Don't rock us too hard owning Ruckus AP devices, which will be, I think, one of the more hardcore hacking talks as we like it here at the Congress. Please give our speaker a warm round of applause. Just one minute, and I'll be good to go. What is that? Awesome. OK, so I'm doing the live demos, so I need to just be prepared with some stuff with a terminal here. This is always good, and another one. Why not? And OK. Wait, what the? Come on. Almost got it. All right, yeah, now I am almost good to go. Awesome. Well, thank you, and thanks, CCC, for inviting me to speak here. Before I begin, I would like to ask if anybody is familiar with Ruckus network devices. Raise your hand. All right, OK, all right. Well, CCC is going to hate me for the next slide. But the first time I saw Ruckus access point was when I intended Blackhead USA this year. I noticed that Ruckus provide the conference Wi-Fi. And when I got back home, I was wondering how many vulnerabilities were discovered on Ruckus equipment. So I did a quick research on cvdetails.com, and I saw that Ruckus had 11 CVEs, and five of them were critical. Those CVE were post-authenticated command injection. Well, this means no pre-auth RCE were found on Ruckus devices, and only post-authentication. So that either means that they are really, really secure, or I'll let you answer this question yourself. So wait. Before I begin, who am I? My name is Galzwar. I'm from Tel Aviv, Israel. I'm a research leader at Aleph Research by HCL Abscan. And I've been doing reversing for around 10 years. And I focus on offensive and embedded devices research. And in this talk, I will be using this Ruckus R510 Unleashed. Ruckus has an Unleashed version for every access point they provide. Unleashed are access points that don't rely on Wi-Fi controllers. However, all access points on this list share the same vulnerable code base. And I noticed that some vulnerabilities also work on zone director product line, which is their Wi-Fi controller. The vulnerabilities, I will show, affect this firmware version and prior. Firmware analysis was pretty much straightforward. No compression, no encryption. And on the R510, you can even get the kernel B config from some odd vision. Well, another cool thing about this research is that I did this entire research with device emulation. Only when I actually found a vulnerability, I actually bought a device. Now I would like to talk about my device emulation environment. I'm using my simple yet useful emulation dockers. On my Docker Hub, I got pre-built QMU systems for different architecture, such as ARMv7, ARMv6, MIPS, and MIPSEL. And these dockers really help me emulating and setting up different routers. For this research, I used Docker that wraps an ARMv7 QMU that runs Debian kernel. And now I would like to show you how easy it is to set up an environment. And that, of course, does not work. So let me just, hmm, just a minute. OK, so just a few more minutes, and I'll show the video. OK, got it. Whoops. Awesome. OK, so here I'm just starting my Docker with port 5575. And I am going to fast forward a bit because it's not the edit one. And here it just starts up. It takes a few minutes, so I cut it out from the original video. All right, now I'm going to go to the firmware extraction folder and just start the squashFS root system. And now I can just copy it using SCP to the port that Docker mapped to. And now I just tar it and then SSH to the Docker. And I got the tar gz file. I'm going to extract it. Get into the folder. Sorry. Get into the folder. And just use truth to change my root to this squashFS. In any minute, yeah. All right, so now I'm running truth, change my root. And now I got the rocker's banner and the busybox, the rocker's busybox. And I can see there in it these scripts, which are the startup scripts. OK, this is it for the doctors. And let's start with some exploits. So this is my first RCE. In this attack, I will fetch admin credentials without authentication and then pop a busybox shell with jailbreak through SSH. And let's start with live demos, because demos are fun and what could possibly go wrong, right? Just about everything, but yeah. All right, so for this, I got my terminal. And awesome. Let me just do this. OK, great. So now I'm going to fetch a file from the router. So I'm just using Wget. And this is my router IP address, the one here. And I'm fetching a file from slash user slash WPS to all.  Thank you very much for that. Live demos, right? Yeah, they told me not to do that. OK, so this is the right terminal. And let me just adjust it as well. Got it. So this one you see, right? Yay. OK, so I'm using Wget. And I'm just going to fetch a file from the router IP address from user WPS tools, tool cache slash var slash rpmkey.rev. So I probably got a typo here. And yeah, so now I got the number eight. And now I'm going to fetch the same file only with eight and pipe it through strings and grab something called all-powerful-login. And hopefully, I got a typo. OK, got it. Powerful-login.  And this is it, finally. So those are the admin credentials. I just fetched them unauthenticated, just like that. And now to finish my exploit, I will just log into the ssage using the credentials I just fetched. And now I will enter the debug mode, script mode, and use exec command to run being a sage. And as you can see, I got my busybox, and I am the admin, and I am part of the root group. And this is it. Thank you. Wow, live demos are tough. OK, so let's understand what we just saw here. So I started by examining the web server configuration. Rokus uses embed this as its web server interface. And this is how the configuration file looks. We see that it uses slash web as its web root directory. And we also see that it uses EGS handler for dot EGS and dot JSP extension. EGS is embedded JavaScript backend language that the web server uses. But the most important thing is what we don't see here. We don't see any file fetching restriction. Whoops. That means I can fetch any file from slash web directory regardless of its file extension or type. In other words, no access control whatsoever. Yeah, so now that I know I can fetch any file, I would like to look for some interesting file to fetch. There are 67 files that are not standard web pages. Eight of them are symbolic links. And one, in particular, is this symbolic link to slash TMP there. Yeah. That means every file I will fetch from slash user slash WPS underscore tool underscore cache going to fetch files from the TMP folder. Yeah. And since I was emulating the router using QMU system mode, I could run the system in its scripts. And I noticed that some files are written to slash TMP on system startup. One of them was this one, rpm.log. This log shows that every day, the router writes a backup file called rpm key with a different reversion number. And that file looked like a really good file to fetch. The problem was that it writes it to slash bar slash run. I can only fetch files from slash TMP. Well, it's not a problem since slash bar slash slash bar slash run is also symbolically linked to slash temp slash bar slash run. Yay for me. Right. So now let's see how I was able to fetch this rpm key file. So yeah, slash user slash WPS tool cache is symbolically linked to TMP. Var run is symbolically linked to TMP var run. Now I was needed to get the rpm key reversion number. Here it's 11. Well, there's a file called rpm key.rev that just stored this number. So I first needed to send a request to get this number. And after that, I can just fetch the right rpm key file. OK, so now that I fetch this rpm key file, I notice that it contains some binary data. So I just pipe it into strings.  Yeah. OK, great. So to finish my RCE, I wanted a busybox shell. SSH can be enabled from the web interface. But the thing is, Rockus are using their own CLI. At first, I tried to run a busybox with hidden command called exclamation mark, v54 exclamation mark. And as you can see, it's supposed to exit the CLI and enter the operation system shell. But the problem was that it needed the device serial number. And I don't necessarily got this number. So I had to use a different approach. Eventually, I used the CLI debug script mode that was only supposed to run store shell scripts. However, this exit command is vulnerable to past reversal. So I just used it to run being a sage, and I got a busybox shell as root. Awesome. So after this beginner's level CTF vulnerability, it got me thinking, there are probably more vulnerability to discover here. And I was wondering in how many ways I can get code execution on those devices. So this is my second RCE attack. Here, I'm exploiting a stack overflow vulnerability with unauthenticated request to an agile page. OK, but before that, I would like to talk about GDRA script I wrote that really helped with the reversing process. So Rocus has left all the log strings in the binary. As you can see here, we got debug error info warn just about everything. And here, we can see a GDRA decompant code for a function. And it's debug log print. What's even better is that Rocus also print the function name for every log print. So I wrote a script that just searched for this log print and renamed the unnamed function with the function from that log print. So here, I just updated the name to get ZDDN instead of the undefined function. And here, we can see a binary called EMFD. I was able to reduce its undefined function from 1,500 to less than 900, which makes the reversing process way shorter. Based on that script, our team member, Vera Mence and I, wrote a generic script for GDRA. This script searched for patterns in GDRA, decompiled code, and renamed the function with matches. Now, I would like to show you how this script can work not only on Rocus code. Here is a GDRA decompiled code for a dropper executable that was compiled with a trace option. Here, we see that its log string contains a function name. This is buff get ECDSA, private key. Our script uses regex to match the log print and group the function name. Then, it replaces the function name with the group matches. So this is how we managed to retrieve function name for dropper binary as well. So this script is already available on Alif GitHub account. Feel free to use it. It's really useful for many projects. But back to my second attack. So now, I would like to present three important binaries in the web interface. The first one is slash b and slash webs. This is the actual embed this web server. It handles HTTP request and execute handlers according to the configuration we just saw. It then sends command through a Unix domain socket to EMFD. EMFD is an executable that contains the web interface logic. It maps function from the web pages to its own function. It then implement web interface commands such as backup, network configuration, retrieve system information, and much more. Libemfd.so is a library that is used by EMFD for web authentication, some sanitation, and some code execution. And now, in a diagram, so webs listen to HTTP slash HTTPS. If it receives a JSA page, it uses EGS handler to pass function to EMFD. EMFD then checks if the function name is mapped, and if so, he calls the function pointer. And eventually, EMFD runs some kind of shell command. For example, if config, IP tables, route, and et cetera. I will get back to this later, but look at this carefully, because this is where everything messed up. For example, when I'm sending an HTTP request to slash admin slash underscore update guest image name.jsp, webs invoke the EGS handler. This handler uses a function called delegate, which sends a command to EMFD through a domain