WEBVTT

1
00:00:02.200 --> 00:00:05.300
<00:00:02.200>So <00:00:02.433>hi <00:00:02.666>everyone <00:00:02.900>today, <00:00:03.133>I <00:00:03.366>let <00:00:03.600>me

2
00:00:05.300 --> 00:00:08.400
<00:00:05.300>just <00:00:05.475>go <00:00:05.649>ahead <00:00:05.824>with <00:00:06.000>the <00:00:06.175>introduction. <00:00:06.350>I'm <00:00:06.524>currently <00:00:06.699>working

3
00:00:08.400 --> 00:00:11.700
<00:00:08.400>as <00:00:08.575>a <00:00:08.750>security <00:00:08.925>relations <00:00:09.100>leader <00:00:09.275>at <00:00:09.450>sneak. <00:00:09.625>I'm <00:00:09.800>also

4
00:00:11.700 --> 00:00:14.600
<00:00:11.700>chairing <00:00:12.166>over <00:00:12.633>us <00:00:13.100>as

5
00:00:14.600 --> 00:00:17.900
<00:00:14.600>a <00:00:14.775>community <00:00:14.950>around <00:00:15.125>the <00:00:15.299>world <00:00:15.475>and <00:00:15.649>it's <00:00:15.825>open <00:00:16.000>web

6
00:00:17.900 --> 00:00:20.500
<00:00:17.900>application <00:00:18.075>security <00:00:18.250>project, <00:00:18.424>which <00:00:18.599>is <00:00:18.775>more <00:00:18.950>of <00:00:19.125>a <00:00:19.299>known

7
00:00:20.500 --> 00:00:23.400
<00:00:20.500>profit <00:00:20.700>organization <00:00:20.900>where <00:00:21.100>we <00:00:21.300>cater <00:00:21.500>to <00:00:21.700>different <00:00:21.900>projects

8
00:00:23.400 --> 00:00:27.500
<00:00:23.400>chapters <00:00:23.540>around <00:00:23.680>the <00:00:23.820>world <00:00:23.959>so <00:00:24.099>that <00:00:24.240>we <00:00:24.380>can <00:00:24.520>foster <00:00:24.659>application <00:00:24.799>security

9
00:00:27.500 --> 00:00:30.800
<00:00:27.500>cyber <00:00:27.733>security. <00:00:27.966>I <00:00:28.200>also <00:00:28.433>lead <00:00:28.666>certain <00:00:28.900>diversity

10
00:00:30.800 --> 00:00:33.200
<00:00:30.800>initiatives <00:00:31.033>in <00:00:31.266>India <00:00:31.500>and <00:00:31.733>outside. <00:00:31.966>That's <00:00:32.200>a

11
00:00:33.200 --> 00:00:36.400
<00:00:33.200>bit <00:00:33.375>about <00:00:33.550>myself <00:00:33.725>now <00:00:33.900>about <00:00:34.075>the <00:00:34.250>presentation. <00:00:34.425>This <00:00:34.600>is

12
00:00:36.400 --> 00:00:39.800
<00:00:36.400>one <00:00:36.574>of <00:00:36.750>my <00:00:36.925>favorite <00:00:37.100>side, <00:00:37.275>which <00:00:37.449>I <00:00:37.625>mostly <00:00:37.800>showcased

13
00:00:39.800 --> 00:00:43.100
<00:00:39.800>because <00:00:40.080>this <00:00:40.360>keeps <00:00:40.640>me <00:00:40.919>engaged <00:00:41.199>and

14
00:00:42.100 --> 00:00:45.400
<00:00:42.100>this <00:00:42.333>keeps <00:00:42.566>audience <00:00:42.800>also <00:00:43.033>engaged <00:00:43.266>people <00:00:43.500>say

15
00:00:45.400 --> 00:00:48.200
<00:00:45.400>sometimes <00:00:45.633>they <00:00:45.866>scared <00:00:46.100>so <00:00:46.333>here <00:00:46.566>I <00:00:46.800>want

16
00:00:48.200 --> 00:00:51.100
<00:00:48.200>to <00:00:48.327>scare <00:00:48.454>a <00:00:48.581>little <00:00:48.709>bit. <00:00:48.836>I <00:00:48.963>want <00:00:49.090>to <00:00:49.218>inform <00:00:49.345>a <00:00:49.472>little <00:00:49.600>bit

17
00:00:51.100 --> 00:00:53.300
<00:00:51.100>at <00:00:51.255>the <00:00:51.411>same <00:00:51.566>time. <00:00:51.722>I <00:00:51.877>want <00:00:52.033>to <00:00:52.188>share <00:00:52.344>some <00:00:52.500>information.

18
00:00:54.400 --> 00:00:57.100
<00:00:54.400>So <00:00:54.574>about <00:00:54.750>this <00:00:54.925>image. <00:00:55.100>This <00:00:55.275>is <00:00:55.449>more <00:00:55.625>of <00:00:55.800>a

19
00:00:57.100 --> 00:01:01.100
<00:00:57.100>futuristic <00:00:57.255>image <00:00:57.411>that <00:00:57.566>we <00:00:57.722>want <00:00:57.877>to <00:00:58.033>have <00:00:58.188>like <00:00:58.344>everyone <00:00:58.500>at

20
00:01:00.100 --> 00:01:04.300
<00:01:00.100>home. <00:01:00.333>They <00:01:00.566>have <00:01:00.800>a <00:01:01.033>companion. <00:01:01.266>Whose <00:01:01.500>robot

21
00:01:03.300 --> 00:01:06.400
<00:01:03.300>doing <00:01:03.650>our <00:01:04.000>work <00:01:04.349>helping <00:01:04.700>us

22
00:01:06.400 --> 00:01:09.900
<00:01:06.400>out <00:01:06.540>with <00:01:06.680>all <00:01:06.820>of <00:01:06.960>these <00:01:07.100>things <00:01:07.240>and <00:01:07.380>not <00:01:07.520>just <00:01:07.660>robot. <00:01:07.800>Talk

23
00:01:09.900 --> 00:01:12.500
<00:01:09.900>about <00:01:10.180>smart. <00:01:10.460>Geyser <00:01:10.740>smart <00:01:11.020>Aces <00:01:11.300>everything

24
00:01:12.500 --> 00:01:15.800
<00:01:12.500>smart. <00:01:12.733>We <00:01:12.966>want <00:01:13.200>like, <00:01:13.433>oh, <00:01:13.666>please <00:01:13.900>do

25
00:01:15.800 --> 00:01:18.200
<00:01:15.800>this <00:01:15.975>do <00:01:16.149>that <00:01:16.325>and <00:01:16.500>they <00:01:16.675>do <00:01:16.850>it <00:01:17.024>for <00:01:17.200>us.

26
00:01:18.200 --> 00:01:21.500
<00:01:18.200>But <00:01:18.400>that <00:01:18.600>information <00:01:18.800>is <00:01:19.000>getting <00:01:19.200>uploaded <00:01:19.400>somewhere. <00:01:19.600>Now

27
00:01:21.500 --> 00:01:24.700
<00:01:21.500>when <00:01:21.675>that <00:01:21.850>information <00:01:22.025>is <00:01:22.200>getting <00:01:22.375>uploaded <00:01:22.550>somewhere <00:01:22.725>there <00:01:22.900>could

28
00:01:24.700 --> 00:01:27.400
<00:01:24.700>be <00:01:24.875>some <00:01:25.050>patches <00:01:25.225>which <00:01:25.400>might <00:01:25.575>be <00:01:25.750>downloaded <00:01:25.925>and <00:01:26.100>when

29
00:01:27.400 --> 00:01:30.500
<00:01:27.400>that <00:01:27.633>happens <00:01:27.866>there <00:01:28.100>could <00:01:28.333>be <00:01:28.566>some <00:01:28.800>malicious

30
00:01:30.500 --> 00:01:33.200
<00:01:30.500>packages <00:01:30.700>which <00:01:30.900>might <00:01:31.100>be <00:01:31.300>downloaded <00:01:31.500>which <00:01:31.700>might <00:01:31.900>be

31
00:01:33.200 --> 00:01:36.300
<00:01:33.200>tracking <00:01:33.400>you <00:01:33.600>every <00:01:33.800>move <00:01:34.000>of <00:01:34.200>yours. <00:01:34.400>Whatever <00:01:34.600>you

32
00:01:36.300 --> 00:01:40.500
<00:01:36.300>do <00:01:36.427>if <00:01:36.554>you <00:01:36.681>have <00:01:36.809>kids <00:01:36.936>at <00:01:37.063>home, <00:01:37.190>they <00:01:37.318>might <00:01:37.445>be <00:01:37.572>tracking <00:01:37.700>those

33
00:01:39.500 --> 00:01:42.300
<00:01:39.500>things <00:01:39.780>as <00:01:40.060>well. <00:01:40.340>So <00:01:40.620>think <00:01:40.900>about

34
00:01:42.300 --> 00:01:44.100
<00:01:42.300>how <00:01:42.649>crazy <00:01:43.000>that <00:01:43.350>would <00:01:43.700>be.

35
00:01:44.800 --> 00:01:47.500
<00:01:44.800>And <00:01:45.033>developers <00:01:45.266>have <00:01:45.500>a <00:01:45.733>big <00:01:45.966>role <00:01:46.200>to

36
00:01:47.500 --> 00:01:51.400
<00:01:47.500>play <00:01:47.780>in <00:01:48.060>that <00:01:48.340>now. <00:01:48.620>This <00:01:48.900>is

37
00:01:50.400 --> 00:01:53.800
<00:01:50.400>some <00:01:50.680>information <00:01:50.960>which <00:01:51.240>you <00:01:51.520>already <00:01:51.800>know.

38
00:01:53.800 --> 00:01:56.300
<00:01:53.800>This <00:01:54.000>is <00:01:54.200>some <00:01:54.399>information <00:01:54.600>about <00:01:54.800>some <00:01:55.000>attacks <00:01:55.200>that

39
00:01:56.300 --> 00:01:59.500
<00:01:56.300>I'm <00:01:56.427>going <00:01:56.554>to <00:01:56.681>be <00:01:56.809>sharing <00:01:56.936>you <00:01:57.063>today <00:01:57.190>from <00:01:57.318>the <00:01:57.445>recent <00:01:57.572>times, <00:01:57.700>which

40
00:01:59.500 --> 00:01:59.900
<00:01:59.500>we've <00:01:59.860>seen

41
00:02:01.300 --> 00:02:04.800
<00:02:01.300>now <00:02:01.500>when <00:02:01.700>all <00:02:01.899>of <00:02:02.100>this <00:02:02.300>is <00:02:02.500>fine, <00:02:02.700>but

42
00:02:04.800 --> 00:02:07.500
<00:02:04.800>if <00:02:05.080>developers <00:02:05.360>become <00:02:05.640>a <00:02:05.920>malware <00:02:06.200>distribution

43
00:02:07.500 --> 00:02:10.500
<00:02:07.500>vehicle, <00:02:07.700>we've <00:02:07.900>seen <00:02:08.100>it <00:02:08.300>in <00:02:08.500>the <00:02:08.699>recent <00:02:08.900>password

44
00:02:10.500 --> 00:02:13.900
<00:02:10.500>and <00:02:10.733>what <00:02:10.966>happened <00:02:11.200>with <00:02:11.433>these <00:02:11.666>cases <00:02:11.900>wherein

45
00:02:13.900 --> 00:02:16.500
<00:02:13.900>the <00:02:14.133>man <00:02:14.366>maintenance <00:02:14.600>of <00:02:14.833>the <00:02:15.066>account <00:02:15.300>itself

46
00:02:16.500 --> 00:02:19.200
<00:02:16.500>or <00:02:16.850>the <00:02:17.200>developers <00:02:17.550>who <00:02:17.900>are

47
00:02:19.200 --> 00:02:22.300
<00:02:19.200>using <00:02:19.480>certain <00:02:19.760>tool <00:02:20.040>sets. <00:02:20.320>Their <00:02:20.600>system

48
00:02:22.300 --> 00:02:26.000
<00:02:22.300>was <00:02:22.500>impacted <00:02:22.700>their <00:02:22.900>tooling <00:02:23.100>was <00:02:23.300>impacted <00:02:23.500>because <00:02:23.700>of

49
00:02:25.100 --> 00:02:28.500
<00:02:25.100>which <00:02:25.299>this <00:02:25.500>whole <00:02:25.700>thing <00:02:25.900>happened <00:02:26.100>now <00:02:26.299>in <00:02:26.500>the

50
00:02:28.500 --> 00:02:31.900
<00:02:28.500>event <00:02:28.700>stream <00:02:28.900>incident <00:02:29.100>what <00:02:29.300>happened <00:02:29.500>it <00:02:29.700>this <00:02:29.900>package

51
00:02:31.900 --> 00:02:34.700
<00:02:31.900>has <00:02:32.133>been <00:02:32.366>in <00:02:32.600>use <00:02:32.833>since <00:02:33.066>2011 <00:02:33.300>now

52
00:02:34.700 --> 00:02:37.200
<00:02:34.700>maintainers <00:02:35.399>started <00:02:36.100>working

53
00:02:37.200 --> 00:02:40.900
<00:02:37.200>on <00:02:37.375>it <00:02:37.549>got <00:02:37.725>busy <00:02:37.899>there <00:02:38.075>were <00:02:38.250>certain <00:02:38.424>issues <00:02:38.600>which

54
00:02:40.900 --> 00:02:43.900
<00:02:40.900>people <00:02:41.055>said <00:02:41.211>real <00:02:41.366>help <00:02:41.522>you <00:02:41.677>out <00:02:41.833>and <00:02:41.988>fixing <00:02:42.144>now <00:02:42.300>when

55
00:02:43.900 --> 00:02:46.500
<00:02:43.900>they <00:02:44.133>helped <00:02:44.366>out <00:02:44.600>and <00:02:44.833>fixing <00:02:45.066>at <00:02:45.300>that

56
00:02:46.500 --> 00:02:50.200
<00:02:46.500>time, <00:02:46.675>there <00:02:46.850>is <00:02:47.025>one <00:02:47.200>thing <00:02:47.375>that <00:02:47.550>happened <00:02:47.725>there <00:02:47.900>was

57
00:02:50.200 --> 00:02:53.500
<00:02:50.200>one <00:02:50.433>there <00:02:50.666>was <00:02:50.899>one <00:02:51.133>person. <00:02:51.366>He <00:02:51.600>actually

58
00:02:53.500 --> 00:02:57.400
<00:02:53.500>sent <00:02:53.700>a <00:02:53.900>merger <00:02:54.100>request <00:02:54.300>which <00:02:54.500>was <00:02:54.700>vulnerable <00:02:54.900>now

59
00:02:56.400 --> 00:02:59.600
<00:02:56.400>when <00:02:56.680>that <00:02:56.960>vulnerable <00:02:57.240>image <00:02:57.520>was <00:02:57.800>sent.

60
00:03:00.600 --> 00:03:01.600
<00:03:00.600>What <00:03:01.049>happened <00:03:01.500>next?

