Our next speaker is TeamStar. Personally, for me, I'm happy that I can announce this talk. I own an Apple device, but for me, the point of owning this Apple device is that it just works. I don't like to tinker with that specific device. So I'm very grateful that there are people who actually would like to tinker with Apple devices, such as TeamStar. So personally, I'm looking forward to learning all about downgrading iOS, how it worked in the past, how it works in the present, and what new will be in the presentation that TeamStar can teach us. So with that, I would like to ask all of you to give TeamStar a warm round of applause. Thanks. Oh, thank you very much. Yeah, I'm TeamStar, and I'm going to present you downgrading iOS from past to present. So the topics of this talk will be the iOS boot chain and how it chains through the versions. I'm going to talk about SHSH Blobs and AP Tickets, what those are. I'm going to talk about the past downgrade methods, real quick intro on IMG3 and IMG4 file format. Then I'm going to tell you what the baseband and sepoise problem is, which we encounter while downgrading. And at the end, there is something new for 64-bit devices. So this is the iOS boot chain. I'm going to see this picture a few times in this presentation. But basically, right here, we have two routes. We have the normal boot, and we have the DFU boot. The DFU is the device firmware upgrade, if you upgrade the device. So yeah, what you can see here is that the boot ROM first boots the first-stage boot loader. The first-stage boot loader boots the second-stage boot loader, which is iBoot and normal boot, or iBag if you go to Restoreout. If you go to normal boot route, then the kernel boots. And for 64-bit devices, this is new. The SAP OS boots, what that is, I'm going to talk a few slides. If you go to the DFU route, then the RAM is going to kernel as booted. This is much like a live system. And you use that for restoring. So yeah, let's talk a bit about iOS history. With the iPhone 2G, we had iPhone OS 1 and iPhone OS 2 and 3. And they were pre-signed. And downward was just possible. There was nothing stopping you from downgrading that. This changed a bit in iPhone 3G. Well, it didn't change in iPhone OS 2 and 3. It was basically the same. But it changed with iOS 4. On the iPhone 3G, Apple added software SHSH checks. And downward was still possible with a few hacks. So let's take a look at the boot chain of an iPhone 3G, iOS 4. I want to note real quick, I'm only talking about iPhones. But this also applies to iPads and iPods with the same hardware. So keep that in mind. So what you can see here that the boot components check each other. Like a first-stage bootloader checks the second-stage bootloader. Second-stage bootloader checks the kernel and the RAM disk and so on. But you can see here, they are missing one thing. The bootroom doesn't check the first-stage bootloader. It doesn't check ILB or IBSS. So if you want to go back to iOS 3, 201, you could just do it. The bootroom doesn't check, doesn't prevent that. So what are those SHSH blobs I'm talking about? Well, Apple introduced those to control what iOS version can be installed on your device. And those need to be requested from Apple while restoring. And an SHSH blob is basically a signed hash plus the asset of the device. So those makes them unique for every device. You can't just take one SHSH block from one device and try to use it with a different device. It won't work because the asset is different. So let's take a look at SHSH and IMG3 file format. So on the left image, you can see the grammar for an IMG3 file. Basically, we have some magic. We have some sizes.  And those are actually interesting ones. And what those IMG3 tags can be, you can see on the right. This is a picture taken from the iPhone Wiki. And those files contain stuff like the iBoot version, what chip this firmware is to be used on. And you can also see SHSH. And the SHSH is basically an RSA encrypted SHA1 hash of the file. So this is how it looks like if you open up in a hex editor. You can see a bunch of IMG3 tags. And the one which I highlighted is the SHSH tag. So yeah, it's basically the RSA1 encrypted SHA1 hash. And below this SHSH blobs, what you can't really see here is the certificate, which contains Apple's public key, which you can use to verify that signature. So let's continue with the RSS3. With iPhone 3GS and the iPhone 4, things changed a bit. With iOS 3 to iOS 4, Apple had hardware-enforced SHSH checks. Those were new in those two devices. And starting with iOS 5, Apple introduced AP tickets. But what that is, we'll see later. So this is how the boot chain looks like on pre-IOS 5 on iPhone 4 and iPhone 3GS. And you can see the only difference here is that the boot ROM does verify the SHSH blobs. So that's actually the only difference. How do we downgrade this? Well, SHSH blob is just a signed hash of the firmware. So there's nothing which prevents us from a downgrade attack. What you would do is you save SHSH blobs while they're signed and there are a bunch of tools which can do that. For example, Tiny umbrella can do that, Cydia, iFate. And when Apple doesn't sign them anymore, you can just reply them. So what you would do is you hook your device up to iTunes. And when iTunes would ask the Apple server, you just man in the middle of traffic and send the blobs you saved. And iTunes would give it to the device. And the device would accept it. And you could downgrade. OK, so what are those AP tickets? AP tickets is as in one form as a container. It contains an e-sit, a board ID, chip ID, and the hashes of all the firmware files and anons. And it's obviously signed. So you can't tamper with that data. Those things are packed inside an IMG3 file and flashed along with the boot files. So this is how the bootchain looks like on all 32-bit devices on iOS 5 and later. What you can see here, the boot ROM still checks for the SHSH blobs. But if you go the ViewRound route, the IBSS checks now with the AP ticket instead of the single SHSH one. And what it actually does when it boots up IBSS, it would generate a nonce. And this is random. And what you need to do is you need to read out that nonce from the device. You need to request an AP ticket for that specific nonce. Then you could stitch that nonce to iBag. And then you could boot iBag. And then you do the same for iBag. So you would read out the nonce. You would stitch it to the RAMNISK and the kernel. And you can boot those. For the normal boot, the ILB and iBoot also checks the AP ticket. But they don't check the nonce. Well, this is because you can't really check the nonce. Because if you would generate the nonce randomly, then you would have to request a new ticket for every single boot. And since the devices in bootloader can't really do that, so nonce is ignored on normal boot. And this is fine. So this is how an AP ticket looks like if you decode it with ISN1. So in the left image, you can see it ISN1 decoded. The right image is a build manifest taken from an iPhone firmware file. So at the left, the first thing you can see is the E-set of the device this blobs belongs to.  And those actually correspond to the one you can see in the build manifest. So the one I highlighted there is the Apple logo hash.  And at the very bottom, you have the signature. And below the signature is certificate, which you can use to verify the signature. So if you pack that inside an IMG3 file, there's nothing too special about it. This is how it looks like. You can see the identifier here is SCAB. You need to read that little endian. So that's basically just the AP ticket. And storing all those information about the device in one single file removes the need to have it in a bunch of files. So it just collects all in one place. So how do we download it? Well, we have Limerain. Limerain is a boot ROM exploit from Geohot. And it works up to the iPhone 4. It's patched to in the iPhone 4S, but up to the iPhone 4 works. And we can make the boot ROM anything we want. So what we could do is we could patch out the AP ticket checks and IBSS and iBag. And then we could boot IBSS, iBag, RAM disk and a kernel without any AP ticket. What we would do then is we would restore with the previously saved AP ticket. And since the nonce isn't checked on our boot, boot, we are good to go. So this is an image visualizing the downgrade using Limerain. First step, you point a boot ROM, then you send a patched IBSS, iBag, kernel, RAM disk and so on, simply restore. And then if you restore with the valid ticket, you can see that everything from there is valid if you go the normal boot route. So what about newer devices where we don't have Limerain? Well, first some background info. Thermal files are encrypted and the decryption is not possible anymore when the kernel has booted. This is disabled by hardware since the iPhone 4S. So before the iPhone 4S, you could actually decrypted with the iOS engine on the phone, but since the iPhone 4S, this is disabled by hardware and you can't use it anymore once the kernel has booted once. And yeah, so basically to get the keys, you need either iBoot or a boot ROM exploit. But luckily in the Jabra community, we have some people who have private iBoot exploits and we have people who have private hardware hacking techniques. And those people, they're able to get the phone keys and they're so kind to share them with us. You can find them on the iPhone wiki. So yeah, they're publicly available for many device and iOS combinations, not for all, but for a lot of them. Also we have K-loader by Winocm and what it could do, it could bootstrap a raw image from kernel mode. So what you could do then is something like jumping back to the bootloader, for example, by booting IBSS. So taking all these possibilities, we have Odysseys. Odysseys is a technique by Xerob. He uses a jailbreak. He uses a task to put zero on K-loader to bootstrap an IBSS. I personally call this KD view mode, kernel D view mode. It is similar to the point D view mode with Limerain where it would like accept anything which you would give it, which is booted. You can do the same if you bootstrap decrypted and patched IBSS. But the only difference is since in kernel the view mode, the kernel has booted once, the iOS engine is disabled. So this means you cannot decrypt firmer files anymore. So the solution to this problem is we simply built a custom firmer as sent the firmer files decrypted already. So yeah, we decrypt IBSS, I-Back, Ramless and kernel and to file system and just send it so the device doesn't need to decrypt them. And we can do that. So this is what it looks like if we're downgrading using Odysseys. The first thing you have here is the normal boot. You boot up the old ILB and in this case, old means before the downgrade and new means after the downgrade. BootRam verifies ILB, ILB verifies iBoot and so on to the kernel.  