Hey everybody Forest here ripping bowman chrome cosmic delight seven box baseball mixer number two random teams So two of each of bowman chrome hobby bowman chrome choice and cosmic chrome and then one topchrome breakers delight all from 2023 Good luck everybody Let's say there's a line drive there All right, let's do it do two hobbies first bowman chrome That's surprising Especially with the d-backs How big it is Hello late and channel two. Hello late and channel two Yeah, they they do they don't do ghost runner in the in the postseason do they? It's not even a ghost runner. It's a run. I don't think so. I don't think so either Yeah, I think I think it's nice goal to start twins first auto is riccardo olivar Number 250 Good start there twins Won't go there. Jordan Diaz a's well baseball classic flagged the 499 I don't really mind the extra innings extra the runner Like I'm not like for it, but I'm not against it. You know what I mean? I don't think it should be Yeah, jersey card to 150 for the Dodgers and the indie pages fall league relic full extra hit there Yeah, as long as I don't think in the postseason that doesn't bother me a ton But if it went away like I don't care Uh pink fuchsia paper wave to 199 is to pay it off with the cubs As lane is live on fanatics live right now first auto samuel basayo. There we go baltimore Great hit for the o's andrew are that's a good box here a gold and then a basayo and a relic Zach fly Trout iconic purple shimmer to 250 is fair enough for the yankees part of young solano Yep, click that link in chat right now if you're on youtube app dot fanatics dot live slash shop slash leighton sports cards Lane's got pyt four boxes of bowman chrome plus a flawless Speckle to 299 is kevin parata gabriel hughes Francisco alvarez it came into the league All right, that was good first box there. All right another bowman's chrome hobby. Then we'll do some cosmic I like this mixer. This is a good mixer. I just typed in come on lane and chat. I didn't have audio So I don't know what he's gonna say. He's just got these first auto for the dodgers Get that dusted off iconic Juan soto gold rookie hunter brown to 50 for the astros You go stroze 13 to 50. There's francisca base and a Guerrero. What's all in to make an almanac while he waits to kill the first break Iconic Corbin carol if anyone could do it. It's lane Ricky refractor Miguel Vargas the 499 Dodgers Thank y'all for filling up the break so far today The last two for tonight are a flawless py t for football And there's a speckle first auto Camilo Diaz astros to 299 And then there's a division's case of nt football later That's it for tonight. Almanac is sold out. All max would be fun to watch though first shimmer is galan for the rangers It's 499 Jordan Diaz again on the flag for the a's iconic Alonzo Cosmic to cosmic Got finest ua for up next and that's the last break daytime cuckoo cuckoo cosmic That's seriously again I'm back stroze. Oh, yeah, that's the last series of the rookie nucleus morel cubs refractor rookie alvarez mats That's an interesting series end of the year Got latty stars in the night Lane's got 21 to go on his first four box woman chrome everybody py t style So if you're looking for like maybe a bigger team They don't want to pay the full case of four boxer might be the way to go JRot extraterrestrial talent toglia Yoshida extraterrestrial talent refractor tim anderson white socks what's the play julian guerrero and bishet Harper's over there buying some bone with chrome. Oh, yeah HD boon Chunky 27 about a spot down to 20 to go on lanes fanatics first break over there bobby witt Bobby Dude jake was listening to some crazy songs today earlier got launched an orbit francisco alvarez He was like he like he like airpods in And he thought like that he's being sneaky, but he was listening to it so loud that like everybody here was listening to, dude He was listening to the matt agascar soundtrack. Yeah, dude. That's fire I like to move it move it. Yeah, dude. He was layering that and it was on repeat too It was like a straight like 30 minutes of that you like to We've got a planetary pursuits saturn might trout Saturn trout That's fire. That is sick. Congrats to the angels patrick are That's the first saturn. I think I pulled actually Very sick Makes me want to play starfield now got mcclain rookie. There's a harris Riley and akunja alvarez base riley green base Got launched into orbit riley.  Do you really die for the triples or no? 299 is hater for the for the padres Uh for the triples i'm gonna roll a die unless for some majority They'll all go the same way in the break if there's a numbered one in the next box will random it instead Uh one two three four five six Two i'll go left unless somebody has a majority Hey guys as soon as I end the stream here. I'm gonna grab a quick snack and then head over to nattox live and uh Hang out with lane breaking some bowman crume Some flawless Okay refractor not refractor, but he stars in the night of gunner henderson. You got it gonna As a bloop As a bloop That intended bloop. That's a special Is lefty Rikki refractor riley green for detroit trout otani on the uh star clusters An auto of andres hymen as for the guardians Adley base Otani extraterrestrial talents michael harris base Rikki nucleus of freeman for the guardians refractor springer blue jays nucleus gallon diamond backs Otani launch into orbit Do you hit the uh the trout Saturn machine? Yeah, man. Congrats on that Orange coming up and it is an erin judge Great card yankees Three of 25. I think it said Yep, three of 25 yankees erin judge Great card there Nice cards in cosmic extra trestle talent of harris Vladdy corporate carol rikki aqua to 199 cj crone rockies Ka says there's a gun or extra trestle talent Two bowman chrome choices and then a breakers of light Allotom Hula Florida scurril He's been very good this year Yeah They need him for the first series First auto is bugarian for the rockies First bowman auto twins freddy michelle Twins again, they has two michelle autos and true gold Wow 49 of 50 valdean celestine What a monster hit for seattle Chang s Holy cow Yeah That is huge right there. We haven't won the big celestine recently No less than the best celestine Got him boom Got him bangerang Okay, here we go. We got a cubs first bowman auto at on sanchez There you go cubs Got base first auto for the mezz or not the mezz the ash show is different orange and blue Kenny gomez Lane says huge That big car little roller line up there the gomez and refractor first auto for the rockies and the perez the 499 All right breakers of light don't get rid of this very often anymore Breakers the light What's he was love like All right, let's do this refractors first Of erin judge j.d martinez kyle schwerber trevor story McMahon and albuys will top it all the refractors When I start on the numbered cards here, you've got a rookie aqua lava of james outman to 199 Dodgers james outman to 199 there Got a green wave rookie ryan nelson to 99 diamond backs Got rookie color here Next we've got a will brennan guardians rookie orange auto to 25 nice true orange rookie auto I'm coming up here There's a youth quake of kade cavalli rookie auto jared young And there's a radiating rookies behind it come on see an auto It is a michael harris radiating rookies Braves very good box there. Well, and a pretty solid.  We'll do a recap and we got finest uefa up next everybody That was a very good break. We hit a good cards in a few of the boxes So for a seven box mixer, I agree andy. We did really well there overall Hope y'all enjoyed it. If you didn't hit I do apologize Is a seven box mixer after all But more than a few spots did well, which which is always good in a smaller mixer Hey, it's here roger. Feel better man. We'll see you later. See you up to 4.99. We had two jordan deez's engulf argus 2.99 parada to 250 serenade to 199 sepada to 500 brown To 199 is crone to 100 is hater to 25 is judge Get an outman true rookie to 199 ryan nelson to 99 and a jersey of andy pages to 150 All right, and then we had autos and men as from cosmic Jared young tops chrome michelle first bowman gomez first bowman Same with it on sanchez vulgarine gallease Bessio nice hit orials refractor perez the 4.99 speckle camilo diaz to 2.99 Gold riccardo oliva as well for the twins and an orange rookie auto will brandon for the guardians radiating rookies michael harris for atlanta Saturn planetary pursuit mike trout for the angels And a gold first bowman auto is felling celestine to 50 for the mariners. Maybe the biggest story fits today They congrats on that. Seattle. Thanks to get everybody moving on to finest uefa


Hi Virgo. Welcome to my channel. This is a channel strictly for Virgos, Virgo's son, Minna Risa and Venus. Hope you are all doing well. There are links in the description box below if you would like to get a personal reading with me. All right Virgo, let's get right into your reading. So the past position, we have the Eight of Cups, the King of Wands and the King of Swords. Okay, Virgo, were you dealing with two people that maybe you walked away from? Fire sign and an air sign. All right, let's see. Present position, we have the Page of Swords, Ten of Pentacles and the Moon and the Future, the Queen of Swords, the King of Wands and the Tower. All right, let's take a look here. I'm going to see what the Romance Angels have to say. The overall love messages for Virgo. Romance Angels love messages for Virgo, Sun and Rising and Venus. All right. Engagement, same as yesterday. Your love life is ascending to a higher level of commitment. Okay. Oh my gosh, heart-to-heart conversations and the saga continues from yesterday. What else? What else does Virgo need to know? What other love message do you have for Virgo? Virgo's Sun, Moon, Rising or Venus. Okay. Attraction, you attract romantic love by enjoying this moment fully. Okay. So, I was just having a quick moment about some message that came to me that there was something in the past, Virgo.  Now, this may not be for all of you, but your person may have left your relationship for a same-sex relationship. Okay. And if you are, like, I really don't know who this message is for, but I'm just kind of picking this up. There might have been a same-sex thing going on in the past that either you did or you didn't know about, that your person was kind of like ascending into a committed relationship with this person. Now, the other message I'm getting for some of you, others, that your person was on that journey and they've walked away from it. Okay. And a secondary message or a third message I'm getting is that it was something, there's two brothers who left together in a sense, like, went on some kind of journey together or your person left to go be with their brother. Okay. Very strange message or to go help a friend or be with a friend and just kind of like, it feels like it was like a temporary thing that it was like, all right, well, I have to go take care of this thing right now. You know, maybe they went on a retreat. Okay. Something strange like that. So take it as it resonates. Okay. But I'm going to pull a terrifying card for this. King of Wands, seven of Pentacles and the King of Swords. Yep. Five of Cups. So Virgo. Yep. Nine of Cups sitting on the eight of Cups.  