There we go. We're using Wi-Fi, so nobody get on Wi-Fi right now for a little bit to do Google sites. We'll be all good. Go for it. There's only one demo, and we've got him hardwired. Good morning, everyone. So just a quick intro. I'm glad, by the way, that Diane is in my team, and she knows what my responsibilities are. So I'm Reza Shafi. I come from CoroS. I run the product team at CoroS prior to the acquisition. I've been here now almost a year since the acquisition, and now responsible for the product, along with Joe Fernandez, who's also here. So we run the product teams for OpenShift together. So happy to be here with Chris, who's going to be joining me in just a bit. But before I get Chris on board, just wanted to talk a little bit about why does it matter, at least a perspective on why what we're all doing with OpenShift matters. And to talk about that, I'm going to start. And by the way, we're going to see a lot of tweets here, because a couple of announcements coming up. That's where we're speaking. All right. It's kind of interesting to see it on the side.  Much easier. That's OK. We'll live with that notification. It's going to be good updates for everyone. All right. So why does it matter? And I'm going to go back 15 years to an article that basically said it doesn't matter. And I remember being a young consultant at the time. This article actually had quite a bit of momentum and traction in the industry at the time. And people were talking about how our industry is about to go nowhere. I was actually worried about my career as people were talking about this. And the argument that Nicholas Carr was making was that IT, like electricity and like railroads in their time, is going to become commoditized. And organizations are not going to need IT, are not going to need to innovate in IT in order to be successful. It's just the commodity that you just use. And so let me just get a quick poll from the audience here. Who thinks, 15 years later now, who thinks that Nicholas Carr was right? OK, good. Almost no hand. Good. Well, I would say he was half right. So let's talk about that. I'm just going to look at the last 24 hours for me. I used Uber to go to the airport and come to the hotel. They've definitely used IT to disrupt their industry. And then I have done my expenses throughout this small time with Concur, which, by the way, is a great customer of ours, local here. And again, they have disrupted the way I do my expenses compared to the way I was doing it with other software, let's say, 15 years ago, which was a lot more painful. And then in the airplane, I used my phone to access an array of videos and entertainment from United. And again, that has completely changed the way that entertainment was being delivered in airplanes. And by the way, I was playing around with OpenShift 4. And doing so, I was just accessing resources at the infrastructure level on Amazon AWS. So on that last one, I would like to say, I was accessing those compute resources like commodity. I was getting it like a utility. And so even though in the first three scenarios, I would say Nicholas Carr wasn't right, in the last one, he was probably right. So what's happening here? I think it depends how you look at it. If you look at it from the different layers, from a computing infrastructure to use the words from the article, getting towards boring necessity to operations, computing infrastructure is slowly getting there. But if you go one layer up, the services that we use to build applications today, I think you can see that innovation is still very much alive.  Technologies like EtsyD, which by the way, you're gonna hear more about tomorrow at the keynote, not to spoil anything. And technologies like Co-CroachDB, and the list goes on and on and on. The innovation at the computing services layer has not stopped. And if you go one level higher than that, applications, the applications that we're all building in our organizations that you're building to get your business to be more successful, all innovation has definitely not stopped at that level. And I would venture to say that the same is true for the electricity example that was used in the IT Doesn't Matter article. Yes, it's true that the electrical infrastructure level is getting to be a boring, it probably has been for a long time, a boring necessity to operations. But if you go one level up, you know, I was just at a Starbucks on my way here again, I put my phone on the table and it started charging. That's innovation at the services level, at the electrical services level. And of course, at the appliance level, electrical appliances are innovating all the time. Now here's the difference though, between electricity and where we're going with our applications and computing services. If you look at these pictures, they're pictures of very early electrical appliances. You see a hair straightener, bottom left, a toaster on the right, a food warmer on the top left. And you'll notice something that's maybe a little odd, but common to all of them, in that they've got a little light bulb plug at the bottom. That's because electricity was first brought to the homes for lighting. But then people notice it's just electricity and I can just plug any appliance into it. And so they started creating devices or applications that plugged into the electrical service using that plug. And in some ways that was a blessing in disguise because it provided decoupling from the electrical infrastructure provider. So it didn't matter whether it was Tesla or Edison or whoever else who was coming up with the electrical infrastructure, your applications were decoupled from it. I'm worried that the way things are going right now, because of the trade-offs we have to make every day for flexibility and speed, that is not the way we're going with the application and software world, NIT world. In fact, as we're tying ourselves to the services, to the computing services provided by the cloud providers, whether it's at the serverless functions level, whether it's at the queuing level, they are deeply integrated with the underlying infrastructure. And those are ties that are hard to break. It's like saying your toaster works with the Washington State University or electricity here, but sorry, if you go to San Francisco, you can't move that toaster, you gotta buy a new toaster. And so this is why I think OpenShift matters. If you look at the things we're working on, it's all about getting to a point where you don't have to trade off between that flexibility and the simplicity of the cloud and the diverse ecosystem of services that are out there, the open community that's out there so that they all operate like a cloud so that your applications can be truly portable and move anywhere. And that's really it. And so what are we doing? Big themes, obviously, the OpenShift team bet on Kubernetes a while ago. Looks like a good bet now. And CoreOS was there with them. We're also talking about automated operations and you'll hear us talk a lot more about automated operations. Something that's at the core of OpenShift 4 that brings the simplicity of the cloud from the operating system all the way up. And not just up to the Kubernetes level, but beyond that for the services that are running on it. Services from all the providers that are out there. All the open core and open source services that are out there, not just cloud provider services so that they can act and behave like cloud services. And things like the operator framework are there to do that. And that's another aspect of what we're working on. So with that being said, let me pass it on to Chris Wright, our CTO to talk a bit more about what we're doing along these lines. Thank you. I should start tweeting to Diane and just have a conversation with myself here. Good morning and welcome to sunny Seattle. I personally am from the Northwest and I recently moved to Boston and I can say it's really cold out there and it's sunny, but I actually feel nice here back in the Northwest. So what I wanna talk to you about is some of the things that we're doing in terms of collaboration across communities. A little bit of like technology, say like sneak previews of where we're going and really think about what are we building together? So my perspective is a hybrid cloud is an opportunity to really create total independence for your applications from the underlying infrastructure. And this is something that if you think about Linux and what Linux did, this is something that we've been doing as an industry for quite a long period of time. So Linux created the opportunity to run applications in a consistent runtime environment independent of the underlying hardware. A hybrid cloud gives us that same capability using Kubernetes to do distributed computing and allowing us to place those applications on public clouds or within your own data center, private cloud or even virtualized or bare metal deployment. So that's really I think what we're building and I think that's the most exciting part to me. If you think about what is a cloud, I would describe a cloud as two key things. One is basically ease of operations. You've essentially outsourced your operations to somebody else, run the infrastructure for me. I'm just gonna consume it through APIs. That creates a lot of benefits. It's really efficient way from a consumer perspective to use the infrastructure. Another key piece to a cloud is what I would describe as differing levels of abstraction or ways to engage with the cloud or services that you consume from the cloud. So a cloud isn't just easy to use, but it's a breadth of services. And what I'm really excited about with the hybrid cloud is we have this opportunity to create an ecosystem of services that run on top of a consistent, call it a fabric or whatever sort of buzzword you wanna use a consistent platform for and a community for creating this ecosystem of best of breed services that we can really run anywhere. So one of the things that I think Kubernetes has done a really great job of focusing on is bringing applications, containerized applications, sort of the modern software architected microservices type of applications to cloud environments. We haven't done as much work as a community focused on bare metal. And one of the things that I find interesting is over the last roughly year or so in talking to customers and users, there's this increased interest in running Kubernetes directly on bare metal. So you could argue we've spent a whole long period of time trying to convince ourselves that hardware just doesn't matter. It's irrelevant. It's kind of this homogenous commodity. You just use compute. And what I think is happening today is we're discovering that certain types of workloads can benefit from running directly on bare metal. Maybe it's access to specific hardware. Maybe it's a specific footprint or environment that you need to operate within, like forthcoming 5G environments with mobile edge or multi-axis edge computing. We have really limited footprint. So bare metal I think is something that we're starting to look at more within Red Hat. It's an opportunity for us to do some collaboration and it's an interesting kind of collaboration across communities. We're working in some context with folks from the OpenStack community to do some of the bare metal provisioning pieces and really trying to create a bare metal environment that has that same ease of use fully automated, easy to upgrade that we're building virtualized, especially in public cloud. So to me, this is a new phase for Kubernetes, a new opportunity, a new way to look at what we're doing with Kubernetes to deploy into a new environment on bare metal. Another piece that I think is interesting here is we have an opportunity to think of application deployment as managed by, say, a single cluster manager and scheduler. So we've been working