a lot of reports. And what we are seeing sometimes is that, of course, the threats out there is emerging. The most worrying thing that we often hear is the lack of preparedness. Very refined that companies were not even prepared. From your perspective, when you join Soul Security, do you think situation has improved? There's a lot of awareness. Or you still feel that, no, this is also the fact that security is not an end product. It's a process. It's a catch-and-mouse game. And you come from a major background. You know that the bad guys have to be right only once. Good guys have to be right all the time, 101% time. So talk a bit about the kind of gaps you are seeing and what do you feel is the reason where organizations are still not fully prepared when we look at API security? It's a great question. Look, I think the first reason to not prepare it is because it's relatively new. So they've built great practices along the years of other protector endpoints and others around how to protect some of their perimeter. And it's new and some organization, frankly, just lack the expertise and the program. I think with the economic situation that we've had in the last year, it also caused some people to maybe not try to expand what they're doing and just focus on the existing controls. I actually think there's a big opportunity here for cost savings. Because again, any data that has to do with an application that's written in an API first manner must go for the API. And that's actually an opportunity to get more visibility without needing to monitor a lot of places within the application. And on the other hand, I'm definitely seeing more awareness, more maturity. I'm definitely seeing people come to us and say, hey, we actually know what we're looking for. We understand attack vectors. We understand how our APIs are being exploited. We have specific concerns versus just telling us, hey, give us visibility or give us a list of best practices. I think that's a great thing. And I think as the years move along, more practitioners are actually going to get that expertise in the same way that web security was a relatively new expertise many years ago. And today, it's like something that's very common in the market. I always love to talk about, of course, technology is the easy part. People is the difficult phase to culture. How much role do you see, of course, security? We see the whole practice around DevSecOps and a lot of other practices, cultural changes are happening. But how much role do you see of culture change when it comes to improving API security? How much organizations are doing it? And as you're talking about, there are a lot of factors. Costs can become a big factor because in that case, security always goes on the back burner, other things take priority. But do you think if organization embrace a culture, then those things will be baked into their DNA and it will not be something secondary or something that is someone else's problem? I am seeing a real progress and maturity in the thinking of organizations. And the reason I think that engineering and developers are a lot more in line with security is because they're a lot closer to production. So we have customers that deploy code into production 40, 60 times a day. And it's very easy for somebody that does that to say, hey, if I do something wrong, there's gonna be immediate impact. So SecDevOps is definitely a practice that we're seeing take traction. We think with APIs probably more because again, the developer actually develops an API and that API gets deployed as is into production. That's different if you're just building like 5% or 3% of some bigger software. And we consider it part of our mission statement to really connect developers to what's happening with their APIs in production. And not just bad things, right? Give them that visibility and make them part of the ownership of making sure that that API is secure and does what it needs to do within the cloud environment. What is your advice to organizations so they can build some best practices so that they're also prepared for the next thread so they don't have to play the catch up game. They are already prepared for these kinds of things. That will continue to happen. I think the best way to look at preparedness for API security is look at it as a maturity model. And the first thing that you need to make sure that you know what you have. The most dangerous API, the API that's most exploitable is the one you haven't heard about. And that is actually a problem, right? Developers sometimes deploy things where the security team is not aware. Make sure there's no zombie APIs. Nothing is left out there that is not being managed from a risk perspective. So that's kind of a basic layers of any risk management program is to know what you have. Then I would say, look at the OS top 10. Look at the typical attack vectors that are out there and make sure that you have a good program in place. So what happens if one of those OSP API 10, OSP is the organization of course that manages standards for application security. Make sure that you have that basic framework in place. And then I would move maybe to a third level of maturity. How are you specifically being attacked, right? What would attackers do or are doing specifically to exploit your business line, the application that you put out there and make sure that you have special controls that put in place to make sure that you're able to counter them or in fact block them from ever even starting an attack. I think that's kind of the best practice. But taking steps because trying to move too fast is sometimes overwhelming. And you mentioned that put on the back burner, everybody's busy, developers are busy and they're not security people. Security people are busy. So just make sure that you kind of go through those steps and see the benefit in each step. As we were talking about culture and you also mentioned cost can be a factor. Priorities can be a factor. Talk a bit about how organizations like Sol Security make it easier for teams so that they don't compromise with security at the same time as folks like you. When you, as you said, your job is to keep an eye on what is the next step. Organizations cannot keep an eye on that because