Photovolphyzmography, PPG, is a simple and low-cost optimal measurement method that is often used to detect blood volume changes in the micro-ascular bed of tissue. It is non-invasive and can be used to monitor heart rate, blood oxygen saturation, and other cardio-ascular metrics. One-two, one-two. The principle behind PPG is that blood absorbs light more than the shrouding tissue, so by shining a light source, usually LED, onto the skin and measuring the amount of light out of transmitted or reflected, one can gauge the blood flow dynamics in the tissue. Here's how PPG typically works. Light emission, a light source, such as an LED, emits light that penetrates the skin. Absorption variation, the blood vessels absorb varying amounts of light during the process that correspond to heartbeats, which is affected by the blood volume changes in the micro-ascular bed. Detection, a photodetector measures the light that is not absorbed by the blood. This signal fluctuates in time with the cardiac system. Okay, let's just do a sound check quickly and we'll start in a sec. I don't have much time today, so I'll jump into development straight away. Okay, I don't have to monitor my own sound, my own voice. I don't like it anyway. And let's do this weekly. So I had that blog of the Reddit. I did spend quite a bit of time making it, but yes, it was generally generated by GPT-4. Yet that image is not great. Let me know what you think of the layout and the general structure, the language. Yeah, I was tuning it down quite a bit. I don't remember how many prompts. I can probably check. And we're doing another one on PPG. Someone was asking what PPG is, so we'll have a whole blog on it. And yes, I'm more interested in all sorts of specific issues about the recordings themselves. So I don't care what it's actually called. We will actually have some practical examples. See what's what the advantages and disadvantages of different recording types, mainly to do with transmitted versus reflected recordings. Yes, googling helps quite a bit. Not sure what the bot will be able to generate in terms of images. Actually quite curious. But we might do this later. Yeah, I'm having all sorts of issues with my USB device because my microphone is not properly connected via another pre-amplifier. Talking about amplifiers. Sorry, I'm jumping around a lot. We also have now a blog on EEG hardware. Can open it at live server. That's not in production yet. But it's meant to be using, so thinking, I'll record my own EEG. I've done it many times before, so it should be more than capable to do that. But the problem is that my older gear, I can't use it anymore. I do have one of those old and I use the DAC, the data acquisition device. The problem is I can't connect the electrodes to it directly. I have to use a pre-amplifier and text instruments. A differential instrumentation amp could help a lot. And this is just so much generic. You don't need the key card or anything like that. To know why it even mentions it. Yeah, we need a good CMMR to know why the BIOS language there. Good common mode rejection ratio. Yes, you have to look it up. Or should I have a section in the... Should we focus on this or move on? Let's move on to proper development. At that too, it now looks better. That has now background, so it looks more like an output. Yeah, we don't like ads, but hopefully they're not too intrusive. They're now delayed, like by 10 seconds or so. I probably could delay them further. I was just playing around with the delay function. Which is done on my server end. Yeah, this need to be made clear that the filter order is only affecting the frequency domain. Now there's a description. The filter order is from 1 to 4. It's just the sharpness of the band filter. All the setting is at 2. Why do I have a field of feeling? That looks correct. This thing would not actually show you the value. Like the window size there. That little value there will actually change. This is in production, by the way, therefore. So you can go check it out. It's in this URL. Popped in the chat for you to play with. You can change your different types of weblets at the window size. There's a lot to play with. I'll leave that there for now. We have another blog. Hopefully all these blogs will eventually turn into web applications. So they will be more useful than just text. They will actually show something useful. Like EG signal quality. Yeah, we can do a lot. We can do a web application there. We'll see how we do it later. This application is in an earlier version. It's a simpler version of the EG data time and frequency domain. It's just scrolling through the file. You can select your channel. Same as the previous two. The newer two. This one here obviously has also options to make the signal less noisy. You can play with that. Okay, the ads are really annoying. Should be probably showing this on my what's called development server not in production. So the ads not popping up. What else? Let's go to the bottom quickly. Jump around this one. Yeah, those five do not currently work. So should I go out of these three? Any preferences for what I should be looking at first? Let's open them quickly side by side. Yeah, we had the original tool that used to work. We have some description to it that we can pop into a ChajBD as well. Let's try to weigh every show. We had something already. So this is feature extraction from images. I actually have some unique images that I could be trying this on. Let's see where is the feature extraction. Right, we don't have a description. That's that old LabVIEW HTML. It's actually whatever PHP. Yeah, I'm getting rid of them. Let's have an info text first. And this one could just have that. We had the original video. It actually shows how it's supposed to work. But this text can be popped up in here. I have the description there. Fast feature point detector detects corners in an image using the features from Accelerated Segment Test, FASD, Algorithm. Fast identifies all interesting features in an image and selects features so that they're consistently detected. Harris corner detector uses the Harris corner detector algorithm to detect corners. The Harris corner detector is a mathematical operator that finds corners in an image. Chita Masi corner detector uses the Chita Masi corner detector algorithm to detect corners. The Chita Masi corner detector is based on the Harris corner detector. But there is a difference in the selection criteria of the corners. Chita Masi works well in cases where the Harris corner detector fails. Okay, so that's the description enough. So essentially we should have a detected type. So we have inputs and the detected type has the image options. The detected type should be Harris and Chita Masi. Yeah, we have that description in the bottom. And we also need a raw data option. And this will be the output. Or should we just display the raw, the original image? No, let's just display the original image. So I have outputs, original, and processed. Oh, come