I do feel like there was some kind of relationship with someone of the same sex. And I feel like your person or two people of the same sex, right, that maybe they were might have been a bisexual relationship. Okay. For some of you. For others who are in same sex relationships, I feel like your person might have been involved with you and somebody else, but then they walked away because this person, whomever they were, I know some of you, this is not going to resonate.  But I feel like this is a message for someone that your person left because they were on a mission to go find their, get their needs fulfilled or met. And I feel like they might have dabbled a little bit in a, if they are heterosexual, they might have dabbled a little in a same sex connection. And that seems like it didn't work. Okay. I almost feel like I want to start this reading over and do something else here. But I feel like I'm just going to leave that portion there.   And something ended with an air sign. And I just kind of feel like your wish in the past was to find someone who was interested in a committed relationship. And I feel like these two people maybe just weren't going to fit the bill in the past. Okay. But we're going to move right on to the present because I feel like, and usually when I do this reading, I'm looking at the other person, but I'm picking up, this is like your energy. And I feel like right now, there's a lot of confusion with somebody right now that you might be dealing with currently in your life. And there is a really strong need to have a heart to heart conversation. Now if there was something in like yesterday, like it continues. Okay, there may be a continuation of these conversations if it happened yesterday. But I feel like there's somebody here who's kind of keeping their eye on you and they really want to talk to you about a committed relationship. But with the moon, this person, they are trying to seek clarity. And I feel like they will be seeking clarity from you, because I kind of feel Virgo that you're really not opening up and sharing anything at this time. I feel like you've kind of gone into the dark. You're kind of like not really out there or putting anything out there in the present. The moon kind of makes me feel like you are just really going within and trying to trust your intuition. And I feel like you've got somebody here who's seeking you or looking for you, because they want to talk to you. Like this person wants to open up, they want to get the truth. And they want to give you some truth. Okay, they're very curious about you at this time. Okay, we have the Empress. So for some of you, it could be a Libra. Okay, but also they're looking at you. Some of you might be on the cusp of Virgo Libra. But this person is trying to find out tell you the truth and the truth being that you truly are everything that they ever dreamed of. Okay, you possess all the elements.  And I feel like this person wants to talk to you and express this to you like their deepest feelings about how they feel about you. And also about, yep, marriage, commitment, the ten of pentacles here. Okay, stability, maybe buying a home together, or, you know, just kind of getting into this, because the ten of pentacles always feel like there's real estate, something here with real estate. But it's like, I feel like this person, you know, they want to talk about getting involved. Now, if it wasn't the same sex thing in the past, your person might have been just dating other people. And in the past have walked away from that because they do want to get into a higher level. They wanted to get into a higher level of commitment. They may have been also thinking that you were involved with others, and they left the relationship. Okay, but now in the present, they're coming to talk to you. The moon is Pisces energy. So you could be connecting with a Pisces. Okay, yeah, two of swords is here. I just feel like that's you and your energy.  You're nowhere to be found. Even if you are, you're just not seeing anything. And I feel like that's pulling that person to become more curious about you and to really begin to see how much they truly value you. Okay. But with the two of swords, it's like, you're like, in this process now, trying to really go deep within and check to see how you feel. And even like what your intuition tells you about love, in general, what do you want? I'm just seeing that scene from the notebook where Noah says to Ali, what do you want? What do you want? It's like you're asking yourself, now, what do you want out of your life? What do you want out of love? And I don't really feel like you're basing it on your emotions. You're just kind of like trying to get in touch with your soul and trying to, and trying to, it's like gain clarity. Do you want someone from your past back? Is there someone you're currently talking to? Do you want this person back? You know, you're trying to kind of shine a light on the truth of how you truly feel. Some of you may be inspired to come to this because some of you are getting some messages in your dreams.  And that the dream state is always the subconscious. That's the undercurrent. That's the thing that just kind of is hidden. And I feel like you're really like purposely not talking to anybody or not trying to get any kind of influence, visual influences.  Some of you are coming to terms and you're like, I'm not even sure if I want the same thing that I wanted before. You know, so a lot of, a lot of seeking truth. Some of you have been seeking truth about yourselves and even saying to yourselves, you know, am I really the Empress? You know, the Empress doesn't, even though it's Venus ruled, the Empress represents all of the elements. Okay. She's like the queen of all the queens. And you know, of course, if you're male, that can apply in your feminine energy as well. But she represents abundance and creation and new beginnings. So you're really, some of you are just having this heart to heart conversation with yourselves. Okay. And or both situations are occurring now. In the future, you've got attraction, you attract romantic love by enjoying this moment fully. So I feel like I want to tell you, Bergo, that you don't need to seek love. You don't need to go on tinder or bumble or, you know, all those dating sites and try to like seek out love. Because the more you seek it, the less you find it.   You know, and that is very attractive because she is just truly feeling and enjoying and loving everything.  And I feel like you're taking on this Queen of Swords energy going forward where you really come to a place, Bergo, where you just become completely self-sufficient and you get totally honest with yourself. And because of all that going forward, there's some shocking communication that comes to you from someone in particular. Okay, there may even be like messages about traveling comes in very quick or somebody might be just showing up at your door and like bringing you good news and this person is ready to take action and ready to make changes, make some changes. Let's take a look here at the Queen of Swords. Okay, the moon again. Yep, you're cutting through the darkness and you're taking control of that moon energy, where you're not going to let it rule you. Okay, you're gaining clarity, you've gained it going forward and you refuse to be in the dark anymore about things or even fool yourself or believe that the shadows on the wall are more than just shadows. You really take a cold hard look at things. You look at the shadow on your wall and instead of saying to yourself, oh my gosh, is that a monster?  You're just being very logical but also enjoying your life going forward because you take the time here. Because I do feel like someone's going to try to talk to you but I feel like in the present there's a heart to heart discussion of emotions and feelings but I just kind of feel like I don't know if you trust it when it comes in or if you need to seek more clarity or if you just kind of block or you just don't engage in that conversation, you might but there might be something about it that you just need to get clarity on first and I feel like you do get it. You do get it. Now the eight of wands, right? Somebody's coming in, nine of wands here. They're so stressed. I feel like this person is crazy attracted to you. You know they want that romantic loving relationship with you and they're having nightmares this person and I feel like for them they need to put a stop to this. They have like some grief going on here. You know this person's got a lot of anxiety maybe even a bit depressed and they just want to come towards you and you know really come towards you not just to have that conversation not just come in and tell you the truth because I do feel like they do come in with some truth for you. They do tell you the truth what they say to you.  Fearful that it will remain that way but I feel like this person is just going to come in and shock you and be like totally just really telling you how they feel what they want okay and the page of swords is back again this tower it's like boom it's boom it's a boom it's a boom coming out of the blue just comes out of the blue okay so be prepared Virgo let's get a couple of love messages to see what else Spirit wants you to know Virgo.  If this person has to block you and stop talking to you and you haven't been like crazy stalking them or being like a lunatic if they are just not talking to you it's because they have tremendously deep feelings for you and they just don't know what to say and they don't want you to reject them and I feel like you need to know that because if they're just truly your friend and everything's you know friends go through moments but if they're truly just your friend you know or like someone who doesn't really have deep feelings for you then there won't be a problem to block you and they won't need to not talk to you okay but you feel like they're doing it on purpose and they are they're being pretentious as if it's not bothering something's not bothering them but they do want to tell you how they feel about you well I'm so attracted to you Virgo for sure still that's right here they will wait for a sign from you but Virgo I think you're giving them a sign and your sign is that you're not chasing them down you're just leaving this person be and your thing is well when they're ready to talk to me they will and then we will talk and then you're going about your life smelling the flowers this person cannot stop thinking about you and yes I was saying that the Nine of Swords is here they're having nightmares these things are bubbling up to the surface or they will be um bubbling up to the surface memories I feel like I am different now so this person is definitely going through a dark night of the soul making changes the attraction you feel is mutual there is chemistry here for sure but it's been very difficult I know I made a mistake they would tell you and I feel like they're going to admit that to you that maybe pretending that you don't mean that much as it was a mistake right now firm