unique socket. EMFD then maps every string it received to a function pointer and runs it. Here we see that EGS handler uses upload verify string to send to EMFD, and EMFD then maps this string to a function also called upload verify. All right. Next, let's talk about how the authentication mechanism work. So there are four permission levels, admin, user, FM, and guest. Here we see that each user has a page with a delegate function call. For example, FM login uses off FM, and user login uses off user, and so on. Once a user is authenticated, his session is stored for a specific period of time. Each JSP page should check if the session is valid before calling other delegate function. Here we see that underscore CMDState.JSP calls session check before he calls the adjunct CMDState, and that means he checks for a valid session before he runs the adjunct CMDState. All right. So I use grep and got 67 pages that did not perform any kind of check. I then listed all the different functions that can be reached without authentication, and one function that looked very interesting was this adjunct restricted CMDState. Here we can see that it does not perform the session check, and it can be reached by sending a request to slash-tool slash underscore RCMDState.JSP. But enough with the talk. Let's go to my second demo, which is the Stack Overflow Exploitation. Again, I'll just use my terminal. You can't see it. Yeah, yeah, just a minute. Live demo is all tough, apparently. OK, here am I. Yeah, OK, so now everybody see? Yeah, awesome. So now first, I would like to telnet my router on port 12345 and see that nothing works, which is good. And now, this is my payload. So this is my overflow, and I'm going to call 10 at D with minus L and minus P, 12345. OK, and now let me just post this payload, and hopefully I will not have any typos. God help me. Tools and underscore RCMDState.JSP. Great, so in a second, it should work. Awesome, so I got a message OK, which is a great indication. And now I can just telnet my router on port 12345. And as you can see, I am the admin. And again, I am the part of the group root. Yeah, and this is it. Thank you. OK, so to understand how I was able to exploit this stack overflow, I would like to explain how the Adgex request works. I was able to run both Embeddys web server and EMFD on the QMU system emulation. And that's how I was able to inspect a standard web request like that. Here I call the underscore CMDState.JSP page, which is mapped in EMFD to a function called Adgex CMDState. Makes sense. Adgex CMDState receive an action attribute from the request. Since the action is do command, it uses something called adapter command. Adapter do command then calls a do command function. Do command is a large switch case function that executes different command based on the attribute it gets. In this example, it gets getConnectStatus, which calls a function called CMD getInternetStatus. Now let's look on a page that do not perform session check. EMFD maps underscore RCMDState.JSP to a function called Adgex Restricted CMDState. This is where the R stands for. The function also called Adgex CMDState, but with a very limited set of commands. This specific request pass ZapD to do command, and it runs an executable called Zap. This is how Zap command runs in the shell. We see that we can control its server and client argument by passing the attribute server and client. The thing is server and client are not sanitized good enough. So I can just pass unintended argument to Zap. For example, this minus d slash temp slash b, crush me please. OK, so I was able to find Zap sources online. Ruckus described it as a robust network performance test tool. And when I examined the code, I noticed there's a stack overflow in the minus d argument. Here's the code that parses minus d argument. Let's see what it does. So first, it replaces all commands character with spaces. Then it copies every segment to a temp buffer. Since it expects a number, this is a very small buffer. And well, they try to be secure by copying string with strn copy, but they use the entire string length for n. So it doesn't really protect the string in any way, and I was able to smash the stack. As for exploitation, R510 uses both NX and ASLR. To overcome NX, I decided to use rope gadget. I used two gadgets to run system with a pointer to my payload. In this case, I'm using telnet d that runs slash bin slash sage as a login page on port 12345. As for ASLR, since Zap is forked from EMFD, I can use a brute force approach, and by that, overcome its 9-bit of randomness. OK, so now I would like to look at a request that runs Zap command again. So if I can control the server and the client attributes, why can I just use it for command injection? So to understand this, I need to understand how Zap command is being executed. Here we can see that do command uses exec syscmd implementation to run Zap. Exec syscmd implementation is a function in libemf. This function first called find syswrapper function, and then it uses vfork and exec v to execute the shell command. Let's look on find syswrapper decompiled code. We see it looks for slash bin slash syswrapper underscore wrapper dot sh. If the script is available, it updates a global variable that I named syswrapper path. Now, exec syscmd implementation executes slash bin slash syswrapper, and in our case, it runs Zap command with the argument from the adject request, such as server and client. Here we can see the syswrapper dot sage line count, and it seems like a very big script. But it handles many commands, but what interesting me is the Zap execution command. Here we see that slash bin slash zap is being executed with opt variable. This variable received both server and client values from the request. However, ops get its value with quotation mark, and that stops me from injecting code.  But what kept me entertained and motivated was that Rockus had the weirdest CLI in their firmware. So before I continue to my next attack, I would like to show you other Rockus CLI. So this is the CLI I had to escape for the first attack. This is an entire different CLI that also being used by the device. I noticed that it can be reached after system startup. This CLI also got a hidden command, exclamation mark, V54 exclamation mark, that also supposed to escape to busybox. But it also needed the device serial number, and it was no good to me. However, this V54 command uses content from this file, slash writable, slash etc, system access. The content of the access file was written by another hidden command called Rockus. I discovered that by passing this string to Rockus command, I was able to inject code and escape the shell. But now for the weird stuff. When I called Rockus command to save my payload, this is what I got. And this one, and this one. Yeah, waf waf, bow bow, and rough. Yeah, Rockus CLI actually box at me. Yeah, so when I called V54 to execute my command injection, I was asked, what the chow? As in chow chow dogs?  No, seriously. Well, at the end, I was able to run a busybox shell, and I didn't really care about those weird Easter eggs. But it was still pretty entertaining. Yeah. Well, I still wanted to achieve pre-off remote code execution by command injection. And I just knew that EMFD got to be vulnerable. It took me some time, but eventually I made this possible. And this is my last attack, where I found a command injection vulnerability, and I was able to reach it without authentication by writing a web page. All right, so as I mentioned before, EMFD executes code in a really messy way. EMFD sometimes uses libmf, other times called shell script sys wrapper. And sometimes it just runs the command itself with libc. These are all the different functions that EMFD uses to execute shell code. Here we see that there are 107 libc system function call. So I had to find a page that uses this function call without sanitation. I was able to find four functions that call system and were vulnerable to command injection. And today I will be showing the last one, which is cmd import AVP port. All right, so to reach the vulnerable function, I need to send an adjunct request to slash admin slash underscore cmd state dot jsp. And my request should look like this. I'm passing a command with cmd equals import AVP port. This also uses do command to call cmd import AVP port function. This function uses libc system function unsafely. Here we see the function decompiled code. All I had to do is to pass command injection in the upload file attribute. And as you can see, it just executes the code. Right, so this is it. That's a win. Well, not exactly. I still needed to be authenticated to reach this function. Well, the problem was that cmd states page check for session. And only then it calls the vulnerable function, adjunct cmd state. All right, so I need a different approach. And what if I could write a page that only calls adjunct cmd state and do not use the session checkhole? It might actually work. For this, I decided to use the zap executable again. Zap has a lot of different arguments. And we already know that we can pass unintended arguments to it without authentication. One of them is set a path for the zap's log. However, writing a log is not enough for me. I need to control the content. For this, I used tag, sub, and note argument. They are a string, so they get a string and just write it in the log file for some extra information. Here is the log file writing code. It gets the file path directly from minus l. And I can control the log content by passing argument, note, tag, and sub. OK, great. But there are more problems to solve here. I wanted to write a page, and it has to be in the slash web directory. The problem was that slash web is a part of the squash fs file system, which is a read-only file system. I needed to find a writable path inside web directory. Luckily, slash web slash uploaded directory is symbolically linked to slash writable slash etc slash errspider. And this directory is on a writable file system. Yay for me. OK, so now I knew that I can write a file with my content to the web directory. The only problem left to solve was that ZapExecutable needed to connect to something called TxStation. Otherwise, it won't write anything to the log file. Since I got ZapSources, I could just compile ZapD, which is the TxStation. And now I can set Zap to connect to a station on my computer. Awesome, so this was the request I needed to send. It executed this Zap command. Notice that I used two arguments, minus s sub and minus t tag, to write my delegate call. Finally, Zap has wrote a file to slash web slash uploaded slash index dot jsp.  Now I can chain those two vulnerabilities together. First, I write a page to slash web slash uploaded slash index dot jsp. Now I can send a command injection payload to the page I just wrote. And this is the time for my last demo, which is the most difficult one, so good luck to me. OK, so first, I will need another terminal. Yeah, this is it. And so in this one, I will run ZapD, which is the TxStation. And I will listen to port 444 with Netcat. Great. And now for my other terminal. OK, great. So now I would like to show you the page create payload. So as you can see here, I'm using the server and set it to my computer. And I'm using the minus l to write a page and minus t and minus s to write the delegate function call to Ajax's cmd state. And now I can just post it. Page create, this is it, to my router to slash tools slash underscore RCMdState dot jsp, no typos. And in a minute, it will just reply and say, OK, awesome. So now I wrote the page. Next, I would like to show you my command injection payload. So here I am using NC on the router. And with Netcat, I'm just connecting to my computer on port 4444 with a reverse shell. And again, I will post this command injection to the router on uploaded slash index dot jsp.  