on. GitHub. Yes. And processed image. Right, and that's some description. So now the question is, should this be a flash application or not? Or can it run on the client side? Yeah, we have that. Shit, going to be four straight away. Yeah, which was some sort of way to jump in between in a more like what it says. The decision to implement a feature detection system as a flash application or client side JavaScript application depends on several factors, including the nature of the data you're working with, the complexity of processing, and the user experience you aim to provide. Here's a breakdown of considerations for both approaches. Yeah, many considerations, services processing, privacy, visibility and integration, development consideration, and what's about that. Python, used in flash, has robust libraries for image processing and CV, which can make the implementation of detectors like Fast, Paris, and Sheet and Marseille easier. I think you just sold it to me. Yeah, on the client side there might be limited capabilities. With Lask, yeah, and we already have like what the 8, 9, 10 of them really. Just one should be easier. Creating a flash application for feature detection in images is an excellent choice for several reasons, particularly due to the flash ability to handle server side processing and the ease of use of Python's image processing libraries such as OpenCV. Here's how you can structure your flash application for feature detection. I'm also checking what the images we could use as examples. Basic structure, so we have web interface back end. The back end does get post requests using OpenCV to implement the feature detection. That's great. Saving the images temporarily, that's okay. Maybe, change it later. Like the output, ending road data. What? That actually is interesting. Normally when you're talking about biomedical images, you're thinking your scans, but here's actually time series data. It can also be an image. That's actually could be quite an interesting thing to do because we could just go into one of the other tools and generate quite a few images and see how the image detector deals with them, deals with those. Or should we go imaging examples? Because the algorithm will be, you can use steps to implement feature detection and install flash OpenCV by the headless. I have flash installed. AJAX did use AJAX in one application, but not in a more recent one. Shouldn't matter too much. The AJAX versus, say, micro scans. Just see what it says. You will process the image quite differently because you'll probably look at the different features. Perhaps if you use Microsoft data characteristics, volumetric, image processing, complexity of data. Yes, the data is more complex. I don't think I have 3D images anyway that would be... I could try and get some 3D micro CT. But at first stage it probably just couldn't be 2D images. What's the final outcome? Is it just using it, for example, in one of the diagnostics? What could be the setting of research, development and engineering context? This will dictate the precision speed via one like many for educational purposes of the mind. Speed is important. Speed... Where do we get the images from? Is important. Data, HTML. Let's do the structure of application files. And all this. You don't need to spell correctly. To make people understand. Basically the main page. Result display. Okay, so put in a single page. A single page panel. Please. For a single page panel. Your application. Letting JS images. That's all the root definitions. It's a bit odd. Can I have a standard... What's the last application that we have made this month? Do it in the same way. IG Spectrum Chandy Noise. IG Spectrum Chandy Noise. And this one here. Like this structure. And this will be the images. And we'll see where we get the images from in a second. So the app is called a feature extraction. It will have an app. Requirements read me. Static style. This one. What's the standard name? Or main JavaScript. And by its index HTML. Data. This will be images. It's a script. It's not for EEG. And this will be image of one. Let's do this. Okay, I don't know why I just rearranged the thing. Explaining each file. I didn't ask you to. That's okay. Can we stop generating that? Okay. And have those. Let's go next. Generate only circles. Update of HTML. Well, just HTML. And this is the first time generating HTML. So, why do we have an upload? Okay. Yeah, we're just generating the templates. For the files. JavaScript file. While it's generating. Let's do the folders quickly. Or should we just copy them? Well, this definitely goes into a folder called other could be done. Actually need this. We have the info file. Copy those quickly. I have requirements. We will need to regenerate those. Obviously, I can delete that. It's JavaScript. Yeah, we're using the DOM content loaded. That looks good. A file. Can straight away correct this into the new application name. Generated some Python code. Just template. Right, we're really generating the HTML. Okay, yes, we want to separate CSS. And probably after CSS, we'll have to update the HTML again. Obviously, we're not ready to deploy with. We just started, literally. With this application. Don't have much. Okay, where is the CSS? The CSS. All the body h1, h2 should be commented out. Because we might actually leave it for now with the HTML template. Just checking that it doesn't have any styling or JavaScript in it. We would like all those to be separate. It's a bit messy. It's a bit messy. Report title. Obviously, we need to change the title. Okay, I don't like this already. Because I said the style CSS is not in CSS folder. It's actually in the static folder, whatever. Well, yeah. Content ID, form, input file image. We're using a plotly JavaScript domain. I do this with the local server quickly. Choose file extract features. This description is wrong. A feature extraction from images. And all this description can go. A format document. Let's see what's what. Okay, HTML, a JavaScript. Let's go for JavaScript. A JavaScript can be renamed. Main JavaScript. It can get rid of all that. Extraction, explanation. Need some images and data. At least one. If we are doing EEG segment. We could actually, this slider. It's not great. This is actual, an actual seizure. How about we do that as an image instead of like an export. E download plot as PNG done. Let's pop this. Let's call it seizure. One PNG popped into data. Right. Should be a file. Should just get rid of all the labels maybe later. More prompts to use. In Zen. We haven't done the last SQL file. Let's go with it for now. Structure, colors. Yeah, we'll leave the colors for now. Example the images in this file. Okay, HTML. Where do we edit? It looks like again. Choose file. Definitely. Okay, and the files. All the image files are in this folder. Choose first default. So this actually does not matter. Just pop another image in there. What can we use? We actually had these images for the wavelet image compression. We could use some of