All right, I think we're good. This is as long as the leashes they give me anymore.  I'm not sure what talk you're here to see but it's not mine My name is Bruce Potter. I'm gonna be talking about the dirty secrets of the security industry. There's a secondary microphone here What's this sir? Just a recorder. Who are you? Your PC world, excellent. I love press. Last year the press quoted me as saying an expletive and my employer's name in the same sentence I hadn't even landed on the ground yet in my hometown and I had a nasty grant from our PR department saying we've had better pull quotes than this Fair enough.  PC world and anyone else if I if I do it happened to let it expletive go Don't quote me on it filled in with something colorful ponies rainbows. I don't care Just anything else so So priest is taking up a few seconds of my time, so I'll get right to the chase First thing I want to say this is nothing to do with my talk, but in general you're at a security convention Do you trust the wireless network here? No, right. Okay. Do you trust the hotel billing system after watching major malfunction own people's? You know TV sets in the last few years. No, should you trust the jackass that's up on stage talking? No, right. Okay. First and foremost talking writing articles writing books is all exercise and social engineering Okay, full stop I can write something that convinces people that I know what the hell I'm talking about and then they give me a microphone I could come up here and moon you all for an hour And they have no control over at this point, you know, it's like it's all over the first book I wrote was a wireless security book for O'Reilly and Like literally I just got a wild hair one day I sent out a Proposal to him and like two weeks later. They sent me a contract to sign, you know And there might have been like five email exchanges in between and that was it, you know, I like O'Reilly They're good publisher. I certainly enjoy working for him But you know it there was not a lot of do-gill as it's involved, you know And for people coming up on stage they're spewing stuff that you take as gospel You go back to your employers and your friends you tell them all about it It may not be true. So challenge everything that you hear when you're here at DEF CON not just what's the MAC address of the AP? But what did this guy just say about attacking MQ series? So this guy say about attacking Cisco routers, okay? By day full disclosure I am a security consultant for Booz Allen Hamilton in the greater Baltimore area by night I founded this new group and that's enough about me. So What's the goal of this thing? I'm gonna poke people in the eye today. That's kind of my intent There have been various Attempts at kind of stabbing the security industry in the face over the last few years at DEF CON. I'm gonna make another run at it There are 800 pound gorillas in the room today and they might be blocking a fire exit So if you ask them to leave that would be helpful Um But honestly, there's a lot of things going on the security industry today that we may not be consciously thinking about right? There's a lot of issues There's a lot of new things that have happened in the last eight nine ten years. This is DEF CON 15, right? DEF CON 4 still involves or DEF CON 5 still involves scavenger hunts where people were stealing shit, right? I mean like to be successful in the scavenger hunt you had to go steal stuff That that doesn't fly so well today, you know like we were much more calm than we used to be DEF CONs in years past were pretty crazy, but everyone's oh, it's DEF CON. It's like it hasn't changed It's like the security industry. Oh, it's the security industry. It hasn't changed What's changed between two none, you know 1997 and today it's immeasurable and so let's let's be honest Let's address that and that's what I'm gonna try to do today There's a lot of people in here that work for companies that I might kind of poke and say things about this is all Again, this is my opinion. All right. I mean, you know ill will I know a lot of us are working hard to solve the good Good problems and things like that I just want to get some discussion going if you have questions if you have concerns ask now throw stuff preferably very expensive digital cameras Give me some warning so I can catch them and scrape the serial numbers off so But feel free and again, we'll break this out somewhere else and there's bars here in Vegas I hear and we can take it up later there too as well, so So first things first I'm using keynote now instead of PowerPoint. You might notice the little spinny animations keynote users. I heard a few of you Max rule Except for everyone that's got an iPhone and turned off Wi-Fi the moment they came to Defcon So this is really awkward to have like one screen like way the hell normally I'm like in front of it pounding on it And I can't reach it so I draw this pyramid a lot and I think a number of you probably seen there already This is I I can hear this is my shirt, so I'm dancing for you. This is the pyramid And like right here at the bottom of doing this for the folks over here. They can't see anything Is operational stuff operational it the idea here this pyramid is like Maslow's pyramid of human needs except geared toward Security operations right you need to do certain things first in order to do the next thing Like I need to have food water and shelter before I care about is it Hillary or Obama? Right like before I get way up the food chain dealing with politics I have to have basic things taken care of same goes in the data center folks, right? It's all about keeping live systems secure and running. That's what security is okay not naval contemplation not feeding all our goddamn wallets it's about keeping things secure and We need to have some structure how we think about this This is a structure that I use again You can disagree at the bottom it operations you got to do that right or security doesn't matter right if you have The dumbest sys admins in the world and the smartest security guys doesn't matter you're screwed right? So we got patch management policies and procedures things like that you do that right you move up the food chain Okay, you start talking about firewalls triple-a services bread and butter network security, right? This is what we all know network security to be farther up the food chain Start getting a little bit more sophisticated have things like software security actually reviewing the custom code That we develop okay There's another really interesting piece of software security that can be deployed in an operational construct that people don't spend a lot of Time doing right now And it's something that I really think that we need to need to address a little bit better And it's the idea of providing software level access control. This is not world group user Rewrite execute privileges. That's not fine-grained access control. That's access control for 1972 and that's cool I mean it was cool back when they were making pentos, but it kind of sucks right now kind of like pentos do today so Products like se linux. Okay, that is the se linux is the equivalent of taking a strategic bomber to go get the groceries Right like it's hella fast and it carries a hell of a lot of groceries But it's a little awkward to take off and land, you know, I don't know about your safe way But I can't land my b2 at mine very effectively There are lighter weight products like app armor from novell that allow you to on an application by application basis Say what the application is allowed to do and not allowed to do it's allowed to get to this directory Write this file read this file do all these things. Hey, what's fantastic about that? Is if you have software that's written badly and someone goes in and tries to pop your box through that software Those types of systems will protect the box. The application may die That's cool But your applicant the rest of the system the rest of your data will be protected This doesn't require the developer to do anything different It just requires that you understand the product and deploy it in an operational environment neat stuff Not a lot of people do it because they like to jump up to the next level right IDS Okay, we've done we're done with stopping the tax and now we're gonna just contemplate them Okay, I got an IDS. Whoo. Look at that. Did you see what that guy did to our network yesterday? Wow Meanwhile your application server has been owned by like 15 different people, but it was really cute how they did it That's not acceptable right you need to be focusing what's going on the software before you care about IDS And then finally if you're really out there you can deal with honeypots But that's only if like you're an academic or you've done everything else so well, and you still have gobs and money so What gave birth to these gorillas that we're going to discuss? This is like the four-minute history of the tubes. Okay, so let's just just bear with that was Ted Stevens thing right call it the tubes I would I spent nine nine years in Alaska, and I saw that many his offices got raided the other day That was the greatest thing ever He's the longest running senator ever.  