All right Defcon 13 is proud to present Marshall Beto with the protocol information informatics project Saturday morning at that god damn. Why am I working Saturday morning at that cone? All right Marshall take it away. All right. So this project is called the protocol informatics project It's basically a plan words from bioinformatics, which is kind of my main inspiration for this project Should I talk closer? Okay. There we go. Thanks So my name is Marshall Beto. I'm a research scientist at McAfee. However, this is pretty much all independent research My company's never even seen this stuff. So I think that's why it's worthy as opposed to something It's out there trying to make money or something like that Let's start Well, the purpose of this project is to basically automate network protocol analysis. So I Just added this slide the other night just kind of like say this is what the thing does you input a p-cap file and Outputs is going to be a packet format. So This is my little XML markup of this particular protocol format, which is just kind of something that's made up Which is basically a two-byte link field followed by a ASPY string or something like that. So my application what it does is it goes through does a series of comparisons and checks and He's a sequence alignment algorithms to understand the general structure of the format. So if you were to analyze this This markup basically what it's doing is describing this protocol saying that it operates on GDP for three five three six four Something I just pretty much made up It's a block-based protocol. So you open up a block You in you insert the link of that particular block which is going to be a short Veganine followed by a variable type Which is going to be a plain text string right now the default value for that is going to be hello, and then I close it all out. So The general idea is you take a protocol you've never seen before in your life You're trying to reverse engineer world of warcraft for all I know, you know, you Input the p-cap file and out comes the structure. So that's a general idea behind it. So So the objective of protocol analysis is first to understand Exactly the format of every single packet. I mean That's pretty simple concept in general, but it does get more complicated as you have to understand the actual state and natural handshake and things of that sort so There's really no good way of doing this at this current time I mean it's pretty much a manual process people sit down with ethereal or something like that and We're gonna piece of paper and just start writing down offsets and trying to use their human intuition to be able to understand What this particular field does and where it's located in the packet? So this information is generally important to understand proprietary protocols Which are actually kind of becoming a little bit more rare in my opinion of all the security products that I've been looking at and things like that Everybody seems to be using soap over SSL nowadays. So maybe the stuff isn't as Applicable in those situations, but if you're going back and looking at like legacy protocols like some state and state of networks and things Like that this stuff is going to be a lot more useful because there's really not that much documentation for that sort of stuff so it's also important for extending the functionality of software if you guys want to write like a open-source client for particular service This this this project can help out in that in that regard and lastly and my favorite is Finding vulnerabilities and unknown or badly documented protocols using fuzzing. So what I basically do is I? Feed it my my p-cap file it analyzes the structure pops out pops out the X-mail markup, and I feed that into my fuzzer and it starts going to work So what protocol informatics does which is just the name of my program basically Heuristically identifies the fields in data format, so it's never going to be perfect But it's as close to automated as you're ever going to get So nowadays the problems with protocol analysis in general is it's a manual process Like I was mentioning earlier you just pretty much do it by hand using ethereal and fields identified largely using human intuition So I guess I was talking to spoon about this a little earlier And he was basically explained to me that well all these protocols are written by humans So you can basically use your you know human intuition to be able to understand how they were thinking and things like that However computers have never really been able to mimic human behavior that well I mean if you're looking at pattern recognition and things like that Your people are moving over neural networks and and other hit markup models and other things of that sort in order to try to Mimic that Intuition in a computer program, so I guess the main challenges with protocol analysis these days is Kind of just understanding general structure when it comes to different types of protocols So it's for example a protocol. That's all binary Usually quite hard to analyze because there's really no points of reference for us when you're going through it you're just kind of looking at the bytes and trying to find patterns and things like that and Typically it doesn't seem like that that's going to be a pretty much a tedious painstaking process So this is really an attempt to automate that so I think that the crux of protocol analysis in general is variable in fields Long strings in the middle of packets and stuff like that You don't necessarily know if it's not like plain text data where it starts and where it ends and what each byte represents and things of that sort so If you're really gonna Typically, this is all gonna be differential analysis You're just gonna be going through doing comparison comparison comparison trying to kind of build a profile as you go along Unfortunately, however Biologists already fix this problem back in the 1970s when they were trying to analyze the genetic structure and DNA and amino acids and all that sort of stuff So this is all pretty much I'm not taking credit for any of these algorithms I'm presenting today All I'm basically doing is reapplying it to our realm, which is computer security computer science and things like that So bioinformatics, what is bioinformatics is basically information theory applied to biology so it's a lot of probability Shannon Shannon entropy all sorts of things like that and it's mainly used to identify genes in the genetic structure of organisms, so Human genome project the majority of the algorithms that are used are mainly sequence alignment algorithms What they're going out there and trying to find is where the beginning of these genes start and where they end What the function of these genes are and what the structure of these genes are how they fold and all sorts of things like that so How how the workflow for how biologists do this they have these large databases just full of genetic data The human genomes in there they have you know mice and you know every other species that they that they've sequenced and They put this all in a database and then they could start running queries on it So saying like I know that this gene exists in you know You know human it will go through and it can understand Common ancestors and things like that but based on mutation rates and all sorts of stuff like that so If you want to put it in simple computational terms it basically is just processing large amount of structured but complex data It's just too much for the human eye to just recognize so you have to put it in database You have to run these algorithms on it and things like that if you really want to understand the structure So yeah, the objective is to identify genes to determine structure and the function Easier said than done naturally, but there's a lot of analogies to protocol analysis in this case So what but one application of bioinformatics is allowing biologists to map phenotype to genotypes being able to say Blue eyes maps of this particular gene attach earlobes maps of this particular gene and things like that so Protocol for mad or excuse me protocol analysis and bioinformatics have a lot of things in common they both operating large sequences of data and My favorite is just the just the analogy of Biology's phenotype to genotype mapping is equivalent to protocol analysis is mapping of offsets to field locations We're basically just trying to Understand the function of a particular field and a byte stream We don't know where it exists, but it's between you know this offset and this offset fortunately for us that actually makes us easier is when it comes to genes and and things like that It's not all it doesn't have a defined start in a defined end You can have like I think eye color for instance isn't just like one single gene. It's it's spread out throughout the genome. So You have to do a bit more complicated analysis to understand or here's a block where it starts Then it skips this many symbols and then it starts resorts over here. So fortunately for us It's really not like that. We have fields. Here's your start offset. Here's your end offset So what I did was I recreated application that was meant to understand the structured complex data found the network protocols So the core algorithms that are used in bioinformatics in general are mainly sequence alignment algorithms There's two of the most classical algorithms of the Neumann-Wunsch algorithm and the Smith-Waterman I'll get into that each particular detail as we go on but basically the Neumann-Wunsch algorithm is a global sequence alignment algorithm It takes into account every single Symbol in the genetic sequence and tries to align it to a different sequence. It's just a pair-wise alignment Smith-Waterman on the other hand is a local sequence alignment algorithm. It's going to find the most common Substream within the two sequences that are most similar There's ways to improve sequence alignment and that's basically by using similarity matrices and I get into that a little later And it has to do with basically all these algorithms are Operate operations on matrices So there's a lot you can do with different weighting and things like that and assigning scores and and how that the The the matrix is traversed. It's all dependent on the scores in the cells So there's actually a lot of really neat things that that they figured out that they can do using this And then what we get into is phylogenetic tree building. This is kind of cool because this is kind of How violates are able to build like a tree of life and not based on fossil record, but instead based on Genetic information so how similar are these two sequences and being able to go all the way up through the through the evolutionary tree to find common Ancestors and things like that So I go over the two tree building algorithms up, Gama and and the neighbor joining tree Which is just you know, I'm sure many people have heard of that And lastly I get into multiple sequence alignment and that's where there's a lot of challenges involved with Aligning more than one sequence just due to computational problems So I go over the progressive and tree base multiple sequence alignment algorithms And this is a lot of information. So if I am going too fast, just put your hands up or something like that So the fundamental purpose of sequence alignment is really simple It's take two sequences regardless of their length insert gaps in either sequence to make them the same length So right here. I have an example of a DNA alignment There's four base amino acids and DNA is thymine, guanine, cytosine, adenine this is kind of just a really simple example of inserting gaps into the first sequence to align it to the second sequence. So as you can see there's three oops there's three Gaps that were actually inserted into the first sequence which would represent a deletion evolutionary wise so The needleman-wunsch algorithm was I mentioned earlier, which is a it's a dynamic programming algorithm meaning that it operates on matrices And it's basically the I think it I think it was the first sequence alignment algorithm ever Written and I think it was 1973 when it first came out Basically it performs a global alignment on a pair of sequences and what that means is that Every symbol in the sequence that goes into the algorithm comes out of the algorithm gaps are inserted There's no substring searching or anything like that. It's going to try to insert gaps Anywhere it can to make the sequences line up to each other as best as possible to maximize the alignment Maximize the score of the alignment And it's mainly used for analyzing closely related structures and the reason for that is if you were trying to analyze the human genome and a mouse genome and using a Global sequence alignment algorithm There's gonna be so many gaps that are inserted that it's just it's not even going to be