those. Use some of those images. Sorry for the ads. Which one's good? Yeah, the first one. Image group as wavelet. Press wavelet. Static images. Right, so this should be in static images. First one, MRI brain. SA02. Yes, this one. Static images. Okay, let's rename this into images. And put it in this static folder. Name this 01 seizure. Yeah, so it's just on top of the file. Copy path. Relative path. Static images seizure 01 seizure. Whatever it's called. All the image files are in static images folder. And choose first file by default. You can get rid of that. Add a drop-down menu to select the image file. Yes, for the Tector type. We wanted to do that. Yeah, that's GitHub co-pilot. And those are good. Why are we using web browsing? Just using the standard GPT-4 default. The out files that are not images, if necessary. Yeah, we don't really have to do it. We won't know at this stage. Change our HTML. Rename the template. Yeah, we don't need that secure file in what? Because the images will be just on the server. Get rid of that image folder. That's right. We don't need to do that. Extracts visual file path. That's not a bad suggestion. Yeah, we don't want a dummy extraction function. We want a real extraction function. Yeah, let's update this item code. HTML. Next. Doesn't mean we don't need Blotly. Deep Blotly chart. Format document. Clean it up. So we have the file. Choose an image. Choose the data. And why is it not populated? Why is it something that is flicking? Making claims. It's too... How do we do that? The question is that if it's rewriting the whole and Flask App would just be it. Take the type. It's debugging. It's true. Yeah, it's still debugging. If you have snippet. Let's create an index HTML template for the dropdown. So HTML. Bum, bum, bum, bum, bum. Scripts. Yeah, we don't have much time. Get something running. Weekly data. Drop down menu. That's the same image. Yep. Yeah. Option. So why is it the same? I don't get it. Why is this not populated? Images study images. And the index HTML. I'm going in circles here. This is just the same. Don't get it. All right. I know what the problem is. Because I'm not running it as a Flask application. I have to run it as Flask. That helps, doesn't it? File, not file. Static images. Static images. Static images. The file is not found. I'll search in the folder. Relative file. Quickly fix this for me. So we can actually move on to the actual development. This is the whole thing I suggest for me to replace. Right. Okay, now it's working. Okay. We are in business. Sure. Images displayed. I'm using Copilot all the time. I actually had to change its settings as well. Copilot. No, I'm using it all the time. I didn't realize it had quite a few settings. Settings that I... Yeah, I think it was actually set up for developers, where you're doing everything myself. I'm not a developer. So, now it actually should be better. I haven't checked it yet. Make sure images displayed in the HTML Flask. So I can try them both side by side. I would actually love to ditch CHBD. Well, because it's more expensive. I don't really need it. If I knew how to use GitHub Copilot properly. So, for example, yeah, I'll try them both. Let's say it's directing us to change the HTML because we meant to have these two images original and processed. So we have the drop-down menu, drop-down menu right here. A place original. And process images side by side. Yeah, that was... Yeah, now it's thinking. I need to generate the whole code. Give me two options. Yeah, like the second one. Accept for tab. Save. Didn't I say side by side? Definitely not side by side. And original image... And, well, can it see? Script HTML. Make sure the images are displayed in the HTML file. Yeah, so this is a much better example. Place it together. Oops. Right. So, yeah, you can tell GPT-3 is actually having context for the whole thing. I'm surprised. GitHub Copilot has access to all my files and everything. It's literally in the development suite, but when it's giving me advice, it's giving me generic stuff, whereas GPT gave me the actual file with the right folder, and it actually works. So, yeah. I'm not sure about... I tried to use one available for students with my university email after, so it was a bit disappointing. It's still using 3.5. Being with 3.5 is... Yeah, I think it's a problem that people use it and then they go get disappointed from it. The main reason I'm able to use, and I don't know why it's in web browsing, is the fact I can start fresh for now, do it quickly, because I'm running out of time. But if I'm in default GPT-4, the main reason I'm able to use it is because it can store the whole context for all the files. So, if I have all these 1, 2, 3, 4, 5, 6 files, if I pop each one of them, I'll go in for last. The order is important. Index HTML first. So, if I start from scratch, the good thing about it, is it the right file? Yeah, and I'm just telling it to read the code so it doesn't generate anything else, and that's because it then stores everything in its memory somehow. You can use these lines to work quite well. And I pop this again. So, it's actually... Yeah, it says, yeah, great, the code's provided. So, it has it in memory. It read the flash application. That's great. Stasis, as I can sort it out later as well. JavaScript is most important. We use the same line. Confirm, you read it, and do not generate anything, any code or anything else. Copy all... Yeah, so GPT-4 is able to keep the context of all the different files. So, we're talking... We're talking 100 lines in HTML, 30 lines in lasks of body in JavaScript. And now, I can actually ask it questions. I'll go into my application. Yes, that HTML, that GitHub copy I generated, didn't actually work, and I'm actually trying to find it and get rid of it. This one here. It gave me very generic stuff. Yeah, I just don't know how to use it. The whole point for me is that I'm able to... Where was I? Yeah, read the JavaScript. It gave me some error or something. Let's read this quickly. It sets up a client-side script to handle a form submission by sending the form data asynchronously to a server endpoint upload using fetch. The server is expected to respond with JSON data that either contains charred data for POTLi if a feature extraction is successful or an error message if it fails. Upon receiving a successful response, it calls renderPOTLi chart to create a chart using POTLi.js. I wasn't actually listening to what it said. We're generating another prompt. We don't have to worry about spelling. Just pop it in as is. And it's giving me... Yeah, it has the context. So that's the stuff that I already have. And then it's telling me what I need to change. And it looks correct. I don't have the processed image yet. Hopefully, we'll have it soon enough. Let's pop this scene. Yeah, I don't have the processed image. That's a problem. And it can do processing for me because it had the Python code as well. Sorry, I went in the wrong... Okay, I'll continue this later. See you in a bit.