I'm like he's 40 years in the Senate by definition. He's done something wrong Like you cannot possibly be in the Senate that long and not have committed a crime um So in the 60s computer security right those are the guys at the doors that checked your badges and had guns Okay, that was computer security in the 60s There were some academic discussions of you know how to secure these computer things But it wasn't really a field yet, right? We were still dealing with building the computers There was no commodity shops in Taiwan that would supply you with gigabytes of RAM on a second-by-second basis I mean this was tubes and we're all kind of bent with this thing like I'm falling off the side there for some reason But it says tubes over there in the corner for those that can't read Things got a little bit more serious in the 70s telnet was introduced Okay, telnet was actually kind of a groundbreaking thing when it came out It allowed people just to connect to other people's computers very easily and do stuff Which was pretty cool. It made networks actually very functional In the mid 70s. There's a lot of research done in the trusted computing systems Which kind of today the lineage is now the trusted computing platform and things of that nature all that genesis was back in the late 60s In the early 70s. We also had neat things like blue boxing Captain Crunch blew the whistle Blue boxes came out telephone freaking had its start in the early 70s Okay, that little green bar in the bottom that can people in like the front row and a half can see That's the my estimated amount of revenue in the entire computer security field in the you know throughout the 70s This is based on wild conjecture and a logarithmic scale. So Feel free to disagree In the 80s BBS is man. It's all about dial-up right like check out my mad 2,400 bod modem like wow that's so much faster my 300-bot acoustic coupler Viruses approaches went mainstream like you know, I remember as a kid I had like the drawer full of floppy drives and like all these Apple 2 programs And they're probably all riddled viruses to you know, like it was just you popped in a drive into somebody they're floppy into Somebody's box and like it got owned cool Like if it was only that easy today, oh wait, maybe it is The hacker underground was born in earnest 2,600 the hacker quarterly emerged Legion to doom CDC all these groups have the roots in the 80s Okay, old-school hacking man. That was that was it the PC was born and the Morris worm, right? The big, you know, what are they what they call that tipping point?  Hey, there's some more money in securing our systems well in In the 90s there was a lot more money right VCs lost all sense of reality and gave money to anyone Okay, just poof if you if you had a pulse and you said computer security You could get a couple million dollars to go off and do something usually burn it in a fire pit in your backyard Firewalls antivirus IDS rapidly emerged and became commonplace right stateful firewalls came out 1994 by 1996, you know, there's all these companies checkpoint whoever else that have state or stateful firewalls for sale 97 everyone's got them deployed like that time between stateless packet filtering and stateful firewalls You know, it's like we're literally like three or four years poof and everyone had stateful firewalls So just to be clear we all understood firewalls as well as we needed to in 1997 All right, there's no more interest at that point right like we should be done We understand the purpose of firewalls just file that one away for later The interweb was born and we lost 65,000 ports, right? It was port 80 and 443 to this day That's what most people think the internet is and my space has its own port now So it's so much goddamn traffic.  The screw group was found in 1999 that was about our level of understanding at the time was you know, hey cool We we know how to install free BSD hackers the movie the pinnacle of hacker culture Yeah, anyway all those that said who who I have a special them never mind So and then and then the naughties that was a great name for this decade that we're in that didn't seem to Catch on you know back in ought eight or whatever and people should I think call it the naughties I'm just going to take this decade and call it that The internet went everywhere right like it didn't go to our toasters, but it sure as hell went to our iPhones And it went everywhere else and so it's pervaded everything that we do Note the green bar the information security industry keeps getting larger, right more systems more networks bigger IT budgets more money period how many people here went to black at more money all right, so I Mean there's a there's a lot of this hackers became profit driven, right? And there's two ways to view this hackers became profit-driven and went underground or making good money working organized crime and things like that Hackers were profit-driven and went above ground and got consulting jobs Right it's kind of a joke and it's kind of true We also it's funny.  So anyway Microsoft found security this decade. This is probably going to be a turning point in computer security Okay, what Microsoft has been doing? I'm not saying it's right not saying it's wrong But it's changing the rules of the game and we need to understand it slammer code read diehard 4 Which apparently was actually a pretty good portrayal of like computer attack and hacker You know kind of things so that was my counterpoint to the the hackers in the movie crap More tubes so secret number one that was all just set up to get to the secrets Right secret number one defense in depth dead. It's dead and never should have started in the first place Let's just put it that way this mantra that we live and breathe of layer on layer after layer after layer of security is Totally broken at its foundation right it is an operational response. I Need to secure the systems in my data center and the code sucks What do I do I buy firewalls antivirus all this stuff? That's the response the response how to make that better Is it build better firewalls and antivirus and anti spam software and all that it's to fix the code Okay, so the first thing that we had is we had computers Okay, we were happy that they did our bidding and didn't take over the world. All right This is a good thing. They had vacuum tubes. They were fragile. You could smack them and they stopped running There was no type safety there was no fault isolation no air handling no sense of assurance But again, it didn't matter because they could count to ten all right the Artificial intelligence war and I've said this before we thought AI was going to be solved in the 60s And by now the computers would be get running this conference for us because it was all about symbolic computing We would build more complicated processors that thought like human beings and that's how we would build artificially intelligent systems Turned out that didn't work so well, right? What what killed AI? What was the final victory in AI? MIPS raw horsepower Okay, you put a lot of information on disk You have processes as fast as humanly possible and suddenly you're deterministic at checkers, right? Seriously like we just beat checkers some guys up in up in Canada I think it was I don't how many people saw this but they beat checkers like holy crap now the way that they beat it They wasn't deterministic they didn't start from the beginning They can't quite capture the entire space of the checkers game But they work backwards from every possible finishing position and then they go ten steps backwards from there So as long as you get to the point where you've removed four pieces from the board the computer wins full stop Moore's law says in a couple years They'll be only have to remove three pieces a couple more years to remove two couple more years will actually have solved Checkers okay wasn't symbolic computing wasn't pretty you know ways of thinking about it It was raw horsepower the vacuum tubes didn't have raw horsepower, but they were awful awful cute so Over time we hook these things together, okay? Remember back to my fancy timeline for those that have seen me talk before this is clearly quantum leap forward in my PowerPoint presentation skills Some nods before it was just drunken like I had transparencies from the bar, and I just written on the bar napkin We hook things together the ARP and that begat internet begat, you know my space Firewalls popped up everywhere TIS release its source stateful firewalls all this stuff still had the bad code Right a better firewall didn't fix everything else didn't make my mail server better Mail server needs to be reachable from the entire internet firewall useless right Full stop But if you're not running other ports on your firewall or on your mail server your firewall doesn't really have to do anything Doesn't do anything the box couldn't do natively itself assuming it's IP stack doesn't suck Right and IP stacks have been around for a long time it and we're generally getting better at making good ones Although Microsoft in a bit of a you know way back machine thing a couple years ago in XP re-released I guess it was the land attack like it was like in the release notes like re-enabled land And if you sent something like from itself to itself from the same port to the same destination port the box of BSOD It's like cool. That was 1995. He did that he brought it back in 2005 But in general, you know our IP stacks have gotten better Steve Bellavan has this fantastic quote and it can pretty much serve as the foundation of how you think about security Right a firewall is a network response to a software engineering problem Okay got bad code didn't know what to do bandaged it at the firewall. That's the defense in death mantra Right got bad code put on antivirus got bad code put on triple-a services did all this crap Don of the firewalls was beginning of the age of defense and death so Networks became global Right we deployed IDS is an antivirus because we couldn't keep a handle on the bad code anymore We got more complicated with our security product offering more and more money got infused to the system We deployed multi-factor authentication and we spent a ton of time managing this right We pay security people to manage firewalls to manage antivirus to do all this stuff cost a lot of money We don't pay security people to manage bad code, right? We don't pay them to work with the developers that work with our vendors to make better code We pay them to manage the band-aids for the crappy code that was created in the first place Okay, I'm not here to say hey We need to change the software development model and push liabilities in the vendor and whatever I know Bruce Schneier and some other folks have some views about how to do that I don't know how to fix that from a policy and whatever perspective from a technology perspective though We need it. I've got some ideas and they'll come in a minute, but anyway I hit it when I trail off in a slide and I forget where I was and I start referencing random things and waving my hands hoping You'll just forget about me for a few seconds