on this project called KubeVirt for quite some time and when you combine something like bare metal provisioning, and KubeVirt, you get an environment where you have containers and VMs as peers and first class citizens that sit right side by side with one another. So the applications that we've spent the last decade building in virtual machines, we don't have to just abandon, we can easily integrate them together in a single environment. Again, managed simply, we talked a little bit, Reza mentioned operators, this kind of ease of deployment. And I think that's a really cool opportunity, it's kind of a converged infrastructure that gives us a place to run applications, independent of the virtualization technology. So kind of a next generation way to look at infrastructure for applications. And I think I already mentioned the performance sensitive pieces, but a great example there is the use of GPUs and FPGAs for machine learning workloads. So there's the machine learning SIG here in OpenShift Commons. And one of the things that we're hearing a lot from users of Kubernetes is, it's a, maybe to put it simply, I think we would probably all agree, Kubernetes is one. Kubernetes is the de facto standard for how we do cluster management and scheduling of applications across Linux clusters. What that means is the entire industry is collaborating and focused on a common platform. And as an example, bringing data-centric machine learning workloads to the same platform is something that we're seeing a lot of interest in. And so things like performance sensitive applications where we want direct access to a GPU to accelerate the machine learning environment, is something that we see community enthusiasm around. And customers are starting to use that as a common building block for their internal applications and infrastructure. So another piece that I think is interesting is initially we spend a lot of time, like how big can we scale these clusters? There's been some scale labs and a lot of blog posts on how many hundreds or thousands of nodes we can scale to. And that's important and it's interesting.  Well, there are some fundamental scaling challenges. There's the question of what does your blast radius look like when you've consolidated onto a single cluster? There's geographic issues as you're trying to spread your applications around the world. There's on-premise, off-premise when you talk about a hybrid cloud environment. So what we're starting to see is more and more interest in running more smaller clusters rather than fewer larger clusters. And here's some examples on the screen of things like edge environments where just by definition you have a lot of different small clusters, maybe direct locality proximity to data, data generation for those machine learning or analytic workloads that are thriving from all the data that's maybe in this example on a remote rig. Maybe it's security and compliance issues, where your data sits, how you partition your application base, access to specific kinds of hardware, so maybe a specialized cluster and using different types of hardware. So a lot of different reasons that you might see rationale behind deploying multiple smaller clusters which introduces a new challenge. Scaling up, well it's hard and it's fun for performance engineering, but we kind of understand what it means from an identity perspective, a storage perspective, a networking perspective when it's one large cluster. When we have multiple clusters we create a new set of challenges for ourselves. So this is an area that has been underway in the Kubernetes community for quite some time. And we are slowly bringing this technology into OpenShift and creating a federation capability that will really allow us to take advantage of deploying clusters where they should go and then deploying applications to the correct cluster over time. And again, we can't trivialize what it means to replicate the data across all the clusters where applications may need to land or what does networking look like in a context where you need to direct to the right cluster, you wanna feel like it's a seamless interconnection across all of the clusters. These are not native functionalities in Kubernetes today. This is how we can advance this state of the art. Already in OpenShift 3.11 we have the cluster registry so you can register a cluster as you bring it online. And we're working towards things like workload placement and policy associated with that so that you can think in terms of, again, from an application developer perspective, how can we ease deployment and have the system take over and push the application to the right location, maybe take advantage of a hardware accelerated environment that your application may ultimately be dependent on to deliver its SLA. So this to me is a view of where we're trying to go with Cluster Federation and we can take a look at a simple use case. Here the developer is using the Federation Control Plane to do the initial workload placement and the initial workload placement was pushed to a bare metal cluster of Kubernetes. Now for whatever reason, it could be policy dependent or point in time doing some upgrades. The developer decides that it's time to push that application to a different infrastructure. So here we're showing something moving the application to a cloud cluster, cloud-based cluster. And what's cool about this is we're pushing the real behind the scenes work into automated routines so that you can specify how you wanna deploy the application and have the system slowly reconcile things like ensure that the data is properly replicated and the application can move to the right location. You get ingress routing to the application appropriately so you're not bouncing all over the place and ultimately our goal here is to make these collection of clusters feel seamlessly independent so that they really look like one large place to deploy applications even though they're managed as separate clusters. So if you're interested in that, we've got a couple folks here. I don't see Paul, he's usually easy to identify. And Ivan, and here's the GitHub repo. We have this demo that we've been working on that shows application portability and it's just a way that you can get directly involved in federation. So some work has already started. The cluster registry is already there but there's a lot of work to do to really fill it out to the full vision of how do we create a completely federated clusters. Another area that shows this de facto standardization around Kubernetes is the work we've seen in the serverless space. So it's not new to the industry, we've been hearing a lot about serverless especially in the context of AWS and Lambda. It's demonstrated some real interesting capabilities of making it as easy as possible for developers to create applications or functional logic. In the CNCF serverless working group, there's quite a few different projects associated with that and where I see the de facto standardization of Kubernetes winning, showing itself is in the Knative project. So this was launched back in July and what Knative is, literally Kubernetes native functionality to support the primitives needed to build serverless environments or serverless platforms. So the primitives of connecting to event sources, building images that will be launched based on those events, scaling from zero and back to zero based on the events associated with the service or function that you're trying to support. These are the kind of core building blocks and we're really excited to announce just today a few minutes ago that we have an OpenShift developer previews of Knative on OpenShift and again this is just the beginning of building an infrastructure that allows you to create functions that run entirely independently of that underlying infrastructure. So the specialized socket that Rezo was talking about and the potentially vertically integrated stack that you find from one single provider is something that we can neutralize and turn into a broad-scale industry initiative using technology like Knative. We've got operators and operators are an example of creating that ease of use that we mentioned in the beginning, what is a cloud? You've heard a lot about operators, this is just an example of a single operator comparing simple containerization through cloud service to operators on Kubernetes which gives you the breadth of availability across many platforms and ultimately if you look in comments there's something like 50 operators and this is a space where we have the opportunity to create that, not the pure ease of operations but also the breadth of ecosystem support for a hybrid cloud vision. So this is something that I think is a really great advance, state-of-the-art advance and it's a place where the ecosystem fundamentally matters. And this to me all adds up to something and I gotta give kudos to Reza for the slide and the quote but it all adds up to something where what we're trying to build is a future vision where it's automated operations. It's so simple to use, it runs like a cloud.  We're really moving in a direction where everything that we do enables machines to manage the clusters and developers to build the applications that are disruptive and really bringing innovation to the industry and providing that platform for really the next generation of businesses and opportunities. So with that, thank you for coming to the comments and look forward to collaborating with you throughout the week. Thank you.


فشرف بل اشتغالي بالعلم ولا تبغي به ما عشت يا دا دا دا لا وياله من شراف عظيم الحمد لله رب العالمين له الحمد الحسن والثناء الجميل واشد أن لا إله إلا الله وحده لا شريك له يقول الحق وهو يهد السبيل وأشد أن السيدنا والنبينا محمد صلى الله عليه وعليه وعلى آله وأصحابه والتابعين لهم بإحسان إلى يوم الدين أما بعد في تصميم الثلاثة بوك تصميم هذه الدورة التي قامت بطبض العلم تصميم العلم قبل أن نهاية تصميم الكتاب القواعد الأربع ومحمد مع عبد الوهب ونقدم الكتاب نخبط الفكر في مصطلح أهل الأثر رتن باي حافظ إبلا حجر العسقلاني يجب أن نقوم بكتاب هذه الكتاب تلاتة الأصول وإن شاء الله today we are going to finish it all بإذن الله الكريم سن أول فإذا ارتيل لك ما ربه فقل ربي الله الذي ربني رب جميع العالمين بني عنه ما هو معبوم لي ليس لي معبوم سواه فالدليل قوله تعالى عود بالله نشيطان ربي مصبي الله رحان وحيم الحمد لله رب العالمين وكل ما سيو الله عالم وأنا واحده من آلك العالم فإذا ارتيل لك بما عرفت ربك فقل بآياته مخلوقات ومن آياته الليل ونهار وشمس ونقمر ومن مخلوقاته السموات السبع ومنذين والأراضون السبع ومن فيهم وما بينكم والدليل قوله متعادة ومن آياته الليل ونهار وشمس ونقمر لا تسجدوا للشمس ولا لنقمر وسجدوا لله الذي خلقه ومن كنتم إياه تعبدون وقال متعادة إن ربكم الله الذي خلق السموات والأضة في سبتة أيال ثم استواء على العفش يغش الليلة النهار يطلب محتيفة والشمس ونقمر والمجوم مسخرات بأمره ألال خنق والأمر تبارك الله رب العالم دي أوصى رحمه الله تعالى كاريون والعدون والدليل قول متعادة يا أجوها الناس أحض ربكم الذي خلقكم والذين من قبلكم لعلكم تتقون الذي جعل لكم الأضة في راشا والسماء بناء وأنزل من السماء ما انفخض به من أفمارات لزقلكم لا تجعلوا لله أن دادر وأنتم تعلمون قال ابن كثيرا رحمه الله تعالى الخالق لهذه الأشياء هو المستحق للعبادة دي أوصى رحمه الله يبدأ أن يجعل أول فاودي من ثلاثة فاودي في التي دي أوثى أول فاودي ومعرفة العبدي ربه ومعرفة رحمه ومعرفة فإذا قيل لك إذا قلت لك من ربك who is your lord فقل respond by saying ربي الله my lord is Allah الذي ربني the one who cultivated me ورب جميع العالمين بنعمته and he is the one who cultivated the whole world the universe with his blessings سبحانه وتعالى so the word ربه is Allah سبحانه وتعالى and from Allah's ربوبية is تربية الخالق الله nurturing the creation with his blessings the external blessings and the internal blessings that Allah gives to each and every one of us Allah gives us external benefits and blessings by giving us children and giving us health and the internal blessings is Allah giving us Islam as a religion and Islam is a blessing وزل