news update. Good morning, everyone. Basil Trappin on this first day of June, Thursday, and we're looking at the Dow futures down 103 at 32,876. Doesn't all go well for the rest of the day. The Dow has been much weaker than the S&P. Look at the E-minus, a continuous contract trading down 75 cents at 41.89, holding much stronger, having only just now, after yearly recovery high, turned down. It's holding pretty well. Look at the NQ, which had a spectacular run. This is the NQ, the E-mini, Nasdaq 100, continuous contract in the futures, trading down 5 at 14,294. It has good support of 14,100. If it takes that out, then you've got to look at 13,900. This is a really important support to hold. If you're looking at the bonds, U.S. bonds are trading right now up to 22,30 seconds at 129 and 130 seconds. This is what I was talking about a moment ago when I did my show, which is recorded for replay at my 10 o'clock time. The TLT is up 25 cents at 103.24, rallying quite nicely, going to try to break this downtrend resistance line. If it starts to trade in the 104 area, yields are going to be coming down. Look, the weekly chart, you can see, stuck in a range between 100 and basically 108.99 or 98. That's been the range for months. We're looking at that. Then the crude oil pulled back very sharply. Now it's unchanged at 14,68.22. It's at a very sharp pullback. It's already struggling. It must hold 67. Otherwise, it's going to retest the 64 area. More importantly, we're looking at the SMHs, the semiconductors, which are holding quite nicely up 12 cents at 144.45. They should be taking a bit of a breather here. There's enough residual strength to say it could have a little pop to the upside. 151.71 was the recovery high. But I think over the next week, we're going to see a big digestive phase, meaning a wippy phase in the semiconductors. With that said, we're about to hand you over to Tommy Brine for the morning market kickoff-grade programming here all day. Did I just once again beat the gong? Yes, there it is. Have a wonderful rest of the day. I personally will see you tomorrow for the target emissions hour at 10 o'clock. Check out both people today to use that. See you soon.


Hello, everybody. I'm Nick. I'm the security engineering lead at Cloudflare.  So specifically, I'm going to talk about my personal experience or my experience at Cloudflare with what happened during Heartbleed when it came out and what happened after the fact. So has anybody read this article? This is a snippet from The Verge. And it is a kind of a semi-fictional account of what happened during the disclosure of Heartbleed. I can kind of paraphrase a little bit how that conversation went, but it kind of went a little bit like this. So do you use DTLS? No, not that I know of. Does anybody use DTLS? And that's for websites, nobody used Datagram DTLS. How about TLS Heartbeats? Well, well, my answer was, well, what's a TLS Heartbeat? I mean, at this point, barely anybody knew what this was. It was a very obscure feature.  You should turn them off. Right, so recompile OpenSSL with OpenSSL no Heartbeats. And that was kind of that was that. So Heartbeats were off for Cloudflare. We have a pretty simple architecture, so deployed it really quickly. And the answer was, OK, looks good. Public disclosure should be around April 9th. So I guess a lot of people had this question, but why tell Cloudflare? Well, let me just go real quick and describe what Cloudflare does. So it's a reverse proxy.  That's the sort of red X up there, as well as send cached content, static content. That's the bright orange. So it reduces anybody getting to your website. That's malicious and reduces the load on your website. And for this to work, this cloud has to be closer to the visitor than it does have to be to your website. So we have this global network. So our nodes are closer to the visitors, and that's how it works. And there's over a million sites on Cloudflare, including banks, government websites, Bitcoin exchanges, almost every Bitcoin exchange is on Cloudflare, the IETF's website, Reddit. I can go on and on and on. So lots of sites, but what Cloudflare does is very simple. It's essentially three services or two. DNS, HTTP and HTTPS, which is powered by OpenSSL and Nginx. So the architecture is very simple in that every machine that we have can serve every site. So thinking back to Heartlead, this is actually, you can see why this would be a really, really bad situation for Heartlead to hit. Anyways, so it happened early, April 7th. 1027, OpenSSL published their advisory and that hit hacker news really quickly after that. Within half an hour, it hit the front page and about an hour later, we posted our standard Cloudflare. Customer sites are patched, you don't have to worry about it, sort of post. And this was, it was a thing. It was a bug and it was starting to gain some steam and then about an hour after that, there was a tweet from CodeNomicon and I think everyone can know what this is. That's the next site. This Heartlead itself, it was branded and it came out to mass media. So this became a really big deal. Heartlead.com had a logo, hit the mainstream press, Heartlead virus, I don't know if you guys remember that but people were saying, oh, there's a Heartlead virus out there and I knew it got really bad when my mother called me and said, what's going on? So this was kind of a big deal and well, we were finished patching so well, we had some time to kill. What are we gonna do? At this point, we decided on three things and one was to help keep this scanner that Filippo had from falling over. The second was to turn our network into a large honeypot to see what type of attacks or what type of scans are happening. And then the third was to decide or to figure out what we're gonna do about our certificates. We have quite a few websites that use our service and many of them use SSL and we had about 100,000 certificates and revoking them was not a really, at this point, the day after disclosure, it wasn't absolutely clear that this was something that you had to do. So first let's talk a little bit about this Heartlead scanner. So Filippo, who's now a Cloudflare engineer, wrote this server in Go and you type in your host name and it scans it for whether or not it answers Heartbeat requests that are malformed. So these are small ones around 100 bytes so that it doesn't leak anything beyond your standard frame. It shouldn't leak any information. He put it on AWS and then put it behind Cloudflare and shout out to Kyle Isom from our team for helping keep this up. But this is kind of what from Filippo's server, what it looked like, there was April 8th, up to 2,000 requests per minute. So this was a very highly used tool and that's nothing because this is the next two weeks. 2,000 is the bottom tick right there. So up to 10 to 20,000 a day, 10 to 20,000 scans per minute for the next two weeks and we held it up to 200 million tests in the first two weeks. So with the scanner up and running. Yeah. And thank you to Filippo, wherever he is, he's somewhere in the room. Stand up, this is thanks for the tool. I don't see him, he's somewhere. But in any case, this is what he found. In terms of domains, it was really bad at first. This is the ninth, this is two days after Heartbleed was originally announced, up to 30% of the sites that he scanned were vulnerable and this luckily cut down and a lot of people use this in their automated testing to validate sites, but yeah, it got down to a low number pretty quickly. So now that that was up and running, back at Cloudflare we decide, well, what can we do? Well, we can log every heartbeat that we see that comes in with a bad size and well, we can put that data in a shelf until now and that's kind of what we did. So here are logs from the ninth and 69% of them had a message size of 16384 which you might know as the largest power of two. You can fit into a signed 16-bit integer, but you might also recognize it as the hard-toded value in the SSL test Python tool that came out the