relevant at that point So it's mainly used for you know Maybe comparing two different types of humans DNA to understand a brown-eyed person versus a blue-eyed person versus attach your lowest person versus a You know dangling so dynamic programming It's a common concept in computer science. It's not it's not program. It's not coding per se. It's just a terminology that's used to Solve problems by using matrices. So the idea is to break the problem up in the sub problems. So you have a matrix you perform a computation on each cell in the matrix and as The algorithm progresses it uses information that was previously gained in the other cells to progress to Until the end of the process So the results of the previous computations are saved and used by the remaining sub problems And need them in which is a dynamic programming algorithm as is most of the sequence alignment algorithms out there So how need them in which works. It's actually pretty simple little operation that it does The first sequence is placed in the top most row and this and the second sequence is placed in the left most column and basically there's there's this little equation right here that Basically, it's used to assess each cell in the matrix starting at position one one There's three steps For these sequence alignment algorithms. The first step is to assign the similarity score So basically what you do is you go through and you score every single similarity between The character in sequence one on the character in sequence two The second step is you assess all possible paths pathways through through the matrix Left up in diagonal from the particular shell that you're in Assigning the current cell with the value of the maximum scoring pathway using this particular equation, which I have a Matrix on the next slide that will make it a bit easier to understand The third step is I'm constructing a pathway from the highest scoring cell back to the back to the beginning of the matrix and What this represents is the insertion of gaps in each sequence and lastly Okay, actually, let me go back to the equation What you're going to do is when you're in cell ij you're going to look at that your diagonal cell Which is i-1 j-1 plus s ij which s ij is going to be the similarity score between Sequence the offset i and offset j in each sequence it's also going to look at the the left oops it's going to look at the left left cell from from the current position and It's going to add a gap penalty because if you're going left or if you're going up You're actually inserting a gap into the sequence and that's not necessarily a good thing because it kind of makes it a bit Irrelevant if there's too many gaps. So there's something called a gap penalty that will Basically dock the alignment score at the end. So you'll be able to understand what the relative You be able to really understand how important this alignment is and what it really represents if it has a really low score Then you know that it's probably really not that significant So this is the visualization of the concept. I use HTTP just because everybody understands it It's a text-based protocol. It's really simple You actually probably wouldn't ever have to use this program to do text-based protocols just because they're so easy but for For example sake I use it just because it's small enough to fit into a PowerPoint presentation So the first sequence is is placed in the the top most Row just get slash an extra HTML HTTP ones dot oh and the second sequence is get slash HTTP one dot oh So as mentioned earlier, you just kind of iterate through the matrix and you perform the scoring based on the The similarity between each Each character so right here the G's match So you have what you score with one and so on so You go out and you build up the matrix. One thing we mentioned though is Needleman Woonch the kind of like the default runtime environment for it is to have a match score of one a Gap penalty of Z and a gap penalty of zero and a mismatch score of zero. So in some cases you can actually Make this a bit more complex by having different like scoring mechanisms G could Might have a stronger alignment So you'd have a higher score in that case and things like that and when I talk about similarity matrices a little later on You'll kind of understand what I'm talking about. It's probably a little too early for that So what you do is you start in In cell one one and you look at your left cell your diagonal cell and your upper cell And you apply this little equation right here, which is going to take the maximum value of the diagonal or the left or the upper For the diagonal cell you actually add the the score of that position. So in this case It's gonna look a diagonal and add one because the G's match There's no match here. There's no match here. So the maximum is going to be the diagonal plus one So it's gonna leave it a one and the way that these matrices are traversed They're traversed left to right and then they move downward. So The next step move over one one position This time it's gonna look left. It's gonna look diagonal. It's gonna look up It's gonna take the maximum In this case before the cell was zero. So this s i j in this case is going to be zero It realizes that the left most cell in this case is going to be the maximum so It it places that particular value in this cell So it's a really simple operation actually just goes cell by cell and it builds it builds up So this is kind of like the completed matrix and I do this all in hex down here Just to make it all line up and look pretty on the screen so Basically, this is kind of how it looks after you perform all the scoring of the of the matrix the next step at this point is to actually traverse back to the the beginning of the matrix and Understand what your alignment is going to be So in this case Typically the maximum cell is always going to be your bottom right So what bit what we do is we start in the bottom right cell in this case because it had the highest value and We look at the neighboring cells and we choose to sell at the maximum value and traverse there So we start here at e and we notice that our neighbors are all these So basically that means that we can go anywhere because they're all equal we can go left we can go up We can go diagonal I Personally like to just go diagonal just because it just makes the most sense basically Signifies that there's not going to be any gap that's inserted into any other any of the sequences Which may mean that there's actual match there? so this is kind of the evolution at this current point so Sorting down here We look we go diagonal because it's D at this point in D. We look around all our neighbors are C We want to go diagonal again by default And else is disappearing The same deal here all be we so we go to diagonal all the neighbors are a go back to a neighbors nine all etc etc all Until we reach this point up here at this five and we look at our neighboring cells again We realize that there's a five to our left a four-door diagonal and four-door up We want to have the maximize alignment So we're going to take the map this the path that will result in the maximum score So at this point, we're going to start going left This is the completed traverse all the way back to the beginning of the matrix So at this point So at this point We're looking around we notice that five to our left is the maximum so we're going to go there same thing We were we're surrounded by two fours and the five on the left so we go left Etc. Etc. All the way until we hit back here and All of them are equal again, so we decide that we're going to go diagonal So and then it goes all the way back to the to the root So what this means at this point is There are going to be gaps inserted into one of these sequences So what did this do? We computed a path through the matrix and now we can apply the rules of the Needham and Woonge to obtain the two aligned sequences Basically, here's the rule any time that you traverse left on the matrix a Gap is inserted into a sequence.  So here's the results of that particular alignment On the bottom down here kind of a lame example with HDP. I know but it illustrates the point There's gaps that are inserted Right here under index a HTML because that particular sequence did not have that file in there How and everything else matches up So what this allows us to do really is to understand the bound the beginning beginning and ending of the boundaries in the packet so If you wanted to analyze this really simple example, you can say that okay These two sequences had get slash in common We can consider that a keyword and that index a HTML was a file name It's a variable link field. You can put any file in there that you want So we're getting it was subject to deletion in the second sequence So what we can assume at this point is that that is a variable link field because it was subject to deletion Followed by the keyword HDP 1.0 So If you want to actually describe this protocol in a fuzzer you could say okay, we're gonna send a get space slash and we're gonna send a Whole bunch of random data in between followed by HDP 1.0 pretty simple This leads us into explaining my the local sequence alignment algorithm, which is used kind of for a different purpose So this sum is called Smith-Waterman. I think it was written in 1979 I think I might be wrong about that. It's basically a derivative of Neatum and Wunsch. It just has some different rules basically What is what it what the point that is trying to do is find the maximum local alignment between the two sequences Which is going to be a sub sequence between the two it's going to find the the subset in each in each sequence that makes the most sense and That may be subject to gaps and it might not necessarily So this is especially useful in terms of determining similarity between distance sequences because you could look at a chimpanzee genome and a human genome and use local sequence alignment algorithms And you'll actually get a lot more data out of it because the alignments will actually mean a lot more in the end So local alignment. It has a strong scoring mechanism whereas global is weak Because of the number of gaps that may be inserted into the global alignment so local alignment algorithms are used a lot to kind of search the database to understand which Species are the most similar to others and things like that so So how Smith-Waterman works. It's a derivative of Neatum and Wunsch The only difference is you kind of start up with some different initial values Also, this is kind of like a default run You can also use similarity matrices and things like that to modify how this works But but by default it has a match of match score of two So if G and G match we sign that it to has a get penalty of negative two anytime that we move up Or anytime that we move left we're going to subtract negative two from the from this from the alignment score The lower the lower the alignment score the less significant it is any mismatch so G and E don't match It's going to have a mismatch score of negative one The difference is When you're in the matrix you start in the cell that has the highest a lot highest score And you're going to start traversing back the difference is when the score hit zero in the matrix You're going to return immediately and at that point those particular offsets In the matrix are the ones that are saved and use as a representative local alignment sequence. So I actually didn't do like a Matrix and stuff like that. It was kind of short notice and things like that But basically if you want to align these two sequences the same thing as before The score is going to be end up being 18 and it's going to find the substring HD space HTTP slash 1.0 as being the most common Local alignment in that those particular sequences. So that's going to be the most similar difference between the two so Smith-waterman is actually used a lot to determine the distance between two sequences So if you want to find it the distance between sequence one and sequence two You're going to take the Smith-waterman score of sequence one running against itself Minus the Smith-waterman score sequence one aligned with sequence two So in this case, it's 48 minus 18, which is 30. So the distance is going to be 30. Just pretty simple So Basically, here's how it's used in my program. It's not necessarily used to determine the protocol fields I use it just as a classifier To allow me to build kind of like a relationship matrix and understand Which packets in the TCP dump file are the most similar to each other because If you're looking at a complex protocol like isocamp or SMB or something like that they have like multiple different message types This is actually going to be really helpful because it's going to allow us to cluster the different types of Messages within that particular protocol So it's used to calculate the