الله سبحانه وتعالى in the Quran اليوم أكملت لكم دينكم واتممت عليكم نعمتي ورضيت لكم الإسلام دينا اليوم today I have completed your religion on to you اليوم أكملت لكم دينكم واتممت عليكم نعمتي and I have completed my blessing on to you ورضيت لكم الإسلام دينا and I have become pleased with Islam as a religion for you so this is the internal blessings that Allah gives a person after bringing a person into Islam after coming into Islam there is another blessing within Islam that not many people get and that is the blessing of نعمة السنة which is another blessing within Islam because a lot of people are blessed to be Muslims but they are not blessed enough to be from the people of the sunnah who are holding on to the right path within Islam because as you all know Islam has many deviated groups within it or sorry Muslim sorry within the Muslims today there are many deviated groups and there is only one group who are saved as the messenger told us to be guided and to be blessed enough to be from that group is an extra blessing from Allah سبحانه وتعالى لذلك the Salafu Hadil Ummah they used to say I don't know which of the two blessings should I be most happy with هداني الله إلى الإسلام هداني الله إلى الإسلام that Allah guided me to Islam or that Allah guided me to the sunnah نعمة what they are trying to say from here is is as much as you might see that coming into Islam and being a Muslim is a blessing being from the people of the sunnah is also an extra and an additional blessing some of the Salaf they used to say you have to thank Allah extra for being guided to be from the people of the sunnah you have to feel this blessing just like you have to feel the blessing of الإسلام it's no different الله سبحانه وتعالى He's the one who nurtured you right now that you're sitting here you're breathing your body is functioning your brain is working your eyes are looking and everything that Allah gave this to you سبحانه وتعالى this is blessings He is the one who then deserves to be worshipped why are you going to worship a person who has nothing to do with your affairs who can't run your affairs if Allah سبحانه وتعالى forsaked you طرف تعيني split second split second He left you not to other people but to your own self you'll be destroyed even you can't run your own affairs you'll be confused and you'll be mind-boggled baffled, baffled you don't know وَلِذَا لِكَدَ فَرْفِسْ دُعَا يُسْتِ بِيْ وَلَا تَكِلِّ إِلَا نَفْسِ تَرْفَةَ عينِ don't pass my own affairs to me before anybody else don't give it to me even split second don't give it to me I can't run my own affairs and then the one who runs your affairs like that who controls everything about you look at people who get sick and ill and they go to hospital the doctors try to solve a problem a complication that's happened they're just trying their best الله سبحانه وتعالى he all he has to say is كون بي فا يقول it will become and then that's the one who deserves to be worshipped no one else that's the one you need to be connected to no one else but Allah سبحانه وتعالى is not one that you run to when you only feel pain and suffering and hardship at times of ease and joy you remember him سبحانه وتعالى and that is coming with a شكر ابن القيه mentions 4 things that if a person comes with he has 5 things sorry that if a person comes with he has come with the true essence of what شكر is he mentions it in his كتاب عدة صابرين والدخلات الشاكيرين I advise you guys to go and look for yourselves 5 things is what شكر is if you don't come with these 5 you haven't come with شكر and you are not upon the path of شكر 5 أصول شكر goes back to he mentions that in his كتاب عدة صابرين والدخلات الشاكيرين because many people ask how can I express gratitude to Allah how the author here only mentions and he puts forward to you one of the 5 that the author مل القيه mentions which is استشعار feeling and recognizing that Allah blessed you if you are in a state of denial that Allah سبحانه وتعالى gave you this how you go to show gratitude one of the 5 مل القيه mentions what is the thing Allah blessed you with don't use it in that which is in disobedience of his if you want to show Allah gratitude the eyes that he gave you want to show gratitude to him in his eyes that he's given you don't use it for that which he prohibited you from سبحانه وتعالى and the ears that he gave you don't use it for that which he prohibited سبحانه وتعالى if you use your eyes for that which is in the disobedience to his commands سبحانه وتعالى and your ears then you're not showing him gratitude and you're not a شاكير and that's what the author says و هو معبودي and so because of that he's the one who I worship ليس لي معبودي سبحانه وتعالى there is no one besides him that I worship the author said and then the author mentions the evidence for ربوبية الألوهية ربوبية is in قوله تعالى الحمد لله رب العالمين رب العالمين is ربوبية and ألوهية is what الحمد لله الحمد لله means الحمد praise كائن الله it is for him لأنه المألوه المستحق للعبادة because he is the one who is worshipped the one who is taken as an إله the one who deserves to be worshipped he's praiseworthy سبحانه وتعالى brothers and sisters it is obligated to on each and every one of us to know الله تبارك وتعالى but there's an amount that's needed knowing Allah سبحانه وتعالى is a very general and generic statement knowing الله سبحانه وتعالى a scholar knows الله and an army knows الله but is there knowledge of Allah of both the same? no it's not the fundamental write this down is very important أصول معرفة لله الواجبة the amount that is obligatory on everybody to know Allah about is four things these four things are amount that is obligatory on everybody if you increase on that your connection your bond with Allah becomes more but this amount is obligatory on everybody you have no excuse to be ignorant of Allah this amount the first one is معرفة to knowing وجود Allah's existence you have to know Allah exists سبحانه وتعالى so you believe for you the person believes العبد بأنه موجود الله exists you believe الله exists the first one is معرفة وجوده knowing Allah's existence فيؤمن العبد the slave believes بأنه موجود that Allah is موجود the second is معرفة ربوبيته knowing الله سبحانه وتعالى knowing الله تبارك وتعالى his ربوبية فيؤمن العبد the slave believes بأنه رب كل شيء فيؤمن العبد the slave believes بأنه رب كل شيء that Allah is the lord of everything and ربوبية three things fall under it خالق الرازق المدبر is the خالق is the one who provides for it or the creator sorry the مدبر the provider or the sustainer sorry and he's the Malik the king those are the three that it revolves around the third one is the amount that is obligated for everybody to know about Allah is معرفة أولوهيته knowing الله سبحانه وتعالى is أولوهية and that means that you know الله سبحانه وتعالى فيؤمن العبد the slave believes بأنه در الله تبارك وتعالى هو الذي يُعبد he is the one who is worshipped بحق وحده he is the one that is worshipped alone ورابع هذا the fourth one is معرفة أسمائه وصفاته knowing الله تبارك وتعالى his names and actions and his attributes فيؤمن العبد بأن لله أسماء فيؤمن العبد بأن لله أسماء حسنة وصفات رولة that the slave believes فيؤمن العبد بأن لله and حسنة that the slave believes الله has noble names وصفات علاء and Allah has majestic characteristics the statement وكل ما سوى الله عالم and anything besides الله is an عالم he is trying to do تفسير قوله تعالى رب العالمين and this statement of the author which he says وكل ما سوى الله عالم and everything besides الله is an عالم is a statement that the people who came after Muhammad and Abdul Wahab they took this from him and this to be honest the reality of it is that this has no place in the statements of the Arabs that the Arabs don't use عالم to be everything besides الله that they ever use the word عالمين to be like that the reason like in this came about is those who are known as علماء علم الكلام those who go into philosophy علم الكلام they place two premises two مقدمةين two principles two premises introductions they put in place the first one is الله is قديم الله is old and the second premise is what العالم حادثون and this universe is what it's a starting point this universe is a starting point and الله is old those are the two مقدمة they put in place so what do they may say everything other than الله is an علم so this is a نتيجة عقلية as it's known it's a result of their rationality and how they think لا مدقل لها and it has no place in the world في الإسان العرب in the Arabic language that it means this the truth of the matter is is that everything that exists other than Allah are two types فالموجودات سيو الله نوعان the things that exist for الموجودات سيو الله the things that exist besides Allah are two types there's this author's statement it doesn't show that there's difference between so we're talking about things other than Allah سبحانه وتعالى the things that exist other than Allah the first one is أفراد التي لا نظير لها من جنسها there are things that have no duplicate they have nothing like it أفراد التي لا نظير لها من جنسها there are no duplicate in its essence there's nothing like it in its essence there's no second thing like that it's just one and it's alone فلا يشاركوها غيروها في حقيقتها كلكرسي والعرش والجنة والنار مثل كرسي الله سبحانه وتعالى الله سبحانه وتعالى كرسي is where Allah places His foot والعرش is the throne of Allah سبحانه وتعالى when a jannah to a naar there's no two jannahs there's only one jannah there's no two naar there's only one naar there's no two kursi there's only one عرش there's only one the second one is أفراد المتجانسة أفراد the second one is أفراد المتجانسة which basically means المشتركة المشتركة في جنس واحد they share the same essence are you with me brothers that's the one that is known as عالمين and the Arabs you die when is عالمين and that's like us we all in the same essence also the jinn entered this as well the angels they entered this as well are you with me brothers now say that وكل ما سيو الله عالمون are you with me brothers the Arabs use it for the second one not the first one then the author رحمه الله he mentions فإذا قيل لك if it is said to you بما عرفت ربك how do you recognize your Lord how do you recognize your Lord the sheikh mentions دليل pay attention for knowing Allah سبحانه وتعالى and recognizing him is too the author gives too and he guides you to two ways to recognize Allah احده ما the first of the two is التفكر pondering في آياته الكونية pondering ان الله تبارك وتعالى is universal science and the second one is you want to know Allah do you want to know him وستطريقه for it you have to attain four things remember how can I attain those four things the first one that the author mentions is التفكر في آياته الكونية pondering ان الله تبارك وتعالى is universal science looking at the whole world and how it's made a lot of the times that arguments that I used against atheists the fine-tuning of this universe and how it's fine-tuned this is آياته الكونية the universal science the second one is التدبر في آياته الشرعية the second one is pondering التدبر تبخند في آياته الشرعية ان الله تبارك وتعالى his Quran the verses of the Quran if you look at the author here رحمه الله what did he do? he said آياته ومخلقاته is there a difference between آياته ومخلقاته that scholars they took two two stances regarding this some scholars they said this is عطف الخاص على العمي some scholars they said this is what? عطف الخاص على العمي and that's something that the Arabs generally do which is they take a specific from a general they take a specific out of a general and they connect that specific to the general and we bring many examples of that إياك نعبود وإياك نستعين is عطف الخاص على العمي because إستعانة is what is part of عبادة is it not إستعانة seeking help and aid from Allah is that not عبادة that is عبادة so you took the khas out of the عام قل من كان عدوة لله وملاكة وجيبريلا وميكالا الله says وملاكة وجيبريلا وميكالا جيبريلا وميكائل were taken out of the angels this is