and wonder like what are you gonna do for dinner or and whatever and then I'll say something funny You'll check back in and then we'll just keep on going So so still we have bad code So now we're moving toward the network as a computer, right? Scott McNeely CEO of Sun said the network was the computer. He was right. He was wrong in two regards one He was about a decade too early and two we work for Sun So he was hoping the network would be the Sun computer, but it turns out no it's a wind-tell platform Sorry there guy So we're going to be service oriented Everything we don't understand it don't have a clue like I read all these, you know CXO level magazines and whatever And they talk about so a revolutionized our data center like all it did was hide it on the map So you couldn't find it anymore. He went to McDonald's and thought this is a really nice data center. It's got a fryer We don't understand XML security we don't understand these Incredibly distributed systems with all these services right we can't write line by line secure code Right how on God's earth can we expect to plug all these systems together anything that resembles a secure fashion? With no clue we understand a theory behind it We understand the theory of line by line secure code now We just don't necessarily know how to enforce it yet when it comes to this big service oriented who ha that we developed We don't get that at all and in between all those little components We've layered in lots of defense and death all these little dots and starbursts and other things that aren't rendering because it's too Damn small We don't we have to manage all that and we have to continue to adapt it XML firewall that's that's great because it sounds like it ties into software problem in the network thing and All you might parse it for like you know proper structure and things like that But you're not going to prevent really sophisticated attacks You're not going to prevent bad things from happening You might get the ankle biters like you got with your firewall, but you're not going to get anything serious So millions and millions of lines of code went into me writing this crappy presentation, right? There's billions of K lock in any enterprise Okay, billions of lines of code running all the networks and systems that we use every day to drive around Las Vegas to fly home To order pizza whatever billions of lines of code. We don't understand any of it. So Have we seen more security? Staff applied to this problem. Have we seen you know better management tools and whatever? Yeah, we've seen all kinds of advances there, but we still haven't fixed the code note Exploded on the slide PC world guy if you could not include the expletive Type safety, you know, there are people Gary McGraw He wrote a really interesting book Exploiting software and in the beginning there's a chapter of that kind of staring at this crystal ball and say what's what? Software security and it'll look like in the next ten years It's actually was written like three or four years ago And it was pretty well on track already one of the things that Gary. I think it was Greg Hoglund wrote with him Said is in ten years will be using all languages that are type safe And a lot of these kind of low-level buffer overflow problems that we have are going to go away I thought that was really really Aggressive I don't think that we're going to get rid of C anytime soon. How many kids just graduated college in this room in the last two years Wow, this is an older Defconn crowd. I guess Did you still learn C sir? Oh, yeah, right? Do you know what type safety is sir? Okay, good good. So the CS programs are getting a little bit better Trust and computing things of this nature. We need to push vendors We need to push operating system provider software providers hardware providers We want better code because ideally what I want to do to my IT security line item Budget is deleted, right? I don't want firewalls. I don't want IDS.   Oh, it's one.  Okay, the request was next time when I round the applause I'll ask I also will request that everyone there was actually a fee for attending this talk So if you come up afterwards and give me, I don't know 50 bucks 100 whatever your heart feels is proper Is that is that a good will that work too, sir? Whoever said that? Make the shopping cart go take it All right, so secret number two We are a long way away from making our jobs professional, right?  Well, we're not Well, a few of us might be by the you know proper definition, but not not many How many people have a degree in something that resembles computer security? How many people have it? Okay, well, if you will keep your hands up. How many of those are in information assurance? Right, okay, that's at least 50% of the folks in this room, right? 50% of the six people that raised their hands Was a master levels program sir. Yeah masters masters anyone have an undergraduate degree. It's something that says computer security. Oh All right, oh, we got one. Thank you, sir. I appreciate it even if you were lying just to prove my point You titled it himself excellence. I'm gonna be supreme overlord of all things electronic. I Have a doctorate. They said no to that My mentor disagreed he already had that title So what are we doing here, right? This is a tens of billions of dollar industry We are the leaders in this industry none of us are formally trained in this job We're all Faking it. We're posers There is no barrier to entry into security, right? We are protecting the world's financial institutions airlines military installations. I just walked up and said I could do it They gave me a job Yeah, we're damn good at lying to people as it turns out So What what you know? Oh my god name another industry that's not that that is a skilled quote industry that has the same situation politics I Said skilled sir skilled Yeah, we were socially adept kind of Except for after three o'clock when it gets to the bar so The question remains We probably do want to formalize our body of knowledge right like you know this whole defense in depth Is it good is it bad? You know that's like a little sliver of the holy war that is computer security And we've got bunch of young kids coming through school They're just owning stuff because that's what they like to do It'd be cool if we had a framework in which to get them educated and we agreed or at least had a process to Start agreeing on what the way to do things was you know, we don't we don't we can't agree in this room We can't agree to write textbooks. We can't agree to train people. What do we do? How do we codify our knowledge to build the next generation of mini Kaminsky's I? Want an army of mini Kaminsky's just so I can like punt them Is Dan here no of course not um Many hall of ours mini DT's you know, how do we take the knowledge that we have make it formal and not make it the cispy um, I mean that's a few a Few giggles. Yeah, whoo So I work for a large consulting company where there's a lot of cispy, so I'm just gonna duck Software developers are the smartest over gonna be the day they graduate from college Sorry developers in the room. It's the truth. Get used to it. You're going downhill You learn about all these formal processes and how memory mapping works at C C When you're in college when you get out of college, you learn new languages You can learn how to software engineering really works in the field Which is turns out quality is not important making it through QA is right there are two discrete things You understand what QA is going to test and you're right around it You know you don't actually make good software. You just make adaptive software that makes the QA guys happy And you do it on time so you can get out of work at a normal hour And you do it on budget because you like getting paid So that's the way software engineering works. We don't teach kids coming out of school how to write secure code There's a few programs around the world that do but it's not yet common place You know, but you don't pick up a compiler on day one and write hello world in a way that's resilient to attack Right most of the time like you write hello world and then you write something that takes input and then displays it to the Screen like and that program is totally ownable, right?  Oh, hey look. I popped the machine It would be cool if like after hello world the next step was here's how to write You know a get s thing that actually is secure and start from day one I learned when I dropped out of college That in my computer science course they taught us exception handling and things like that as like a third-year CS problem I'd already developed all my bad habits by then I commented my code I commented out the crap that didn't work and rewrote it again underneath it and I kept doing this and I would have like 100k chunks of code with only like six compiled lines so Someone at some point should have said don't do that Right, but they don't we don't teach people how to write good code because we don't know how to because there's no Formal body of knowledge and we're not professionals yet. So this is something I don't I don't have a solution for this You know, so this is one of those things securities everybody's problem, right? Well, sure, right? Whatever like that's that's a fantastic idea It's you know why it's everybody's problem because we don't know how to solve it for them So we oh, it's your problem to deal with right like that's why security is that you see these signs like in the office No securities everyone's problem. No, it's it's your problem as it turns out. You just don't know how to do it We can't train everyone who has the word security in their title let alone train all the users Right like it's it's hard to get the money to come to blackhead and Defconn and most of you are just here to drink so Thank you. Thank you for being honest, sir. I appreciate it is Las Vegas if you hadn't noticed um I Don't know how anyone gets away. This is the boondoggle of all boondoggle It's 7,000 people you know most of them and you go to Vegas and you drink and you call the security conference and your employer Pays for I'm sorry. They might be listening Hi What we need everyone well auction it off later Users users need tools that they can't screw up right they need shotguns that don't have triggers and have solid barrels Because then they can aim it at their foot all day long and do this and nothing goes wrong like it's fantastic We need to build Software systems that enable the users to be as dumb as humanly possible and still maintain the integrity of our systems Okay, doesn't mean we should install a better VPN so that all their bit the crappy data is encrypted No, we should write better systems. How do we do that? We have to train people to be how to write it How do we train them?  