Is it working, can people hear me? I haven't streamed for such a long time. Yes. So, hello chat, hello. It's nice to stream, I haven't done it for such a long time. I think my mic is probably a bit not quite, isn't it? How about now? A bit better? Yeah, basically the same. Okay, so once in particular for this stream, I thought what we could do is use it as an opportunity for chat to tell me what you want to hear, what you want to see, things you want to check out on the Minifreak, because obviously you had the great big bunch of embargo lift videos that came out a few days ago. The reality of most of those is that actually most folks hadn't had the Minifreak that long, about a week maybe. So, well, that's everyone that got videos out. One thing you want to see in particular, just let me know, otherwise I'll just explore it a little bit. But yeah, it's really good. This is a synth that I'm very excited about. Okay, some questions coming through on chat already. So, slow this down a bit. Let's do this. Let's do some slice as well. So, some questions in the chat. I've heard said that the Minifreak is just two microfreaks welded together, but does it have some polybrute goodies? It's loads more than just two microfreaks welded together in terms of the flexibility of the Mod Matrix. You've got three times as many modulation destinations. So, you can do a lot more in terms of rooting your modulation. You don't have the Minifreak had any real lack of that. But then you've also got the two oscillators, of course.  So, I think it's a lot more than just two of those welded together. What else have we got? I want to hear the modal synth models in poly. I will get to that in just a second. That's a great idea. Good shout. Are the keys the same size as the keystep? As far as I can tell, yes. So, yeah, mini-keys, keystep size. But the keybeds are really nice as far as mini-keys go. So, I'm happy with that. Keyboard feels nice. What are the filter details? Filter details, I don't know for certain, but I will assume this is the SEM filter as it was on the microfreak. It has the same functionality. The resonance sounds the same. So, I'm guessing it's probably the SEM. What else have we got? Would have been cool to have the touch plate keys, yes. I know that I'm probably in the minority, but I loved the touch plate keys on the mini-freak, and I wish this had touch plates. There we go. That's my view on it. That's why it's nice to make cool rhythms. It's an awesome feature. The fact that you can use it on the arpeggiator and on the sequencer is amazing. Is the housing made completely metal? I think there's some plastic in there, but a lot of it's metal. What do the frog buttons do? What do the frog buttons do? I'll show you that right now, and then we'll go on to the modal as requested. So, the frog buttons are related to the arpeggiator. So, if we adjust the octave amount, then you also, depending on how you've got your frog set, you've also got the random octave as well, which will jump the notes in the arpeggiator round. Right, let's get to the... I'll try and do as many questions as I can in the stream. Let's get back to the modal question, because that's a cool question I actually haven't tried it. Back to initialised patch. So, let's go on here, the type here, and we'll go to modal. So, for modal, we're going to want to set the release to full, because it has its own decay. Let's go down octave as well. For some reverb on that, I reckon. Give it some reverb. Turn the horn. Higher octave. That's pretty. Let's put some pitch wobble on that. So, come in here. I'll go to an LFO, a little bit of pitch wobble. Because we're going to add some filter to it. Then we could put maybe the carpola strong behind it. Yeah, that's the modal synth in poly there. Good fun. Let's see. Can I assign how to use those assignable routing options again? Yeah, sure. So, let's go back to an initialised patch. So, say I want to control something in the matrix here that I don't have control of with the default one. So, you've got pitch, wave, one, timbre, one, cutoff by default. So, say I want to modulate the attack based on an LFO, for example. So, that's not something that we have access to. So, all you need to do to assign any knob that's on the control panel to your mod matrix is hold down one of the buttons with all the knob. And now this column with this button is this knob. So, we can now choose what we want to control it with. So, maybe we want to control it with an LFO. Maybe a slow LFO. Turn up the amount, something like that. And then if we're going to do that, actually we need to make sure that this isn't re-triggering, of course. So, let's turn the re-trigger to be free. So, now we've assigned attack to this column here. We've got it modulated with an LFO. So, now our attack knob has been wiggled by the LFO. So, if we did like an arpeggiator. We have the attack sort of fading in and out. And you can do that on the mini-freak with up to nine different parameters now. So, you've got one, two, three, and then you can switch page by pressing shift. And then you've got three more. And then, again, you've got three more. Yes, that's here. That's the signable modulation there. Does unison sound satisfyingly fat? Let's find out. Let's go back to initialised patch. So, I believe... So, this is just with a sawtooth wave. I think in here we can pitch a new voice. Yeah, unison spread and unison count. So, at the moment we've got all six voices. And then we can come out of here and do the spread. Now, what you don't get with unison here is any stereo spread, unfortunately. Which would be amazing. But we can also do spread across like... That is the start of the Ganon fight in Ocarina of Time, isn't it? Amazing. And then you can also stack it as octaves. Yeah, so there's unison. Let's see what else. What is the body composed of? I think it's some metal, some plastic, I believe. Let's see what else. How do I like it in comparison to other synths I own? I like it a lot. I haven't had it for long enough to really say for certain. But the kind of creativity side of it and sort of... I can make it do lots of things that I want to make a synth do. So it's potentially up there with the Opposix for me. And the Opposix is one of my favourite synths that I own. So I like it a lot. So I have some gripes. I wish it had the touch plate keys. And I've had one complaint about the... It's not so much about the sound, but the delays and the reverbs are a little bit safe. I'd like to see something a bit more sort of freaky with those. Yeah, delicious. Is there a feedback parameter on the chorus effect? Let's find out. I think there is, yeah. So let's go back to initialised patch. And come in here, we can choose chorus. So we have rate, depth and dry wet. So no, it would be the answer. Chorus does sound quite nice though. And there are different types. So let's just see whether any of them have a more feedback. Oh, that's got more feedback on it, hasn't it? So some of them have got more feedback in them naturally. But there's not a straight up feedback control in there, unfortunately. But it does sound good, doesn't it? That's a nice wide-sounding range. Nice stuff. Do you, I think it would fit well alongside your trusty blow-filled, mod wave and peak? Yes, I think so. Have I noticed any timbral differences between any of the plaits oscillators from Micro to Mini? I haven't done a side-by-side comparison. What I plan to do in some free time, I might do a video on it, I don't know, but I'm planning to manually transcribe some of my patches from the MicroFreak to the Mini to see whether there's anything particularly different between them. Let's see what else we've got here. I love that it will include a free VST, Me2. Does the MiniFreak send out all MIDI data after touch up? I haven't tested up. I would assume it would send out after touch because the MicroFreak did, but I don't know for certain. Sorry. And Luca asks, does the LFO go into audio rate? Let's crank those LFOs. So we keep going back to a boring initialised patch. We'll build some patches in a minute, perhaps. So let's throw LFO1 into cutoff. That's a good place to do audio rate. So from the low end, this is the lowest. Which is pretty long for someone that likes to do ambient and generative. That's actually genuinely possibly not long enough. So that's the longest, so let's crank that. Audio rate about there. Yeah, 1 into audio rate now. Not high audio rate though. But certainly, we can get some stuff done there. Square. Oh, the exponential sort. Sounds good audio rate. Now I wonder whether or not we can push the LFO to go faster if we modulate its rate. Perhaps if we modulate its rate based on the keyboard, can we make it go faster? So if we go, so we'll assign the rate there on the assign knob, and then do keyboard modulating the rate of the LFO. We might be able to push it faster, I don't know. It might be topping out though. So I think it went faster. I think it goes faster than we had it. But not by much. So this is just the filter now. So we can hear. So that's as fast as it could go. So it's in audio, right? Quite comfortably. So we can do audio rate there. Can you still modulate a mod matrix with a custom mod slot? Yes, you can assign a depth to an assign and have something else modulate something else. Like you could on the Microfreak, that's amazing for generative stuff. That's good. Does it gent? That's a good question, so we find out. I reckon to do gent, we probably want carpless strong. So let's go carpless strong. Then we're going to want to distort that, of course. If we're going to be doing gent. Oh Jesus. Angry at distortion than that. Is that genting yet? I don't know. Three band EQ. Scoot the mids. And it will chug as well. So I'm probably way behind on the