61
00:03:02.600 --> 00:03:04.100
<00:03:02.600>so <00:03:03.049>the <00:03:03.500>whole <00:03:03.950>content

62
00:03:05.400 --> 00:03:08.600
<00:03:05.400>Again <00:03:05.600>packaged <00:03:05.800>and <00:03:06.000>sent <00:03:06.200>to <00:03:06.400>everyone <00:03:06.600>now <00:03:06.800>everybody

63
00:03:08.600 --> 00:03:11.400
<00:03:08.600>started <00:03:08.755>using <00:03:08.911>it <00:03:09.066>but <00:03:09.222>then <00:03:09.377>there <00:03:09.533>was <00:03:09.688>a <00:03:09.844>crypto <00:03:10.000>minor

64
00:03:11.400 --> 00:03:14.700
<00:03:11.400>in <00:03:11.540>it. <00:03:11.680>So <00:03:11.820>anyone <00:03:11.960>who <00:03:12.100>was <00:03:12.240>running <00:03:12.380>that <00:03:12.520>package <00:03:12.660>was <00:03:12.800>actually

65
00:03:14.700 --> 00:03:16.300
<00:03:14.700>running <00:03:15.049>crypto <00:03:15.399>minor <00:03:15.750>as <00:03:16.100>well.

66
00:03:17.100 --> 00:03:20.800
<00:03:17.100>So <00:03:17.255>all <00:03:17.411>the <00:03:17.566>resources <00:03:17.722>were <00:03:17.877>getting <00:03:18.033>flushed <00:03:18.188>now <00:03:18.344>this <00:03:18.500>seems

67
00:03:20.800 --> 00:03:23.100
<00:03:20.800>to <00:03:20.975>be <00:03:21.150>okay, <00:03:21.325>then <00:03:21.500>it <00:03:21.675>was <00:03:21.850>removed. <00:03:22.025>But <00:03:22.200>then

68
00:03:23.100 --> 00:03:26.500
<00:03:23.100>there <00:03:23.299>are <00:03:23.500>recent <00:03:23.700>incidents <00:03:23.900>just <00:03:24.100>in <00:03:24.299>January. <00:03:24.500>There

69
00:03:26.500 --> 00:03:30.200
<00:03:26.500>was <00:03:26.733>a <00:03:26.966>maintainer <00:03:27.200>that <00:03:27.433>person <00:03:27.666>himself <00:03:27.900>actually

70
00:03:29.200 --> 00:03:32.000
<00:03:29.200>added <00:03:29.433>a <00:03:29.666>loop <00:03:29.899>condition <00:03:30.133>in <00:03:30.366>one <00:03:30.600>of

71
00:03:32.400 --> 00:03:35.400
<00:03:32.400>the <00:03:32.540>packages <00:03:32.680>and <00:03:32.820>for <00:03:32.960>one <00:03:33.100>of <00:03:33.240>the <00:03:33.380>package <00:03:33.520>the <00:03:33.660>complete <00:03:33.800>package

72
00:03:35.400 --> 00:03:38.300
<00:03:35.400>was <00:03:35.600>removed. <00:03:35.800>So <00:03:36.000>these <00:03:36.200>strange <00:03:36.400>things <00:03:36.600>are <00:03:36.800>happening

73
00:03:38.300 --> 00:03:40.700
<00:03:38.300>now, <00:03:38.650>it <00:03:39.000>doesn't <00:03:39.350>stop <00:03:39.700>there.

74
00:03:41.400 --> 00:03:44.700
<00:03:41.400>How <00:03:41.750>about <00:03:42.100>dependencies <00:03:42.450>dependencies? <00:03:42.800>I'm

75
00:03:44.700 --> 00:03:47.200
<00:03:44.700>sure <00:03:44.875>this <00:03:45.049>you <00:03:45.225>must <00:03:45.399>be <00:03:45.575>hearing <00:03:45.750>day <00:03:45.924>in <00:03:46.100>and

76
00:03:47.200 --> 00:03:47.700
<00:03:47.200>day <00:03:47.424>out <00:03:47.649>now.

77
00:03:48.300 --> 00:03:51.200
<00:03:48.300>I've <00:03:48.440>been <00:03:48.580>a <00:03:48.720>developer. <00:03:48.860>I've <00:03:49.000>been <00:03:49.140>a <00:03:49.280>security <00:03:49.420>person <00:03:49.560>so <00:03:49.700>I

78
00:03:51.200 --> 00:03:54.800
<00:03:51.200>know <00:03:51.375>the <00:03:51.549>pain <00:03:51.725>which <00:03:51.899>everyone <00:03:52.075>goes <00:03:52.250>through <00:03:52.424>wherein <00:03:52.600>it

79
00:03:54.800 --> 00:03:57.200
<00:03:54.800>is <00:03:55.033>so <00:03:55.266>hard <00:03:55.500>to <00:03:55.733>sometime <00:03:55.966>make <00:03:56.200>people

80
00:03:57.200 --> 00:03:58.500
<00:03:57.200>understand <00:03:57.492>that <00:03:57.785>there <00:03:58.077>are <00:03:58.370>issues.

81
00:03:59.600 --> 00:04:03.100
<00:03:59.600>Now <00:03:59.739>on <00:03:59.880>top <00:04:00.019>of <00:04:00.160>it <00:04:00.299>if <00:04:00.440>you <00:04:00.579>realize <00:04:00.720>that <00:04:00.859>there <00:04:01.000>are

82
00:04:03.100 --> 00:04:06.300
<00:04:03.100>certain <00:04:03.239>dependencies <00:04:03.380>that <00:04:03.519>we <00:04:03.660>download <00:04:03.799>as <00:04:03.940>part <00:04:04.079>of <00:04:04.220>the <00:04:04.359>package. <00:04:04.500>For

83
00:04:06.300 --> 00:04:09.400
<00:04:06.300>example, <00:04:06.500>this <00:04:06.700>is <00:04:06.900>our <00:04:07.100>app <00:04:07.300>and <00:04:07.500>there's <00:04:07.700>only

84
00:04:09.400 --> 00:04:12.400
<00:04:09.400>a <00:04:09.680>little <00:04:09.960>bit <00:04:10.240>of <00:04:10.520>little <00:04:10.800>bit

85
00:04:12.400 --> 00:04:15.700
<00:04:12.400>of <00:04:12.575>app <00:04:12.750>that <00:04:12.925>we <00:04:13.100>develop <00:04:13.275>whatever <00:04:13.450>we <00:04:13.625>say <00:04:13.800>because

86
00:04:15.700 --> 00:04:18.400
<00:04:15.700>this <00:04:15.875>is <00:04:16.050>a <00:04:16.224>mental <00:04:16.399>block <00:04:16.575>that <00:04:16.750>this <00:04:16.925>is <00:04:17.099>hola

87
00:04:18.400 --> 00:04:21.400
<00:04:18.399>rap, <00:04:18.575>but <00:04:18.750>if <00:04:18.924>there <00:04:19.099>is <00:04:19.274>one <00:04:19.450>piece <00:04:19.625>of <00:04:19.799>it

88
00:04:21.400 --> 00:04:24.300
<00:04:21.399>if <00:04:21.539>it's <00:04:21.679>not <00:04:21.820>working, <00:04:21.959>we'll <00:04:22.099>check <00:04:22.239>on <00:04:22.380>the <00:04:22.520>internet <00:04:22.659>download <00:04:22.799>the

89
00:04:24.300 --> 00:04:27.400
<00:04:24.300>dependency. <00:04:24.533>Dependency. <00:04:24.766>It <00:04:25.000>starts <00:04:25.233>working. <00:04:25.466>Do <00:04:25.700>we

90
00:04:27.400 --> 00:04:30.900
<00:04:27.400>track <00:04:27.555>it <00:04:27.711>all <00:04:27.866>the <00:04:28.022>time? <00:04:28.177>No, <00:04:28.333>we <00:04:28.488>don't <00:04:28.644>and <00:04:28.799>we've

91
00:04:30.900 --> 00:04:33.200
<00:04:30.900>seen <00:04:31.179>that <00:04:31.460>period <00:04:31.739>over <00:04:32.020>period <00:04:32.299>your

92
00:04:33.200 --> 00:04:36.600
<00:04:33.200>time <00:04:33.340>over <00:04:33.479>time <00:04:33.620>the <00:04:33.760>same <00:04:33.900>things <00:04:34.039>are <00:04:34.180>creeping <00:04:34.320>up <00:04:34.460>and <00:04:34.599>sometimes

93
00:04:36.600 --> 00:04:39.200
<00:04:36.600>when <00:04:36.833>there's <00:04:37.066>a <00:04:37.300>urgent <00:04:37.533>release <00:04:37.766>and <00:04:38.000>things

94
00:04:39.200 --> 00:04:42.300
<00:04:39.200>have <00:04:39.316>to <00:04:39.433>go <00:04:39.550>right <00:04:39.666>so <00:04:39.783>we <00:04:39.900>try <00:04:40.016>and <00:04:40.133>do <00:04:40.250>that, <00:04:40.366>but <00:04:40.483>then <00:04:40.599>we

95
00:04:42.300 --> 00:04:45.700
<00:04:42.300>miss <00:04:42.500>out <00:04:42.700>on <00:04:42.900>some <00:04:43.100>important <00:04:43.300>aspects <00:04:43.500>now <00:04:43.700>comes

96
00:04:45.700 --> 00:04:48.500
<00:04:45.700>the <00:04:45.979>attacker <00:04:46.260>The <00:04:46.539>Tackle <00:04:46.820>attacking <00:04:47.099>the

97
00:04:48.500 --> 00:04:49.500
<00:04:48.500>developer <00:04:49.400>tooling.

98
00:04:49.900 --> 00:04:52.400
<00:04:49.900>I'm <00:04:50.133>sure <00:04:50.366>all <00:04:50.599>of <00:04:50.833>you <00:04:51.066>are <00:04:51.299>most

99
00:04:52.400 --> 00:04:55.900
<00:04:52.400>of <00:04:52.599>you <00:04:52.799>are <00:04:53.000>using <00:04:53.200>the <00:04:53.400>IDE <00:04:53.599>plugins. <00:04:53.799>Now

100
00:04:55.900 --> 00:04:59.700
<00:04:55.900>when <00:04:56.133>you're <00:04:56.366>using <00:04:56.599>the <00:04:56.833>ideal <00:04:57.066>plugins <00:04:57.299>if

101
00:04:58.700 --> 00:05:01.400
<00:04:58.700>somebody <00:04:59.400>impacts <00:05:00.099>that

102
00:05:01.400 --> 00:05:04.400
<00:05:01.400>so <00:05:01.633>if <00:05:01.866>you're <00:05:02.099>not <00:05:02.333>updating <00:05:02.566>the <00:05:02.799>the

103
00:05:04.400 --> 00:05:07.900
<00:05:04.400>things <00:05:04.555>on <00:05:04.711>time, <00:05:04.866>if <00:05:05.022>you <00:05:05.177>are <00:05:05.333>not <00:05:05.488>updating <00:05:05.644>the <00:05:05.799>tooling

104
00:05:07.900 --> 00:05:10.700
<00:05:07.900>on <00:05:08.099>time <00:05:08.299>or <00:05:08.500>the <00:05:08.700>third <00:05:08.900>party <00:05:09.099>plugins <00:05:09.299>on

105
00:05:10.700 --> 00:05:11.900
<00:05:10.700>time <00:05:11.060>what <00:05:11.419>will <00:05:11.780>happen?

106
00:05:13.100 --> 00:05:16.400
<00:05:13.100>So <00:05:13.216>this <00:05:13.333>happened <00:05:13.450>with <00:05:13.566>one <00:05:13.683>of <00:05:13.800>the <00:05:13.916>plugin <00:05:14.033>for <00:05:14.150>visual <00:05:14.266>studio <00:05:14.383>code <00:05:14.500>or

107
00:05:16.400 --> 00:05:19.600
<00:05:16.400>the <00:05:16.679>person <00:05:16.960>actually <00:05:17.239>broke <00:05:17.520>into <00:05:17.799>Visual

108
00:05:19.600 --> 00:05:23.500
<00:05:19.600>Studio <00:05:19.727>code <00:05:19.854>where <00:05:19.981>they <00:05:20.109>were <00:05:20.236>able <00:05:20.363>to <00:05:20.490>get <00:05:20.618>access <00:05:20.745>to <00:05:20.872>the <00:05:21.000>repositories

109
00:05:22.500 --> 00:05:25.800
<00:05:22.500>and <00:05:22.733>do <00:05:22.966>a <00:05:23.200>lot <00:05:23.433>of <00:05:23.666>stuff, <00:05:23.900>but

110
00:05:25.800 --> 00:05:28.500
<00:05:25.800>fortunately <00:05:26.033>they <00:05:26.266>were <00:05:26.500>able <00:05:26.733>to <00:05:26.966>report <00:05:27.200>it.

111
00:05:29.200 --> 00:05:32.200
<00:05:29.200>Now <00:05:29.327>they <00:05:29.454>reported <00:05:29.581>it. <00:05:29.709>This <00:05:29.836>could <00:05:29.963>have <00:05:30.090>gone <00:05:30.218>in <00:05:30.345>a <00:05:30.472>totally <00:05:30.599>different

112
00:05:32.200 --> 00:05:35.500
<00:05:32.200>direction. <00:05:32.355>Now <00:05:32.511>think <00:05:32.666>of <00:05:32.822>a <00:05:32.977>state <00:05:33.133>of <00:05:33.288>open <00:05:33.444>source <00:05:33.599>security

113
00:05:35.500 --> 00:05:38.700
<00:05:35.500>Now <00:05:35.733>open <00:05:35.966>source <00:05:36.200>security <00:05:36.433>is <00:05:36.666>something <00:05:36.900>which

114
00:05:39.800 --> 00:05:41.500
<00:05:39.800>we <00:05:40.266>feel <00:05:40.733>is <00:05:41.200>okay.

115
00:05:42.400 --> 00:05:44.000
<00:05:42.400>But <00:05:42.866>why <00:05:43.333>think <00:05:43.799>of?