And this is what I call KDE view mode and this is because if your device booted IBSS, it behaves to the outside world like as if would be in KDE view mode. So the outside world couldn't tell if it's actually IBSS or KDE view mode or D view mode. So this is why I call this KDE view mode. What you would do then is boot a decrypted and patched iBag and decrypted and patched RAMness and kernel. Then you would simply run a normal restore but you would restore a valid AP ticket. And if you try to boot then, BootRam verifies ILB. In the AP ticket, the nonce is ignored so you're good to go and you could boot. So this really cool, but in this talk I haven't talked about the baseband. The baseband is a processor which handles communication like when you're trying to call someone and stuff like that. And the security of the baseband has improved too and the downgrade is not really possible. Also less people care about baseband at all since carriers start to unlock phones. So in the earlier days of iPhones, the reason why I would want to hack the baseband is because the carrier would sell a simlocked phone and you want to use the phone with a different carrier. So you would try to hack the baseband and get an unlock so you can use the phone with a different SIM card. But since carriers start to sell unlocked phones, don't really need that anymore. But from the earlier days, the common practice became not to update the baseband because security proved that too. What you would do is when you're upgrading the iOS, you would keep the old baseband. So you could still keep all the vulnerabilities and exploit it again. And when you direct the device, you could then exploit again the baseband and you could unlock your phone. And from those times, we know that many non-default iOS baseband combinations are working, combinations that weren't shipped. Some are not, but lots of them are working. So, yeah, we know that the new iOS and old baseband works, but the other way around works too if the gap isn't too big. So Odysseus uses this fact. It keeps the baseband with its signature and downgrading. Since the iPhone 4S, the baseband is stored on a file system. Before that, it's stored on some memory, but since 4S, it's on a file system. And this is why you need to patch the firmware for not updating the baseband. So what you would actually do, you would grab the old baseband from the phone, create a custom firmware where you put this old baseband in and you would flash the new, the custom firmware with the old baseband. So then we have Odysseus OTA. So Apple signs OTA blobs for iOS 6.1.3 for the iPhone 4S and for the iPad 2. And what exactly are those OTA blobs? Well, OTA means over the air. If you update your device, not using iTunes, but if you go to settings and update and just downloads the firmware and updates, and this is what we call an OTA update. And Apple signs 6.1.3 for these two devices because those were shipped initially with iOS 5.  So what you would need to do if those devices are still in iOS 5, you would need to upgrade first to 6.1.3 and from there you could go to iOS 9. And same applies for iOS 8.1 for some other devices. So the idea with Odysseus OTA is to use fresh OTA tickets. And you can also grab a baseband ticket since that's signed too.  But since it's signed here, we could just grab tickets and download it. This was discovered by Syrup and me around the same time. We're using different techniques like I'm patching the firmware bundles you use to generate the custom firmware. He added the command link parameter to iDeviceRestore where you pass a build manifest, but it's basically the same thing. So normal AP tickets and OTA tickets only differ by the RAM disk cache. And this also makes sense because if you're upgrading using iTunes, you want the upgrade process to be handled by iTunes. But if you're upgrading using the OTA method, you want your phone to do it on its own without iTunes. So we need to boot a different RAM disk. And the hash of the RAM disk doesn't really matter because we're booting that thing with K-loader anyway. So no nonces, no nothing is checked. So Odysseus is cool, but it also has some limitations. It only works for 32-bit devices and you need firmware keys because the device can't handle the decryption you need to decrypt it. You also need custom bundles, so know how to make the custom firmware. You need all these patches and those are not available for all device and iOS combinations. So what about 64-bit devices? Well, let's have first some background info with 64-bit devices. Apple switched to the IMG4 file format and we also have a new enemy, the secure enclave processor or short SAP. And SAP is used for TouchAD, it's used for file system encryption and some other things and it's definitely required for booting so you can't just decide to not boot it and use your phone, this won't work because you wouldn't be able to decrypt your file system. SAP has its own nonce inside the AP ticket and those need to match the one SAP generates when it boots. So also there are no known exploits for SAP, so for those who expected zero day for SAP to be dropped, I'm sorry, no exploits for SAP. So yeah, let's take a look at the IMG4 file format. IMG4 is an iOS and One formatted container, this is the IR encoded and what a signed IMG4 basically is, it's just the IM4P, this is the payload, this is like just a boot file, iBoot or something like that with an IM4M and IM4M is the manifest and the manifest is basically the AP ticket. And the interesting thing here is that every IMG4 file has its own copy of the manifest of the ticket. This eliminates the need for a ticket only file like we used to have with the IMG3 file format. And this is probably required for SAP because all bootloader files are flashed as some memory, except for SAP, SAP is the only thing which is stored on a file system and this is maybe why they made a single copy of the ticket to every file. So yeah, let's take a look at the IMG4 file format. You could see here on the left side, this is if you just simply AS and One decrypt a decode the file, you can see IMG4, IM4P and the tag of that file, this is SAPI, this is a SAPOS which is, yeah, displayed right here. Then you have the actual SAP, then you have the key bag and the key bag is actually an encrypted key which the device could decrypt and it could use that key to decrypt the firmware. So below that you have the IM4M, this is basically the manifest, but you can actually see the better on the right image. Right image is what IMG4Tool gives you if you just display the file, basically also the key bags and you can see there IM4M and I walk through all those things real quick. The BNCH is the APNONS which is inside the ticket. Then you have some device specific data, you have the ESID for which specific unique device this ticket can be used and the SNON is the SAPNONS and SRVN is the server NONS. It's basically NONS the server generates. So even if you request over and over again a ticket with the same parameters, you would still get a different ticket because the server NONS changes and as far as I know, the server NONS is not really used for anything. So below that you have a bunch of hashes from all the different files. Right here you can see the hash for the bad zero image. So this is how the bootchain looks like on 64 bit devices. If you go the normal boot route, the only thing which really changed there is starting with the bootrom. The AP ticket is changed, earlier this was the SHSH. And if you go the DFU route, not only the bootrom checks the AP ticket and generates an APNONS. So actually you need to request an APNONS from the bootrom and so on, but you also need to request a SAPNONS and put it inside your ticket. Yeah. So we've seen this all improved a lot, but can we still downgrade? And yes we can. So let's make a downgrade plan for 64 bit devices. Well, we know that the baseband and iOS mismatch works and what if this would work for SAP2? That would be cool, right? And also every IMG4 file contains its own copy of the AP ticket, but do they actually need to be the same? Well, let's continue with our plan here. What I did here is I made a little tool, iGetNONS. Basically all it does, it fetches the APNONS and the SAPNONS from the device in all the different modes. What I did then, I took my iPhone 5S, put it in DFU mode, connected it to computer and read out the nonces for AP and SAPNONS. What I did then is I requested a ticket for those two specific nonces for my device with TSS checker and stitched that ticket to IBSS and I booted IBSS. Then I again checked what nonces are generated and I've seen nonces doesn't change. So I again stitched that ticket to iBag and booted iBag and again I requested the nonces and again the nonces doesn't change. So this is definitely something we can work with. Yeah, we've seen we get the same nonces for DFU IBSS iBag and this also works if you go from iBoot to iBag and this is actually the route we're gonna go for downgrading. You see why in a few slides. And also notice that the SAPNONS is completely ignored in IBSS and iBag. It only matters when booting SAP, which kind of makes sense, I guess. So what happens if you could somehow predict or regenerate an APNONS? Well, this is where Prometheus comes in. Let's for a second assume we somehow can predict an APNONS. What we could do then is we would request now a ticket for a nonce which will be generated later. And once that isn't signed anymore, we can somehow make the device magically regenerate the nonce and use the ticket we saved before. So this brings us back to the old classic replay attack and we could boot up to the RAM list. So we can only boot up to the RAM list because there's still SAP. We can't do this for SAP and we need somehow to boot SAP. Well, what we can do here is we can just boot a possibly newer, but signed SAP. And since it's signed, we can request a valid ticket and we're also restoring the newer, but signed SAP and we're also doing the same for the baseband. So fix everything, right? This is how Prometheus looks like when booting the stuff. First, you boot to ILB, then iBoot. This is checked by the AP ticket on your device. If you hold down your home button while booting, you will get into recovery mode and it will stop there. Then we do some voodoo magic and make the device regenerate the APNONS, which we have saved the ticket for. Then we stitch that ticket to iBag and boot that. And again, the saved ticket stitched it to the RAM list and the kernel and boot that. And what we're doing here is we're booting not the shipped SAP, but the latest SAP, for example, with a valid ticket, which we just requested for the NONS that generated us and we boot that. Then we're doing a normal restore with the difference that we're restoring the AP ticket we saved. And we're restoring the newer SAP with a different AP ticket. And we can do that because every IMG4 file stores its own copy of the ticket. Yeah. Now, the only real question is, how do we predict the APNONS? Because if we can't predict the APNONS, we can't really use all this. Okay, let's take a look at the OTA update procedure. So when you take your phone, go to Settings, Update. What it would do, it would download all the boot files and store the RAM list in memory. It would set some boot arc and it would reboot. The RAM list is not encrypted, the boot files are. And you need an AP ticket to boot. So you can't really request an AP ticket while you're in recovery. This means you need to request a ticket before going to recovery. And we have a problem here. So there's something needed to be stored. So the AP, so the updater can predict what NONS will be generated on next boot. So we can request now an AP ticket and use it on the next reboot. So all we gotta do is find this something. Well, let's take a look in Envira. So in the big picture, you can see kernel cache from iOS 10, yeah, Apple was so kind to ship iOS 10 unencrypted. So we can just take a look here. And what we see here is com.apple.system.bootnons. And the only thing left is figuring out what all those values mean. And if you Google, you'll eventually end up on ionvrom.h on opensource.apple.com. And there you can see this G-O-F variables, this variable table. And so basically the elements here are first the string, then the type, then the permission, and the last thing is probably counter. So if we take a look at the kernel dump, we see 0x3 and 0x3 for the type and for the permission. And if we take a look at the type, it's a type string. And if we check the permission, it is permission kernel only, which is kind of bad, but it's nothing we couldn't change with the kernel patch. So patching this to permission user read would allow us to use the Envira tool to read and write this variable from user land. So yeah, how do we predict IP nons? So the generator is saved in Envira. Once you request from LockdownD and Nons. And you can do that by either requesting Nons with iTunes or the updater can request the Nons from LockdownD. And that generator is saved to Envira and consumed on the next reboot. So you can't really predict Nons twice. You can do this just once. So this is how such a generator looks like and it generates the following Nons on my iPhone 6. And yeah, since the permissions are kernel