I don't think but Think about the hacker culture 10 years ago and think about it today And why I like to say is if we had started schmoo con in 1997 Our main web server would have been owned off the face of the earth the moment we opened that conference for being a bunch of white hat Lamers right and it would have been socially acceptable like that's just the way the community worked Like there was a battle there about white hats and black hats and gray hats all this crap and people owned other people's boxes And it was all commonly accepted the chaos was part of the culture. It is no longer part of all culture This is the most polite group of people there were people no offense standing in line yesterday to buy T-shirts at like three o'clock on Thursday afternoon at deaf con Does that strike anyone is a little strange like this thing is all about damn the man Like someone should have walked up with like I work at jinx hat wear hack wear dot com t-shirt Walk behind the damn counter and bought themselves a t-shirt walked away like that would have gotten mad props But no we all stand in line We're very polite we're the British and the French having a battle in the 1700s We all stand on two sides. No way. I'm gonna shoot now. Then you should be One two, all right, you lost ten guys. Sorry. We'll stand here. I'll make myself real big All right. You miss me. All right guys. Come on. Let's do it again You know our adversaries are the American revolutionaries right they're crawling around in the woods And they're doing things that we can't do or at least we can't think we can do right because we're in this thing We all come in priest says get the hell out of the aisles and we do and I'm not trying to disparage the whole like not Pissing off the fire marshal because God knows we don't want to piss off the fire marshal That appears to be like a completely unregulated branch of the government There's like the executive the legislative the judicial and then the fire marshal like He's shut down everything but I Remember the first year that we had problems here the fire marshal I was the first talk on the first day in one of the tracks and one of the goons came up and said You've got to tell everyone that's not sitting down to clear out.  I don't want to get killed but everyone left, you know, everyone got up and play we left We need to kind of embrace the fact like okay if we're gonna kind of ride this line of grey hat and professional like Make a decision right be a professional. Let's figure out how to professionalize a workforce. Let's make the certifications worthwhile Let's make the education worthwhile. Let's make the training worthwhile Let's find a way to pass this on to the next generation. I do things that don't matter. I'm getting a ten minute sign. Oh my god. Oh All right, so defensive depth led to this ginormous green industry that I'd written Very few products are actually geared toward making things more secure, right? Like I think I might have said this there are some products software scanners You know ounce labs for it if I aspect to name a few that that actually are geared toward helping at least audit code Right and you've got hardware security modules and smart cards and things They're probably part of secure systems But a lot of what we buy is part of this defense in depth and that's the big part of most IT security budgets Right is what we would classify as defense in depth network security who ha so Let's look at a recent kind of I call this case study like it's formal It's a bunch of random bullet points pulled from a couple of different articles. So um Microsoft Microsoft went to the river and they found security, right? Hallelujah. They got it. They figured it out They spent a lot of money right or wrong what they're doing their approach They are spending more money than most put companies spend period on security and they heard it You know vendors and consumers all these people said we need more secure systems. Okay Microsoft said all right Well, we're right in Vista. What can we do in Vista and they've got all this stuff And they'll tell you all about it in a million briefings about how this is so cool One of the neat things was on 64-bit version of the OS their flagship product geared toward industry Where all their new applications and things are going they said what we're going to do is require all drivers to be signed Simple right this is good If you've ever seen like I do the talk on trusting computing and talk about a little bit about driver signing And then the good that can yield it doesn't mean it's good code But it means it's the code you intended to run Okay, think about that fun your laptop or your computer your iPhone or whatever today when you're at Defconn every time you touch the keyboard You could verify only the code that you intend to run is running Hallelujah like that would be fantastic to know there's no Trojans There's no there's no viruses that have been loaded no keystroke loggers that kind of thing which tend to work By basically acting as a driver and hooking the kernel. Okay, so Microsoft said no, sorry gonna have to get all your drivers signed Well, and they closed off a bunch of api's that the security vendors were using to do their stuff all the antivirus and whatever Security community security excuse me product community got very upset and said Microsoft's exerting too much pressure Right, they're locking us out of the space because not only are they doing this But the same time they're releasing a competing antivirus and anti-fishing product Maybe they overstep some antitrust bounds there or not But nonetheless they've made an effort to honestly lock down the operating system right and a pretty good one I think that most of us can common sense say yeah, that sounds pretty reasonable Well, the security product vendor said it's not reasonable to us because it impedes our ability to sell our products Okay, so then they start bickering some of these security vendors Authenticity and for once is the one I could find found ways to bypass the security mechanism that Microsoft had created and actually Geared their flagship product around that bypass So they had a hack Vista to make the product work then they released a press release that said hey We figured out how to hack Vista so we get our security product to work, right? Excellent that's what I want to hear like as a consumer of security products I want to hear that you had a pop the box in order to un-pop the box So Microsoft said all right we hear you we don't want to get sued antitrust lawyers are really expensive So we'll open up some API's will allow some unsigned interaction and basically defeat the whole purpose of what we were trying to do in the first place All right, so let's think about that in the past we presumed That our systems were so insecure that we had to buy third-party security products to make them better, right? That's the presumption period That's the ground truth of why we buy third-party security products not because they have pretty boxes The corollary to that is we believe the third-party security price code was of a higher quality Than the code that it was trying to protect Giggle giggle chuckle. Yeah, okay. There's some examples where that might not have been true The future says hey security is a real concern and big software shops are actually starting to do the right thing The corollary to that is so are we're going to keep spending money on security products Or at least the same type of security products, or is the security product space going to fundamentally change in the next five years? 10 I'm usually kind of aggressive on that What does the future look like I don't have any idea, okay? I'm just trying to set the hook for you guys to think about it Because I know at some point a goon is going to come up here and a hook something at me to get me off stage Secret the last full disclosure is dead Let's not kid ourselves, right? There's money in disclosing vulnerabilities. There's a lot of money in it And it's changing the landscape of computers e5. All right. Thanks. Oh Over the last 15 years really is when the disclosure discussion Started right we we're community. Okay. We're not a perfect group a professional group There's no def con professional engineer badge that you get or something like that, right? I mean we are an ad hoc community that has has grown and lived on the sharing of information Publicly and we can do so in a way to exert pressure on vendors to fix their software and their hardware, right? That's the nature full disclosure There's an entire spectrum of how to disclose the RF policy and the oh I safety guide and all these different private views about How to deal with disclosure? Okay, so responsible disclosure was we used to have disclosure panels at def con or people debated that gradient of Full disclosure well now Things have changed skip the stuff in the top in the bottom We have companies that will pay we have very legitimate companies that will pay for vulnerability information And there's some not so legitimate companies that may be paying for vulnerability information as well They're private transactions. It seems totally acceptable to at least the majority of the community that that's okay It's okay to find a vulnerability in a system not tell the vendor to tell a third party instead get money from them And expect that they're gonna do the right thing Okay, I'm not I got nothing against cdi and vcp. Okay. I'm just using them as an example here, so Cisco Microsoft won't pay they're taking a