relative distance between sequences for clustering purposes and tree building which we get into later In bioinformatics Smith-waterman is used for multiple segments alignment because DNA is no starting in whereas a packet packet does That's also another big advantage that we have. We know where the packet starts We know where the packet ends. We also have fields that start here and in there. There's no like Fields that are going to span over multiple, you know blocks and jumping over each other and stuff like that like it doesn't in DNA So to improve these alignment algorithms, we use what's called similarity matrix Basically, we replace our scoring mechanism Before I was showing you that a match score would equals equal one and need them in Woonch a match score and Smith-waterman would equal two and things like that similarity matrices on the other hands are Their their tables based on the on the probability that this sequence is allowed to mutate into another sequence in evolution it is possible for different amino acids to mutate into into others but not but not other ones so it's basically allows Biologists to say, you know adenine can mutate mutate in the thymine, but not cytosine and things like that by the way I'm not a biologist. I don't actually know if that is true, but it's just an example. So similarity matrices were pretty I guess They're pretty different I guess because It's kind of based on preference. There's there's there's similarity matrices out there that are used only when Comparing really distant sequences and there's similarity matrices that are used when comparing really close sequences, so The applications protocol analysis is really good though because we have data types. We have plain text data We have binary data and things like that So we can assume that binary data is acceptable for binary data to mutate into other binary data and plain text data to Mutate into other plain text data Especially if you're using a protocol that usually uses English words you can actually have a similarity matrix that accepts I before E and and other kind of common linguistic rules like that so The protocol for me informatics similarity matrices our alphabet is 256 By it's long. So we have a 256 by 256 matrix and each mutation Each cell contains some mutation probabilities between every character So we might say that it's acceptable for a to mutate into e but not into like hex ff and things like that so This is actually kind of some outdated stuff. There's actually a lot easier ways of doing this so So what this allows us to do is is obtain a bit more optimized alignments This way when we're if we use these similarity matrices that are especially tailored for different types of network protocols If you have one that's mixed has plain text in it and binary data in it You could use a particular similarity matrix in there and basically what this does is it allows when gaps are inserted into the sequences There's the alignment is still going to hold true where Plain text data is only mutating into other plain text data binary data is only mutating into other binary data You're not going to have any mismatches in between so I guess the kind of role similarity matrices though is that They're they're they're gonna really be have to be tweaked and you could have Probabilistic models you can do some like Markov chains and stuff like that to initially build your stuff But it's also kind of subjective. I can say that I know that you know Like a plain text character is commonly followed by a null so it's it's able to mutate into a null character and stuff like that That's that's very acceptable so Bioinformatics scientists been years perfecting their version of similarity matrices I don't know how many revisions there are blows them in the pan matrices But there's quite a lot and they're each used for kind of different purposes. I kind of actually had a problem trying to represent this stuff and kind of Allow others to understand kind of what I'm talking about and this isn't actually that great But it's just a kind of stupid example. This super script B just stands for binary. Let's assume It's like hex zero one hex zero two hex zero three Etc. Etc. So if you wanted to line these protocols alignment without proper scoring might actually insert gaps into incorrect places and assume that F might be able to mutate into like hex zero one and hex zero four and stuff like that, which isn't necessarily a correct alignment If you use a similarity matrix with Decent data that keeps track of mutations between different types of data types You'll start getting better alignments where all the ASCII data is aligned to each other all the binary data is aligned to each other and Things like that. So it's basically just a tool to help us Signify our our alignments a bit better so I Kind of explained so far how to do a pairwise sequence alignment, which isn't that isn't that useful Just had a look at two HTTP requests and say, okay, here's the variable link field This is the spot where you put file names. It's really not that big of a deal But it's really not that pairwise sequence alignment isn't really that useful You really have to go start getting the multiple sequence alignment if you really want to get significant results. So Multiple sequence alignment is basically the act of allowing more than two sequences It uses Needleman-Woonch as the alignment algorithm and uses Smith-Waterman as a scoring algorithm The problem with this is there's computation issues So Needleman-Woonch as I showed before It operates on a in-by-in or excuse me in-by-in matrix where n is the length of sequence 1 and m is the length of sequence 2 If you want to start aligning three sequences, you can start building hypercubes and things like that and traversing through hypercubes The problem is it's a the operation is into the ant power where n is the length of sequences and n is the number of sequences This isn't really going to be feasible for us So I have my little illustration of my hypercubing traversed. It can be it can be done But I've been trying to align sequences that are up to 1500 bytes of length and it takes a really really really long time so What we use is a heuristic sequence alignment algorithm. So heuristic. I'm basically sacrificing accuracy for time The objective is to align every sequence to be to each other in a reasonable amount of time But the results are never ever going to be perfect So the way that this is done is by building these phylogenetic trees and phylogenetic trees are basically What you guys would think of a tree of life? You start with you know common ancestors and you kind of move down and you can start understanding the Similarities between certain species and things like that. It's the same thing with packets We know that in SMB all the SMB authentication packets are going to be more similar than a data transfer packet and things like that so typically these are just binary trees which makes it quite simple actually and It does have an interesting parallel in protocol analysis because protocols mimic evolution by changing their fields The kind of just kind of goofy thing that I have here is what came first get slash index HTML or get slash Obviously get slash is going to be the common ancestor So here's my little rip off of the tree of life of lizards as you can see on your on the right hand side These guys look a lot more similar in structure than to this the sea Tigris guy over here with a long tail So basically similar situation applied to packets so To create phylogenetic trees, there's an algorithm called up Gama, which is the unweighted pair group method using arithmetic averages It's pretty simple actually This little equation right here just signifies how the distance between two clusters is taking taken basically The lower the dpq function is going to is going to determine the distance between each sequence and cluster i and cluster j and it's basically just taking the mean of that and returning that back is as a distance of i and j so In this case the dpq is going to be a Smith-Waterman score and the d ij is a distance between two clusters i and j So this is just the operation that's used each step of the way when building the tree so To build the tree each sequence is put into its individual cluster So one pack up per cluster basically Use the up Gama algorithm to iterate through every single cluster doing comparisons between every single Sequence you take the two with it with the smallest distance between each other you create a new cluster k by uniting those those two sequences You define a new node k with child nodes i and j to build the tree you add The cluster k to the universal set and you remove i the clusters i and j It's basically at the very end. You should only have one cluster and You should have a tree bill at that point So here is a phylogenetic tree of SMD protocol. This is just doing like no sessions and stuff like that As you can see there's actually a pretty large disparity between just the differences between different types of packets the edges at the edge length signifies the distance so It's kind of more than a pretty picture I'm sorry. I can't actually like I don't have any cool interface where I can zoom in and tell you exactly what those packets were and stuff Like that at this current time, but from the analysis that I did each one of these clusters up here Represented one of the SMB Message types in the protocol. So this is actually going to help us Say we want to analyze the SMB like authentication packet. Okay, it's you know this cluster over here for instance So we started this route node number start going to start doing our progressive alignment over here. So The tree is your guide. Basically what this tree is going to be used for is to align the sequences to each other As I was talking about that heuristic alignment earlier What we're basically going to have to do is what's called progressive sequence alignment and what that means is we're going to align two sequences to each other and then we're going to Pick one of the one of the alignments and use it as a representative sequence for those two sequences Then we're going to align another sequence to that representative sequence and as gaps are inserted They are They are moved down towards the towards the root Excuse me down towards the leaf nodes on the graph. So the problem with this is If gaps are inserted into the tree in errant places that will be propagated all the way down to the leaf nodes Which can result in significant alignment. So it probably should be a more building tree building should probably be a bit more of a manual process where While you're doing the analysis you kind of look at it and you say this does look acceptable to me I'm going to accept this alignment to be the representative sequence. So Gaps aren't inserted into errant places. Basically. So Opposed to the exponential hypercube traversal upcoming up performs In comparisons where n is equal to the depth of the tree minus minus the root. So that's very feasible for us We can actually align sequences in our lifetime, which is very helpful. I think So multiple sequence alignment basically the rule as I was explaining earlier about progressive alignment is once a gap always a gap So Basically what you're going to do is you're going to align two sequences to each other place a representative sequence in that in the root node of that and As you align sequences to those representative sequences those gaps are going to Translate themselves all the way down to the leaf node So basically the the rule for doing the tree traversal you start in the root and if the root is no You start going left and then you go right If the left does not know and the right does not know which signifies that there are sequences on those two leaf nodes You align those two sequences you choose a sequence with the least number of gaps inserted and that's kind of just I Got the best results out of that I don't really know if that's kosher in the bioinformatics world or anything like that But from my experience that resulted in in decent alignment. So In this case we align sequence one and sequence two Sequence one is chosen to be the representative because there were not as many gaps inserted So kind of lowers the margin of error of errant gaps propagating all the way down through all the alignment So what we're going to do is we're going to place sequence one in the in the root node of these two leaf nodes and we're going to keep track of the edits in the edge So the edits in this case would be you know, I'm I don't have the the list of the offsets right in front of my face but There's going to be edits that are inserted into sequence two to insert those gaps pretty tree not really so you start you start in the The root node apparent note right up here Like I was saying earlier if the root is null you go left and right