only, you need to patch the kernel to be able to read and write that. So this is kind of a demo, I guess. It's just an image, but still. This is my iPhone 6 running iOS 9.1. And what I did here is I first I requested a Nons from LockdownD. Then I run Envira-P to print all the variables. Then you can see we only have bootercs, debo2r's, autoboot and backlight level. Then running Nonsenabler, which patches the kernel. And if again I run Envira-P, you can see the comapples system bootnons magically appears and we can read it and we also can write it. So this is the only way. Well, the Nons is 20 bytes. And this means we have two to the power of 160 different possibilities. And this is just too many to brute force. The generator on the other hand is eight bytes. This is two to the power of 64 possibilities. But this is still too many, unless you're the NSA, there's even no point in trying. But I did all these calculations after I tried that. So let me show you my results. So I wrote the little script. Basically all it does is puts your device into recovery, sets the boot arc to false, so you always put in the recovery when you reboot. Then it reads out the Nons and reboots. Then again reads out the Nons and so on. And I let this run for, I don't know, two hours and it gave me like 2,000 Nonses. And if we take a look at the Nonses, they are on the right side. So I ordered them and you can see the first thing there is the Nons. Then in the second column, this is how often it was generated. And the last column is the percentage. So the one highlighted in blue is not actually the one generated most often, but it's my favorite one. That's why it's blue. And if you take a look and sum all this up, you can see that five Nonses are 20%. So we can definitely work with that. We also had some community test results. So I asked on Twitter, just take your phones and try this too. And I've seen multiple iPhone 5S generate the same Nons on iOS 9.3.2 and iOS 9.3.5. And this also works with multiple iPad Airs. And close versions. I haven't tried 32-bit devices. Maybe it works, maybe it doesn't. I have tried later devices like iPhone 6, 6S, and I don't know if someone tried an iPhone 7. But those don't generate collisions. Also the funny thing here is that I have seen collisions on iOS 9.3. I have seen collisions on iOS 10, 10.1, 10.2, but I haven't seen any collisions on iOS 9.1 and 9.0. So maybe that's something, some bug that Apple introduced on 9.3. I don't know. I haven't seen any collisions for iPhone 5S and 9.0. So it seems collisions are possible for some device, iOS combinations, and this can be used to downgrade without a jailbreak. So what you should do is run your own tests, figure out what nonce is generated the most, and get an AP ticket for that specific nonce. So downgrade scenario here would be, you upgrade to newer iOS, and figure out what nonce is generated the most often, and you need to do that because maybe it changes what nonce is generated. And yeah. So you would request an AP ticket with that specific nonce for an older iOS while it's still signed. When Apple releases a new iOS, the older one is signed for a certain amount of time, and you would need to do that while the older one is signed. And when the signing window closes, you make the device regenerate the same nonce you have the ticket for, and you could downgrade. You could even chain up different iOS versions like first downgrading from iOS 10 to 9 because 9.3.5 maybe generates a different nonce, and then you can use the tickets with the saved nonce there, make the device regenerate another nonce, which you have the ticket for, and you could go even further. I need to say at this point that it does work for downgrading iVoot, but the iOS 10 SEP is not compatible with iOS 9. So if you try to downgrade iOS 10 to iOS 9 by restoring an iOS 10 SEP to iOS 9, you don't get a working system, so don't do that. Well, this is cool, but Prometheus has lots of limitations, and it relies on the fact that the baseband, the SEP, and the iOS versions are not tied together, and checks for that can easily be added. Also, SEP and baseband are always the latest signed version, and they might not work with all the iOS version. This is the case for iOS 10 SEP with iOS 9. Also, the AP nonce must be predictable, and Apple can make our lives really hard here. They could, for example, add a salt in iVoot and change that in every different iVoot version, and since they're encrypted, there's no chance that you can get that salt. So it would kind of eliminate the downgrade without Jarex, so yeah, Apple can really do lots of things here. So for future downgrades, yeah, saving AP tickets is always a good idea. Even if you can't downgrade right now, maybe you can in future, and maybe there will be new bugs in futures or new techniques, and yeah, definitely save you AP tickets. So the tools I used here is TSS Checker. TSS Checker is a tool for requesting AP tickets from Apple with lots of customizations. You can manually specify the AP nonce, the set nonce you want the ticket for, if you want the basement ticket, if you don't want the basement ticket, and really lots of stuff, and I haven't seen any other tool which can do that. So TSS Checker is cool for that. Also, IMG4 tool, it is used for manipulating IMG4, IM4P and IM4M files. You can view those files, you can stitch IMG4 files, you can check the manifest and stuff like that. Also, Future Restore, this is the actual implementation of the Prometheus downgrade method. So what Future Restore allows you to do is to specify the ticket. You want to use the specify the set, you want to install and specify the basement you want to install, and all of these will be open sourced. TSS Checker is open sourced right now. IMG4 tool and Future Restore will be open sourced shortly after the stock, and yeah, at this point, I want to thank Nikias, who made Auto Tools Script for Building Future Restore. Future Restore is a really messy project which consists of TSS Checker, IMG4 tool, and I was IDYs restored, just all packed together and made some more work, so it was really complicated to make build files for that, and yeah, thank you. And now it's time for some Q&A. Thank you very much for the presentation. If there are any questions in the audience, we have four microphones at which you can line up, and then I will call you. If you need to leave the room now, that's okay, but please do so quietly and take some trash with you if you can. I think the first question was at the very back of the room. Yes, please. Thanks, so my question is a bit generic, but since you're in the scene, right? Why do jailbreak and other iOS hardware hackers never consider hacking as a hardware directly, or maybe they do? I think there are people who are doing hardware hacking. I know that some people are doing hardware hacking for getting the firmware keys, but I think most likely this is because hardware attacks are not really practical for the average user, so you can't tell a user, well, you need to open up the device, you need to wire those two pins, and then you have a jailbreak, so this is why I think mostly it's focused on software. All right, we're gonna take one question from the internet, please. Thank you. What is the point in downgrading a device? Well, I actually asked it myself a few times, but it seems like there are really lots of people who do want to downgrade for some reason. For example, if you use this technique to downgrade without a jailbreak, right now the latest signed version is iOS 10.2, and if you do all this voodoo magic, you could right now downgrade with that to iOS 10.1.1, and there is a jailbreak for that, so you could basically downgrade to get the jailbreak, but most likely you can't do this, so I don't know. Many people say newer versions are slower, so they downgrade for speed. I don't know, people just want downgrades. All right, we're gonna take a question from the front here. Yeah, I have a question about nonces here. As far as the studio found that there are some nonces that are much more frequent than others. Is that right? Yeah. And did you investigate why this could happen? Like did you find the algorithm which generates them somewhere in the firmware? I haven't really looked into that part. What I did is just basically tried. I figured out if you take lots of iPhone 5S on iOS 9.3 something, it would generate the same nonce across the devices, but I haven't really looked into it why they're doing that specific nonce. I didn't even expect this to work at all, so I was surprised. Why does it even work? Okay, thank you. All right, we're gonna take a question from the front, please. That was actually my question as well, but could I just get a picture of that nonce collision slide? That was fantastic. I think they're, yeah, I think they're even more on Reddit Post, which there's a guy who, I published them on my blog, and there's a guy on Reddit who put them all together in an even different statistic. I was thinking about taking that image to a presentation, but it's somewhere on Reddit which devices generate collisions and which don't. Okay, we're gonna take one more question from the internet, please. Thank you. Will it work on all 64-bit devices? Well, I guess. The only thing which would stop it from work on the iPhone 7 right now is that I haven't pulled the, well, what the iPhone 7 is doing with the baseband, they're changed the baseband, and I haven't pulled the IDY3 Store commits for handling the new baseband format. This is why it doesn't work right now on iPhone 7. I don't know what the new memory protection the iPhone 7 does if it stops it, if it doesn't stop it from patching. I don't know. It will probably work. Well, I assume it works with all 64-bit devices. It might even work with 32-bit devices, but I never tried. Okay, question from the back. Thanks for the talk. My question is more or less a dummy question. You showed us in the slides that this work for 935 and 933. And now you said by answering the previous question that this work with iOS 10. Maybe I misunderstand something. You mean that slide, right? Yes. Well, basically what the slide is saying that I had people with iPhone 5s on 932, 933, 944, 935, and they were trying to generate the nonce, and this was the same across all these devices, so generated the same. But the iPhone 5s also generates nonce collisions on iOS 10.0, 10.1, 10.2. There's a difference between 9 and 10 that they're just simply different ones, like five of these of iOS 9, and on iOS 10 it's just five different ones. Can I? Sorry, we're gonna take another question from the front. Thank you for the talk. Still about the repeated nonces, you already answered that you haven't looked into how they're generated, but is that code in the publicly reversible part? Like how hard would it be to figure out how they're generated? Well, if you boot the device and request a nonce from there, that would be a nonce generated from the bootloader, from iBoot or something, so you would probably need to dump iBoot and reverse it there, the random number generator. What I did is I took a look at the generator thing and I figured out it's just the little Indian encoding and if you hash that byte string, this is basically the nonce, so I focused on that, so you just take eight bytes, hash that and this is the nonce. This is also what TSS checker does when saving blobs, it would make random eight bytes, hash them, so we know we can use that specific generator if you write it to NVRAM, it would generate the same nonce, but I haven't really looked into how iBoot generates the random nonces. But iBoot, there are decrypted iBoot available for reversing, are there? I don't think that they are decrypted ones, I know there is a technique by Quirty where you could dump an iBoot from iOS 8 devices for 64 bit. For 32 bit, there are decrypted firmers, but I haven't really looked into that. On this I have focused on 64 bit. Thank you. Okay, one more question from the internet please. Thank you. Is it possible to get around the theft protection with downgrading a device? No, it