stand, right? The problem it so yeah, so then you know what that should the vendors pay well is that extortion? I don't know well I found You know and applying that kind of pressure it might be a good thing I'm not I don't want to take a stand on this largely because I don't have time to get into discussion right now, but Maybe they will it's funny because I remember taking example I used to do some about free wireless stuff in northern Virginia this guy came up to me I got this a couple times and they say hey, you know what I'm thinking about getting into wireless security consulting business and My this company that's down the road I was war-driving and I found a bunch of open things that he had and their file servers open and whatever So I was gonna go down and tell him if they pay me $10,000 I'll fix it like That sounds like extortion, you know like but it turns out that that's the market that we're creating today to sell vulnerabilities in so Okay, where's the line? What's the ethics in this do should we have a discussion about this? Maybe probably, you know Should there be a little bit more thought involved? Probably but you know what the next generation of mini-dans and mini-hell bars and all those folks They're growing up and they're seeing their idols in this community doing this and they think it's acceptable Okay, whether it is or not. I'm not going to debate but it fundamentally changes the landscape of full disclosure. Okay, the What it used to be was What disclosure method should I employ you know now it's should I disclose or should I make money on it? Maybe there's even gradients in there But there's a whole new area open up in the full disclosure world and its impact. We don't understand yet So we might have lost track of something Okay, my point of this is not to rail on these companies But it's the fact that ultimately we're trying to make live systems more resilient to attack right definition of computer security It's not to make us all rich. It's to make the systems more secure Just creating a secondary market as a clearinghouse for vulnerabilities actually make the end user more secure Can anyone tell me yes or no? Yes or no? And that was the best I could hope for We are potentially putting our entire livelihood at risk by running around like cowboys right now We haven't thought this through and we need to so where does that leave us one the landscape has changed, right? At least that's my understanding. I don't when I walk the halls and when I read what's going on in the popular press I don't see the recognition of things having changed. It looks like just more sophisticated products and more sophisticated attacks I think the ground rules have changed and we need to understand that I think we need to make vendors and the product manufacturers make products that are more secure Period trusted computing things of that nature. Hallelujah. Yeah, you're supposed to applaud now or something throw money body parts underwear We need to create a formal body of knowledge for information security and we need to hold each other accountable, right? I said some pretty inflammatory things today That three people challenged me.  You redeemed yourself.  There we go that we get some creativity there sir. Excellent We need to think about these things. Okay, you need to spend some serious thought What are you doing with your career? What are you trying to do with your little pet project? What are you doing with your little hacking group? You know, we do it in the schmoo group constantly debate What are we trying to get done? What's going on in the industry? Okay? It's not just about who's got what product and how cool the newest release of the mware is right? It's about how is this stuff changing the landscape of what we do so real quick Schmuck on past and future Schmuck on three how many people here with Schmuck on three? Yeah, so it's in DC for those that don't know we're gonna have it probably February 15th That seems to be the relatively solid date At the same venue Warburton Park Marriott in DC We're about a thousand people show up last year thousand people left Which was good. Although one unnamed goon Inadvertently tried to sleep in the wrong hotel He was pretty drunk went to the wrong hotel after talking with host health security realized He wasn't in staying at the omni. He was staying at the ward man, but he was in the omni Which is why his key wasn't working and other things We did something creative we kind of thought about training But we decided to do instead is turn the labs into like an open source lab development kind of thing where 30 people came I participated kind of like these to set up the network network. We did the same thing at Schmuck on It was very successful. We'll probably do that again as well raised a lot of money for EFF For the one laptop per child. They had a great panel discussion got some awareness on that overall It was a blast. Hopefully it will continue to be so in the future also.  So thank you very much


Everybody forced here ripping six boxes of 2022 origins football hobby for Adam M Thanks, Adam and good luck. All right, got rookie variation Malik Willis Got fields number to 199 and A Cortland Sutton number to 299 Jersey card hunter Renfro 99 Good start with the on-card autos. It's a George Pickens rookie on-card auto.  Good start and Skymore rookie Jersey auto 69 and 99 Breaking as LeVar Shope to Joshua get any Star Wars Chrome breaks earlier. I got him one Caleb didn't pull me anything good That's how it goes with me and Caleb though Kenny picket rookie Carson Wentz numbered to 199 and 299 Kyle Pitts a Nike swoosh patch one-of-one rookie Wanda Robinson There we go Adam nice wandale that mag and a wandale Robinson rookie on-card auto Followed by a trimmick bride rookie Jumbo Jersey auto. We pulled he in origins tonight, too Origins we just been pulling fire even before that the triple threads case is good We pulled that sick trout in five-star, right? Yeah Of course the big ball a brand swoosh at oh man, I don't know LeVar at the 299 Darren Waller Raiders to 75 Najihara Steelers Matt Corral rookie Jumbo patch to 199 Ryan Robinson jr. Rookie auto on-card 15 of 99 and Rookie Jumbo Jersey auto Dolphin to Eric Izucanma from yo dobs. That is a seguan Barclay to 199 And a 299 Eli Mitchell Sub Jacob she up to gold rookie patch nine of ten Alec Pierce six of ten It's upside down nine and Brian Robinson jr. Rookie base rookie base on-card auto and Pierre Strong jr. Rookie Jumbo patch auto to 99.  It's been fun Montgomery to 25 And Adam Thielen numbered to 199 Champailly Jersey number to 99 sauce Gardner rookie gold auto 10 of 10 Gold sauce and Alec Pierce rookie Jumbo Jersey auto and he just keeps going Good five boxes so far Adam. There's a sixth one Pedigree case hit Josh Allen. We got a case hit now Michael Penman jr. To 199 and at 299 is Ezekiel Elliott Durbin James Jersey number to 99 Villas Jones jr. Rookie auto to 99 Big part of the back to Kenny pick it orange RPA 20 of 75 Adam I'd say you crushed it plain and simple Kenny pick it Two gloves were in no gloves That'll do a man Congrats again. We'll get these out of here out of here for you. I don't know what that was weird


Hello, hello, you've tuned into 24hourflamenco.com.  Thanks for tuning in. Please subscribe. Tune back in next week. Check me out at 24hourflamenco.com and subscribe to me on YouTube at Gas Liquid Solid. One word that's flamenco alchemy is the subject. And leave your comments and questions in the comments box.


Russian missiles struck the center of Ukraine's Pokrovsk twice on Monday night, killing eight people, including five civilians, regional governor Pavel Kirilenko said in a statement. The second missile hit the Ukraine-controlled town near the frontline 40 minutes after the first, the governor said. It killed and injured first responders, witnesses of the strikes told a Reuters cameraman at the scene. Two rescuers and one military person were among the dead. One policeman and one military person were wounded, but most of the 31 injured were civilians, including a member of the local city council, Ukrainian officials said.


Hi and welcome to the session. Let us discuss the following question. Question says, consider the following parallelogram. Find the values of unknowns x, y and z. Let us now start with the solution. Now in given parallelogram A, B, C, D, angle B plus angle C is equal to 180 degrees since adjacent angles in our parallelogram are supplementary. So we can write in parallelogram A, B, C, D, angle B plus angle C is equal to 180 degrees. This is because adjacent angles in a parallelogram are supplementary. Now substituting corresponding values of angle B and angle C in this equation we get 100 degrees plus x is equal to 180 degrees. Clearly you can see in the figure that measure of angle B is 100 degrees and measure of angle C is x. Now to solve this equation for variable x we will subtract 100 degrees from both the sides of this equation and we get 100 degrees minus 100 degrees plus x is equal to 180 degrees minus 100 degrees. Now 100 degrees minus 100 degrees is 0. So we are left with x on left hand side is equal to sign is as it is and 180 degrees minus 100 degrees is 80 degrees. So value of x is 80 degrees. Now according to the property of the parallelogram opposite angles of a parallelogram are equal to each other. So we get angle D is equal to angle B and angle A is equal to angle C. This is because opposite angles of a parallelogram are equal. Now note that angle D is equal to y and angle B is equal to 100 degrees. So substituting corresponding values of angle D and angle B in this equality we get y is equal to 100 degrees and angle A is equal to z and angle C is equal to x which is further equal to 80 degrees. So substituting corresponding values of angle A and angle C in this equality we get z is equal to x is equal to 80 degrees. So we get z is equal to 80 degrees and y is equal to 100 degrees. So required value of x is 80 degrees. Required value of y is 100 degrees and required value of z is again 80 degrees. This is our required answer. This completes the session. Hope you understood the solution. Take care and keep smiling.