the root is null in this case If there's there's no value being stored there. So we're going to go left Same thing here. We're going to go our our child nodes are not null So what we're going to do is we're going to align sequence one and we're going to align sequence two We're going to choose a representative sequence, which is going to be one We call it one prime at this point. We keep track of the edits in the edge So edits the edits for between sequence one and two were stored in the left in the left edge and edits for sequence two are stored in the right edge We just traverse our way back up to the root Start moving right now We align the representative sequence, which is one prime with three store those edits in the edge And now what we need to do is we actually need to we need to Propagate those gaps that are inserted by the edits all the way down to the leaf node. So If we want to align all the sequences to each other, we basically Add up all the edits. So sequence one aligned, which is over here. We're going to add the edits of one prime three to one two To add the add the edits the edits in this case are going to be the gaps by the way if we're going to edit Excuse me, if we're going to propagate those gaps down the tree to sequence two, we're going to take one prime three added to the edits of two one and lastly For sequence three all we need to do is add the edits of three and the edits of sequence three and one prime in this case as explained So another kind of hokey example of three sequences being aligned this time a Bit more verbose usage of HTTP I guess So basically in this case right down here. This is what's called our consensus sequence What we basically do is we start in offset zero when you go down we say, okay, these are all bunch of G's So we're going to put a G down here, etc. Etc. Once we start getting over here, we start noticing that there's gaps inserted So that might possibly mean that that is a variable link field so in this case, you know, I'm just representing that by the question mark down there and All is the same you have a space here. This is all matches up just fine followed by host followed by more unknowns dot Three three spaces for comm.net, etc. Followed by the user agent block Followed by the browser type followed by except text x amount So if when we're analyzing this consensus sequence, basically what we can say is okay Here's the structure of this particular format. We have a get space slash followed by a variable link string followed by HCP 1.0 I'm not counting new lines or anything like that at this time Followed by host followed by another variable link sequence followed by dot followed by another variable link sequence followed by user agent variable link sequence except text x amount so What we could do at this point is feed this little Structure into our fuzzer and just kind of just let it let it start going. This is completely automated process I didn't really have to do anything in this case Unfortunately, I don't have like any good mixed protocol where it's buying it half binary half plain text for me to show you right now, but I'll put up some examples on the website and kind of like walk you through using the tool and stuff like that They might be actual actually useful One thing that I want to say about this though is If you'll notice With these consensus sequences, I'm just assuming that this is gonna be variable length and this is not gonna mean anything So basically what what's happening here is I'm losing information. There was a C here in two gaps There's there's got to be a better way to represent these consensus sequences There's something called sequence logos and basically what it is you it's kind of just like a stacked histogram of each of each offset So let me find a good example. So right here after the after the host you have two W's followed by a gap Basically when you stack that histogram up usually it's a W But sometimes it's it contains a gap and things like that So in this in that case you don't really lose information and you're actually able to use a little more of your human intuition to be able to understand the alignment a bit better than just Ruling it out just because of her gaps or because of her mismatches and things like that so So basically here's how we're going to analyze this the consensus sequence in this case We could do statistical analysis on each column by building histograms So we build our consensus sequence Like I showed you on the previous page and we and we look at the mutation rates and the offset comparison between between each offset So basically what we can do is We can say okay, this has a A mutation rate of let's see. Let me try to find a good example okay What what we can do is if you look at this block right here of all these question marks All these every almost every single one of these has a similar mutation rate They they have a rate of change that that is pretty constant So if we were wanted to analyze this like a binary protocol It's all it's a lot more difficult to look at just on the screen. We pretty much base our Understanding where the field begin feels and based on the on the mutation rate so for instance what we can do is Look at the rates of mutation for each offset and using that we can kind of understand what that particular field might be used for so One thing I wanted to mention though is beware junk data in the last example if there were any posts in there It would result in kind of a bad alignment and it would it would actually be a little more difficult to understand what the general structure was so What I was talking about earlier about with the with the clustering algorithms if you cluster things correctly and you choose your The root nodes in each cluster You'll be able to get decent alignments out of it instead of trying to align really distant sequences where lots of gaps are going to be inserted so Yeah, classification is your friend The better that you cluster the packets the better your sequence alignment is gonna end up being so This was kind of an experimental phase about a year ago when I was working on this But I kind of already implemented this in code. So it's really not that experimental anymore I just haven't really had a chance to work on the slides At first what I was basically doing was I was separating the dynamic data data that was changing versus the static data So in the case of HTTP I was able to understand just the different blocks and stuff like that and understanding the variable length fields Just by because it was dynamic data. It was changing To understand integer fields. This was actually work. This actually worked out pretty good You can build like a just an ingram frequency tables for one two and four by window sizes and you just kind of slide yourself over over the consensus sequence in that point and You can use some logic in your program to try to discern what that what the particular function is of that field so for example if two consecutive bytes that are integers Mutate at the same rate the chances are that they're part of the same field and maybe their checksum or something like that They're changing every single packet The second example if in two consecutive bytes the least significant bite increments faster than the great greater significant bite It might be a 16-bit sequence identifier field or something of that sort so This is all also implemented stuff fortunately But what I was going to basically do is build a protocol profile based on each consensus and aligning each sequence individually to break down the structure so for example, I would take a SMB login authentication packet Consensus sequence I'll take a SMB like data transfer packet and then I would align those two to consensus sequences to understand the general Structure of the protocol the packet format in general They're still going to be pretty deviant, but you'll be able to understand like the specific blocks in between like I'm block-based protocols Like isocamp SMB and things like that That's actually going to be quite helpful. I would think The biggest challenge for me this far is being able to present the data in a readable format where the user can actually understand the results so I Have all this stuff kind of implemented Like on a like a command line tool which kind of made it difficult So I'm just kind of like using antsy color and stuff like that to to kind of print all this stuff out And the last thing I wanted to say about this particular tool is it will never be fully automated if accuracy is in mind But if you're doing protocol fuzzing you don't really have to be accurate necessarily so it's kind of okay to have It's kind of okay. I guess to have That that that kind of entropy in each sequence. Let me get this So basically what this can be used for is understanding unknown protocols some kind of like Worm for all we know communicate with its with its brothers and sisters all over the internet using some binary format that we've never seen before This also allows us to fuzz network protocols more efficiently because we don't necessarily have to write protocol specs for them If it's a common protocol I'd probably say just go read the RFC or something like that and and just look at the ethereal samples because there's so many of Them, but if you're looking at some black box protocol, you've never ever seen before in your life This is going to be a tool that would probably definitely be useful. So Also one thing I kind of forgot to mention, but this can also be used for file formats There's you know, there's really no there's no difference between a packet format and file format So if you wanted to understand some proprietary file format Same same situation the only thing that you need to do is just have a lot of samples that are different so And also if any of you guys have any ideas about how this stuff can be used I'm interested in hearing it so My conclusion is this stuff will never be automated a hundred percent like I was describing the tree building earlier It's good if you wanted to Be involved in each step of the process so you know which representative sequences use and which gaps are inserted because as gaps propagate down To the root nodes there can be errant gaps that make the alignment quite useless and things like that So Basically right now. I have a Python proof of concept for this. I have some C++ code that I'm working on It's actually gonna be pretty good. I should have it probably finished in about a month or two The Python code right now. I use Pyrex I don't know if you guys have ever heard that to do like all the the hard computationally expensive algorithms like the Needleman Moons matrix operations and stuff like that I don't know if you guys have ever seen this tool. It's called orange. It's pretty cool It's um, it's basically like a widget-based visual programming interface It kind of allows you to play with different data mining algorithms. So you can kind of like link together everything so in this case like what you'd be able to do with Protocol informatics is be able to say okay. I want to use this particular Classification algorithm for clustering. I want to use this particular sequence alignment algorithm I want to use this particular tree building algorithm because there's actually Like four different types of tree building algorithms. There's the Upcoma. There's neighbor joining. There's multiple parsimony things like that So there's a multitude of uh of opportunity to implement all sorts of things and kind of just figure out what what works So I guess the whole moral of the story with with what I'm trying to say is um I know it's it's kind of difficult for people in this industry to kind of like look outside their science that they're working on and kind of Understand that people might have already kind of solved everything back in the day So this is just kind of a good example. I mean this stuff was was figured out in the 70s and you know It's 2005 now and it's we found the use for it. So I'm taking questions now. I'm feel free to walk up to get a microphone up here or something like that and uh Thanks for coming Questions I can't hear you Do you want to come up here and try to use a mic? Yeah, I'm working almost exactly the same thing with mutating web things But I just walked in on the end of your lecture and I was talking to this guy who's also doing tree algorithms But he's doing it with granularity Based on the levels of complexity of the search Have you looked at any of that stuff for your sorting and tree methods? Yeah, that's basically a maximum parsimony tree building. That's where You every step of the tree you're going to look at The complexity of what it would take for these sequences to mutate to to reach this particular result and and usually Evolution chooses the path of least resistance So in maximum parsimony trees you have two different choices. You're going to choose the choice. That's the most simple Anyone else? Okay, well, this is a lot of information. I'm sorry if I didn't have any other ways to represent it in a kind of clear and clear and concise manner, but This is the website for for this project and I Encourage you all to visit the site and download the tool and just give me feedback if you got it. So thanks Just want to make an announcement that meet the fed will be a