Sorry about that. OK, again, great. And now, hopefully, I'll see that I am the root user. One more second, again. And now, be root. Yes. OK, OK. Yeah, yeah, wow, that's, yeah, live demos. How about that? You don't see them anymore. OK. In conclusion, I demonstrated three pre-auth RCE today. The first one was credential leakage with CLI jailbreak. The second one was stack overflow without authentication. And the last one was command injection with authentication bypass. I also shared my Docker setup and introduced a very useful GDRA script that helped with my research and can help others. Rocker's networks was informed about these vulnerabilities. I requested 10 CVEs for this research, and they confirmed these CVEs. If there are any Rocker's user here, you should stop what you're doing and go and check that you're running the latest firmware update. If not, you may be victim to some very serious abuse. So again, please check your firmware ASAP. OK. And well, this research was a lot of fun. It involved all sorts of different vulnerabilities. It was also an excellent opportunity to check our Docker emulation environment, which proved itself very useful. A blog post with all the details will be posted. But since Rocker's asked really nicely, I will wait with my post until January 6. So stay tuned for my blog at Aleph Research Blog. And while you're there, check our amazing research. And this is it. Thank you very much for listening. Thank you for this great talk. So now we have quite a lot of time for Q&A. So you already know the game, queue up at the microphones, or ask a question on the internet. We will today start with the internet. So please. All right. So there are a couple of questions here. The first question is, will this work on unleashed firmware of Rocker's AP? Yes, it definitely will. Not the latest, but the entire research was conducted on the unleashed version. All right. Now let's do an in-room question first. And microphone number one, please. So thanks for the great talk first. Then you mentioned that there were 107 handlers for which cold system at some point. I hope you didn't check them manually. So my question would be, you probably used GDRA to search for those. How would it be? Yeah, so the system, the reference count just gave me a really good indication that they're doing something wrong. And when I actually searched for command injection, I first looked what are the reachable pages that uses system. So that narrowed the list to something smaller, which was still around like 15, well, 15 or so. So I just saw that the command injection was done pretty much manually with GDRA. No fancy scripts here. So no analyzing of the call tree in GDRA? No. OK. Thanks. Sure. All right, microphone number two, please.  Then secondly, from a networking consultant perspective, the quad one usage in your scripts, it's easy. But please don't do it, because people tend to use quad one as a legit IP address in their systems for dummy IP addresses, which is actually a DNS server on the public internet. And just comment. The actual question is all your attack vectors are against when you are able to reach the system on a layer three basis, right? Yeah, correct. So all of the attacks are from both the internet or the LAN. But yeah, only layer three. So OK. And in the end, I can only offer you that I have some hardware from an orange vendor. I can offer you if you want to do some further exploration on other vendors. Yeah, why not? All right. The internet has another question, I think, right? Right. So the internet wants to know, is the virtual smart zone mode also affected? No. Only access points and some of the vulnerabilities, as I said, also work for the zone director. All right. Number two, please. Thanks again for the entertaining talk. And I noticed that on some of the slides, there was like a hard-coded cross-site request for GERI token. So I just wanted to ask, what's up with that? And were you able to find more places where there are basically security boundaries crossed by a hard-coded string like that? Yeah, so I tried to focus my research more on the low level and stack overflow and command injection from the binary analyze. But yeah, we saw some web vulnerabilities. One of them is SSRF and another might be with tokens that is still hard-coded. There are a lot of things to keep on looking in those fingers. So you didn't report that one? No, the hard-coded one, not yet. OK, thank you. All right, the internet. Right. So how much time did you invest in total for ripping this device into little pieces in so many ways? So it took me one month. The first exploit I found relatively fast. I think it took me around two days. And after that, the other analyze took me around three weeks or so. All right, microphone number two. Thank you for this awesome talk. I really enjoyed it. The first bit of the presentation was a little bit fast for me, the docker part. How did you discover that you can run the Ruxus firmware in your own docker container? Can you please repeat your question? How did you discover that you can run the Ruxus firmware in your own docker container so that you can discover all these flaws? Yeah, so I skipped a few steps. So I basically used beanwalk. And after I extracted the, so I downloaded the firmware, used beanwalk. And then beanwalk usually extracts the squashFS, which is the firmware file system, different file system. So I just copied it to my docker. And because it's a cross architecture docker, it runs the ARM architecture. And I was able to actually run the code from the firmware, the user space code. OK, thank you. Sure. All righty, any other questions? You have 30 seconds to invent a question. Do you have 30 seconds of content? No, I can do a fancy dance or something like that. All right, yes, please. OK, I wish I could. I wish I could. All right, still no questions? Well then, a good night to every one of you. And thank our speaker again, please.


To compete in phase one of the community's competition, you must register, create a team profile, and submit your proposal. This video tutorial will take you through those steps. First, go to communities.xprize.org to get started. Click the register button here in the banner. This will take you to a login page for our prize operations platform, or POP. You can create your login using an email and password, or register using your Google, Facebook, or LinkedIn accounts. If you create your login with an email address, you'll receive a message asking you to confirm your account. Open that email and click Confirm.  This should take approximately one minute.  Then, indicate that you are interested in the adult literacy XPRIZE community's competition, and that you are starting a team. You will now need to review and accept the terms and conditions for use of our site and platform before you can continue. Once you've accepted the terms by checking this box, click Submit. Next, you will need to create a team for the community's competition. Click on the Create a Team button in the competition portal to be redirected to the team registration form. Make sure the prize and the drop-down is the adult literacy XPRIZE community's competition. Enter your team name, and again, select the country and city where you are based. Remember, only entities located in the United States may compete in the community's competition. We also want to hear how you learned about the competition. If you're accepting new team members, make sure to check this box. Now, enter the email and phone number for the primary point of contact for your team. Finally, you'll need to confirm that you understand that only organizations duly constituted in the United States are eligible to compete, and that participating adult learners must also be in the US. Once you've done this, you can tell us more about your team by adding a description, your affiliations, and your social profiles. You can always go back and edit your team profile. After you've created your team profile, you can add members by inviting others to create a user profile by clicking on the Manage Team button on your team page. Now it's time to start the application. From your team page, click on Activities. You will see that there are seven activities to complete. Don't worry, they're each relatively short. Activity 1 is our terms of service for the community's competition. You can access these by clicking Start. Once you have read the agreement, you can sign it through DocuSign. The remaining activities make up your Phase 1 proposal. You will need to write a 100-word elevator pitch in which you are asked to provide a high-level explanation of your team's approach to distributing the apps to learners in your community and improving access to adult basic education and English as a second language. Your elevator pitch is a brief statement that each reviewer will read to develop an initial understanding of your strategy and approach to distributing the apps. This is your opportunity to make a good first impression. You will also need to provide a link to a YouTube or Vimeo video describing your team and your strategy for reaching adult learners in your community and distributing the ALXP apps to them. Videos should be 30 to 90 seconds in length. Make it simple. You do not need to produce a sophisticated video. Your pitch must be in English and we want you to introduce yourself and your team. Tell us how you will reach adult learners in your community. Tell us what is unique about your proposed solution and explain how you would achieve scalable and sustainable impact. Activities 4, 5 and 6 make up the core of your proposal. We want to know who you are, what you will do, and why it is scalable. Tell us about yourself, your team, your organization, and your community. What will you do to create impact and innovation in adult education? How will you recruit learners to download and use the apps? How will you expand your reach to include more learners? And why do you believe your approach will work? Tell us why your approach is both scalable and durable, as well as how you intend to ensure its growth and longevity. Finally, we ask that you provide samples of recruiting materials. Anytime you start an activity, you will need to save it by clicking the gray save button. If you click submit, that portion of your application will be submitted and you will no longer be able to edit it. If you need to get a portion of your application unlocked, please email us so we can unlock it for you. You can reach us at adult.literacyatxprize.org. In the resources section of your team page on POP, you can view important competition documents such as the competition guidelines, scoring rubric, and an explanation of how judges' scores are normalized to ensure fairness, as well as a PDF of the application. To compete, you must register your team by December 8th, 2018, and submit an application by December 21st. You can learn more about the adult.literacyatxprize.comunities competition by visiting communities.exprise.org. You can also view other explainer videos about the competition on our YouTube channel. You know your communities and constituents best, and we need your innovative ideas for reaching low literacy adults that seek to improve their English reading skills. Register to compete at communities.exprise.org. If you have more questions, email adult.literacyatxprize.org. Together, we can transform lives through literacy.