boundaries are needed Virgo because I do feel like you have you know boundaries does not mean being cruel boundaries is kind of just like saying no thank you that does not make me feel comfortable you know it's just it's standing up for yourself standing your ground but not being cruel about it it's basically just saying I appreciate the offer but I don't feel comfortable doing that I'm just giving an example right it's not anything other than that it's just being true to yourself an external party is intruding on this relationship okay some of you do have some interference now an external party it doesn't say a person it could be if you know for a fact that that's your story for others it could be work it could be really just anything it doesn't have to be a person could be a place or a thing and that's just everything in the world you know this person maybe just binge watches Netflix too much and doesn't have time to talk to you or they work too much and that's a priority or there's children involved that takes up someone's time okay so there is some type of an interference but also there's acceptance everything happens for a reason and Virgo I feel like you need to know that what you're going through at this time with a particular person if there's someone in your life there's a reason and a purpose for all of this and you might be trying to discover that and you may find out going forward why you two came together sometimes sometimes it could be that they were there to teach you something but sometimes it could be that you were there to teach them something right so it's kind of like some of you Virgos just have this great insight and some of you really were brought together with this person to help them grow or to teach them things by way of your love and growth is growth is it can be difficult like going to the gym when you get a trainer you know they you really get excited about it because you know what's going to happen and how it's the outcome is going to be but the process of going through that is exhausting and you may get frustrated with your coach because are you teacher for whatever because they're putting you through a series of tests or you're going through a series of tests and no one said that it would be easy but you know there's no gain if there's no pain sometimes and you know it may not be because it's an absolute love relationship it could just be that there are some lessons here not just for you but for your person that you're both learning from one another however this is a love relationship and I do feel like it's this is like a snapshot of the process that you guys are going through you know I'm not seeing like major commitment here I'm just seeing that there needs to be a heart-to-heart conversation and you need to come to terms with is this what you want for your life when this communication comes out because I feel like you may have been fooling yourself in a lot of ways um that you do love this person but maybe now you're not sure if this is what you want long term with this person um I feel like your person may want this with you but there has to when that conversation comes I think you'll gain clarity um but with the eight of ones that do feel like they feel like they don't want to be without you permanently so we'll just see how the energy plays out tomorrow um sometimes the readings can be a continuation of the one before and other times they're just completely separate from everything all right so I hope you enjoyed all this Virgo and I will see you very soon make sure you hit like share and subscribe thank you bye


Survive the two minutes I guess. Also as a courtesy to everyone in here please turn off your cell phone and paging devices.  They're distracting. So please just if you can be courteous just turn them off. Thank you. Otherwise I'll have to get a cell phone jammer next year and I don't want to have to do that. Air Ideas. I have looked at no less than well let's look. There's network flight recorder. There's real secure. There's those horrible NT based ones from Raptor. I mean Raptor. Sorry. Accident technologies. They don't call them that for nothing. And they basically all have a problem. None of them are integrated.  And more often than that they, I regard an Ideas largely as a DOS against the operator. It's what you call a human denial of service. When you have a human being can only take in so much finite information. Well in Ideas I had the misfortune of looking at real secure and it has some nice features if you want to snoop people's IRC traffic. But the problem with it is it's noisy. In one day I got, just with a default set, I got 300 email messages. Do you know what I did? I created a filter that automatically sends them to the trash because I don't really care about all these things that aren't really happening or they're happening wrong or they're just dumb. It's like basically Ideas technology is like a virus scanner, but it only scans. It doesn't clean. It doesn't quarantine and it doesn't do anything. Who cares if you have a virus if you can't clean it? So anyways, this is why I, and a guy named Chris Cooth, a really, really, really sharp Canadian fellow who isn't here, he's the open BSD portion of this. I use open BSD. I am not a God in it so please forgive me if I might spell it wrong occasionally or you know I'm not a BSD God so please forgive me for that. Anyways, I'm going to begin now. A note of caution. Automated response systems can cause more problems than they solve. These things that I am presenting you are nothing more than guidelines. Denial of servicing yourself is very easy. Enemies more clever than yourself can make life most miserable. Nothing replaces vigilance, defense in depth, keeping the server's patch and being sneaky. Again, the reason I put this note of caution is because what I'm suggesting, I thought of it just today, was basically I'm giving the equivalent of SAMs. We now have radar, which is Ideas, but now you have SAMs which you can launch against incoming aircraft. But if suddenly your SAM thinks that your air traffic controller is a target, things are going to get in trouble. So this is just a note of caution that what I'm describing and the flexible response systems, which I will be describing in here, can cause more problems than they cure. So with that said, I'm going to continue. Don't say I didn't warn you. Deficiencies of typical Ideases. They do not adapt and consider multiple factors. They only respond with things like resets or blocks. They don't do anything. They just scream. And they do not automatically stop an intruder. One of the largest things I've heard here is automated attack. Well, why not automated defense? Or even better, automated defense. And if necessary, I don't advocate the use of offensive force, but flexible response I do advocate. And instead of just dropping a packet, what if suddenly I start logging, let the intruder think they've got in and reroute them dynamically to a honey pod. As they're attacking my IAS server. That's one kind of a dynamic response that you can do. Instead of just, oh, I'm reset packet. I mean, that just seems lame to me. I mean, with the AI technology that we have, with all the clever and really cool hacks I'm seeing, why can't we have clever responses? They're also expensive. An average IDS sensor will run you between $5,000 to $15,000 per sensor. Now, I don't mind making people like NFR rich. I don't have any problem against it. They have a reasonable project. At least it's not based on NT. But when I see that it's that much, and I say I want a place, I work in a trading environment, and we have, I think at last count, at least 14 different networks and on, like, 15 different vendors. And that's a lot of places where I'm going to place sensors. At $15,000 a sensor, we'll just use it. That's a lot of money.  They love spending it if there's equities and risk.  But ask them to spend $10,000 on a firewall product, and they, well, what's my ROI? And then you say, well, what makes you feel safe?  So, this is kind of, basically for the cost of a sensor, $400 with a cellarine, cellarine processor with a, if you want to really be fancy by yourself a $500 Intel Ether Express Pro with a four ports, so you can monitor up to four ports per sensor now. If you don't have enough CPU, well, that's a different question. But it's definitely an option. The signatures, which are the heart of all the IDSes today, with exception of anomaly-based, are not updated fast enough. I think I may be wrong in this, but as I, from a year ago when I was dealing with ISS, they updated quarterly, maybe, maybe more than that now, but it was, it was roughly quarterly. NFRs, I think, were a little better monthly. And I can't, I don't really know how real secure does it. I haven't actually looked at theirs. But even if it's a month, it's too long. All of a sudden, all these clever people here come out with, say, 17 variants on a new exploit for God forbid, IIS.   So, basically, because of the fact, and this is another limitation, is signature-based IDSes do not detect things that they don't have signatures for. So it's very nice to be able to have other people all over the net who are relatively intelligent writing signatures. You're also locked into a closed and expensive solution. If I, I mean, some of them do have languages, but like for instance, the NFR, the key exchange is absolutely a nightmare. They use 56-bit DES, and the keys never change ever. It's a shared secret between the client and the server. And it's not even public key. It's not even like 128 bit, because, well, we couldn't figure out how to get the license export or whatever. And I don't like that. I don't like being boxed in. I like having flexibility. I like being able to be sneaky. And a lot of times, it's very difficult to be sneaky with a lot of these commercial vendors. Now, they do have their place. I very much feel that if you're in a Fortune 500 or trading firm or financial firm like I am, you probably need both simply because the people upstairs really like to spend money in some senses, which is counteractive to what I said. But you have your one $15,000 sensor and your 30 Snort sensors. And so they kind of think that, oh, you're guarding the gates with a wheel and really when Snort's doing the work in the background. Not that they know that, of course. It's also harder to be clever and integrate data across multiple sources. All of the IDSs have woeful user interfaces. One of the gentlemen yesterday was talking about horrible user interfaces. Well, IDSs have everybody beat. I've never seen any of them with decent user interfaces, especially the alert screens. There's too many of them too quickly for a human to absorb.  