called عطف الخاص على العمي it happens many places in the Quran are you with me the reason why many of the times that is done and its importance the ones that are taken out of there are done because of its importance also the hadith is very common حديث of جيبريلا sorry حديث حديث دنيا إِنَّا مَنْ أَعْمَلُوا بِالْنِيَاتُ وَإِنَّا مَنْ يُكُلْنِمْ رِيْمَا لَوَا فَا مَنْ كَانَةِ يِجْرَطُوا إِلَى اللَّهِ وَرَسُولِهِ فَا يِجْرَطُوا إِلَى اللَّهِ وَرَسُولِهِ وَا رَسُولِهِ وَمَا كَانَةِ يِجْرَطُوا إِلِى اللَّهِ وَا يُصِيمُوهَا أَوِمْ رَأَةِنْ يَكِحُوَا is the woman part of the dunya is she not she is why she taken out of the dunya is because of the fitna that the dunya has to men the women are equal in that fitna as well are you with me صح وصد حديث of the prophet صلى الله عليه وسلم he said ما تركت فتنة أضر على الرجال من اللساء صح فتنة so it's equal the women are equal to the dunya in fitna to the men some scholars they say what it means is that the woman is the ultimate goal for men and he only uses the dunya to get the woman whereas the woman is opposite the dunya is what she likes and the woman demands the stepping stone صح some scholars they said that that's why women they like what do they like flashy stuff are you with me if the brother's back pocket is not swollen he's in trouble brother صح his back pocket has to be swollen in order for even a meeting to be placed between him and his father صح are you with me now the diaries are becoming serious the system might say as it goes on I'm going to put myself on a weighing machine you have to pay that much gold so the author why did he why did he break this the two from the two some scholars they said others scholars they said no it's not the Quran slightly used them differently it used it differently and he will bring them the verses if you look at the examples when Allah SWT he spoke about the day and the night the sun and the moon Allah used the word ayat when Allah spoke about السماوات السبعة and the أراضيل السبعة Allah used مخلوقات and the author is trying to observe the usage of the Quran are you with me then the author he brought three verses he brought how many verses the author brought here three verses قوله تعالى the statement of Allah لخلق السماوات والأرض أكبر من خلق الناس that's the first evidence he brought and that brothers shows that shows that the creating of the سماوات and the أرض is bigger than the creating of the human being the human is nothing compared to the سماوات and the أرض the second is ومن آياته الليل والنهار والشمس والقمر لا تسجدوا للشمس ولا للقمر وسجدوا لله اللذي خلقه إن كنتم إياه تعبدون and the third verse that he brings is what the third verse he brings is إن ربكم الله الذي خلق السماوات إن ربكم الله الذي خلق السماوات والأرض في ستة أيام ثم استواع على العرش until the ending of that verse and then the verse mentions in it الله mentions يغشي the word يغشي means a يغطي is to cover something حثيثاً means سريعاً حثيث means سريع when something goes fast مسخرات means مذللات الله made this earth دليل humiliated for you you can just move on it you put your foot on it you jump on it مسخرات means when something is made easy for you it's working for you الله humiliated his his world for you that it serves your need and then you go and you worship you worship besides الله سبحانه وتعالى then the author رحمه الله explained and expanded that the Lord of all of that is the one who deserves to be worshiped and that's why he says والرب هو المعبود والرب الله is the one who deserves to be worshiped سبحانه وتعالى and he brings the آية for it يا أيها الناس عبود ربكم عبود is what worship we mentioned yesterday when you open the مصحف today and you read the Quran سورة الفاتحة the first أمر that comes in the Quran from is عبود ربكم there's no أمر before that that is the first أمر عبود ربكم and that is to show you how serious and how important it is that one knows the importance of عبانة then the author brings the statement of يبنو كثير رحمه الله يبنو كثير is the great scholar who commented on the Quran he's got a تفسير book he said تفسير of the آية يا أيها الناس عبود ربكم he says the creator of all of this هو المستحق للعمادة is the one who deserves to be worshiped محمد يبنو عبد الوهاب alone is an إمام and he's alone a scholar he could extract that ruling by himself why does he have to attribute to يبنو كثير for it shows you that the scholars they quote the scholars and they attribute things to those who preceded them in it he could have just said that sentence by himself and he could have left it there what did he choose to do attribute to one of the إمة of this field الله سبحانه أسأل إبنو كثير رحمة الله تعالى نعم


Greetings everyone. My name is Russ McCree. Thanks for coming, sticking around. Mike Bailey on my right. We are unfortunately for some of you guys who are already here talking about CSERF very specifically and very targeted attacks against multiple platforms. There's certainly some crossover from the fine performance you saw just prior to us, so we apologize for that, but our mission with this discussion is more to point out how very specifically this attack can be used across so many interfaces, so many platforms, so many places, and how incredibly inherent it is to most web apps. So there is some repeat. I apologize for that, but I think you'll find it. We'll try to skim over those parts. Yeah, exactly. We won't tell you how to fix it, we promise. We won't tell you our employers, but in case you know, please don't attribute any of this to them. Carry on. All right. Basically the gist of this talk is that CSERF is bad stuff. It's a very underappreciated vulnerability, and it's all over the place. Because it usually gets rated as a pretty minimal issue, it almost never gets fixed, and that means that we have these kinds of holes all over. Spacebar. Spacebar. Okay. I'm not very good at this computer thing. All right. So in case you didn't know, in case you weren't at the last talk, basically a cross-site request forgery is making a user do something that he didn't intend to do, usually against another site. Okay, always against another site. Well, all right. If that user is an authenticated user on that other website that you're attacking, you can use it to escalate privileges and perform actions that he didn't intend to do. There are other attacks you can use that don't really have anything to do with the session or the authenticated user, but we'll get into that later. Yeah, one of the key concerns again is that, you know, okay, surprise, surprise, 90 plus percent of websites have vulnerabilities. Yes, we know. The reality is, though, certain things that can be fixed, certain things that can be done to prevent are so rarely done, and when the impact, in particular, to CSERF attacks is so high, we believe that it really actually borders on negligence, and while that may be somewhat counterintuitive, we think that there's a responsibility here in site coders and providers that really, for reasons of millions and millions of people at risk, we think should be fixed, and Mike, in particular, has got some very, shall we say, some exemplars to prove that point. So we have, I would argue, it's never ending. We're going to try to limit what we talk about here today. There are some things that we can't talk about that will be coming out, say, next four months, probably about accurate. Well, I won't even describe what they are, but suffice it to say, the impacts are larger than imagined with regard to anything we're going to show you today, but nonetheless, I think this stuff proves the point, particularly when it comes to wormable stuff and or just flat out, in essence, compromise of a system right up to admin. Alright, let's roll this move along. Okay, cross that request for a drink. It still works. Alright, we're going to show you how to prevent it. We'll breeze through that because that's not interesting here, but first of all, we're going to show you what you can break with it. Alright.   So everyone clicks links, yes, we know. Mike can tell you in particular to the extent that somebody obviously clicked a link, i.e., the CEO of Strong Webmail, and it cost him $10,000, which Mike paid for this trip with. Explain, that's probably worthwhile. It's worth a beer, too. I have beer. Thank you, Trey Ford. So my mom's going to watch this video later, and she's going to be pissed. Mike's additional skill is that he actually brewed this beer. Alright, so Strong Webmail. This is a fun story. I was just sitting on my computer one day, and on Twitter, some people were passing this link around to StrongWebmail.com. They were having this contest that if you can hack into our Webmail, you get $10,000. And a couple of us were just passing the link around joking about it, like, yeah, that's not going to go well. Then Lance James, if you're on Twitter, he's XSS Exploits, he says, you know, let's go ahead and do this. Let's sign up for an account and win this money. And I'm like, okay. So Lance bankrolls it. He pays the $5 to set up an account. Thank you, Lance. Yeah, and once we set up an account and logged in, within the first minute, we found a cross-site scripting holes. Where were they going? Alright. Once we had the cross-site scripting holes, it was just a matter of coding a payload and figuring out how to get it to execute. We weren't sure if the CEO of the company actually checked this email account. We figured it was probably just a dummy account set up because we didn't really think they were playing on paying. And so we sent in the cross-site scripting hole we found that it involved injecting HTML into the subject line of an email. And when he'd view it in the email web mail client, it would execute and own his account. We had to figure out how to get him to look at this email because we didn't think he actually logged in. So what we did, we set the subject to that email to, we said, hey, we think we've won. Who could resist clicking on that? So we're watching the logs as soon as he hits that, the payload executes, and we got all the information we needed to win our 10 grand. So while that's not really a cross-site request forgery story, it's a fun story, and it demonstrates our next point here. Quick tools, the thing about tools is you can do this either manually, whatever you want, any kind of proxy mechanism. I prefer tamper data. You like SAC bar, for IE heads, there's Fiddler, all the same thing. See the parameter, break the app. Like the McAfee Secure app. Sorry, James. McAfee Secure, this is one that hit, it was in the news I think in May. I published some cross-site request forgery holes in the McAfee, actually it's McAfee I found out last night. You pronounce it McAfee. But I found some cross-site request forgery holes in their McAfee Secure application, which you use to scan websites and find vulnerabilities in websites. So I was using this application actually, and I noticed that it wasn't, we'll get into the protections a little bit later, we'll go through that quickly, but I noticed it wasn't protecting against this stuff. So I coded it in a payload and I set up an exploit so that if you hit my evil website and you're logged into their account, I add myself as an administrative user to your account and then I can scan your website for vulnerabilities. And so it's just kind of ironic having that in the McAfee Secure portal. I actually have screenshots from it. Basically I just described what happens though. Every user set up on this account, you hit my website, has an iframe, I've got the URL there, the basic idea is add user dot whatever. It loads that up in an iframe, adds my user, and shoots me an email with my temporary password. So this is completely blind and zero knowledge attack. If you're logged in, I get an email with an account password. All right. Obviously the McAfee implications are many and scan whomever, whenever. However, it gives you another subset of vulnerabilities to play