What's up everyone, it's Hicks here and welcome back to another video. Today we're going to be talking about Grand Theft Auto VI. Let's get right into this. So GTA VI is currently in development and is likely a few years away from being released. In September 2022, footage from GTA VI was leaked and it showed a male and female character robbing a diner and evading police. Rockstar stated that they were extremely disappointed that footage from the unfinished GTA VI was leaked but that they were going to be continuing developments as planned. It appears GTA VI will be set in a modern day vice city but reports suggest that it's going to be a smaller game than GTA V was. Now as of right now there is no confirmation as for what that means whether it means that the map size is going to be smaller, what is going to be included in the game is going to be a lot less or the overall length of story mode, right now there is no confirmation. Rockstar has noted that they will expand and add things to the game after launch with future updates and expansions. However they have not clarified whether or not they're going to be adding stuff to story mode in the future after it is released. With GTA V the only updates we received over the years was mainly for GTA Online. It added a ton of vehicles, weapons and more ways to earn money online. On GTA V once I finished the story mode I mainly only focused on the online portion after that. It will be interesting once the GTA VI is released, once story mode is finished if they will add stuff to story mode in the future with future updates. That will honestly give people a reason to return to story mode once they do complete it but I do feel that GTA and Rockstar as a whole is focused more on the online portion because they do get a lot of sales from shark cards as well. As of right now Rockstar hasn't officially announced anything everything that you do see online is either fan made or as of right now just rumors. I keep seeing online a lot of people commenting saying what is taking Rockstar so long and a lot of people are assuming since GTA V was released in 2013 that since then they've been working on GTA VI and that is just not the case. They've been working on a ton of other games and working on huge updates for GTA V not only for the PlayStation 3 but also for the PlayStation 4 and now currently with the PlayStation 5. The past 10 years they've been focused on not only GTA V updates but also working on other games as well and the reason for this is because they've been making a ton of money off of GTA V they didn't in my opinion need to even start creating GTA VI because they're still making a ton of money off of GTA V. A lot of people are buying these shark cards to get in-game money and buying the shark cards so they can purchase everything that is included in the new updates instead of grinding out because on GTA V there definitely is a huge grind to make money and with every new update that comes out everything seems to on GTA online to get more and more expensive as the years go on. In all honesty GTA VI has just started production around 2020 so expect to see a few more years before GTA VI is released. As of right now they've only been working on GTA VI for the past couple years and if you remember back when GTA V was released that game took five years to create so expect roughly five years of it being in production for GTA VI before it's released so if the time frame is correct with 2020 being one around whenever they started creating GTA VI expect by 2025 GTA VI to be released. Now with that being said hopefully within the next year Rockstar starts announcing some more stuff maybe they announce and drop an official trailer or at least announce the release date I think at least if they were to either do one or both of those either just give the release dates or also giving us an official trailer or at least some gameplay or something that will get fans hyped and hopefully shut a lot of people up as far of everything that is happening with GTA VI because as right now most of the stuff you see online is just rumors. Now when you look at GTA V and you compare it to previous games from Rockstar GTA V was a lot more advanced it had better graphics better in-game mechanics and overall was a more modern day feel for GTA and I hope that GTA VI even exceeds my expectations as far as how it is now because remember GTA V was originally released in 2013 it is now 10 years later so hopefully a lot more things are updated in-game. Hope you guys enjoyed this video I'll keep you guys posted on any official news from Rockstar pertaining to GTA VI comment down below what you guys want to see in GTA VI and I'll see you guys in the next one please take care peace


As a general rule, the only way to find the value of a trigonometric function is to use a table or some calculating device. But every educated person in a free society should know a few things, like how to distinguish between evidence and anecdotes, how to distinguish between coherent, logical arguments and meaningless 140-character tweets, and the exact values of sine, cosine, and tangent for certain angles. And so we have the following results, the values of sine, cosine, and tangent for angles of 0, 30 degrees, 45 degrees, 60 degrees, and 90 degrees. So the sine of 0 is 0, and the cosine of 0 is 1. The sine and cosine of 30 degrees is 1 half and square root of 3 over 2, respectively. The sine and cosine of 45 degrees are both equal to square root of 2 over 2. The sine and cosine of 60 degrees, square root of 3 over 2 and 1 over 2. And the sine and cosine of 90 degrees is 1 and 0, respectively. Now there's several noteworthy patterns in this table, and one thing we can do to make these patterns a little bit more clear is to rewrite all of our numbers in a similar format. And notice two things, many of these numbers are over 2, and many of these numbers have square root of something in them. So let's rewrite them, 0 is the same as square root of 0 over 2, 1 half is the same as square root of 1 over 2, and 1, well that's really square root of 4 over 2. And so our sine values form this nice progression, square roots of 0, 1, 2, 3, or 4 over 2. And our cosine values go in the opposite direction, square roots of 4, 3, 2, 1, and 0 over 2. Now, you should remember you should memorize these sine and cosine values. You should know the tangent values as well, but since tangent is sine over cosine, you don't need to memorize the tangent values separately. Once you know the sine and cosine values, you can calculate them. Now 30, 45, and 60 are all angles in the first quadrant. What about other angles? For those, we can take a look at the reference angle. We look for the right triangle. The important thing to remember is that the reference angle determines the length of the opposite and adjacent sides of the corresponding right triangle. So it determines the magnitude of the sine, cosine, and tangent. However, the sines are determined by the sines of the x and y coordinates. And this suggests that we can find the sine, cosine, or tangent of an angle by finding the reference angle, determining the magnitude of the sine, cosine, or tangent, and adjusting the sine of the sine, cosine, or tangent. For example, let's try to find the cosine of 135 degrees. So the first thing we want to do is to find our reference angle. Since 135 is 180 minus 45, we can rotate by 135 degrees by making a half-turn counterclockwise, that's 180 degrees, and then rotating back by 45 degrees. So our reference angle is 45 degrees, and 135 degrees is a second quadrant angle. Now let's look for the right triangle. Now remember, cosine is our x-coordinate, the horizontal distance. And since our reference angle is 45 degrees, our horizontal distance will be the same as the cosine of 45 degrees. So pulling in our table of exact trigonometric values, we see the cosine of 45 degrees, square root of 2 over 2, is this length. And finally, since theta is an angle in the second quadrant where the x coordinates are negative, then the cosine of theta must be negative. So cosine of 135 must be negative square root of 2 over 2. How about tangent of 210 degrees? First, again, we can sketch the angle of 210 degrees, and we see that we can get to it by making a half-turn counterclockwise, 180 degrees, and continuing on for another 30 degrees. So the reference angle is 30 degrees, and the angle is in the third quadrant. So again, we look for the right triangle. Since tangent of theta is y over x, and both x and y are negative in the third quadrant, then tangent of theta will be positive. Our reference angle of 30 degrees has a tangent of 1 over square root 3, and so the tangent of 210 degrees will be the positive version of that number, 1 over square root 3. How about the sine of 660 degrees? And so we notice that 660 is more than 360. So we might say that 660 is 360 plus 300. Now, what can we do about this 300? Well, we could make a movie. More usefully, this is almost 360. In fact, it's 360 minus 60. And so this says we can rotate 660 degrees by making two full counterclockwise turns, and then turning back 60 degrees. So the reference angle is 60 degrees, and the angle is in the fourth quadrant. Again, we'll look for the right triangle. And remember, sine is the vertical distance. Since sine of theta is the y value, and y is negative in the fourth quadrant, sine of 660 degrees will also be negative. So our reference angle 60 degrees has a sine of square root of 3 over 2, and so the sine of 660 degrees will be the negative of that value minus square root of 3 over 2.