as you also said, they don't know the next vulnerability there. So talk about how you folks held them. So once again, these organizations continue to focus on their building, their business value, their developer continue to put their effort and time in building the business, adding the business value and you folks help them to secure their workloads, their environments. We see as part of our mission statements to improve API security, making sure that our customers are well educated, that they are aware of the threats that are out there. We both do this in terms of a training program and talking to them, but also automatically, our platform has components of threat intelligence where we're able to look at specific attacks. Recently, there was an interesting attack against one of the WordPress applications called WhoCommerce. And one of the things that we did was to make sure that all of our customers that are in that space, eCommerce, are able to see exactly when that attack vector is deployed against them and give them clear actionable steps in order how to mitigate that. And I thought that was great partnership because yes, it is hard for every organization in the world to educate themselves about every attack that's happening out there. So I think one of our benefits from our central vantage point as a SaaS vendor is to constantly be able to make sure that that information gets the right people. Ori, thank you so much for taking time out today and give us a great overview of the whole API security landscape. And I also look forward to a lot of more discussions with you around the whole API security. But I really, really appreciate your time with it. Thank you. Thank you so much. It was a pleasure. Really great questions. And looking forward to talking to you in the future, Assault itself matures and our space becomes even bigger than what it is today. Thank you.


Hello everybody, my name is Parfé Tokono and I would like to do some work on what we are doing. My university is about dual execution with a genome framework. It is not really related to micro-candle system but since we are working on the micro-candle operating system, I think it is worth to come and present something about what we are doing. So it will be essentially about how we can run and re-run a program or process in genome with a new technique that I will present to you in the following slides. So my presentation will follow this outline. I will give some introduction to the dual execution in comparison. After that I will present what the technique we are applying to the subject, systematic process element we play. I will also talk about some possible usage and advantages that we have with the system, how we play with genome framework and the current state of the work, performance impact, and I will end by some remaining work. So for the introduction, DWC as you go, dual double execution with comparison. The general purpose is to detect error and take action to recover. It is in the field of fault tolerance. This fashion of executing program may also be used for debugging software verification and hardware testing but in what we are doing, we are specifically doing it for fault tolerance. So generally, this double execution may happen in parallel. So there are other people that do it simultaneously but one execution is delayed with the first. But others can do it also in sequence. That is what we are doing here. And it also may happen at instruction level or at the set of instruction level. For what we are doing, we are specifically doing it for a set of instruction levels. But to make it detect error, each execution must be deterministic. So we have to play the instruction, we take it again, the same instruction of the same data in the same environment so we are guaranteed to have the same result. So we do comparison and see what if there was an error in one execution or not. So that is the basic idea. So other people have done something like that. You can see in the literature primary backup hypervisor based fault tolerance from results. Other virtual matching based security system that they call revert. And other questions of doing it are hardware assisted deterministic replay from Montesinos. They call it capo if you want. There are some reference that you can consult. So concerning what we are doing, the basic idea is to apply the dual execution to a set of instruction. And we also take in account some limit of time. That is our dual execution must not exceed some time limit. So we have to hold also this constraint. So to achieve this goal, what we are doing is essentially to modify the kernel of an operation system. In this case, we are modifying the kernel that genode use of x86 hardware that is NOVA. So we are modifying the NOVA kernel so that for each process, the kernel divides the process in short element, processing element that we call PE. We run them twice and make the comparison between each running result. So if the comparison is the same, the result are the same. So we consider that the execution was okay, they match. And we can proceed to the next processing element if a hardware error happens during one of the execution. So surely one of the execution will be different from the other and the comparison will not be the same. So we consider that there was a problem and we have to restart the same processing element. But also if there was an expected exception, so all we have to do is to restart all the entire process. So the three phases, first run, second run and comparison, verification and commitment, we call these three things operational transaction. That is the set of operation that have to be done or neglected. If it is not okay, so we have to restart the entire operational transaction. So for this fall of this to hold, the processing element must be atomic and independent. So we do all our best that there is no interaction with the outside world and no input output. We end our processing element at each input output that we have to do with the outside world. Every dependent, time dependent instruction because there is no way to run the same time dependent instruction that it will return the same results. So even we have to run this kind of instruction, we have to end our processing element. That