116
00:05:44.600 --> 00:05:47.600
<00:05:44.600>The <00:05:44.775>whole <00:05:44.950>project <00:05:45.125>that <00:05:45.300>we <00:05:45.475>have <00:05:45.650>the <00:05:45.825>whole <00:05:46.000>code

117
00:05:47.600 --> 00:05:50.500
<00:05:47.600>base <00:05:47.800>that <00:05:48.000>we <00:05:48.200>have <00:05:48.400>only <00:05:48.600>10 <00:05:48.800>to <00:05:49.000>20%

118
00:05:50.500 --> 00:05:53.400
<00:05:50.500>is <00:05:50.700>what <00:05:50.900>we <00:05:51.100>are <00:05:51.300>writing <00:05:51.500>and <00:05:51.700>rest <00:05:51.900>other

119
00:05:53.400 --> 00:05:56.800
<00:05:53.400>is <00:05:53.633>all <00:05:53.866>open <00:05:54.099>source <00:05:54.333>open <00:05:54.566>source, <00:05:54.799>even

120
00:05:56.800 --> 00:05:59.500
<00:05:56.800>if <00:05:56.955>I <00:05:57.111>talk <00:05:57.266>about <00:05:57.422>my <00:05:57.577>own <00:05:57.733>website <00:05:57.888>I <00:05:58.044>hosted <00:05:58.200>on

121
00:05:59.500 --> 00:06:03.500
<00:05:59.500>the <00:05:59.675>whole <00:05:59.850>open <00:06:00.025>source <00:06:00.200>content, <00:06:00.375>then <00:06:00.550>comes <00:06:00.725>these <00:06:00.900>issues

122
00:06:02.500 --> 00:06:05.400
<00:06:02.500>how <00:06:02.966>much <00:06:03.433>time <00:06:03.900>it

123
00:06:05.400 --> 00:06:08.500
<00:06:05.400>takes <00:06:05.555>to <00:06:05.711>fix <00:06:05.866>these <00:06:06.022>issues <00:06:06.177>but <00:06:06.333>then <00:06:06.488>do <00:06:06.644>maintainers <00:06:06.799>have

124
00:06:08.500 --> 00:06:11.800
<00:06:08.500>full-time <00:06:08.733>just <00:06:08.966>fix <00:06:09.200>these <00:06:09.433>no, <00:06:09.666>we <00:06:09.900>all

125
00:06:11.800 --> 00:06:14.300
<00:06:11.800>are <00:06:12.000>maintainers <00:06:12.200>of <00:06:12.400>some <00:06:12.600>other <00:06:12.800>project. <00:06:13.000>We <00:06:13.200>have

126
00:06:14.300 --> 00:06:17.200
<00:06:14.300>our <00:06:14.416>life. <00:06:14.533>We <00:06:14.650>have <00:06:14.766>our <00:06:14.883>work <00:06:15.000>we <00:06:15.116>have <00:06:15.233>so <00:06:15.350>many <00:06:15.466>things <00:06:15.583>going <00:06:15.700>on.

127
00:06:17.200 --> 00:06:20.300
<00:06:17.200>Sometimes <00:06:17.433>it's <00:06:17.666>not <00:06:17.900>feasible <00:06:18.133>or <00:06:18.366>it's <00:06:18.599>easy

128
00:06:20.300 --> 00:06:21.800
<00:06:20.300>to <00:06:20.750>just <00:06:21.200>update <00:06:21.650>it.

129
00:06:22.600 --> 00:06:25.300
<00:06:22.600>So <00:06:22.800>what <00:06:23.000>happens <00:06:23.200>next <00:06:23.400>the <00:06:23.600>bugs <00:06:23.800>get <00:06:24.000>fixed

130
00:06:25.300 --> 00:06:29.100
<00:06:25.300>after <00:06:25.500>a <00:06:25.700>while? <00:06:25.900>So <00:06:26.100>this <00:06:26.300>bug <00:06:26.500>JavaScript <00:06:26.700>marked

131
00:06:28.100 --> 00:06:31.700
<00:06:28.100>down <00:06:28.255>parser <00:06:28.411>took <00:06:28.566>one <00:06:28.722>year <00:06:28.877>to <00:06:29.033>get <00:06:29.188>fixed. <00:06:29.344>Now <00:06:29.500>when

132
00:06:31.700 --> 00:06:34.300
<00:06:31.700>that <00:06:31.933>happened <00:06:32.166>what <00:06:32.400>happened <00:06:32.633>next <00:06:32.866>or <00:06:33.099>what

133
00:06:34.300 --> 00:06:37.400
<00:06:34.300>were <00:06:34.475>the <00:06:34.650>issues <00:06:34.825>that <00:06:35.000>were <00:06:35.175>faced? <00:06:35.350>So <00:06:35.525>there <00:06:35.700>was

134
00:06:37.400 --> 00:06:40.500
<00:06:37.400>a <00:06:37.539>cross-site <00:06:37.679>scripting <00:06:37.820>attack, <00:06:37.960>which <00:06:38.099>was <00:06:38.239>there <00:06:38.380>for <00:06:38.520>one <00:06:38.659>year. <00:06:38.799>Now,

135
00:06:40.500 --> 00:06:43.200
<00:06:40.500>what <00:06:40.780>is <00:06:41.060>crossing <00:06:41.340>scripting <00:06:41.620>when <00:06:41.900>an

136
00:06:43.200 --> 00:06:44.800
<00:06:43.200>application <00:06:43.479>take <00:06:43.760>input <00:06:44.039>from <00:06:44.320>the <00:06:44.599>user?

137
00:06:45.500 --> 00:06:49.600
<00:06:45.500>Process <00:06:45.780>it <00:06:46.060>without <00:06:46.340>validating <00:06:46.620>and <00:06:46.900>doesn't

138
00:06:48.600 --> 00:06:51.500
<00:06:48.600>even <00:06:48.880>a <00:06:49.160>scat <00:06:49.440>escape <00:06:49.720>the <00:06:50.000>characters

139
00:06:51.500 --> 00:06:53.700
<00:06:51.500>or <00:06:51.733>just <00:06:51.966>print <00:06:52.200>it <00:06:52.433>as <00:06:52.666>it <00:06:52.900>is.

140
00:06:54.300 --> 00:06:58.200
<00:06:54.300>Now <00:06:54.500>on <00:06:54.700>top <00:06:54.900>of <00:06:55.100>it <00:06:55.300>the <00:06:55.500>vulnerabilities <00:06:55.700>like

141
00:06:57.200 --> 00:06:59.100
Apache.

142
00:07:00.300 --> 00:07:03.700
<00:07:00.300>Now <00:07:00.440>in <00:07:00.580>Apache <00:07:00.720>struts, <00:07:00.860>there <00:07:01.000>was <00:07:01.140>an <00:07:01.280>issue <00:07:01.420>in <00:07:01.560>version <00:07:01.700>2.3.

143
00:07:05.400 --> 00:07:08.800
<00:07:05.400>This <00:07:05.679>affected <00:07:05.960>many <00:07:06.239>organizations <00:07:06.520>but <00:07:06.799>affected

144
00:07:08.800 --> 00:07:11.300
<00:07:08.800>Equifax <00:07:09.266>because <00:07:09.733>it <00:07:10.200>became

145
00:07:11.300 --> 00:07:11.700
<00:07:11.300>a <00:07:11.659>news.

146
00:07:12.500 --> 00:07:15.300
<00:07:12.500>Now <00:07:12.966>Apache <00:07:13.433>a <00:07:13.900>notified

147
00:07:15.300 --> 00:07:18.300
<00:07:15.300>that <00:07:15.455>there <00:07:15.611>is <00:07:15.766>an <00:07:15.922>issue <00:07:16.077>in <00:07:16.233>struts. <00:07:16.388>They <00:07:16.544>released <00:07:16.700>a

148
00:07:18.300 --> 00:07:21.500
<00:07:18.300>fix <00:07:18.533>after <00:07:18.766>releasing <00:07:19.000>a <00:07:19.233>fix <00:07:19.466>there <00:07:19.700>was

149
00:07:21.500 --> 00:07:24.700
<00:07:21.500>exploit <00:07:21.700>available <00:07:21.900>on <00:07:22.100>the <00:07:22.300>exploit <00:07:22.500>DB <00:07:22.700>people <00:07:22.900>were

150
00:07:24.700 --> 00:07:27.600
<00:07:24.700>starting <00:07:24.979>to <00:07:25.260>exploit <00:07:25.539>started <00:07:25.820>checking <00:07:26.099>but

151
00:07:27.600 --> 00:07:28.900
<00:07:27.600>then <00:07:27.892>mean <00:07:28.185>while <00:07:28.477>what <00:07:28.770>happened

152
00:07:30.100 --> 00:07:33.100
<00:07:30.100>What <00:07:30.333>happened? <00:07:30.566>Was <00:07:30.800>that <00:07:31.033>Equifax <00:07:31.266>they <00:07:31.500>were

153
00:07:33.100 --> 00:07:35.900
<00:07:33.100>trying <00:07:33.240>while <00:07:33.380>they <00:07:33.520>were <00:07:33.660>trying <00:07:33.800>to <00:07:33.940>fix <00:07:34.080>it. <00:07:34.220>They <00:07:34.360>got <00:07:34.500>preached.

154
00:07:36.500 --> 00:07:39.100
<00:07:36.500>Now <00:07:36.700>this <00:07:36.900>tells <00:07:37.100>us <00:07:37.300>how <00:07:37.500>fast <00:07:37.700>you <00:07:37.900>can

155
00:07:39.100 --> 00:07:42.200
<00:07:39.100>detect <00:07:39.255>how <00:07:39.411>fast <00:07:39.566>you <00:07:39.722>can <00:07:39.877>respond <00:07:40.033>to <00:07:40.188>a <00:07:40.344>breach <00:07:40.500>and

156
00:07:42.200 --> 00:07:45.400
<00:07:42.200>how <00:07:42.375>you <00:07:42.550>can <00:07:42.724>do <00:07:42.900>it <00:07:43.075>at <00:07:43.250>scale <00:07:43.425>because <00:07:43.599>it's

157
00:07:45.400 --> 00:07:48.300
<00:07:45.400>not <00:07:45.575>just <00:07:45.750>one <00:07:45.924>app. <00:07:46.099>There <00:07:46.275>are <00:07:46.450>multiple <00:07:46.625>apps <00:07:46.799>which

158
00:07:48.300 --> 00:07:50.600
<00:07:48.300>might <00:07:48.500>be <00:07:48.700>using <00:07:48.900>the <00:07:49.100>same <00:07:49.300>feature <00:07:49.500>same <00:07:49.700>things.

159
00:07:52.400 --> 00:07:55.100
<00:07:52.400>And <00:07:52.599>then <00:07:52.799>come <00:07:53.000>software <00:07:53.200>supply <00:07:53.400>chain <00:07:53.599>risks. <00:07:53.799>Which

160
00:07:55.100 --> 00:07:58.800
<00:07:55.100>impact <00:07:55.300>everyone <00:07:55.500>now, <00:07:55.700>what <00:07:55.900>are <00:07:56.100>these <00:07:56.300>supply <00:07:56.500>chain

161
00:07:58.800 --> 00:08:01.100
<00:07:58.800>risks <00:07:59.080>software <00:07:59.360>is <00:07:59.640>actually <00:07:59.920>eating <00:08:00.200>the

162
00:08:01.100 --> 00:08:04.600
<00:08:01.100>whole <00:08:01.300>world <00:08:01.500>if <00:08:01.700>you <00:08:01.900>think <00:08:02.100>about <00:08:02.300>this <00:08:02.500>whole

163
00:08:04.600 --> 00:08:04.900
thing.

164
00:08:05.800 --> 00:08:09.000
<00:08:05.800>When <00:08:06.000>software <00:08:06.200>eats <00:08:06.400>the <00:08:06.600>whole <00:08:06.800>world <00:08:07.000>what <00:08:07.200>you

165
00:08:08.100 --> 00:08:10.500
<00:08:08.100>think <00:08:08.566>of <00:08:09.033>it <00:08:09.500>when?

166
00:08:11.700 --> 00:08:15.200
<00:08:11.700>Uber <00:08:11.840>do <00:08:11.979>Dash <00:08:12.120>when <00:08:12.260>more <00:08:12.400>all <00:08:12.539>of <00:08:12.680>the <00:08:12.820>people <00:08:12.960>they <00:08:13.099>are

167
00:08:15.200 --> 00:08:15.700
<00:08:15.200>all <00:08:15.650>virtual

168
00:08:16.700 --> 00:08:17.300
Uber

169
00:08:17.900 --> 00:08:20.500
<00:08:17.900>I'm <00:08:18.055>not <00:08:18.211>sure <00:08:18.366>if <00:08:18.522>they <00:08:18.677>have <00:08:18.833>an <00:08:18.988>office <00:08:19.144>now <00:08:19.299>they

170
00:08:20.500 --> 00:08:23.300
<00:08:20.500>at <00:08:20.655>least <00:08:20.811>when <00:08:20.966>they <00:08:21.122>started <00:08:21.277>off <00:08:21.433>they <00:08:21.588>just <00:08:21.744>started <00:08:21.900>off

171
00:08:23.300 --> 00:08:26.500
<00:08:23.300>renting <00:08:23.475>the <00:08:23.650>cabs <00:08:23.825>people <00:08:24.000>started <00:08:24.175>using <00:08:24.350>and <00:08:24.525>many <00:08:24.700>many

172
00:08:26.500 --> 00:08:29.600
<00:08:26.500>other <00:08:26.733>companies <00:08:26.966>are <00:08:27.200>doing <00:08:27.433>that <00:08:27.666>and <00:08:27.900>that's

173
00:08:29.600 --> 00:08:32.400
<00:08:29.600>our <00:08:29.833>Cloud <00:08:30.066>things. <00:08:30.300>And <00:08:30.533>that's <00:08:30.766>the <00:08:31.000>more

174
00:08:32.400 --> 00:08:35.800
<00:08:32.400>architecture <00:08:32.600>Modern <00:08:32.799>Life. <00:08:33.000>Now <00:08:33.199>when <00:08:33.400>that's <00:08:33.600>there <00:08:33.799>there's

175
00:08:35.800 --> 00:08:38.900
<00:08:35.799>a <00:08:35.939>whole <00:08:36.079>supply <00:08:36.219>chain <00:08:36.359>that <00:08:36.500>goes <00:08:36.640>here <00:08:36.780>in <00:08:36.919>the <00:08:37.059>earlier. <00:08:37.199>The

176
00:08:38.900 --> 00:08:41.300
<00:08:38.900>build <00:08:39.100>was <00:08:39.299>oh, <00:08:39.500>let's <00:08:39.699>build <00:08:39.900>a <00:08:40.100>server. <00:08:40.299>Let's

177
00:08:41.300 --> 00:08:44.500
<00:08:41.299>build <00:08:41.579>this <00:08:41.859>create <00:08:42.140>and <00:08:42.419>create <00:08:42.699>and

178
00:08:44.500 --> 00:08:47.100
<00:08:44.500>I <00:08:44.733>it <00:08:44.966>Ops <00:08:45.200>and <00:08:45.433>work <00:08:45.666>on <00:08:45.900>it

179
00:08:47.100 --> 00:08:51.200
<00:08:47.100>takes <00:08:47.240>one <00:08:47.380>year <00:08:47.520>to <00:08:47.660>develop <00:08:47.800>our <00:08:47.940>application. <00:08:48.080>But <00:08:48.220>now <00:08:48.360>that <00:08:48.500>has

180
00:08:50.200 --> 00:08:53.500
<00:08:50.200>changed. <00:08:50.433>Everything <00:08:50.666>is <00:08:50.900>a <00:08:51.133>child. <00:08:51.366>Everything <00:08:51.600>is

181
00:08:53.500 --> 00:08:56.200
<00:08:53.500>based <00:08:53.655>on <00:08:53.811>the <00:08:53.966>whole <00:08:54.122>cycle <00:08:54.277>how <00:08:54.433>fast <00:08:54.588>you <00:08:54.744>can <00:08:54.900>do

182
00:08:56.200 --> 00:08:56.300
it?