is not because after your downgrade or restore in general, you need to activate the device and this is completely separated from the system, so you would need to get an activation record, this has nothing to do with downgrading and restoring, so now you cannot bypass theft protection. Question in the front. Yes, earlier you said that the baseband itself was used primarily for tying devices to a specific carrier and that for a while you could drive a different baseband and iOS combinations, but then, and you said that they were now tied together, what is actually inside the baseband? What is it being used for in modern science? Well, you have, as far as I understand, different some kind of chip and the baseband is the firmer for that specific chip and that handles the communication with the GSM and stuff like that, so if you wanna use LTE or if you call someone, then you're using that specific chip with that specific firmer attack to that and this baseband is the OS of the thing that handles telephone and stuff like that. And does it have storage? Could there be cryptographically relevant information in that particular section? Probably, there are some carrier information, I don't really know, but there's nothing really what the user would have access to anyhow. Okay, another question in the front, please. Hi, thank you for the talk. I wanted to ask you about if is there a way to get a K-loader for 64-bit devices? Honestly, I don't know. Okay. Another question from the internet. Have you ever break the device? If I ever break the device, no, I haven't. Any other questions? Now is your chance. Yes, please. You mentioned that it wasn't possible to downgrade from 10 to 9.5, but then you also had a slide on chaining those downgrades. Can you talk about that? So, these slides were made in the days where iOS 9 was still signed, so I wrongly assumed you can, but the really thing which is stopping you from downgrading iOS 10 to iOS 9 is that you cannot use iOS 10 ZEP on the iOS 9 firmware. You could finish up the restore, but at the very end of the restore, it would fail. At that point, it would have already written the bootloaders and iBoot, so you could boot up to recovery, but there's some stuff at the end which they restored and finished so you don't have a file system. I don't know if you have a file system, but you don't have a phone you could use. The bootloaders are there, but that's it. Another question in the front, please. This might be a dummy question as well, but after the downgrade, are still the user data on the phone maintained or are they wiped afterwards? This is a good question. This is actually a restore, so when you restore, you can wipe the whole data. There's also an option to upgrade where you don't actually erase the data partition. I have an option in Future Restore which sets the flag for IDYsRestore to not wipe the partition, but to the upgrade instead, so you could try downgrading and with that flag set so it would keep the data, but I don't know if it's a good idea to do that if it would mess stuff up. I haven't tried that, but maybe I could. Another question from the internet. Thank you. Can you save the set before updating and use it again after you downgraded to a previous version? No, you cannot because when the set, when restoring, you boot the RAM disk and then you also need to boot the SEP OS. So, and before you booted the SEP OS, you can't really start the downgrade. And the normal downgrade restores the file system and stuff and the SEP firmer actually handles the restore process for the SEP, so it would restore also the SEP and those nonsense need to match. So it's a completely separate restore process, so we can't do that. Question in the front, please. Why is the baseband so hard to exploit? I'm not saying the baseband is hard to exploit, but I have the feeling personally that not many people are looking into it because I wouldn't know what I would do with, like it's a lot of work just so we could downgrade. I'm not seeing why anyone would do that. In theory, you could exploit the baseband, you could try to downgrade that. What you also could do is you could patch the older iOS so it would understand the newer baseband API and get that somehow to work. It's definitely doable, but the easier way is just hope that it works. Thanks. Another question in the front, please. Is it, so what software handles writing the firmware to the SEP and things like that and would it be possible to patch that in the same way that you would patch the kernel to just not write the SEP so that you'd be able to do downgrades and things like that without having to write the newer SEP? I don't think you can do that just as easily maybe. You probably need to exploit the SEP firmware and to stop it from downgrading because SEP handles a lot of stuff like true random number generator and other things. So I think to not update the SEP, you would need to actually exploit the SEP, but I haven't really looked into the SEP, it's just what I assume. Any other final questions? All right, so when you go, please take some trash with you and please give another warm round of applause for Team Star.


All right everybody, welcome to the Boff wrap-up session for Academy on Monday, August 13th, 2018. We've got about 100 people here. We had 12 Boff sessions today and so I'm going to ask a representative from every Boff to come up and give a little one minute, two minute summary of what you did today in your Boff. And we're going to start with the Conan Boff, which has Ovidiu's name on it. Have we got any Conan people? All right, no Conan today. I can briefly say that we found out lots of things are awesomely prepared and then complexity hits, so we figured out yes, one Git repository provides several libraries sometimes, so we should split it into several Conan packages so that makes things a bit more complicated, but we might actually end up with something pretty nice and hopefully make building stuff when you're a new contributor much easier and also even actually creating applications and deploying them easier potentially. So yeah, it sounds hopeful but a lot of work is needed. If you have a bit of Python time on your hands, it would be greatly appreciated. All right, thank you Frederic. Next up is the automotive session. Who did automotive? Okay, that is the camera. Last year we worked on identifying the gap between where Katie was back then and what we need to showcase our software in R&D automotive environments. This year that gap is way shorter and we are ready to start working in showcasing Katie's software on small devices on Yocto. So we have been discussing which applications would be interested to showcase. We need something that works on Plasma Mobile that is interesting and also we have been discussing where we can showcase it during the rest of the year up to FOSSTEM next year. So hopefully we will start showcasing Katie's software in embedded and automotive environments this year. Thanks Agustin. Now we're going to move on to the whole day worth of buffs for Katie's gear, products, the Plasma stuff. Dave, please talk about Plasma. Okay, so we had a bunch of different topics. We started with Plasma Mobile. We started with the Plasma Mobile. Mobile. Let's reset the rooftop. This is fine. Okay, so for the Plasma Mobile buff we discussed what is current state. And one of the important points we discussed is how to recruit new members for the Plasma Mobile because currently it's very low on the contributor side. And we basically discussed some more bits about on the technical side, like using bundles on the mobile. And I think the discussions were very useful. So yeah. Then we moved on to some of our Wayland topics, a discussion about screen sharing from Jan Wave. That really worked for your camera. Thank you. Wayland topics, several different protocols for input and screens and scaling. People talk about some of their issues that we need to address. So that came in to giving us a lot of to-dos and not a lot done. After lunch we came back to discuss some more of the long-term bigger picture topics. We discussed the talk that I gave yesterday about moving some parts out of the process and where we go. That came into a lot of good ideas of things to explore and some new discussion points. Afterwards? Afterwards, like both of every single academy since a decade or so, we talked about activities and virtual desktops. So since now we pretty much have to redo the work for the support in Wayland, both for virtual desktop and activities. We are looking about ways to either merge them or make them work better together. Good news is that we will have a virtual desktop spec in Wayland for 5.14. Then after that we'll start to look into activities. An interesting thing is every time we did a little polling of the people that were attending there. Quite some people were using both virtual desktops and activities at the same time for pretty much the same use case. One was using only activities and not virtual desktops. Some other were using only virtual desktops and not activities. But this gave us a bit of a better idea where to go with the architecture. Hopefully in Wayland it will be way more smooth and integrated and beautiful for everybody. The notes will be on the mailing list. Thanks Dave, Bouchan and Marco. Next up in that room there was the HIG, our Human Interface Guidelines. Yeah, the Human Interface Guidelines both. It was organized by Fabian Riedmeier who already had to leave so I will just wrap it up quickly. So we talked about this project that she initiated. We had the HIG in the Wiki but now we have it on a new address at hig.kd.org and you are welcome to visit it. And we talked about how we could improve it in detail. So it's a new format and it's things written now which improves in many aspects of how it was before. So we want to improve it in details more and we got some feedback but we also want to look at the bigger picture of it like how can we see the Human Interface Guidelines maybe now for the next few years in terms of Plasma and Breeze and all the applications and yeah we will discuss this or the designers will discuss this in the VDG meetings tomorrow and you are welcome to join them. Thanks Roman. Moving on we got a promo buff but I guess promo. Promo is probably promowing. Thank you. So in the promo buff today Paul and Ivana talked about everything they did in the year. He showed us a lot of statistics that they pulled from the Twitter, the page views. We talked about how to maintain user engagement, the other drops, what were the spikes. We also talked about how can we engage and that was one of the action items. Teach out to more t-shirts and see how we can get more kitty users there. What else did we discuss? We talked about mentoring programs and how can we do more outreach to the students. We talked about the plans of revamping the website and yeah I think that was about it. Thank you Dvaya. You're half a minute too late Paul to give a summary of your own work but Dvaya has covered for you. Is Camilo around for the Vave? Vave, Vave. Alright Michael please. Tell us about Vave. Camilo held his buff for his Vave multimedia app, a music player basically. In that buff we talked a lot about the focus because he's got very impressive vision, very long reaching scope. He's already got his app working on Kirigami so you can run it on Android today and he's able to show it and demonstrate it. You can run it on a plasma mobile today. You can use Case for that platform and again he showed it on a Nexus 5 running plasma mobile. He's also talking about backend stuffs like SoundCloud and how people can make music together and use free software apps like Wave in order to share that together. Some of the other stuff that we talked about is kind of approaching the intellectual property and copyright issues that are inevitably associated with anything with music nowadays and kind of where the current commercial market has kind of left opportunities for free software to develop like trying to play music on your phone without having you streaming or without