has some criteria to fill our goal. The main thing happens, we have also to stop the processing element if the process makes some exception, page folder, this kind of stuff so that we keep the processing element. So short to holding the term. So in practice, what we have to do is to compare each processing element result that is the memory page that it modifies. So if the process modifies three pages, we have to compare the content of this three memory page and see that if they are the same. The same thing happened to the register that the process may have modified. So we also have to compare all the process related register. So for the following, I will present in the next slide how we do the process. For you to follow me, we will call EN, the Nth processing element that we will do. The first execution will be called EN1. And the second processing element execution will be called EN2. About memory pages, we will call PM1, the modified PM page during the first execution. And PM2, the modified page in the second execution. So how we do it? Before the first execution, we save all the registers. We also save all the memory page that the process can make modify during its execution. So to keep trace of all modified process page, we set all the memory page read only. And so that if the process try to modify the page, it will fault in the kernel and will treat this fault. So during the first execution, we try to construct the set of assessed or modified memory page. And we keep it in a list so that at the end of the two execution, we will make a comparison. We will do the comparison. Essentially, after the first execution, we also have to flush the cache so that the processor will need to fetch new data from the main memory. So that it will not be obliged to, it will not use data that it has kept in its cache during the first run. So that all the data he will work on will be fresh data. So at the end of the second run, we make the comparison. And as I said, just as I have just said, if everything is okay, we can proceed to this first, to this following processing element. And if there is a problem, we just have to restart the same operational transaction until there is no error. So I may recall that the error, I'm talking about data transit error or soft error that may appear in the CPU register. And after some rewriting in the register of cache, this error may disappear. So to do this work, it's happening that we will have to make, for each page, that the process will modify. We have to make three copies for each page. The same thing for the comparison. We also do comparison. And sometimes we notice that during its execution, the process may modify up to 10 memory page or memory frame. So we have to do all this comparison in the time limit that we must not acid. And also, yeah, we must also keep to the operating system to respect its service constraints about applications. So there is a lot of work to do in the kernel, but also real-time constraints must be met. So now this technique of dual execution has already been applied. The question? Yes. Okay. Are you really thinking the number of pages changed upon transaction, like if you trade, which is then are you going to stop the process and the process? No, no. The process can change its page. And yeah, when it does some specific accession, not related to our technique, so we will end the transaction. But if it is to start the process, we set up its page to read only. If its access is for this kind of page, there is no problem. So we will give this page back to it so that it can continue its work. So basically, this idea has already been applied to a simple process running on bare metal machine without any operating system in 1911. But there is also another work that another PhD student is doing to put this technique to operating system. But in general, what we are essentially trying to do is to try this concept on virtual machine support so that we will see if we can do all this stuff in the kernel while supporting virtual machine service. So one concern is about how we stop the processing element. We said that we have time constraint. So if the process release the CPU from its own, that's okay. From its own, that may happen when the process make a system call, for example. So we will stop the processing element. Or when it's false, it wants to access a new page that he needs the kernel to give it or the memory manager to give it. So we will stop the processing element. But if the process do a lot of work without releasing the CPU, when the time limit is exhausted, we also have to stop the process. And this we do it by issuing a timer interrupt so that we could hold in the time limit. So that is basically the idea of how we manage to make our processing element not exceeding the granted time limit. So when we apply it to genode, we are essentially interested in three questions. The first is, is it possible to do it like that for virtual machine running on a micro kernel system like that? Essentially, we will also want to measure the performance impact that this fashion of executing a process will have on this kind of system. And also, we will try to reduce, to shorten the granted time until we can find the maximum time that we cannot exceed. That is, maybe we'll find 10 microseconds. All our operational transactions must hold in 10 microseconds or maybe 100 microseconds. We don't know. So when we will be exercising the system, we'll find what is the maximum time limit that we can hold so that all the system may continue running normal. So basically that have three questions. Now, we cannot answer this question because the work is not fully completed. But we have some, we already have some results that give us some insight of what the system may be after it will finish. Firstly, we notice that the, that is just a chronogram showing how the process execution is going. So in the first time slot, we have a user process and at some time it will fall in the kernel or it will be stopped by the timer. And the kernel will take action to restart the same process for the second time. And after the second time, after the second execution finished, we also fall down in the kernel and we can take action to make the comparison and verification and