183
00:08:56.900 --> 00:08:59.700
<00:08:56.900>Earlier <00:08:57.366>after <00:08:57.833>a <00:08:58.300>release

184
00:08:59.700 --> 00:09:02.300
<00:08:59.700>of <00:08:59.875>three <00:09:00.050>months <00:09:00.225>six <00:09:00.400>months <00:09:00.575>one <00:09:00.750>year <00:09:00.925>used <00:09:01.100>to

185
00:09:02.300 --> 00:09:05.100
<00:09:02.300>go <00:09:02.474>for <00:09:02.650>party. <00:09:02.824>But <00:09:03.000>now <00:09:03.175>think <00:09:03.349>of <00:09:03.525>do <00:09:03.699>we

186
00:09:05.100 --> 00:09:08.500
<00:09:05.100>have <00:09:05.255>time <00:09:05.411>we <00:09:05.566>need <00:09:05.722>to <00:09:05.877>develop <00:09:06.033>a <00:09:06.188>feature <00:09:06.344>right <00:09:06.500>away.

187
00:09:08.500 --> 00:09:11.600
<00:09:08.500>We <00:09:08.655>need <00:09:08.811>to <00:09:08.966>develop <00:09:09.122>it <00:09:09.277>in <00:09:09.433>a <00:09:09.588>day <00:09:09.744>in <00:09:09.900>a

188
00:09:11.600 --> 00:09:11.800
week.

189
00:09:12.500 --> 00:09:13.200
<00:09:12.500>and <00:09:12.815>good <00:09:13.130>life

190
00:09:14.700 --> 00:09:16.200
<00:09:14.700>So <00:09:15.150>it's <00:09:15.600>lightning <00:09:16.050>fast.

191
00:09:16.700 --> 00:09:17.000
and

192
00:09:18.300 --> 00:09:21.900
<00:09:18.300>what <00:09:18.474>is <00:09:18.650>the <00:09:18.824>surface <00:09:19.000>supply <00:09:19.175>chain <00:09:19.349>basically, <00:09:19.525>so <00:09:19.699>think

193
00:09:21.900 --> 00:09:24.400
<00:09:21.900>of <00:09:22.133>manufacturing <00:09:22.366>supply <00:09:22.600>chain <00:09:22.833>or <00:09:23.066>food <00:09:23.300>supply

194
00:09:24.400 --> 00:09:27.200
<00:09:24.400>chain <00:09:24.600>where <00:09:24.800>there <00:09:25.000>are <00:09:25.199>raw <00:09:25.400>materials <00:09:25.600>it <00:09:25.800>goes

195
00:09:27.200 --> 00:09:30.000
<00:09:27.200>to <00:09:27.480>suppliers <00:09:27.760>then <00:09:28.040>employee <00:09:28.320>builds. <00:09:28.600>It

196
00:09:30.600 --> 00:09:33.800
<00:09:30.600>manufacturing <00:09:30.775>comes <00:09:30.950>into <00:09:31.125>picture <00:09:31.300>goes <00:09:31.475>to <00:09:31.650>what <00:09:31.825>Warehouse <00:09:32.000>goes

197
00:09:33.800 --> 00:09:36.900
<00:09:33.800>to <00:09:34.000>delivery <00:09:34.199>and <00:09:34.400>then <00:09:34.599>goes <00:09:34.800>further <00:09:35.000>now <00:09:35.199>everything

198
00:09:36.900 --> 00:09:39.700
<00:09:36.900>is <00:09:37.180>a <00:09:37.459>proper <00:09:37.740>supply <00:09:38.020>chain <00:09:38.300>how

199
00:09:39.700 --> 00:09:42.200
<00:09:39.700>much <00:09:39.900>who <00:09:40.100>needs <00:09:40.300>it <00:09:40.500>what <00:09:40.700>time <00:09:40.900>how <00:09:41.100>much

200
00:09:42.200 --> 00:09:45.000
<00:09:42.200>time <00:09:42.375>it <00:09:42.550>needs <00:09:42.725>to <00:09:42.900>be <00:09:43.075>developed <00:09:43.250>all <00:09:43.425>of <00:09:43.600>those

201
00:09:45.200 --> 00:09:48.400
<00:09:45.200>things <00:09:45.433>now <00:09:45.666>if <00:09:45.900>there <00:09:46.133>are <00:09:46.366>certain <00:09:46.600>issues

202
00:09:48.400 --> 00:09:49.200
<00:09:48.400>that <00:09:48.640>come <00:09:48.880>in <00:09:49.120>that

203
00:09:50.300 --> 00:09:53.600
<00:09:50.300>People <00:09:50.579>coded <00:09:50.859>people <00:09:51.140>create <00:09:51.420>certain <00:09:51.699>pipelines

204
00:09:53.600 --> 00:09:56.400
<00:09:53.600>there <00:09:53.833>are <00:09:54.066>storage <00:09:54.300>data <00:09:54.533>then <00:09:54.766>there <00:09:55.000>it

205
00:09:56.400 --> 00:09:57.200
<00:09:56.400>goes <00:09:56.760>to <00:09:57.120>Consumers.

206
00:09:57.800 --> 00:10:00.700
<00:09:57.800>Now <00:09:58.033>when <00:09:58.266>that <00:09:58.500>process <00:09:58.733>happens, <00:09:58.966>there <00:09:59.199>are

207
00:10:00.700 --> 00:10:02.800
<00:10:00.700>certain <00:10:00.900>bits <00:10:01.100>and <00:10:01.300>pieces <00:10:01.500>which <00:10:01.700>can <00:10:01.900>be <00:10:02.100>broken.

208
00:10:03.600 --> 00:10:05.300
<00:10:03.600>But <00:10:03.800>we've <00:10:04.000>seen <00:10:04.200>in <00:10:04.400>the <00:10:04.600>past <00:10:04.800>as <00:10:05.000>well.

209
00:10:06.100 --> 00:10:09.900
<00:10:06.100>A <00:10:06.255>why <00:10:06.411>do <00:10:06.566>we <00:10:06.722>focus <00:10:06.877>on <00:10:07.033>supply <00:10:07.188>chain <00:10:07.344>attacks? <00:10:07.500>Because

210
00:10:09.900 --> 00:10:12.500
<00:10:09.900>people <00:10:10.180>try <00:10:10.459>and <00:10:10.740>exploit <00:10:11.020>the <00:10:11.300>weakest

211
00:10:12.500 --> 00:10:15.500
<00:10:12.500>links <00:10:12.655>and <00:10:12.811>who <00:10:12.966>are <00:10:13.122>the <00:10:13.277>weakest <00:10:13.433>things. <00:10:13.588>We <00:10:13.744>that's <00:10:13.900>the

212
00:10:15.500 --> 00:10:16.800
<00:10:15.500>first <00:10:16.085>time <00:10:16.670>now,

213
00:10:18.600 --> 00:10:21.700
<00:10:18.600>When <00:10:18.833>the <00:10:19.066>attacker <00:10:19.300>attacks <00:10:19.533>the <00:10:19.766>whole <00:10:20.000>supply

214
00:10:21.700 --> 00:10:24.300
<00:10:21.700>chain, <00:10:21.933>they <00:10:22.166>try <00:10:22.400>and <00:10:22.633>Cascade <00:10:22.866>the <00:10:23.100>attack

215
00:10:24.300 --> 00:10:27.600
<00:10:24.300>and <00:10:24.533>infiltrate <00:10:24.766>as <00:10:25.000>many <00:10:25.233>information <00:10:25.466>as <00:10:25.699>much

216
00:10:27.600 --> 00:10:30.700
<00:10:27.600>as <00:10:27.775>information. <00:10:27.950>They <00:10:28.125>can <00:10:28.300>take <00:10:28.475>out <00:10:28.650>now <00:10:28.825>when <00:10:29.000>they

217
00:10:30.700 --> 00:10:35.100
<00:10:30.700>try <00:10:30.875>and <00:10:31.050>take <00:10:31.225>that <00:10:31.400>much <00:10:31.575>of <00:10:31.750>information. <00:10:31.925>What <00:10:32.100>can

218
00:10:34.100 --> 00:10:36.600
<00:10:34.100>they <00:10:34.450>do <00:10:34.800>with <00:10:35.150>that <00:10:35.500>information?

219
00:10:37.400 --> 00:10:40.600
<00:10:37.400>Then <00:10:37.633>comes <00:10:37.866>a <00:10:38.100>point <00:10:38.333>that <00:10:38.566>are <00:10:38.800>there

220
00:10:40.600 --> 00:10:43.300
<00:10:40.600>any <00:10:40.880>people <00:10:41.160>or <00:10:41.440>companies <00:10:41.720>who <00:10:42.000>are

221
00:10:43.300 --> 00:10:46.300
<00:10:43.300>talking <00:10:43.455>about <00:10:43.611>it? <00:10:43.766>So <00:10:43.922>think <00:10:44.077>of <00:10:44.233>the <00:10:44.388>research <00:10:44.544>forms <00:10:44.699>like

222
00:10:46.300 --> 00:10:49.700
<00:10:46.300>Gartner, <00:10:46.455>they're <00:10:46.611>very <00:10:46.766>well <00:10:46.922>known <00:10:47.077>in <00:10:47.233>the <00:10:47.388>research <00:10:47.544>the <00:10:47.699>keep

223
00:10:49.700 --> 00:10:52.900
<00:10:49.700>doing <00:10:49.933>University <00:10:50.166>researchers <00:10:50.400>around <00:10:50.633>different <00:10:50.866>aspects <00:10:51.100>now

224
00:10:52.900 --> 00:10:55.700
<00:10:52.900>while <00:10:53.133>supply <00:10:53.366>chain <00:10:53.600>comes <00:10:53.833>and <00:10:54.066>unlike <00:10:54.300>top

225
00:10:55.700 --> 00:10:58.300
<00:10:55.700>of <00:10:55.980>it <00:10:56.260>and <00:10:56.540>it's <00:10:56.820>being <00:10:57.100>part

226
00:10:58.300 --> 00:11:01.200
<00:10:58.300>of <00:10:58.579>every <00:10:58.859>organization <00:10:59.140>every <00:10:59.420>person's <00:10:59.699>life.

227
00:11:01.200 --> 00:11:04.800
<00:11:01.200>So <00:11:01.375>they <00:11:01.550>say <00:11:01.725>45% <00:11:01.900>of <00:11:02.075>the <00:11:02.250>organization <00:11:02.425>worldwide <00:11:02.600>will

228
00:11:04.800 --> 00:11:05.500
expect

229
00:11:06.500 --> 00:11:07.400
<00:11:06.500>or <00:11:07.310>experience

230
00:11:08.600 --> 00:11:09.600
<00:11:08.600>their <00:11:09.500>tax

231
00:11:10.500 --> 00:11:13.600
<00:11:10.500>think <00:11:10.675>of <00:11:10.850>45% <00:11:11.025>that's <00:11:11.200>a <00:11:11.375>huge <00:11:11.550>number <00:11:11.725>which <00:11:11.900>is

232
00:11:13.600 --> 00:11:16.600
<00:11:13.600>actually <00:11:13.950>increasing <00:11:14.300>and <00:11:14.650>day <00:11:15.000>by

233
00:11:16.600 --> 00:11:19.300
<00:11:16.600>day <00:11:16.880>increasing <00:11:17.160>whatever <00:11:17.440>forecast <00:11:17.720>we <00:11:18.000>have

234
00:11:19.300 --> 00:11:21.500
<00:11:19.300>done <00:11:19.500>in <00:11:19.699>the <00:11:19.900>past. <00:11:20.099>Those <00:11:20.300>things <00:11:20.500>are <00:11:20.699>changing.

235
00:11:22.200 --> 00:11:23.400
<00:11:22.200>The <00:11:22.560>error <00:11:22.920>is <00:11:23.280>changing.

236
00:11:24.400 --> 00:11:24.600
now

237
00:11:25.500 --> 00:11:28.400
<00:11:25.500>all <00:11:25.655>of <00:11:25.811>these <00:11:25.966>things <00:11:26.122>are <00:11:26.277>fine, <00:11:26.433>but <00:11:26.588>then <00:11:26.744>there <00:11:26.900>are

238
00:11:28.400 --> 00:11:31.300
<00:11:28.400>multiple <00:11:28.555>tools <00:11:28.711>which <00:11:28.866>are <00:11:29.022>part <00:11:29.177>of <00:11:29.333>it <00:11:29.488>and <00:11:29.644>because <00:11:29.800>of

239
00:11:31.300 --> 00:11:34.200
<00:11:31.300>which <00:11:31.439>there <00:11:31.579>are <00:11:31.719>issues <00:11:31.859>that <00:11:32.000>can <00:11:32.140>be <00:11:32.280>there. <00:11:32.420>Now <00:11:32.560>think <00:11:32.699>of

240
00:11:34.200 --> 00:11:37.300
<00:11:34.200>dependency <00:11:34.480>confusion, <00:11:34.760>which <00:11:35.040>is <00:11:35.320>becoming <00:11:35.600>a

241
00:11:37.300 --> 00:11:40.500
<00:11:37.300>big <00:11:37.474>big <00:11:37.650>issue <00:11:37.824>because <00:11:38.000>while <00:11:38.175>we <00:11:38.349>are <00:11:38.525>coding <00:11:38.699>certain

242
00:11:40.500 --> 00:11:43.300
<00:11:40.500>issues <00:11:40.733>stay <00:11:40.966>there, <00:11:41.200>for <00:11:41.433>example, <00:11:41.666>when <00:11:41.900>we

243
00:11:43.300 --> 00:11:47.200
<00:11:43.300>call <00:11:43.500>certain <00:11:43.699>features, <00:11:43.900>like <00:11:44.099>index <00:11:44.300>of <00:11:44.500>now <00:11:44.699>these

244
00:11:46.200 --> 00:11:49.300
<00:11:46.200>things <00:11:46.400>we <00:11:46.600>have <00:11:46.800>to <00:11:47.000>define <00:11:47.200>whether <00:11:47.400>we <00:11:47.600>are

245
00:11:49.300 --> 00:11:52.100
<00:11:49.300>calling <00:11:49.416>an <00:11:49.533>object. <00:11:49.650>We <00:11:49.766>are <00:11:49.883>calling <00:11:50.000>a <00:11:50.116>string <00:11:50.233>we <00:11:50.349>are <00:11:50.466>calling <00:11:50.583>an <00:11:50.699>array

246
00:11:52.100 --> 00:11:56.100
<00:11:52.100>if <00:11:52.240>you <00:11:52.380>don't <00:11:52.520>because <00:11:52.660>we <00:11:52.800>don't <00:11:52.940>have <00:11:53.080>the <00:11:53.220>right <00:11:53.360>validation <00:11:53.500>they

247
00:11:55.100 --> 00:11:58.400
<00:11:55.100>could <00:11:55.333>be <00:11:55.566>confusions <00:11:55.800>and <00:11:56.033>dependency <00:11:56.266>confusion <00:11:56.500>is

248
00:11:58.400 --> 00:12:01.600
<00:11:58.400>one <00:11:58.750>of <00:11:59.100>the <00:11:59.449>biggest <00:11:59.800>issues

249
00:12:01.600 --> 00:12:03.200
<00:12:01.600>these <00:12:01.950>days <00:12:02.300>all <00:12:02.650>prototype <00:12:03.000>pollution.