Here is a rig I am using today Going out to eat for dinner with friends. I just realized my pocket gimbal has no batteries What I have going on here is the Canon Vixia HFR 800 You can see it's turned on Using an L brackets and not actually using the adhesive cold mentis showed in a previous video I have a little Elanze camera light off to the side on this cold shoe and up the top here. I have the Comic a track shot. It's got a gain meter here What I've actually done is used manual always better to use manual levels with an external mic on the Canon Vixia HFR 800 so I haven't manually dialed into 32 and I'm just keeping an eye on the Levels here on the screen and this is what it looks like from the front So nighttime little rig here. I could do the other way around with the Light on top and the microphone off to the side, but I've gone for this predictor config


for another video for Artjoy of Sharing for May 2020. Now this month, because we've all been staying at home for the past couple of months, and if you don't know why if you're watching this in the future, Google Spring of 2020 or just Google 2020, you'll figure it out, trust me. Anyway, we've all been staying home, so I've been trying new and different long-neglected forms of creativity that I have laying around. I do still love color. I love my watercolor. In fact, my watercolor tools are on the table over there because I need to work on them this week. I love lots of different kinds of art. One of the things that I do love and I always go back to, and I never seem to completely get rid of, is needle crafts. I started out doing my creative journey doing needle crafts, and it continues to be a running theme periodically in my work. My grandmothers, both on both sides, were seamstresses. On my dad's side, I am second generation American. My dad's family is from Italy, and they all embroidered and crocheted and tatted, and so hand sewed, hand stitched things, and I was a kid that had trouble focusing and sitting still, and so today I would probably be diagnosed with something, but anyway, we won't go there. I digress. One of the things that all of them always did was get me to do something creative because that seemed to help and seemed to help me focus. It still is true today. I frequently go back to my roots and go back to stitchery. I do love fabric. I do love stitching. Lately, I've been doing what they call slow stitching. These are three of the many pieces I've made. Hey guys, so we are in my, one of my spare rooms. This is the art reference library and the completed works library. FYI, I do have one of those. There you go. So I realize as I'm editing the clip here for our drawing of sharing, I'm missing a clip. Lately, I just, you know, I'm blaming it on Corona Brain, whether that's accurate or not, but I'm having issues remembering to turn on the camera. I don't know. Anyway, slow stitching, at least to me, is a form of fabric collage and it's a combination of hand stitching and embroidery and beadwork and I'm really enjoying it a lot. I do have, I was showing or had it on the table. You saw this piece. This is one of my finished pieces and it's worked on a piece of yellow felt wool, felted wool and it's got beadwork and trims and silk and distressed fabric. This is another one in the base for this one is a piece of an old quilt. Obviously Citrus inspired with some beadwork and stitching and ribbon embroidery. This is another one and this has a piece of my machine knit embroidery, machine knit, holy cow. Machine machine embroidery canvas pieces. I think I'm sold out of the Etsy shop at the moment, but I do sell them when I have them.  So I just wanted to quickly pop in here and say that yeah, so in case for those that don't know, slow stitching is basically hand sewing, hand sewing, embroidery. I add beadwork to them frequently and you know, you can put yo-yos on it and you'll see when we get started on the little piece that we're going to do today. There's some really good reference, one in particular reference YouTube channel. I will link in the description below for you all. And yeah, if you have any questions, comments or concerns, leave them down below and I'll be happy to answer them if I can. If I can't, we'll find out what the answer is together. All right, back to the video. Okay, so generally when I get started, I have sort of a color theme or design, general design in mind. So I go through my selection of materials and notions, buttons, threads, and I pick and pull things that go along with that theme. I generally don't have an idea of what I want the completed design to look like, but I usually have some sort of color theme or something in mind. So I have pulled all of these different things from my stash. I do have my scrap fabric bin. I don't know if I'll need it, but I have feathers and strings, seashells, charms, buttons, yo-yos, a bag of lacy, textured trim, some distressed fabric, some fabrics in the sort of blue color themes that I want, including one that's a fabric that I printed using my home printer with some of my artwork on it, a piece of felt for the back. So I generally like to work with something like felt or cotton batting or a piece of an old quilt or something as my back piece. I've got some silk ribbons and yeah, we're going to speed forward through my process where I select the pieces and pin everything together. I will show that to you when I'm going to speed through it and I will be right back. And you'll see that I have things mostly pinned together. I did take a still shot of this piece as it is right now in case I forget where things go because to start the stitching process, I have to unassemble what I've done. So I'm going to take this one out, put it up here. I have, I picked a word to sew on here more often than not. If you've been following me for a while, you know, my work has generally got words in it somewhere. Now sometimes how I pin things are so that I can do this without taking things completely apart. What I will do is move this pin just a little bit. So that it's more like this. And I can flip the lace back. I can flip this piece back and I can stitch this on. Then I can flip this one forward and stitch this on. Then I can flip this forward and stitch this on. Got it? Okay. So we're going to flip these back. I'm going to grab because I don't have a wonder clip near me. Why don't I have a wonder clip? It's a little small clip. Hang on. All right. Got my clips, got my reading glasses. I think we're good to go. All right. I also have my tiny scissors. We are going to use just a plain needle and thread to sew this on. You can use embroidery floss. This is button silk buttonhole twist. You can use ordinary thread. You could glue it together. There are some fabric loge artists out there that just glue things together. I like the idea of hand stitching. It's a slow meditative process for me and I usually turn on some music in the background and I'm good to go. So what I will do is move this pin out of my way. I'm going to start with just a simple running stitch.    Do it a couple times and pull the needle like that. It doesn't matter if your stitches aren't perfectly even. For me, I like things to be rustic and uneven. As you notice, the fabrics are not hemmed. I do trim them out sometimes. I'm going to be doing some edging on one of my projects this week sometime, but usually I leave them just unfinished. So just go all the way down. You could go this way. I'm choosing to go the long way. Move this pin out of the way. Try not to poke yourself. And then when I get somewhere near the end where I'm happy about ending, I'm going to go from here from the top and I'm going to go down out the back. So I have one row like that.  It doesn't have to be in the same spot where you ended. I definitely usually like my rows to start and stop in slightly different places, but basically you're going to do the same thing and go back the other way. So I'm going to finish that. I'll fast forward through the process and I'll be right back. I wore a little blue piece after I was done with this one and I did the same kind of running stitch only. I just went the opposite direction between the stitches, the thread color, the thread texture, and the fabric color and texture. It just gives more interest to the background of our finished piece. Now we're going to add the lace. I'm going to switch up the stitches a little bit. This is some more buttonhole twist. So the gray was a silk buttonhole twist as is this one. This is another silk thread, but this is just a regular sewing thread. You don't have to use silk. Use regular thread. Use what you have. If all you have is one of those little trouble sewing kits, that'll work. All right. So I'm going to do a cross stitch. So I'm going to come up here. First I'm going to zoom in a bit. There we go. I'm going to come up here in the lower left corner. I'm going to push the pin out of my way. I'm going to go about a quarter of an inch away in the upper right and go down. So I've got a slanted stitch. Then right under that stitch where I went in, about the same line as where I came up that first time, I'm going to come up and then I'm going to go down. I'll make a little X, otherwise known as a cross stitch. So we're going to attach our piece using cross stitch, our lace piece. It'll add some interesting texture to the finished piece. Your X's is don't all have to match. Mine generally don't. They're usually all different sizes. Once you get a couple of them in, then you can take the pin out and the fabric's not going to go anywhere. So I'm attaching the yo-yo. I've got a few stitches in. So I'm coming up through the back, catching a little bit of the yo-yo fabric, and then going back down just outside the yo-yo and doing these little tacking stitches about a quarter of an inch apart all the way around the yo-yo. Bring it up to the camera. So oops, where are we? We're going to come up. I'm just grabbing a couple of stitches there. And then we're going to go right here. My stitches barely show. Yours can show more than mine. They can be closer together. They can be farther apart. There's no wrong way. Just get that yo-yo sewn down fabric. Or I'm going to try anyway. I'm going to go up through the bottom again. I'm going to go down about a quarter again, a quarter inch, right? I'm going to go about a quarter of an inch away. Come up through the bottom. And then I'm going to go back down where I came out on that first stitch so that we have what looks like a constant row of stitches. It's called back stitch. So up in the front, down in the back. So like running stitch, only you're filling in all the holes instead of leaving a space. You don't have to do this. You can just do a running stitch to attach it down. And of course, you could do this on machine. Maybe you don't have any interest in hand sewing. Some of these little pieces would be fiddly on the machine. So once again, once you have a few stitches on, take the pin out because at some point the pin just is in your way. Okay, we've got our yo-yo on, our butterfly on, our background fabrics on. Now we're going to decide about the buttons. I'm going to grab my needle that still has some gray thread on it. And I do think we're going to put these buttons on. The question is, do I want them here? Do I want them up here? I think I want them up there. So let's get this blue one on first. You don't have to be crazy about doing a million stitches to attach this button because again, we're not putting any stress on this. We're not washing it. It's not going to hold anything together. But if you're doing this and the button is going to be part of the closure of the journal cover, of a journal cover, then you probably want to put more stitches than I'm doing. This video is supposed to be about favorite things. And one of my, as I look for the hole for this button, one of my favorite things to do when I can, which I can't right now, is to go thrifting and antiquing for vintage sewing supplies, thread buttons, notions, and use them for projects like this, fabric collage type projects like this, and other mixed media applications, rather than buying new things. It's not only a little easier on the budget, but you get interesting things you can't find in the store anymore like silk buttonhole twist. Okay, so that's done. Now before we do anything else, I want to figure out where to attach this word, which I think I want to have down here in like the lower ish right corner. And again, I have a little bit of this gray thread left. So I think we're going to use that. Okay, now you could call it quits and attach it to your piece of driftwood, but we're not going to do that.  Now you don't have to do this part, you don't have to do any of this, but I think seed beads are fun to work with. They are challenging. You can use something bigger than the seed bead, of course, I'm going to get out my supplies and I'll be right back. Okay, now this next part's definitely optional to embellish your work. I know I keep saying that, but seed beads are not for everybody. Maybe you want to add beads, but you don't quite want to go this tiny, you don't have to. So I've selected some colors of beads that I think will go with my piece. Of course, you can see on my tray, this is a cafeteria, sorry, this is a cookie sheet, I usually use a cafeteria tray, but I don't actually know where it is right now.  