commitment. So we notice that the second execution is shorter than the first execution. That is normal because after the first execution, we already know all the memory page that the process will modify. So during the second execution, there is no need to, the process will not have to fall also on this page demand. So we already know all the page that will be modified. So that is why the second execution is shorter than the first. So that is okay. But what we also remarked that the time we use to, the time we spend in the kernel during, between the first execution and the second execution is extremely long. Our measurement shows that we can spend up to 80% of the time doing some work in the kernel between these two execution. And after we investigate, we find that it's essentially about the cache flashing. Now our cache flashing mechanism takes a lot of time to finish. So that means that in the future work, we have to find a better way to optimize this cache flashing mechanism. So about some performance impact, what we are projecting to do is to run some benchmark after the system will be fully finished. But now, because it is an ongoing work, we cannot make the performance impact with great precision. So what we do is to approximate the normal genome execution with the second run. Since the second run is executed without any pay faults, it may be considered as the normal genome execution. So what we do is to take the overall time spent doing the same, the two execution, and we divide it by the second execution time to find the approximation of the performance penalty that we have with this kind of system. So that is the simplest formula we use. And we find that for the worst case that happens during the initialization system booting period, we find that the overhead could go up to 3400%. That is very, very huge. But if we remove the time spent in cache flashing, we find that there is more acceptable performance overhead. So when we remove this time, we find that the first execution can take only 40%. The second execution is about 13%. The restart time between the first execution and the second execution is about 13%, and the verification time is only about 28%. So with that, we can say that when we will optimize the cache system, there will be a more acceptable performance impact. So the same thing is when we stop, the old graph was when the process released the CPU from its own. But we also want to know if we stop the process with time interrupt, what will be the performance impact, and it is approximately the same. All the time was spent in the cache flashing, and if we remove the cache flashing, we have this kind of graphic, and the overhead is very, very less clear. It is about only 200%. That is two times the normal genome execution. So maybe I must also say that when we have to stop the process, since we don't know, when we stop the process, we have to know at which instruction it stops. So what we do now is to count the number of instructions. And for this, we use the instruction counter feature that exists in every CPU. For what we are doing, we see that the Intel instruction counter is not so precise, or there are some parameters that we must take into account to find the exact number of instructions. But if we use, instead of using Intel, if we use AMD, it is more precise. That is what we notice now. We are working on Intel CPU for now. And other problem that we have now, it is about some randomly page fault that happened after the system is fully initialized. We don't know how this page fault appear now, but in the future, we will also investigate those problems. So essentially, what we are going to do in the next future is to try to understand the page fault codes, optimize the cache flashing system, and try to finish the work with virtual matching support so that we can handle more heavy tasks. Last, I think, like running all his list scenario, we have Linux running in Gnode, running on a special Nova kernel, DWC feature of Nova kernel. So that is the current state of the work. It is not already finished, totally finished, but that is where we are now. So, if you have any remarks or questions, I'm at the end of the presentation. Yeah. Okay, thank you. I wonder about how do you handle a single event offsets in the kernel or in the verification? Single? Yes, he used the faults, trying to protect them. Yes, he used single event offsets. How do you deal with that in the kernel and in the verification mechanism? I don't know, get your single event. If you have an SCU in the kernel, you don't care about protecting application processes. So what if the SCU hits the kernel when it's running, not the application process? Now, what we are doing is only to support user-land process. After that, I think protecting the kernel will be, because we have all the kernel, we will introduce some redundancy code in the kernel so that we can make this SCU detection. But now, all our focus, we are focusing on user-process support. Do you expect that the modification of the kernel will be less big, bigger problem? So your focus is now on the bigger problem, am I correct? No, I don't think that this will be a big deal because now all the problem is supporting any process without knowing what the process is doing. But the kernel, we know the kernel, we know the code of the kernel, so it will be to make some special points in the kernel so that we can roll back and go in forth and back between the kernel code. That will not be a big deal, I think. These transients errors that you mentioned, how often have you seen them? Is it happening regularly or is it every once in a while? And should I worry about that as an application developer? Yeah, some studies have shown that this kind of error may happen with probability loss or poison probability loss, but that is why we are limiting in the time so that the time constraint is there to guarantee that there is only one error. Because if we have two errors, we cannot manage to see, because if we have two errors, the two executions may not be valid for comparison. So the main criteria is to have only one error, and that is why we are, we may be constrained by certain limits of time. Yes, this kind of error, they cannot happen regularly. They don't happen regularly, but