questions. Because there's loads coming in. Thanks so much in chat for getting them. I will try and get through to everything. Everyone here is cool, and I love you. I concur. Is there a tape echo delay? There's not a straight up tape mode on the delay. There is, however, a filtered delay, which I guess is what you probably want for tape kind of stuff. The delay. Let's try filtered ping pong. You can do all that kind of stuff. But the delay, the filtered one at least, doesn't go to infinity. And reminder, all of these effects controls are modulatable by the Mod Matrix, which is good news. And also in the macro controls as well, which I showed in the video. Can I make a string sound? Yes. And so can you. There are various different ways to do it. You can actually go for a straight up string sound, because we've got Karpus Strong here. So we can get there pretty quickly. Oh, we could have two Karpus Strong at once now, couldn't we? Have them slightly detuned, and that would be nice. So there's another Karpus Strong there. Oh no, are you sweetie? That's very kind of you. Lovely to see you there. Thank you so much. Yeah, so we can do a string sound, of course. Of course, we could also make this paraphonic if we wanted to get that kind of string synth kind of feel, and if we wanted to use paraphonic correctly. It's still polyphonic. Don't think it's not polyphonic. Mark Doty will be annoyed. Or so that's not paraphonic on the VCA. Yeah, anyway. Could I imagine this being multi-tomboral with an update? I... maybe. I mean, architecturally, you'd have to have everything going through the same effects, but I guess so. I think although you can certainly modulate the type of the the type of the oscillator in the Mod Matrix, so you can... If you used the keyboard modulation, you could put two different sounds on two different parts of the keyboards because you have enough modulation here to have two completely different sounds on different parts of the keyboard, and I think you could even modulate the type. Let's try. Let's not talk about it. Let's try. If we just go in the middle somewhere here, and we assign type to the assign there, and then we modulate that based on the keyboard. Like... Yeah, so... It's actually moving through different oscillator types. So you can make things essentially multi-tomboral within one patch by spreading things out using the keyboard, so we can even change as we're seeing the oscillator types here, but you can fine-tune stuff so much, and you've got nine slots to do it, and that's quite a lot of push-and-pull. It's not quite as much as the Opposix, but it's still plenty. So even if they don't give us multi-tomborality on the firmware, then we can still fake it. Fake it till we make it. What am I drinking? That's a great question. I'm just going to have a bit more of it. It's a whiskey called Kavalan, K-A-V-A-L-A-N, which is a Taiwanese whiskey that my good friend got me for Christmas, I think, possibly on my birthday, and it's delicious. It's genuinely one of the nicest whiskies that I've had incredibly drinkable. It's dangerously smooth, basically. Delicious, though. Effects at this price range since it's a pretty dull, but I think that's a good thing. You can always skip the news. Erring on the side of usability, of course, is good. That said, I would at least like maybe a shimmer reverb, you know, that might be a nice or pitch-shifting delay. Although, you can probably fake a pitch-shifting delay. If we... So if we come into here and we make use of one of the synced delay, that one doesn't smear, though. Do any of these smear? That's a shame. So the synced versions of the delays don't smear, but if we assign an LFO to the time here and we use a stepped LFO like that, so LFO 1, there, gets slower, and we need it free-running as well. Sure. Can you modulate the effects in the... Oh, hang on, I might skip to some there. Can you modulate the effects in the... In the Modmetrix? Yes, certainly can. Can the macros send the LFO further into audio rates? No, because it can only affect the knob position, so it can't push it beyond the knob position. You're setting knob positions on the macros, unfortunately. What would I pair this with for a drum machine? Digitact, sure. Always digitact, or syntax, or digitone, or any of the many wonderful drum machines that we have access to. I've got the... If I had thought to set it up, I could have put the drum log out as well. Can't work out if that's a massive glass or a tiny synth, kind of both. I'm going to be contriving with it. It's a lovely synth, but without the freaky keyboard, is it really a freak? I've made my opinion known for that one. Hi from Belgium, hello. What else? Can you shout to make a delayed LFO with the Modmetrix? Yes, I can. Just checking that there isn't already a delayed LFO. No, fine. So the way you would do this is by rooting the LFO's amount through something else like the cycling envelope. So if we... As a starting point, it's probably easiest to do it with pitch. So if we root D, D, D, LFO to pitch... So if we wanted that to come in over time rather than be there straight away, what we would do is we would modulate the amount of this slot with something like the cycling envelope. So if we set our cycling envelope to be a sort of swoop in, and we set the sustain to full. So what we would do is... First of all, we want to turn this amount down.  Then what you do, it's difficult to show because my hand kind of covers things up, no matter what.  Like that. And what that's done is now assigned that slot to this column. So now... We can turn that one off altogether. Now that we've come to a sign one, this is now... Have I managed to... Is that right? I think I've done something wrong there. Have I wanted to pitch? Hold that down. Why isn't that working? What am I doing that's dumb? So we're starting in the wrong... Do I have to start outside of this? Why can't I make that work? If I had made it work, I just had the attack set to... That was working. I just had the attack set too short. So we were hearing it straight away. So now... What I showed you the first time was the right thing to do. I just had my cycling envelope set stupidly. So now the LFO fades in instead. Silly, silly, silly. I wish I could backport some of the features in the Mini Freak to the Micro Freak. No idea. I'm afraid. Not like it's Synth Punk. Does it have a power supply that screams when the synth is off like the original? I never did that. And not that I've heard. No. How portable is it? Would it be possible to add a 12-volt bird cord? I don't know what the power requirements are on it. I don't have the full specs yet because I still don't have the manual, I'm afraid. So I don't know. The power supply that came with this, I think, is similar to the one that came with the Micro Freak though. So it can't be pulling much more than that power supply can supply. Will After Touch Route 20 parameter? Yes. So it's assignable inside the Mod Matrix. So anything that you can assign in the Mod Matrix will assign to there. I've nearly caught up. I've been looking for my first hardware synth. Would I recommend this? Yeah, I mean there are lots of good potential first synths. What you get with this potentially is a slightly wider range of oscillator sounds that we do more readily available, I should say, maybe, oscillator sounds than on a lot of other synths because the Digital Oscillator is quite a bit that sort of put behind presses and turns and in the menu there's quite a lot in the menu actually. So from that perspective, there's a bit of menu diving but there's nothing that's particularly difficult. I think it would make a good first synth, but there's a lot of competition for a good first synth. To be honest, there's loads of decent, more knobby per function synths that are out there. Right, I've got to the end of the questions. So I'm going to make a patch. Might try something more generative or, I don't know, let's see. Initialize patch. Let's see what we can do with generative stuff. Should I turn it into a drum machine? No, I'll do that in a video. Oh, one thing that I really like about this. Here's what isn't a good example. I alluded to this in my video, but here's a good example of a little thing that's in here that just is really, really neat. So I'm just going to turn up the other oscillator. So it's got the two oscillators going there. Cool. So obviously what we could do is route an LFO to just one of the pitches of the oscillator. So maybe I'll just do it to just one, rather than one and two here. So we can assign that here. Boop, cool. And now if I put an LFO into it, obviously if I turn it up high, it's going to sweep all over the place. Which maybe isn't exactly the kind of sound that you're going to want. But here in the menu, which you have no hope of seeing on here, we have a way to quantize the pitch mod on here to different things. So we can quantize the pitch mod on the oscillators to chromatic, for example. Turn down. So now the LFO is modulating the pitch of the oscillator, but it's chromatic. Or we can go octaves. Fantastic. Or fifths. Scale. Or major scale.  