St. Lucia's tourism sector has received a shot in the arm with the reopening of a major source market. We get details from Geraint Georges of the St. Lucia Tourism Authority. The government of St. Lucia noting the tourism sector's integral role in national and socioeconomic development of the country will be ensuring that the instructional arrangements surrounding tourism development are revised to address the various challenges facing the industry. Minister for Tourism Investment Creative Industries, Culture and Information, Honourable Dr. Unastahile at a recently held meeting of the Tourism Advisory Committee highlighted his vision for St. Lucia's tourism sector. The minister explained that efforts to improve tourism governance must recognise tourism as a composite sector to which many other sectors contribute. He expressed his belief that St. Lucia should also be afforded the opportunity to contribute and to benefit from the sector. And if we can go back to St. Lucia's, you are part of this. You add a room, you add two rooms and you operate your own micro-business. Everything in there, make it an authentic St. Lucia experience. Let them go in the communities, create the economic activity in the community so people, visitors can go to the communities and enjoy it and earn money for the communities, earn money for families. We're not saying don't go to resorts, but we say we can offer you a St. Lucia experience that is authentic, that is genuine and reflects the best of us. And if St. Lucia can start seeing, they can earn a livelihood from the tourism industry, whether it's in the village shop, whether it's the village restaurant, whether it's at a accommodation in a particular home, whatever it is, St. Lucia's now see more and more opportunities in the tourism industry for them. Dr. Ehler stated that visitors should be getting a more indigenous St. Lucia experience, even utilizing products made and sold in St. Lucia such as soap. The minister also asserted that St. Lucia should play an integral role in all stages of the development of the sector. This would ensure a sense of ownership as it relates to the tourism sector and as such, more St. Lucia's would be able to earn from the sector. We need to take a frank look at some of the developments we have coming up in St. Lucia. I feel very uncomfortable that an investor would be coming to St. Lucia and we have an understanding and agreement that you would put 200 million dollars a resort, but then the designs are not done by St. Lucia's. No work involved in the design and the drawings and the architectural work is done by St. Lucia's. The construction, when you look at the requests for incentives, the Montalorys and trucks and tractors they want to bring down, we had the St. Lucia and contractors involved in constructing the resort or the hotel, whatever it is, and you said one shouldn't we start changing this and say to developers, if you're going to come to St. Lucia, then surely you must use some of our architectural skills and talents that we have in this country. It cannot be just to put a stamp on drawings to send it to the DCA. Let us see St. Lucia's reflected in the designs and the drawings and the construction. Can we see more St. Lucia's involving it? I'm not saying your construction manager should not be of your choosing wherever in the world they come from, but more St. Lucia construction firms involved in building it. The Tourism Advisory Committee's meeting also provided an opportunity to review the sector's reopening strategy, while deciding on the way forward amidst the COVID-19 pandemic. Chief Medical Officer Dr. Sharon Belma George explained that the review encompasses protocols and measures put in place to facilitate the reopening of the sector as well as what obtained in other sectors. News at breaches, current active cases on island and the risk associated with the reopening of the sector to name a few. Now a lot of times when we think of COVID we tend to focus only on the challenges, but it has also given us quite a few opportunities to take a really intense look at the tourism industry and to really find how things ought to operate, not just for COVID but in a more sustainable way where we look at health and safety in relation to the sector. So a lot of our reviews, we're looking at sustainable measures, the challenges that we've faced, the risks that we note with the sector because we've had an opportunity to look a lot closer at the industry, and also more importantly making recommendations that are sustainable, not only for the COVID environment now but longer term. So a lot of the recommendations, we look at how we minimize the risk that the tourism sector can provide, and also the other issue that we are going to look at is moving forward. How do we continue developing the sector, keeping in mind health and safety as a very, very important aspect of the sector. Chairman of the St. Dutcher Tourism Authority, Tadius Antoine explained that many factors must be taken into consideration when deciding the way forward for St. Dutcher's tourism sector. The Tourism Advisory Committee essentially is a committee, it's a ministry base, so it's a policy-based institution to help advise from the ministry point of view also, the minister's point of view and to engage stakeholders to develop a plan of action as to how we move forward the tourism industry, not just during COVID but for tourism on the whole. All right, so how is this, if this committee is going to face the daunting task ahead as far as the COVID scenario is concerned, we know it's two years ongoing, how is the Tourism Advisory Committee going to put its role into play to ensure that the tourism environment and the tourism economy continues as we know it? As you have heard from the minister earlier on, it's about balancing livelihoods and also balancing lives. So while the Tourism Advisory Committee looks at more of the future planning of the tourism industry, it's also taking consideration now, what's happening now and in doing so, it works in the Ministry of Health in deciding what best protocols are put in place, what best advice will give our results, our alternative accommodation in inviting tourists to our island and in helping the staff of those institutions to stay employed. But it's about a plan forward for the tourism industry, for now and also for the future. The 17 member committee will also be revising several legislation so as to ensure all are able to benefit from incentives and other initiatives within the sector, from the Government Information Service, who made Mark reporting.


What's up everybody? Ricky Caruth here. Look, our market has changed dramatically in the last couple weeks and that's what I want to talk about today. I want to talk about the fact that when a market shifts like this, your business will suffer temporarily and it's only temporary. Once the dust settles from this huge transition in the market, we're going to be just fine. Now I'm doing a walkthrough right now for my client who's out of state on this two bedroom. It's a really large two bedroom for $4.89. We're closing tomorrow and I want to show this to you guys. This is an amazing unit. Look how big the entryway is here. The really wide hallway coming in. Really nice big kitchen. You got this window right out the dining room. Incredible view. High ceilings, crown molding. Got the same view from your living room here. It's a corner unit and I'm in Orange Beach at Escapes to the Shore unit 1501. There's the pool area. Master bath. So I'm getting messages from you guys left and right telling me how deals are falling through right now. What do you do? You've got buyers that are backing out due to this coronavirus situation, the market downturn, so on and so forth. And what I want you to know right now is that this is completely 100% normal. This is going to happen. I don't want you to get discouraged. I don't want you to get frustrated. I know it hurts when you lose deals and the momentum of your business kind of just goes away, but I want you to know that this is normal. This is what happens when we run into a scenario like this where the market completely flips upside down. This happened to me in 2008 when the start market crashed. It was actually 2005 when the real estate market started to go down. I lost everything by 2006. I was roofing houses by 2007. I was on an oil rig. So I've been through all this before. Trust me. And I'll tell you the truth. I wrote a book about this. It's called List to Last. I'm going to put it in the description below. You guys need