There's a few male frets that are like the jocks. The cues. The cue dogs exactly. And then.  That's cool too. That's cool too. That's fire, bro. That's what this is. That's ovaries and fallopian too. I thought it was a tort, but I'm like, I ain't going to do it.  Yeah, here. Oh. I just got it. When you say when the cues tort, the ovaries. An ovaries and fallopian too. Yeah, that's what I love about it. I thought you was like holding the cheeks up. No. I thought you was doing. No, I'm doing. Actual. Don't throw up, they hooked though. Don't do that. They don't like that. What do you mean? They don't like when people throw up, they said. This is, I'm not a cue. I'm a gynecologist. He's a mouthful though. He was on your fingers. You like to cue an LGBTQ. Do I? I'm an LGBTQ dog? Hi. Hi. That's not a part of it.


Hi everyone, Joe for Jaspy's casewrakes.com coming at you with 2023 Bowman Chrome Baseball Hobby Pack Break number 49 with eight of those hip parade baseball spots being given away. That's the hip parade mixer edition. Check that out. It's a pretty fun break. Hip parade mixer edition. Now first, let's do the pack break itself. All teams are in no combos. There's everybody right here. Thanks everyone for getting in on it and let's roll it, randomize it six and a four, ten times each. One, two, three, four, five, six, tenth and final time. And remember ladies and gentlemen, we just have to do one more of these fillers, sell a handful of spots straight up and we're in breaksville. So we're very close to filling that nine and ten. Now no trade windows in these little filler breaks but there's everybody's names right there. There's the first half of the list. There's the second half of the list and let's just print and rip. All right, nothing too crazy there. I was hoping for maybe a sneaky autograph but the whole point of this though is not necessarily the pack break but who's going to win those hip parade spots for a fraction of the price. It's gather everybody's names, new dice and it's two and a three, five times. So it's going to be top eight after five. Good luck. One, two, three, four and five. So from nine through 30, sad times. Alan very close but just no cigar. Hopefully your name's still up there somewhere. Top eight, happy times for you. It's going to be half times for Michael. Alan, there you are Alan. John, Luke, Andy, Alan again, Chris and Kevin. So there you go, top eight. Let's fill up that last filler. Let's get that hip parade across the finish line. Jasmy's caseworks.com. Bye bye.


There's only a few days left for you to join my breakthrough six-week online course, the Martial Meditation Method. For the last 15 years I've been personally studying meditation and for the last 10 years I've been teaching guys in my live courses a system of meditation that allows you to dissolve your approach anxiety, your social anxiety to get out of your head into the present moment into your body and I'm really excited to finally announce that this is available to the general public, not just the guys that come on my very expensive live workshops. So if you want to find out all about the Martial Meditation Method and join me and a select group of men on this six-week journey of self-discovery, relaxation, balance and inner peace, click the link below or in the description and I'll see you on the first day of the course.  Of course you do. In this video I'm going to be expanding on the applications of meditation in terms of sex and sexuality.   Obviously you want to extend your own personal internal practice and be able to share that with your lovers to become a much more intuitive and skilled lover. And I think most men think that when they're looking at improving themselves in terms of their sexual skills that this is all about techniques. It's all about understanding special ways to massage the G-spot or twiddle the clitoris. There's this system called One Touch which is like some strange new pseudo-scientific sexual system where you have to rub the clitoris at this certain point just past one o'clock 500 times this way and 300 times this way and it's supposed to be some special technique. I mean perhaps it is and I think these kinds of technical understandings miss the point of what it means to be a great lover. Now I'm not saying that there are not technical aspects to being awesome in bed. There absolutely are. You need to have a fundamental understanding of female anatomy of generally where the clitoris is and how to apply pressure to it of things such as G-spot massage of erogenous zones of angles and when you're having sex positions, dirty talk all these things that are technical in their nature and this is not the subject of this video that's something for a whole other product which I'll certainly be releasing in the future something I've been working on for a long time actually but more important than having perfect sexual technique is understanding how to use your meditation your awareness, your presence in the bedroom or in the alleyway or wherever it is that you choose to be with your lovers because a man can be technically amazingly proficient he can know all the right moves but the problem is, firstly, is that women are not robots they're not all identical physiologically they don't all respond to the same stimulus and the same woman doesn't respond to the same stimulus depending on her mood, she'll change depending on her mood, depending on where she is in her menstrual cycle, depending on how aroused she is depending on the dynamic that she has with any given man so even if you know some special techniques that's not going to work if you try to apply it identically to every single woman and if you've got a special move that you know works all the time with all the ladies then I'm here to burst your bubble the truth is that most of the women you've been with have been faking it because if you're doing the same thing to every girl and they're all making the right noises it doesn't mean you're awesome it means that she perceives that you've got a sexual ego she perceives that you've got a lot of pride around your ability and your skills and you're doing your thing and she's like okay, he thinks he knows exactly what he's doing but he doesn't know my body he doesn't know my moods, my desires and therefore I don't want to upset his ego and so I'll pretend that I like it that can be kind of a shocking thing for many men to realize but if you want to be a great lover you need to put aside your ego you need to put aside your pride and you need to learn to use the presence and awareness that you've been learning throughout this course and then to apply it with a partner so what that means is firstly, set aside the idea that you need to be technically perfect and certainly that you need to have a bank of skills that you've learnt or that you have your toolkit and that's what you're going to apply to every woman understand that the truth and a spectacular lover is his ability to be present, responsive and in the moment with his lover because great sex happens moment by moment it doesn't happen when you're planning and that's something that I know I used to be guilty of and many men are guilty of is that when they get in the bedroom they have a set routine of things that they do or that they want to go through so I'm going to go down on the girl for a few minutes and then I'm going to do missionary and then I'm going to get a blowjob and it's all moving towards them coming and ejaculating at the end so what that means is if you're planning if you're trying to move through a sequence then where are you? Are you in the present moment? Of course not you're in your head you're thinking about the future you're projecting towards the future and as a result the woman perceives and feels that you're not with her women tend to be a lot more emotional and kind of dispersed in their sexuality men are often very centric on their cocks so we're focused in on our penises and on ejaculating for a woman to have great sex it's not so much about even if she does have an orgasm of course that's nice if she has one or more but a woman is going to perceive a really amazing sexual experience to be something that is full body that is immersive that is like a trance which is where she gets out of her own head gets into her body into an altered state of consciousness and that's something that great sex is great sex is a trance that you're sharing together it's an abnormal state of consciousness it's where both of you lose sense of time lose actually sense of your own personal ego and identity really amazing sex is when two people blend where the division between where you start and she starts blurs where you feel almost like your one organism this is the male and female essence entangling and going through this amazing kind of cosmic dance that's what awesome sex is a woman is going to walk away from a sexual experience with a guy that's like technically got her off he did the right things and he found what buttons to push on her and made her come she's going to feel satisfied by that but only as satisfied as she would with a vibrator really as opposed to a man that's there fully with her engaging with her in real time present with her with his eye contact with his touch responsive communicating even if she didn't have an orgasm coming out of that sexual experience she feels electric alive she feels sexy she feels like a goddess and that's the kind of experience that girls come back to over and over again


Hello, so today we're going to load a multi-part disk image into FTK imager and verify that it's actually correct. So first I have this multi-part disk image. It's only a 2 gigabyte image total in five sections. If we right-click on one of the sections and I go to properties, then you can see that this is a 500 megabyte section of the total disk image. Next if we open up the imaging report from the image, we can see the MD5 checksum and it starts with 73AAE5, so we'll remember that and we'll use that to verify that we actually are loading or verifying all of the image sections. So here I have FTK imager 3118 and I used this version of FTK imager to create the disk image. So now if I want to load and verify a multi-part disk image, I can go to file and add evidence item, go to image file, next and then please enter the source path. Click browse and for this I need to be able to, I should just only select one image file and in this case I need to select the first one. So depending on what your naming is and FTK imager by default names is 001, you want to make sure you're always selecting the first disk image otherwise it might not detect all of them. Select the first part of the total disk image, click open and then we have our disk image loaded, click finish and then our image shows up in our evidence tree. So if we expand that we can see the partition and this already looks pretty good because we have a 2GB partition and if it was only one part of the total disk image we might not have this information. So we can go ahead and verify that this is actually the full image by clicking on test 001 and right clicking and then go to verify, drive or image and this also looks good because here we have 2GB detected and it's verifying 2GB where if it was only loading one part of the image file then it would only be 500MB. So once this is finished we should see computed hash 73AAE5, okay so we have our MD5 hash values matching whenever it was verifying the data it was 2GB and we are showing a 2GB partition here and we're able to list all of the files or all of the file structure in the partition. So even though it is a little bit confusing because it does say test 001 and it looks like you're only adding one file but as long as you can see the total disk size for your entire image and especially you should always be verifying anyway especially whenever you are verifying your disk image you should see that it's calculating a hash over all of the data and the hashes should match. As long as you have that then you can be sure that FTK imager has loaded all of the data.