an internet connection. So that's kind of the high point. A lot to do and very impressive progress so far. Thanks Michael. Next up is a category you wouldn't, it's hard to believe he's really here and that he's really real. There's the Sysadmin Boff. Thanks Adrian. So in the Sysadmin Boff we had a very productive, if somewhat lengthy discussion about how to handle Sysadmin onboarding as well as going over everything that we currently have in terms of infrastructure. What is easiest to delegate out to members of the community without affecting principles around trust and security of our infrastructure because our data is important and very sacred to us. And we came up with a list of systems and items that could very quickly be broken out which could reduce the load on the Sysadmin team so that we can focus on doing other items and we also came up with a list of other things that could potentially be broken out to in the long run reduce the issues with capacity we have and we also talked to a much lesser extent about the identity revamp and what's necessary to bring that forward and replace the current platform which now is quite dated and has reached into this lifetime. Thank you Ben. Next up is the fabricator Boff. So after migrating to fabricator like two years after, like that has been two years and there were like lots of complaints about fabricator and lots of people hated the fabricator at completely. So that's why I registered essentially this Boff to gather around some actual constructive feedback about what's wrong with the fabricator and how Sysadmin can solve it or possibly forward that discussions to upstream. I actually didn't expect that much audience in my Boff and it turned out that the whole room was completely full. But in the essence we gathered a lot of nice feedback about how... So essentially we gathered a lot of nice feedback of what the communities problems are with the fabricator and we also got solutions for many of the community members' problems right on the Boff. So that's the good. Thanks Bouchan. Also we have the community data and community metrics Boff. Is Kevin around?  In the KDE community we've been using the blue blobs for years. The blue blobs have turned green and after that kind of pastel colors it's about measuring the health and the state of our community. We've used these blue blobs, green blobs to take a look at who's contributing and how often and who's busy. It's also a means of detecting when people go away because then you can be concerned. You can say, hey, where have you been? Welcome to your first academy. But there's more to measure in our community than just that and there's more to our lives than just commit messages. So we've been considering what other data sources we can add to the analysis tools and how we can extend the analysis tools to produce more information about how our community works so that when people ask us, hey, how are you doing?  Alright, that was the community data session. Then Lydia led the community goals retrospective. She's away. Anyone else want to give a summary of the goals session? Is Neofitos here? Then Neofitos, I'm going to stick you with it. So, yeah. The discussion involved around the three goals that was voted. There was a discussion about the privacy goal a bit and how that can evolve that through the years and to integrate it better into what we're doing because there were some suggestions that were not committed enough on that goal. We were discussing a bit about how to think of the goals. How do we plan to end them or maybe how other goals might succeed them in the future and how do we decide that one goal is complete and one is not. We talked a bit more on each goal and what we can do going forward in regards to the onboarding goal and in regards to the usability goal. We shared also some problems we found so far in terms of trying to achieve these goals, what we see, what are the areas we can improve and what are the areas that we did well and we need to continue doing. That's what comes to mind now, actually. And of course it's good to have goals but in the end we need to get our software out there and that's why we had the distro-boff which got all the distros together to talk about our common goals and common issues. Yeah. So in the distro-boff first we had lightning talks introducing nine distros featuring KDE, some smaller ones and some large ones and then we had an hour of discussion where we discussed some of the issues that we are facing together and one big topic was how to deal with bug reports, how to get users to file good bug reports and how to get them upstream when needed because very often they end up sticking around in the downstream distribution bug trackers and another issue was also how to get distribution developers more involved in upstream development. What can we do for that? You want to add anything more? I would just say that a lot of people thought that we were going to fight and instead we're all collaborating. Thanks Kevin. That wraps up the Boff Wrap Up for today. I'll see you all again tomorrow morning at 9.30 for another session of Boffs. Have a good evening.


So, welcome Peter, and this is the first time we have the chance to have a conversation at all, but today we'll speak of course about philosophical counseling, which is not only our common interest, but also our common practice. And of course, you have much more experience than I do, and you've written also a sort of now classic, I would say, about philosophical counseling, the title of which is Philosophical Counseling, and which sort of, that was a few years ago, but it's still very useful because it sort of gives a good panorama of this new movement, what are the different approaches, debates. I found it also very respectful of the different points of view that are possible. But tell me, how did it start for you? How did you become a philosophical counselor? Well, it was quite by accident actually. I was working on my master's, I think I just finished my master's degree. At the University of British Columbia, and I was speaking with a colleague, a student of mine, a fellow student. I was in my 40s at that point, I went back to university quite late in life, and which is a totally different story as to why that happened. But the colleague of mine was asking me what I was doing during the summer. And I said over the summer, I volunteered at a group home for men who are recovering drug addicts and alcoholics. And what I was requested to do was to teach them critical thinking skills so that they would make better decisions in their lives. And I said, and sometimes the men approached me personally and asked me to help them with personal problems, family issues, relationship issues, something like that. And I said, so that's what I did. And I taught critical thinking, and then occasionally I would help people, the men overcome individual problems. And she said to me, well, that sounds like philosophical counseling to me. And I said, what's that? I never heard of it before. And she said, oh, well, there was just a conference here at UBC on that topic. And I said, I didn't know that. And she said, I think there's a book out about it. So I looked and it was Rand Layhub's and Tillman's book. And it was philosophical counseling when I started reading the essays and that I said to myself, this is what I have been doing. And I was in between my masters and my PhD at that point. Like I said, I was sort of coasting over the summer trying to figure out what to do from my doctoral thesis. And I thought, well, I'm going to put together a proposition, a proposal to my advisor that I'd like to do my PhD on a justification of philosophical counseling being a legitimate form of therapy. And so that's what it was. And when I finished my dissertation, I offered it to a publisher and they accepted and it became the first book. Right. So you started quite early, I would say. And when did you start really practicing with the awareness that you were doing philosophical counseling? Right. Because as I understand carefully, you sort of were like Monsieur Jardin doing prose without knowing that he was doing prose just by talking, right? Exactly. Yeah. Yeah, I had no idea I was doing philosophical counseling. And reading the Tillman's and Lehab book, it clarified as to what I was doing and of course helped me in what I was doing as well because I could see what other counselors, what they were doing, their approach. And it was quite diverse. The essays in that are quite diverse between practice and counseling and I think if I'm not mistaken, essays on corporate advising and so on and so forth. There was quite a range of things offered in the book. But the philosophical counseling part certainly applied to me and I was quite happy to read about it. Now I may be wrong about what's the content of that book is. It may not be quite that diverse because I haven't read the book for quite a while, but that's what gave me an understanding of what I was actually doing. What's your take on this idea that I'm sort of trying currently to theorize and also look at it through different angles of philosophical health? Do you have a feeling that you are participating into such an idea? Or would you qualify differently? No, I think I would call it that for people in the field and for philosophers who understand what philosophical health actually means. Here in North America, the word philosophy is not well understood. And we even have movies that were from Harry Potter where the title was changed in North America because the philosopher Stone would not resonate with viewers here. They called it whatever I can't remember what it's called now, which really shocked me because it's one of these things where I thought North Americans were not very clued in about philosophy and the change in that movie title really confirmed it for me. So when you talk about philosophical health, you and I can understand roughly what that means. We may have slightly different perspectives, and I certainly agree with the importance of it, but to converse with someone, to spread the message about philosophical health, where I live anyway in North America, I don't think it would serve a very good purpose. So the point that the approach that I take is to teach people how to think well. And that's critical thinking, and that's a small part of what philosophy actually is. And by teaching people to think well, it not only helps them overcome an issue that they're involved in, which is philosophical counseling, they have a relationship issue, you help the person think through it and make decisions as to how to resolve the issue. It also helps to prevent. So when you help people think for themselves, think about philosophy for children, you help that child or the adult add to their toolbox, the toolbox they have of ways to resolve issues and ways to think about problems. And that's philosophical health, the way I understand it, that you have the ability to look at an issue from different perspectives, think about different consequences, decide on the one that you want as an outcome, which is moral, and which is possible, and so on. And that's a preventive approach that prevents young people from going up to be gangsters and so on and so forth. So philosophy throws off of the health, just like in medical health, it helps to overcome a situation, but who wants to wait till they get sick, we want to be healthy, so we take on a good diet to prevent the possibility of illness. And I look at philosophical health the same way. That's very interesting, and there are two points here that I want to unfold with you. The first one is the distinction between thinking well, and you mentioned that phrase, and thinking for yourself. But before we get into that, I think it's relevant to mention the young people in the sense that there is a discourse today, scientific discourse that says young people do a lot of silly things, stupid things, because their prefrontal lobe is not yet developed. Ten years ago, the science was saying it sort of gets mature at 20, now they're