I've got some vintage pearls from an old broken necklace and some different just random parts, some safety pins, some hooks, some new, some vintage pieces that I've sort of been working my way through as I'm doing my slow stitching. Every now and then I'll clean it all off and put things away, but for right now I'm leaving things on here and I'm finding that I'm occasionally going to say the pearls or something else to use. And I'm looking at this and I might use these three vintage blue, funny, funny blue beads on this piece that we're doing, that is a definite possibility, so we'll leave those out. Anyway, okay, so the first thing we'll do is we'll go to each one of our colors of seed beads and take out a little bit of a spoonful, this is a baby spoon. And I've got some thread that's intended for beading and a needle that is like thinner than a hair. It's difficult to thread, especially without my reading glasses on. I can't do this without my reading glasses on anymore. I don't know, they should have these kind of supplies at Michael's or any other craft store near you. They can be difficult and challenging to work with, but the results I think I think are well worth it. So I'm going to show you some basics here. So right away as I was making this, I looked and I saw I heard a bead, random bead. Okay, I thought I really kind of want to embellish that butterfly's body, so I'm going to come up with my needle with my thread on it at the bottom of the butterfly's body. And I'm going to grab with the needle while it's hanging like this. Can you see that? I'm going to grab three or four of the darkest color of bead I have out here. And I'm going to go, I don't know, about a quarter of an inch away, the length of the three beads. And I'm going to just stitch them down like that. Then I'm going to go back up near the top of that last bead and grab three more. I usually work with threes. I don't usually do four, but you can. It's up to you. And then pull it down. There you go. And that will enhance the butterfly's body. Something like that.  And then I'm going to tie that off again. All right. I'm going to go up through the center of my yoyo. There we go. I'm going to grab white, blue.  Now some of those bead colors are going to sink down into the yoyo, which is fine. I'm going to go up again. I usually do this twice inside of a yoyo just because sometimes the bead colors sink down in there and always see them all. There we go.  And then, so I like that, I want to put beads in the middle of the buttons too, which you can also do. So I'm going to go up, pick a button, go up through the hole. I'm going to pick the white, the blue, and the light gray and then go down the adjacent hole following the way I stitched the button. Okay, we're not done with the seed beads yet, but I was going to put some more beads on there and then I thought, I want to do the butterfly's antenna and I want to make this a flower and put a stem on it. So we are going to do that with some embroidery. I have some gray embroidery floss here. It was leftover from another stitch. I'm going to come up from the bottom near the head of the butterfly. Then I'm going to hold my thread this way. I have the sharp pointy part of the needle facing my fingers. I'm going to wrap the thread around the needle four times. I'm going to go up here and go down. I'm going to kind of hold everything with my thumb and pull and one antenna that's called a pistol stitch. I'm going to take another piece of the same color gray thread and I'm going to come up down here at the bottom and we're going to do a back stitch stem up to that yo-yo. Kind of curve it a little bit. It doesn't need to be a straight line to end in the same place. So I'm going to take this one up a little higher. Otherwise it ends in the same place as that one. I don't find that visually as interesting. Remembering some of my composition work from being a painter, which is one of my other favorite things. Some of those same theories and techniques apply no matter your medium. I just like creating little pieces of artwork, whether it's painting or stitching or whatever. It doesn't matter. Okay there I'm going to stop there. Start down here and I'm going to take a light gray bead, a blue bead, and the big bead. As soon as there it is, as soon as I find the hole it's a bead. There we go and then a white bead. I'm going to attach them all in a clump like that. We will do another one and we will do a blue bead and then a white bead. Now you could do all of your embellishments on here with different embroidery stitches. Of course you could. I usually find myself doing a combination of a few embroidery stitches and some beads most of the time. I don't think it needs anything else. So now we have our piece of driftwood. I have some sort of thick cording thin rope. I do have some like feathers and things but I don't think I want to use them. I don't think they fit on here. I mean they would work but I don't think that's what I want to do. So I think I'm going to just take my cording without poking myself, which I obviously failed at, and do at least one stitch like this and then tie it off. So it hangs nicely. I love that and I love the texture of the frayed rope and everything. So that's slow stitching. My adventures in slow stitching, it's one of my favorite things. There is a reason why I haven't gotten rid of over the years lots of my stitching supplies and embroidery things and while I did purge the excess bulk at times I did keep the majority of it and there's a reason for that. I just love fabric and stitching and needlework. I do love paint and watercolor too and I will always keep those also and I'm currently mulling over in my mind watercoloring on fabric. What would that look like? That might be some future videos. So anyway what are the things that you love? What are your favorites? Maybe it's something you haven't done in a long time or at least in a while. Dig it out of the closet and give it a try. I'd love to know what it is. I'd love to have you share. Let's start a conversation over an art joy of sharing. The link to everyone else's videos is in the description below and the link to the art joy of sharing Facebook group is also down there. So I would love to have you share your adventures with slow stitching or what other sorts of favorite arts and crafts that you're up to at the moment. That's it for now. Don't forget to check out the video descriptions on your favorite creators here on YouTube and also ask over in the Facebook art groups if your creators have a way to support the free content. Most of them do. Here on YouTube we put it in the video description over in the Facebook art groups you might have to ask but we all usually have a Nazi store or an Amazon affiliate link or a PayPal tip jar or something. We would appreciate the help so do ask if there's a way and if you can we would appreciate that.  Do something nice for yourself because you deserve it and I'll see you later. Bye guys.


Hi there, welcome back to my YouTube channel Daniel Rossell here. I'm going to do another OBS video This one is very cool. Very very cool pulse effects is essentially a mixer effects Engine all that kind of good stuff for OBS for pulse audio. So if you use pulse audio on Ubuntu then This will basically allow you to take things to the next level in terms of effects and in terms of basically at least from the equalization standpoint, which is extremely useful So I'm just gonna bring that a little bit over here and how to install it in Ubuntu 1804 So there's instructions and it tells you all the kind of goodies you will be able to get once you have this installed on your machine Now what I will be doing is I'm going to be trying to post pulse effects on to What you are listening to which is my lab mic coming into OBS And therefore using it in conjunction. So I I'm going to put myself down to let's see I'm gonna put myself on the top right hand side of the screen and pulse effects is Hopefully it is actually locked. So you've actually been if all has gone. Well, you've been listening to me via pulse effects Up until this point, but this is what the toggle does. So if I toggle that off, I don't have pulse effects running Now there's much more to it than that. This is a pretty beefy program As as programs come for Ubuntu. So there's a lot of stuff to be digging through here. For instance in the main menus you have Start service a login toggle process all outputs toggle process all inputs toggle. These are very very important Spectrum show the spectrum give it different colors Gradients spectrum colors spectrum type bars or lines Pulse audio very very useful. So For the microphone, I'm locked in here to the My USB lab, which is exactly what I want. So that's good. And I can also set a latency here And the outputs locked to my analog stereo and I can blacklist applications So again, this is a really bringing more application level control than you're getting in the default pulse audio Yoke now, let me show you through the so One kind of crucial thing not to miss see here just on the top left of the screen where you have so you want to make sure that you're You're editing the right input here So like this is I put and the microphone source will bring you over to input and I can see until I hit obs We're not gonna be getting seeing exactly what's going on, but wait for the magic moment. Oh, look at that All the levels are moving all the frequencies are moving And now what you're listening to is being processed through pulse effects. So that's how easy it is quite cool So, um, yeah, I'm just gonna leave it on actually and show you everything this thing can do Not everything now. I haven't gone through a lot of it to tell you the truth Or I don't think I will use a lot of it. Nevertheless, the fact that it's there is very very cool so Let me just show you highlights some of the standout features and you can listen to me sounding a little bit ridiculous at times Multi-band gate and gate and I got to be honest. I don't know what these do. I I do not use these now you can apply audio filters in OBS studio and My guess would be that you probably shouldn't use audio filters when you're doing this Now, what would be the advantage of this the obvious one from the couple of Videos I've done so far. Well, if you're editing your filters in OBS studio Go in right click on audio source edit filters Just keep this open extra OBS and so much easier to make these modular adjustments on the fly, right? WebRTC looks quite useful. So there's a few tools in this Starting here with the echo cancellation. So let me enable it now So now you're listening to me with the echo cancellation turned on. Do I sound less echo-y? Now you're listening to to me with it turned off. My room is actually quite echo-y. It's very very much not treated for acoustics. So Maybe that'll work high-pass filter on high-pass filter off Suppression level is on high dialing down the suppression level to low No, you suppressor gain controller compressor and voice detector You can look up what all these do online. I'm guessing this locks into my voice a little bit So, um, don't forget that if you leave them ticked you're going to be Keeping that that effect applied. So I'm gonna actually untick this now And just verifying I'm going through OBS limiter is there too. So you can So this is me speaking without any limiting and I'm changing the Trying to change the how loud I'm speaking to and I'm watching the level meter bounce about of it on OBS But let's see if I click on automatic leveling and let's see has that made any difference And now I click on automatic smoothing control and I'm now varying as much as I was almost but it looks to me as if the Leveling is actually becoming a bit smoother. So that is quite cool And you've got all these different controls here again beyond my pay grade I'm just looking at the basic things that think this thing can do. You have a compressor multiband compressor filter and The equalizer so I'm going to look at the equalizer is this is very important. So multi-track equalizer. I'm just going to push up the some of the base levels here and I should be getting a bit more or please see I'm guessing that Getting the overall levels I can see some Clicking happening and I was like, where are the presets on this thing? Are as follows and you can just play around with levels here And I push and changing all those Resets presets are under preset. So you click on the icon here and then click on presets and now Let's have some fun Okay, and now I'm now speaking to you through the ballot the ballot preset. Do I sound like I'm recording a ballot? Now we're on the dance preset in pulse effects and recording this into OBS studio. So let's see how that sounds We have the party effect going on now And let's see something that would be useful