So if we now change that wave into like a random sample and hold, we'll synchronize it. And then we could duplicate that on the... Oops, I didn't actually save it. Ah, that's silly. Sorry. So if you set that to minor pentamonic again. We do the same thing on oscillator 2, but then do it with a different LFO. Then we'll just get it to start making its own melodies. Like that. And then we can do LFO 2 going to the other oscillator pitch, which is also quantized. It's a reverb. So there's an example of just a really nicely thought out feature that's just there to allow you to do something creative without having to... Well, you can't do this on a lot of synths, right? So you kind of get to do self-patching stuff. You can also get stuff... I haven't really checked all of this yet. But you can get the different... Yeah, so if we had the cycling envelope set to an envelope mode instead. Now set the cycling envelope to be triggered by LFO 1, for example. As you can get. So cycling envelope. Can I see it now? Retrigger source LFO 1. So now it's sort of self-playing. This isn't the arpeggiator and this isn't the sequencer. This is just application of... So it's pretty cool from that perspective. Sorry, I got distracted. Now I'll scroll back. Let's have a look. How far can you push the standard shape virtual analog oscillators as far as classic synth sounds go? So you can do your classic poly stuff, of course. So let's try speedrun. This is a classic pad sound. Any percent. Virtual analog. Chorus. Like it on Twitch for synthesizer speedruns, I don't know. Use velocity to adjust the envelope amount. So we should be able to go... Setting LFO... Sorry, setting aftertouch to do... To do more pitch wobble. So we could do... We need to turn off velocity... In there. So... Where is that? Keyboard. Matrix source. Just aftertouch. Now I have a CS 80 or something. One big thing that we've lost with the touch keyboard is that we don't have poly aftertouch anymore. So now I can't do single note... Single note pitch wobbles. Which is a shame. So you can do classic sound stuff. For sure. D, D, D, D, D. Tick-tock keys. To go is amazing. So that's good. Is that in sync? If you're talking about... Way behind now. The LFO stuff, yeah, it was in sync. Do I think it might benefit from a vintage inspired knob? Everything does. The frog is the octaves on the arpeggiator. So that's... Kind of boring but useful. D, D, D, D, D. Cool. Let's make another patch. Let's do something... Let's do something... Let's do something after having your drink first. Oh, I know. I know, I know, I know. So one of the things that... That's really, really neat is that some of the oscillators and oscillator 2 will take the input of oscillator 1 and shape it and abuse it. And my favourite one that I came across. One of my favourites. I like the comb filter as well, but there's this destroy one which is like a decimator and bit reduction and everything. Kind of wave folder, but it's pern note. So we do have a... In here we have a bit crusher mode. Yeah, so we've got bit crusher. But you can hear there that when we do the bit crushing and decimating you're hearing it interact with the different notes that I'm playing. So here what we can do is run oscillator 1 per voice into oscillator 2, which is acting like a decimator which gives you a completely different sound because it's not going to have the different notes interact with each other. Wave folder in here as well. So this is just with the basic waves oscillator as the input. This awesome glassy sort of... like a digital broken recording of like a toy box or something. Love this kind of stuff. Bandpass filter. How cool is that?  So assign that in the mod matrix. LFO 1 goes to timbre. It's a different level of messed up. Amazing. Give that like a phase... We could bit crush it again. Should we try that? We could put a phaser on it. So someone asked whether we had feedback on the chorus. We don't but we do on the phaser. Put some quick delay on that. Stereo perhaps. Stereo. See what that needs is the arpeggiator of course. So the custom LFOs really are. It's going to depend on what sort of patch you're creating. For a patch like this probably not a whole lot of use on it. Generative patches or stuff where you're trying to create rhythmic rhythms within the patch that you're playing. Really useful for that kind of thing. If you're trying to make like a drum machine type patch for example. I don't know if the kind of person that would do that kind of thing. But that would be a really useful thing there. I'm not going to use one every patch. I haven't used them at all in the live stream. But for the right kind of patch they'll be really really useful. I think running them really slowly and getting evolving rhythms. Maybe with both of them working in custom mode. That might be really interesting. So these ones do still somewhat suffer from the micro freak issue. On the micro freak a mode with the holding of a shift didn't they? In some modes they take a long time to turn. But they're not as obviously bad as they were on the micro freak I don't think. The sounds coming out of this are like the sounds that FM has to show off to prove why FM get those sounds. That's not true. FM is easy. You just don't know it. Agreed. This is the kind of thing that you might otherwise try to do on an FM synth. Like I'm sure I've made a patch like this on the opposite. That's enough of this. So this is just the arpeggiator by the way. I've got the slice and dice thing happening. Again a bit more sort of rhythmic stuff happening in there. Mutating the arpeggiator which shifts the arp. So you can kind of just leave it. This might be pretty neat. Let's do another patch. Should we do something disgusting? What time are we at?   Do you know what? I'm going to save that patch. I like that. I'm going to do an awful thing and not name it though. So do as I say, not as I do. Right, so let's try making something foul. So I reckon we'll use one of the noise engineering ones. Probably the bass one to begin with. Because with that noise... These are such a gift, these noise engineering ones. They are beautiful sounding oscillators.  It works wonderfully in really delicate, broken sounds. Well I love it. Okay, mono. Good start. Listen to how much movement is in there already. This is just the noise engineering bass oscillator type. Fantastic stuff. Now I just think it does look great. I've not really used one in any great depth. I did contact ASM asking them if they wanted me to make some videos and they just ignored my email sadly. So... Yeah, need a Euclidean sequencer in there. You need an Euclidean sequencer in everything. Amen to that. I just need PAMs here. And the MIDI expander for PAMs. Right. So we've got that. Let's use the other oscillator to just give us a sub, I think. Probably use the basic way for that. We'll use the same one perhaps. And then just tune it an octave down. Boop, boop. Okay, so I reckon that saturator knob, which is the wave, needs to be controlled by an envelope. We'll use the cycling envelope for that. So, cycling envelope to wave one. It's already in the mod matrix, starting to assign it. Boop, boop, boop. Boop, boop, boop. Can we decouple the envelope from the VCA? Okay, so let's just use the cycling envelope for the cutoff as well. Boop, boop, boop. Sequencer in there. So, spice. That's distorted. So some of the distortion here is absolutely vile. Disgusting, at least. So we've got a folding distortion. So we're watching the cutoff, so we've just got some movement Yes, there's the answer. So slow, synchronized, identified. So it's off. It doesn't sound like it's doing much, it's because it's resetting the envelope. So it sounds frugal. What do you reckon? Some chorus? And then some delay? Oh wait, no, no, no, no. Not chorus, unison. And then some chorus. There's a glitch. Oh, wait, no, no, no, no, no, not chorus. Unicorice. Oh, no, no, chorus. So put some delay on it, right? And then what we do is we can set the top one to quantize its pitch modulation to octave and then send a slow LFO to it so that top line keeps moving whereas the sub stays still. Sick. Or maybe fifths even. We'll see. Uh, what was I going to do? Okay, delay. So, yeah, what we're going to do is I'm going to set the pitch mod quantize for oscillator one to let's try octaves and then send and make it continuous as well. I need to do that. So LFO two can go to tune of oscillator one. Obviously a bit fast. Right, just checking in on any other questions. Does the spice add in random ratchets? Yes. Looks like I need a refill. Yeah, no vocoder. No vocoder at the moment. Hopefully they change that. Now before we go, the question is can I make it do like a bass drum sound? Or have I used the four-way envelopes now, unfortunately? Let's try it. Let's try it. Hang on. Let me think. Sorry. We probably do this for the mod. I've had another envelope. I could do this. It's too late. I wish I left the drum lock out. Anyway, I think I'm going to leave it enough to kill that night there because it's getting a little late over here and I've got a busy day tomorrow. So, yeah, I probably could do it with the mod lane, but it requires me to think about it too much. Yeah, I reckon you could probably... What could you? See, this is what the LFO designer would be good for as well, because you could have four-beat LFO where only the first beat has an indent in it. Yeah, but yeah, thanks everyone for hanging out and thanks for asking all the questions. I hope that it was a useful stream for everybody, and I hope I've managed to show off a couple of different sounds that I wasn't able to show off in my video. If you haven't checked out my video, then it's there. I go through all the features. I build three patches from scratch, a little bit less haphazardly than in the live stream, so if you want to check that out, that's there. But I make a quick custom LFO. I've told people I'm going, so people are leaving the stream now, so I feel bad for then making something else. I do make a custom LFO in the video, so go watch the video if you watch the video, then you can see me make a custom LFO in there. Yeah, otherwise, thanks for hanging out everyone, and I hope you have a wonderful night. Take care. Thank you, Martin. That's really, really kind of you. It was disgusting, wasn't it? It's just what we want. Play you up there then. Take care, everyone. Bye-bye. Have a good evening, or night, or day. Take care. Bye-bye.