with. Linksys, this one was something that I stumbled on because I actually have this device at the house. No, it's not available to the internet. And ultimately when reporting it in a brand new WRT-160N internal device, Linksys said, and I quote, I apologize if you guys are here anywhere, I can't reasonably prevent CSERVS without bogging down our code. The compromise we made here is to have a timeout on the web interface so users are logged out after 10 minutes of inactivity. We also advise users not to click on suspicious links while logged into the web interface or close the web interface as soon as they're finished completing the router. They claim this language is on the site, I've not seen it, I did go looking for it. And obviously none of these mitigations are particularly useful when it comes to breaking things, which I will show you. So, here's logging in with my known good account. Hope you guys can see this within reason. You can see that my current password is, I'm a doofus. And of course we'll let me in. And there we are. So in classic attack form, well first the form itself, it will ultimately force the account to change its passwords to really doofus. And we'll do that through the classic social engineering attempt. From your friends at Linksys, please log into your router and upgrade now, which inevitably somebody will always click. And you'll find that in fact, now if I log back in as if I were the attacker, I'll be doing so with the account that the CSERF script forced. Which isn't again really doofus. Now this is an attack on one network device, one router. When we started looking at this kind of thing, we found out that almost every web application we look at has these kinds of holes, especially the ones that are sitting on your internal network. And everybody thinks my internal network's safe, nobody else can get to that, except for your browser can get to it. So, I think we have a few more examples, other devices that sit on your internal network that are vulnerable to this kind of attack. Netgear on my, I know, much on HATES blogs, I understand. On my blog, just prior to DefCon, I did a Netgear attack. I won't bother you with it here, but it's very much the same thing where we were able to force the remote management interface on where typically it's off by default and immediately change the access port as well in a fashion that had made it somewhat visible, not only to me, but to any bots going by. So, somewhat interesting. Other infrastructure devices though, I mean think about it off the grid. It's not just stuff that's available to the internet, right? Think about it from an intranet perspective and the, shall we say, you know, evil attacker on the inside. Who uses Ubuntu? How many of you use transmission for your BitTorrent client? How many of you would tell me if you did? This has actually been fixed in the current version. I don't know if it's been fixed in the current version in the Ubuntu archives or in there. But I was talking about this a little while back on my blog. For some reason, transmission has a web interface built into it, the latest version of it does. It just came out recently. And this web interface is enabled by default, but only accessible to the local user. So I honestly don't know why this is even needed because the local user obviously has access to the regular application. But at any rate, the local user can access this web interface. This interface is vulnerable to cross-site request forgery. So if you hit my website, I can force you to create requests to your own application on <IP_ADDRESS>. And it will change, I can change the directory, you're downloading all your files to, and then I can force you to download a file of my choice. So I actually was, while I was testing this, I accidentally changed the directory to my main root directory, and I downloaded a file that overwrote the whole thing. So it works. It works really well. And I'm glad I have backups. Self-surf. All right. This is a fun one. ESPN.com. I think that it's a very highly ranked traffic site. I think it's like number 14. I don't know if it's in the U.S. or overall, but is that overall? Okay. Until recently, they were vulnerable to both HTML injection and cross-site request forgery. This makes this little perfect storm for an exploit, that you can have a site performing cross-site request forgery against itself. So it's not really cross-site, but same principle. And what you can do here is you can actually worm this thing without any client-side scripting at all. So if you think no script is going to save you from this kind of attack, you're dead wrong. Basically, by creating these requests back to this site itself, we can add this HTML code to any profile of any user who views my profile, and we can propagate this payload across the entire site. So this one's someone interesting. It's not that broadly used in application, but where it's used is kind of what's fascinating, because it includes things like MCI. It's very European in nature. Securitas, Red Cross France. And in case you wanted to know anything about the missile defenses of the Bilgin Defense Agency, this is one way you could actually lift the data. They have missiles, apparently. They do have two missiles in Belgium. That's right. Case one broke. So... So just a calendar. They use it as a learning portal for folks to go get training inherent to the organization. But what's rather amazing is that it's vulnerable to CSERF, but it's also vulnerable to script injection as well, so you can then drop all kinds of evilware in there if you wish. Kudos to our friends at XSS.org. I promised I might say hi. And at the end of the day, it's very simple. There's nothing to it other than pushing a frame, pushing whatever content you want into the calendar, and then anybody coming along in the general context of a session, they do not need to be authenticated, can be instantly owned as needed. So obviously, not much good. And then OSCommerce, this one... Okay, so surprise, surprise. Web apps that are feeding customers and websites, particularly for shopping carts, etc., are broken. This is obviously a well-known, perhaps quite obvious, statement. The issue we took with it is the fact that OSCommerce alone, and this is not an exaggeration, we figured current installs is about nine million and change. Unfortunately, again, discovered while picking on McAfee Secure, because literally two-thirds of these sites are branded McAfee Secure. Indicating, in fact, that they might not be. I'm checking Twitter right now. Yeah. Sorry, guys. So this one's interesting, and particularly because of credit card, we're going to work on the admin account. I'm logged in as admin currently, and I will fall victim to an attack. One of the things I want you to see first and foremost is the fact that Fred Flintstone's account does, in fact, include his credit card. Nice. In case you're having a difficult time funding this little adventure, that's a real number. Kidding. So we trick Fred into stepping on board and adding an admin user. Frank is now an admin user thanks to the script we've thrown at him. I log in, as Frank, with my handy-dandy account. I go back to Fred Flintstone's account, which is now visible to me, and I, as the attacker, now own his credit card. So, again, all through very fundamentally simple C-Serve attacks. The thing that's frustrating here is, and I believe Sean in the last talk, is that we walked in with saying this, is that everyone assumes C-Serve's about get, right? These are all post-attacks. These are all circumstances. So when we talked about that, and Mike and I were chatting, we discovered that, oh, no, that means there's another problem. Zencart was forked off of OS Commerce a while back. It's basically the same code. Well, it's been changed a lot since then, but it's built off the same code base. So we found out that it's vulnerable to the same thing. And that gives us another 7,330,000 sites that are vulnerable, which gives us a grand total of 16 million some websites that are taking credit cards and storing data, and vulnerable to the cross-set request forgery. And this isn't a minor vulnerability. I mean, you can add admin users to any of these sites. That's a big deal. An even bigger deal, in my opinion, is C-Panel. C-Panel, if you don't know it, it's an administrative web interface for mass-hosted servers. Let's ask the question. How many people here have a website? Come on. How many people here probably use a website with C-Panel and a hosted provider? You're all lying. Look at you. There's so many more of you out here. What's the problem? All right. The WHM interface, the web hosting manager, it's vulnerable to cross-set request forgery. If you're logged in as an administrator or as root on this server, which people do, because apparently you need to manage your web server through a web interface, if you're logged in as root and you hit my website, or you hit any website I control, I can do anything I want. I can reset your root password. I can upgrade software. I can modify any setting I want. I can suspend, unsuspend accounts, through the WHM interface. That's scary, and that's bad. What's even more scary was the response that I got from C-Panel. Do we have that here? We have a video. We like video. The response that I got from C-Panel was we can't fix this because it's a feature. Apparently they're worried it's going to break integration with third-party billing software, so they can't fix this vulnerability. And so we have literally millions and millions of web servers that are sitting there ready to be rooted, and C-Panel won't fix it. They do have a cross-site request forager protection feature. It doesn't do much. It checks the refers. This is actually, I can't pause it. What it does is it checks the refers of the request that's made to the server, and it makes sure that either comes from its own server, so you can't do it across sites, or unfortunately a lot of people don't send refers. In fact, there's an RSC that states that if you're on an SSL server, you don't send refers. So they have to obviously accept requests that don't have any refer at all in the browser, in the request header.  You want your video? Yes. Now, there's plenty of other ways to strip of refers if you are worried about this, but the easiest way is just to bounce somebody through an SSL encrypted site. And that's easy enough because there's plenty of SSL encrypted sites that have open redirects on them. There's plenty of them that have other issues. So cross-site scripting, anything I want, I can make this request to your web server and root your SSL server. And in this case, I'm actually throwing a cross-site scripting thing, but that's actually a different demo. That's a different talk. But that was just me getting root access on that server.  Which ones? There's a lot of annoying things on my mind. I know. Amazon, eBay. Oh, boy. A lot of people aren't thinking about it. The classic example of the cross-site request forgery is either, you know, owning somebody's bank account, transferring money to your account, or doing the privilege escalation through an administrator who's got access to something. But there's a lot of sites that just they just take any request you send them and they do things with it. And it turns out you can actually do a lot of things that they don't want you to do. An example of this. Amazon.com Whenever you're browsing through the products on Amazon and you come back to the site later, you'll see all the products you've recently viewed, or a few of them, and they're there to try and sell you more products or try and sell you something you already bought. But if I can make you use that site using, or not view it, but request the site with the cross-site request forgery, next time you come back to Amazon.com, you're going to see any product that I want sitting in that recently viewed items box. And that may not make a whole lot of sense. But with the money that people spend for advertising, putting something on the front page of Amazon, that seems like that would be a big deal. It also works with eBay. There's a recently viewed items box there. If you're using, I'm trying to remember what it was, there's actually a handful of them, but there's a handful of major e-commerce portals where I can actually stuff items into your shopping cart using cross-site request forgery. So if you're looking through your shopping cart and you're wondering why you've got these products sitting in there, you may click on them, you may look at them, and you may buy them later. I mean, if you're looking through your shopping cart, and you may buy them later. Either way, it's good advertising.  