And I don't like to see 7,000 alerts paging by me at, you know, 2,400 bot even. It's too fast. So anyway, here's my philosophy for our IDS. Basically, an intrusion detection system should be able to intelligently respond to data from a variety of sources, hosts, networks, multiple points of view. In other words, for instance, from the point of view outside the firewall, point of view on the DMZ on the firewall, point of view on my people going out to the firewall. Because for those of you that NAT, you know that telling what traffic is coming out as it's knatted behind a firewall makes finding out who's really downloading all those Napster files very difficult. Also, there's hosts. Basically, the hosts are really important because network traffic by itself doesn't allow you to correlate. Whereas with host stuff, I'm talking things like you have an NT host running Tripwire with a syslog monitor with auditing, reporting to backlog or there's 101 of those things for NT. And this is the sneaky part and I don't really mentioned here. You actually construct because you have an IDS, you send the port 540 to nowhere. But of course, you reconstruct it on the IDS because you're listening to UDP port 540 bound for a non-existent IP address for any of you that want to be sneaky with syslog.  He doesn't have any syslog server, but yes, he does. You just don't know he does. Anyways, routing and switching gear. Anyways, those are just some of the sources.  I'm trying to be all inclusive. Am I speaking loud enough? How is this? Okay, I'll speak loudly from now on. Continued on the philosophy. Air IDS should never denial of service and its own network. Denial of servicing is a very bad thing, especially when you're doing it to yourself. And IDS should be mostly open components. I said that because I don't really know what license I'm wanting to go with. GPL is really nice and then there's open BSD and there's all these silly licenses and I don't really know which one. But I want to be mostly open because that way people can work on it and realize that they're not going to make me rich. I mean, that's not the object of this project. The object of this project is to provide a community-based IDS that doesn't suck. I mean, that's basically what this whole... So anyways, that is the project goal. You can tweak it because it's open source. You've got the source code. You've got the license. And documentation is another thing. I'm going to make sure that the documentation is damn good because I hate it when you download these things and it says compile it this way and you do and it doesn't work. I mean, that is frustrating. If you write documents, write them correctly or don't write them and let them figure it out for themselves so they're not fooled into thinking that your documentation actually works. You can use it in ways the original authors never imagined. There are things that you can do with Snort and Pearl and PHP and SSH and all these open things and you can combine them in a system that is far greater than the original intent of any of their authors. I mean, using SSH to write dynamic firewall rules is not something I've heard of. I've heard of it being done on the host, but not being done from a central command processor, which I'll get into. And finally, it's cheap.  I don't care what anybody says. You're going to have to know what your traffic is.  And everyone talks about that, but no one really stresses. Tuning will take you a quarter. I mean, if you're on a relatively large network monitoring anywhere from three to six network points, you're talking a lot of time. I did a complete network evaluation of just six network segments. It took me a month because you're going through raw packet data. You're looking at stuff. You're having to talk to programmers. Why are you using port 56789 through 60,000 for your application? I mean, and you have to, oh, well, I also use 12345 and 678910. I mean, there's these human factors that you have to throw into the mix. You just can't go to the protocol analyzer and say, we use all these ports and not know who they are and be able to intelligently look at what they are. So I do want to really, really, really stress the human factors involved in this system are probably the most important. Technologically, it's kind of a neat idea, but the human factors are the singularly most important because, like I said, if you've got developers working on programs and you don't know what they do and it's like, oh, my God, why are they opening 50,000 connections per second? Well, we're getting quotes from AT. I mean, there's those kinds of things that you have to know about your network. So anyways, I'm going to continue. And IDS should not annoy. When I get an alert from my IDS at 3 in the morning, it had better well be an alert. I don't want to get woken up at 3 in the morning to know that some idiot's trying to run the newest IIS exploit on me. I patched it, have a nice day. And IDS should be completely out of band so it is undetectable. Now, I will admit I have not researched into the implications of using a bridging sensor. I'm sure that they're detectable. I'm not saying they're not. But to your average attacker on the outside, the only way I know of, and please correct me, the only way I know of to detect a bridging sensor would be latency. Because it's just sending them along. I mean, because it's a layer two device. It's open BSD. So as far as I know, I actually did some measurements. And the only way I could tell by looking at the packet was that there was a tenth of a millisecond delay between the time that it got between the two interfaces. So it's kind of hard to detect. The management portion of it, I like to have out of band because a lot of times there are flaws. No matter what you do, you probably will make a mistake. So if the IDS's management console and all of the components are located on a completely out of band network, there is no way that anyone, or it's very difficult, for anyone to get in and hack your IDS and look at all the beautiful signatures. It's less convenient for the admins, but so what? They get off their butts and they walk to the server room or you patch it into your cubicle and do it that way. At least it's somewhat more secure. When they cut across? Well, that's the advantage of using bridging, because there's no IP. I mean, yes, there's certainly, there certainly are things they can do to make your active response act against you. That kind of attack is quite possible, but the sensor itself doesn't have an IP on either side. I mean, there are certainly certain kinds, you could probably try to denial of service it and whatnot, but there are other preventative measures that we can take to minimize and limit that. IDS should have at most one or two decision-making points. Now you do start running into a problem with this in terms of performance, if you're monitoring large amounts of networks using, essentially I'm advocating the use of a centralized SQL database on one computer with probably four or five processors on a really big network, simply because it's less places for things to go wrong. It's less places for attack. If you keep some of the componentry down, it's simplicity, so you want to keep it as simple as possible and yet at the same time maintain the flexible response. So it's a very important to have one or two decision-making points. And IDS should work in conjunction with other protection systems. Firewalls, the host themselves, and routers. They should be able to dynamically talk to these components and, if necessary, take action based on the input of multiple sources. And again, I'm trying to advocate as a union of all these technologies that everyone says, like one people say network-based, one people say host-based, I say both in conjunction because neither of them by themselves is sufficient. And IDS's evidence should be admissible in court.  They're on alterable media. Those packets have been written and logged to those things. And all the raw packets should be available. The problem with basically any of the sensors is you don't have the raw data.  So you can say, okay, here's the raw data. And, you know, here's what the conclusions we can do and you can actually look at the raw data. So having a packet vault is a very important thing. And IDS should be OS agnostic. That means it doesn't matter what OS. It has to work on all of them. I mean, not necessarily the sensors or not necessarily the actual hardware that runs it because I just can't really advocate running most of these things on Windows. It's just too scary. I mean, it's, I just, I can't. I mean, I'm just, I was, I was trying to secure it. This is a brief aside. I was trying to secure an IIS server.  There is nothing I can do. It runs as a local system. So if there's any new problems, it's got root. So just put a reverse proxy in front of it and be done with it. I mean, that's really the only way I know how to secure IIS.  And of course you get rid of no ops too that way.  I'm quite proud. But I could not stop IIS because a lot of the kids coming out of college today dare I say use Microsoft Foundation classes and Visual Basic for their programming and lots of these people will be hired because A, they're cheap and B, the only thing they know is Microsoft. And so weaning those people from the the that process is kind of hard.  Just think of it that way. Microsoft is so insecure that we will always have a job. Anyways. And yes, I know I just, I'm not being OS agnostic. Oh well. The IDS is, yes. And IDS should allow the analysis and analyst the flexibility of looking at past data. This is the snort portion of it. I haven't really talked, I'm not really going to get into the specifics of using snort and acid and all these other things. But those are some of the, all this is at this point, the only thing that's real is the flexible, is the ability to have a command processor respond to input from a snort sensor. And the concept of a bridging sensor. Most people just have sensors. This is why I have a sensor when you have bridging code. So not only is my sensor a sensor, it's a firewall. So I happen to be running checkpoint and there's the new horrible RDP attack. My sensor basically, I can put the firewall rule block all RDP from the outside. My checkpoint never sees it and I don't have to worry about patching and causing my network to crash. Because I'm sure you've all had upgrade fun anyway. Components of RDS. This is actually, can someone tell me in an hour, because I'm just going to kind of take a five minute break for everybody, because a lot of times you go on with these two hour presentations and you know you get kind of bored. So I'm going to take a five minute break after the hour mark, and then I will begin immediately after the five minute break though. So if you're thinking of leaving or whatever, you'll need to be back here then. Anyways, so the components of RDS. These stealth sensors, they are bridging firewalls with open BSD and to be correct, we use the, it's PF rather than the other one because of that licensing thing. I still haven't figured that out, but anyways, the centralized data gatherer, the sensors and host report to this. Typically this is going to be an industry standard database, whether it be my SQL or Postgres. Problem with my SQL is if you have a lot of data coming in, it doesn't do transaction queuing. And so you're just going to be in trouble, because my SQL will just choke. Because it does blocking IO when you start getting multiple data sources. So you've got 17 snort sensors reporting to one database, and all of a sudden, my SQL just can't handle it. So at this point, it's just a database, I'm not going to say which, but a database which can handle transaction queuing and can do threads, because you're going to have to do threads in order to keep up with the speed of the network. And I'm not even talking about gigabit. I mean, anyways, a historical comparison module. This is what I regarded as an anti-annoyance feature. If you have a site saying, well, let's not say China, because everybody said China today. Let's say Russia.  