might be like the I'm not sure actually techno. There's no voice or commentary or stuff like that more base Let's throw on more base and see how that sounds. Do I sound more bassy? Okay, so I'm going to take off the equalizer. There is a Deaser. Oh reverberation is always fun to play around with so let me Throw on some reverberation and now I'm in a large room. Do I sound like I'm in a large room? Now I'm in a tunnel. Do I sound like I'm in the middle of a tunnel? Here's the experimental feature and you can change other features here like travel cut Small room size. Do I sound like I'm in a small room? Here's a medium room size and let's get out of this because this is the one. I'm really excited about pitch modulation This are all up and let's go the other way. So here here you can enjoy the last of me standing in this weird voice and I'm going to go to Minus six of each other now. We should be standing like my voice is deeper. I'm all the way down to minus nine Stereotools in stereo tools. I can let's see output Channels, let's meet the right channel here. Now. I'm meeting the right channel of the stereo feed So it should only be left channel coming through now. I am muting the left channel. So only right channel coming through and Finally we have maximizers. So this is I think getting you as close to maximum levels as you can you can change here the The threshold and DB's the ceiling and the release in milliseconds So that's it lots and lots of interesting tools and now what I'm going to do is on OBS and I should have detached myself from OBS and now you're just sounding you're just listening to the humble all Raw microphone or at least you know just being being mixed here directly in OBS So that's basically if you're using a bun to and you want to get a mixer And you want to use it in coordination with OBS pulse effects is the tool and I was just open that and then you know just Tied attached it to the the input application and make sure to hit the microphone so that you know you're editing the input levels Thanks for watching if you'd like to get more videos feel free to subscribe to the YouTube channel


Hi everyone. I'll at least do a quick sound check. And my clock just struck 4.55. So we're going to roll on lines. OK, great. Welcome, everyone. My name is Art Mannion. This talk is about the future of CVE. I'm going to do a little bit of audience questioning and polling to start off with just to help sort of tune things. And feel free, please, to ask questions during. If you want, wait till the end is fine. I could easily overrun my time. I'll try very carefully not to. But do please interrupt me if you'd like. If you're waving a hand around, I'll try to stop. Try to keep it on topic with whatever I was just talking about, but I'll be happy to have a bit more of a discussion. Are folks in the room familiar with CVE at all? Raise hands. OK, good. We can skip some stuff. I was asked to talk about the future of CVE. That's we're really going to focus there. I am. I didn't put the quote in, but those who forget the past are condemned to repeat it. That's very true here. Even in doing my minimum research for this talk, I came across a great source of past knowledge from 1999 that completely predicted all the problems we're having with CVE today. So let me jump into it. I will ask you to quickly read this text to the bottom left is the mission statement of CVE. Identify, define, catalog, publicly disclosed vulnerabilities, right? CVE originally stood for common vulnerability enumeration. I believe it was also then common vulnerabilities and exposures. It is now pretty much just CVE. That trademark symbol is meaningful. I'm going to wear a number of hats. Get it? During this conversation, I'm employed at Carnegie Mellon University. I work at an FFRDC, so a Department of Defense funded FFRDC with the university. My sort of day job is coordinated disclosure. Yes, sir? Sure. Federally funded research and development center. This is a thing in the United States. There's federal law that it's literally a triangular intersection of academia, industry, and government. If you can contract it at scale and you know what you want in the government, you go do a bid. If you have a problem you're not sure what to do with, you can talk to an FFRDC is a very rough reason for the thing. So coordinated disclosure, right? Somebody finds something, a security bug of vulnerability. They try to tell the vendor supplier maintainer. Sometimes they come through us as a third party to help them coordinate that conversation, particularly when there are problems like disagreement with the vendor and the reporter or the researcher or many, many vendors involved. That's when we get involved these days more often than not. So that's where my sort of background comes from. CVE is very important as a piece of that disclosure. When the vulnerability leaves its embargo and becomes public, advisories go out, patches and updates go out, commits are committed in public source trees, researchers post their work. That boundary of hopefully not public to public, the CVE marks that boundary. I am a board member of the CVE board. I earned this hoodie by being around during the 20th or 25th anniversary of CVE. I guess it was the 20th. My organization is also a CVE numbering authority, which is to say we're allowed to grab a number and write it up and assign it to a vulnerability. And then we then own the description and the content that's supposed to get published with that CVE. I work very closely both as a sort of a professional partnership and also I'm funded by CISA. So in the United States, especially in the federal civilian space, CISA part of DHS has public safety, critical infrastructure protection mandate and cybersecurity for those things. So we work really closely with them. So number of hats here, I'm going to mostly try to wear a CVE flavored hat. I am not a pure CVE apologist and I really want to ask, if people have complaints, concerns, questions, I have a number of my own. It is my responsibility to hear those and bring them back to CVE and not to just tell you, that's not a problem, don't worry about it. So please be as blunt as you'd like. Been in this for 20 years, I probably won't be offended. We would rather hear about problems than not hear about problems. So this font of knowledge from 1999 was the first sort of the paper, the seminal sort of paper about CVE towards a common enumeration of vulnerabilities. And in a just a horrible, probably juxtaposition of pictures, we have, that is the spirit of CVE past is from Dickens and that's Scrooge extinguishing the spirit of Christmas past who came to haunt him. And we have Stefan, this paper really does have it all. It worries about the definition of the word vulnerability, the abstraction of where the vulnerability is and sort of a logical hierarchy, how precise the definition of a vulnerability can be. I mentioned this boundary between public and not public and public. CVE at the time was looked at as a bridge. CVE has never tried to intentionally be the only one single ID space to name them all. It definitely has idea and market share from being around for a long time. But it was originally planned to be a link so you could have many, many IDs. If they all happen to reference the correct and same CVE ID, you can connect those things together. That was sort of the initial plan, yes. Yes, we want to connect these independent islands of information in an accurate way. And this is important for later. This early paper had a very minimal idea for CVE. Just enough information and it was a modular piece of the problem to define the thing with the ID on it and link to many other sources for sort of more information. Very briefly, this is the spirit of CVE present. So there is a built by the CVE program, a largely MITRE staff, but some other folks as well. Called ID Reservation System. So right now, as a CNA, I want to go get an ID to assign to a vulnerability. I have an in-house tool that someone built for me that goes and talks to their API. We have accounts on their system and I can pull IDs. I think there's some rate limiting or some maximum at which they think I might be abusing the system and they'll shut me off. But that is in place today. That is part of a module of the CVE services suite of things. And we submit CVEs via GitHub, which is actually, it's called a pilot. It's been like a four-year running pilot test. It's worked very well actually. I'm going to withhold judgment. I may have had the opinion that leaving the submission process in GitHub was a fine thing to do. A lot of transparency. Everyone knows how it works. You don't have to build your own software. I'll call that a personal opinion and certainly not consensus of the CVE program. There's a JSON format for CVE IDs. It's the version four format. That's going to be important in a minute. Managing all these authorities who can assign and issue CVE IDs is a quasi-manual at the moment. But again, this is all a setup. There's good future stuff coming very soon. There are clients to pull IDs and soon to submit IDs. The three main clients I'm aware of are listed here. Vulnergram, CVE Lib and CVE Client. All of these developed by not MITRE proper or not the CVE program proper, but by concerned and highly involved participants in the community. Just to remind folks, I mean, county vulnerabilities is a horrible, hard problem in the first place. I'm not trying to be precise here. The red line, I think I updated this for 21, yep. The red line is the count of CVEs. The national vulnerability database in the U.S. is keyed directly off of CVEs, so those are the same counts. There are a couple of other databases here that have a higher number claimed. And I'm not going to get into, if they don't count the same, you already have a problem comparing. Just to say, CVE has a mission, all publicly disclosed vulnerabilities. CVE, we are not meeting that. We are maybe several thousand short by this measure, at least. Again, questions about how you define and how you count, but I'll be the first to say we've not met that goal just by trying to. That blue line very briefly is my organization. In 2008, we stopped trying to count all the publicly disclosed vulnerabilities because others were doing a much better job than us. And then in 2014, a colleague of mine generated some Android mobile app, SSL behavior testing. He automated the whole thing, downloaded a million apps and tested them in 23,000. Horribly ignored certificate warnings basically, and we connect to anything. MITRE called us, after our fifth request for 1,000 CVEs, and we had a discussion, and the answer was no more CVEs for you. But just to prove that a little bit of automation can blow anyone's manual counts out of the water. I'm sure there are fuzz testing infrastructures that can generate a lot of output as well. Is it a crashable bug? Is it a vulnerability? Hard to tell at scale, but just as an example, we're still kind of human scale dealing with this stuff, and that's not a great way to do it. Progress, there are, so CNA is right, a CNA is authorized by the CVE program. You have been judged responsible enough. You've met some criteria to interview that you will assign CVEs in a meaningful, good, accurate way, follow the rules, be responsible for your assignments and not let them sit out there lingering. There's a reserved but public thing where I reserve 20 CVEs and I assign them the vulnerabilities and someone goes and publishes those, but they're sort of empty in the CVE corpus.  