QuickBooks Online 2022 import bank transactions into QuickBooks. Get ready because it's go time with QuickBooks Online 2022. Here we are in our bank feed practice file we set up with a 30-day free trial holding down control scrolling up a bit to get to that one to five percent currently in the home page otherwise known as the get things done page and the business view as compared to the accounting view changing to the accounting view is something you can do by going to the cog up top switch to the accounting view down below we will be toggling back and forth between the two views either here or by jumping over to the sample company file currently in the accounting view back to the bank feeds practice file last time we've been talking about setting up the bank feeds noting that we can do so by going to the bookkeeping area down below then going to the transactions tab up top and then going into the banking area we have the two options that we can then upload by and note that you can also basically set up a new account by the way which would be a cash type of account or credit card type of account those which can be connected to financial institutions if you would like to take that route we're setting up your bank feeds but you have then two methods that you can set up the bank feeds either connecting directly to the bank or by uploading the transactions in prior presentations we downloaded the transactions directly from the bank and now we're going to put them and upload them into the system we're going to do so with a QBO file which is a data file you can typically get from most financial institutions but if not we also downloaded the CSV file which is in essence an electronic spreadsheet without any of the other kind of formatting things in it that would be there for like a normal Excel type of document that we can then upload once uploaded you will be in the same spot whether you have the bank feed connection or whether you just uploaded in other words you'll have the financial transactions which are basically this kind of stuff the increases and decreases and the dates which you can also think at about and visualize in the format of a bank statement which would look something like this although not the same data into our bank feed limbo that will then have to add into the system in such a way as we can then add it for the financial statement creation balance sheet and income statement so I'm going to go then to the upload transactions close the hamburger upload transactions left-hand side we have the capacity to manually upload the right-hand side bring in transactions automatically so we're going to be doing the left-hand side here which says number one open a new tab and sign into your online bank account so that's going to be the verification process that they would still like to have even though you're basically just uploading the transactions into the system number two export your bank statement in and dot CSV dot QFX dot QBO dot OFX or dot TXT now you would think the QBO would be the one that would be the easiest one to upload into the system and when you think about the bank statement notice you you might not format it just like a bank statement which you typically think of as a paper statement or a PDF type of format generally you're going to want it in one of these formats which is basically a list of the data that you that you have here that's just direct data in a data format then we're going to upload your bank statement here so we can drag and drop it or select the file which we will do now so I'm going to go ahead and select the file so I'm going to go and select the file here and see if we can locate it we put ours on the desktop it's on the desktop up top here and I'm looking for the QBO file I could put either of these two in place but I'm going to do the QBO file I would think that would be the easiest way to go and then I'm going to scroll down and continue that it says which accounts are these transactions from you got the checking account and the account information on the left hand side where do we want to put it in our books in other words what what account are we going to put this information into we don't have an account that it's going to be going into at this point we need to add the account which could be kind of a problem if you're looking at the business view because I think it's a little bit easier to add the accounts in the accounting view so you might want to do this with the accounting view but I'm going to try to do this it does give me I'm in the business view and it gives me the ability to give me the look and feel of the accounting view which is nice the main thing here is they defaulted to a bank account that's what you need to select because the bank account has the capacity that's the account type that has the capacity within QuickBooks to allow the bank feeds for it so that's what we want cash on hand I'm not going to say it's cash on hand I'm going to call it the checking account call it the checking account and then you might want to put like the last four digits of the account number sometimes and this is just a mock account number right there of course sometimes you might want to put the actual name of the checking account could be useful of the financial institution that is but if you have multiple accounts at the same financial institution the thing that is easiest to differentiate one account from the other is the last four digits of some account number because the first four digits could be the same too that's why you're picking the last four digits you might also want to have if you have a multiple bank accounts basically a sub or a parent account called the cash or the checking account possibly just a generic cash and then sub accounts of your multiple checking accounts underneath it if you have multiple checking accounts you can do that by selecting the sub account down below down here but we're just going to have one account checking account up top okay when do you want to start tracking your finances from this account in QuickBooks I'm just going to say save it and close it here there's our checking information let's continue it says then the import is completed so it looks good next step accept your transactions you're in control of how your bank info goes into QuickBooks transactions only show up in your books after you review and accept them so in other words we're in the process right now but it's not finalized or in the books at this point in time so I'm going to say done here and then power up QuickBooks to get organized and it says review a few expenses now to help QuickBooks learn how to categorize you when you're done see the snapshot I'm going to go ahead and skip this one skip it please and this is what we have here so you get the little tag up top we'll go through this in a little bit more detail later but you got the tag up top which is going to be the account that you're currently in so that'll show you where you are at as you scroll down then you've got your information down below and then the actual transactions down here which you could see basically this is the raw data that they're pulling into this section which I would call Bank Feed Limbo that means it has not been confirmed or added in other words you have to add these with either the confirmation here it's trying to guess over on some of these transactions to help us out but it's not all automated it's not automatically going into the system yet and typically we're going to want to add a couple kind of things one is going to be the account that it needs to go to it's guessing here that it's going to the service account and two we need to add the customers and the vendors which you can add you can put this into the system without customers and vendors but if you do then you're losing a level of detail that you could have by adding the customers and vendors you won't be able to search in other words the transactions by customers and vendors if you don't add the customers and vendors so it's a very good practice to do and that's what we will be doing just to see this however let's go to the tab up top right click on the tab up top duplicate that tab I want to go into the reports just to note that the data that's now in the system is not being included into into our reports yet so we can go here and check this out by going to the in the business view it's under the business overview the reports in the accounting view would be if I jump over to the accounting view the reports are down below and to get into the banking area in the accounting view it would simply be banking on the left hand side and then you have your banking items up top that's where the bank feed limbo what I would call bank feed limbo the holding area of managing the data from the bank feeds will be located I'm going to go then to the reports I'm back to our sample file we'll go into the reports and if we were to open up the standard two reports the balance sheet in the income statement let's open up the big balance sheet and just do a range change this is for latin this is for 0101 2 1 to 12 31 2 1 and run it and there's nothing there right no transactions yet if I did the same thing for the income statement is there anything in the income statement yet because I just imported all this data from 010122 to to 1231 222 run it and there's no data there yet so so that means there's work to be done and the work that needs to be done no matter what kind of accounting system we have even if it's the easiest system to be able to implement the bank feeds into and create and automate directly from them the financial statements for the first few months we'll have to do a lot of work assigning out the proper customers the proper vendors the proper accounts and then memorizing those transactions where necessary so that it can be more automated in future periods that's what we'll work on in future presentations


Hi, this is Nate Adams of Energy Smart Home Performance, and I'm up in an attic today getting the prep work taken care of. I don't always help out with this, but I'll be doing it in this case. So this spot right here, if you look over here, this is a bathroom. This is called a drop soffit, so the ceiling is down about a foot there. This is a big leakage area, so I'm going to prep that by putting some fabric across the top and foaming it in. But then there's another open wall cavity here, there's open wall cavities everywhere. So what you're looking down, this is inside the wall, the second floor. So there's heat that just works its way through here, and any air leaks like outlets and light switches and so forth leak air up into here. So I'm getting this ready by stuffing it with some fiberglass, which you see through here, and then I'm going to foam the top of that. And then also note where you have a round object or a square hole, you want to get those sealed up. That's typically how it gets cut for plumbing stacks, so there's two right here. And then the last thing that I've been working on is over on the gable end. This is a very old house, this was originally built in 1842. So in Cleveland this is about as old as they get, and so this is also an open wall cavity, the outside wall. We're going to be blowing these walls next year.  And then we'll never get a really tight pack. So this is not going to affect the air leakage numbers today, but it will next year once we get this fixed up. Now this house is also unusual. Take a look where you can see daylight coming in from outside in the siding. This is kind of crazy. So this can be where insects and bugs and so forth can make their way in. In fact over here there's a place big enough you can see where somebody's clocked it. So I'm just going to nip that with some foam while I'm at it. And then the last piece, oops, here's why you check your work. I missed that hole. I need to get that plugged. You can see up here I got that plugged with some fiberglass. And fiberglass, I'll get some foam over top of that. The fiberglass is just to keep the foam from falling straight out there. But over here you can see up in there this goes into the Eve. So this is where critters can get in. If they can get into that Eve then they can climb into here.  So hence you can see we've removed the insulation. So this is an interesting project and an interesting bit of prep that needed to get done for it. So I thought I would show it off.