in some time constraints, we may be sure that maybe for 10 microseconds or something, 100 microseconds, we may be guaranteed to have only one error. So in this kind of situation, we may use this technique to detect and correct this kind of error. Okay, thank you. Thank you. I'm wondering, have you actually physically observed some errors? No, not yet. So have you at least tried to inject some errors? Yeah, that is what we will do at the final stage. When we will finish, we will try to inject some experimental error to see how the system resists this kind of error. I have a related question. It's not from me personally, but from Jakub Jama, who is looking at the live stream, and he wants to know if you have looked into the hardware mechanisms for detection and recovery features like they do in the Solaris fault management framework. Are you talking about this slide? I don't know exactly. He just wants to know if you have looked into the hardware features to detect failures, like machine check exceptions that tell you about memory errors. Now we don't use this kind of feature matching check exception for what we are doing now. We don't consider this kind of exception. We are especially interested in accepting an error that may happen and the processor is not aware. We are interested in this kind of error that may corrupt the content of a register or a single memory path in the CPU without the CPU knowing that this kind of error has happened. But if there is some error that corrupts the system and the CPU may get the information via the matching check exception, I think that will be very easy to hold. Because for this kind of exception, if it is recoverable, it has not broken the CPU, it can take action to recover. But the kind of error we are interested in here is those soft errors that may happen without the CPU knowing that there is an error. Those errors, for example, SCU errors that may happen due to radiation in the space or those kinds of stuff. Because it is not a conference for space radiation, we are not going to talk about this kind of error here.


Hi to everyone around the globe. Good morning, good afternoon, good evening. Thanks for joining and spending your valuable time with me today in this webinar. Today I'm going to cover the topic of using frameworks to define problem space. And this is like a segue into the previous topics that I've done earlier in the webinar of product school. I've done about road maps. I've also done about product discovery techniques. And those things are mostly like strategic and looking at discovery techniques is really understanding the discovery process and what are the possible techniques? And today it's like I'm focusing on defining problem space. This is the most wanted topic. Either you work with UX, you don't work with UX. Either way, this will be extremely helpful because I'm imagining that all the product managers or to be product managers are going to juggle or juggling with a lot of tasks in a day. Meeting people, knowing things, discovering new things, hearing feedbacks, continuously sort of giving, getting user feedback, satisfaction, new requests coming in. A lot of things is happening in your day to day life. And imagine that you have to deal with a lot of product improvements, developments, optimizations on an ongoing basis in a large scale. And you're like, okay, I have like 25 things here on my table and I have to deliver all of this and I don't even know which one is creating the maximum value. So to really maximize your product value, this frameworks will be helpful to identify all of those 25 or 40 things what's really valuable for you to practice. Or I'm not talking about prioritization techniques, but really looking at, okay, is this a problem you want to solve? So I want to be careful with the terminologies I use because this is purely to understand you have a lot going on in your product. What is really the value you're delivering? Can you differentiate when some request comes in whether it's a problem versus something, they can just tolerate without that development being done in your product. So yeah, so that's what I'm gonna cover. We are not doctors, we are product managers looking at things holistically. So this is a very basic thing. You have 25 things on your table. You want to know how it creates value. Just take a paper and a pen, write down the problem statement. If that has come as a solution from your stakeholder already that they have thought through, just ask them what is the problem they are trying to solve. Where is this coming from?  If they don't have an answer, what that solves for the users in the larger scale of user groups, if they are not aware, they just know that many users are complaining about that maybe make a hypothesis that this will solve the problem from A to B and the value is going to be A to B. And also try to understand this valuable is only to the customers or also to the organization that you're working with, company, the brand, the product, what does it really help? So try to map out what the value is for the organization and what would be typical action points that you would take? Just launching a product list, launching a feature does not make your change successful. So you really need to understand is there like a marketing strategy that you have to go along with? Do you need to tell your salespeople to communicate this out to your users so they can start using? Do you need to work with internal stakeholders to talk to their users to make changes in the way they are working toward of this? So really understand the change management process piece as well. So you know that when you make this feature change that's really going to go along with other schemas attached to it. And the adoption prediction, that's very true because as I mentioned if the change management transition part is not thought through, what could happen is you could have a feature hanging there and then you could find out that they wanted it but they didn't have the capacity to use it for some reason or they had a different change of thought process. So you did not really thought of predict what the future is going to be like and then take that into consideration for your feature. So, and next one you'll need