saying at 30. And so, and even the solution sometime that our proposal, they should do more sports, then they can focus because they're tired. And what you're saying with the preventive approach echoes with one aspect of philosophical health that I find important is the adequation between our thoughts, what we find relevant in terms of values in our acts, such that we don't act in contradiction with what we value. And this sort of self-reflection can be, for young people, a way to train what they supposedly are lacking, which is a sense of the consequence of their behavior, of their acts. Yeah, and so let's go back to something that is actually related, thinking well and thinking for yourself. Is that what you say it's the same thing? No, it's not. And if I may just go back a step to something you said about the prefrontal lobe. I've been writing lately about helping people to try and avoid blaming their brain, which is, again, very pervasive in our society. So if someone makes a bad decision, oh, their prefrontal lobe is not developed very well. And maybe we've got a drug that will help that. That's the step, that's a sequence of events in North American culture. It's very important for children to grow up and at home where parents make good decisions. And if the parents aren't able to make good decisions, the child's not going to learn that either. You don't learn making good decisions in school until you get to university where you can take philosophy and critical thinking classes. So what is it that trains a person to think well? They can think for themselves and it doesn't stop someone from getting into trouble because of decisions. They have a certain number, and I use the term loosely here, they have a certain number of tools to work with. They can ask their friends if the decision is difficult, they can ask their friends. The friends are limited by the tools they have in their toolbox. And of course, the tools that we have are culturally relevant. The things that we get from our culture, that's why travel is so important for young people to understand how other cultures think and act and behave and so on. So what happens is young people or anybody works with the tools they have and or they ask their friends and relatives who work with the tools they have, which may add 10% to what they've got now for a toolbox. And it still doesn't solve the problems, so to speak, in their life. And that's where philosophical counselor comes in, or a philosopher or whatever, where the tools that we have in our toolbox as philosophers are really extensive. And I've got a shelf full of tools behind me that are called books. And if I don't know something, I can look it up. But not many people have the kind of philosophy books that you and I have in our libraries at home. So thinking for yourself is limited. There's a range of ability you have by thinking all by yourself. And most people realize they get to a point where they get stuck and they can't think. And the teacher says, well, think harder. How do you do that?  And so what happens is when people can't resolve an issue, they talk to their friends. But we are there as philosophical counselors and say, look, we've got the tools, we've got the expertise that we can help you with, right? Not that we're trying to tell you what to think. Because, well, humans said such and such or Spinoza said such and such. You should do what they said. That's not the way we work, right? We say, well, here's the perspective they took. And it's something to offer to the client for them to think about and perhaps accept or not. And any one of the next suggestion. So again, your question about thinking for yourself is very different from being able to think well for yourself, right? Right. And so it's interesting because that sort of might explain why I didn't know this anecdote about Harry Potter. And I'm very curious about the title of the American book because maybe that could be useful for us. But there is this idea that it's not only American that philosophy is very unpractical, right? So philosophers are these people who keep banging their head on doors because they are thinking about big ideas. And actually, the more they do so or the more someone might be interested by this deep questions, the more that person actually might be in danger of doing everything wrong with the domestics or the logistics of her or his life, right? So I think there is might be this sort of almost fear of the philosophical domain in a country in like maybe the US and Canada is a little bit different. We can talk about that later. But in a place where the the pragmatics of life are so important, right? The effectuality being effective. And so now what you're saying about the tools, I think comes from a sort of overarching idea that we know we are convinced that philosophy is actually generative. It's very useful and very pragmatic, in fact, because there is a deep connection between our ideas, whether these ideas are very clear or implicit or working as ideologies or fixed ideas within within our subconscious and the way we act. And this comes all the way back as of course, you know very well to the Greeks, we are well aware that philosophy, philosophizing was a way to become a better citizen, a better active citizen. And so what I believe that what we're trying to do with this concept of philosophical health and in practice with philosophical counseling is that we're really trying to democratize this empowering disposition that allows ideas to be social forces when they are well calibrated. And so of course, many professionals, philosophers would disagree with us, right? They would be, some of them would be outraged at the idea that, oh, that philosophers are giving tools for a better life, right? But I think that I deeply agree with you and it's interesting when we reread philosophers. Well, of course, I'm also trying to solve cosmological questions or questions of the logical coherence of reality, etc. But they are also, many of them, you mentioned Spinoza, there are many of them trying to answer the question, what can a philosophical conviction do? Spinoza said, what can a body do? We could say, what can a philosophical belief do?  So your experience is that there is a space, even in a country that takes out the world philosopher from mainstream entertainment, your experience that there is a space for it and that it sort of, it works, you could say. That's a really good question and an interesting perspective. I have the experience of writing a book called The Philosophy's Role in Counseling and Psychotherapy. That was one of my latest books, you may have seen it. And it has been reviewed by one, I'm not sure, psychologist, psychiatrist, something like that, as being way too simple, as having dumbed down the information. So as a writer, I find myself stuck in the middle. Okay, when I write really strong philosophical, what I think are strong philosophical essays, I don't write books like that for a good reason. When I write strong essays, those essays are read by other philosophers who understand them. At least I assume that because I get feedback, right? When I look at the public out there, what I see them craving for is understanding of the stuff that philosophers are playing with. And I'm using the word playing, because there's a lot of material that's written that's only read by other philosophers. And the question is, what's the point? What good is that? So if you're going to, as a philosopher, help society, you have to think about, okay, at what level is society reading? In North America, the level of reading comprehension is quite low, in my opinion. And when it comes to philosophy, it's very, very low. So what we have in North America is a lot of sort of self-help books, okay? The latest one, the latest fad, is the recent fad was about positive psychology, which is helping people that isn't always critical of what's wrong with them. It's giving them tools to live a better life. And I'm thinking positive psychology, isn't it what philosophy has been doing for centuries? Okay, that was one fad that's gone now. Apart from Schopenhauer, who was doing negative psychology. And the latest fad is the one with mindfulness, right? And that goes right back to ancient Greece, and don't ask me to quote who it was, or the expression over the gate that says, no, thyself, right? That's mindfulness. So we're talking about 2,000-some-odd years of history of philosophy, trying to get people to be mindful of themselves, to understand why they believe what they believe, and to decide what they want to keep and what they want to get rid of, right? And yet we have this latest fad of mindfulness books coming out. And when you read those books, they are philosophy at a very, very low level. They're extremely watered down. And that's what the general public needs. If you want to help people improve their lives, you have to write at a level that people can understand the material. And I see a huge division between the self-help books on one hand, which to me are extremely boring, and the philosophy books on the other hand, which often are very difficult to read, like Heidegger and what have you, right? There's very little in between that solid food, so to speak. We have baby pablum on one hand, and we have exotic meals on the other hand that people cannot afford to spend the time on, right? So that middle ground is really lacking. I think that's really interesting because among other points, two notions there. The first one is the idea of simplicity, which you brought up via the critique that was made to your book. And I think that's an epistemological question in the sense to use an un-simple word, but in the sense that when a philosopher uses what might sound today like a simple approach, for example, Spinoza. When Spinoza says, there is basically just one emotion. It's joy. And all the others are sort of modulations on joy. And joy is the feeling that your power over the world is increased, let's say, put it in a simple way. And there is a reason, a philosophical reason sometimes for choosing simple terms, especially today, where the psychotherapy field has been invaded by a very normative nomenclature, whether it's psychoanalysis with all its concepts from adipose to transference, etc. And each, let's say, each approach as its jargon, you take the DSM-5 and you have this very long list of syndromes. One of my games is I invent new ones just for the fun of it. For example, you have the red carpet syndrome. So red carpet syndrome is this syndrome that people have today that why is society not unfolding a red carpet? For me, I'm so unique, right? Or for my community. So I think that in a way it can be healthy to go back to simple words. Instead of saying you have obsessive compulsive, depressional disorder, say, maybe, let's say that you're sad. Why are you sad? Now, on the other hand, there is sometimes use of simplification without justification. And then you have these books that I agree with you are more or less all formatted the same. And also based very much on this idea of will, right? So if you want, you can. And I think that philosophers are very rarely saying that they are very much often trying to find a sort of an understanding for how how there can be a necessity, ethical necessity in your life, such that if you consistently believe in a certain value, and then you repeat certain actions, then this will create a reality because reality is often created by repetition. And the other point is that why is sometimes philosophy not contemplated directly at actually indeed, as you were saying, a tradition that has explored all these new fads before is perhaps that there is today the idea that if something is exotic, coming from abroad or the Middle East or or or China or India, then it's more exotic. So it's nicer, right? So mindfulness, for example, is a it's often presented as as a something inspired by Buddhism, etc. And so we have we tend to I think as Westerners, we also tend to forget our own spiritual traditions. Philosophy being one, I think it's Michel Foucault