But there's also the issue, then, of forcing somebody's history to change. If I can manipulate your search history, think of all the fun things I can do with that. Again, I can use it for spamming, or I can stuff your search history full of links to whatever product it is I'm trying to sell. What if it's worse than product? I mean, there's legal implications here, too. That's kind of what we're trying to drive at. If you think about the ability to force somebody's history to basically contain people have been prosecuted based on their search history before. That's exactly right. So if you want to really hose somebody, and something is in particular, certain search engines are vulnerable to the ability to force that. This is a side note, and Russ doesn't know I'm going to talk about this, but he works for an evil corporation. He happens to have your search history displayed whenever you go to their major search portal that just apparently came out a little while ago. It has a search history, and I can stuff it full of links to whatever product I want to sell, or whatever malware I want to sell. I mean, if you want to buy malware, or just download it. Don't know what you're talking about. I will. Misconceptions. So Mr. Sullivan over at Black Hat, is talking about URL rewriting as an option to fix this. I would by no means disrespectfully disagree, but to some extent we take issue with that. Obviously, the majority of the things that people think should fix this issue don't. Thoughts there real fast? We've gone amazingly fast, which is unfortunate. Well, we could just talk later. Where are we going? Where are we going with this? Just basically. Some things that actually do work to protect against cross-site request forgery, and I said I'd get into this later, but a captcha is basically forcing the user to manually do something and do it on purpose in order to make a request. Another... You go ahead and take this one. I'm not thinking straight. You okay? I'm a little bit wired. I had a lot of coffee this morning. The issues around captchas, of course, is that they're most often broken, number one, and often they're two. A captcha itself might be based on a token, and if that token is repeatable, obviously you pass it once, you pass it again, and you're through. It's a very simple, shall we say, bypass and doesn't really work. The most important fix of all is a unique token. But again, how strong a unique token are you using, number one, and are there now, all of a sudden, magically in the last four weeks, attacks that will even compromise you there through CSS history? Do you want to clarify that one? I can clarify that one. Are you clear headed enough for that? Okay, so this is an attack that came out just a lot... I think about two weeks ago. Well, the CSS history hack is a well-known hack in security industry. Basically what it does is it uses CSS to find out what links you've visited before. So it colors a link blue, and then it checks the link to see what color it is. And if you visit it, it'll be a different color than if you haven't visited it before. And theoretically, it's not all theory. You can use this to compromise a cross-site request forgery protection token by just brute-forcing that token and see... You just generate a whole bunch of different options and you see which one works. It doesn't work so well if the token is not hard to predict, if it's long, and if it's randomly generated, it doesn't work very well. So the point I'm trying to make is to make sure that your CSRF validation tokens are cryptographically secure. The final thought on it, too, is that even there, particularly as a DDWRT, that router, no protection in the world was even implemented on it, but ultimately at the end of the day, you didn't even have to be logged into the device because the checks were so insecure. So ultimately, you could via ICSRF attack own the device without any mitigation in place at all. So a lot of it comes back to secure development practices, which we're not going to get into here. And unfortunately, we flew through this thing, so that's kind of it. We can open up to Q&A if you want here. I can have Mike go on forever. But really, it's up to you guys, sir. The reality is unless better development practices are put in place, say again. I'm sorry, you're right, absolutely. So the gentleman said that in particular with regard to things like do-not-call lists for marketing, that the more prevalent web applications become as services for marketing, services for tracking, services for analytics, etc. If they're in fact not coded properly, mitigated properly that then attacks against privacy, you're going to be even more and more stringent. I think really the thing to look at for us is too, what does it mean in the now cloud or SaaS? I mean, there's so many buzzwords now where they're putting everything out in the internet or in the world. And again, I find so often that they're not protected, so it really is an issue. There's a mic over here, so can you pop that mic on, boys? There you go. Good. In inserting browser histories, forcing browser histories into unsuspecting users we have people in this country being prosecuted criminally for the contents of their browser history in part. Mike, would you care to comment about what type of forensic trails you're believing when you're injecting someone else's browser, well, false browser history into an unsuspecting end user? The really tricky thing about this attack is that it really can be completely anonymized. I can inject these cross-site request forgeries any website that I can put any HTML or a deep-linked image in, MySpace. I can put a link in MySpace to an image on another domain. There's no way you're going to track that back to me personally. You may possibly be able to track it back to MySpace, but who doesn't browse MySpace? Nobody does anymore. From a forensic perspective, it's very difficult. In the context he's talking about, it's one of those things where, you know a user executed something and it's attributable then to that user, but if that's not the actual user who did it, because he was forced, the only forensic trail you might have is if the back-end of the, shall we say, the system he's using, the social engineering site, pick it, if they're tracking IP access, but even that's not going to get him anything because it's coming through.  Another really interesting attack that I actually was going to talk about, but I didn't is using cross-site request forgeries to make other people perform attacks for you.  Yeah. You make it so that it, you know, lock up the server by just pulling a huge database query, something like that. If you have, oh, if you have file injection holes, which are really still pretty common in web applications, but you don't want them to see that, you know, I don't want somebody to see that it's me making these requests, that's fine. I can just put links to it in MySpace, somebody else will own the site for me. I can inject scripts, I can perform all these attacks, I can do SQL injection, I can do it all through cross-site request forgery, have somebody else take care of the dirty work for me. Again, none of which attributable or victim, so. From the standpoint of forensics, you modify the search history, you're not placing the data from those locations, so I would have a hole from something that I actually went to, search history to data that's not on the drive, so it might be the essence of data being missing, cache data being missing that I might look at, is that true, or is modifying the search history placing those, the actual, your access of those you are making the requests with cross-site request forgery.  It visits the site, if I load this page up in an iframe, you make the request and you'll load any images inside the site, so it looks like completely legitimate browsing as far as the user side goes. Although in the case of the browser history attack, if you force something into somebody's browser history, that they may not have visited, is that a fair analogy? In that case, if they haven't visited it. That's what I was talking about. One of the points there is that the trail may stop at the history file that says it, but if you truly are a good forensic investigator and you haven't dug in... My index.dat would tell me... I went there, my cache would tell me there's this hole. That's right, and so there are theoretically some gaps, but again, it's the quality of the investigator doing it and certainly would be enough to cause you significant problems, but yes, a good... Russ is the one with the forensic background, so... Oh, absolutely, yeah. I mean, if you do it through any of the known anonymizers, it's the worst. I mean, theoretically, you've compromised somebody's box and you make requests through their box via C-Serve.  Sir. Hi, I was a little bit late. I don't know if I missed this, but did you mention any client-side protections that people in this audience might use to generally protect themselves? That's a good question, actually. As far as client-side protection goes, there's not a whole lot right now. There's some really cool stuff coming, though. NoScript just added some... Everybody here uses NoScript, right? Yeah. NoScript just added what I believe is called the ABE, the Application Boundary Enforcer. It's a feature that forces... It basically protects different zones on your web... on your web browser. So I can't... My application can't make requests to your local internet zone or to your local machine. It's very good. It's not quite 100% yet, but it's coming, and I really like it. Another thing that's coming up, Mozilla just announced that they're putting together... It's... I'm forgetting all the abbreviations for things, but I think content... Just tell them what it does. Framework, policy, something or other. Basically, it's a feature that it does the same thing, only way better. You're... This is all opt-in, so if my website... If I send a header back saying protect my website, don't let any cross-site request forgeries happen. Your browser won't make any request to any outside domains at all, and that is what... It's exactly what we need. The problem is that it's opt-in, and if it wasn't opt-in, it would break the entire internet. But it's the single protection. It's something you get, but again, if you believe it such that it's opt-in, it's something you don't have to use in Dustball Victim. Right, thanks. I appreciate the mention of NoScript's ABE, but I have to... Because you didn't plug this for me, I figured I should mention I'm actually the author of a Firefox extension called Request Policy. I don't know if you've heard of that one, but that one... I owe you a beer. That one would actually protect against just about everything you mention, across-site. That's a different issue in that sense. But other than that, of course, this means someone has to install the extension, be running Firefox. This is not something that you could propagate and have developers use on their website to protect users everywhere, but for those in the audience, that's something. Definitely look it up, because it's good stuff. That's Request Policy? I was asked to repeat it, yes. So, dude, come see us. I apologize for not knowing of it, but I'd love to talk about it. No, no, it's pretty new, actually. I just wanted to see if you could do that. No, good. Come up later. Another question? Have you done any Cross-site Request forgery jumping out of a sandbox, like using multiple browsers, or if I have IE and Mozilla open and I'm doing my open surfing on IE, but I'm doing my quote-unquote secure surfing in Mozilla? Cross-site Request forgery... I mean, by nature, using a browser and exploiting the browser. I have some ideas. There may be stuff coming. We'll see what works. So, I do have some stuff I've been meaning to work on there. It's walking by. Anyone else? Alright, we'll give you some time back. We appreciate you guys coming out, everybody. Thanks.