Studying Hamlet, let's look at key quotes relating to Claudius' character. In Act 1 Scene 2, we discover that after the death of his brother, he's been quickly crowned King of Denmark. He begins his coronation by saying, the yet of Hamlet are dears brother's death. Now here he speaks an Imbit pentameter, basically showing that he's somewhat mourning his brother's death. He also says, of his death, the memory breed green. Now the caesura hair shows that it isn't that long ago that his brother died. He also says that we with wise of sorrow, think on him. Now the literation of W hair basically is him saying that we're still thinking of King Hamlet's death. Yet he follows this on by saying remembrance of ourselves. Now the pronoun here ourselves is basically saying, whilst we're thinking of King Hamlet's death, we should also think about ourselves, which seems a little bit disingenuous and false. This fakeness is also shown because he talks about our sometimes sister, now our queen, referring to Queen Gertrude and the sibilance of some time sister shows that he has basically married his brother's wife. He then juxtaposes the words funeral and marriage. The composition of these words show he's really quick to marry Queen Gertrude. We question his motives.


defining statistics. I've been teaching statistics for so many years like 16 17 years and every time I enter the class I see almost the similar faces. Over the last 15 years I haven't seen much change in students attitude or students kind of you know first you know reaction toward the word statistics like why statistics and why statistics in psychology and they have so many myths about statistics that it's hard we opted for psychology just to stay away from statistics why we are teaching why we are studying it it's gonna drive me crazy it's gonna be very tough oh my god I can't do statistics and I have even seen teachers like professors and my friends and colleagues even they will just say that oh statistics is really hard like you say I'm getting a K Air Mujee Punjabi wonnie me aty. So there are certain attitudes and certain perception about statistics and the first reaction most commonly and on average I have seen in students particularly in under that students that statistics is something really tough and it's gonna you know drive us crazy but today we will talk about statistics actually is really not that tough or statistics is the kind of thing that our first reaction should be like it's really the coolest thing in psychology because I know that we all say that psychology is a science and by end of the your undergrad degree even you will be getting BS or MSc in psychology so it's a science degree and what actually is making psychology science basically because statistics is a one magical kind of thing or a magical van which gonna you know take any objective thing you will collect data we will talk later in our lecture today but you can collect data and you can take the observations you can run few analysis and you can report the results in a very objective way and in a very empirical way. Statistics is really coolest thing and it's really magical to me because we get answers to the questions that we really are entrusted only through the help of statistics. Similarly, in psychology, our stigma is that if a psychology student is meeting somebody in any social gathering or anywhere, the first reaction is that you are a psychology student, tell us about ourselves. So I always think or my students we say that we are not magicians that we're gonna tell you what's gonna happen what's going on in your head but you are thinking we are just psychologists but yes actually we can tell people attitudes we can tell their perception we can tell their thinking patterns we can tell their preferences we can tell their likes dislikes their personality their cognitive abilities and there's so many things about life by using research and statistics like we ask them a couple of questions and then we you know see where the questions are coming from link them with the research and design and run the analysis and yes we can give you answer on that that what kind of personality you have what kind of cognitive abilities thinking patterns preferences all those things. So, Pela Meera appeals, all students say again statistics is really something that is coolest in psychology and it's a kind of such a wonderful and amazing thing that you really get all what you really want to know using statistics. So how we define statistics basically the term is refers to a set of mathematical procedures for organizing summarizing and interpreting information. For example, if your class go my Pela test do or failure assignment do or may up supposing the hundred students are registered for this course and they get the first assignment and that assignment is of 10 marks and each one of you will be getting some score out of 10. So, may be pass 100 data points are going to make it so sophisticated that I can summarize and I can organize and I can present the data in a very smart way. If you ask me how students are performing, I can just tell the whole hundred observations in one score, average score on the first assignment in the virtual classes is kind of 6 out of 10 or 10 or 10 or 10 or 10 or 10 or 10 or 10 or 10 or 10 or 10 or 10 or 10 or 10 or 10 or 10 or 10 or or maybe 7 out of 10. So we can just not only collect data but we can organize in a frequency distribution kind of thing in a graphical sort of thing and then we can present data in a smart way. Statistics is the science of designing studies or experiments, collecting data and analyzing data for the purpose of scientific discovery. Just I have just said that we are just collecting data and we analyze it and we get the answer. So statistics help us in designing the studies and then analyzing the data and reaching to some conclusion or answer. Statistics is a science of learning from data. I always remember when I was at Michigan Tech in my professor used to tell me, Saima always feel the data, Saima look at the data, data definitely is telling you a story, learn from the data, what is telling you and now I realize that yes, every time you collect the data, it's just learning from data and every data we collect on any topic actually has a story inside it and that a researcher or a true scientist need to explore what the data is, what the data is and what the data is telling. So statistics and it is a tool that actually help you, you know, kind of get story out of the data and learn from that data. Specifically stats serves two general purposes. Number one, that we can communicate the results through statistics and then we can answer the questions that we are looking through scientific research or scientific inquiry. The statistics mainly summing up, it deals with the collection of the data, number two, organizing, summarizing the data, number three, analyzing the data and then finally making inference or decisions and procedures, predictions about the data. Mainly, in psychology, we are more interested in predictions and inference. So the fourth point that we are looking through is that we are interested in predictions and inference. So the fourth point or fourth objective would be more important in our course so that we can see how we can study a small sample and draw inference about the population. Statistics is important. Even if we don't work on numbers, we have to bring numbers and we have to tell anything, any answer, any solution, kind of quantifiable way, in objective way. So basically I say psychological research only makes sense when you are able to understand statistics.


The first thing about Holy Spirit, we learn He is our reporter. Second thing that we learn is He is our revealer. And the third thing is the Holy Spirit is our ruler. He is our ruler. It's so fascinating to see the fact that He was raised in the house of Jacob, but He ruled in the house of Pharaoh. He didn't rule the house of Jacob in the beginning. He ruled the house of Pharaoh. The dream was not that He will rule Pharaoh. If you remember the dream of Joseph, let me remind you, the dream was that He will rule his father's house. But his father's house had no respect for him. And the house that had respect for him, Joseph, the prisoner, Joseph with a scandalous name, Joseph with a questionable reputation. He says, Joseph, you got to hold a ghost. You didn't charge the whole country. By the way, here's the ring. Everything. He says, the only difference between you and me is I will still be Pharaoh. But the Bible even says further on that He, Joseph, becomes the father to Pharaoh. And guess what Joseph does? He turns the country upside down. He saves the country from their biggest problem. And when 14 years are over, when they went through the biggest challenge ever, Pharaoh, who surrendered everything to Joseph, became the richest man in the world. How do I know that? Because Joseph made every piece of real estate in Egypt be given to Pharaoh and every breathing human being and animal to be Pharaohs. What would Joseph do if his brothers would do the same? We are so afraid of the word ruler. Some of us, we fear because we saw rulers, people who pretended to be rulers. Intimidation, domination, manipulation. And we think exactly like that about Holy Spirit. Holy Spirit, He's not going to ruin you when you let Him rule.  He is not going to bring your life down. Not one bit. Your fear that He's going to take your favorite toys away, take all of your fun and not let you have sex until you get married and not let you have all the joy and all of these rigid things. When all of this is done, you will begin to see that actually He will elevate you to heights. You have no education, connections or intellect to get to yourself.  The fear of letting the Holy Spirit rule our life because He will take things and kick you out of the throne and sit on the throne and say, You, you be my slave. That fear is not scriptural. When Jesus said the Holy Spirit will come, He used the word parallectus. The meaning of the word simply means helper, advocate, counselor and comforter. The meaning of the Holy Spirit in your life is that He is going to come and when you give Him the keys, He is not going to ruin your life.  Joseph, after he translated the dream, Joseph never said, Hey Pharaoh, can I make a suggestion? You should hire me. Joseph never brought his resume and says, By the way, I know you'll be looking for a guy to take the position over Egypt. Here's my resume. Please consider me. Not once Joseph made a suggestion so that Pharaoh will choose him and Holy Spirit waits to be wanted. Holy Spirit waits to be invited. Holy Spirit, He's not going to push Himself. If you don't want it, He will remain as incarcerated prisoner and your life will remain a complete mess.