to think is how do we measure this? So that's truly important. If you don't define your KPIs what you're going after then how can you know whether you're successful or not? This is really to understand that. So just take a paper, those 25 pieces of things that you wanted to deliver now we send this format ready. Now you have everything on your wall or you have it on your mirror board or any other tool that you're using to list out all of these things. Now you're like, oh I have all of these things I don't even know where I should be spending my time. What will be really be useful? So Canon analysis really helps and that you have 25 items you sort of understand what you want to deliver. I would, what I would do is I would ask I would make my stakeholders or my user groups or the users actually sit in the room. I will be like all these 25 things that they want I would frame it in a question format like how would you feel if you have a reference point to this feature or function like referring to this reports how would you feel if you have this? They can say I would love to have it I like it I really or they would say like I expect to have it I totally dislike it or it can be anything. They can say that and you say that how do you feel you want to have it? They could come with one of those reactions and you can also ask them how would you feel if you don't have that in the product? You know, what would you do? And they would be like hey, I can work around it it's okay I have a neutral feeling to it or they could say like yeah, it's a complex work around but I can manage for a period of time it's sort of tolerate or they could be like this will frustrate me where I would leave my job and I would or I would leave your product and then I would do something else because this is not helping me. This could be possibly some reactions. So asking the same question on a positive side and a negative side would give you like a sort of a matrix where you can make when they say that hey, if it's not fulfilled yeah, I could still tolerate it and when it's sort of like when you ask them hey, like how would you feel that it's not, you know that's something you want to have then they say yeah, I expected to have then it's sort of like a customer delighter so you really sort of map it out across this matrix and then you see where the actual value lies is when they say that they dislike it in either way whether they have it and they dislike it when they don't have it and then when they say that they love it when they actually have it that's the area that you want to go behind and that's the actual value where it lies so you can use this framework to really sort of play with it and see where that is in the matrix and really sort of plays those 25 things across these matrix and be like hey, now I found where the product value lies now I have something I can do and this is one format or framework of actually analyzing it the other framework is basically like persona the empathy map, the persona document so why do we need to do this? If you go back historically 15 years or 20 years back we didn't have any digitalization we didn't have digital platforms we had everything sort of happening on the in person so we knew what they was going in the life when somebody changed we tried to understand why they are working with us why do they like our products why do they like our services there was a personal connection and when this digitalization happened we sort of like focused more on digital technologies giving the things to our customers somewhere that human connection is lost what if the person behind the screen has changed what if that person's motivation has changed what that person's ambition has changed we have not hunted at any of those we are just giving, giving, giving, giving without knowing any of these three things so this will really help us to understand where we are focusing our energies we have to understand their motivation we have to understand where they see themselves in five years down the line when they're using our products and we also need to understand how they feel about it are they feeling happy, have they feeling negative I think that's the most valuable thing so this will really help you in identifying some of those benefits and putting it in there and sort of mapping that to your 25 items that you have and you hear the user input about that the next thing is jobs to be done so the jobs to be done discovery frameworks is not something I'm talking about today I'm talking about really sort of mapping out your 25 items into like what is like the thing that you want to go behind so in that imagine that you have the 25 items the problem statement that you define now let's go on the value that you're delivering which means that you could say for example, like by launching this new wish list I am going to have all of these users interact with this feature and they would basically ultimately convert into a potential buyer for this product so this is an actual outcome when you write this outcome the stakeholders or the users could say how important it is to them and the satisfaction is something different and satisfaction as they can say like hey, you give me or you don't give me I could be satisfied I could remain satisfied or my satisfaction increases my satisfaction decreases it can happen in various ways so you give this 25 items as a value deliverable and you rate the importance as already defined by your business stakeholders in some way they have that in their mind but it's really a good activity where you give this out to your stakeholder group or your user groups to really sort of put it in their point of view what the importance is and what the satisfaction would be by doing that and you would see this template will help you or this framework will help you where in the importance scale then somebody says like hey, this is highly important to me but and the satisfaction is like really low that's an opportunity on the other side if they are saying the importance is very high but the satisfaction is also high irrespective of that you need to ask the tough question of why do you want to do it and sometimes they may say that the importance is like it could also be here high, low, medium they