Welcome to the World Summit on the Information Society 2016 in Geneva, Switzerland. And I'm delighted to be joined by Dr. Ibrahim Alderbal, who's the general coordinator of the Khalifa Empowerment Programme for Students. And it's called Aqda. So tell me, my Arabic is not very good. What does Aqda mean? Actually, maybe it is your mistake that your Arabic is not good. Aqda doesn't mean an Arabic, I can't. With this program, Khalifa Empowerment Programme, actually it is a program in cooperation, in coordination with more than 50 partners in UAE. So all of us, we decided to launch a program or new initiative, we call it Aqda. It means I can't. Just try to passionate the student to do a positive behavior, positive things. So to positively engage with information communication technology? In everything. Actually when we go back to the Aqda program, it is not only focusing on the technology. We have four pillars. It is life skill education, life skill crime prevention, health and safety and national identity. So, for example, here today we are in Western because we are focusing on the crime prevention. One of the crime prevention we are focusing on with the IT technology. And how much concern is there in the United Arab Emirates about the misuse of social media? Actually, UAE is part of the world. When we say it is the global challenges. Actually we have now for social media. But if you go back to the statistic, UAE more than 173% of the people they have using the mobile phone. It means for any single one, he has two mobile. This makes very big challenges. If we go a little bit decided about the technology, now when you said ten years back, the internet challenges was because it was a PC, then it shifted to the laptop. Now our mobile phone is internet. There is no control. Maybe further after five years as the professional says we are coming to the uncontrollable explosion of the technology. It means we have to make our new generation ready for the new challenges coming up. And what are some of these challenges when you talk about the uncontrollable explosion of the internet? Actually to be honest as a parent, maybe ten years back, very frankly, the challenges was misusing about the sexual sites, websites, some sites, the sexual sites for example. Now the ISIS is involved for example. Terrorism involved in this one. The traffic accidents involved the health issues. For example now what we call it the professional disease. For example if they are using this technology in the wrong way, maybe they have some diseases coming up. So many challenges are coming up. And so what is your main message to students that they use this technology correctly and that they don't misuse it? Actually myself and we believe the students of today are leaders of tomorrow. So the message we try to make them ready for the coming future, ready for the coming challenges is their lives. So they have, they should be ready. We give them some tools to be empowerment. This is the concept of Khalifa Empowerment Program. It says Agdar. This is the meaning, the main concept of Agdar. It means it is your life. Please take care of your life. One of taking care of your life is to be ready with the challenges. One of the challenges is facing the technology. And it's a 360 program so it's not just students that are part of this program. Actually when we say 360, the other word is what is the un360. The 360 means to make our new generation ready. It means we have to work for the students, parents, our partners, the community, the teachers. For example we train more than 15,000 teachers how to deal. We found most of the teachers, this is not in UAE globally, they are not enough professional to deal with the new technology. So that we train more than 15,000 teachers. We train more, we reach around 70,000 students to deal. When we say the students, the generation, in which age we have to go to the new students. In Khalifa program we go from age 6 till age 25. But for each age it's different message. We have students, we have local students, we have non-local students. We have to respect that different culture. So it's actually this very comprehensive program. And the tools we are using is not only the presentations, actually we have different, different tools. It could be games. Now for example we have games in Apple stores. We have four games already we launch it. More than 12 million individuals they download our games on Apple stores. It could be sometimes brochures. We have different brochures in Arabic and English. We could be delivered. We have a national program, what we call it a national curriculum. This is, I can't say, I'm guaranteed this is the first one in Arab country. I doubt maybe in the global world because actually we focus on four pillars. We believe that everything is integrated with each other. For example when you come to students and say be aware of the technology without working on the self-esteem of the student, life skill of the students. I cannot work alone. When we say be careful about the ISIS. I have to make self-confidence to deal with the peer pressure. Now we have E peer pressure. So I have to make my students ready for that. Dr Ibrahim Aldebal, thank you very much for joining us and telling us about the extremely comprehensive AgDAR program. And do join us on the ITU YouTube channel for more interviews with ministers, regulators, experts on information and communication technology here at the WISIS Forum.


Assalamu alaikum, I am Mokhtar Ahmad with the virtual university course of human resource management, which is MGT501. For today, we will start our today's session. During my last lecture, I asked you to go through your x5 to 10 year plans and with this context after going through our previous lecture, which was about a carrier, just try to understand what kind of carrier path you are picking and what are different goals you have set there for your carrier there. So, you define out something good interesting there, to write me. So, let's start our today's session, what about the 24th one? We started our carrier concept there. And we will also discuss about the stages of carrier development. And then we also discuss about the role of HR department, what kind of support they can provide for the carrier development. And even they can guide you to dwell your own carrier plan. And this is good because this is a motivational factor. Whether you are joining is that company for the job or for a career job. And if it is a career job, then chances are you are going to stay there longer. And you are going to put extra effort there to excel in your career. You are just starting your job and the sooner you will get a good opportunity and you will leave. So, that was the sport. Because with the sport, with the proper facilitation, you are motivating your employees that they should have their career plan or us may have many different moves in your career, one can take a promotion. If you are not coming to the up to mark, they can bring you down. And even sometimes it is giving you an opportunity to go for your higher education too. This is a plus thing for you. And exit. Either way, you have been fired or you resign. In the last lecture, I had discussed this appointment and I gave it a little bit more effort. Don't take it for granted that leaving the institution is beneficial for you or resigning. That was one aspect I discussed. For those people who are challenging and who have guts. So, they resign or the organization tells them thank you very much. We cannot go together. And sometimes let's see, downsizing is happening. It is also an effect that until you find it difficult, until you find it hard, you can't do a unique job. You create new things from that. And a good manager, a good human being here, they always take that hardship, that tough time as opportunity for them. So, these are the different moves we discussed during our previous lecture. And at the last, I think we also discussed that the HR department, they try to match the organization development objectives and the individual development. For that, we tried to understand it. When you think of the development of the organization, you create new opportunities. Not only opportunities are created, but also requirements are decided. And then you look at your employees, your own workforce and see, do they qualify for the same opportunities? Remember when we read the recruitment, the selection process, we always have internal and external both sources. We always give opportunity to both, the outsource and internal source. The external source is there and the internal source gives opportunity.  Yes, with such and such time, we are planning to have such and such new thing in our organization. And for those, we need people who should be having such and such requirement completed. And this is how you are not only developing your organization, but you're also developing your workforce. So, let's start our today's session. We have to continue that career, it was not finished. And of course, then we have to shift to the performance part. There are certain barriers internally to the career advancement, one's career in advancement. If I know that these are a hurdle and I overcome it, chances are that I will excel in my career. These are the hurdles which can stop you to excel in your career. Let's see your performance, you don't have to desire a qualification. If you miss a particular skill, you can excel. One, lack of time, you don't have time. You don't have money to pay the dues. If you have to go for a higher education, you don't have the resources for other types of work. So, this can be a hurdle for a person and for an organization. Let's see, an organization want that they should provide proper training and development training for their employees so that they excel in their career. But you don't have so many resources. Individually also it is the same thing. Let's see you think if you get this degree from such a certain institution, again, you might have time constraint, you don't have time to go there for a couple of years. You might have the financial problems, you might not be able to pay the dues. Similarly, let's see if within the organization you are working, you have a very tight schedule there, the job is very rigid, demanding and of course your leadership is not sportive, they don't care. That is also a limitation. As I have discussed in the last lecture that organization don't want that they should go for extra qualification because they are scared. Now, this is one approach, one school of thought. The second approach is no, they say no, we should give them the fair chance. Whatever time they are spending with your organization, you should be wholeheartedly working there. Or if you get a good chance, why not? Everybody has the right to grow. So leadership depends on the job itself, it is very demanding, very rigid, you cannot get time out to go and get the extra skills, extra knowledge. The department, the organization is not sportive, they don't provide you the information, they don't guide you. So, that is one limitation which can hinder your career advancement. Similarly, you don't have proper opportunities, career opportunities and pathway within the organization or employees. I have seen a lot of time people leave organization because they are there. We are very happy here, we are enjoying, but the thing is we don't have any future expansion here. There is no chance of growth here and this is a very strong motivational factor that you want to excel in your career. Everybody wants to be in search of a better future. But if you see that there is no future opportunity then it is a negative aspect and that is also one limitation. Now, what can we do to be successful in your career management practices? As an organization, as an individual, as an institution, what can we do? We can put