250
00:12:03.900 --> 00:12:06.100
<00:12:03.900>Then <00:12:04.366>comes <00:12:04.833>issues <00:12:05.300>in

251
00:12:06.100 --> 00:12:09.800
<00:12:06.100>the <00:12:06.380>containers <00:12:06.660>and <00:12:06.940>the <00:12:07.220>bells <00:12:07.500>think

252
00:12:09.800 --> 00:12:12.400
<00:12:09.800>of <00:12:10.033>solarwinds <00:12:10.266>attack <00:12:10.500>what <00:12:10.733>happened? <00:12:10.966>There <00:12:11.199>was

253
00:12:12.400 --> 00:12:15.600
<00:12:12.400>a <00:12:12.516>dependency <00:12:12.633>which <00:12:12.750>was <00:12:12.866>added <00:12:12.983>as <00:12:13.100>part <00:12:13.216>of <00:12:13.333>the <00:12:13.449>belt <00:12:13.566>that <00:12:13.683>got <00:12:13.800>shipped

254
00:12:15.600 --> 00:12:18.700
<00:12:15.600>to <00:12:15.833>everyone <00:12:16.066>and <00:12:16.300>people <00:12:16.533>started <00:12:16.766>getting <00:12:17.000>panicked

255
00:12:18.700 --> 00:12:21.600
<00:12:18.700>when <00:12:18.900>they <00:12:19.100>realized <00:12:19.300>there's <00:12:19.500>something <00:12:19.700>wrong <00:12:19.900>Microsoft <00:12:20.100>for

256
00:12:21.600 --> 00:12:24.400
<00:12:21.600>and <00:12:21.755>there <00:12:21.911>was <00:12:22.066>one <00:12:22.222>more <00:12:22.377>company, <00:12:22.533>which <00:12:22.688>was <00:12:22.844>actually <00:12:23.000>part

257
00:12:24.400 --> 00:12:27.600
<00:12:24.400>of <00:12:24.750>I <00:12:25.100>yeah <00:12:25.449>FireEye <00:12:25.800>they

258
00:12:27.600 --> 00:12:31.000
<00:12:27.600>actually <00:12:27.775>reported <00:12:27.950>it. <00:12:28.125>Now <00:12:28.300>on <00:12:28.475>top <00:12:28.650>of <00:12:28.825>it. <00:12:29.000>There

259
00:12:30.200 --> 00:12:34.100
<00:12:30.200>are <00:12:30.400>other <00:12:30.600>issues <00:12:30.800>in <00:12:31.000>storage <00:12:31.200>like <00:12:31.400>cold <00:12:31.600>they

260
00:12:33.100 --> 00:12:36.600
<00:12:33.100>started <00:12:33.300>coming <00:12:33.500>in <00:12:33.700>and <00:12:33.900>it <00:12:34.100>whom <00:12:34.300>it <00:12:34.500>impacted.

261
00:12:36.600 --> 00:12:39.700
<00:12:36.600>The <00:12:36.800>whole <00:12:37.000>thing <00:12:37.200>is <00:12:37.400>not <00:12:37.600>just <00:12:37.800>impacting <00:12:38.000>the

262
00:12:39.700 --> 00:12:43.200
<00:12:39.700>tooling <00:12:39.933>the <00:12:40.166>code <00:12:40.400>build <00:12:40.633>the <00:12:40.866>organization, <00:12:41.100>but

263
00:12:42.200 --> 00:12:45.600
<00:12:42.200>they <00:12:42.480>are <00:12:42.760>impacting <00:12:43.040>they're <00:12:43.320>targeted <00:12:43.600>towards

264
00:12:45.600 --> 00:12:48.200
<00:12:45.600>consumers <00:12:45.833>the <00:12:46.066>end <00:12:46.300>goal <00:12:46.533>is <00:12:46.766>to <00:12:47.000>get

265
00:12:48.200 --> 00:12:49.300
<00:12:48.200>the <00:12:48.447>data <00:12:48.695>of <00:12:48.942>the <00:12:49.189>consumer.

266
00:12:50.800 --> 00:12:52.800
<00:12:50.800>Text <00:12:51.033>that <00:12:51.266>information <00:12:51.500>and <00:12:51.733>leverage <00:12:51.966>that <00:12:52.199>information.

267
00:12:54.700 --> 00:12:57.500
<00:12:54.700>It's <00:12:55.050>complex, <00:12:55.400>but <00:12:55.750>we <00:12:56.100>it

268
00:12:57.500 --> 00:13:00.200
<00:12:57.500>is <00:12:57.675>not <00:12:57.850>impossible. <00:12:58.025>We <00:12:58.200>all <00:12:58.375>can <00:12:58.550>work <00:12:58.725>towards <00:12:58.900>it.

269
00:13:00.200 --> 00:13:04.100
<00:13:00.200>We <00:13:00.433>can <00:13:00.666>apply <00:13:00.900>implicit <00:13:01.133>trust <00:13:01.366>and <00:13:01.600>at

270
00:13:03.100 --> 00:13:04.600
<00:13:03.100>the <00:13:03.775>same <00:13:04.450>time.

271
00:13:05.700 --> 00:13:08.900
<00:13:05.700>We <00:13:05.840>need <00:13:05.980>to <00:13:06.120>make <00:13:06.260>sure <00:13:06.400>we <00:13:06.540>don't <00:13:06.680>rely <00:13:06.820>on <00:13:06.960>that <00:13:07.100>implicit

272
00:13:08.900 --> 00:13:11.500
<00:13:08.900>trust. <00:13:09.100>That's <00:13:09.300>why <00:13:09.500>we <00:13:09.699>talk <00:13:09.900>about <00:13:10.100>zero <00:13:10.300>trust

273
00:13:11.500 --> 00:13:13.400
<00:13:11.500>never <00:13:11.966>ever <00:13:12.433>trust <00:13:12.900>anyone.

274
00:13:14.400 --> 00:13:16.400
<00:13:14.400>have <00:13:14.750>the <00:13:15.100>boundaries <00:13:15.449>rightly <00:13:15.800>said

275
00:13:17.600 --> 00:13:20.700
<00:13:17.600>the <00:13:17.800>access <00:13:18.000>has <00:13:18.200>to <00:13:18.400>be <00:13:18.600>properly <00:13:18.800>built <00:13:19.000>and

276
00:13:20.700 --> 00:13:21.500
<00:13:20.700>on <00:13:20.940>top <00:13:21.180>of <00:13:21.420>it.

277
00:13:22.700 --> 00:13:25.400
<00:13:22.700>Make <00:13:22.980>sure <00:13:23.260>that <00:13:23.540>the <00:13:23.820>weakest <00:13:24.100>link

278
00:13:25.400 --> 00:13:28.600
<00:13:25.400>also <00:13:25.680>is <00:13:25.959>being <00:13:26.240>validated <00:13:26.520>whosoever. <00:13:26.800>That

279
00:13:28.600 --> 00:13:31.500
<00:13:28.600>person <00:13:28.800>is <00:13:29.000>whosoever. <00:13:29.200>That <00:13:29.400>tooling <00:13:29.600>is <00:13:29.800>everything <00:13:30.000>has

280
00:13:31.500 --> 00:13:32.500
<00:13:31.500>to <00:13:31.950>be <00:13:32.400>validated.

281
00:13:33.200 --> 00:13:36.500
<00:13:33.200>If <00:13:33.400>I <00:13:33.600>talk <00:13:33.800>about <00:13:34.000>those <00:13:34.200>examples <00:13:34.400>series <00:13:34.600>developer

282
00:13:36.500 --> 00:13:40.700
<00:13:36.500>IDs, <00:13:36.700>this <00:13:36.900>is <00:13:37.100>another <00:13:37.300>example <00:13:37.500>of <00:13:37.700>2021 <00:13:37.900>and

283
00:13:40.700 --> 00:13:43.100
<00:13:40.700>then <00:13:40.875>we <00:13:41.050>had <00:13:41.225>my <00:13:41.400>visual <00:13:41.575>studio <00:13:41.750>code <00:13:41.925>as <00:13:42.100>well.

284
00:13:43.100 --> 00:13:46.600
<00:13:43.100>And <00:13:43.255>on <00:13:43.411>top <00:13:43.566>of <00:13:43.722>it <00:13:43.877>the <00:13:44.033>pipeline <00:13:44.188>and <00:13:44.344>CI <00:13:44.500>issues

285
00:13:46.600 --> 00:13:48.700
<00:13:46.600>in <00:13:46.800>court <00:13:47.000>go <00:13:47.200>that <00:13:47.400>was <00:13:47.600>a <00:13:47.800>big <00:13:48.000>issue.

286
00:13:49.700 --> 00:13:52.800
<00:13:49.700>On <00:13:50.050>then <00:13:50.400>some <00:13:50.750>soluents <00:13:51.100>solar

287
00:13:52.800 --> 00:13:55.200
<00:13:52.800>winds <00:13:53.000>actually <00:13:53.199>brought <00:13:53.400>us <00:13:53.599>to <00:13:53.800>a <00:13:54.000>point <00:13:54.199>that

288
00:13:55.200 --> 00:13:58.200
<00:13:55.200>Supply <00:13:55.375>chains <00:13:55.550>are <00:13:55.725>real <00:13:55.900>supply <00:13:56.075>chain <00:13:56.250>attacks <00:13:56.425>are <00:13:56.600>real

289
00:13:58.200 --> 00:14:01.600
<00:13:58.200>but <00:13:58.433>is <00:13:58.666>it's <00:13:58.900>actually <00:13:59.133>new. <00:13:59.366>No, <00:13:59.600>it's

290
00:14:01.600 --> 00:14:04.500
<00:14:01.600>been <00:14:01.740>there <00:14:01.880>for <00:14:02.020>a <00:14:02.160>very <00:14:02.300>very <00:14:02.440>long <00:14:02.580>time. <00:14:02.720>These <00:14:02.860>attacks <00:14:03.000>are

291
00:14:04.500 --> 00:14:07.500
<00:14:04.500>not <00:14:04.733>new <00:14:04.966>even <00:14:05.200>after <00:14:05.433>solarwinds <00:14:05.666>many <00:14:05.900>attacks

292
00:14:07.500 --> 00:14:08.000
<00:14:07.500>have <00:14:07.950>happened.

293
00:14:08.800 --> 00:14:11.600
<00:14:08.800>Like <00:14:09.150>the <00:14:09.500>whole <00:14:09.849>ecosystem <00:14:10.199>has

294
00:14:11.600 --> 00:14:14.200
<00:14:11.600>been <00:14:11.833>tampered <00:14:12.066>in <00:14:12.300>Canada <00:14:12.533>for <00:14:12.766>a <00:14:13.000>food

295
00:14:14.200 --> 00:14:14.500
chain.

296
00:14:15.400 --> 00:14:15.800
now

297
00:14:16.600 --> 00:14:19.300
<00:14:16.600>even <00:14:16.740>though <00:14:16.880>we <00:14:17.020>know <00:14:17.160>about <00:14:17.300>that, <00:14:17.440>but <00:14:17.580>what <00:14:17.720>are <00:14:17.860>we <00:14:18.000>doing

298
00:14:19.300 --> 00:14:22.200
<00:14:19.300>about <00:14:19.500>it? <00:14:19.699>So <00:14:19.900>there <00:14:20.099>are <00:14:20.300>more <00:14:20.500>scrutiny <00:14:20.699>and

299
00:14:22.200 --> 00:14:26.100
<00:14:22.200>visibility <00:14:22.355>that <00:14:22.511>is <00:14:22.666>being <00:14:22.822>done. <00:14:22.977>Now <00:14:23.133>even <00:14:23.288>White <00:14:23.444>House <00:14:23.600>President

300
00:14:25.100 --> 00:14:27.200
<00:14:25.100>Joe <00:14:25.566>by <00:14:26.033>then <00:14:26.500>and

301
00:14:28.500 --> 00:14:32.200
<00:14:28.500>vice <00:14:28.850>president <00:14:29.200>Harris <00:14:29.550>Administration, <00:14:29.900>they

302
00:14:31.200 --> 00:14:34.300
<00:14:31.200>came <00:14:31.433>up <00:14:31.666>with <00:14:31.900>certain <00:14:32.133>recommendations <00:14:32.366>and <00:14:32.600>the

303
00:14:34.300 --> 00:14:37.200
<00:14:34.300>emphasized <00:14:34.579>on <00:14:34.859>Surface <00:14:35.140>security <00:14:35.420>as <00:14:35.699>well.

304
00:14:37.200 --> 00:14:40.400
<00:14:37.200>That's <00:14:37.355>why <00:14:37.511>it <00:14:37.666>is <00:14:37.822>important <00:14:37.977>that <00:14:38.133>we <00:14:38.288>understand <00:14:38.444>the <00:14:38.600>risk

305
00:14:40.400 --> 00:14:43.800
<00:14:40.400>areas <00:14:40.633>within <00:14:40.866>the <00:14:41.100>supply <00:14:41.333>chain <00:14:41.566>wherein <00:14:41.800>we

306
00:14:43.800 --> 00:14:47.000
<00:14:43.800>understand <00:14:44.079>what <00:14:44.359>is <00:14:44.640>the <00:14:44.920>problem <00:14:45.199>where

307
00:14:46.500 --> 00:14:49.500
<00:14:46.500>exactly <00:14:46.733>it <00:14:46.966>can <00:14:47.200>impact <00:14:47.433>the <00:14:47.666>libraries <00:14:47.900>containers

308
00:14:49.500 --> 00:14:52.200
<00:14:49.500>code <00:14:49.700>build <00:14:49.900>CI <00:14:50.100>because <00:14:50.300>it <00:14:50.500>is <00:14:50.700>going <00:14:50.900>to

309
00:14:52.200 --> 00:14:54.800
<00:14:52.200>impact <00:14:52.400>consumers <00:14:52.600>in <00:14:52.800>the <00:14:53.000>end. <00:14:53.200>Whatever <00:14:53.400>we <00:14:53.600>say.

310
00:14:55.400 --> 00:14:58.300
<00:14:55.400>And <00:14:55.633>we <00:14:55.866>need <00:14:56.100>to <00:14:56.333>understand <00:14:56.566>there <00:14:56.800>are

311
00:14:58.300 --> 00:14:59.300
<00:14:58.300>no <00:14:58.750>inherent <00:14:59.199>risks.