who actually and Pierre Hado who are two figures that pointed the fact that the Greeks were using philosophy as a way towards the good life. And they I mean, we are we tend to forget that we have these traditions within ourselves, whether it's the for example, the mystical tradition in Europe in the Middle Age, Europe, right? So when we look for mysticism, we prefer to look also again as at China or India. But so I think it's a good, I think it's a good idea. And I think more and more people are actually turning to philosophy to to help to help them articulate meaning in their life. But then we could be critical and say and observe or whatever, observe, I don't know if you agree with me that many people discover philosophy as a way of life through stoicism. And and this idea that, well, it's about accepting life as it is. And I find that politically significant that stoicism, even in the production of self health books, because there are now a few that are presenting themselves as philosophical, they are selling stoicism, which I find politically actually a bit dangerous in the sense that they're selling the idea that philosophy is about renunciation. But philosophy can also be about, you know, combat and idealism and transformation. But fair enough, maybe that's maybe that's one way to to enter the field. And maybe people, if they read stoicism, then they will discover other other aspects of philosophy. But my question, and you can, of course, comment on what I've said, but my question was also about your practice is like, tell us more about your practical experiences of counseling, like, for example, if you have one, of course, anonymously, one one case that was really a moment, a significant moment of your of your life of counselor that we'd like to share. Yeah. Wow. Yeah, I have I have very few clients at the moment, because I'm retired from teaching, and I've sort of drawn back from from having personal sections, because I did that for what 15 years or something. And you do you do reach a point where, especially because I was involved in academics, where the face to face counseling is a lot of extra work. And it requires a particular mindset and so on. But but that's having said that. So I'm not I have, I have two clients right now. And I work by phone, which, you know, it saves me having to open my home to people and so on. Pardon me. And of course, with COVID, it's very risky to have clients anyway. So everything's been pulled way back, just like other businesses, mine is very much pulled back. But I want to okay, you made so many points, it's really hard to answer them all. The thing about jargon, I really hate that word.  And I know you're doing it for a purpose. And I understand that. But when I get accused, or when I hear people accusing philosophy of using jargon, like my students sometimes have said that, I say to them, well, every profession has its jargon, but they don't call it jargon. They call it technical language, right, they call it their professional language. And the reason we have that is it makes discussion simple. So when I say existentialism, you know exactly what it means. I don't have to, I don't have to say, by the way, which is blah, blah, blah, blah, blah, blah, blah, blah, before you understand what I'm talking about. And then I forgot my thought anyway, at that point, right. So jargon is professional language that is a shortcut, so to speak, right. So, but, but it's a professional language. No doctor in my experience anyway, will tell a patient in medical terms, what's wrong with them. And that's the patient specifically asked, well, what is that, right. The doctor in a sense puts it in simple terms for the patient to understand in the medical field. And what I'm saying is that this happens in philosophy too. You have discussions in philosophy that are appropriate between professionals.   I'm not going to then use all the expressions from, you know, authenticity and all those expressions a surter came up with to explain existentialism, right. I'm not using the jargon when I speak to clients. And that's important. And I can scare clients away too, when you use the jargon because they can't keep up with you, they don't know what you're talking about, right. The other thing that you mentioned, is about stoicism. And one of my clients that I have right now was really into stoicism because he lived a very, very troubling life as a young person. Very, very difficult family situation with a fairly brutal father from what I understand from what he told me. And for him, stoicism was totally appropriate to a point, okay. But where I draw the line is to, when you, when people look at stoicism, it's just putting up with what you're given, putting up what life, what life throws at you, and, and don't complain, just adapt, right. And there's, like you said, politically, there's a problem with that. If you've got a government that's on the brink of becoming a dictatorship, is there a really good idea to just go along with it and just adapt yourself to the dictatorship? And for most people, the answer would be no, you're crazy, we don't want that, we want democracy, right. Or whatever the situation is, there's a limit to the usefulness of stoicism. And, and because people don't understand the history of stoicism, they apply it to modern day situations and books come out, you know, about how to be a stoic in today's life.   So there's a limit to stoicism, but that's not presented in most books that that I'm familiar with. And I don't read a lot of current help self help stoic books. But you see, I'm saying there, you know, the understanding of philosophy is lacking. So we have, we have, we have students going into counseling that, you know, and I'm slightly off track here, but, but I'm sure you'll forgive me. We have students who go into counseling, who understand the technique of counseling, they understand the technique of existential therapy, okay, or rational motive behavior therapy, which is critical thinking skills, they understand the techniques, but they don't have the understanding of the philosophy behind them. The same with, with stoicism, people, people promote the idea in their books and what have you in their, in their groups and what have you of stoicism, but they don't understand where it came from, where it was meant for soldiers and poor people who had to put up with incredibly difficult situations in life, right.  So that, that's my take on, and I'm not sure if I've answered all the different points you're making because you, you bring out a lot of points and you really stimulate my thinking, by the way, I appreciate that. Well, thanks. That's mutual. And that's a very good point. I think I share that conviction that if you want to be a philosophical counselor, you, you need to dig into the, you know, you need to have a deep knowledge of the history of philosophy and the text, etc. Otherwise, you can do something else. Can I just jump in here for one second? When I first started teaching my course in philosophy for counselors, I actually advertise it to our students in my university as philosophical counseling. Okay. And I advertise it to philosophy students. And like the first time I taught that the first semester, I think I had five students that signed up for the class, which was very disappointing, right. And I talked to some of the students and, and you know, as to, you know, why is it there's so few of you and basically what it came out to was, well, philosophy students, if you've advertised that the philosophy students, they don't want to be doing counseling, they want to do this, this philosophy stuff, this high level thinking stuff, that's what they're doing in class. So what I did after that is I advertised the course to students who want to become counselors and psychotherapists, and I changed the time of the course. And I call it philosophy for counselors. And now every time I, well, not now, because I'm not teaching anymore, but every time I taught the course after that, I've had overflow classes with spending room only. Because the students that signed up for it are students who want to already help people. Right.  That's, that's important. Absolutely. Absolutely. Yeah.  That's a very good title. You should do a self-help book against all of these self-help books. I wanted to give an example, because some people might be wondering here, but what is it really that they're doing? And I want to give this just an anonymous, very brief example of one person that came to me and was a man of, of, you know, in the middle of fifties. And came to me because he, I mean, he felt lonely. And he had no family, never had a child. And he wanted to talk about that. And, you know, along our conversation was just the first session. So on the one hand, yeah, he wanted to find love. He expressed the need to find love and to, to have a child and to have a family.  And, and so, you know, I led him to understand the contradiction between on the one hand, a philosophical sense that was idealism, this idea that love is desirable, and, and, and as a spiritual non material good. And on the one hand, the vision of women that he had that was typical of cynicism, which is another, which is a school of philosophy, by the way. And so, what I told him, because I, I mean, I try to be, especially in the first session, not to be judgmental. So the well, right now, at this stage, I'm not telling you be an idealist rather than a cynic, which, which I think people should be. But I just told him, you need to make a choice here for the sake of coherence, because your sort of mind set division between two opposite systems of thought might be precisely what prevents you from finding love. And then more details is that when he described the way he was trying to find love, he was going after married women. So this was very problematic. Right. So this is just to give an example of the kind of discussions we can have. It's like, we show that behind behaviors, there are belief systems assumptions.  And that impact can be really, really sad and painful, such that we are alone in life and we feel, you know, more or less desperate. So I just wanted to, to add that example, perhaps you want to that, you know, triggered another thought or example from the past, I would like to, I know, for example, that you've written a book on women in philosophical counseling, would you like to say a little bit about that? Yeah, the whole idea of, maybe I can give a little bit more background. I was born and raised a fundamentalist Christian. And there are beliefs that I grew up with, that were absolutely rock solid. This is what we believe. And everything else is false, and so on and so forth. And we were taught basically that that questioning was you could really ask wrong questions, bad questions. And so the belief system I grew up in is religion. And I wanted to clarify that was that was part of what you talked about earlier, this, this philosophy can be looked at like a religion, I would really have, I would really disagree with you. I have lived religion, and it's very different from philosophy, where there are clear boundaries as to what you can, what you're allowed to, which are not allowed to believe, right? So, and it took me a long time to get over that. I had what I call this religious hangover for a long time, where my religious beliefs would interfere with my daily thinking, even while I was studying to be a philosopher, my religious beliefs would pop up every once in a while. So, and those beliefs certainly, you're absolutely right. The beliefs that you have determine how you live your life, and determine what other beliefs you accept or don't believe. And this is why I talk about philosophy being the attempt to examine your beliefs and your values and so on, so that you're not guided by them, you're not controlled by them, that you decide where they came from, and whether you want to keep them or not. And the only way you can decide whether you want to keep them or not is by looking at other beliefs and other values, and making a choice, and then coming to a choice that is moral, for one thing, and reasonable, in whatever, wherever you live, whatever society you're part of, right? So, I totally agree with you. The fact that there are people who are raised, and again, I've got a couple of clients like that, who have beliefs that are, in my opinion, really problematic, because they're supposed to, for example, love family members that treat them terrifically miserably according to what they've told me, right? There's a super contradiction. And by the way, that's been argued in a number of books as to a possible beginning for schizophrenia, if there is such a thing as schizophrenia, okay? And I dispute that. Where people are, as young people are raised with conflicting beliefs, and values and so on, where parents, for example, say, I love you, and they don't hesitate to, you know, to harm the child, right? The old, I love you, but don't touch me kind of thing, right?  