clear expectation on the employees, either it is the performance expectation, either it is the skill improvement expectation. So, when we will read the performance surprise in the next lecture, when you sit with your employer or senior or immediate boss and they say, what is the objective? What are the objectives for the next year? They fix your goals and objectives for the next year. Why do they do it? So that you know what you have to achieve. There are many times when it is written that you should improve your skill. Otherwise, he or she is not eligible for the promotion, for the advancement. So, whatever expectations the organization feels, from any employee, it should be very clearly given to him or her and there should be proper monitoring and feedback system. You are not doing right. You should improve this skill because here you are deficient. You should also provide opportunity to your employees that they should move around. Move around means they should have a chance to work in a different setup, even job rotation. Or even if you have your office somewhere in other countries, give them the chance that they should have the interdiction expire. Give them chance that they should go and have a they should work in a larger environment, in a bigger setup. It is learning is always there. Even if you are doing the same job at a different location, that might give you another opportunity to learn more things. Not only learn more things, but you might get some other opportunities. And if you can afford, if you can manage your time, that will be good opportunity for you to prepare you for the next position, the higher positions so that you can excel your career. And the agnation should help, implies that they should make your career plan. If I know that these are the growth opportunity I can have, but attach which all those things are such and such type of skills, knowledge, experiences, whatever send that then it will be easy for a person to prepare himself or herself for those positions. Or they keep that plan in front of them and they see how he or she is doing. And if at the time there are certain changes or even that person they imply the workforce, himself or herself, they have a second option. They might be changing their area. Must but at least you must have a plan. So that you should be focused and you should be concentrating. What else? And then make sure that you keep them on the track and how you will keep them at the track. And it is again human psychology. When there is some kind of punishment and reward system there. I have a small child here who sees that if she does not know that a heater is burning, a woman is lying down or a woman is burning, she tries to catch her. But when her hand burns, then you see that that child was also small and she does not touch it again. Because she knows that, she knows that. And that is what is reward and punishment. And let us forget about punishment here. At least there must be reward and recognition there. And if the institution observes these things, then chances are that not only your employees' workforce will increase, but the institution will develop and the organization will grow. And along with that they will also excel in their proper career. So we should encourage that performance through rewards and recognition. How much you deliver, how much you produce, that should be recognized as an institution. You see that a small appreciation letter works. That the institution, it implies the month, it implies the week, it implies the atmosphere. But it is a very big motivation factor. And keep the performance improving. Similarly, organization provides clear and continuously kind of instruction and counseling that the workforce, the people should, the employees should assess their skills and of course they are carried direction. We have a fish bone analysis that says, what efforts do you have to do to achieve this? This is positive force, this is negative force, you have to match both. You have to adapt it in a SWAT analysis, in any way. But at the moment all these things, when you are doing the performance appraisal process, and it is good for everybody, giving employees the time and resources they need to consider short and long-term career goals. Now this individual career development can be short term and long-term. Give them a chance, they should put their efforts towards their short-term and long-term career goals. But not at the cost of the performance for their present job. Now let's see individual versus organization career planning. We have two kind of roles here, one is the organization, if they are playing, it is playing their role and the employees are individuals. With proper planning, developmental planning of organization, and of course the individual have their own plan, what do they do? They work to achieve goal, good person, organization, fit through selection. The abilities of the person and the need of the organization. Now the organization, the goal they have to achieve, they pick the right person, who is fitted in that scenario. Yes, organization, but of course the individual too, and as a whole society is getting the benefit. And let's see what is happening at the individual level. Now because that effective workforce is already there, now same time, they are not only giving the performance as desired, but they also understand and they monitor what? Career opportunities, successes and failures. Not an individual level, but of those, organization is also monitoring it and facilitating it. So keeping in view that career planning, then they will put extra effort, organization will facilitate them, that person will increase his effectiveness and performance or her performance by learning more skills, by improving his or her qualification, by having the mentoring, others seek, others ask, and what will happen, that ultimately you can have more successful and healthier career. At the organizational level, they can have the stronger and more effective workforce, or at the individual level, they can have more and successful and healthier career. So see both parties are getting the benefits. It is the organization development, same time it is the individual development. So it is a win-win situation. What is performance by the way? So we are done with the career part. Any concern, any comments in your mind? I always mention that people in the Washington University, they are sitting for you, always available, write them and they will respond you. There is no clear concept, something is confusing, you cannot understand its relevance with the subject, unless you will ask. And as I told you, don't leave anything at any stage, for granted, don't take it. Because what is going to happen? Ultimately, if the foundation is not right, then the building will be destroyed. And but remember if your concepts are clear, don't worry then. If you have any question or discussion, you are very much confident to answer and suggest them. So should we start a new topic? Do write me if something is bothering you. So we are done with our career part. So let's start our next topic, that is performance. What is performance? Performance is equal to A into E into S. A multiply E, multiply S. What is A? What is E? What is S? Let's see them. A is the ability. Any person's performance depends on their abilities. E stands for effort. How much effort he or she is putting there. Abilities can happen as soon as possible, but some extra effort can be done. So are these two things important? No. You might have ability, you might be putting extra effort, but if organization is not providing you support, you cannot deliver it. So one way of performance, to understand or to explain is that performance of any person is equal to his or her ability and how much effort he or she is putting there and what kind of support they have within the organization. Why do we care? Because performance is playing the, this is the basic, whatever we are up to. This is the bottom line. On performance, all these things depend on performance, on individual performance, on organization performance, on nation performance and so on. So performance is the end result. The bottom line.  Any indicators can happen. Anyone can test the performance. But first of all, let's see what is performance. In the last slide that you saw in the last one, performance is equal to what? Abilities, efforts and support provided by the organization. Let's look at another way of performance in this slide. Performance is function of what? Ability, motivation and opportunity. And what is ability? Knowledge and skills. You have learnt something big and then you have practiced it and you have the ability to perform that particular thing. That is your ability. Or what is the motivation? How much effort there is behind it? And what about opportunity? We have seen so many times people with good ability but they are not performing. Because they don't have the motivation sometimes. And even if they have the motivation, they are not getting the opportunity. So all three things are very important. Ability and efforts. How much motivation there is behind it? Opportunity. And it is very interesting to find out that even your ability is a little average and if you get a good opportunity, then you perform well. Another person can have a very good ability. He is at the top but he or she is not getting the opportunity. So at the bottom, zero. So we have to keep in our mind that the best way to perform other people are when marrying the performance, when weighing the performance, we have to see whether he or she has the fair opportunities to perform. You have a very good mechanic. You have a very good worker. But if the machine is not working properly, then it is not a problem. As a manager, this will be our responsibility to see the problem. So where is the problem? Why are we not getting the best performance? Is it the ability? Is it the effort or the opportunity? And if we can make all these three ingredients available, then the performance is there. Similarly, capacity to perform, that is the ability. Isn't it like that? When he or she has learned, he or she has experienced, that is the ability. Similarly, willingness to perform, the motivation, the efforts and opportunity to perform. And these are the determinants which will give you the performance. With this background, with this basis, let's move forward. Now, what are the indicators that we will say that the performance is good? When you have to check your performance in the virtual university, what will be the indicators? Yes, your grades. Your time to give assignments, their grading, these are all the indicators of your performance. You are watching the TV, how will you say that the performance is good or wrong? If you are checking, you are getting the performance of that level. We will say that the performance is good. The computer that you use at home, how can you check the performance of that computer? If it is working, if you turn it on, it will on. When you give instruction, it will respond and then write response. Now, if you say that the performance is good. Let's look at some examples. Let's look at financial, economic perspectives. Let's look at the indicators of the organization. We will tell them that the financial is doing a good job. It is doing a good job, it is surviving. What? If you look at any institution, financial point of view, if it has cash flow, cash flow is that money is coming, money is going. You are getting cash inflow and cash outflows. All these processes are called cash flow. If it is working, it means it is surviving. That's why some money is coming, some are going, some are spending. But, if it maintains the financial position, then it can be that its sale growth is also coming, quarterly updates. Operating income is coming so much that it keeps functioning. So, this is the indicator that that company or that organization is performing. In a way, well that it is surviving, it is maintaining its pace, its work. But, how can we say that this organization is prospering? What will be its indicator? Its market share is increasing, its profit is increasing. We are returning on investment and its value is getting added. So, what is this indicator? They are showing you that this organization, this company, this firm is prospering. Let's see the customer point of view. How can a customer say that your performance is good?  