312
00:14:59.800 --> 00:15:03.100
<00:14:59.800>Compromises <00:15:00.033>don't <00:15:00.266>happen <00:15:00.500>because <00:15:00.733>of <00:15:00.966>dependencies. <00:15:01.199>We're

313
00:15:02.100 --> 00:15:05.500
<00:15:02.100>testing <00:15:02.300>our <00:15:02.500>dependencies. <00:15:02.700>We're <00:15:02.900>checking <00:15:03.100>we <00:15:03.300>are <00:15:03.500>maintaining

314
00:15:05.500 --> 00:15:08.500
<00:15:05.500>it <00:15:05.780>and <00:15:06.060>if <00:15:06.340>something <00:15:06.620>happens <00:15:06.900>to

315
00:15:08.500 --> 00:15:12.900
<00:15:08.500>a <00:15:08.627>pipeline, <00:15:08.754>we <00:15:08.881>have <00:15:09.009>a <00:15:09.136>parallel <00:15:09.263>pipeline <00:15:09.390>which <00:15:09.518>we <00:15:09.645>can <00:15:09.772>use <00:15:09.900>that

316
00:15:12.900 --> 00:15:13.400
time.

317
00:15:14.400 --> 00:15:15.900
<00:15:14.400>Now <00:15:14.737>it <00:15:15.074>doesn't <00:15:15.412>stop <00:15:15.750>there.

318
00:15:17.300 --> 00:15:20.300
<00:15:17.300>If <00:15:17.455>I <00:15:17.611>compromise <00:15:17.766>one <00:15:17.922>of <00:15:18.077>the <00:15:18.233>dependencies <00:15:18.388>if <00:15:18.544>I <00:15:18.699>start

319
00:15:20.300 --> 00:15:23.200
<00:15:20.300>by <00:15:20.533>passing <00:15:20.766>the <00:15:21.000>supply <00:15:21.233>chain <00:15:21.466>measures <00:15:21.699>which

320
00:15:23.200 --> 00:15:23.600
<00:15:23.200>are <00:15:23.560>there?

321
00:15:24.400 --> 00:15:27.200
<00:15:24.400>How <00:15:24.527>cool <00:15:24.654>that <00:15:24.781>would <00:15:24.909>be <00:15:25.036>so <00:15:25.163>what <00:15:25.290>can <00:15:25.418>we <00:15:25.545>do <00:15:25.672>start <00:15:25.800>with

322
00:15:27.200 --> 00:15:31.200
<00:15:27.200>the <00:15:27.375>foundation <00:15:27.550>have <00:15:27.725>visibility <00:15:27.900>on <00:15:28.075>the <00:15:28.250>environment <00:15:28.425>understand <00:15:28.600>where

323
00:15:30.200 --> 00:15:33.600
<00:15:30.200>the <00:15:30.400>Frameworks <00:15:30.600>which <00:15:30.800>are <00:15:31.000>there? <00:15:31.200>We <00:15:31.400>have <00:15:31.600>many

324
00:15:33.600 --> 00:15:36.400
<00:15:33.600>and <00:15:33.833>Frameworks <00:15:34.066>which <00:15:34.300>are <00:15:34.533>there. <00:15:34.766>We <00:15:35.000>need

325
00:15:36.400 --> 00:15:39.300
<00:15:36.400>to <00:15:36.574>start <00:15:36.750>with <00:15:36.925>the <00:15:37.100>basic <00:15:37.275>things <00:15:37.449>very <00:15:37.625>very <00:15:37.800>important

326
00:15:39.300 --> 00:15:42.800
<00:15:39.300>to <00:15:39.455>have <00:15:39.611>these <00:15:39.766>Basics <00:15:39.922>and <00:15:40.077>it <00:15:40.233>doesn't <00:15:40.388>stop <00:15:40.544>there. <00:15:40.699>There

327
00:15:42.800 --> 00:15:45.500
<00:15:42.800>are <00:15:43.150>many <00:15:43.500>other <00:15:43.849>foundations <00:15:44.199>like

328
00:15:45.500 --> 00:15:50.100
<00:15:45.500>Linux <00:15:45.733>Foundation <00:15:45.966>which <00:15:46.200>talks <00:15:46.433>about <00:15:46.666>or <00:15:46.900>cncf

329
00:15:49.100 --> 00:15:52.500
<00:15:49.100>Foundation, <00:15:49.275>which <00:15:49.450>is <00:15:49.625>part <00:15:49.800>of <00:15:49.975>Linux <00:15:50.150>Foundation <00:15:50.325>all <00:15:50.500>of

330
00:15:52.500 --> 00:15:52.900
<00:15:52.500>these <00:15:52.860>things.

331
00:15:54.500 --> 00:15:57.400
<00:15:54.500>Between <00:15:54.675>Linux <00:15:54.850>Foundation <00:15:55.025>be <00:15:55.200>Cloud <00:15:55.375>native <00:15:55.550>Foundation <00:15:55.725>read <00:15:55.900>open

332
00:15:57.400 --> 00:16:00.500
<00:15:57.400>ssf. <00:15:57.574>Sorry. <00:15:57.750>I <00:15:57.925>just <00:15:58.100>mentioned <00:15:58.275>Cloud <00:15:58.449>native <00:15:58.625>Foundation <00:15:58.800>as

333
00:16:00.500 --> 00:16:03.300
<00:16:00.500>part <00:16:00.655>of <00:16:00.811>Linux, <00:16:00.966>but <00:16:01.122>open <00:16:01.277>ssf <00:16:01.433>foundation, <00:16:01.588>which <00:16:01.744>is <00:16:01.900>new

334
00:16:03.300 --> 00:16:06.500
<00:16:03.300>which <00:16:03.500>is <00:16:03.699>actually <00:16:03.900>catering <00:16:04.099>towards <00:16:04.300>open <00:16:04.500>source, <00:16:04.699>and

335
00:16:06.500 --> 00:16:09.800
<00:16:06.500>then <00:16:06.675>there <00:16:06.850>are <00:16:07.025>software <00:16:07.200>but <00:16:07.375>bill <00:16:07.550>of <00:16:07.725>materials <00:16:07.900>which

336
00:16:09.800 --> 00:16:12.400
<00:16:09.800>are <00:16:10.079>available <00:16:10.359>by <00:16:10.640>Linux <00:16:10.920>Foundation <00:16:11.199>by

337
00:16:12.400 --> 00:16:15.200
<00:16:12.400>over <00:16:12.633>us <00:16:12.866>and <00:16:13.100>many <00:16:13.333>many <00:16:13.566>other <00:16:13.800>places

338
00:16:15.200 --> 00:16:18.300
<00:16:15.200>where <00:16:15.375>there <00:16:15.550>are <00:16:15.725>best <00:16:15.900>practices, <00:16:16.075>which <00:16:16.250>we <00:16:16.425>can <00:16:16.600>Leverage.

339
00:16:19.100 --> 00:16:22.600
<00:16:19.100>And <00:16:19.300>let's <00:16:19.500>secure <00:16:19.700>our <00:16:19.900>good <00:16:20.100>containers <00:16:20.300>as <00:16:20.500>bombs

340
00:16:22.600 --> 00:16:25.400
<00:16:22.600>infrastructure <00:16:22.727>as <00:16:22.854>a <00:16:22.981>code, <00:16:23.109>all <00:16:23.236>of <00:16:23.363>these <00:16:23.490>things <00:16:23.618>are <00:16:23.745>very <00:16:23.872>very <00:16:24.000>important.

341
00:16:26.300 --> 00:16:29.800
<00:16:26.300>We <00:16:26.455>need <00:16:26.611>to <00:16:26.766>secure <00:16:26.922>our <00:16:27.077>pipelines <00:16:27.233>build <00:16:27.388>up <00:16:27.544>pipelines <00:16:27.699>have

342
00:16:29.800 --> 00:16:32.400
<00:16:29.800>a <00:16:30.079>right <00:16:30.359>set <00:16:30.640>of <00:16:30.920>source <00:16:31.199>code

343
00:16:32.400 --> 00:16:35.800
<00:16:32.400>management <00:16:32.600>because <00:16:32.800>I <00:16:33.000>have <00:16:33.199>seen <00:16:33.400>cases <00:16:33.600>wherein <00:16:33.800>there

344
00:16:35.800 --> 00:16:38.700
<00:16:35.800>are <00:16:35.955>so <00:16:36.111>Squad <00:16:36.266>management <00:16:36.422>totals <00:16:36.577>which <00:16:36.733>are <00:16:36.888>there <00:16:37.044>tools <00:16:37.199>which

345
00:16:38.700 --> 00:16:41.700
<00:16:38.700>are <00:16:38.875>there <00:16:39.050>but <00:16:39.225>then <00:16:39.400>what <00:16:39.575>happens <00:16:39.750>they <00:16:39.925>get <00:16:40.100>reached?

346
00:16:42.500 --> 00:16:45.700
<00:16:42.500>because <00:16:42.655>the <00:16:42.811>right <00:16:42.966>keys <00:16:43.122>are <00:16:43.277>not <00:16:43.433>there <00:16:43.588>the <00:16:43.744>third <00:16:43.900>particles

347
00:16:45.700 --> 00:16:46.200
<00:16:45.700>and <00:16:46.150>use

348
00:16:47.400 --> 00:16:50.700
<00:16:47.400>They <00:16:47.555>have <00:16:47.711>issues. <00:16:47.866>We <00:16:48.022>don't <00:16:48.177>manage <00:16:48.333>our <00:16:48.488>secret <00:16:48.644>and <00:16:48.800>credentials.

349
00:16:50.700 --> 00:16:53.600
<00:16:50.700>There <00:16:50.875>are <00:16:51.050>many <00:16:51.225>other <00:16:51.400>issues <00:16:51.575>which <00:16:51.750>are <00:16:51.925>there. <00:16:52.100>We

350
00:16:53.600 --> 00:16:56.300
<00:16:53.600>have <00:16:53.800>to <00:16:54.000>empower <00:16:54.200>our <00:16:54.400>developers. <00:16:54.600>We <00:16:54.800>have <00:16:55.000>to

351
00:16:56.300 --> 00:17:00.000
<00:16:56.300>our <00:16:56.533>Empower <00:16:56.766>our <00:16:57.000>security <00:16:57.233>team. <00:16:57.466>Now. <00:16:57.699>Are

352
00:16:59.200 --> 00:17:01.900
<00:16:59.200>we <00:16:59.340>going <00:16:59.480>to <00:16:59.620>have <00:16:59.760>less <00:16:59.900>or <00:17:00.040>more <00:17:00.180>software <00:17:00.320>in <00:17:00.460>the <00:17:00.600>future?

353
00:17:02.900 --> 00:17:05.500
<00:17:02.900>More <00:17:03.133>open <00:17:03.366>source <00:17:03.600>or <00:17:03.833>less <00:17:04.066>open <00:17:04.300>source.

354
00:17:06.900 --> 00:17:09.300
<00:17:06.900>When <00:17:07.100>we <00:17:07.300>are <00:17:07.500>thinking <00:17:07.700>of <00:17:07.900>it <00:17:08.100>lock <00:17:08.300>for

355
00:17:09.300 --> 00:17:09.800
Jacobs.

356
00:17:10.300 --> 00:17:13.300
<00:17:10.300>Dr. <00:17:10.440>Is <00:17:10.579>nothing <00:17:10.720>but <00:17:10.859>if <00:17:11.000>you <00:17:11.139>know <00:17:11.280>about <00:17:11.419>it, <00:17:11.560>it's <00:17:11.700>very

357
00:17:13.300 --> 00:17:16.600
<00:17:13.300>popular <00:17:13.500>Apache <00:17:13.700>logging <00:17:13.899>framework <00:17:14.099>written <00:17:14.300>Java <00:17:14.500>and <00:17:14.700>it

358
00:17:16.600 --> 00:17:19.600
<00:17:16.599>also <00:17:16.833>supports <00:17:17.066>in <00:17:17.300>New <00:17:17.533>Jersey <00:17:17.766>ecosystem <00:17:18.000>now.

359
00:17:20.600 --> 00:17:21.900
<00:17:20.599>It <00:17:20.892>is <00:17:21.185>impacting <00:17:21.477>a <00:17:21.770>huge.

360
00:17:22.500 --> 00:17:26.100
<00:17:22.500>Organized <00:17:22.849>it <00:17:23.200>ecosystem <00:17:23.550>or <00:17:23.900>organizations

361
00:17:25.100 --> 00:17:28.200
<00:17:25.099>because <00:17:25.449>when <00:17:25.800>that <00:17:26.149>came <00:17:26.500>out

362
00:17:28.200 --> 00:17:29.400
<00:17:28.200>everyone <00:17:28.740>went <00:17:29.280>crazy.

363
00:17:30.100 --> 00:17:33.300
<00:17:30.100>Oh, <00:17:30.227>I'm <00:17:30.354>impacted <00:17:30.481>or <00:17:30.609>not. <00:17:30.736>I <00:17:30.863>don't <00:17:30.990>know <00:17:31.118>if <00:17:31.245>I'm <00:17:31.372>backed <00:17:31.500>or

364
00:17:33.300 --> 00:17:36.300
<00:17:33.300>not. <00:17:33.455>It <00:17:33.611>became <00:17:33.766>highly <00:17:33.922>critical <00:17:34.077>the <00:17:34.233>way <00:17:34.388>we <00:17:34.544>were <00:17:34.700>doing

365
00:17:36.300 --> 00:17:38.500
<00:17:36.300>it <00:17:36.533>with <00:17:36.766>Apache <00:17:37.000>when <00:17:37.233>Equifax <00:17:37.466>got <00:17:37.700>preached.

366
00:17:39.200 --> 00:17:42.600
<00:17:39.200>Now <00:17:39.400>these <00:17:39.600>things <00:17:39.800>are <00:17:40.000>cascading <00:17:40.200>like <00:17:40.400>telling <00:17:40.600>us

367
00:17:42.600 --> 00:17:45.700
<00:17:42.600>that <00:17:42.833>these <00:17:43.066>issues <00:17:43.300>still <00:17:43.533>exist. <00:17:43.766>You <00:17:44.000>have

368
00:17:45.700 --> 00:17:48.300
<00:17:45.700>to <00:17:45.980>talk <00:17:46.260>about <00:17:46.540>it. <00:17:46.820>It's <00:17:47.100>been

369
00:17:48.300 --> 00:17:50.900
<00:17:48.300>four <00:17:48.475>years, <00:17:48.649>but <00:17:48.825>you're <00:17:49.000>still <00:17:49.175>seeing <00:17:49.350>the <00:17:49.524>same <00:17:49.700>issues.