Well, I see this and I say, you know, there's about five or six IPs and I verify them, because you really don't want to react based on historical stuff, because machines do exactly what you tell them, and if they see a particular host six times denial of service, well, we all know what spoofing is, don't we? Anyways, so the historical comparison module is more for a human to look at. Say, are these hosts repetitive offenders? Are they doing port scans? Are they doing what I consider to be hostile traffic? I'm very much an advocate of what I call geographic profiling. If a particular geography is causing you problems and you have no business have to be receiving web traffic. For instance, I work in a Chicago-based trading firm. There's no way that anyone from China should be looking at my website. I'm sorry. We were proprietary markets. There's no business reason for me to be even accepting any traffic, except maybe email, and even that questionable from these hostile sites. I recently saw a lot of the these HTTP scans from the from the Beijing and other areas, and I just got tired of it, so I just said 209.star.star.star. Block! And all my ports can't stop, so anyways. Yes, I know it's racial, but sorry. Anyways. The command rules processor for active filtering. This is probably the most complex part of the whole thing. It's a separate module which would have to use an expert-based system to make intelligent decisions. You just can't have something if I regular expression this signature do that. You can do that, but you're going to have some very dangerous rules if you do. So what I'm proposing, I don't have yet. I've got a couple people hopefully in the audience who are really good at expert system stuff. I need a database and what we can call a response library. We have not only a database of hostile actions, but a response library that can talk to the other modules so that it reacts intelligently to threats, intelligently and automatically. And with all the processor power that we have these days, why not have a really big expert system? I mean you, with a gigahertz panium costing less than $500, there's no excuse not to. So anyways, this command rules processor, what it does fundamentally is it takes the input, consults with the expert system, and decides what it should do. For instance, I am running a trading firm. I start seeing HTTP scans and hostile IS activity from site X. I'm running Tripwire at the same time.  And basically all of a sudden, so I see this traffic and then on the host, the trading application binary is suddenly modified. Now this is probably a bad thing. It means that my trades are no longer trustworthy. So that warrants an immediate response.  It doesn't matter where it's from. The reason why is because it is such a catastrophic condition, it is better to stop the trading than it is to go on trading with unknown data. And again, it depends on the site policy. This is where the human factors come in. You have to know what an unacceptable condition is and oh, be sure to translate that to your manager. Say, if this happens, we will lose connectivity. Or if this happens, this will happen. You have to be very clear in the policies and written procedures that you have in your organization. Again, if you're just doing it for yourself, don't worry. But if you're in a Fortune 100 or banking or clearing corporations like I've been in, if you suddenly stop service and you're clearing a billion dollars a day, you don't have a job very long. So you do have to bear these things in mind. The command processor essentially uses SSH to talk to the sensor on an out-of-band network. Now you say, why do you bother? Well, we all know about the problems with SSH. I mean, it's certainly better than Telnet. But even with version two, there are problems. If it's out of band, well, first of all, I've got an encrypted transmission, which is good. But now it's an out-of-band encrypted transmission. So then an attacker through the internet, I will say that, through the internet or an outside or even inside without physical access to my out-of-band network, cannot subvert the system. Now it is relying on physical security of the boxes. Obviously, you don't want to leave it out in your kiosk area. But anyways, what it does is it sends an SSH command, you know, pf, block in, source my web server, if it sees that event, and then send out a page. That is one example of a kind of response that the command processor could do. Another kind of response that you could do would be, say, I see, I just see suspicious web traffic, you know, like, why are they doing 100 million dollar trades when all we do are, you know, like, four lots and eight lots, you know, of trades.  And then what you do is you start recording those packets to your worm drive or something there. And in case there's fraud, and we have SEC unfortunately, we're trading, so we have to worry about that, we can admit that, and if necessary, convict this person based on the packet vault. So you can do more intelligent, and you want the raw packet data again because it's the raw most form of the data. It's not been distilled, it's not been altered, and in a court of law, as far as I can understand, it's the raw data that's probably more important, although the distilled data is very important, but the raw data is a vital aspect of this. The anti-shoot ourselves in the foot module contains hosts not to block.  If I start seeing hostile traffic from a partner, scream, but don't block them, and notify the partner, maybe send a message to the sysadmin at the remote site saying, by the way, it looks like I'm receiving port scans from your IP, can you check to make sure you haven't been hacked? And I wouldn't have to do anything, the whole system would do it for me, and that's what I'm talking about with flexible and intelligent response. It doesn't denial of service my partners, or my web server can talk to my DNS server, oh my god, port scan from DNS, block, end of game. I mean, you don't do DNS anymore, and anyways. Finally, the last one's kind of a pipe dream, I just threw this in, that did a heuristic or learning mode to make configuration easier. It'd be kind of nice if you could just have like you'd fill out these little questionnaires about your network, and it could come up with a fairly basic set of rules that would actually be applied, because most people are not going to have the expertise to go with TCP dump on their networks and do things. So kind of like those silly wizards you see that ask you things, and to kind of to some degree have a very limited response system. Like what is your web server, what is your DNS server, who are your partners, and if I see an attack from one of these, what do you want me to do? That kind of a heuristic, it's not really heuristic, but the learning mode I was thinking of, if every review is mason, it dynamically watches the traffic and then just automatically generates rules based on that. It's very dangerous, but very convenient. So it's just kind of it's just kind of a thought. I don't really know what to do with it, but anyways. This DELS sensor, it's a transparent, bridging approached, is used. This allows for undetectable monitoring. Well, relatively undetectable. I'll say that because I'm not an expert on bridging transparent firewalls, but it should be relatively undetectable. Traffic flows can be stopped because it's also a firewall redirected or even reflected back in an attacker. I don't know, I kind of like the new the new, this is a Linux plug. I kind of like the, we reflect attack, the mirror target on the new IP tables is kind of cool, but anyways. Finally, it makes it difficult to attack the IDS itself. It's bridging. I would love to see some attacks on bridging IDS's that would be very interesting paper. I haven't seen any to date. I've seen nothing that really, that talks about it other than denial of servicing them.  Again, if the rules are improperly made, an attacker can send packets at you knowing that you have the system in place and really make life miserable. The sensors have three interfaces. One for management and two for bridging. Ether Express and Nix. I've heard a lot of banter about which one's the best. I personally use three comms, but I have noticed high CPU utilization. You probably, the Ether Express, Chris basically recommended them. My friend who's a Cisco person said he saw like five times the throughput on the new ones. You don't go with the old ones, but the new ones. So anyways, and as you know, CPU utilization and bust mastering and all these other things are quite important on an IDS. Sensors should be based on a reliable and secure operating system. OpenBSD, as far as I know, is one of the more secure operating systems on the planet. I will preface that. Mainframes are more secure, but anyways, they are. It takes 30 minutes to enter a user. Anyways, 26 transaction codes before you can even log in. OpenBSD is relatively easy to set up due to its minimalist philosophy and secure design. For me to go through the package selection on Susie or any of the Linuxes, it takes the better part of an hour and a half to two hours because there's 4,000 packages in Susie alone. And I think in the New Mandrake there's like 3,500.  So you have to go through every package and so anyways, BSD is just install it default, turn off the, you know, they for some reason they leave RPC open is turn off the RPC and it's pretty much done. OpenBSD, Snort, Acid and the database work. The rest is going to be a project. Anyways, let's continue. The, anyways, let me continue. For those of you that who are here, this is a theoretical talk. I do have some practical application, but unfortunately, I'm not a programmer. I'm okay at network stuff but I'm not an expert. And so what I'm trying to do is I'm trying to get together, like I said, a community-based project where we can get all these different people with different expertises for a non-profit because if it's a profit, it's just everyone becomes selfish and then suddenly it just doesn't work.  I mean that, that is really what the vision of this project is. And so at the end, there's all kinds of resources and I will continue with that. Yes.  