could say that hey, this is very important but then the satisfaction is really high already then I would say like hey, this is not something that's going to deliver the highest product value I know that that's going to deliver a value but do I want to do that now? No, there are better things for me to do so in the 25 things this is the excellent way to sort of prioritize so you can try this out another one is the battle cards this is helpful especially when you have like 25 items you know the features, you know the advantage you know the benefits that you're going to deliver to the business you're going to have the value of the customer taken into account and if you want to compare it to your competitors or compare it to your past experience sort of have that and then questions to ask is like more on the feasibility and scalability what you really want to do so this will really help you in sort of understanding are you going to deliver that value in the end or not because you're always focusing on like okay I have this done, I'm going to deliver I'm going to ship this this is better than my competitor, great but are you serving the right customers are you serving the right user groups are you targeting the right people an excellent example is in my previous company or in my previous job experience that I worked in an education technology side we wanted to do something like a marketing campaign for some users who are using our content to read books and we were like hey like let's do this let's launch this marketing content in the website where they're reading this content and stuff and when we really did a complete thorough research what we found out is the readers are always not your buyers their parents can buy, their friends can buy anybody can buy for them and these buyers are accessing the same content in a different way the marketing content in a different way so it turned out to be that the campaign could not be accommodated in devices like phones or iPads it was only more like web friendly and it was happening on the website where actually people read and they don't care because they are not going to be your buyer so where you wanted to launch that product marketing content or campaign was on a different location where these buyers exist so this was a very good research and an understanding when we completely think through end to end and when we ask the questions will this be something that people will consume at the end or will they adopt it at the end then you find answers no then you really need to start digging the value-based delivery that you want to do so this can be helpful either for your product one-on-one or against your competitor so yeah so this could be valuable and all of these frameworks are truly helpful if you have an understanding of your product and as I stated already like a high level sort of a you call it a PRD the product requirement documentation or your high level understanding of what the product deliverable is or initiative is, capability is it is termed in so many different ways but the idea is you need to have an idea and you need to have a goal strategy KPI value to the customer value to the business and then these frameworks really sort of help you understand when you have so many things happening around you around the world like things like disruptive things like chat GPT and stuff like that so how can you prioritize disruptive stuff new stuff, old stuff, happening stuff everything across in one board so that's what this frameworks will help you so that's it so thank you for being here today and this was a short session but I hope really helpful where you could get frameworks to understand how you could really define your problems is for your product and value is delivery for your product and if you do have further questions please feel free to ask me anything and here is my LinkedIn details and let's speak about what we have discussed and thanks for joining today and for your time bye bye


India is big its huge we are 1.3 billion and more population means more health related issues especially preventive health care. At the same time there is an opportunities for creating more solutions. If you look at the urban India today health care is something we just take in a backseat for so many people and the main reason is the hectic schedule and poor lifestyle. As per the current study India is home to 1 billion lifestyle disease incidents which is one of the largest in the world. Now if it is not taking care in timely manner it is going to develop a lifestyle-based diseases very fast like health related issues, diabetes, people are going to be obese more and more and high right hypertension. India has a lot of chai there's no doubt but do we know that one standard cup of a chai which is kind of a homemade chai is having 55 to 60 calories and we keep on drinking without even knowing it so if we keep you know three four cups of chai or four five cups of chai without even knowing we consume approximately 300 to 250 to 300 calories. Me and my partner Ravinder Parashar who has been we have been friends for last 14-15 years one thing that we found is not as per our expectation is basically the process of knowing calories is cumbersome. What if a person is just clicking the photograph of the food that he is taking and the result is done and the outcome is shown on immediate basis I think half job is done. The meaning of Calvary is verify your calories and the short form is Calvary. Calvary is a product which is based on the artificial intelligence and machine learning and computer vision which can recognize a food image and let you know what is your calorie intake and not only calories but at the same time it is going to throw the result of other nutrients also. Our focus is India. Indian food is it's very wide diverse and one of the toughest foods I must say across the world. There are thousands of varieties available in India and each food item each variety can be prepared in 100 different ways so it is very difficult to recognize our accuracy is more than 85% I must say. Our objective is not just telling people about their nutrients in take value but making their lifestyle better and making them aware of or encouraging them to have a healthy eating pattern.