But I want to be very clear that I differentiate the beliefs that we have, that we don't think about every single day, right? I believe, for example, my car is parked in the parking lot out here, but I'm not thinking about it until just now. I just totally forgot about it. Doesn't mean it's gone. It's still there. But there are, there is this belief about the unconscious or the subconscious, whatever. I think, what's the term that Freud uses? Is it unconscious or subconscious? I think it's the unconscious. Yeah, where you have no access to that, right? And it controls your life.   What happens to free will at that point? If you say, you're doing this because of some unconscious thing, seek, you know, search it out, see what it is that your belief is that you're now behaving that, that's now driving you to behave a certain way. What is it you believe about the situation, like, like your client, like you said, two different things that conflict, that's, that's driving his life to be miserable, right? Those are not unconscious things, they can be. Well, he was not, he was not conscious about them in a way we could say we could argue, right? But that doesn't mean it was the unconscious. Exactly. Yeah. So yeah, I mean, again, I totally agree with you that, that, you know, what you believe and what you value and what you fear. And those things, the trouble is those things can be diagnosed as mental illnesses too. That's, that's another old discussion topic, right? But actually, of course, we, there are so many topics and we'll, we'll finish in a few minutes for today. But I think I'd like to finish on that question because you, you have a very strong opinion that I find extremely interesting on, on the fact that many of the so-called mental diseases that are labeled are actually the wrong categorizations of, of sort of more philosophical or, or cognitive, you know, dissonances or, or constructions. Can you say a little bit more about that? Sure. The place to start is to, to see that in psychotherapy and psychoanalysis and so on, in the, in the world right now of mental health care, there's a huge confusion.  There are many books that, that I've read that say point blank that the brain is the same thing as the mind. The mind is the same thing as the brain, which is interesting because you can get a brain cancer, but I've never heard of mind cancer. So, you know, what's going on here? Well, the brain is an organ, like a kidney or the heart or the liver. And it can be, you can take it out and look at it and point your finger at it. It has external reality to your body. The mind doesn't have that. It doesn't have any of that. The mind, in my opinion, is your beliefs, your values, your thoughts. Okay.   You are your mind.   Right. And, and when, when they talk about mental illnesses, what they're really talking about sometimes is brain diseases. So you can have Alzheimer's, you can have Tourette syndrome, you can have Fetal Alcohol Syndrome. And those things affect your brain and they affect your thinking. Okay. And they're caused by the brain, malfunction, some kind of malfunction. Okay. Mental illnesses are not caused by the brain. They're in a sense caused by your thinking. So you can have, you can, you can be, how does it go here? You're not suffering from depression. You're depressed about something. If you use the terminology that you're suffering from depression, you're in a sense reifying, you're making depression into something real, which it isn't. Depression is, is what you're thinking about, what you believe, right? If you say you're suffering from anxiety, same problem, you're not, you're anxious about something, right? And that differentiates the brain, which has causal explanations for what's going on to the mind, which has a different kind of causal thing, because the mind is, is not a physical entity. Your beliefs and values are so I'm collected. So when I wrote in one of my essays that, that when people talk about philosophy of mind, as though you can study one mind and understand minds, it's really a mistake. You can say you can study brain, the brain, you can study the brain, because most of people's brain, most of our brains are very, very similar, very almost identical, right? But you can say study a mind and know everybody's minds. Why? Because everybody's beliefs, values, fears, assumptions, hopes, all those things are very, very different. You and I, our minds are very unique, but your brains are not. Okay. And that's the big difference. And the problem in psychiatry, here's a metaphor I use quite often. The problem in psychiatry, and especially biological psychiatry is that they're studying a book. Okay. And the book is you. But the book is not you. Okay. The story in the book is you. And what psychiatry does is they open up the book, and they study the paper, the pages, and they study the ink spots. And they figure that's the way to figure out what the story is all about. And it's not the story is the book, the story is the story. Okay. The story is not the physical properties of the book. And so there's a huge problem in the research right now, when it comes to neurological research, there's something in the brain. And I asked my, you know, I asked my students when I was still teaching, I would say things like, well, does your brain make a date with your girlfriend?  No, it's you. It's your beliefs and your values and your hopes and your preferences and so on. And that's buying. Okay. But you can't put, you can't put the mind in the same category as you can put the brain, which is a physical thing. That's a long answer to a short question. Yes, no, but it's this is a very important topic. And I like the metaphor of the book. And we could say that as philosophical counselors, we, we try to help people write their own book and not just the the puppet in the story written by others. There's so much in what you said, which is for example, the cognitive diversity aspects. Right. The the how do we philosophically and politically favor a world where cognitive diversity thrives in a way that creates more possibilities, more ways, new ways of life. And indeed, there is a mental health approach today, which is connected to industrialism that tends to on the country have a mono, you know, I was going to say mono maniac, but you know, a very standard view of what a person is. And that is of course connected to the fact that there is a huge industry of medication. So we we're not going to go into into that. But that's of course the reification of depression that you were talking about. And of course, we're not saying that depression does not exist phenomenologically as something that people might might feel. And then we put a label, but very often, those labels are connected to some form of of medication station. And there's a problem there. So there's, I mean, what I I see is that this was just an introduction. Nevertheless, I suggest we we conclude here. But this is really interesting. Is there any final word that you would like to to conclude with, for example, I really like your idea that stoicism will kill you. So what if you tell that to your patient, your patient, who has a story? What else would you tell him? What counter what antidote to stoicism would you propose? That's that's a really good question. And I meant to mention that and it slipped my mind because we're talking about so many different things. What I suggested or not suggested, but what I got him to think about was the fact that he's not the problem. It's not his adaptation that's at fault for where he is in his life. It was a situation he grew up in, the society he grew up in the family he grew up in. And so I said to him, you know, the responsibility is not you and your bad thinking. The responsibility is how you're raised in your family and abused in the family in a society that got away with it, and the family got away with it. And that was a turning point. I felt anyway, I could hear the click in the in the in the mind of my client at the other end of the phone when he went, wow, it's not about me. It's about how I was raised. It's about how I was I was forced to live and where I was forced to believe. And I said, yeah. And this is the problem with stoicism is it says just put up with the kiddo, you know, whereas I said what I'm trying to teach you is is to how to think for yourself and decide how to live your life on your own. So that was a big thing. It's not just I was a warning him about stoicism, but I was I was offering him existentialism without throwing another isn't in there to make the pot, you know, much work here. Right, right, right. And then also the idea that once we have identified the negative determinisms of our past, then we shouldn't have bad faith, you know, the sartre and bad faith about it, in the sense that okay, we we're not going to pose as victims forever. We can from that start and then many people have, of course, different starts, but many people's would have reasons to complain about their what to do about it. This is another this is another really interesting point to an important point to the difference between blame and responsibility. Okay, so in the same, you know, the same conversation with the same client, I said to him, your parents, and where you grew up the neighborhood and so on, were responsible for what you believe and what you value and what you feel and what you fear. But it's hard. It's difficult to to hold them to blame, because your parents were probably doing what their parents taught them to do was a good way to raise their child. So I said, you know, and this is difficult for someone who's been abused by their parents, right? I said, you know, they were doing the best they knew how. And they victimized you. Okay, the trick now is for you, when you have children, he was in his 25, 30, something like that, I said it's not to not to then copy that, not to carry that lineage of that, you know, the abuse to your children, right? Because otherwise, who do you blame? Well, you can you can hold people responsible back into infinity.  Somebody has to stop in and step in and say, I'm going to stop here. I'm not going to do this anymore. So the lesson that that I tried to I said to him, that this the lesson you might want to learn is the fact that you don't need to be like your parents, right? That this is that this is not going to and people are worried about that too. I've had other I've had other clients who are worried about I'm going to be just like my parents when I grow up, because I yell at my child today. And I said, you know, you don't have to be that way. You can be the new beginning to the to your lineage to your family line by what you do. I literally had the same experience with my family. I mean, not that I was abused, but my family were not a huggy type of people. And and one visit that we made to my family, they're on the other end of the country. I actually decided to give my sister a hug. And she said, Oh, I didn't know we were huggy people. And I said, Well, we can change that. Okay, well, that's a that's, I think, a very beautiful conclusion. We'll end with that idea of new beginnings, right?   Thanks. Thanks a lot, Peter.