first day. 20% were 121 and that was actually from Flippo site and University of Michigan, maybe, were you guys scanning on April 9th? Or in any case, there were a lot of requests that used the zero-length packet, which is another way to just check to see if your site is vulnerable, but about a week later, it was around the same. So if there were people who were mass exploiting this against sites, they were probably using just the basic SSL test Python script and around 20% were still Flippo's tests. So if you can do the math here, it seems that a lot of people were just scanning with Flippo's tests. It wasn't a lot of mass exploitation and flipping the numbers back, you see that 1% of Flippo scans were actually against sites on Cloudflare. So this is what the map looks like for where the attacks were coming from. I know IP maps are not really that interesting, they don't tell you that much, but this is where it is. There's some strange spikes like in Iceland, but don't read too much into it. Now the question is, and this is what we were thinking when it first came out was, why was it really so dangerous? Why was Heartbleed so bad? Well, it's kind of a layer six request that doesn't necessarily get logged. People don't log parts of handshakes very often, unless you have a specific IDS rule or something like that. And it's really bad in that 64K of server memory can be exfiltrated by one request. And this has login info, session cookies and perhaps TLS private keys, we didn't know. And if you kind of look at the diagram here, this is, that's the heap right there. Everything that's above the request, if you have a new request comes in, it gets put on the heap and anything that was previously removed from the heap is still sitting there. So we know that they're passwords cookies, people were finding this right away. And the question was, would the key be there? Is the key gonna sit above one of these requests? So we looked at the code, right? And what did the code say? Well, it said this can't happen, at least not in Nginx, the key gets loaded right away and therefore gets at the bottom of the stack and any time that you do allocations or for requests coming in, they're gonna be higher up on the stack and they're not gonna be able to read the original key, right? And Nginx itself was single threaded, so if you have this, it's not gonna be able to catch something halfway in the middle of another thread doing an operation. So OpenSSL has a big number library that they use and they clear the memory when they're done. So if you're doing a handshake for TLS, all of the cryptographic material is gonna be cleared by OpenSSL. At least that's what we thought, right? And we weren't sure, I mean, I just looked at some code and what do I know? So we launched the Cloudflare Heartbleed Challenge. So this was something that we did to crowdsource an answer. So we set up a standard Nginx, which was outside of Cloudflare, was on a third-party VPS and it had the vulnerable version of OpenSSL and we said to all of you guys, come and find it, see what you can do. And to show proof, give us a message signed with that private key. What did we find? Well, for the first couple hours, there was trolling and as you can... This is so many clopping because they did this, but basically anything that you post onto the page is going to be put into memory in the Nginx. So people were posting private keys in there and they were posting what looked like, you can see my name there, Nick, what looked like a passwords file. So everyone was getting really confused, getting all this, there's a private key in my Heartbleed request and but nobody was actually getting the key until we saw this tweet from Fedor and we took a look, this is Cloudflare office, that's me pointing out a television screen and yeah, he solved it. So congrats to Fedor. And so he wasn't the only one. This was in the first 24 hours or so, there were 12 people in the first 48, about 25 people had solved it and got the real key and sent proof. So can you steal private keys? Absolutely yes. And it was solved in under 10 hours and private keys can definitely be vulnerable but another thing we did was we logged where in memory the Heartbleed requests were coming in and we compared that relative to where the private key was initially allocated and they never overlapped. So how did this, how did it actually get solved? Well, there was a second bug in OpenSSL. Who would have known looking through that code? If you dump the memory of the request, all the places in red are where private keys did exist at one point and it turns out some temporary variables were not wiped. This is the code to clean up the mess, there's big num free versus big num clear free, this is just, yeah, it was just in certain cases in the Montgomery multiplication they didn't clear up, they didn't clean the partial pieces. We can do a little bit of math just to show how people actually solved it with this but RSA you have a couple different things, you have a public exponent E, you have two primes multiplied together and they make the public key and a private exponent D and if you get any one of PQ or D you get the whole private key. So what people did was they took every 128 bit block that they saw in exfiltrated Harpley data and they just tried to divide it into the modulus and if it divided, there you go, it's factored and this is how nine out of the 10 people solved it, turns out that one of the prime factors is just sitting there on the heap after tens of thousands of requests you might look upon it but one enterprising gentleman Ruben Zoo who's at University of Cambridge, he used a much cleverer method which is Coppersmith's attack which is a lattice reduction attack where you only really need about 60% of one of the private keys to find it out and this depends on the fact that the public exponent is small. So for performance reasons the public exponent in RSA is small so that any public operation is really fast but he solved it in only 50 requests so that was actually really interesting. So private keys are gone, right? What does that mean? Revocation time. You know, the internet was built for this, right?  This is just, this is how we designed the system, right? And this is what Sands kind of reported, that's mostly us actually, that's all the internet but that's mostly Cloudflare and this is what it looked like. The blue line is revoke certificates and as you can see, that's April 7th. This is after Harpley. This is when everybody was revoking and then that green spike is Cloudflare revoking but once we revoked all these certificates we found out that, well, it didn't really mean that browsers wouldn't accept these certificates anymore and I can go into that really quickly. There are three methods to do this that were built for handling revocation certificates in X509 and first is the certificate revocation list and this is just a flat file with a list of certificates that are revoked and did us revoking 100,000 certificates break CRLs? Heck yeah, it did. So the CRL from Global Sign grew from 22 to five megs.  