to go read that because I talk about this exact moment, everything I learned through the last crash and it prepares you for the upcoming crash, which I've been talking about for years now that is inevitable and it's happening right now. So what I want to do is help reduce the failure rates in the industry right now in this moment by helping you through this. So what I want you to do is realize that deals may go away temporarily. It's a shock in the system. Real estate is a lag business. So anything you had going on under contract or people looking at properties, they're going to put the brakes on right now. A lot of them. Now I have a lot of stuff that's under contract. A lot of properties under contract that will continue to close. I've talked to everyone involved. They're okay with the situation. They're going to close. I'm going to lose some of them. Okay. You're going to lose some of your business. Some of your business may continue. You may lose all your business. Who knows? But here's the facts. Now that we are to this point in the market, all the buyers moving forward know what's going on. We know that there's an outbreak. We know there's a pandemic. We know that the start market is going down. We understand all this moving forward. So all of your buyers and all of your deals moving forward will be solid. So realize that. Now what do we have to do? We have to get out there and make calls.  Good job. What I want you to do is go back and call all those people that you talk to and see how they're feeling about it. See what they got going on. See how they feel about the situation and how you can help them. Do they want to buy because they feel like prices may go down. We're going to put them on a list if we see some deals. We're possibly, I'm not saying we're going to see a downturn in real estate, but we're possibly going to see some prices go down. It's a possibility. You can't say that it's not going to be a possibility. You can't say that it's going to for sure happen either. If this straightens out pretty fast and everything goes back to normal, that's probably unlikely. There's a lot of damage that's been done. This could be very serious. Not trying to scare you, but it might be a situation where if prices do come down, it's going to be so easy to sell properties. What I want you to do is stay on the phone. Stay talking to your past clients, your sphere of influence. When you get through that list, we're going to go after new people. We're going to continue circle prospecting. RedX is your friend. Geo Leads is your friend. We're coming out with a new product for Geo Leads. It's going to be 5,000 contacts for just $100 and we're also going to include email. That's coming out really soon, so be on the lookout for that. Tomorrow, I'm going to make live calls with Quintavius. Quintavius Burdatz is going to be right here on this YouTube channel, live tomorrow, making calls during this pandemic. That's going to be a sight to see, so definitely tune in tomorrow at 3.30 central for those live calls. Back to the situation at hand, the current market. Our business is going to temporarily suffer. We're going to fight through that with phone calls and continue talking to people. We're going to fight through to the other side. How long is this going to take? It could take a couple months for the dust to settle. That's okay. We need to be okay with this and continue working every day to get better and better and better and figure out how to communicate with people through this crisis and how we can help them moving forward. I'm telling you, this is an opportunity in disguise. This is a good thing. The market needed a correction and here it is. It's sad that it had to happen through a virus that hurts people. Nothing could be worse in the world, but as far as the market is concerned in the business world, for us real estate agents, we actually needed something to calm the market down and bring prices down a little bit. When prices come down, like I just said, it's going to be very easy to sell. No one knows what's going to happen here. There's a lot of uncertainty. That's why everything's going crazy.  Deals are going to continue to close. You may have a few that fall off because of this, but we're going to get them right back. Business is going to continue to be unlimited for every single real estate agent. Believe that. Closings are going to continue to happen every day regardless of market conditions and business is unlimited. You guys know how our role and let's always, remember this, always focus on the relationship over the transactions every time. When you do that, you turn one prospect into 10 to 20 deals over the life of your career. This is the moment right now when you get out there and you gain more market share. You acquire more market share during these times because your database is going to grow. To me, market share is the amount of property owners in the area who know who you are and you're building personal brand with. Get out there, talk to property owners as many as you can. If you're scared of the phone, if you haven't been making phone calls, you're going to have to now. Nothing's going to save you from not making phone calls. You have to make calls during this time. You have to get out there, meet people, see what's going on, and see how you can help people. I hope this video helps you a lot. I hope it calms you down a little bit. We just need to work through this. I'm here. Comment below if there's anything I can do for you. If you have any questions whatsoever, that's what I'm here for. I'm going to answer every single comment on this video and hit me a thumbs up and subscribe if you haven't already and we'll talk to you guys soon. Let's go!


Micro Center. I could kiss you. I could kiss you. You had the power strips. Thank you. The only reason I could buy these today is because of you in there. Remember yesterday's vlog? The Clicks enabled me to buy these and we're talking about power now. Power for the studio. Power to charge everything. All the batteries, the drone, everything. So happy. I've been dreaming about these things for about two long months. Years. Little box in an opening. Oh, you better watch outside. Basically, you know what? We're all about value and like high quality product. Working stock. Seth, you look out. We'll be like lifetime. Like, yep, you wear these for the rest of your life. Yeah, interesting. Cool. Stone. And you know, I wish I could give you a tip of like how to get to do about a hundred bucks, how to get them cheaper with a coupon code. But I tried for about two or three weeks, all sorts of different coupon codes. Yeah. And none of them were applied to Birkenstadt. Yeah, yeah, yeah.  It never goes on sale. Yeah. Some things they're like, listen, this is how much it cost to make it. And this is what it cost. And look what I got. First purchase. This is for charging and the lights. So one will be like dedicated to lights. The charging never stops. It never stops. Wow. This is amazing. One, two, three, four, five, six, seven, eight. Micro center. Your dad would be proud. Oh, he would be so proud of you. Except there's one issue over there in that corner over there with some cash in it. And I spent some today. I finally spent some money on the studio, on the power, not tell you power strip like this one, 12 outlets. And I got two of them, 24 outlets. Now I got to be a little careful, of course, of over burdening the system. But basically one of these strips will be for the lights that are going to go up in here in the studio. And one of the strips is just for charging everything, everything. And I don't have to worry about running out of outlets now. Question of the day.  I bet you do. If you're living the 21st century like true love and I are always unplugging the coffee maker to charge your phone or whatever the case, it's nonstop. It's a little ridiculous, frankly. I'm excited. Thank you for the clicks. It's happening. It's in here. It's in here, folks. So now that the shed is clean, I got to clear off a little bit over here. I'm realizing it's, it's all got to go. It's just all got to go. I got to start fresh and I might leave the shovels up on that wall over there. But bottom line is we're coming along tomorrow. I'm going to do a little more sanding on the shelf and maybe a little bit on the wall, slap some paint up, and continue the procession toward a studio shed for you guys to boost that value. Thanks for coming by. Thanks for bringing the power today. Thanks for bringing the power. Seek beauty. Work hard. Love each other.