The point here is, I already sort of said maybe CVE isn't quite reaching all publicly disclosed vulnerabilities. There's been a concerted effort and the chart doesn't lie, right, since around 2016 to really distribute and federate the work so that others who care perhaps even more than the central authority about the CVE content and the CVEs are out there doing that. This is a lot of, I think we call them vendor CNAs or maintainer CNAs, right. If I'm being responsible for my software, I'm owning my bugs and my security bugs and I have decided to own that, I will issue CVEs for my security bugs. That is the desired path. So, there is growth. I don't know if it should be, shouldn't be higher. You can go search GitHub for things and find numbers in the orders of magnitude higher than this for numbers of projects and vendors and suppliers of software. These are the numbers currently though and that's what they are. I think it's 200, so this was 2021. The number is up to like 220-ish CNAs as of this date. Yeah, it's a US thing and a lot of Western Europe and sort of Western attention on these things. Nonetheless, there's a, it's not meant to be a US specific thing. There is a strong desire and attempt to make this global for anyone who wants to participate. This is how it's organized and I should say a bit more about MITRE here. I don't work for MITRE and I won't sort of speak for them but the URL for many years was cve.mitre.org, right. MITRE is at FFRDC, similar to mine. Sorry, they are a larger one and they are contracted with to operate sort of the CVE program. The whole program and MITRE included have been working hard in the past years to design an organizational structure where it doesn't depend on MITRE or any single entity to run the thing. There is the need for a secretariat, which is currently MITRE, and at least one top level route of which MITRE is the predominant one here and that's simply historically the way things have been but this is designed such that a lot of the work happens at this bottom tier with all the CNAs. There's a hierarchy to the CNAs. So, a country, Japan for instance, JP-CIRT-CC is a route CNA and they have a defined scope which I'm guessing is probably things ending in .jp. In CVEs in Spain, Google, I looked this up. There's a Google Android CNA and I think the Google CNA here, I think it has a broader scope than just Google stuff and I don't recall without looking up why that they are a route CNA. Oh, sorry, I do remember. It's any of their alphabet sort of owned organizations. Google has a CNA that will cover those. So this organization is designed that one could replace the secretariat with a different organization and you could have more than one top level route and it would survive a post MITRE world. So, yes, MITRE is very much tied to the CVE program but the official term is the CVE program. The fact that MITRE has a prominent role is true but we're trying to sort of build around that dependency. So, to the future. First, some bad news, right? In Scrooge, his future is not looking good because he's been a jerk for a long time and I think the ghost is pointing to his grave here giving him a hint. So, Linux Kernel Devs, at least one of them, don't really care about CVE and Greg talked about this a lot a couple, two, three years ago. And I actually spoke to him about it before he sort of talked about it more publicly and I don't really have an argument with him.  Furthermore though, if you think about the abstraction and he has first-hand accounts of this, right? Hey, there's something happening in C and C works a certain way and there's a bug in it and it has something, it does something, right? At the level that they're all working in the kernel, it may or may not be clear at that layer of abstraction that it is or isn't a security impact and he has stories where I think his story is he created a bug, someone told him about it and he fixed it three years later and then after that realized it was a horrible vulnerability the entire time. There was no CVE, no one noticed it was that. I had a security impact at all. So there's a piece at least the way I look at this as sure. At that, with that perspective, bugs are bugs. That's how computers in C behave. Fine, no argument. The rest of us kind of want to know if we have local privilege escalation or networking stack vulnerabilities in the Linux Kernel that we all really use a lot of or depend on even if we don't use it ourselves. There's also a great write-up from Kurt Seifried and Josh Pressers and Josh, the new Josh, sorry, yes. Yes, the other Josh, other Josh B about the global security database. And again, despite being around longer and having some de facto status, CVE does not claim to say we should stop using GSD identifiers, stop using something else, only use ours, that's not the approach. And that would be a foolish approach and it wouldn't work anyway. But there's a nice blog post from I think mostly Kurt but maybe it was jointly written about why and tell some of the history of going to the GSD. And it's a good read and I have a tab here I'll flip to if things go smoothly later. Kurt and Josh really put some pressure on CVE in a good way with the distributed weakness filing and DWF, ha ha, right, it's one letter off of CVE. They could have gone with bud, I realized later but I don't have an acronym for it. Kurt was, I believe, and I write very rightfully so, not happy with the speed of CVE assignment and getting things published and he did a much quicker version of it that was DWF. There was a period of time where DWF was sort of made part of CVE and that didn't kind of pan out. DWF tried a second time working outside of CVE. This led to the global security database work. Not gonna get into the history too much but these are all very fair criticisms of CVE. And in fact, despite some probably strong feelings and discussions between Kurt and maybe Josh and the CVE folks, their work was very, very beneficial and probably kicked off CVE's sort of change of attention to try to modernize and be faster and lower overhead. So, better future, a brighter future and this is a big question we get. When are the new services coming out? I am told there will be an announcement on June 30th. The announcement is not the actual delivery of the new services but the next update is coming out then this URL at the bottom is where these announcements of progress are made if you're really waiting to hear what's happening, check that page every so often. I think I'm safe in saying June 30th will be the next one. Someone told me that too, I believe. So, what's coming up though is replacing the GitHub submission and the ad hoc-ish, slightly manual user management with straight up proper API services. So, this IDR where I can reserve a CVE that I need is already in place. That's how things work today but coming soon and these are in sort of beta and test right now so this is, I really hope, pretty soon this time. Being able to submit and upload my content, populate my CVEs through the API and I can self-manage, once I'm approved I can sort of self-manage my users and my organization. A JSON version five format is coming out. There's a big up conversion process going on but people smarter than me and with better Python skills are getting that worked out. This CVE JSON five format, probably one of the biggest new features is containers. So, sort of by default there's just one container. A container is the source, right? Who provided the information? And a future CVE record, JSON five record can have more than one container. So, the cert CC can publish a CVE ID and we're responsible for the first container and someone else could in theory come along and provide other content and it would be clear to the consumer that cert CC said these things and a different data provider in a different container said these other things and that's built into the JSON format so you can tell who said what and who to go ask questions of or yell at. Also an attempt and actually the OSV folks filed a nice issue, a couple of issues to help with this at just a little bit more sort of machine-based way to deal with versions. Versions string, version systems are all over the place and it's a giant mess and there's just almost no hope. Nonetheless, the OSV folks had a really nice contribution. They're probably using it in the osv.dev format where basically you can parameterize and say I'm using this type of version syntax and then your version operators take on meaning because you've declared that greater than means, greater than for instance, or whatever your range definitions are. So a little bit more machine readable. I'm not sure what a comfortable means. Compatible probably. Sort of package and product version information is going into the JSON five. There's a bunch more. Not gonna get into it too much for now. Very brief example of some, so I'm gonna go quickly through the remaining slides. This is now a set of issues I'm aware of and I'm kind of tracking not in any particular order. I'm gonna hit them pretty quickly and then ask if you wanna come back to what we can talk about them. And very importantly, if you don't see something here that's on your mind about CVE, really wanna hear that, I will take them back, things back to the board. This is a vendor called Moxa.  The second one only has some CNVD IDs. So my question is why on earth is Moxa not putting out CVEs for that second one? In 2019, I don't know but that's odd and weird and there's a gap, there are two things that CVE has missed in some way. CNVD is a Chinese vulnerability database. Not to be confused with CNVD, also a Chinese vulnerability database. I believe CNVD is officially government run and it's not clear what CNVD is run by. It might be a slightly more commercialish or academic issue, I haven't sort of figured it out yet. So coverage is still an issue, we've covered that, right? Mission focused, this one's actually important to me. I have a less is more mindset and I'm very clear I am not in the majority. This is not a consensus opinion of CVE. Part of JSON5 has those containers, it also has a whole lot of other stuff you might see in a full featured vulnerability advisory, impact, description, credit, CVSS scores, other scores, lots of other stuff you might see in a full featured vulnerability record. I don't know if that's a good idea and I'm of the opinion that it is not and my argument is basically if we could really focus on the narrow mission by identifying the stuff and only that, we haven't fixed that yet, just do that. There are plenty of other people out there who are going to add on content and link via CVE and the vendors are gonna have more detailed advisories, third parties are gonna have more detailed advisories, researchers will have more detailed information. When you reproduce the information in another record, you now have debt. There was a great example of this with the log for J disclosures, there was some initial heat of the moment mistake, I think from Apache about that a certain Java version protected you and Apache realized this and corrected the CVE entry and then that got fixed and there was an accidental overwrite and that got taken back out again and then it got fixed again. So there was some thrashing with the CVE content and people look at CVE and they see if you're running this Java, you're safe. That was a pretty misleading bit of information for three or four days. Had that not been there in the first place, we didn't need it there, right? That belongs in the Apache advisory and I can say CVE, oh I'm gonna go, it's an Apache thing, I'm gonna go look at that vendor or that supplier or that maintainer's advisory and read that authoritative information. If you're maintaining multiple copies of your authoritative information, you have some debt. And in fact this quote's from the paper, 1999. And I'm gonna be using this with the CVE board to see if I can get any traction on this. Less is more, minimum information to catalog. Transparency, CVE is by no means trying to not be transparent. I think there is some accidental lack of transparency these days. This is the second part of my text here. The board email list is fully public and archived publicly. As I was searching for research for this talk, I realized, it dawned on me that a lot of the discussion has moved off into the CVE working groups and they're not, again, they're not intentionally non-transparent but there's a lot of variety in how they sort of log their stuff or keep track of it. And most things you can join and get access to the archives and all the information. Some of them are just public but there's a lot of variety and so by, I think by accident and by growth, the implementation of the working groups has less in transparency a little bit unintentionally. This GitHub pilot, the great thing, the Log4j issue, right? A colleague and I were working on Log4j, you know, whatever the day that was or weekend that was that it came out, we noticed this and get blame. It was straightforward to figure out what had happened. There had been an inadvertent overwrite from the CVE program that put the wrong information back in. We could email someone with two, you know, this commit introduced the fix, this commit accidentally overwrote it, please fix this straightforward. I am actually not sure in the future services 2.1 World how that will be possible, how you'd notice that sort of thing. So that may be a material transparency issue. The other stuff is accidental but we are trying to be transparent. This is a massive piece of the puzzle. You know, if I have a CVE that says, describes a buffer overflow, I really have a CWE, right, I have this class of problem but I don't have an instance of it, right? So the CVE, the buffer overflow has to affect something. So I have to have a CVE entry that says what component, what piece of software is vulnerable. I have to have something there. But can I have a comprehensive, complete list that everyone can go out there and identify? And that's no, possibly very, very difficult. All you have to do is identify all the software components on the planet and all the vulnerabilities and then intersect them. Simple, simple three steps and we're done. So all we have to do is that. Yeah, pardon me. Yeah, I think we were gonna fix this a couple of years back, actually. Identify the components, is SBOM gonna help us with that? Sincerely, it is, please, yeah. I believe so. I'm passingly familiar only, but, sorry, for the sake of those online, GitBOM was mentioned. Identify all the components, I'm a huge SBOM fan. I could be wearing, I should be wearing my SBOM t-shirt under my CVE hoodie, but all of your, whatever you