You can rewrite the packets in transit between bridge one to bridge two. Anything you want. That's the whole point. Use dev random, I don't know. Oh, sorry. The question was is if you don't have a IP address, how do you rewrite packets? Headers. And I basically said, well, you rewrite the source address and destination address any way you want because it's PF. You know, it's, it's a low level. You've got raw sockets. That's the whole advantage of the OS. You write any source or whatever. I mean, write in Muser's own source address if you want to be nasty. Anyways, sensors, sensor descriptions. Sensors communicate relevant traffic via out of band network to reporting module. Sensors can receive commands via SSH version two. Version one is hopelessly flawed. I don't recommend using it unless you have no choice. It's better than Talnet but avoid one if you can. If you do use it, turn on compression. At least it makes finding the passwords a little harder. Sensors can dynamically block, allow, ignore, reflect, or redirect or log traffic. I didn't put that in there. Sensors can also send out syslog, basically the covert channel thing I talked about where you, you just have all your hosts on the DMZ basically sending to a mythical syslog server but you're actually recording the syslog traffic as it, as it comes in and reconstructing it based on that. It's, it's for the event logging in for some of the host based stuff that you need. Sensors will send data to an industry standard SQL server. And one thing I should put in there, sensors will send data in a standardized format. Or at least there'll be some kind of a, because it, I, originally was just going to use snort but then I thought well why don't we use all these other ideas as too? And so just basically somehow parse their alerts into a one to one equivalence so that you get some kind of a standardized database among all the different date of all the different vendors. I, obviously this is a huge task but it's a nice idea. Data will be encrypted.  So, let us use Zebedee. It's a very nice blowfish encryption. It works on windows. It works on Unix. It stands for Z, Zlib compression blowfish encryption. And it's really fast and it's much faster than SSH. It supports keys between servers and so basically you send your database connection through an encrypted Zebedee tunnel to the sensor. So, you don't have to but for the truly paranoid it's there. Centralized information repository description. The host is hardened. Basically, you know, you've done the sensible things taking out unnecessary services, no compilers, etc. Runs a journaling file system. The nice thing about journaling file systems is if you turn off the power, you don't lose your database. Well, guess what we have? We have a very large database and they don't take kindly to power outages and to be honest, I really, the XT2 kind of scares me with databases because it's fast but it's just kind of squirrely at times. So, I personally use a Susie with Ryzer. Some people say it's unreliable. I've been running it for a year and a half now and haven't lost a single file on 100 gigabyte file system. So, it's pretty reasonable. It's on a UPS and obviously has the UPS connector connected to it. So, if you lose power, it shuts itself down gracefully. Now, this means that if you have a server, you make sure that you buy yourself a little 400, you know, APC 400 and it runs your server for two minutes. That's silly. Buy yourself a big APC and then your database can take as long as an hour to shut down if it's Oracle, God forbid. And so, you need to make sure that when you get a UPS, you get one that's big enough for the wattage. Look at the wattage or the ratings and do a test. You know, before you have all your important data on it, to unplug it and see how long it lasts under load.  You know, there's all kinds of all these other factors in them. It's regularly backed up. When I say it, the only thing I really refer to is the database. If you're using my SQL, it's really easy, shut down the database and tar up the directory. With other types of databases, it's a little more complicated. And to be honest, I'm not really a database guru, so I don't know. Figure it out. It's on an out of band network again. It doesn't have to be, but I recommend that it is just because of the fact that it's such vital information. And from a privacy standpoint, when you're talking about deploying a system like an IDS, especially in universities, or you're recording all the traffic. And not only that, but you have a permanent record of all the traffic. The privacy concerns of protecting that kind of information are huge.  I've seen people fired. I've actually had to have people fired as a result of sensor traffic. I mean, and it's a really hard thing to do.    I mean, it's just, it's just unpleasant. And I just, like I said, so it has to be, I think, just because of the fact that it's repositorying all the information, it has to be on an out-of-band network. It doesn't have to be, but again, because of the ethical concerns in the kinds of data that we're collecting, I think it's in your best interest to do that. Currently, the only OS that does most of this out of the box is Susie Linux. Mandrake will do it. I don't know if there is a journaling file system for BSD out of the box. If there is, great. Slackware? Okay. Well, thank you. I haven't used Slackware since 92, so please excuse me. Yeah, and Dead Rat, I just, it's better in the 7.1, but it unfortunately, I just don't like the way they do things.  So that's just me. Now you were saying, you're worried about a journaling file system, but you're recommending RAID 0. Well, that's why we have backups. RAID 0, I'm sure you're all Uber hackers, but just in case there aren't any, RAID 0 means you stripe the disk across two, so you have basically twice the speed, but half the reliability. Because if either of the disks go bad, you lose everything. But you have a really fast disk. For less than $400, I can have a 160 gigabyte disk, which will do 50 megs a second on an IDE channel. Mind you, that's IDE. That's not SCSI. We're not talking Ultra-166 or Sun hardware or 64-bit PCI.  That's a lot of bandwidth. You're almost saturating the bus at that point. Basically, the central, as a host-based firewall, in the case of Linux, you would be using, I would recommend IP chains until IP table stabilizes, but IP tables is really nice because you could do MAC address checking. You do MAC address checking. You can do all kinds of flexible response. And basically, what it says is, even though you're an autoband network, only these hosts can connect to me. So even if they get physical access or tap into the line because you're not using fiber, because most of us can't afford the fiber cards to our desktop. Anyways, so basically a host-based firewall, it doesn't change. It's just, these things can connect to me on these ports and whatever. Sensors and syslog reconstruction occurs on this host. Basically, the syslog input is fed directly to this host and in parallel to the system, I just like to do a tail on the text file for any immediate responses that need, you know, right now, this is just one event that doesn't need to be correlated, that's catastrophic or needs to be responded to. It just gives you a really nice way to write a quick and dirty proscript to send an emergency rule out to a sensor firewall if you need to. Again, basically a talk to the central command processor stores all the data, syslog, IDS data, host alerts, and TCP dumps of all, I would say not all data, but all relevant data. Obviously, if you're not doing certain kinds of things, you don't need to monitor everything, but figure out what you need in your policy and dump that to raw packets. The historical comparison module, it talks to the centralized information repository, checks to make sure that all the data coming forward, it looks for repeat offenders, and it checks for port scan repetitions from hosts. It's largely from nuisance users or hosts. It can also be used to detect stealth port scans. Again, imagine a database that you never erase.  I mean, that's, that's very powerful, especially if you start getting the data mining. The command rules processor. Again, this is the heart of the IDS. It dynamically adjusts the rules based on attacks in real time. It doesn't do dumb things because of the anti-shoot ourselves in the foot module. It sends rule changes via an encrypted channel to the sensor. It constantly communicates with the centralized information repository, and it can interact with firewalls. This last part is, is if a lot of the commercial firewalls checkpoint, sunscreen, ANS interlock, if anyone has used that firewall. It's like we in the past anyways. Basically have scripts that you can dynamically add rules. So you can actually, on your main firewall, do things. And again, it's just thrown in as kind of a, it's, it's an integration feature that you can actually do with your firewall. Of course, it requires command line facilities on the firewall to work. Command rule processor continued. It is able to react to network event and host events. Compares and correlates the results from multiple sensors to see if sophisticated attack is taking place, and it contains a flexible response. In other words, if certain conditions are critical, cut off all access, if only non-critical, perhaps, page or log all of the suspicious packets from the hosts. How am I doing for time? Okay. Thank you. The, again, the command rule processor, it can block problematic hosts via historical module. Basically, these are ones that are not in the anti-shoot ourselves in the foot module. So I will not be blocking my DNS server. Can actually tell what is happening on the host itself. I like Tripwire because combined with a lot of other techniques, it can, it can tell you if a file is changed. Now the problem with Tripwire is if an attacker gets in and modifies or gets rid of the Tripwire process, obviously you're out of luck. But a lot of times if you're sneaky and rename the Tripwire executable write.exe, I mean, a lot of people probably are not going to figure out that you have Tripwire. I mean, and you can actually move things to non-default locations. Now, granted it's security through obscurity, but everything that you can do to slow down your attacker gives you more time to defend. And that's what they'll game is, is basically is to increase the amount of expense, time and effort to get into your systems. The, can actually, and again, Unix Syslog, I kind of like Syslog. A lot of people say it's bad. It's so universal. And as long as you do it out of band, people aren't going to denial of service you. It's harder anyway.  You can use things like Syslog next generation, but I find that it's kind of buggy and like it has memory leaks and it's gotten better. You know, the cryptographic check sums are very helpful, but again, if they've compromised your host, they probably have access to your keys anyway. So why worry? Custom alerts. Again, there's different kinds of ways to be alerted. There's like Snort has the SMB server message box for your Windows users. There's pagers. There's, you know, there's all kinds of different ways. This is kind of an interesting thing. I just thought of it's kind of a random thought, but instead of representing a host as something impersonal, like I have a picture of something like a person and say that someone denial of service is your web server.  I mean, it would be, it would be kind of a very graphical way to show a manager what's going on because managers don't understand this. They don't. So anyways, it's the use of a, of a custom alert system such as that. The command rules processor can take corrective action based upon a host as well as network inputs. On the open source network components that I'm using today, Snort, SSH, Zebedee, Pearl, or whatever scripting language of your choice, for those who have other ones. Did you want to take a break now or do you want to keep going? Okay, we'll break for five minutes then. It's already posted. It's already posted. Are you going to get it? Yeah, at the end. Yes. Yeah. Basically, the next module is the anti-shoot ourselves in the foot module. Contains lists of hosts that should never be blocked. Contains trust relationships. I don't like trust relationships, but they're a fact of life, unfortunately. So if we have trusted partners, we at least don't denial of service them or block them. Contains knowledge about our network, what services should