370
00:17:51.600 --> 00:17:54.000
<00:17:51.600>You <00:17:51.800>still <00:17:52.000>seeing <00:17:52.199>it <00:17:52.399>because <00:17:52.600>we <00:17:52.800>are <00:17:53.000>thinking

371
00:17:54.200 --> 00:17:57.300
<00:17:54.200>it <00:17:54.400>as <00:17:54.600>a <00:17:54.800>Regulatory <00:17:55.000>Compliance <00:17:55.200>failure, <00:17:55.400>but <00:17:55.600>sometimes

372
00:17:57.300 --> 00:17:59.300
<00:17:57.300>we'll <00:17:57.500>have <00:17:57.700>to <00:17:57.899>do <00:17:58.100>more <00:17:58.300>than <00:17:58.500>that. <00:17:58.700>Just

373
00:18:00.100 --> 00:18:03.600
<00:18:00.100>Then <00:18:00.300>comes <00:18:00.500>Cloud <00:18:00.699>security <00:18:00.899>controls <00:18:01.100>then <00:18:01.300>comes <00:18:01.500>third

374
00:18:03.600 --> 00:18:06.400
<00:18:03.600>party <00:18:03.800>size <00:18:04.000>issues <00:18:04.199>remote <00:18:04.399>code <00:18:04.600>execution <00:18:04.800>now <00:18:05.000>with

375
00:18:06.400 --> 00:18:09.200
<00:18:06.400>the <00:18:06.555>remote <00:18:06.711>for <00:18:06.866>execution. <00:18:07.022>There <00:18:07.177>are <00:18:07.333>funny <00:18:07.488>things. <00:18:07.644>For <00:18:07.800>example

376
00:18:10.600 --> 00:18:13.400
<00:18:10.600>With <00:18:10.833>remote <00:18:11.066>code <00:18:11.300>execution <00:18:11.533>in <00:18:11.766>a <00:18:12.000>vast

377
00:18:13.400 --> 00:18:16.400
<00:18:13.400>top <00:18:13.575>10 <00:18:13.750>because <00:18:13.925>it's <00:18:14.100>a <00:18:14.275>security <00:18:14.450>top <00:18:14.625>10 <00:18:14.800>risk

378
00:18:16.400 --> 00:18:19.800
<00:18:16.400>list. <00:18:16.750>So <00:18:17.100>it <00:18:17.450>injection <00:18:17.800>came

379
00:18:19.800 --> 00:18:22.100
<00:18:19.800>down <00:18:20.000>from <00:18:20.200>first <00:18:20.399>to <00:18:20.600>third <00:18:20.800>it <00:18:21.000>came <00:18:21.200>down

380
00:18:22.100 --> 00:18:25.400
<00:18:22.100>and <00:18:22.240>suddenly <00:18:22.379>we <00:18:22.520>start <00:18:22.659>seeing <00:18:22.800>these <00:18:22.939>remote <00:18:23.080>code <00:18:23.219>execution <00:18:23.360>and <00:18:23.500>it

381
00:18:25.400 --> 00:18:28.200
<00:18:25.400>reminded <00:18:25.575>us <00:18:25.750>no <00:18:25.925>injection <00:18:26.100>has <00:18:26.275>to <00:18:26.450>be <00:18:26.625>taken <00:18:26.800>as

382
00:18:28.200 --> 00:18:31.400
<00:18:28.200>the <00:18:28.340>first <00:18:28.480>one <00:18:28.620>because <00:18:28.760>if <00:18:28.900>we <00:18:29.040>don't <00:18:29.180>consider <00:18:29.320>it <00:18:29.460>anyone <00:18:29.600>can

383
00:18:31.400 --> 00:18:34.200
<00:18:31.400>deploy <00:18:31.680>malware <00:18:31.960>ransomware <00:18:32.240>system, <00:18:32.520>we <00:18:32.800>can

384
00:18:34.200 --> 00:18:37.600
<00:18:34.200>take <00:18:34.375>over <00:18:34.550>the <00:18:34.725>servers <00:18:34.900>exfiltrate <00:18:35.075>the <00:18:35.250>data <00:18:35.425>there <00:18:35.600>are

385
00:18:37.600 --> 00:18:41.000
<00:18:37.600>issues <00:18:37.833>with <00:18:38.066>the <00:18:38.300>Integrity <00:18:38.533>availability. <00:18:38.766>We <00:18:39.000>can

386
00:18:40.200 --> 00:18:43.800
<00:18:40.200>actually <00:18:40.433>disable <00:18:40.666>the <00:18:40.900>security <00:18:41.133>services. <00:18:41.366>Oh <00:18:41.600>how

387
00:18:43.800 --> 00:18:46.400
<00:18:43.800>cool <00:18:43.927>that <00:18:44.054>would <00:18:44.181>be. <00:18:44.309>I <00:18:44.436>would <00:18:44.563>love <00:18:44.690>it <00:18:44.818>as <00:18:44.945>a <00:18:45.072>security <00:18:45.200>person

388
00:18:46.400 --> 00:18:49.600
<00:18:46.400>or <00:18:46.540>if <00:18:46.680>I'm <00:18:46.820>a <00:18:46.960>attacker. <00:18:47.100>I <00:18:47.240>would <00:18:47.380>love <00:18:47.520>that <00:18:47.660>but <00:18:47.800>think

389
00:18:49.600 --> 00:18:50.300
<00:18:49.600>of <00:18:49.915>these <00:18:50.230>things

390
00:18:51.800 --> 00:18:54.400
<00:18:51.800>Below <00:18:51.940>for <00:18:52.080>Jay <00:18:52.220>is <00:18:52.360>a <00:18:52.500>very <00:18:52.639>popular. <00:18:52.780>That's <00:18:52.919>why <00:18:53.060>it <00:18:53.200>is

391
00:18:54.400 --> 00:18:57.200
<00:18:54.400>an <00:18:54.555>issue <00:18:54.711>or <00:18:54.866>what <00:18:55.022>it <00:18:55.177>is. <00:18:55.333>Now. <00:18:55.488>There <00:18:55.644>are <00:18:55.800>other

392
00:18:57.200 --> 00:19:00.800
<00:18:57.200>dependencies <00:18:57.480>which <00:18:57.760>require <00:18:58.040>attention <00:18:58.320>what <00:18:58.600>are

393
00:19:00.800 --> 00:19:03.300
<00:19:00.800>the <00:19:00.975>issues <00:19:01.149>which <00:19:01.325>are <00:19:01.500>there <00:19:01.675>how <00:19:01.850>exactly <00:19:02.024>we <00:19:02.200>can

394
00:19:03.300 --> 00:19:03.700
<00:19:03.300>detect <00:19:03.660>it?

395
00:19:04.600 --> 00:19:07.800
<00:19:04.600>Oh <00:19:04.879>strange <00:19:05.159>now <00:19:05.439>we <00:19:05.719>haven't <00:19:06.000>demo

396
00:19:07.800 --> 00:19:10.500
<00:19:07.800>let's <00:19:07.955>go <00:19:08.111>ahead <00:19:08.266>and <00:19:08.422>do <00:19:08.577>it. <00:19:08.733>Now. <00:19:08.888>Let's <00:19:09.044>start <00:19:09.200>with

397
00:19:10.500 --> 00:19:13.400
<00:19:10.500>certain <00:19:10.780>demos. <00:19:11.060>For <00:19:11.340>example, <00:19:11.620>we <00:19:11.900>have

398
00:19:13.400 --> 00:19:16.600
<00:19:13.400>Florida <00:19:13.680>air <00:19:13.960>pollution <00:19:14.240>wherein <00:19:14.520>I <00:19:14.800>created

399
00:19:16.600 --> 00:19:21.000
<00:19:16.600>this <00:19:16.740>video <00:19:16.879>just <00:19:17.020>for <00:19:17.159>you <00:19:17.300>because <00:19:17.439>sometimes <00:19:17.580>the <00:19:17.719>internet <00:19:17.860>doesn't <00:19:18.000>support

400
00:19:19.300 --> 00:19:22.300
<00:19:19.300>or <00:19:19.766>there <00:19:20.233>are <00:19:20.700>certain

401
00:19:22.300 --> 00:19:25.500
<00:19:22.300>issues <00:19:22.427>but <00:19:22.554>lock <00:19:22.681>4G <00:19:22.809>I'm <00:19:22.936>gonna <00:19:23.063>go <00:19:23.190>ahead <00:19:23.318>and <00:19:23.445>do <00:19:23.572>it <00:19:23.700>replicate

402
00:19:25.500 --> 00:19:28.200
<00:19:25.500>because <00:19:25.627>I <00:19:25.754>have <00:19:25.881>set <00:19:26.009>up <00:19:26.136>everything <00:19:26.263>on <00:19:26.390>my <00:19:26.518>local <00:19:26.645>system <00:19:26.772>as <00:19:26.900>well.

403
00:19:28.200 --> 00:19:31.400
<00:19:28.200>So <00:19:28.375>for <00:19:28.550>this <00:19:28.725>one, <00:19:28.900>what <00:19:29.075>I <00:19:29.250>did <00:19:29.425>was <00:19:29.600>there

404
00:19:31.400 --> 00:19:35.300
<00:19:31.400>is <00:19:31.540>a <00:19:31.680>requery <00:19:31.820>which <00:19:31.960>is <00:19:32.100>part <00:19:32.240>of <00:19:32.380>the <00:19:32.520>whole <00:19:32.660>Express <00:19:32.800>API

405
00:19:34.300 --> 00:19:37.800
<00:19:34.300>framework <00:19:35.000>and <00:19:35.700>in

406
00:19:37.800 --> 00:19:38.400
<00:19:37.800>the <00:19:38.070>rec <00:19:38.340>query,

407
00:19:39.100 --> 00:19:43.200
<00:19:39.100>We <00:19:39.227>are <00:19:39.354>using <00:19:39.481>a <00:19:39.609>feature <00:19:39.736>where <00:19:39.863>we <00:19:39.990>are <00:19:40.118>taking <00:19:40.245>the <00:19:40.372>string <00:19:40.500>from

408
00:19:42.200 --> 00:19:43.800
<00:19:42.200>the <00:19:43.600>user.

409
00:19:45.100 --> 00:19:48.700
<00:19:45.100>Now <00:19:45.240>when <00:19:45.379>we <00:19:45.520>are <00:19:45.659>taking <00:19:45.800>the <00:19:45.939>string <00:19:46.080>what <00:19:46.219>happens <00:19:46.360>is <00:19:46.500>that

410
00:19:48.700 --> 00:19:51.000
<00:19:48.700>we <00:19:48.980>are <00:19:49.260>checking <00:19:49.540>everything <00:19:49.820>if <00:19:50.100>you

411
00:19:51.300 --> 00:19:54.400
<00:19:51.300>see <00:19:51.455>on <00:19:51.611>the <00:19:51.766>screen <00:19:51.922>that <00:19:52.077>there <00:19:52.233>is <00:19:52.388>an <00:19:52.544>input <00:19:52.700>that's

412
00:19:54.400 --> 00:19:54.900
<00:19:54.400>being <00:19:54.850>taken.

413
00:19:55.800 --> 00:19:59.100
<00:19:55.800>We <00:19:56.033>have <00:19:56.266>certain <00:19:56.500>validations <00:19:56.733>in <00:19:56.966>place. <00:19:57.200>And

414
00:19:58.100 --> 00:20:01.800
<00:19:58.100>if <00:19:58.300>you <00:19:58.500>see <00:19:58.699>that, <00:19:58.899>I <00:19:59.100>have <00:19:59.300>a <00:19:59.500>sanitization

415
00:20:01.800 --> 00:20:03.300
<00:20:01.800>function, <00:20:02.250>which <00:20:02.700>is <00:20:03.149>there.

416
00:20:04.100 --> 00:20:07.300
<00:20:04.100>Even <00:20:04.255>for <00:20:04.411>index <00:20:04.566>of <00:20:04.722>greater <00:20:04.877>than <00:20:05.033>sign <00:20:05.188>less <00:20:05.344>than <00:20:05.500>sign.

417
00:20:07.300 --> 00:20:10.400
<00:20:07.300>So <00:20:07.533>we <00:20:07.766>have <00:20:08.000>validation <00:20:08.233>for <00:20:08.466>SQL <00:20:08.700>injection.

418
00:20:10.400 --> 00:20:13.400
<00:20:10.400>We <00:20:10.633>have <00:20:10.866>validation <00:20:11.100>for <00:20:11.333>cross-site <00:20:11.566>scripting <00:20:11.800>all

419
00:20:13.400 --> 00:20:16.100
<00:20:13.400>of <00:20:13.555>that <00:20:13.711>is <00:20:13.866>there <00:20:14.022>and <00:20:14.177>even <00:20:14.333>we <00:20:14.488>are <00:20:14.644>escaping <00:20:14.800>the

420
00:20:16.100 --> 00:20:19.800
<00:20:16.100>characters <00:20:16.333>so <00:20:16.566>that <00:20:16.800>even <00:20:17.033>if <00:20:17.266>the <00:20:17.500>validation

421
00:20:19.800 --> 00:20:22.400
<00:20:19.800>gets <00:20:20.033>bypassed <00:20:20.266>but <00:20:20.500>then <00:20:20.733>output <00:20:20.966>at <00:20:21.200>coding

422
00:20:22.400 --> 00:20:23.900
<00:20:22.400>is <00:20:22.592>there <00:20:22.785>or <00:20:22.978>escaping <00:20:23.171>is <00:20:23.364>there <00:20:23.557>so <00:20:23.750>that

423
00:20:24.700 --> 00:20:28.200
<00:20:24.700>The <00:20:24.933>script <00:20:25.166>the <00:20:25.400>third <00:20:25.633>party <00:20:25.866>script <00:20:26.100>does

424
00:20:27.200 --> 00:20:29.400
<00:20:27.200>not <00:20:27.900>get <00:20:28.600>executed.

425
00:20:30.100 --> 00:20:32.800
<00:20:30.100>Now <00:20:30.274>it <00:20:30.449>it <00:20:30.625>is <00:20:30.800>good. <00:20:30.975>But <00:20:31.149>then <00:20:31.324>what <00:20:31.500>next?

426
00:20:34.300 --> 00:20:36.900
<00:20:34.300>So <00:20:34.533>here <00:20:34.766>comes <00:20:35.000>the <00:20:35.233>type <00:20:35.466>of <00:20:35.700>like.

427
00:20:38.100 --> 00:20:41.100
<00:20:38.100>index <00:20:38.300>of <00:20:38.500>many <00:20:38.699>other <00:20:38.899>features <00:20:39.100>where <00:20:39.300>we <00:20:39.500>don't

428
00:20:41.100 --> 00:20:41.700
Define

429
00:20:42.600 --> 00:20:46.000
<00:20:42.600>that <00:20:42.800>where <00:20:43.000>could <00:20:43.199>be <00:20:43.399>the <00:20:43.600>issue <00:20:43.800>where <00:20:44.000>what

430
00:20:45.500 --> 00:20:48.300
<00:20:45.500>input <00:20:45.700>you <00:20:45.900>need <00:20:46.100>to <00:20:46.300>take. <00:20:46.500>So <00:20:46.700>here <00:20:46.900>we've

431
00:20:48.300 --> 00:20:51.900
<00:20:48.300>just <00:20:48.475>mentioned <00:20:48.649>that <00:20:48.825>oh <00:20:49.000>escape <00:20:49.175>the <00:20:49.350>input <00:20:49.524>as <00:20:49.700>a

432
00:20:51.900 --> 00:20:55.100
<00:20:51.900>string <00:20:52.133>field, <00:20:52.366>but <00:20:52.600>in <00:20:52.833>case <00:20:53.066>if <00:20:53.300>I

433
00:20:54.100 --> 00:20:57.300
<00:20:54.100>change <00:20:54.300>it <00:20:54.500>to <00:20:54.699>any <00:20:54.899>other <00:20:55.100>thing <00:20:55.300>if <00:20:55.500>I

434
00:20:57.300 --> 00:21:00.600
<00:20:57.300>change <00:20:57.407>it <00:20:57.515>to <00:20:57.623>or <00:20:57.730>do <00:20:57.838>an <00:20:57.946>object <00:20:58.053>if <00:20:58.161>I <00:20:58.269>change <00:20:58.376>it <00:20:58.484>to <00:20:58.592>an <00:20:58.700>area

435
00:21:00.600 --> 00:21:01.600
<00:21:00.600>what <00:21:01.050>will <00:21:01.500>happen.