wanna call your dependency tracking, your inventory, your asset management, your upstream dependency awareness, do that. Should be doing it anyway. A lot of people are doing it anyway. If you wanna call it SBOM, great. If you don't, also great. Know what you're running, know your upstream dependencies and we have to do better than verticals knowing those things. It has to be a horizontal cross ecosystem sort of solution. That's the bigger sort of SBOM story. GitBOM does pieces of this, is as much as I can say, and I've heard good things, so I'll say thumbs up. Getting a little bit back to the minimalist idea, I don't know, and I'll speak for CVE at least, that it makes sense at scale to have a huge list of affected things jammed into the CVE record. Personally, what I sort of envision is vulnerability records and software components and a third thing that joins them together in combination. So I sort of have a graph RDF thing in my head. That level of engineering is not gonna fix this for us, we need to do more than that. We mentioned sort of more, I guess it was computable, not compatible. Version semantics, that can help. Try to use Simver or something else, great, but not everyone's going to. VEX, VEX is coming from the NTIA SBOM work into the SISA SBOM work. Vulnerability, exploitability expression. I may have the acronym wrong, may have shifted slightly, but it is VEX. And this is meant to be a structured way to convey status, right? Component is not vulnerable to vulnerability. And VEX sort of focuses heavily on reasons you are not affected. The theory here being that with greater SBOM and inventory and upstream dependency knowledge, there'll be a lot more stuff that looks like, hey, you've got old known vulnerabilities in all your upstream and a maintainer could quickly say, no, I don't because at scale. That's sort of the rough idea behind VEX. And Alan Friedman is not here to fight with me, so. Yeah, I'll skip on here. Hey, when you have a dispute or an update to a CV entry, the current model, the CNA who issued the ID is basically where you have to go. And that does give that CNA some implied or inadvertent power to maybe respond quickly or maybe not respond quickly or maybe discuss it with you or maybe they're not gonna answer the email for a couple of days. You follow the CNA hierarchy, you may end up at often mitre today, but the top level CNA or the next CNA up in the hierarchy for that discussion. That's the path. Getting things changed or updated that you don't own is tricky. And I don't think, I think there's too much friction perhaps these days, personal take on it. It's a known issue, but what to do about it has not really been solved yet. Man, there's this thing called the cloud and your computer is sort of somewhere else and you do something with the service, I don't have a computer or a product that I got with a CD-ROM and a box that I run. And thankfully, CVE has partly accommodated the fact that cloud services exist. This is a snippet from the rules. Literally, it's the book of the CVE rules. So if I am the cloud service provider, I am allowed to issue a CVE for my stuff. If I am the cert CC and not the particular cloud service provider, I am not allowed to issue a CVE for that cloud service provider stuff. To me, that's a problem with the rules. Hasn't yet been sort of adjudicated. There was some concern that there'd be a proliferation of cloud service CVE IDs and no one needed to do anything about them because the cloud service would just fix them, which is often the case and a great selling point for cloud services. But I don't know if that concern was ever sort of proven out or not. So here's where we are with that one. Couple of issues about CVE for malicious code. And this was talked about at least yesterday, I was at a talk. In these cases, you've got sort of some upstream, so this is Ruby and probably node things where either someone's package was compromised or someone is doing some name squatting or somebody got mad and changed what their software does to put the hearts in. That's one of these. That's this one, I think. Does that get a CVE?  If I download malicious software and run it, there's no vulnerability involved. I downloaded malicious software and ran it. That's a problem, but it's not a vulnerability. There's no bug. I ran malicious software. Maybe I got tricked, right? There's a social engineering or an understanding concern. There's a pretty good argument, though, to say we need to know about these things and CVE is pretty close and it's out there. So let's use CVEs for them. And then there are, I mean, just in my slides here, there are three CVEs for this already. One of the rules is if a CNA for their own stuff says they have a vulnerability and calls it that and they issue a CVE ID, then guess what? It's a CVE ID. So it's quite possible. I don't know who, you know, Node or one of the vendors here did this and therefore it's in the corpus and we're done. There was a debate about CVEs for vulnerabilities in malware. I am pro. I'm in favor of a CVE for your vulnerability in malware. It's a vulnerability in software. Sure, put a CVE on it. There are a whole lot of cases of this.  If you read closely, they're kind of borderline vulnerabilities, it's a bunch of DLL injection on Windows if you're running local stuff. You can trick the malware into running it, your own DLL, but so a bit esoteric, not a major use case. There was a debate. We don't wanna help malware authors out, was sort of the answer, but it's a vulnerability, give it a CVE. I covered this a bit up front. There was some really good existential motivation from Kurt and Josh and DWF and GSD DWF at the time really was putting put pressure on the CVE program to modernize. And again, despite some of the feelings and discussions, huge win, so lots of, I don't think, other Josh is not in the room, is he? Yeah, so, yeah, Josh pressures Kurt Seyfried, Seyfried. Seyfried get mentioned because it was a great, great thing. There are plenty of other databases and IDs. VulnDB is OSVDB and they did a lot of work and OS was open source and they tried really hard and cared about the community.  And they were successful, so good for them. But you can't get their good stuff anymore unless you pay. VulnDB.com is another new one. They have a pretty high count. I don't know their business model, there must be a subscription involved somewhere. I mentioned the two Chinese ones that I can keep getting confused. OSV.dev is Google, but it might be under the OSS, open SSF? Okay, so OSV.dev is another database and a format, both. There are lots and lots and lots. Josh and Josh had a talk earlier with a screenshot of a whole bunch of databases. Almost any vendor who does their own advisories consistently has their own naming system as well. But DWF really lit a fire in a good way. Yeah, I said this sort of upfront. We really, really do want the feedback. Even if we don't care if it's complaints and criticism, we want those things. The board is the board at CVE. There's different discussions and opinions, but we wanna know and not know about problems and concerns. There's still some friction from just historically how CVE was engineered and designed. It's gotten a lot better, but things could be quicker, easier, faster, lower overhead. We talk a lot with the CNA community, of course, because that's who's out there assigning things. We talk with the research community really from anyone. We'll take any input on this. And yeah, this issue was filed by, I think the OSV.dev folks with the CVE.Json5 repo to get the version information in better shape.  And it worked out great. It was open source collaboration. It was in GitHub. It's all public. When's all around? Yeah, going back to 1999 again, this is a battle I keep fighting. I feel like Don Quixote running at the windmill sometimes. And this just popped up again in the CVE-CNA coordination working group had a big discussion about, well, there's a CVE for this library, but I use it and you use it. Do we use that CVE or do we issue new ones for our implementations of that problem? And sort of both things are true philosophically and different things happen in reality every time. Sometimes everyone points to the Heartbleed CVE and that's fine. Sometimes people cut their own for their implementation and if you're not careful you lose track that the subsidiary CVE is actually related to the source one and information is lost. 1999, the people who wrote the whole thing up predicted this, they were correct. It is unsolved today. It's not a hard solution, a colleague of mine mostly and me, but mostly Allen Householder fixed this a while back. A very simple reference system as long as you're doing it systemically could take care of this, right? Equivalent to alias four, not alias four related to, you have a child and parent maybe. You don't need a whole lot of relationship magic to get this worked out. That really needs to be in, oh yeah, here's, sorry. Here's the work from the X ref. So possibly related, related, not equal, equal, superset, subset, overlap where the few we came up with. So that's the slide deck. I got a five minute warning a moment ago. So happy to take questions. Please, yes? Yes, they're not in schedule yet because I am late binding. They will be there. Plus, I'm not sure how fast I can flip back to it. The tiny URL at the beginning is the, cover your eyes, everyone. That tiny URL is the Google slide version of it, but they will be in schedule probably later today. Yeah, sure thing. Oh yeah, that's slide availability for those online. Any, no online questions? Nothing, okay. Anyone else? So I have a huge complaint about CVE. Now's a great time to throw that out. You can also tell me privately if you want, or you can just report it and then you'll put it on Twitter, but I'm happy to take stuff to the board. No huge complaints about CVE? Yeah, absolutely. Okay, fine. I'm happy to hear them, okay. Private, private reporting is fine as well. Did you wanna, yeah, Josh, yep. I think so. So the question is, I'm up here claiming CVE's willing to work with other databases and I firmly believe that. And how does that happen technically? So the JSON5 format is, you know, the JSON5 format and the other format of whatever database is where things would have to sort of line up or not. I attended the GSD talk, so the namespace trick, I think is gonna work pretty well for GSD. I don't really dream we're ever gonna get, you know, Rosetta Stone level field compatibility across a whole lot of formats. I don't know what the right answer is, but JSON5, CVE's committed to a machine readable format, even though some of the fields are, insert your text prose here, but, you know, we'll work on that as well. Was that it? Was there a second thing? No, okay. Yes, please. Yeah, right off the bat here, I have much of the numbers gonna show up here. So risk-based securities is, for 2021 is, I don't know, 27,000 and CVE's around 20,000. So they've got 7,000 more than CVE has. Now they published an annual report with that number in it, but their data is proprietary, so I can't inspect it carefully or anything. But I mean, I just looked up one of my, that slide about Moxa has a couple of CNVD vulnerabilities in it and not, there are two missing ones right there. So you don't have to look around too hard to find something, a vulnerability that's public without a CVE on it. Every so often I'll just issue one and try to clean that one up at a time. Not scaling well, but yeah. There are, I treat the CVE count as a low watermark. That's the minimum number of publicly disclosed vulnerabilities per unit of time. Yes. Yeah, I mean, there are, I know, because I know how they started out, the risk-based security database, I believe they do a really good job trying to aggregate things, but again, their data is proprietary. They're making a business out of that collection and that analysis. CVE does not itself try to go aggregate more. It just tries to issue. It's the first data provider. That Valdi B site seems to be aggregating, but again, I think they have a commercial business model in there somewhere. So there's not one sort of open data pool for all the vulnerabilities that I'm aware of.  Please, yep, GSD. Yep. No, go ahead quickly, yep. Yeah, so that's it. Yeah, so for the online folks, GSD Global Security Database without a V in it, although I kept trying to write a V in myself, Global Security Database is designed to be able to collect or people to submit or integrate their, all their database information. So it's designed to do that, yep. Okay, got it, yeah. So the comment there is Global Security Database, not limited to vulnerability, malicious code, tampered things, belong in as well. Yes, last bit, we're at time yet. Sure. Well, for GSD, I just talked to Josh. Last time I was up, I don't know that Oval, it's not, we're not apples to apples anymore, so I don't know how you integrate that. Yeah, I think I'm at time, so thanks very much, everyone. You will find the slides in Sked, if you don't get that. I'll put the URL back up for the tiny URL, so. Thank you. Here, right?