But if we keep going, or in other words, we say that its quality is good. Now, if we keep going, it becomes black and white from color.  So then, the TV is not performing well. Your result, God forbid, is not good. So, what happens then? Your parents also support you. Otherwise, your things are stopped. No TV, no recreation, no picnic. Sit down and work hard. Your performance is not good in the institution. So, you have to sit extra, do this work properly. And then they also try to figure out what is the reason, what is the problem, where is the problem. So, customers are also very good judge. The feedback, the response is also for you, how is your performance? Let's take some examples. You are bringing a new product in the market. Your sales is increasing. That is the indicator that your performance is getting better. Sales are decreasing, that is a negative aspect. Customers are telling you that no, that is not what we are expecting. And in this price, we don't suit this. What is your value? Customers will decide. How is the product quality? Are they willing to pay on the higher side? Or are they at the middle low level side? If the customer is willing to pay on the high price, that means they are giving your product quality or value to it. They are understanding its performance well. There is a brand loyalty in marketing. That people demand that they want the same product. And that is the one message for you, that they are satisfied with your product, with your product performance. And they are brand loyal. So, the performance is the same. How satisfied is the customer with you? They come back to you to buy again. Similarly, how timely do you make it available? How do you fix it if there is a problem? How do you fix it? These are the few things which can give you a fair idea about the performance of your company or your organization. And customers are the boss. In the same way, there is success and innovation. How do you see this performance?   You should be very much careful about that day. Why? Because either they have lost their faith on you that you cannot do anything as a leader. How are you the boss? Are they don't need you anymore? Are you not solving their problem? In either case, that is your failure as a boss, as a leader, as a teacher even. If you don't ask me, that means you believe that I cannot satisfy you. Or you think that you don't need me. In both cases, I don't really need you. Same thing is with the leadership. What is its performance? I will not mix up the leadership and the things for this, we have a separate lecture. Staff stability in the organization is also an indicator that the performance of the organization is good. If the turnover rate is less, you know what is turnover rate? People keep coming to the organization. If the turnover rate is high, it is a bad signal. Bad indicator. That means people are not satisfied there. That means they are happy with the performance of their organization. They are satisfied with their boss. They are satisfied with their management. Their performance will be good. Similarly, innovation comes in the organization. And there is an effort on it. This is also an indicator that you are performing well. Let's see. We look at the operational level of the business. The purpose of telling all these indicators is to make it clear to you what performance is. Let's not look at one side of the performance. Let's try to look at it in a broader spectrum. And it varies from what we are talking about. We are talking about the customer, what we are talking about the aggression, and what parameters you will check with it. How can you see that the manufacturing of any production unit is excellent. Its performance is very good. If its product development cycle is efficient and effective, its unit cost is very appropriate. You benchmark it, right? The wastage is decreasing. We will say that the performance of the unit is excellent. If it takes more time, more wastage, and it takes more time to sell it to the market, then the process is not good. Something is missing somewhere. Similarly, let's look at the design. How good is its design? It is the other way around. Its design is effecting on its performance. If it is efficient, then we can say its performance is good. Otherwise, the better it is, the more money you have put on it. It is not performing. It is an inefficient product, inefficient design. So, I believe you have now a good idea about what is performance. What is performance? It needs proper sport, opportunity, and abilities, knowledge and skill. When it happens, you will say that your performance is good. And based on performance, you can have the outcomes. That can be in a product shape, in the service shape or whatever. Clear? Motivation means how much effort you are putting in it. How much motive is behind it? And the kind of ability you have or in a particular environment where you have the sport or opportunity is that you will give performance to all things. What will be the outcome of this performance? Either it is a good performance or a bad performance. That can be a product, that can be a service, whatever. Now, how it is relevant with our subject? Why we are studying this performance here? Because we are dealing with the organization. And in that, we have to see that the performers even measure their name. Let's go and see first the factors that influence whether the performers will be sustained or not. We have to see in the organization that it is a sustainable performance. Like I told you, the TV you have turned on, you can see that the picture is good, the color is good, the voice is also closed for a while. So then, if you touch it a little, it moves a little, then it moves. So this is not a performance. It was a good performance a while ago, now it is bad. Then we will do something with it, and then it will be fine. So it is not a sustainable performance. The performance is the good one, which is sustainable. How is that possible? If the organization can have and measure their performance, they can see it together. And you can have the same concept of punishment as well. It is a good performance, reward it. If the performance is not good, reward it, even you can have the punishment. So you should know the consequences. If I will do this good, I am going to get this benefit. If I am sloppy, I will do some mistakes, I will be getting this punishment. If this is also good, then it is a good one. Plus, there is a continuous feedback. As you get up in the morning, do some work in the morning, do some private time, what is this? It is a feedback, you get the continuous feedback. The reinforcement strategy is that yes, do it. If you do everything, you can have the better job performance. When we are talking about organization, and why do we measure the performance? Let it go like this. Why do you have exams? Why do you collect assignments? Why is your grading done? Similarly, in the organization we do measure the performance of people. So that, we should enhance the motivation and productivity. This will be the performance. If you get good performance, reward it, recognition it, then you can see the other side, if you are validating the things, it will help you, improve the machine, improve the process, improve the skills, train them, whatever, and this will also help you to detect the problems. Where is the issue? Is this equipment? Is that skill deficiency? Are the motivation factors? Are the opportunity, which is creating the problem and you are not getting up to clear it? Similarly, if there is a change, to evaluate that change, it is necessary to evaluate whether it will adapt or not. People are taking it positively. That can also provide you the basis for the making decision. Decision about what? About future planning, about compensation, about rectification, if you have to fix something, or even the selection process you have made a mistake. That is how it will help you. Similarly, there is a comparison. You have topped the second position and the third position. In the employees, he is the best, he is average, he is below average. Why? So that they know what we are doing. And then, of course, if somebody is doing good job, he or she might be getting better cell, he or she might be getting better cell. And you have a base, who are you giving the best return? So that if there is a legal problem, he or she can justify it. And what do we do in this? Every proper work that is done, the same performance is evaluated on the dimension. Like I told you, TV, its picture tube, its color, its sound. You use a pen to write because you have to write it. You have to see it. So this is what we will discuss in the future. Let's see how we can manage our performance. Performance management is basically a means of getting better results. By understanding and managing performance within an agreed framework. You will be given this facility and you will have to perform this. And the plan is a goal. And it is a process to establish a shared understanding about what is to be achieved and how it is to be achieved. And an approach to managing and developing people. Why? That they will be. You can achieve through this. Do you know what is expected from you? What is its requirement? What parameters will you be tested on? All these processes will be in performance management. So what is the goal? Improve the effectiveness and efficiency of the organization. How can we do that? You have to align the employee's work behavior and result with the organization goal. Very important. What do you have to do with all these processes? You have to align those things. What? The work behavior has objective goals. You have matched the needs and abilities. And you are also improving by training, by development, by giving the motivation, by facilitating. And it is an ongoing process. And that is performance management. Let's stop it here and see what we have covered so far. We started with the barriers in the career advancement in the organization. And then we tried to discuss the performance. And I hope you are clear with the performance part. Or performance management. What happens? That was our today's subject. For next time, Inshallah we will try to cover this performance appraisal part. Which is very important activity of HRM. It is important to read it. It is a very important subject. Very important activity of HRRK. It depends on many things. It is important to read it. And with this expectation we will see it well. Allah Hafiz, Assalamu alaikum