Hello friends, I am Sanjay Gupta. In this video, I am going to demonstrate you the use of move to function to change x and y coordinate positions. This function is available in Graphics.h header file and I will be demonstrating it with the help of TurboC. Before starting, you can subscribe my YouTube channel by clicking on the link which is available at bottom right corner of this video. You can download my app Techimage that is available on Google Play. You can connect with me by following these details which are available in front of you. Now you can see I have included two header file connu and Graphics.h then inside main function three with four variables gd, gm, x and y are declared. gd is initialized with detect. It will automatically identify the graphic driver then character array str is declared then init graph function is called which is having three arguments first argument is gd then second is gm so graphics driver and graphics mode variables addresses as passed here then a path for graphics library c, tc and bji is passed here after initializing the graphics I can call getx and gety functions to identify the current x and y coordinates position so x will be containing current x coordinate position and y will be containing current y coordinate position because I have used getx and gety functions now I am calling s printer function this s printer function is having first argument str this str will be containing this string in this string current x and y position equals to percent d and percent d statement is written these two percent d's will be replaced by x and y respectively first x will be replaced by sorry first percent d will be replaced by x and second percent d will be replaced by y and the complete string will be assigned into str to display it on console I am using out text x y function this function will display the content of str on console on 10 20 coordinates then getch will hold the screen close graph will deallocate the graph and return 0 because return type of main is integer now I am executing this code you can see the output current x and y positions are 0 and 0 now I am going to use move to function so that you can see we can change the cursor position or you can say x and y coordinate positions so move to is passing 30 and 40 so x coordinate will be moving to 30 and y coordinate will be moving to 40 position I am copying these statements and I am pasting it just after the move to function call you can see this code these statements identify the beginning x and y coordinate positions then move to is changing the coordinate position and again I have identified the coordinate positions this time I am changing this y coordinate so out text x y will print second message on 10 40 coordinates I am changing these coordinates because two statements will be printed on two separate positions now you can see the output current x and y positions are 0 and 0 this is because of first a get x and get y function call then current x and y positions equals to 30 and 40 this is because of second get x and get y function call and these coordinates has changed because of this move to function so friends in case of graphics if you want to change the x and y coordinate positions then you can use move to function anywhere anytime and any number of times so I hope you have understood how I am using move to get x and get y functions together to changing and to identifying the x and y coordinate positions if you want to watch more programming related videos you can subscribe my youtube channel that is sanjay gupta underscore tech school thank you for watching this video


Good afternoon everyone and welcome. This is Melissa Armour with Stocks. What should I thought I would review Adobe? Why? Well, because I gave an option call on Adobe prior to the earnings coming out that the stock would gap up as it turns out it actually did gap up on the earnings but did not have the follow through and it got mainly due to the market. The market just collapsed the day of the Adobe earnings. Who knows why? It just did. But it definitely affected the stock because this is a market stock. This is way back here. So the earnings came out in the night of the 12-10. In fact, I'm just going to show you here where it actually was. 12-10. I want to show you this is the actual earnings, the live earnings on 12-10. This is the post market because it was at night. The call was just spot on to predict the stock would gap up on the earnings. However, what ended up happening was, okay, so this is the earnings, 4 o'clock, huge green bar, rallied, made a high of 94.42, and then on the live day, the stock actually in the pre-market, well no, it was the 15th. It was the 15th it took to get up over 95. That was the next number. So here was the earnings, failed to go higher through that number on the earnings, but did make an all-time high. Then it took two days to get up here over the 95 number that I had. And the next number is 98, but it's not there yet. And it looks like it's going to get there soon. Someone emailed me about the fact that I had made this call and I had put it out to everyone on my marketing list. If you read the email that day, you saw it, and I said about the option call and I did an option in it. And I predicted the gap to gap up. I predicted the stock, okay, to gap up on the earnings. That 100% happened. How I saw that has nothing to do with my system. It's my ability to predict stocks and their price movements. But the gap didn't follow through on that day from where it opened due to the bearishness on the live day in the market. Some days will be times when stocks do not follow through even if the gap rates well on the live day. What usually ends up happening though is that it continues the next day and follows through as a continuation gap. And that's exactly what Adobe did. So interestingly enough, it did follow through. It did go over the high of the high of the day of the gap of the earnings today, which was 93.65. It took two days, but it rallied the previous day. Anyways, the stock closed the night of the earnings at 88.96. I predicted it to gap up and it did. So it opened on the next day at 92.51. But remember, in the post market it was up over that number more than that, over 93. So the stock actually gapped up like a good, you know, three, four bucks or whatever between the post market and the pre-market and the day of the earnings when it opened. Had a beautiful rally. It just took two days to get going. So when you do options trains, you have to be right for the timing. If you have an expiration date, which all options do. So you can either be tight, tight, tight with it or give yourself more time where you'll pay more money for the cost of the price of the option. It's up to you. Either way, the prediction I made for Adobe to gap up in the earnings came out to be true. The targets that I gave for Adobe to get to are still going to come out to become true. But the timing of these things did not happen the exact day that I wanted it to, which was the previous day after the earnings, which was 12.11. And some person had the gall actually to email me that he shorted the stock on that day in the option. That was an insane thing to do. The person obviously made money because the stock fell on the day, on the actual live day, okay, had a bearish bar, opened a rally, made a new high and then fell. Have you shorted the stock on this day as a day trading made money? But was it the right thing to do? The answer is no. And the person had the gall to email me that I had made the call that it would rally, which it did, okay. But anyways, this person made money shorting it. This is a terrible short. This is a terrible, terrible, terrible short. And what I have found is one of the major problems with day traders or swing traders or any trader at all is that people won't make money doing something that makes absolutely no sense. And it's a complete and total incorrect trade. And then they will keep making trades like that and end up obviously losing. It was a terrible trade to short a doble the day of the earnings. Despite the fact the stock fell on the day and the market ran red on the day, the stock held in the first 15 minutes of the day as a short, set the low of the day in the first 15 minutes of the day and has set this low, which it has not fallen through since the day of 12-11 of the earnings open, which was 90-12. And the market's fallen a bunch of days in here. The stock actually made a brand new all-time high, even though the market is not. This stock is one of the strongest things in the market.  It's a terrible trade. It's a terrible call. And anyone that does that will not make money consistently. What you have to realize is that as a trader of any kind, day, swing, core, long-term investor or anything, you decide to do in the market. There will be times when something doesn't work out that you predict will work out and does not work out. And sometimes there's no explanation why. Sometimes there is an explanation why. And the answer of Adobe, the reason that it gapped up turned out to be like I predicted. It did not go to the target that I predicted on the day of the earnings because of the reason, a real reason, which was the market, because Adobe is a market stock. But sometimes there's not a reason something doesn't work out. But if you have my ability to be able to make predictions of stocks before they gap and in the live gap, based on the 26-point rating system, you will consistently make money in the market. When you take potshots at doing things like shorting Adobe the day of this trade, okay, on 12-11, the day that it opened, gapped up, made a new high and fell on the day, the person that shorted this, whoever that person was that made money. By the way, I took off my list. Because I would never take on someone like that as a client. The fact is that it was a terrible trade. And people that do these things do not consistently make money. The only way you have longevity in the market to do it as a full-time career or a part-time job, or anything that you want to sustain you to be an investment that's worth your time and energy and effort and brain power is if you can learn a system that will consistently make you money. Shorting Adobe the day of the earnings may have made you money but it's not consistently going to make you profitable as a trader of any kind. It was a terrible trade for anyone that did it. And what happens is, and I understand the way the brain works, when you make money doing something incorrectly, you tend to then associate with your mind that type of trade and you will repeat it in your mind that you made money doing X, Y, Z like shorting Adobe this day and do it over and over and over and over again and give back thousands and hundreds of thousands of dollars to the market by doing poor quality trades just because the one day you made a trade that made you money. But that's not what I do. I take quality trades based on a 26-point rating system that predicts what the stock's going to do. Every once in a while they don't work and that is part of trading. Anyone that does this for a living or anyone that does this at all has to accept that and be willing to accept that without losing conviction in their system. As it turned out, my prediction the stock would gap up and make a new high was right on the day. My prediction it would follow through was correct as well. This stock is actually moving ahead of the market and is a great, amazing, fantastic lump.  And if you made money shorting it, you will give that profit back to the market and a thousand times over and more. Because at the end of the day, you cannot short a chart like this, like Adobe. It is an amazing chart. It is moving faster than the market. And it is a market stock and what I would consider a market leader. Know that if you want to be successful you've got to learn to trade from someone that reads charts correctly like me. And if you are able to do that and have the confidence and conviction to come to me and pay for my Golden Gap class and learn from me, you will make money consistently over your entire life. It's not just about one day. It's about Monday, Tuesday, Wednesday, Thursday, Friday, January, February, and March to the end of the calendar year. 2015, 2016, and for the rest of your life. Have a great day, everyone. The next Golden Gap class is January 9th and 10th. Email me at melissa at thestockswish.com and have a fantastic day.