Hi, I found a picture online and I want to use it for a project. I just want to check to make sure I understand the license the creator has used to protect it first. Thanks for coming in. Often people will use pictures they find on the internet without bothering to check the permissions. First, can you tell me what you would like to use the picture for? I would like to use it to help advertise a product I'm trying to sell. Sounds like you're interested in using the picture for commercial purposes. Will you be making any changes to the picture? Yes, we would like to combine it with images that we've created of the product we were trying to sell. So you're also trying to remix the image. Let's take a look at the license the owner has used to protect his or her work. This is a Creative Commons license. That means that the user has chosen to allow you certain uses of the image without first having to ask for their permission. Okay, can you explain in more detail? This Creative Commons license allows for remixing the original image as long as you give credit to the original author. Great, so I'm all set. However, it looks like the author has placed limits on using the image for commercial purposes. You will need to contact the author for permission to use the image for your advertisement. Oh, okay then. Remember, if you want more information on a Creative Commons license someone has used to protect their work, you can always click on the license for more details. Great, thanks for your help.


And the next talk will be be deniable public key encryption by O'Neill Peikert and Waters and Chris Peikert will Give the talk Thank you. Oh my time's up already. Oh, I'll fix that. Don't worry This work is by deniable public key encryption with Adam O'Neill and Brent waters So many talks start with a story and this one is no different today's story Alice and Bob are siblings and one of them is away at school and They want to plan a party for their big brother for when Alice comes home to school So they're using public key encryption to keep their messages safe because big brother is watching them and So Alice encrypts this message saying let's have a surprise party for big brother and big brother sees Sees his traffic goes by but it's encrypted so he can't tell What the message is? But he's awfully curious about it. So when she comes home He kind of uses his prerogative as a big brother and twists their arm and says hey Tell me you're public, you know the coins that you used to encrypt this and hey Bob Tell me the secret key that you used and the party is now ruined. So that's pretty unfortunate for everybody all around So what we would like is something called by deniability and we'd like a property like this that Alice can send Bob an encrypted ciphertext using some kind of deniably Encrypt and denyably encrypted process encryption process and Bob should be able to decrypt Alice's message correctly But if Bob rather of big brother comes around and tries to twist their arm or maybe in advance Anticipating that he might do so Alice and Bob can prepare some fake encryption coins on the left and a fake secret key on the right so that when big brother does come around and They have to hand these these keys and coins over magically. It looks like an innocuous message that everyone can agree on Okay, so it looks the fake coins and keys actually make it look as if another message had been encrypted Okay, and encrypted honestly, it's not like there's nothing suspicious about these coins and keys Okay, so an important fact is an important thing about the model We're considering is that the coercion is always after the fact so Alice and Bob are able to encrypt and decrypt You know not subject to any coercion, but then later on they might be coerced to reveal their coins And this is really a kind of a dual concept to Something that Ben alone to instra Janistra called a uncoercible Communication which would allow Alice, you know when she's under control of Bob a big brother to send the message But secretly indicate that hey, I'm you know, I'm being coerced to send this message so ignore it Okay, so we're talking about after the fact coercion here today So there you know This is a kind of a toy example, but there are a lot of serious examples where deniability might be might be needed Kind of any kind of anti-coercion Scenario Roger Dingledine's talk gave countless excellent examples of scenarios where people might be able might really need Deniability for their own safety or security. So for example journalists or whistleblowers Really would who might want to keep their sources safe Would definitely benefit well from deniability these two fellows know definitely well or if you find yourself on With a different kind of big brother to deal with you might need it Deniabilities often been proposed for voting protocols and the basic idea is that well if you encrypt your vote But then later on your your boss asks you to show how you voted Well, you could reveal any votes So, you know, there's no way to force you to reveal your vote or you couldn't be able to sell your vote come back to this Question a little bit later in terms of theoretical Cryptographic concepts. It's a nice concept because it actually implies a strong notion called selective opening security for encryption and It also implies something called non-committing encryption Which helps you design adaptively secure protocols But it's actually strictly stronger than both of these in particular for property for it stronger because the ciphertexts that are Equivocable actually can be decrypted by real players. They're not just generated by a simulator. So they actually have real content behind them Okay, so those are applications. There's been some prior work this notion was first formalized in this paper CDNO Kennedy Dwork now on Ostrowski in 97 and They they give nice definitions and some feasibility results. They showed that the sender deniable Public key encryption as possible. So it allows you to coerce only the sender but not the receiver and then they also show that you can With interaction you can kind of flip the roles of the two players So you could course only the receiver but not the sender and and then they also showed that you could do by deniable encryption If you interact with third parties as long as at least one of those parties doesn't remains uncoerced Okay, and then but in practice people have also asked for this kind of some kind of deniability property It's usually goes by the name of plausible deniability. So there are programs called true crypt or rubber hose file system and they basically allow you to say If you're coerced to reveal what's on your hard drive or decrypt what's on your hard drive You can say well that this part of the hard drive is actually just random noise. I never stored anything here So there's no message there move along Now that might be work well for storage with your within your own computer But it's arguably not very useful for communication because if you're sending messages back and forth It's hard for you to argue. Well, there's there's actually no message here. I've just been talking to Bob for years okay, so Anyway, we'd like something more and we'd like to actually be able to equivocate the message and not just claim that there's no message there at all So in this work we give we make some progress on these problems We give a by deniable encryption schemes. This means that you can simultaneously coerce the sender and the receiver And you can reveal any message that you like Even chosen as late as the time of coercion or in advance And this works importantly in what's called the multi-distributional or for my own mouth's sake Well called a flexible deniability model and what that means is that they're actually alternative deniable key generation and encryption algorithms which Alice and Bob would run in advance, but then when they get coerced they would actually equivocate and claim to have run the normal sanctioned encryption and key generation algorithms, so I'll say more about how we formalize this later So I want to emphasize these are true public key schemes. They're non-interactive in contrast to the previous by deniable scheme And there's no third parties. We actually give two very different styles of schemes. One is a generic construction It's based on what's called a simulatable encryption and an idea introduced by a dumb garden Nielsen and they introduced it for the purpose of non-committing encryption and we find it interesting that it's possible to actually build Deniable encryption with this basic primitive and then we have a special some arguably more efficient or different definitely certainly more efficient and definitely different Construction that uses some peculiar properties of lattice encryption Now both of these schemes have key sizes greater than the message size But if you think about it for a moment This is inherent because if you have a fixed ciphertext and you want to be able to open it in 10 different ways There must be at least 10 different secret keys that you can reveal So it's inherent, but it's still not very Nice because we'd like to be able to encrypt messages that are longer than the keys So we give a way to do this with a limited restricted notion called plan ahead by deniability and plan ahead basically means You give up on this ability to reveal any message under coercion you simply say that in advance I'll choose two three some bounded number of messages which I can then later reveal and And now we can do it with short keys and long messages Interesting this is an analog of what's called somewhat non-committing encryption by Gary Wicks and so from crypto Oh, nine and another good benefit of this is that the sender and receiver automatically Agree on what is the fake message and what's the real message? When you have this coercion problem you have the problem of well if you put Alice and Bob in separate rooms and tell them You know what what was the real message they might equivocate to different messages and that would look bad So the plan ahead scheme actually tell you know lets them both know what the innocent messages And then third we give some analogous solutions and models in the identity based setting And this is kind of an interesting setting That's arguably pretty interest pretty useful because it says that in the identity based setting you aren't the curator or generator of your own secret keys rather you go to a Public key if generator or an authority who extracts a secret key for you So the model is something like when you go under your coercion You say well I have to go to the the public key generator to get my secret key and you can tell the public key generator Hey, please make it decrypt in this way rather than the real real message There's also been some subsequent work following the first announcement of our results here So in the past year a crypt there was in paper on interactive an interactive scheme Which gets a full sender deniability so not in the flexible model, but rather and the full full deniability model It uses an interesting primitive called sampleable encryption, which really looks like it solves the problem But unfortunately if you look very closely there turns out to be a fatal bug And it for some reason it doesn't seem to be enough to solve the problem So full deniability is really a very interesting problem even just for one side even with interaction It's a very neat problem second work, which will appear in The upcoming Asia Crypt