Hey and welcome to our first video in our series on trigonometry for electricians now trigonometry is a very important concept When we're dealing with electrical theory so much is based off of the right triangle Which we'll get into in other videos, but it's important for us to have the foundations of trig Now the beginnings of it are we're going to start with is Pythagoras's theorem Which if you remember from geometry in high school is just a squared plus b squared is equal to c squared Now the c squared is your hypotenuse side, which is going to be your longest side And generally what we're trying to do is figure out what the size of a side is not the square of the size of a side So what I want to do is I want to get rid of this square in order to do that I have to square root the c squared and to get the square out once I do something to one side of the formula I gots to do it to the other side So it ends up being c is equal to the square root of a squared plus b squared Let's see how that looks in a formula See what I mean here. I've got c is equal to the square root of a squared plus b squared Now let's throw this at a triangle and see practically how this will play out Trying to determine the sizes of the sides whether they be a and b or the hypotenuse c Now here, I've got us a right triangle We know it's a right triangle because I've got the square box here that tells me that that's 90 degrees Which also tells me that these other two angles have to add up to 90 degrees Because we know that all three angles in a triangle have to equal 180 degrees We also have a side and b side here, which will be given proper names in our next video But right now we'll just call them a and b and the important side here is this c side That is our longest side a k a the hypotenuse the hypotenuse will always be the longest side of a right triangle So if you calculate something and it works out to be smaller than a or b you've done something wrong And we also know that because it is opposite the 90 degree angle. So it will always be the longest side So let's throw some values at this a and b have given the values of four and five We're trying to determine what c is here now using Pythagoras's theorem We know that a squared plus b squared is equal to c squared So we know that the formula is going to be four squared plus five squared is equal to c squared So now that we've determined that c squared is equal to four squared plus five squared Let's get rid of these four squareds and five squareds. We know that four squared, which is four times four is equal to 16 Plus five times five, which is equal to 25 c squared is equal to 16 plus 25 Now that I've determined that c squared is equal to 16 plus 25 Why don't we just add 16 and 25 together and be done with it? So c squared is equal to 41 Now that I've determined that c squared is equal to 41. I'm not looking for c squared I'm looking for c so we need to get rid of this square somehow and like I said before We have to square root this side to get rid of the square Whatever we do to this side we have to do to this side. So c is equal to the square root of 41 So go ahead and punch that in your calculator C is equal to the square root of 41 and you're gonna work out that c is equal to 6.4 So congratulations, you've just solved for the hypotenuse, which is this c and so let's get rid of c and throw the answer in there So there we go now. We've determined that 4 squared plus 5 squared is equal to 6.4 squared Now what do we do though if we have a hypotenuse side in one of these sides and need to determine this side As we did before let's throw some numbers at it. I've got the hypotenuse is 450 and The B side or the A side is 225 Sorry the A side and now we want to determine what the B is so what we're going to do is let's plug into the formula We know that the formula is A squared plus B squared equals C squared or C squared is equal to A squared plus B squared So let's throw that in there. We know that 450 squared is equal to 225 squared plus B squared. Let's throw that into our formula Okay, so that we got that 225 squared plus B squared is equal to 450 squared Now we need to get B alone. So what we have to do is we have to subtract this 225 squared out of there Now even before we do that, let's get rid of these squares Let's figure out what 225 squared is and what 450 squared is and deal with those numbers first So we see that 225 squared actually works out to be 50,000 625 that's a big number plus B squared is equal to 202,500 Now we need to get B alone because we need to figure out what the B is right? We're trying to figure that out We can get rid of this 50,000 625 by subtracting it out of this side see this plus here that means that we have to subtract this to get rid of it as With any equation whatever you do to one side of the equation you have to do the other so B squared is going to equal 202,500 minus 50,000 625 So all we've done is we've moved the equation around here So we have B squared is equal to 200 and 2,500 minus 50,000 625 which works out to be 151,875 so we're getting closer to our answer B squared is equal to 151,875 as Before we need to get rid of the square that doesn't do us any good Let's square root the B squared and then let's square root 151,875 and get our answer because it's going to be B is equal to the square root of 151,875 So we're starting to see the answer get closer and closer here B is equal to the square root of a hundred and fifty one thousand 875 punch that into your calculator, and we get our answer of 389.7 So we have determined that 450 squared Minus 225 squared gives us three eighty nine point seven squared That is determined the size of B and that basically completes our walkthrough Pythagoras's theorem Doesn't matter if you have this side and this side you can go a squared plus B squared is equal to C squared Or if you have this side you're just going C squared minus This side is equal to this squared or C squared minus this squared is equal to this squared It's not too shabby at all. It's not too hard to walk through. This should just be a review from grade 12 Or not even grade 12 probably grade 10 geometry in our next video We're gonna start getting into some more trig functions Talking about the ratios of sides and starting getting it to sine cosine and tangent


Then man hands her a check. If you turn your television on to any news channel, you will either hear about the protesting and riots or see live coverage of them. It is incredibly sad that a relatively small group of people makes it appear as if everyone is bad. The truth is that most people showing support for George Floyd and his family are doing so peacefully. Yes, they are standing up for what is right but they are being respectful about it. Unfortunately, even some of those individuals find themselves in the crosshairs of the hoodlums trying to destroy cities. Some of the peaceful protesters include single moms. Although they are already tapped out, short on time and often living on limited funds, they too want to lend their support for positive change. So when they become the target for rioters, it hits especially hard. Like a lot of other single mothers, Michelle decided to march with a group of protesters who weren't doing anything wrong or bad. But while heading to her car after marching, she made a horrific discovery. As Michelle turned the corner, she couldn't believe what she saw. There was her car destroyed. It hadn't just been vandalized but severely damaged. The windows were busted out, doors kicked in, and the interior ransacked beyond recognition. Remember, Michelle is a single mom. So how on earth would she come up with the money needed to fix her car when she barely had enough to survive on? All she could do was cry. She stood there looking at her vehicle with tears streaming down her face. We don't know if Michelle believed in angels before this event, but we're pretty sure she does now. As she stood on J Street that fateful Sunday night, something unexpected happened, but this time it was good. A black man she had never met before approached her and without hesitation held her while she broke down. His name was Barry Accus and he is a community organizer. He like others is saddened about the current events, especially as they stretch into his neighborhood.  As Barry learned more about Michelle, sitting back and doing nothing just wasn't an option. So he arranged for her to meet him the following day. That's when she received the biggest surprise of all. Along with more hugs, this amazing man gifted her with a sizable check, enough to get her car repaired. Instead of crying tears caused by violence and disrespect this time, Michelle cried because she was so appreciative of what the stranger did for her. She too is a black woman, so to have her vehicle targeted by thugs tore at her soul. After the story went viral, it spread across multiple news stations. During one interview, Barry shared some important words. In spite of all this, humanity is going to prevail. It's that kind of positive attitude that will help bring the changes needed. What started out as one of the worst days Michelle had ever experienced quickly turned into a blessing. This story is a perfect example of doing things the right way. Protest but be peaceful and respectful. When you see someone in need, step up to provide assistance. Michelle has a message to the rioters by saying, I just want to tell these kids to stop breaking stuff that does not pertain to what's going on. She's 100% right. The destruction isn't about honoring a man who was senselessly murdered, rather than help the cause, the rioting is hurting it.