This is why in the morning, and we're discussing about financial literacy, you can tell us what is that one bad financial decision that you made in life.  Talk to us at Y254 channel, and you will sample your comments later on. For now, Roger is answering us. What are some of the ways, what are some of the principles that one can put into action for someone who wants to start their financial literacy journey? Okay, sure. Thank you so much. And as I started, I said that you cannot spend what you don't have.  So you have to know what streams are you going to use so that you can earn. For example, if you are going to, maybe, when I lay in the native of Ibarua, like for example, where I work in Nakoro, there are Ibaruas for 200 shillings per day. I mean, from morning 8 to around 1pm, 200 shillings. So you have to know that how much am I earning per day so that I can spend X amount of money. And if I need to borrow Y so that I can have a total of Z and I can use it for A. And then from what I have borrowed, I'll need to return by this time of the month. And then what will I save? It also comes to that. So let me see if I get you. You have to first earn. Yes. How much you are spending so that you know how much you need to save? To save or invest. To save or invest and if you have taken alone? And if you are going to invest, will you need to add up some cash that goes now to borrow it? You need to loan. Then in borrowing, you'll have to ask yourself, am I worthy of this credit? In this Kenya, I hear that we have about 70% of the population is in CRB. Yeah, Xida. That's a big problem. Yeah, so we have to also check, self-check our credit worthiness. Are we worthy of that credit? Are we worthy to co-op an attala, co-op an branch? Now what are your goals? I think I failed to mention that in the savings part. Before, after spending or after making a budget for your spending, you don't have to spend. You just make the budget. Then you have to pay yourself by saving. So fast you make the budget? Yes. You know, this and this and this, I need to pay the rent. I need to have my transports aside. I need to buy shopping for the house. I need this and that. So you do a budget first. And then next, you do savings. Yeah, you have to pay yourself. The first amount of money that you get off from the salary that you earn is to save. To save. Pay yourself. Pay yourself. It's important. I've been working for that for 40 days. But I don't know how to save. I don't know how to save. So instead of saving, I decide to save myself. I don't know how to save myself. No, that's not the right way of paying yourself. So paying yourself is saving? You pay yourself by saving. So after saving, you need to maybe invest in something. You have a dream. You have a goal. So you know your goals. Your long-term and short-term goals. I need this to get to this place. For example, myself, I'm seeing my company getting somewhere in the next five years. So personally, I'll be saving something from my own kit. I'll also be saving from the company's kit. But this will help me in the next future. I need to invest the money to something. For example, we are now investing in inputs, firm inputs. The prices of fertilizer have gone up. Around 6,000, 7,000 farmers can witness. 6,000, 7,000 for one bag, 50 kg of fertilizer, chemical fertilizer. But we have inputs for organic which are much effective at 2,500 shillings at around 1,500 for 25 kilos bag. You see, kind of decisions that we have to make at the end of the day will also determine. So that is my short-term and the long-term plan. I'm planning that in the next five years, I have my own kind of manufacturing center for the organic farming. But before I get there, I need to sell other people's inputs. So we get them from other manufacturers and sell them to farmers because we have that connection with the farmers. Alright. So then, if we need to invest much further, we need to borrow maybe from a bank. A bank, we have to look at the interest rates of the bank or from a circle, somewhere. And then the repayment period. And then other terms. For example, is it worthy for my company to have this credit or is it worthy for myself, Rogers, to have this credit? Then we'll also need to protect what we have. By protecting, I mean we can have a kind of an insurance that protects us from financial risks. We'll also come to that. Okay, no problem. So let's list them. You said you save a badge. You earn and then you have a budget. Budget. And then you save. Save and then invest. Save and then you invest, right? Yes. And then after investing, you see how... You can borrow. You can borrow. Yes. And then after borrowing, you see how you can protect. Yes. That's the insurance bit of it. Yes. Okay, so back to savings. So should you just save for the sake of saving? This, saving not investment. So should you just save or should you have a plan before you save? So I'm saving for this. Or should you just go ahead and save to Evo? I can save that saving and investing at wins. Okay. So someone can say that I'm saving by investing. And someone else can say that I'll get to a bank open a savings account which gives me an interest of this percentage. So that is a kind of an investment in savings. Okay. So you don't have to just save. No. You will determine that I need to pay myself an amount, let's say X, amount X. So what are my plans? What are my short-term plans? I think I talked about it. You talked about it, the long-term goals and the short-term goals. Yeah, the long-term... What are my short-term goals first? No, you have to determine the long-term so that you can determine... You can know how to break the short-term plans and then they'll contribute to one. All right. And now back to loans. How do I manage loans? 70% of canyons according to research are already in CRB. So you find them to a taboro from Tala, Keshom to a taboro from Mshwari, Keshom to a Tafani. You know, different avenues and then you delete it and it becomes a trend. You borrow or you borrow to pay a loan. You know, so how do we break that? Okay. It depends on what you do with a loan first. You borrowed it alone, what did you do with it? If it was something worthy, I bet you should have returned it. If it was for sherehe form, I'm sure you wouldn't get... You wouldn't... Out of it, you wouldn't be able to return it. But if you invested it maybe in a business... You'll have returns. For example, there is a time when I used to sell shoes. And there are students who survived by selling shoes and I really applaud them. Because they are becoming informed as early as they are. Someone is 17 and is already in business. Yes. So I think about the loans, what are you borrowing it for? The purpose of it is what matters. Yes. And if you invested it, it turns... It turns or what? It turns. Find a way, work yourself, and make sure that you repay it. Then the next time you are thinking of getting a loan... Think twice. Think twice. But if you know someone who lives from hand to mouth, it's not necessarily sherehe or business. So I'm borrowing to pay my rent. I'm borrowing so that I can eat food today. This month, I don't know what to do. So I'll go to Paletala, I'll go to Kopa, 20,000. So next month comes, maybe I get some 20,000 from another loan app. I'll pay it. You know how it works. You know how people borrow it. So definitely because I don't have a job, I don't have anything. This is the only... You know, means to know how to share this point. And why do you borrow a loan to pay a loan? So you see particular interest to see Qatar's rent next time. Yeah, it's quite a limit and all that. Okay. So I understand such kind of situation. And at some point in my campus life, I think I also borrowed. Wow, you must be very... Financially, okay. Come on, it's at one point. No, not just one point. I mean, at some points... Points. Oh, at some points in campus. That's a good idea. Because to survive, of course, you need food.  So you need to pay bus fare and all that. But it never reached a point that I borrowed to pay. I borrowed just the pile. But I think that was... It really helped, by the way. Even though he didn't have money to pay. And to clear afterwards. I think when it comes to loan, we need to think of our goals. And if it's for surviving, you can survive by other means. So you find other avenues of survival? You can use other avenues to survive. For example, if it's in a school set, you can maybe go to your... For example, I was in the University of Nairobi. And we had this work study program. We were paid 125 shillings per hour. That is what I used to survive with. I remember the salary that I got at the end of the week. It was about 5000 shillings. That was good. We used to work at the Kahawa. Thanks to Professor Kiyama. We used to work at the Kahawa in the College of Agriculture and Veterinary Sciences. And that 5000 shillings, I tried and prepared of debts. Because the next time they'll have... Well, maybe I'll need to borrow. But I enrolled in a financial class. So you got that awareness on how to manage. And you have a program coming up from an organization that you are the co-founder in, that is SkillUp. So what do you do as we come to a close? Tell us what you do and how you inspire the young people to have this awareness on financial literacy so that they can become better. Okay, so thank you so much for this opportunity. SkillUp inspire is a forum for both tertiary students. By tertiary, I mean their polytechnics, their colleges, their universities. Basically, the reason for this is to help empower them to make informed decisions and venture in entrepreneurship and also be financial literate. By this, I mean that they can use their skills. Everyone has a skill. Maybe you have speaking skills. I have graphics, design skills, I have something. We merge them. That is what we encourage. That kind of building, I can say brotherhood or a meaningful relationship with the rest of the world so that you can have one common solution to your problems. For example, I have talked about maybe someone as a good communicator. Another one is good in graphics. Another one is good in social media. He has so many followers in social media. They can join up. Come together, merge and form something. That will give them income. For example, as we speak, there are so many politicians out here. Looking for people to help them to come on board to their team? To come on board to their team in terms of communication. When I talk to them, we need people in logistics to go and talk in their campaigns. I am not talking about politics in terms of politics but I mean I talk about it in terms of the opportunities that are available. There are so many opportunities. There are companies which need to do advertising. That also they can come up and team up. Others in agriculture also, like myself, come in. So from different fields, right? Different fields as long as you get the skill. And if you don't have the skill, you can also learn. When is this workshop happening? That first March, it is happening from 2 p.m. to 5 p.m. At American Corner Spaces, Bazaar. Yes, more years than you. Thank you. This has been a great conversation with you. Thank you for sharing your insights on financial literacy. I believe we have picked from it. I believe that you have picked from it. So make sure that you aren't fast and then you save. You have a budget and then you save and then you invest. Then after that, you can have an insurance plan. That has been Rogers who is an entrepreneur and a young farmer. We take a short break and we will be back with Ram Agoko to discuss youth and politics.