Oh, that's, wait, that's morning, everyone. It is 7 a.m., look at me, look at me go. Well, Joe and I are about to go get some breakfast. Today is the meet-up day, which is really exciting. We're leaving, we have to meet up with the people from garage at 8.30. So we're just gonna go get some bagels. Joe loves his bagels, and then... It's really not a New York thing, it's just been crazy.  Never had that before. Subscribe if you guys are new here. Also, if you guys are watching this, this is our New York tour stop, but we are gonna be in Chicago on Saturday, this coming Saturday. I will have all the info on the screen. Be sure to check that out if you guys are in the area. I hate this bag with it, but I'm just wearing it right now. I'm wearing this Wild Fox GP set. It's one of the most comfortable things I own, and it's so cute. Welcome to New York. I wanna eat this cocoa. Okay, I made it to pick a bagel. That's me next month in Coco's year. We made it to the mall. We're here like two hours early, so we're gonna get ready here. Guys, look! Getting ready for the meetup. How are you liking your drink elephant products? I'm really enjoying myself. I was like, Danny, do you wanna try my drink elephant products? I have them all with me. It's literally every video that I mention them in. No, I know, so I'm like so excited for you. Oh, I was so excited. That was the coolest moment of my life. I made Ian come in my office and stare at them with me, and he was like, dude, this is actually sick. Mom, everyone was obsessing over this hand sanitizer. Yeah, it was a hit at the shoot yesterday. No, but like this kind. I'm just getting ready. Gonna go change it to my outfit. I have to go to pick out an outfit, but... Also, they just texted us a picture of you guys because you guys were already in line. We got here like two hours early and you guys were already in line. They sent us this photo. It's so cute. All right, we're at the store. We're gonna pick some clothes out. Oh, wait, let's take a photo with that after. Oh my gosh, nice. That's so cute. That is so cute. That's me. That's so funny. Wait, we're just gonna go back. We just bought some stuff. We're on the store, that's so cool. I forgot about that. So much angel. An angel. My nice little, my beautiful cold-boothed coconut milk. I have some fruit snacks that I'm sharing with Danny's mom. Some Sour Patch Kids, if you need any. Healthy day in my life. This is what I eat in a day. 15 minutes. Hi. And I feel like I'm here to be honest with you. Look at my best friend. This is me and Joe all the time. We love drinks. This is definitely in bed at like 1AM. Joe walks into my room and he's like, he's freaking out. What are we gonna say? Oh yeah, sorry. We also got cars, full-car, that's gonna put your other wrap on. Oh, that's cute. Cool, cool. Yay, thank you. Hey guys, this is Brian with Scenes. They're getting ready to go out and meet everyone. Woo. It's our big day, girlies. Come on. Our faces are now in Kenzie's face. Man. Are you ready? I'm not pre-gaming. We got some Morgan Yates. Yes. Speaking of Morgan, Demi Lovato had to meet up here into this too, so. They look so good. They look incredible. Iconic and they brought us, what is it? Look, look in the back, just look. Is this it? New York Vlogs. Do I look like one of these? Oh my gosh. What song do you love? Watch out, it's so good. I love it. Thank you. I mean, it's not mine. It's Janice, but yay. With the meetup, it was a fun time. I'm sure she'll talk about it in this case. It's a little freer. We vlogged. Josh just finished the meetup. Well, here's the live to determine that I come. The bomb.com stuff. Oh, it's awesome. You told me to do that. I should have, but I was already running behind. We went way over, so yeah, it's fine. Okay, we're back in the back room, but oh my gosh. Okay, so I got some flowers on a nice card. This stuff is so sweet. You guys do not need to bring this at all. It's just so cute. Mariam had asked you to spray. And then Brian brought me my favorite candle, which is so cute.  And then the chocolate bar. All the little kids that were there were so freaking cute. Okay, wait, Danny, come in my. Thank you guys so much for coming. It was amazing. Seriously, next weekend, we're in Chicago at the Woodfield Mall from noon to 3 p.m. Same time, we'd really love to meet you. There's gift bags for the first 100 people who come. Yeah. We're like delirious, but seriously, thank you guys so much. And when we looked at each other, we were like, oh my god. It was amazing. Hey guys, I'm back from the meetup. It's a few hours later, actually. Joe and I just went out and I thought we were grabbing coffee and I left everything in the room because I was charging my phone and then we like got food and stuff. So I should have our vlog camera, but I didn't. But seriously, the meetup was amazing. Thank you guys so much to anyone who came. It really means the world to me. But this is all about, so it was amazing and I'm not gonna talk about it forever, but seriously, so grateful. It was incredible. Look who's here. Missed me. Yes, I missed you so much. Guys, everyone, did you know that Joe, yeah, do you want to be in it? This is my maid for the camera. Guys, comment down below how old you think Joe is. Three, two, one, go. Thanks. A timer. A timer. Yep. Pretty hype, so I'm gonna link this. Link down below. So sure. Should we like cheer him up? Oh my God, are we doing this? Aw, that's gonna be cute. Okay, wait. I don't know how me. Did he like lean on me, yeah. This is gonna be cute. We'll take like... How many seconds is it? How many seconds is it? 10, nine, 11. It should be a couple. It's like a couple. It's enough for... Wait, okay, run. I'm running. Okay, I'm coming. Okay, wait, we're taking a new one. Hey guys, what's up? That's how you start a new video. Hey everyone, welcome back to my channel. Oh, Joey's video. I have to go back. Can I just do it? Yeah, there's the... That was a problem with me. Good morning everyone. It is Sunday morning. It is raining in New York, which is a dream come true for me. I love the rain, except for where we have to walk to church. We are about to go to Hillsong. We are meeting with someone. I posted an Instagram story, we're meeting with someone. But if any of you guys are in Chicago, and I actually don't know my flights to Chicago yet, you wanna go to church in Chicago, let me know and tell me where to go. Danny just sent me an audio message. Let's hear her. Yeah, my hair's in a bun. I'm like, put mascara on and tint a moisturizer. Okay, see you soon. All right, well, we need to leave, so. We're not packing up. Hey guys. Bye Ian. What are you talking about? I'll have to do it before you leave. Yeah, nice freaking try. You're the room key, right? Who's the Ian now? Don't say that, that's so rude. Thank you. My favorite person, Joe's here, but oh my gosh, I shouldn't be doing this. Look, look here. I like it. It's so cute. Wow, it's huge. Guys, these are so cute. Look how they give you the food. That's actually like, oh my gosh, I love that. Yeah. Okay, so we left service. It was amazing. And then we went to Blue Stone, which you guys saw. We're walking back to the hotel right now. Look at Joe right now. Merch shirt, merch hoodie. I love my number one fan. Okay, oh my gosh, we're packing up the room. I'm gonna miss this view. I know I've shown it a billion times. Also, wearing my dropper stone shirt. We just took some disposables.  I'm not excited to leave. Hey guys, we're back from New York. I actually need to end the vlog. So thanks for watching. Thanks for coming to the meetup if you guys did. We'll be in Chicago on Saturday. Love you guys so much. Bye.


talk is basically just a five minute addendum to sham stock. How many of you would prefer to use view over angular if you could? Okay, there are a few people and if you want to use all the features that sham just talked about all the beautiful parts about native script, but prefer to use view as a framework instead of angular, then there is native script view, which just a few things about myself. I've been working with Vue.js a lot recently I've written a lot of view libraries. So and these days like mobile apps, I've been trying out native script view to build some though originally I have been a very long time, six, seven years I've been working on native mobile apps. So what's native script view? It takes native script use Vue.js as a framework and creates a logo like that. Okay, so native script. I think you're seeing something. I'll just add a few things that I felt really nice was that you can create certain layouts which are actually pretty hard creating in even native iOS or Android grid layouts wrap layouts kind of things. And of course, this part that I think sham already talked about is that you can write code which looks like objective C or you can write code which looks like Java. So and you can just directly use them in JavaScript because it uses internally reflection and you can use native script as with plain JavaScript and XML files or you can use with angular like you've seen now. And finally, you can use it with Vue.js. The latest version of native script view allows you to use Vue CLI 2.0 components. So you can't actually use with Vue CLI 3 right now. But your view single file components, those who have used, you can put a pub Jade as templates if you want instead of HTML, you can use type script or coffee script in the script part instead of jays. If you want to, I mean, that pack is going to transpile all of that for you.  So the simple project will be showing is uses Vue.js, but it also use type script with that. And it, your view X for state management and view router for roots, all of that completely works out of the box when you're using native script view. And best part here is like, when you're creating a cross platform thing like it works on iOS and write one of the things I prefer is like if it's a simple project, it's not too complicated. I want to write zero Swift or Java files. Okay. And zero bridges. So in a descriptor allows you to do pretty complicated apps without understanding a lot about how the native part works. I mean, if it's a pretty complex app, probably you need to write some bridges, but if you don't need to, there'll be a great thing. And it supports, of course, auto reload. So see takes you to the Apple Maps app right now. And if I just change the URL from maps, you are right to maps.google.com instead, click on the location. Now it goes to maps.google.com. Okay. So everything that you all the features that you get when you are developing a view app on a website, a web pack single bundle file with hot module reload, all of that stuff is there. And best thing is going to show it in a live app. So you can use CSS animations and they translate into native animations. This is a very powerful feature. If you're using something like react native, which is one thing that we can compare to native script is that you have to create animation objects and then animate items. Just show just show the app once when I open the app, get this animation that is happening. When it is running, it is an actual native animation inside Android with interpolators. But I have defined it in my code simply using CSS files to translate animation, automatically converts into native animations. There are things like also if you want to say open up a QR code scanner, it automatically asks you for permission for camera and stuff. Most of these libraries already exist. You don't need to even understand how the native layer this is working. And actually it's because emulator has 90 degree orientation problem. Yeah, I think that works. It is a probably scanned. So I think I'll just show you the scanning code like just a single line of code which makes this possible. Yeah, you create a barcode scanner and you would like this dot do scan it as for the permission opens the camera does the scan all of that stuff. You don't need to understand how the native part works. So if you're making simple apps, I think it's a pretty good option. And if you want to probably take out the code for this or want to contribute. So this is where it would end up the first one has geek slash mobile right now I'm just building it on my repository and if anybody has installed the Android app right now, I know it's pretty buggy. So it's going to improve probably by the next conference. This will be the app and anybody who has iPhones they would be able to use it as well. And you would have all the features that the existing app has and extra features to possibly know by the next conference if you come to a conference, you don't have to have you know how to play. Thank you.