So this talk is part of an online course on commutative algebra and will be about co-limits and exactness. So more specifically, it'll be about the following problems. So suppose we've got a lot of exact sequences of modules over a ring indexed by elements I inside some category J. And suppose we've got suitable morphisms between all these elements. So we've got a functor from J to modules. Then the question is, is the following sequence exact? So if we take zero, it goes to the co-limit over J of AI, goes to the co-limit of BIs, goes to the co-limit of all the CIs. And we can ask, is this exact? So this is part of a general problem but pretty much whenever we've got a functor involving modules, we want to know whether it preserves exactness. So first of all, it preserves right exactness in all cases. In other words, if we miss out this zero here, then if all these are exact, then this is exact. And there are two ways to see this. So method one, we could observe that taking co-limits is left adjoint to a diagonal functor. So what we've got here is a functor from our category of modules to the category of functors from our category J to modules. And if we've got any module M, then we can just have a functor from J to modules that just takes everything in J to M. So if J is say, a category with two objects and two morphisms, then the corresponding functor from J to M will just be to take everything here. And the corresponding left adjoint functor takes some sort of function from J to M to some sort of functor from J to modules to the co-limit, which is in this case, will just be the quotient of B by whatever you need to make these two morphisms the same. And left adjoints are always right exact. So in particular, co-limits are left adjoints so they preserve right exactness. So that's the first method. Method two is as follows, that the point is that co-limits commute with co-limits. So the point is if you've got an exact sequence, A goes to B, goes to C, goes to zero, then C is just the co-limit of these two maps. So we've got the map from A to B that we started with and we've also got the zero map from A to B. So what we want to say is that co-limit of a quotient is equal to a quotient of co-limits. And as a quotient is a special sort of co-limit, the fact that co-limits commute with quotients is a special case of the fact that co-limits commute with co-limits. So the next question is why do co-limits commute with co-limits? Well, the easiest way to see this is to just look at a sort of example. So suppose one of the categories just has two objects and two morphisms and the other has say three objects and a couple of morphisms that looks like this. Then you can consider the sort of product of these two categories which is going to look like this. And you can take co-limits of the first category and this will give you some objects here. So here we're taking the co-limits along each row, so to speak. And we can also take co-limits along the column. And if we do that, we will get some things there. And then we can take the co-limits of these things or the co-limits of these things and we want to know if they're the same. So we get some sort of thing here. And you can see that this, whatever object this is, is both the co-limits of this diagram and of this diagram because it's in fact the co-limits of the whole thing. So the co-limits of this will be this object here. And this is fairly easy to check. I'm not going to actually do it. And the only thing I'm going to observe is that this is rather similar to Fibini's theorem in integration theory. So in Fibini's theorem, if you've got a function of two variables, fx, y, dx, you can either integrate with respect to x and then integrate with respect to y or you can integrate with respect to y and then integrate with respect to x. And then integrate with respect to x or you can do a sort of double integral, two-dimensional, the big integral. And all these three integrals are the same under suitable conditions on F. And the same thing sort of happens with co-limits. You can either take co-limits horizontally, then take them vertically or you can take them vertically, then take them horizontally. Or you can take a sort of super co-limit where you do both at once and all three of these produce the same answer. So this is a sort of Fibini's theorem for co-limits. In particular, we see that the co-limit functor over J is right exact. And if you've got any right exact functor, it has a derived functor which could be written as co-lim1 over J. So I'm not gonna say very much about this derived functor because nobody seems to use it very much. So what we now want to ask is, what about left exactness? So we can ask, is a co-limit of injective maps injective? In other words, is this co-limit functor left exact and therefore exact? Because we've just shown it's right exact. And the answer is no. And it's quite easy to give examples of this. So suppose we take the co-limit of two maps, Z mapping to two or zero to Z. So the co-limit, and let me put the co-limit in green. So the co-limit is going to be Z modulo two Z. On the other hand, we can have a map from the rationals to the rationals which takes as multiplication by two. And the co-limit of these is zero. And now the integers are a subset of the rationals. So these maps here are injective. So here we're taking a co-limit of injective maps and this map here is not injective. Well, you might quibble that we're taking a co-limit over a funny category instead of taking a co-limit over a directed set. Even if you take a co-limit over a directed set, it doesn't preserve co-limits. So here's a second example. Suppose you take Z mapping to Z, mapping to Z where this is multiplication by two or you could take Q mapping to Q and Q with multiplication by two there. And here you find the co-limit is the rationals and here you find the co-limit is Z modulo two Z plus Z. And again, this group here is not a sub-module of this group here. So co-limits don't preserve exactness even if you just take co-limits over directed sets. However, a co-limit of, so a co-limit over a filtered category, let's call filtered filtered does preserve exactness. So this is a very important case in which taking co-limits over filtered categories differs from taking co-limits over possibly unfiltered categories. So in order to see this, we first need a special property of filtered co-limits or filtered co-limits. And the key point is here is that a filtered co-limit of modules MI is can be written as the following. You take the disjoint union of all the MI and you question that by the following equivalence relation. We say that MI is equal to MJ here. MI in MI and MJ in MJ. If we can find a map from I and J to K, so that MI and MJ have the same image in MK. So here's the element MI and here's the element MJ. And you can look at their images in here and they should both have the same image. So this gives a relation on the disjoint union. And the key point is that this relation is an equivalence relation. And the proof that it's an equivalence relation uses the fact that J is filtered. And it's easy to see this by drawing a little diagram. So suppose you've got these elements MI and MJ and suppose MI is equivalent to MJ. What this means is that from I and J you can find maps to a third element of the category such that MI and MJ become equal. And then MJ is equivalent to MK. And this means that if we take MK here, then MJ and MK become equal in this category here. Well, now what we can do is we can use the fact the category is filtered to find a new object here and arrows like this. And now is the image of MI in this equal to the image of MK in this? Well, not necessarily. But what we can do now is we've got two maps from MJ to this element here. And we can now find another object here in a map here making these two maps equal if you compose them with this map. And now you can see that MI and MK have the same image. So MI is equivalent to MK. And this proves the relation is transitive and proving it is symmetric and reflexive is very easy. So it is in fact an equivalence relation. So the fact that the category is filtered means you can define the co-limit in this way. Notice that if the category is not filtered then you can't generally do this. For example, if your category just looks like this then the co-limit of two modules is going to be MI direct sum MJ. And there is usually absolutely no reason why the direct sum of two modules should be their union quotient out by something. In fact, it never will be unless one of the two modules happens to be zero. So this result definitely fails for non-filtered categories. So now we can use it to show that a filtered co-limit of injective maps is injective. And this is quite easy. Suppose we've got elements MI contained in NI for I in your category J and suitable maps between them. And we want to show that the limit or the co-limit of the MI is contained in the co-limit of the NI. So let's put a question mark to minus that's what we want to prove. So suppose we've got some element MI in MI whose image in the co-limit of NI is zero. So we've got MI and it's going to map to some element NI in capital NI. And because this has image zero, it means there must be some element J in the category such that NI has image zero in NJ. Well, then we have the corresponding image of MI in MJ must map to zero. So MJ equals zero as the map from MJ to MJ is injective. So MI is zero in the co-limit because its image under some map of J is zero. So this shows that filtered co-limits are of injective or injective. So in terms of the derived front, we can say that the first derived front of a co-limit vanishes if the category J is filtered. So I should add a sort of awful warning here. So we can do the same for limits instead of co-limits. So co-limits are right exact and we find that limits over a category J is always left exact. However, it need not be right exact even if the category is filtered. So we'll see an example of this fairly soon in an upcoming lecture. So in other words, the derived functor of the, sorry, that should have been a inverse limit. So the inverse limit is always left exact. However, limits or inverse limits, their derived functor need not banish even if the category is filtered. Finally, we want to discuss co-limits of flat modules. So what we're going to show is that a filtered co-limit of flat modules is flat. Notice that an unfiltered co-limit of flat modules need not be flat, of course. A fairly simple example of this is the fact that any module is a co-limit of flat modules, not necessarily filtered because we can just take a resolution of it by free modules. So for any module, it's a quotient of a free module and the kernel is the image of another free module and these modules are both free and therefore flat. So M is the co-limit of R to the star goes to R to the star. It's a co-limit of two maps between free modules. So the fact that the limit is filtered here is absolutely essential and this is quite easy to prove. So suppose that M is the co-limit of some modules MI. So for MI, MI is flat and this is a filtered co-limit and suppose we want to show that M is flat. So let's take an exact sequence. North goes to A, goes to B, goes to C, goes to zero and then we notice that North goes to A, tends to MI, goes to B, tends to MI, goes to C, tends to MI, goes to North is exact. We're assuming this is exact, of course and this follows because MI is exact and now we notice that North goes to the co-limit of A, tends to MI, goes to co-limit of B, tends to MI, goes to co-limit. C, tends to MI, goes to North is exact and this follows because co-limit preserves exactness and here we are assuming that this is a filtered co-limit. So this is where we use the fact that we're taking filtered co-limits and finally we see that North goes to A, tends to co-limit of MI, goes to B, tends to co-limit MI, goes to C, tends to co-limit. MI goes to North is exact and this is because taking tends to product commutes with taking co-limits. So we've shown that if we start with an exact sequence then tensioning it with the co-limit of the MI is also exact, which means the co-limit of all the MI is not exact flat. Incidentally, there's a converse to this theorem which says that any flat module is a filtered co-limit of finitely generated free modules and what we've proved is that any co-limit of finitely generated free modules is flat. So Lazard's theorem says that a module is flat if and only if it's a co-limit of finitely generated flat modules. I should add a slight warning here that the proof of this theorem in Eisenberg's book appears to have a slight gap in it. So if you want to see a complete proof you can check Lazard's original paper. Okay, so that's enough about co-limits. Next lecture we will probably be discussing limits and flatness.