You can see that for the year we're in, the Economic Forecast Council has dropped the forecast by a small amount, but dropped it nonetheless to 2.1. In 2013, you can see where the Economic Forecast Council was in January of this year, where they have now landed in their formal advice a couple of weeks ago, and at 2.2, again a drop we have adjusted as well. We think and the Ministry advises that they believe that level of prudence is still appropriate as between 2.2 and 1.8 that we are basing our calculations and figures around. So what does this all mean in terms of the bottom line for British Columbia and for the fiscal year we're in? So you see what's happening on the revenue side, and I'll talk about that in a moment, where you see the further deterioration on the revenue side. Expenses and expenditures we are holding firm to and to the extent that we're able to manage through and realize on our objectives that is a key part of the strategy. You'll recall when we were last here a few months ago we talked about managing down some of those expenditures, particularly the reduced revenues from natural gas and identified a target. We have realized on a good chunk of that target we have some more way to go. 65 million remains to be identified and we will have hit that target. But bottom line you see continued growth for this fiscal year in the deficit and that presents obviously an ongoing challenge and one that we are having to manage and we'll get into some of the details around that. I will show you in a moment a comparative chart that I think is important. So there we are and there's Ontario, Quebec, Canada and for fund the US. To put it in some kind of context, we, BC's interest bite, that's the taxpayer supported interest expense as a percentage of taxpayer supported revenue, for us was 4.1% last year. For Ontario it was 9.5%. What does that translate into in real dollars? For us it was 1.6 billion. If we had Ontario's interest bite of 9.5% applied to BC's taxpayer supported revenues, our debt servicing costs would be 2 billion more than we presently pay. Where does that leave us going forward? We will know of the measures that we've taken to control expenditures, hiring for each management salary freeze, control on travel. The question that I'm sure someone will ask so I'll answer it for the first time and then again are we going to balance the budget next year? We're going to balance the budget next year. You will know that in the fiscal plan we showed the progression towards that balance. I thought I'd give you a quick, just put up a slide on the PST and the transition to the PST. So everything's on target for April. The first registration of businesses begins in January. The liaison work is taking place. The phone lines are up for people that have questions. Next steps as I say are pretty predictable. We'll finalize the work on the budget. Look through some of the other budget consultation material. The Select Standing Committee of course has reported out and some of the other agencies, the expert tax panel some of you are familiar with provided some recommendations, finalized the budget and the budget is February the 19th next year and we go from there.


In your presentation, the assets where Vanguard really took off and spiked and just let Fidelity in the trail, happened about 2007. And another thing happened in 2007, and I wonder what the correlation is. That was the founding of the local head toward God. Well, I'm glad to answer your question. Alright, without further ado, a number of years ago, Jack asked if he could have a chat with Phil Bernstein, an informal non-political chat. And we all know the way Jack wants Jack gets, and it's become known as the Farside Chat. So without further ado, I'd like to introduce Jack's companion for the Farside Chat. He's a retired neurologist who helped co-found the fishing frontier advisors. He's written another best-selling title in both finance and economic history. He holds both a PhD in chemistry and an MD. Please welcome one of the smartest guys I know, Dr. Bill Bernstein. Well, since you made sure that you made this comment, I'm going to start with Keynes v. Haydn. For those of you who aren't quite familiar with the big Keynes that you can address, you can on my okay now? Yeah. Okay, is that okay? Yeah. Yeah, all right. Welcome, sir. Good to see you. So, you know, for those of you who aren't familiar with Keynes, it basically says that the rest of Central Bank is necessary to bring out the punch bowl from a necessary to take it away when necessary, and Haydn said that, you know, you won't be encouraged to booms and busts, and you'll get hard on inflation. And of course, this became relevant in 2009 when the Fed brought out not just the punch bowl, but the whole liquor store. And, you know, we haven't seen inflation, but there's still the risk of booms versus busts. I've seen booms getting thrown from all the equipment. I wanted to interject on what you wrote about that. Let me say, again, with that perspective, that reminds me of Mao Zedong, the Chinese leader. Mao Zedong and the Chinese leader, I guess, look better. He was asked about the implications of the French Revolution. And Mao Zedong said, it's too soon to tell. I think that's pretty wise. I'd say any Keynes has been, importantly, vindicated by this last go-round national system. What would have happened if it were smaller to some extent, and the converse to some extent. Back in those days, the converse did things. Oh, I'm not supposed to say that. And they pumped them up. They pumped and they're still really stopped pumping, but they're not taking up any of the well. And I think that helps to explain why we have all the industrialized companies in the world. I've had the best recovery. Switzerland, maybe, ahead, but against Italy. I'll be a grease-out. The United Kingdom has been stronger. And I give the Fed a lot of credit for that. Particularly since this time, the Fed is operating with, with regard to the economy is operating, the conventional economic wisdom policy, such as the Fed does, a fiscal policy, you need to spend more. And we have not done very well on the fiscal policy side at all, so how this will all be, have those huge assets on the Fed. Everybody expects them to unwind, but maybe those will be the same for a while. And I think probably the most important guess is these low-interest rates are going to last for quite a while. The smart money is saying, I, consistent with my personality, would say if the smart money is all betting, no rise in rates, I'd better not rise in rates. But I think that the smart money so far, remember exactly what it is, is about right. So I think King's got this one pretty much right in an imperfect world. I studied it back in college for his help on understanding the markets. And that's essentially where this, he called it enterprise versus speculation for long-term yield on the asset versus the price that the investors are willing to pay for it. And that's the fundamental. I think the most fascinating and vivid data related to that is that if you subtract the long-term tips yield from the long-term treasury, you'll get an imputed inflation rate over the next 30 years of 1.6%. You know, if you want to make an economic historian laugh, you can tell him that figure if you remember that figure. All right, well, if you turn your soul after the second martini to the left. I only had one. I only had one. But those are the best ones, aren't they? And you told me that you own the International Bond Fund. Well, yes, it was in your retirement plan. No, no, I'm sorry. That has a misunderstanding about what I said. Actually the way the conversation went was that I decided to move to get a little more conservative. I wanted to move right into it in your retirement account at Vanguard to have a limited list of funds and includes total bond market fund, which for reasons I've said over and over again, it's 70% governments. I wanted to go to an intermediate term, Bond Index Fund, which is about 35% or 40% or 45% or 50% governments. And I would like it to be even lower than that run just like an index fund. Are not eligible choices. So what I was complaining to Bill was, why are they offering that as a choice when they could offer something that would make a lot more sense for 90% of all investors? So it's a small misunderstanding with that. I wouldn't want to do that. Well, you've got to be kidding me. How did you have your opportunity to tell me why I was still wrong about international investment? Well, first, let's talk about the first one that I'll give you. Well, international, my thesis is so clear in my mind. My thesis is so clear in my mind. I can even hear that echo, so I know I'm doing okay now. And that is, first of all, if you invest in the S&P 500, you will own an internet from outside the U.S. So it's not exactly for higher risk adjusted return or something like that. On U.S. stocks and U.S. stocks, we've read for many years, long time ago, 15 years ago, we read about 35% or 40%. And now it's about 85%. In these last couple of years, it may be 95%. I wish you don't get that thing that people say has value that I don't believe has value. But whatever it is that's going on. Is that too Pennsylvania Dutch and expression for you? So that is, and this is the way I've kind of run all my yet. So in concept, that gives you more companies, whatever you want to say. But I look forward to see what's in it. And the largest, the largest, the largest holding is France. So the U.K., the scene over there, they still had more of several ways of going on tourism as kind of a yesterday thing. Not so much to be said about Britain. Japan, every once in a while, is tsunami. What's so high about that? None of that's on the ground. Oh, France. Oh, France. Do you know they don't work there anymore? They were supposed to go with $35 a week when they went on strike. 