We're used to that kind of traffic but you can see here every three hours there are waves and this had to do with the cycles in which CRLs were updated and Microsoft Internet Explorer downloading them and yeah, it was pretty rough. Anyways, CRLs broken. How about OCSP? OCSP, well, this is the online certificate status protocol. This is a kind of question answer. Is this certificate revoked? Yes or no? And well, it's really broken and Chrome has kind of known this for a while and stopped checking but if you have hard fails, it does disallow you from using certain networks especially with captive portals and if you have a soft fail, somebody on the network can just kind of drop the OCSP response and voila, the site is no longer revoked. So it really doesn't work or scale to the degree that we'd want it to in plain OCSP being requested from the browser in that sense. How about CRL sets? This is Google's proprietary method that they basically collect all the CRLs that they can from different certificate authorities and put them together and install them in the browser. So you get updates with the browser of these sets of CRLs. I shouldn't say all the CRLs but it's specific certificates and this is kind of what we found out. They only do EV certs and special EV certs and if the browser doesn't get updated then you're not gonna get an update in your CRL set which is, it's kind of bad. So cloudflarechallenge.com, once it was solved we revoked it and the way it was not an EV cert but Chrome did mark it as revoked because well they added it manually into a JSON file. So none of the 100,000 Cloudflare certificates were being marked as revoked by Google Chrome. So we basically made a hack and I don't know if you can read this but it's the most efficient four lines of C++ revocation. This is in Chromium, it revokes all of our certificates. This is a hack, this is not scalable, you shouldn't do it this way but it was how it had to get done because there were no valid ways of doing revocation. So yeah, revocation is pretty much broken and what can we do? Well there's shorter certificate expiration periods that could help, that would at least help with the CRLs because you won't have to be holding on to old certificates for very long. You can sort of shrink the size of the sets pretty quickly. OCSP must staple is an extension that requires you to send the server to send the OCSP response in the handshake. That can help too, certificate transparency, something else has thrown out there to solve this but none of these are widespread and none of these have been implemented so something has to work for revocation. So I guess in summary, there are three things that we did after Heartbleed. We kept the scanner from falling over, turned our site into a honeypot and while we definitively answered that, yes, you have to revoke your certificates and there's no excuse. So there's a lot of takeaways from Heartbleed, right? I don't want to be the one to sort of tell everybody how to take away what to learn from this but open source disclosure is hard and this really was the first one of the year of what turned out to be many open source disclosures and we did learn a lot of lessons of how to do that correctly. Other things that pointed out, which seem obvious to people but weren't obvious or weren't in OpenSSL which is features should be disabled by default. Nobody who installed OpenSSL 1.01 wanted heartbeats necessarily so turn off features by default. Another thing is well, expect the unexpected that's sort of obvious in computer security. We didn't really learn that from Heartbleed but it was definitely a shock when it came. Other things, these attacks, a lot of the attacks on real sites that Cloudflare saw, we saw quite a few attacks as I mentioned but a lot of them were just scans from people just trying to see if their sites were alive so that's a reassuring sign. Crowdsourcing was effective for the Heartbleed challenge. I couldn't find the private keys and luckily there are very smart people out there who were able to find it. Is anybody here in the auditorium a winner of the Cloudflare challenge? Is anybody here? I don't see any hands. But anyways, I don't have my glasses so congratulations wherever you are. And the last thing is revocation needs a solution and the last conclusion from this is really support OpenSSL. It's, I messed up my microphone there but thanks. No really, I mean this is part of critical infrastructure for the world and for not only websites but as Zach here was telling in embedded devices and these guys need support. So please support OpenSSL and I'm done, thank you. Okay, quick announcement before we start the Q&A if you are going to leave the room, please get up now, go out quietly without talking so we can do the Q&A nice and quickly. Also, you will be only able to leave the room at this point. Yes, if you have any questions, please line up at the microphones. We'll start with microphone number one. Thanks, not really a question, thanks for the talk. We really followed the progress even before the talk with your paper you published and we just wanna contribute a piece of missing information. So the first attacks, as you called them, 24 hours after the disclosure that were us. We weren't really attacking. We started working on a scanner about 20 minutes after the public information and it was a top scanner in the region. So it was a scanner and used multiple different methods. As we went, we came to the conclusion that there may be firewalls be deployed in between which may stop some of the packets. So we used many different packets in one, in every request. So that's also a scanner there. Is your mic not on? No. Quick interruption, if you're leaving on the ground floor, please only use the front left and the front right door. If you're up there, you can use any door you want, but if you're down here, please only use this door and this door to leave the room. Thank you. Does your mic work yet? Hello? Yes, great. Yep, thanks for the comment. I don't think I saw anything specific to your account, but... Yeah, no, no, it's great to know. So, I mean, it's one of those things that's really hard to tell from our perspective whether something's gonna attack, whether someone's malicious or whether there's someone just scanning. A lot of the hosts that we see don't have any information that identify what the intent is. Microphone number two, please. Hello? I have a question to CloudFair. Could you stop blocking toy users, please? You make the internet more central every day. All the fancy homepages which they're and come on the door network is so small, you could handle it with that finger-snip, all of the bandwidth and you're blocking all the end nodes, all the time. We're looking into solutions for Tor. The main problem is that there is a lot of spam on Tor for websites and right now filtering through the good and the bad is something that we're working on and we are focusing on that this year. So, look for something coming up this year for Tor users. Thank you. Next up, we have a question from our signal angel asked on IRC. Yeah, thank you. So, given that maximum TLS record length is 16 kilobyte, how is it possible to even get back 64 kilobytes? It's, you can split, you can split a heartbeat request over multiple records. I believe, I think that I'm pretty sure that's how it works. Microphone number one, please. What is your opinion on Libra SSL? Go for it. I'm not sure if I'm the most qualified person to answer that, to be honest. I think there's well intentioned, I think the community acknowledges that there are a lot of problems in open SSL in terms of its maintainability. It's one solution, I'm not sure if it's the correct one. Yeah, I think Libra SSL works for its goal, which is open BSD. They have a portable version by now, as well as they did with all their other forks, and it's much cleaner code.  So, the un-maintainability will remain for a while. Yeah, I agree that open SSL does support quite a lot of different platforms and some people need that. But the different forks of open SSL that have come recently, Libra SSL, Boring SSL, are taking patches from each other. So, I think the more people looking at this project, the better. We have time for one more question. Microphone number three, please. Hello, and both your talks, you showed numbers of vulnerable sites decreasing and increasing again afterwards, can you explain that? So, I think there were small bumps that were just people coming and going. I don't think we saw a lot of websites that became vulnerable. I think a lot of it is just pieces of measurements, websites that came and go between different scans. I don't think there were any large jumps that we saw. When it comes to the data that I was showing, this is from Filippo's scanner and not everybody was scanning the same domains every day. So, that's just standard variance. Thank you very much, Sakira Nick. Please give our speakers a warm round of applause.