Welcome to JSON Web Tokens, Understanding Common Pitfalls. My name's Bruce. You may recognize me from the show floor as the guy that's overly enthusiastically handing out info stickers. I'm actually a software developer. My background is in web development, application security, and access management. So in those roles, I've spent a lot of time reading specifications for the web, such as the JSON Web Token RFC. And today, I hope to distill some of that knowledge and bring it to you. So this is a 101-track lecture, which means I'd like to start from a base foundational knowledge to get us all on the same page first. But if you've worked with JSON Web Tokens before, then this might be a good review. Once you have them implemented, you generally just start relying on them and trusting that they're working as expected. So this might also give you a way to go back and make sure that you're actually using JSON Web Token securely. Starting from the base, we're going to be going over a JSON Web Token format, so what they actually look like and what's inside of them, along with how they're actually used. Then we're going to move on to signing JSON Web Tokens. This is the key and bit of information that I want to make sure everybody can get on the same page for, because the signature is the key to security for the JSON Web Token. If your signature in validation is not good, then pretty much all bets are off. Anybody can tell anything to your applications and they will trust those tokens. The signature is important because there's information encoded in the JSON Web Token that whoever's receiving the token will look at and take us true based off of this signature. And then finally, once we understand that signature, then we'll move on to the security and common attacks on JSON Web Tokens. By the end of this talk, you should be able to accept JSON Web Tokens, create JSON Web Tokens, validate them, and identify some common vulnerabilities. I like to start things off with some real world analogies before we actually dig down into the technical details. Anybody here actually go to the bar last night after the conference? I know I did. And the first thing that happens when I went to the bar, I guess I have a youthful glow, is they asked for my ID. So I produced this government ID and gave it to the bartender. The first thing the bartender did was look to see that the ID was valid, issued by somebody they trusted, which was the Canadian government. If it looked like it had all the anti-forgery features that an ID has, and finally, once they trusted it, they read the information on the ID to make sure that I was actually who I say I am and I can buy alcohol. Finally, once they validated that information was correct, then they served me. This is actually pretty similar to the process of validating a JSON Web Token with an application. So I was able to validate who I was at the bar using my ID. But how am I going to do that online? Obviously, I can't scan my passport and send it along to every website. That would be inconvenience and extremely insecure. I need some kind of virtual piece of ID that's issued by a trusted authority. But maybe in this case, not the government's. That also wouldn't scale very well. So who do we trust online? We trust the big tech companies like Google or Microsoft. So maybe we can use them to sign in, or maybe even on a smaller scale if we have our own microservices we're using. Maybe we have an authentication service that we trust that our other microservices can rely on. This is where JSON Web Tokens come in. They're like a digital online piece of identification. So going back to our bar analogy, when I presented the bartender with the ID, that's like the JSON Web Token itself. When the bartender looked at the JSON Web Token and saw that it was issued by the Canadian government, that was like seeing that the JSON Web Token was signed by a trusted authority like Google or your authentication service. Finally, they read the information from the ID or token and made some assumptions about who I was because they trusted it. So what is in a JSON Web Token or JWT? Well, it's an acronym, and you can break it down to its three parts pretty straightforwardly. The first part is JSON, or JavaScript Object Notation. If you've done web development, I'm sure this looks familiar. It's a pretty standard way to send information about an object between a server and a client in a way that's easily readable. The next part, W for web, this is the expected place that JSON Web Tokens are to be used, normally between microservices or any other application running on the web. And finally, there's T for token. And this isn't a token in the sense like a Bitcoin or any other kind of cryptocurrency. This is just token in the form of a piece of information that asserts something about the person that holds that token. So this is what a JSON Web Token actually looks like. It's pretty esoteric and intimidating to humans, pretty clearly not meant to be read by us. And if you look closer, even though it's intimidating with a bunch of numbers and letters, you'll see there's actually three dots separating distinct parts of this JSON Web Token. So what we're actually looking at is the three different components of a JSON Web Token, the header, the blue part, the payload in pink, which is the information about who holds this JSON Web Token, and the green part is the signature. One important thing to note is that although this looks very obscured and potentially secure, it's actually just base64 encoded. Base64 encoding is just a standard way to encode information to send it over the wire. So a common misconception I guess I've seen when people are working with JSON Web Tokens is that they think they can store secret information in them, and in the case of a standard JSON Web Token, that is not the case. It's just base64 encoded, so whoever receives this token can decode it and read whatever's inside of it. There is something called an encrypted JSON Web Token, which I'm not gonna talk about here, but if you're looking to send encrypted secret information to somebody, that's what you'll want to use instead. So let's go through the components. The first component of the JSON Web Token is the header. So this is information about how the token should actually be validated by the party that receives the token. In this case, you can see that it's specifying the HS256 algorithm was used to create the signature, and in the case of all JSON Web Tokens, as far as I know, the type will be Jot. There can be other things here if it's not a JSON Web Token. The next part of the token is the payload. This is the meaty bit that your clients will actually be looking at. This contains all the information about the party that is presenting the token. So this could be a token presented by a user, or it could also be a token presented by, say a machine, like another microservice calling it to a different microservice. In our example here, we've got the email of the user that the token was created for, hello at example.com, and then two other commonly seen fields in JSON Web Tokens. So these are abbreviated for the point of just saving space in the JSON Web Token, but you can see the second field there is IAT, which stands for issued at. This is the time the token was created, and if you receive a token with an issued at in the future, it's not valid. And the third field, which is also an extremely important one, is EXP, the expiry of the token. These are both UNIX timestamps. The expiry is important, because if you receive a token that's after the expiry, the information in it may no longer be valid. So kind of going back to the ID analogy from earlier, this is like the information that was written on your driver's license or passport. And for the expiry, that's like the expiry of the passport, like maybe somebody's address has changed, or maybe some of their features have changed since this passport was issued. And finally, there's the signature there. This part is kind of a little bit more difficult to demonstrate because it doesn't decode into JSON. It's just an integrity check value for that header and payload. Like I said, this is actually the most important component because it lets us know that the information in those first two sections has not been tampered with, and we can trust it. So let's break down actually how we get this signature to make sure that we're doing it correctly and validating it correctly. Well, there's two ways to actually get the token signature. The first way is using symmetric key signing. So according to my research, this is actually the most common way to sign a JSON web token. In my experience, symmetric key signing has been more popular, but it's pretty straightforward. So when the party is creating a JSON web token, they'll take that header and payload. So the information about how the token was signed and the information about who the token was for, and they'll generate a hashed-based message authentication code, which is a mouthful, using the header and payload, along with a shared secret key. This outputs a unique value, which they set as that third section of the JSON web token. One important thing to note here is that you don't really have to worry about how hash-based message authentication codes are working just know that when you pass in this shared secret key, which is like a password, it's going to output some unique value. And if anything in the payload of the token changes, like say somebody decodes the token, changes their email to admin at example.com, then this signature will no longer be valid and the signing party will reject the token. So how, sorry, the receiving party will reject the token. So what does that actually look like? So the party receiving the token will follow a similar process. They'll take the header and payload values, and they'll also use this shared secret key, which they've established somehow beforehand to exchange with the other party, and then they'll find the unique value and compare it to the signature sent in. Since these signatures match, they'll know the token is valid and they can proceed safely. Kind of the downside of this symmetric signing approach here is that although it is pretty straightforward using the shared secret key, establishing that shared secret key is a little bit less secure. You don't know who all has access to it. So since the person validating the key has that same password secret key, they could also generate tokens that would be seen as valid. And if there's other people that are validating those tokens, then you can't actually tell who it came from since the key is distributed. Due to this, I've used asymmetric signing more. This is a good approach if you've got a bunch of microservices and you've got one service that's only focused on authentication. You don't want the other services to be able to create their own tokens at all. So asymmetric signing is like how cryptocurrency, while it works, you've got a private key and a public key, and the private key is only held by the authentication service. Meanwhile, the public key is available on some