35 hours a week. Hey, who works? Does anybody in the room work only 35 hours? Or when others step on these dollars, I spend my money in dollars. I save my money. That's my money in dollars. I am the most productive economy in the world. How is that going to improve my returns? Now, I just don't see the merit of any of it. Why take a currency risk? Yes, it can be hedged with a cost of a lot of money. And when you get the international bonds, I'll sneak back on that one, Bill. The international bond yields about 1.3%. And the U.S. bond yields, depending on how you want to calculate it, to 1.5 or 3%. And the today's yield is what determines your future return on the bond. Now, it doesn't seem to me to be looking good and bad. I don't want to worry about foreign currencies. I also know that with the exception, maybe, of Switzerland institutions, financial institutions in the United States are the most established in the world. The protection of shareholder rights is the most established in the world. There isn't any possibility of currency controls getting in the way of mining. So, and my final icing on the cake is when Warren decided to leave its 90% of his wife's estate that he's leaving to her in the S&P 500 index fund, he obviously wasn't thinking about $100 in the index business with like this. And then Warren's fees because like this and that. Just like the book thing. I'm sure he'll think of something. But then I know what's saying. So take that. Just think about what you're really trying to accomplish there. Performance. It would not be amazing to see the performance reversed in the U.S. and that's been going on for a while. The long run is a message I was trying to say in the data I showed you this morning. It's determined by the strength of the economy. The stock market has nothing to do with stocks and non-U.S. stocks. Look a little bit undervalued relative to the U.S. maybe even up to the U.S. in terms of dividend yields and P.E. mortgables will go over. But maybe that's because they're riskier. I don't see the need for it. And then I would finally say supposing I'm wrong, we'd do better by say 2% next 10 years. I think so. But it's not going to matter whether you have 2% a year difference. It's going to be very large. But in the long long shot, I think. And you put that on compared to zero.  In which you put whatever in your logical case. That could be wrong. Now I do what I'm saying. I guess I have to reverse the old expression. I do not eat my own cooking. I don't do internet. Lousy forecasters means a lot. We do have lousy forecasters. We're going to admit it. An awful pattern in the crowd for a lousy forecaster, which is I haven't been proven right yet. All right. Well, the next question I suppose I have. That has to do with ETS. It's how many people in this audience own ETS? I think it's not the job, but it's close to. Can I ask a second? Can I ask a second? That's my point. And so you might think that a lot of if not most small investors don't trade them. It's cheaper or more fashionable substitutes for ETS. And so my question is don't you think that the turnover figures for the ETS are skewed probably by institutional investors who trade their things for their own reasons? What is an institutional trading business divided half into people that are trading them with some activity and people that are buying and trading them very rarely? They said they can no longer do that. So we switched to an ETS. $100 spider. The turnover this year marks the institution. And they're going long, they're going short. Sometimes they're hedging on this early speculation. But it is the most widely traded stock in the world every single day in terms of the dollar value. This is the piece I'm writing for the next limo's journal on this very subject. I was the most really nice man. I'm worth talking about as the basis for months to be bought and held and of course consulted with. I mean I'm such a man.  The ability to stand in principle instead of market share. I'm honestly very pleased with my decision. I have no run party institutional business. Both of these State Street funds have 63%. 6,000%, 600% a year and bank guards in one sector to another. It's not kind of a use. Even if they turn over the velocity shares, the market is going up for 2 trillion percent or something, I don't know what it is. So each seeking, so there's a lot of junk out there and these guys have velocity shares as a turnover of shares of 10,000 3 and it's only 7% institutional ownership. Those in retail are a lot smaller than the others. The largest in a bunch is about $100 billion. ETS are clearly the new way to speculate. ETS is almost as great as trading in individual stocks. So we know that's going on, but there is another business going on and a useful ETS strategy, a little bit cynical is fine just so long as you don't trade them. Investors is not an asset, it is a liability. And when you see that, they won the market with 1,000 points, I don't know, half an hour or something. A lot of ETS traded a ridiculous price of maybe discounts of 50 or 60 or 70% for the rest of the day. There are some sharp scissors who bought them up and people sold them and they said they had open sale water and maybe the ETS was selling at 20 and they said I want to sell it at 19 but if it goes from 20 to 3, they sell it at 3. And that is actually happening. So we need to think about the structure of the ETS and the stock market. You know, open stock orders without open sellers without a range of stocks and things of that nature. But there is a business there that I had to guess. I'd say the ETS business is probably 65% institutional, 35% individual and I'd say maybe a quarter of the individual total because people are using ETS in the right way or in the wrong way. That's a good guess. Someday we'll find out. Just the world. Any executive, if I'm the executive who brings out a leverage or an interest fund should learn and I'll be just smooth. All right. Well, let's shift gears a little bit. The Center for Retirement Research in the Lawson Foundation knows it's a great deal at risk index for retirement risk index every year. It was about 30% 30% of people were over at risk 30 years ago and now it's gone up to 51% by any increases over the year by about a percent or two. In a lot of other ways, it's very conservative. They assume that you take all of your retirement assets and militize it and by the way reverse mortgage your house. Which means that the real percentage of people who are actually at risk is probably much higher. So do you think there's a retirement cost and what should you do about it? A crisis in all three legs of the retirement school. What are social security? And it would be so easy to fix if we had the political will to do it with very small changes in retirement age in contributions in maybe limiting withdrawals to people who have reached a certain level of other income. There are all kinds and basically it would be not noticeable in the short run. But it's also politically charged. We can't get anybody to summon the will power. So if we don't do something where everybody knows this number and then it's by 2023 I think it is. Unless we do something, social security will be paying out and it's taking in and it's easy to avoid that. We just don't have any political will to do anything in Washington. We have a lot of intelligent things like fixing social security and it'll get politicized like everything else even like that fiduciary duty standard fixed on optimistic that all of the common sense will prevail. Pension plans. Pension plans on the corporate side declining. Pension plans on the state and local side very strong and they are all assuming 7.5% future returns. They're about 62% funded on average so that's going on a 7.5% return to balance the books over the next 25 years. They're not going to get 7.5%. You've got to be kidding me when they accept that the future returns in the market will be maybe that 4% will be low maybe it's a lot low who knows maybe it's even high who just don't know but if you want to assume 5 you can't get in the balance portfolio anything like 7.5%. So what the state and local funds are doing it seems is saying okay the index fund their money is coming in index fund still when they look at it they say this just will not do let's say Pogo is right buyer returns well let's get a couple of good hedge fund managers and let's get which one do you pick common standard and they use these terms like macro and this and that I don't understand really what those various categories of hedge funds are. I do understand that very few other hedge funds like my son actually runs an actual hedge fund and he's 50% short 40 long stocks 40 short stocks if he's long in the auto field he'll be short in the auto field he can't be more conservative he has a beta of 5% or 6%, 70% returns year after year so that's a hedge fund what they do is unusual strategies enormous fees compensation strategy and not an investment strategy so called hedge funds they're not going to get it out of that one pension plan can not it's the other thing you want to do when you go to 5% let's say which is probably still on the job today this way and let a successor get stuck with the problem think this way, I mean they're business men but a private pension system is going to be in shambles it's going to be a serious economic problem the 401 is a very simple and fundamental to massage them all the things you would obviously do in a retirement plan you would obviously not do in a thrift plan let people take their money you can take money out cap a lot of your social security account whenever you want but that makes any sense at all but there has to be a very stern discipline for the time you retire so there has to be much less flexibility that's what a retirement plan would do the thrift plan we're on about 15 minutes later on the agenda we're going to take a 20 minute break we'll catch up shortly Q&A about 15 minutes with the experts and we'll get back on schedule take a break now, thank you Bill thank you Jack