In the world of mock-toe boots, Grant Stone produced two. Well, actually three, if you count the Norwegian split-toe as mock-toes, which I don't. In the more traditional stitch around the apron mock-toes, they have the brass boot and the fuel boot. Which one would you choose? G'day, how you going? Welcome back to my channel, Bootlossophy, and happy new year! If you're brand new to my channel, my name is Tech. I acknowledge the tradition custodians of the lands that I live and film on here in Perth, Western Australia, the Wajik people. Mock-toe boots cut a fascination for many people. In the United States, they are traditional work boots, especially in their wedge sole incarnation, like the Red Wing 875 Classic Mock-toe or the Theragood Classic Mock-toe boots. I have reviewed both, but up here, the Red Wing is a perennial favorite. Outside of the United States, mock-toe boots don't give that classic heritage American memory of work boots or hunting boots. And in most other parts of the world, they are seen as nice and different boots, even if people understand the history behind them. In the early 1950s, Red Wing first introduced the 877 8-inch high mock-toe boot, developed for farmers and hunters. As these people spent a lot of time in cold, wet conditions, the new wedge soles helped them keep dirt from getting stuck on their soles, and the 8-inch shaft kept them protected from weather and snakes. In 1960, Theragood introduced their mock-toe, and it actually served as the official boot of the American Boy Scout movement. So in many ways, Grant Stone, established in 2016 with their mock-toe boots, came late to the mock-toe party. Grant Stone was founded by Wyatt Gilmore and Josh Lang, following Wyatt's family history of connections with boots through his grandfather's and father's connections with olden shoes. Through his father's connections, Wyatt worked in a private contracting shoe factory in China for a while, and when he established Grant Stone, he made that factory his manufacturing partner, while basing company headquarters and warehousing in Michigan in the US. I've already said in my various reviews of Grant Stone boots that their business model is almost business school perfection, implementing strict manufacturing process control and quality control protocols and systems in China, developing efficient warehouse inventory dispatch systems and final inspection processes in Michigan, selling through their website direct to consumer and removing economically inelastic cost structures. Grant Stone produces incredibly good quality boots at $100 or more off what they could otherwise sell for. If you're enjoying the video so far, don't be shy of clicking on like. It really helps me out. But for now, we'll move on to this. Grant Stone's brass boot. This model, with the Earth Waxy Commander Uppers from Charles F. Stead's tannery, is set on a proprietary commando lugged sole. You can get the brass boot in other uppers, coming from Horween, Badalassie, Carlos, Tannery and other Stead letters as well, on either this commando lugged sole or their own proprietary white wedge sole. At the time of writing, there are 12 different models of the brass boot, not counting limited releases. I'll leave a link to Grant Stone in the description area below so that you can have a look at their different models. Aesthetically, they are lasted like a traditional mock-toe boot in that they are high-walled, and the apron stitch creates the mock-toe look. But they are different to the more traditional red wings and thorough-goods, because that vamp stitch is more in-board than at the edge of the wall, and the high-sized themselves, if you see from the profile, are more rounded rather than straight up and across. Like all Grant Stone boots, it is good year-welted, and if you don't know what that is, go see this explanation video up here. But being good year-welted, of a really sturdy construction involving leather mid-soles and in-soles, steel shanks, leather heel counters, and fully leather lined, coming in at just under a kilogram each, so not a light boot. Despite the construction, which is strong enough for, I guess, 90% of people who buy them, I don't think they are truly work-boot intended. Like manual labour for sure, and hiking across tough terrain, which I have done, they will stand up. But I'm not sure I put them into construction work where dropping heavy lumps is a thing. As I said, there are loads of other leathers used, but this waxy commander is easy to wear and take care of. The wax suede being really water-resistant and good against scratches and scrapes, and if the wax wears off, you can always re-wax them. Now, this is Grant Stone's relatively new offering, the Field Boot. This one is in veg-tanned leather, the saddle-tanned from Badalasi Leathers, which is very firm and supportive. Again, the Field Boot is available in a variety of uppers. I think at the moment, seven in all at the time of writing, but all of them so far are on this proprietary white-wedge sole. The sole, unlike the famous Vibram Christie's sole that's on the Red Wing Mocktoes, have a rippled finish, offering arguably a little more grip, but also with more dirt-tracking because of the grooves. I have found it to be slippery in mud because the waviness is all along one axis, so if you're slipping, it could be quite dangerous. The last shape hails towards the main moccasin hunting boot style, like Brussels moccasin boots, even with the addition of this strip of leather forming a bumper that sort of recollects that shape. This is not real, by the way. I'm pretty sure it's not an extra strip of leather, but it's just sewn onto the strip of leather at the side so that there's only ever one layer. It has a taller shaft than the brass and a suede padding at the top of it. This is also good-year-weltered and also has the leather insole and midsole, the cork-filling, the steel shank, and the leather heel counter. The Italian Vegeten leather is firm, but it's not stiff, and it is very supportive around the ankle. It will stain when it gets wet, but the darker staining dries right out as it dries. You do need to condition this a bit more than the Waxy Commander suede, and a little mink oil now and then will help to keep it more water-resistant, although it will darken it, as you can see. It's not quite as orangey as the original. Listing the