Three out of three Grand Slams. Novak Djokovic is one of the Wimbledon men's single championship defeating Mathieu Berettini of Italy 6-7, 6-4, 6-4, 6-3. The victory gives Djokovic the world's top ranked tennis player his 20th Grand Slam singles title, tying him with Roger Federer and Rafa Nadal. Just as important, it also gives him his third Grand Slam title of the year and positions him to become the first man in more than half a century to win the calendar Grand Slam when he contests at the US Open later this summer.


This review describes the current state of knowledge on the use of naturally occurring compounds from plants, known as phytochemicals, in cancer therapy. These compounds often act by regulating molecular pathways involved in cancer growth and progression, such as increasing antioxidant status, carcinogen inactivation, inhibiting proliferation, inducing cell cycle arrest and apoptosis, and regulating the immune system. The authors emphasize the potential drugability of phytochemicals and highlight recent trends and gaps in phytochemical-based anti-cancer drug discovery. This article was authored by Amit S. Jodhari, Pulavisi Mandave, Manasi Deshpande, and others.


We had this plus complication. Just run it now. This is a simulated EEG. This is a simulated EEG. I'm trying to do fuzzy logic analysis. It will be away from the detector meant to have this scroller. So the idea is that you have this baseline EEG. Yeah, the temperature looks legit. Go about 0.3 plus minus 0.3 and then you will have a big EMG artifact every now and then. And we should have the fuzzy logic being able ideally to detect it. So I'll say what's the probability of EMG in the signal is based on these parameters. So we're designing a Flask application. So the Flask application, we have some, we already did a couple of sessions on it together. And we already have some code. We have a HTML file, a JavaScript file, a Python file, that is the Flask application, and a CSS file as well. Okay, the couple of issues. There are couple of issues with the code. Can we make sure the scroller actually works? Because currently, the whole waveform is shown. Well, this one did something. It made the window of the chart smaller, but it's still displaying the whole data. So I'm not able to actually scroll through it. Okay, this works better. Now, we also would like, can we double check that we actually generating the EMG artifact, the chewing artifacts? And because later we want to have them in the data while scrolling through. So essentially, we'll need this, we'll need to generate a longer data set with the EMG bits embedded into it. So we can scroll through. And later for the fuzzy logic algorithm to mark to give a percent likelihood for EMG in the signal. Okay, I tried this code. It seems, is it all EMG now? And there seem to be no baseline EEG in the data. We need to correct this. Also, can we make sure the window of the chart remains the same size and fits into the window on the front panel? Okay, this is better now, but the EEG looked better before. It looked more realistic before the last update of the code. The EMG, a periodic EMG in the code in the data looks great. So we have begin at zero at false settings for the ticks, which is scales, a few scales. Why can zero false? And we have these ticks. All right, we need a coma. And no, that didn't come on. It's not about the ticks, it's about, about, and now it's even worse. I don't see any of the data on the chart. Is it about the ticks or the auto scaling of the whole window? Okay, we need to redo this chart. The chart, there's a lot of problems with it. Can you, can you regenerate that bit of the code? Yep, understood. Let's rebuild the chart configuration with a focus on ensuring proper visibility and auto scaling of the data, particularly on the Y axis. I'll provide a revised version of your chart setup in JavaScript that should help address these issues. Key adjustments. Canvas width. The canvas width is set dynamically based on the data length. This is crucial for the horizontal scroll bar to work correctly. Chart type, type, line is appropriate for EEG data visualization. Y axis auto scaling, the Y axis is configured to automatically adjust its range based on the data. The begin at zero is set to false to allow the chart to scale based on the data values. Autoskip, max ticks limit, and autoskip padding are set to ensure that the axis labels are readable and not overcrowded. X axis configuration, adjust the X axis settings as per your data's time scale. Responsive and aspect ratio, set to false to disable automatic resizing. This setup should provide a more reliable and clear visualization of your EEG data. If the data is still not displaying correctly, it may be necessary to check the format and range of the data being passed to a chart. Please test this configuration and let me know how it goes. If there are still issues, we can explore further adjustments. Yeah, we definitely need to explore more adjustments. It still doesn't work well. There are also issues with the axis not being visible. The data being outside the visible range on the Y axis and also the EEG signal label text is moving with the scroller, whereas I'm expecting it to be stationary in one place. Yep. Yep. To address the issues you're facing with the EEG chart, let's refine the chart configuration further. The main objectives will be ensuring that both the X and Y axes are correctly scaled and visible, keeping the EEG signal label stationary while allowing the data to scroll, properly fitting the data within the visible range of the chart. Here's a more detailed approach. Y axis autoscaling, we need to ensure the Y axis scales correctly to fit the data. If the data goes outside the visible range, it suggests the autoscaling isn't functioning as expected. We can try a different scaling strategy. X axis configuration, if the X axis is invisible, it may be due to the canvas size or the chart configuration. To keep the label stationary, you can use a separate element in your HTML for the label, positioned outside the scrolling container of the chart. Data check, ensure the data passed to the chart is in the correct format and range. Canvas size, verify that the canvas size matches the amount of data you're plotting. Browser rendering, sometimes issues can arise due to how different browsers render content. It might be worth testing in different browsers. Test this setup and let's see if it resolves the issues. If problems persist, we may need to delve deeper into specific aspects of your implementation or consider alternative charting solutions. It's always easy to blame the browser rendering. I do not want the label outside the chart. As it is, it's okay. I just expected not to move, always be in the same position within the chart. We make sure the waveform, the data is centered within the chart is centered on the Y axis. Yep. To keep the EEG signal label stationary within the chart and ensure the waveform data is centered on the Y axis, we need to adjust the chart configuration. The goal is to modify the chart's Y axis scaling and the placement of the label. Let's tackle these issues. To center the waveform, we need to adjust the Y axis range so that it dynamically fits the range of your data. We'll calculate the maximum and minimum values of your data and set the Y axis limits accordingly. To keep the label stationary, we can use a plugin in chart. JS though allows us to draw custom text on the canvas. This way, the label remains in a fixed position within the chart area. Here's how you can implement these changes. The Y axis is dynamically scaled based on the data's range. Custom annotation, static label, is added using chart. JS is annotation plugin. You might need to include this plugin if it's not already part of your chart, JS bundle. The label remains stationary within the chart. This configuration should center your waveform data on the Y axis and keep the EEG signal label fixed within the chart. Please test this setup. And if there are any further adjustments or issues, let me know. And no, I do not see the label anymore. And also the data is not centered. I expect the signal, the waveform, the data waveform to be centered around zero and also zero to be the center of the chart in terms of the Y axis. Can we update the CSS code as well? The waveform is still not centered and the label is not in a fixed position. In a different browser. Yes, pretty annoying. It's different in terms of the scroller, but it displays the same. The waveform is still below the visible area of the chart. The waveform is still below the visible area of the chart. Nothing works. We need to adjust anything else as well for this to work. It's the current CSS that I have. Can we keep using the color palette for the project everywhere? Not use any other colors. Also, I'm still having the same problem where the signal is not centered in the middle of the chart. When I remove the EEG chart container code from the CSS, it is working okay. So that's probably going to be redone. Okay, it's working better now, but the chart is too high and it doesn't fit the current window. How do we fix that? Okay, adding this bit seem to have made the trick and it's not working much better. Fantastic. I'm glad to hear that adjusting the maximum height for the chart did the trick and that it's now working better for you. It's a bit odd that it has this sinusoid. It regards the EEG data. It's a bit odd that it has a sinusoid as a baseline EEG. It doesn't look realistic. Here are a few suggestions to improve the realism of the generated EEG data. Baseline oscillations. Ensure the baseline EEG oscillations reflect realistic brainwave frequencies, like alpha waves around 8 to 12 hertz, beta waves around 12 to 30 hertz, etc. The amplitude and frequency should be within realistic ranges. Noise and artifacts. Really EEG data often contains noise and artifacts that are not perfectly periodic or uniform. Consider introducing random noise and varying the artifact patterns to more closely mimic real-world signals. Signal complexity. Really EEG signals are not just a single frequency sine wave. There are mix of several oscillations from different brain regions. You could layer multiple sine waves of different frequencies and amplitudes to simulate this complexity. Use recorded data. If possible, consider using segments of real EEG data as your baseline. This data can sometimes be obtained from open source datasets if you do not have access to actual EEG recordings. Here is an example modification to the data generation code that introduces more randomness to the signal. In this example, the generated EEG signal is a mixture of alpha and beta waves, with some Gaussian noise added to simulate a more realistic EEG signal. Remember, the key to realism in synthetic data is complexity and variability. Try tweaking the parameters and layers of your signal until it visually resembles the complexity of a real EEG waveform.