endpoint for anybody to access. It's public intentionally and can be used to validate signatures created with this private key. So here's what it looks like to actually create a signature for a JSON web token using asymmetric signing. Once again, we take the header and payload and we hash them, which creates a unique value. Then, since we're the party that's creating this token, we can use our private key to encrypt that unique value and add it as the signature. When somebody receives the token and they need to validate it, they will use the public key of whoever signed that token to decrypt that third section of the token, the signature. This will reveal what the person that created the token says the unique value was and then they can compute the hash of the header and payload and compare them to make sure that nothing has changed. Due to the nature of asymmetric keys, only the person that holds that private key would be able to generate that signature so you know that it's valid. So what does this look like in practice? This is a super simple diagram of what a microservice architecture might look like. You can see on the left here, we've got the authentication service and on the right is some other service. Let's say it sends emails or something. It could really do anything. So step one, the clients, the laptop down there will log into the authentication service, say with the username and password. The authentication service will validate that username and password and then create the token for that client and sign it with their private key. The tokens then send back to the client and they can make requests to the email service for whatever feature they want. Say they call an endpoint to send an email, they'll send along that token in the header of the request and the other service can then take that token out of the header. Look at the public key for the authentication service which is public and everybody knows. Validate the signature and that the contents of the token haven't changed. Validate the tokens and how it expired and then finally proceed to do whatever it wants. Send the email. So let's break that down into an algorithm. So what we did there was we've separated the JSON web token into its three segments. Header, payload, and signature. We've decoded the header and payload and checked from the header which signature algorithm we should use to verify the token. Then, based on that algorithm, we've verified that the signed hash matches the header and payload, the hash of the header and payload of the token that we've received. Finally, we know that's valid so we checked the information. Who is this user? Is the token expired? Is it after the time the token was issued at? And then we can proceed. Seems pretty solid, right? Well, there's one fatal flaw in here that's actually enabled by the JSON web token specification and that's step three. So when you're validating the header segments of the JSON web token, the RFC actually says a none algorithm is valid to use. So what this means is whoever's receiving the token, we'll check the header to see which algorithm they should use to validate the signature. And in the case of none, that means don't validate this token, just take it as valid. So this is actually a pretty big footgun if you're just immediately writing to the spec of the JSON web tokens. And it might seem extremely obvious, but this is actually something that's fairly common. In 2019, I don't know if you've heard of Auth0. They're a fairly prominent Oauth sign in service. They were actually vulnerable to this signature algorithm confusion. And that meant that any token that was sent in with the none algorithm in a different casing in their case, I guess they were comparing the actual none capitalized to a different casing was seen as valid. So how do we protect against this? Well, it's pretty straightforward as we go off of the spec. Actually, here's a demonstration actually of what it would look like to attack a service that's not validating the algorithm is what they expect. I'm running commands in the terminal here. I'm just creating a header here with the none algorithm for signing the token and base 64 and coding it. Then I'm creating the body of the JSON web token, setting the email to whatever I want. In this case, admin.example.com. And since it's not being validated at all, the service accepts that as correct and allows me to proceed as admin.example.com. So yeah, we can protect against this by going off the spec and only allowing specific signature algorithms that we accept as valid. So in our case, let's make sure that the token is using an RS256 signature. Most JSON web token libraries will protect you against this and just decline the none algorithm. But it's worth checking the library using and making sure that's actually the case. The next vulnerability is in the case of symmetric key signing. So as I pointed out, that secret key is the keys to the kingdom. And if that's compromised, then any token that comes into your service could potentially be not correct. So in my example here, I've got a token that was signed using a symmetric key. It was a really short one, SN1F. I found a random tool on GitHub called Jotcrack, which just brute forces the secret key used to sign a symmetric key signed token. And I ran it here against this token and my MacBook was able to crack it in 10 seconds. So once a party has access to your secret key, they can use any legitimate tool like Jot.io. This is just for decoding tokens and modifying them. And plug in that secret key and enter whatever information they want. So you can see here, it might be a little bit small. I set my name to admin at example.com and I plugged in that secret key and it was valid. So anybody that passed that token into our service would be able to make whatever calls they wanted as an admin. The protection against this is pretty straightforward. You're just gonna wanna use a sufficiently long secret key. The length of that secret key varies depending on what signing algorithm you're using. Kind of building on that a less direct but increasingly common attack that I've personally seen growing in the wild is that attackers are now going directly after tokens rather than username and passwords. And the reason for this is that as NFA is getting more popular, if you have a username and password, then you still need access to whatever the second form of authentication is. So maybe you have to like SIM jack them and get access to their actual phone number to do like a text verification or something. But as an attacker, if you can get access to the tokens, then you can bypass the whole initial authentication flow and just make requests until that token expires. So this is a pretty tempting target for a user or for an attacker, sorry. So you're gonna wanna make sure you store these JSON web tokens securely. In my case, I prefer storing JSON web tokens in a cookie for the user experience. But this comes with some pitfalls that I wanted to point out as well. So if you're storing the JSON web token in a cookie, you're gonna wanna make sure that cookie is secure. That means using an HTTP only cookie which can only be sent, or sorry, HTTP only cookie, which can only be accessed when sending requests. It can't be accessed by JavaScript, which means no malicious scripts in the browser can actually access that cookie. You're also going to wanna make sure the cookie is set to secure. So it's only sent over HTTPS. Nobody intercepting the traffic will be able to read the cookie in that case. And finally, if you're not doing some fancy redirects for a single sign-on, then you'll also wanna set a same-site flag on the cookie, probably too secure, so that it can't be sent across redirects. The other option is to actually not store cookies at all. This means just keeping the JSON web token in memory while running your application. But that's a little bit of a trade-off for user experience, because if they refresh the page, they'll log back in. As you saw in both the signature algorithm confusion and secret brute-forcing attacks, the most important thing is definitely storing your keys securely that you're using to sign these tokens. The best thing to do is to store the key in a place that it can't be accessed at all, like a hardware-signed hardware certificate manager or something like that, like AWS HSM. I'd recommend something like AWS key management, so only the parties that are expected to be able to access the key can access it, or something like vaults. So that's more auditable. Anybody calling in to access your keys, you can see who's using them. And in the unfortunate case that your secret key actually is compromised, it's much easier to roll it. It's contained only in one place. You can go change it there rather than finding everywhere the secret key is just stored in the environments and going and change them individually. So we've gone through the main security pitfalls, but I think another common pitfall that I wanted to point out was making sure you're actually using JSON web tokens in a way that makes sense. So JSON web tokens really shine in a distributed environment. They're stateless, which means you don't have to call in to some central authentication service to make sure they're valid. And this is good for if you're making calls to many like distributed systems. They don't have to call back always to validate the token. They know the public key so they can validate what it says is true. This will reduce the network calls, reduce latency. And it's also nice just to be able to assert some information about whoever's calling your service by checking the token they used. But you might not even need a JSON web token. So if you're using just like a monolithic or a simple service, then session tokens might still be enough and you don't need to worry about any of this complicated stuff at all. So it's tried and true, just creating like a simple hashed secret to send back to the users. And then validating that when the request comes in if you have quick access to the database. The other kind of downfall of JSON web tokens that I didn't really touch on earlier was that due to their statelessness, if you need to invalidate them, then it can be a bit of a pain. So since you're accepting any token that signed is valid up until it expires, there's no way to revoke it unless you do some complicated stuff like a token block list. But that kind of defeats the purpose of using JSON web tokens. So that's another pitfall is that session tokens can be easily revoked. JSON web tokens might be valid for the duration of their lifetime. So you're gonna wanna make sure also to keep the session lifetime of the JSON web token as low as you can. So that's it. We have the base knowledge to create, verify, and securely work with JSON web tokens. You can go forth now and make sure that your libraries are actually validating JSON web tokens correctly and that you're creating them correctly. Thanks for coming up. If you'd like to talk with me about tokens at all, I'll be at the info booth at the conference floor. I'd love to hear from you. Thank you.