differences, apart from the obvious aesthetics of a modernized moccato boot versus a US east coast moccasin hunting boot, obviously there are external differences. The commando lug sole versus the wedge sole, although you can get the brass boot with the same wedge sole, the exact same one. The wedge sole is made of blown rubber, so the difference in weight is obvious when you pick them up, where the brass boot in this configuration is about a kilogram per boot. Each field boot is only about 0.8 of a kilogram, about 800 grams. The field boot sports these D-rings instead of regular speed hooks, as used in the brass boot, which does reinforce that main hunting boot look. And of course there's the bumper patch as well as the pocket stitch at the back of the backstay on this field boot. The Goodyear welt on the field boot is a flat welt, whereas the welt on the brass boot is a split-reverse welt with one split-half pushed up against the uppers. As for the similarities, the construction comes first to mind. Both are quality construction with quality materials, starting with US leather for the welt midsole and insole, and I think also the heel counters. Now they are both cork filled and they both have a triple ribbed steel shank inserted into the arch. The quality of the stitching and the care taken to align, say, the welt ends and the hardware is unbeatable. They both use Grant Stone's Floyd last, which is roomier than their Leo lasted used in their diesel and Edward service boots. Some say the Floyd is bigger and therefore to size down, but I find I size them the same, understanding that there's more volume, not width or length. They are both as comfortable as each other, hard to beat based on a well-designed last and all natural leather and cork layers below your feet, molding to the shape of your feet the more you wear them. I found them both easy enough to break in with the provisor that you need some time to break in the sole so that they flex where your feet flex. Both are initially stiff at the sole, leading to a little heel slip in both. One I think is caused by that thick wedge sole, the other by the split-reverse welt and tough midsole and rubber outsole. In summary, they are different boots but very similar. It's obvious they share a familial DNA. Both are sturdy enough to go for long walks in the bush and track over sand, rocks and forest trails. But I don't think either are true work boots. Although my friend Dave from the Vintage Future channel has thrashed his brass boots and my friend Dale from Dale's Leatherworks channel has even beat up his shell cordovan model of the brass boot and then restored them with some good conditioning. So maybe I shouldn't be so adamant that they can't take proper work, manual work. Alternatively, I'm not sure the field boots are good hunting boots. I don't hunt so my opinion is based on this noisy clicking of the D-rings and the fact that the rolling waves in the wedge sole can be slippery and mud. Which one you would choose will, I think, depend on what you'll be using them for. You can choose them just from your preference about looks. The hunting boot style versus the work boot look. You can also choose them for grip and heft with the brass boot winning that one. You can choose them as a semi work boot working around the house or you can choose them as straight up casual boots. Over to you now. Go take a look at the website linked below. Don't forget to click on the like button before we finish and if you're wanting more boot reviews don't forget to subscribe. Until the next time, stay safe out there and see you soon.


What's up guys and welcome to Trendy Updates at SPM Bars. Now onto the trending news today is Kwaomba, the famous Tik Toka na juli kana kama kabilaim hans 90 million Kenyan shillings per one Tik Toka post. Weh! Indo na ito kwa moka maindio nini and I'm telling you this Tik Toka na juli kana kama kabilaim is from Senegal Laki ni piya tuliyona juzia liyeza kupata a Italian citizenship kwa ibuwa ni kama Senegalese Italian and of course in a recent interview that's where he revealed that he hans 750,000 dollars and that is approximate 90.3 million Kenyan shillings. One Tik Toka guys. Jugo mam na elewa? I'm telling you and of course he enjoys a lot of millions and views pa le Tik Toka from the content that he posts. Jugo mam na juli kana kama kabilaim and I was awake a pa le Tik Toka. He takes and you know a video or a situation and buy him to ame very complicate, ame complicate sana. Na na konyesha this is how you should have done this na haongi yata he does not even use his voice on those Tik Toka videos. An na konyesha na mkono pekeyake and that is what that gets kabilaim 90 million Kenyan shillings per post. Na of course kabilaim anakuanga ame partner with very famous brands all over the world. Ono jo kama Netflix, Hollywood, Amazon, yani all the best brands anba zona eza kuzijua. Ni zo kabilaim ana weza kufanya nazo kazi. Na of course the comments section is lit as always. Na nikianga liya pa le app di kadir anasema 15 seconds 90 million kuspobu video modya ya Tik Toka is those 15 seconds to one minute. Na imagine apa Kenya unangoja 31 days upewe 8k yam shahara. Ay, that is hard I'm telling you. Na ona day van anasema mimi ningekuwa na post 10 times a day. Aikini piyatu na kumbuka itzapat na da post ko sababu lazima clienta kwa ame kupa ele kazi. Na ya fukuna busian boy DJ anasema na si siata wakufkisha 20 views on Tik Tok ni kama miguna miguna kuru di Kenya. Siyuka ma ni memuelewa. Aya kuna zuleya anasema kama ni Kenya mtu Angelipa Tax After. Ay, ok sawa sawa. Na ona purity ana uliza anataka mtu. Ay, ay, meona pesa eh? Yala fukuna alishan jambi anasema na haungiangi and then there is you, who talks hadimate inaka uka ah yamani. Shiku anasema he is earning more than our president, ala weh. Alafu jani afrika anasema dey, maybe I should be more quiet. Hehehehe, kliya li kama kabileim haungei. Na anapata zilehela alafu kuna Roma anasema bati amtu ni amtu na nyukweli. Nyukweli kabisa. Ay, aya basilin piya anamon bia kam marimi, suratstating enezea ukumbelembele. I don't know what are your thoughts about what kabileim does. Let us know down on the comments section. Natu anbi ewe uka patakuuna ana 90 million for a post. What would you actually do with your life? Let us know down on the comments section. But in the meantime, keep it trendy. Updates, hapa SPM bars.