The history of South Africa would not be complete without the mention of the Zulu tribe, governed by a fighting spirit which has produced renowned warriors like Pambatagamanginza, who led a rebellion against the Poltex and Shagazun, who played a prominent role in the Zulu wars and united the nation. Dance has always played a central role in celebrating their achievement and a variety of traditions that have been passed down through generations. In Langu, a war dance performed on weddings, crowning of kings, when a child is born and when war is won, signals happiness, unites Africans, and signals victory. It is a war dance that demonstrates the mighty fighting human spirit. Over the past two years the world has been fighting a deadly virus but today we stand strong as nations, as weak media communities, through the valleys and mountains, through the streams and ocean, having beaten the monster we have overcome and we can't wait to tell yet another story for generations to come. Capsulated in the spirit of Islam, the Zulu war dance which originates in South Africa, a dance that brings resilience during the times of hardships and pain. This is a celebration that is a legacy of creators for all those which are open and free knowledge. It is a call for volunteers to a safe space that is mainly performed to the drum beats of preserving knowledge through diversity, collaboration, and advocacy. Rise, weak median, rise. We celebrate your conquering spirit which has kept you going for more than two decades. Welcome to Wikimaniya 2022, the festival edition.


In this presentation, we're going to record a transaction related to net assets being released from restriction.  Here we are in our not-for-profit organization dashboard. We're going to be jumping over to Excel to see what our objective will be. We're currently in the tab 10, last tab on the worksheet. You'll recall in prior presentations, we've been entering data basically in a journal entry format recording that information to the trial balance. In the trial balance, you'll see that we don't have those two columns as we do have in the statement of activities and therefore we had to break things out such as the expenses down here and they're in there by nature, how we would normally see expenses in the expense categories that you would typically think of with regard to expenses, rent, salaries and so on and so forth. You'll recall we made another worksheet breaking it out by both nature and by their function. If we were to do that in a trial balance worksheet and we won't go through the process because the accounting software will help us to do that, that's what the functions will help us to do, but if we were trying to see this in a worksheet such as this and build the reports in Excel, a two-dimensional kind of worksheet, we would have to take then these expenses. For example, I took these ending balances over here and then pulled them into our beginning balances in this worksheet down below and starting in cell P35 and then we took this information and then recategorized with this journal entry. You can analyze this worksheet if you so choose, I'll give it to you here, but we took it out of the expense items that were by nature and then allocated them out to the expense items by function, including the two programs and the management in general. Now we're going to be down here and working with the second trial balance to do the next transaction we're going to be thinking about here. This trial balance, now this is a way that we can see once again a trial balance breaking out expenses by nature up top and a trial balance breaking out by function on the expenses down below. We're going to record this item to this second trial balance. Now the next thing that happens is we're going to say that some items were released from restrictions and we're going to say that the released item from restriction was for the government grant items, which we spent money on, we're going to spend money on education. So given the fact that we're spending money on education, that's going to release money from a restriction because now we've complied with that restriction, we're going to release the money. So anytime we can spend money or anytime we do spend money in such a way that it's going to comply with some kind of restriction that is in place, our assumption is then that we spent the money out of that money so that we can release the restriction. In other words, our goal as the not-for-profit organization is of course to release the money from restriction whenever possible so we could spend the money in whatever way we see fit as much as possible within the confines of our objective, which is generally the programs that we need to have. So we've got to release it from restriction. Now to do that in this two-dimensional kind of a field, we're going to say we spent $128,504 in something that's going to be able to release money from restrictions and we're going to use two accounts that look very similar, very long names here. Fit assets released satisfaction of purpose restriction without donor restrictions, same name with donor restrictions. You can think of these like as I would think of them as like income accounts and income goes up with a credit balance. So the one that has no restriction is now going up, the one without restriction because we're releasing it from restriction so we're crediting it, increasing it for an income account perspective or decreasing an expense, in other words decreasing net income or increasing net income and then on the other side we're going to say the one that was restricted with restriction is going to be going down if you're thinking about an income account or you could think of it as an expense kind of account. In other words net income is going to be going down from this one so increase in this one, decrease in this one, no net effect on our net income from a total perspective so no net effect here but when we break it out to our two columns it'll be broken out within the two columns in the statement of activities. So when we see this in a trial balance format we need two accounts to represent it so that we can then use the trial balance to construct the statement of activities but when we see it in the statement of activities then we can break it out and you'll see here we've got this net assets released from restriction satisfaction of purpose and the one without donor restrictions unrestricted that the good one that we don't want restrictions is going up on the income side and the one that has donor restrictions is going down so the donor restricted items are going to be decreasing and so we're going to record this in the current period and of course these net incomes or the total the change in the net assets is going to be then rolling over to the equity section basically on the balance sheet statement of position. So that's going to be our trend now note here also that we really only need one account if you if you have this breakout now obviously we're going to be breaking this out in our system in zero by using the classification function so really we only need one account and then to assign them to their proper classes I'm still going to make two accounts however because I like that kind of balancing method because that helps us to gives me like a double check on it so I would still create two accounts and you can group them together using zeros formatting for formatting purposes if you so choose with the really flexible reporting functions they have okay so let's go over and see how are we going to do this within zero so I'm going to go back on over to zero and then we're going to do this with a journal entry so we can do it here with a journal entry so I'm going to select the accounting drop down we're going to go into our reports and again I'm looking in the reports not for an actual report but I'm looking to get to the journal entry so I can enter some debits and credits here we're going to go down to the general journal we're going to say add new journals so we're going to be adding a new journal which is basically a journal entry debits and credits and we're going to say that this is going to be I'll just call it release from restrict John and this is going to be education government grant and then we're going to say the date on this thing let's just put it as if the somewhere closely in the year here I won't look up the date we'll make it as of January into the month here somewhere close I'll pick at the 30th doesn't necessarily this isn't an adjusting entry necessarily here so this is could be any time in the month there's no alright and then we're going to go down so that populates down here that looks good now of course we're going to need a new account here so we're going to need a new account and we're going to say the one that was released without doing a restriction so I'll make this account name something similar to that I'll shorten it up once we get here but we're going to have to make a new account and it's going to be some kind of income I'm going to put it on the income side of things so we want to make it somewhere in the revenue or income or sales area so here let's put it let's put it under the service it should be on the bottom probably so let's make it 4 3 5 0 4 3 5 0 so I'm going to go back up top and say I want to make a new one and I'm going to make the code to be 4 3 5 0 the account type sales type of account let's make it a sales type of account scrolling down sales type of account and then I'll put that huge name here and I'm going to say really I wanted to be net assets released and let's just say net assets released and then say this is going to be the restricted because this is going to be the debit one that's restricted and then the unrestricted is a credit so I think that's what we need I think that's it so I'm going to say say well let's just copy this whole thing now because I'm going to do this again except the next one's going to be unrestricted so I'm going to say copy that and then save and then on the next one let's put the next one in there while I'm thinking about it this one's going to be another account like we could put it in a same account net assets released and then again use the classes but I'm going to make two accounts just just we I mentioned that before I won't say it again and then I'm going to say the drop down and we're going to go to