to 32C3. Unfortunately, this is the last time I'm going to say this. I feel honored to present you Karina and Linus with the closing event. To be fair, nobody wants to do the closing event. You want to start? Especially not us. So we want to recapitulate on some of the ideas that we had for this event. And the first question I would like to ask is, who of you complied with the 6-to-1 principle? I didn't. But it's quite some of you. I'm proud. A little special effect. Just blew the show. Not much sleep. I think that's the main problem for the most of us. At least I really could use some more. And to one of the reasons for so little sleep, which we all got, is that some of you really appreciated our new concept for the bathrooms and saw the possibilities in that. Okay, please. I think just possible if you don't have gender-based toilets enjoyed there and party there, at least for a little while, because it was really hard. See three events? There's one rule that has never been changed. And that is, before you take a picture, please ask people for consent. And for several years now, we have somebody here that is constantly being asked for consent to take a picture with this camera of people. And that is one of the little highlights from my end of this event. Which happens at Congress, is this size, is people lose their stuff. It's a person. Okay, that's something we didn't knew. And I think most people not. Because everybody was sorting who lost his shoes.  There's a lost and found. You can grab your stuff there. They will be there after the closing event for a little while afterwards. All the stuff goes to the logistics area. So perhaps your friend is also there. Somebody brought him there. Yeah, as we thought, shoes is not the only thing which went missing. There's also this in person. Seriously. Okay. I wouldn't recognize. I wouldn't recognize. Yeah, so if you miss something coming back to the serious part, go to the infodesk and ask if they found it there. It's much easier to give it back from here than to have to ship it somewhere all through the world. They have some IP packets left, but you must prove that it's yours and not spoofed. You came up with a couple of challenges. Among them, a challenge to every third angel that I witnessed last night. I think this goes without more saying. As you remember, our little challenge. We have not prepared a price because we wouldn't think that anybody would be able to print this. And the way it is, it was impossible. You see the fleeting lines somewhere and I think 3D printing is just not there yet. But I think there's somebody in the audience that would like to present their attempt in 3D printing the logo. I need to buy you a beer or something. I really don't think anybody would be that crazy. It took 18 hours to print that thing and that was the time and effort trade-off to make it until 7 today. So it would be here for the closing ceremony. Yeah, we brought you the whole video. So I don't know, existed a whole video for somebody who wants to enjoy the whole thing? I don't know. Something we also talked about at the opening was the angels and I heard that when we showed you the logo and especially the URL, they had a peak on their web server. Very nice. In total we had, can you give me the number? 1350 active angels. Angels did more than 15,000 work hours up to now. Proud to say that we topped the number from last year like I wished at the opening. What I learned afterwards is that already during the opening we had topped the number from last year.  Very nice. Yes, but even if Congress comes to an end and this is a closing, it is not over. There's still a lot to clean up in the whole house. So please, if you go out here, help wherever you can. You don't need to be an angel for that. Just ask where you can help, pick up stuff, collect things. There's really much to do and everyone from us wants to finish early so that we can go to the after party tonight. One little request from the cleanup team, please don't just help in a way that you think you're helping. Please ask the app at heaven what exactly it is that you could help with. We're going to do a little exercise. No, no sports.  And I want you to now be totally silent, close your eyes and lean back in your chair.  In the front of your inner eye you see, release the tension from your left leg and you release the tension from your right leg and you breathe in. Remember when you first arrived at CCH and fairy dust was there, waiting for you. Remember when you saw that talk you had been waiting for all the time. Remember when you did not get into the talk you wanted to see, had to watch a different one and it was so awesome. Remember when you first met someone you only knew from the interwebs. Remember when you had your first tasty drink in the lounge. Remember when you were getting ready to leave, met someone and suddenly the sun came up again. Remember when you had two hours of sleep, one meal and six showers. Remember when you learned something that you thought you would never understand. Remember when you saw the joy in the eyes of a little kid that was soldiering a robot. Remember when you finally found that awesome sticker you had been searching for all day long. Remember when you saw all the cool children toys and were jealous because they were all used by children. Remember that funny shirt this one person wore. Remember when you took an involuntary nap during a lecture. Remember all the inspiring, funny, thoughtful and nonsense conversations. And now please take the feeling you have right now and keep it in your heart as an infinite source of energy. And now we want you to release this energy to thank everybody, not only for their work at Congress, but also throughout the years.  One, two, three! The crisis again from him. Why? To call him there. I'm not worried. We are a very active employer. Why? In some areas of our house you can do what you always wanted to do, but you are not punished. For example, telecommunication. A press conference was called on and he said that the Justice Minister was in charge of the independence of the justice. You can also translate that. In the sentence, please leave me in peace, Mr. Justice Minister. Then I need a crisis number from you. And why? Please understand that I don't want to give an answer to that. In some of these answers I need a crisis number from you. In laughter and in crying, I say thank you very much for this great closing event.


Fire Missions! Tonight we're going into our illumination, this is about your munitions, this is our illumination rounds and those are used to help illuminate the battlefield for the maneuver unit and so we'll be shooting some IR illuminations, such as infrareds, regular illumination rounds, we'll be shooting illumination rounds, IR illuminations, infrared and regular illumination rounds to light the night sky for the maneuver element. This is my first command and it's always learning experience, I'm learning how to take care of people while also accomplishing the mission because this battery, everything that falls under it is my responsibility. So I was 2-1-2-1 a few years ago, Elger episode, so this is like a nice mission for me to go back with the maneuver element but we're going to be shooting for them, they'll be the ones doing their sticks lanes and that's when they practice doing their maneuvers while we will illuminate the sky for them to see what their objective is. I want to say God bless America, thank you, I'm glad to be here, hi mom, dad and all my family and I'm proud to be an American and glad to be here, I said it, I can't say it too many times, go on.


Chapter 3 – Health and Safety All dead bodies should be handled with safety and respect. Following a disaster, there is often fear or reporting that dead bodies will cause epidemics. This is a myth. Generally, dead bodies do not cause epidemics after disasters due to natural hazards, where the victims die from injury, drowning or fire. However, there are of course some risks to body handlers and the general public following a disaster. Dead bodies that are the result of highly infectious diseases like Ebola, cholera or Lassa fever, or of disasters where diseases are endemic carry some risk, as coming into contact with infected body fluids from the dead can infect others. Taking safety precautions like basic hygiene and the appropriate use of personal protection equipment or PPE, using body bags, field bags or culturally appropriate shrouds and the cleaning of facilities and vehicles can reduce this risk. The environment itself can also be hazardous. It's important to know when it's safe to enter an environment and when it should be avoided. Finally, body handling can be a difficult emotional experience to endure. Psychosocial support and debriefings should be in place for body handlers, as it's an exhausting job and many responders also face stigma in the communities. As always, the bottom line is to prioritize the safety of the living and treat the dead with care and respect.