by Bendlin at all They actually show that fully receiver deniable encryption is impossible So formally that statement means if your secret key is only a sigma bits long then There's always a way to distinguish between Real messages and faked messages with one over sigma distinguishing advantage So basically there's no hope to get full receiver deniability if your scheme is non interactive So this actually motivates why we really have to work in this flexible deniability model And so again when faced with this impossibility we don't deny it We were just going to be flexible about our security notion Okay, so this is the model that we ask for flexible by deniability as usual we have three Algorithms so key generation encryption and decryption and these three by themselves form a valid encryption scheme, so The decryption is correct. It's semantically secure and so forth and then on top of those three things We have deniable algorithms so a deniable key generator and a deniable encryption algorithm and corresponding faking algorithms And so here's what we ask for the deniability experiment Security-wise so for any two message bits B and B prime the left experiment is simply you generate a key you encrypt a bit B and then The coercer comes along and says give me your keys and coins and you hand them over Okay, so that's what the coercer gets to see there's actually a lot of redundancy here It's enough to give the coercer just sk and r Because he can derive pk and see from that but that's what you get and The alternative experiment is what happens when you actually use the deniable algorithms So now we Deniably generate a public key together with something called a faking key and then we deniably encrypt a message the message B prime Okay, to get a ciphertext and then later when the Coercer comes along We use this faking algorithm together with a faking key to say you know what I want cipher text C to decrypt As a message bit B and that's gonna output some fake secret key here and the receiver Sorry the sender Simultaneously runs he says here's my original randomness that I used I'd like this bit B prime that I originally encrypted to appear as if I encrypted a B and So that's going to output some fake encryption randomness and as usual the Coercer gets to see all all four items Okay, so we'd like these two experiments to be indistinguishable Even better well Instead of a secret key you could actually have the coins for Jen will treat these as if they're equivalent But in the paper we show that coins can be done Okay, so and just just to give you an idea full full deniability would say You can't use different algorithms here. You actually have to run Jen and Anke here And you they're still faking algorithms, but they have to take the original coins and the original coins here So that's what we would ask for So it's a it's it's after lunch. We're all digesting so I think I'll keep it pretty light And I won't go into too many technical details, but I'd rather consider you know, is this definition actually meaningful or useful and They're kind of two two common objections that that I've often have raised about deniability in general and the flexible model And the first objection is well, you know, everybody knows that you could have you could have run these faking algorithms So who do you think you're fooling when the coercer comes along? You're not going to convince them that you really sent this message that you're claiming to have sent and I say Yeah, you're not the point is not to convince anybody I mean everyone knows they could be faked and that's that's the world We live in so the point is that if you consider like perfectly secure communication Talking through a lead pipe where there's no record at all that anything had happened This is ideally perfectly deniable you can claim after the fact to have said anything to anybody But the problem is that encryption itself has the side effects that mostly usually it introduces a risk of being coerced So now there's a record of a ciphertext that you sent and now you can later be coerced to open it up Okay, so this is an undesirable side effect and deniable encryption is attempting to get rid of that Side effect, okay, so you're not trying you're not going to fool anybody into believing Into convincing the coercer of anything but actually just to preempt the possibility of coercion in the first place by making it useless Okay, the second objection is typically to this flexible model Which is a very natural question the first one you think of is well, there's these alternative Deniable generation and encryption algorithms. Why wouldn't the coercer just ask for the coins from those algorithms? And and if he did then then there would be a way to You know, you wouldn't have a way to equivocate your message And the answer is yeah, he could he could ask for those coins I would recommend as a user that you just really insist. No, I really did run the recommended algorithms Okay, Jan and Inc The coercer has no evidence You know He may have reason to believe that you want to change your message But he really has no evidence that you ran those alternative algorithms and had you run these original algorithms You couldn't give him the coins of the deniable algorithms, okay? You just computationally wouldn't be able to so they're kind of two cases here The first is that the coercer says you know, I guess I've sent my subpoena you've submitted, you know What you claim and I have to be happy with that so the coercer goes away and all's well and and we win The second case is that maybe the coercer says no, I'm not satisfied I'm really gonna punish you and put you in prison until you give me coins for Jen and Inc. Okay in that case You're arguably living in kind of an unjust society because there's no reason to believe that you've run these algorithms But here you are rotting in jail. So Flexible deniability does allow you to to cry uncle and say okay, okay I admit it. I ran the deniable algorithms here the coins and now you've very now you've proved what message was truly sent the problem is if you're in this world deniability is the least of your problems in In fact full deniability doesn't even save you in that world because again just as you could with flexible deniability Anticipating that you might end up rotting in jail until you prove in a valid way that you've what message you've really encrypted Well, you could just use verifiable randomness like the digits of pie to encrypt, right? So there's still a way in a full deniable scheme to prove the way you bet that you really sent the message. Okay, so Arguably, it's it's not a flexible versus full Problem there. So this also calls into question the applicability to voting because if you really want to sell your vote You can even do so in a fully deniable scheme just by using digits of pie or some kind of output of a pseudo random generator something like that Okay, so now I will do some Technical things, but still with pictures So the main tool for deniability from the CDNO paper is something they called translucent sets, which is a really nice idea The idea is that we have the set you which is the whole universe and then inside of it We have a set P which is parameterized by a public key Okay, so the public key specifies what is this P set and there's a trapdoor that comes along with With this with this translucent set So there's a few simple properties if you have the public key you can sample efficiently from the P set You can also sample from the you set just by picking K random bits But a P sample is pseudo random So if you pick a random from P it actually is indistinguishable computationally from if you had picked from the whole set And so this allows you to fake Later on you say you chose a P sample to start with but then later on you can claim that it was a you sample just by saying Yeah, the P sample. I just picked these K random bits Okay, so you can fake in one way from P to you, but not vice versa and For the receiver the receiver using the secret key can easily distinguish a P sample from a sample So the receiver can tell which which set it falls into and there are many instantiations of this idea This very basic idea. So let's see how you could do it How could you use this to get a deniable encryption scheme? Well, the normal encryption scheme to encrypt a zero you just take two U samples and to encrypt a one You take a U sample and then a P sample Okay, and Bob can tell which of the two samples they are and so he can distinguish a zero from a one and decrypt On the deniable side the deniable encryption algorithm to encrypt a zero He just takes two P samples instead and for the one. It's the same as before So let's see what happens The courser comes along and Alice can fake so for any you know if the original message is zero or one It doesn't matter you can fake it as a zero or one in either direction Just by changing claiming that P samples were actually U samples Okay, so you can just check that all possibilities are doable there but if you course Bob you get a secret key and The true message is revealed. Okay, so we really need to work on the receiver side here So one of our contributions is one of the two Schemes is something we call by translucent set and it's to take care of this their receiver problem So a public key now has many secret keys and the P tests are slightly different So this you know this secret key might call those values P samples and this one might call those P samples and so the idea is if you pick a P sample then most secret keys will indeed classify it correctly, but Given the faking key you can actually generate Secret key that makes the P sample fall outside. So it forces it makes it look as if This P sample is actually a U sample Okay, and so this allows Bob to fake a P as a you and then using the previous encoding everything works So instantiation Just uses the fact that in the GPV identity based encryption You can cause a decryption error, but obliviously so the user doesn't know it just kind of a Anyway seemed like an annoying fact an annoying property that we're using for deniability So I have no time so extensions Just like I said the planet to head deniability is what something we do and full deniability is still a really Interesting open question. Thanks. I'll take your comments questions. There's any question. Yeah Yeah, the faking key you can't reveal. Yeah, that's something you cannot reveal that. Yeah, the faking key is very special No, you yeah, I don't see any reason why it couldn't be although Revealing a faking key already reveals that you've run the the deniable generator. So There's already some The faking key is only output by the deniable generator Okay, yeah, maybe they handed it Okay, yeah Yes There actually are a large number of possible faking keys for a for a given public key. We don't use that property, but it's true That's right. Yes. So the question is why not just erase In fact, it's not very common for you to keep your encryption coins around. So in coursing a sender You know, I forgot my coins is definitely a could be a credible answer It's a less of a credible answer for the receiver who typically has to keep a secret key around in order to decrypt things So that's another reason why we wanted to focus on the receiver side Things but there's discussion in the paper about erasures and what we think of them Okay, let's thanks the speaker again And if there are more questions, I'm sure that Chris will be able to take them offline during the break