new account and this one's going to be the number is going to be four three five two let's say so I'm going to say new account number four three five two and then the name is going to be that but then I'm going to say it's unrestricted unrestricted and then the type is going to be a sales type of account and then that looks good so I think that's good I'm going to save that so there we have that and then once we go into the restricted and unrestricted I'm going to say that this one is going to be this is going to be the well the debit's actually the restricted one this one's the restricted one and I'm going to put it into the government grants for the education so it's going to actually come out of there because it's a debit it's going to be decreasing that item and then the amount was four see the amount was four one two eight five oh four so we're going to say the amount one two two eight five oh four and then the unrestricted I'm going to put all the unrestricted into the fundraising when it's the income on the income side of things I'm just going to put it into unrestricted fund rate one two eight five oh four so alright so there we have it that looks good that looks good everything looks good okay let's go on down and post this check it out so we'll post this out and then we're going to go into our reports and see what has happened with it so then we're going to go up top and go to the accounting drop down let's take a look at our income statement let's look at all all four of these income statement type reports so let's open up the income statement and there we have it then I'm going to right click on this tab duplicate it then I'm going to go back to the tab to the left and let's open up our income statement worksheet so I'm going to hit the drop down though these are the ones that we made so we made these in prior presentations it was good times if you missed those you can go back in and and check those out so we're going to look at the income statement worksheet and then I'm going to duplicate this tab once it pulls up again I'm going to hover up on the on the tab up top right click on it duplicate it then go back to the tab to the left again we'll do this again we'll hit the accounting drop down we're going to go to the restricted items worksheet it's going to the restricted items worksheet again another altered income statement for the restricted items we'll see how all these tie together as we go practicing that process right click it on the tab up top again duplicate in the tab going back to the tab to the left accounting drop down so we'll go to the accounting drop down then we want the unrestricted worksheet unrestricted worksheet so there we have it so we in income statement the income statement worksheet the restricted items and then the unrestricted items okay let's go back to the tab to the right here's the actual income statement so if we go down to the income statement our new items are here just as we saw in the worksheet we see one going up and one going down notice their income type of accounts if you got the debits and credits wrong then you know obviously just you could just reverse it right here here you see it in the plus and minus format where the unrestricted item is going up from an income perspective restricted going down no net effect down here no net effect we're just showing that that release from the restriction that's going to flow through basically the total equity section so okay so then we're going to go then to the worksheet let's go to the second tab to our worksheet and here we see it broken out with regards to the unrestricted so the unrestricted is now decreasing and we don't see the item on the restricted side yes we do what am I talking about here so we've got the unrestricted here so 128504 is increasing on the unrestricted because they it came out of the restriction is now it's now unrestricted and reducing the restricted side so this little worksheet up to the total column is going to be similar to our statement of activities which is now breaking this information out in this format again note that we could have just used one account called released from restrictions right instead of using two accounts here but the two accounts gives us kind of that double check that it's going to be that's going to be deleting out now also note that if you wanted to see this in one account you could then for external reporting purposes again if we wanted to make an external report you can edit your report and I would make an internal and external so this is something we might do when we get to the editing of the external reports but if I then hold down control and I'm shifting I'm going down so we can see our activity and if we went to the restricted and unrestricted if I was to take this one and hold down control and take both of those and then say I want to group that into just one group which I'm going to name net assets released from restriction and then say okay and then I want to I want to pull those into that item so then now those are going to be grouped together so then I can say alright done that assets really I won't save this item so next time I pull up this worksheet it won't show this way but this is some one way that you can you could get the more detail and have that grouping and again this is similar to like sub accounts so you can kind of do this and like a quick books online but the flexibility you have with it here is pretty pretty nice so now it just it shows up in that one line item even though we have have two reports that's kind of like a sub account type of activity if I wanted to expand them I would just go to the edit tab and then hit that little triangle to expand them back out and then we can see it in that format as well I'm going to hold down control scroll up just a bit and then if we break out this information to the unrestricted and restricted if I go into the restricted items here so within the restricted items scrolling down the rest the actual item that was unrestricted was with regards to the government grants so now we see the government grants here we see the restricted item with regards to the government grants so now we got this item that are still restricted the thirty thousand four ninety six so now we're showing the actual items that are restricted and note that this ties out this to to the the end result here because I'm using I'm looking at the same accounting period the two thirty four six fifty six for our three restrictions grants time long-term projects two thirty four six fifty six ties out to the income statement where we have the two thirty four six fifty six and the restricted items back to the this one also note that if you this would also tie out to the balance sheet and well let's check it out if we go if well we can't see it right now but later on we'll take a look at the balance sheet but just note that when we tied out to the balance sheet we're gonna have to change the date range to the life of the restricted item and then that and then it will show an item that will tie out to the balance sheet item for for the restricted accounts so the sum of all restriction accounts for the life of the of the restriction should then be tied out to the balance sheet accounts which will have two of them after we make an adjustment for them which will show the restricted and unrestricted items for the for the kind of like the equity section or the net assets section of the balance sheet then if we go to the unrestricted again if we go back to this income statement now we're looking at the unrestricted which is this this gross profit of the three sixty five five oh four that's gonna be covered by this worksheet the unrestricted items and there's the we put it into fundraising and if I scroll down we get the net income the 301 252 actually let's take a look at that bottom line number on the if I take a look at the unrestricted bottom line number on the net income we're getting a total of 44 244 if I go back to my worksheet over here and we take a look at the total column which is this one the 44 244 for the unrestricted alright so then I'm gonna go back on over here so there's there's the detail there now the thing we changed is the income side of things and notice that typically we're looking at the breakout here we just put it into into fundraising so typically we'll put you know the default setting when the income is going up is to put it into basically the fundraising category unless there's you know specific activity on on the other categories here usually I mean the main purpose of this report the requirement of this report is to break out the expenses down here down below as we saw in a prior presentation both by function and by nature so but in any case this report of course will then tie out to the the income statement worksheet report as well but it will tie out to the unrestricted column so that's gonna be it for now let's get out of here


Hi everyone, Joe for Jasper's casebreaks.com coming at you with 2019-2020 Panini Mosaic Basketball, one sell-o-pack break number 65, with a chance to win 10 spots in Noir Basketball. In fact, this fills up that Noir Basketball break, that'll be in a separate video. As always, we're going to do the break first. First off, big thanks to all of those folks right there. They're the teams right there. Let's roll it. Let's randomize it two and a three, five times for each list. One, two, three, four, five. After five, we've got Anthony all the way down to Ryan H. Let's assign you a random team five times on the randomizer. One, two, three, four, and five. After five times, we've got OKC down to Orlando. All right, so I'm not going to read up all these names, but there's the first half of the list right there. It's just one sell-o-pack, but as I say in every one of these breaks, every single time, you never know. Chad, Palakins, Jeremy, Grizzlies. Who knows? Yeah, Jose thinks that you don't think anything's going to be open it up any time soon. Come on, list. Texas is starting to reclose bars back up again. Restaurants being shaved down to 50% capacity instead of 75%.  People weren't social distancing properly enough. Don't ruin it for the rest of us, ladies and gentlemen. It's a thing. Mask up, be safe. Ooh, John Morant. That's nice. That RJ Barrett's pretty nice. Not too shabby either. He's got some upsides. Still ask them up, so even those on the Knicks. Eastwood with the Knicks, John Morant going to Jeremy Agno and the Grizz. Nice. Pink Camo is exclusive to this set. We got KCEP. You might get some more minutes without Avery Bradley, Chris Paul, and Eric Pascal. Nice. All right. The important part of this is who is going to be in the mixer. So let's grab all your names again, put you in a blank list. Let's re-randomize your names. It'll be top 10 after five, four and a one, five times. One, two, three, four. Good luck. Fifth and final time after five times. Big thanks to all those folks right there. I appreciate it. Thanks for giving this a shot. Congrats to the top 10. Ryan, Derek, Zeal, Jeremy, Zeal, Zach, Brianna, Chad, Aaron, and Zeal Kong Ning. Bam. Right there. Top 10. Congrats to you. You're in noir basketball. Coming up in a separate video next.