436
00:21:03.200 --> 00:21:06.900
<00:21:03.200>So <00:21:03.340>this <00:21:03.480>seems <00:21:03.620>so <00:21:03.760>nice. <00:21:03.900>Oh, <00:21:04.040>no, <00:21:04.180>no, <00:21:04.320>no, <00:21:04.460>nothing <00:21:04.600>else

437
00:21:06.900 --> 00:21:07.400
<00:21:06.900>is <00:21:07.125>gonna <00:21:07.350>happen.

438
00:21:08.200 --> 00:21:11.300
<00:21:08.200>So <00:21:08.355>now <00:21:08.511>what <00:21:08.666>all <00:21:08.822>of <00:21:08.977>this <00:21:09.133>is <00:21:09.288>fine, <00:21:09.444>let's <00:21:09.600>go

439
00:21:11.300 --> 00:21:14.900
<00:21:11.300>ahead <00:21:11.475>and <00:21:11.649>check <00:21:11.825>the <00:21:12.000>app <00:21:12.175>like <00:21:12.350>what <00:21:12.524>exactly <00:21:12.700>input

440
00:21:14.900 --> 00:21:18.400
<00:21:14.900>it <00:21:15.055>is <00:21:15.211>showing. <00:21:15.366>So <00:21:15.522>let <00:21:15.677>me <00:21:15.833>show <00:21:15.988>you <00:21:16.144>with <00:21:16.300>an

441
00:21:18.400 --> 00:21:21.700
<00:21:18.400>app <00:21:18.575>that <00:21:18.750>what <00:21:18.925>happens <00:21:19.100>is <00:21:19.275>so <00:21:19.450>I've <00:21:19.625>just <00:21:19.800>this

442
00:21:21.700 --> 00:21:24.600
<00:21:21.700>is <00:21:21.855>the <00:21:22.011>only <00:21:22.166>single <00:21:22.322>file <00:21:22.477>that <00:21:22.633>I <00:21:22.788>have <00:21:22.944>that <00:21:23.100>I'm

443
00:21:24.600 --> 00:21:28.000
<00:21:24.600>using <00:21:24.774>and <00:21:24.949>I'm <00:21:25.125>running <00:21:25.300>on <00:21:25.475>Port <00:21:25.649>30 <00:21:25.824>to <00:21:26.000>3000.

444
00:21:28.700 --> 00:21:29.300
<00:21:28.700>now <00:21:29.240>here

445
00:21:30.600 --> 00:21:33.400
<00:21:30.600>if <00:21:30.755>you <00:21:30.911>see <00:21:31.066>this <00:21:31.222>is <00:21:31.377>a <00:21:31.533>URL <00:21:31.688>because <00:21:31.844>it's <00:21:32.000>running

446
00:21:33.400 --> 00:21:37.000
<00:21:33.400>on <00:21:33.575>Local <00:21:33.750>Host <00:21:33.925>and <00:21:34.100>I'm <00:21:34.275>testing <00:21:34.450>it <00:21:34.625>but <00:21:34.800>without

447
00:21:36.400 --> 00:21:40.000
<00:21:36.400>an <00:21:36.540>array <00:21:36.680>so <00:21:36.820>I'm <00:21:36.960>just <00:21:37.100>going <00:21:37.240>to <00:21:37.380>be <00:21:37.520>going <00:21:37.660>ahead <00:21:37.800>and

448
00:21:39.700 --> 00:21:42.300
<00:21:39.700>using <00:21:39.980>it. <00:21:40.260>So <00:21:40.540>my <00:21:40.820>if <00:21:41.100>you

449
00:21:42.300 --> 00:21:45.600
<00:21:42.300>see <00:21:42.455>my <00:21:42.611>application <00:21:42.766>is <00:21:42.922>running <00:21:43.077>on <00:21:43.233>Port <00:21:43.388>3000 <00:21:43.544>now <00:21:43.700>and

450
00:21:45.600 --> 00:21:48.300
<00:21:45.600>I'm <00:21:45.800>going <00:21:46.000>to <00:21:46.199>be <00:21:46.399>checking <00:21:46.600>whether <00:21:46.800>I <00:21:47.000>get

451
00:21:48.300 --> 00:21:51.600
<00:21:48.300>an <00:21:48.533>alert <00:21:48.766>or <00:21:49.000>I <00:21:49.233>get <00:21:49.466>the <00:21:49.700>output

452
00:21:51.600 --> 00:21:52.400
<00:21:51.600>that <00:21:51.960>I <00:21:52.320>desire.

453
00:21:53.100 --> 00:21:56.900
<00:21:53.100>See <00:21:53.274>her <00:21:53.449>if <00:21:53.625>you <00:21:53.800>see <00:21:53.975>that <00:21:54.149>output <00:21:54.324>got <00:21:54.500>executed

454
00:21:56.900 --> 00:21:58.800
<00:21:56.900>because <00:21:57.250>I <00:21:57.600>have <00:21:57.950>an <00:21:58.300>array.

455
00:21:59.600 --> 00:22:02.800
<00:21:59.600>But <00:21:59.800>instead <00:22:00.000>if <00:22:00.199>I <00:22:00.399>remove <00:22:00.600>that <00:22:00.800>will <00:22:01.000>it

456
00:22:02.800 --> 00:22:05.400
<00:22:02.800>get <00:22:03.149>executed <00:22:03.500>maybe <00:22:03.850>maybe <00:22:04.200>not

457
00:22:05.400 --> 00:22:08.100
<00:22:05.400>but <00:22:05.575>let's <00:22:05.750>go <00:22:05.925>ahead <00:22:06.100>and <00:22:06.275>try <00:22:06.450>that <00:22:06.625>if <00:22:06.800>you

458
00:22:08.100 --> 00:22:11.700
<00:22:08.100>see <00:22:08.300>it <00:22:08.500>does <00:22:08.699>not <00:22:08.899>get <00:22:09.100>executed <00:22:09.300>because <00:22:09.500>it

459
00:22:11.700 --> 00:22:15.000
<00:22:11.700>was <00:22:12.050>escaping <00:22:12.400>the <00:22:12.750>string <00:22:13.100>not

460
00:22:14.600 --> 00:22:17.200
<00:22:14.600>an <00:22:14.949>area <00:22:15.300>because <00:22:15.649>it's <00:22:16.000>defined.

461
00:22:18.200 --> 00:22:21.900
<00:22:18.200>And <00:22:18.340>it <00:22:18.480>is <00:22:18.620>defined <00:22:18.760>that <00:22:18.900>if <00:22:19.040>the <00:22:19.180>input <00:22:19.320>string <00:22:19.460>but <00:22:19.600>in

462
00:22:21.900 --> 00:22:24.300
<00:22:21.900>case <00:22:22.055>when <00:22:22.211>we <00:22:22.366>take <00:22:22.522>the <00:22:22.677>input, <00:22:22.833>we <00:22:22.988>have <00:22:23.144>to <00:22:23.300>Define

463
00:22:24.300 --> 00:22:26.300
<00:22:24.300>what <00:22:24.500>kind <00:22:24.700>of <00:22:24.899>input <00:22:25.100>that <00:22:25.300>would <00:22:25.500>be <00:22:25.700>taking?

464
00:22:28.700 --> 00:22:29.100
<00:22:28.700>so <00:22:29.060>now

465
00:22:32.200 --> 00:22:35.800
<00:22:32.200>if <00:22:32.340>you <00:22:32.480>see <00:22:32.620>this <00:22:32.760>it <00:22:32.900>is <00:22:33.040>going <00:22:33.180>to <00:22:33.320>work <00:22:33.460>now. <00:22:33.600>Similarly.

466
00:22:35.800 --> 00:22:38.500
<00:22:35.800>This <00:22:35.955>is <00:22:36.111>just <00:22:36.266>an <00:22:36.422>alert, <00:22:36.577>but <00:22:36.733>I <00:22:36.888>can <00:22:37.044>take <00:22:37.200>any

467
00:22:38.500 --> 00:22:41.200
<00:22:38.500>other <00:22:38.655>information <00:22:38.811>as <00:22:38.966>well. <00:22:39.122>Now. <00:22:39.277>I'm <00:22:39.433>going <00:22:39.588>to <00:22:39.744>stop <00:22:39.900>here.

468
00:22:42.300 --> 00:22:45.700
<00:22:42.300>This <00:22:42.427>is <00:22:42.554>more <00:22:42.681>of <00:22:42.809>a <00:22:42.936>prototype <00:22:43.063>pollution <00:22:43.190>that <00:22:43.318>we <00:22:43.445>see <00:22:43.572>but <00:22:43.700>let

469
00:22:45.700 --> 00:22:48.000
<00:22:45.700>me <00:22:45.933>show <00:22:46.166>you <00:22:46.400>something <00:22:46.633>around <00:22:46.866>the <00:22:47.100>log4j.

470
00:22:48.500 --> 00:22:51.300
<00:22:48.500>So <00:22:48.640>here <00:22:48.780>I <00:22:48.920>have <00:22:49.060>set <00:22:49.200>up <00:22:49.340>the <00:22:49.480>environment. <00:22:49.620>This <00:22:49.760>is <00:22:49.900>my

471
00:22:51.300 --> 00:22:52.000
<00:22:51.300>local <00:22:51.930>system.

472
00:22:52.900 --> 00:22:55.400
<00:22:52.900>And <00:22:53.180>I'm <00:22:53.460>using <00:22:53.740>this <00:22:54.020>lock <00:22:54.300>for

473
00:22:55.400 --> 00:22:58.600
<00:22:55.400>Shell <00:22:55.555>goof. <00:22:55.711>I <00:22:55.866>have <00:22:56.022>a <00:22:56.177>server. <00:22:56.333>I <00:22:56.488>have <00:22:56.644>a <00:22:56.800>client.

474
00:22:59.700 --> 00:23:02.900
<00:22:59.700>What <00:22:59.855>I <00:23:00.011>need <00:23:00.166>to <00:23:00.322>do <00:23:00.477>is <00:23:00.633>to <00:23:00.788>execute <00:23:00.944>this <00:23:01.100>attack.

475
00:23:02.900 --> 00:23:05.800
<00:23:02.900>I <00:23:03.100>need <00:23:03.300>to <00:23:03.500>have <00:23:03.700>a <00:23:03.900>server <00:23:04.100>running <00:23:04.300>now.

476
00:23:05.800 --> 00:23:08.100
<00:23:05.800>I <00:23:05.975>don't <00:23:06.149>want <00:23:06.325>to <00:23:06.500>impact <00:23:06.675>any <00:23:06.850>other <00:23:07.024>servers. <00:23:07.200>So

477
00:23:08.100 --> 00:23:11.500
<00:23:08.100>I've <00:23:08.227>set <00:23:08.354>up <00:23:08.481>a <00:23:08.609>server <00:23:08.736>and <00:23:08.863>the <00:23:08.990>local <00:23:09.118>system <00:23:09.245>as <00:23:09.372>well <00:23:09.500>itself.

478
00:23:12.100 --> 00:23:16.000
<00:23:12.100>So, <00:23:12.227>let <00:23:12.354>me <00:23:12.481>see. <00:23:12.609>What <00:23:12.736>do <00:23:12.863>we <00:23:12.990>have? <00:23:13.118>Oh, <00:23:13.245>sorry. <00:23:13.372>Okay, <00:23:13.500>so

479
00:23:15.300 --> 00:23:17.700
<00:23:15.300>let <00:23:15.500>me <00:23:15.700>go <00:23:15.899>ahead <00:23:16.100>and <00:23:16.300>go <00:23:16.500>to <00:23:16.700>server.

480
00:23:19.100 --> 00:23:20.400
<00:23:19.100>And <00:23:19.392>start <00:23:19.685>the <00:23:19.977>server <00:23:20.270>first.

481
00:23:21.200 --> 00:23:22.400
<00:23:21.200>So <00:23:21.470>I'm <00:23:21.740>gonna <00:23:22.010>go <00:23:22.280>ahead.

482
00:23:26.200 --> 00:23:30.400
<00:23:26.200>Here <00:23:26.316>if <00:23:26.433>you <00:23:26.550>see <00:23:26.666>what <00:23:26.783>I <00:23:26.900>have <00:23:27.016>done <00:23:27.133>is <00:23:27.250>that <00:23:27.366>I <00:23:27.483>have <00:23:27.600>jdk

483
00:23:29.400 --> 00:23:32.200
<00:23:29.400>version <00:23:29.866>11 <00:23:30.333>on <00:23:30.800>my

484
00:23:32.200 --> 00:23:34.800
<00:23:32.200>system <00:23:32.400>now, <00:23:32.600>this <00:23:32.800>is <00:23:33.000>just <00:23:33.200>in <00:23:33.400>a <00:23:33.600>folder.

485
00:23:35.700 --> 00:23:37.500
<00:23:35.700>Because <00:23:35.980>this <00:23:36.260>is <00:23:36.540>a <00:23:36.820>vulnerable <00:23:37.100>version.

486
00:23:38.700 --> 00:23:42.300
<00:23:38.700>If <00:23:38.840>you <00:23:38.980>want <00:23:39.120>to <00:23:39.260>know <00:23:39.400>more <00:23:39.540>about <00:23:39.680>vulnerable <00:23:39.820>versions, <00:23:39.960>there's <00:23:40.100>a

487
00:23:41.300 --> 00:23:44.200
<00:23:41.300>there's <00:23:41.533>a <00:23:41.766>whole <00:23:42.000>list <00:23:42.233>awesome <00:23:42.466>list. <00:23:42.700>I

488
00:23:44.200 --> 00:23:47.700
<00:23:44.200>can <00:23:44.400>share <00:23:44.600>where <00:23:44.800>you <00:23:45.000>can <00:23:45.200>find <00:23:45.400>every <00:23:45.600>resource

489
00:23:47.700 --> 00:23:50.700
<00:23:47.700>about <00:23:47.933>log <00:23:48.166>for <00:23:48.400>Shell. <00:23:48.633>Now, <00:23:48.866>what <00:23:49.100>I'm

490
00:23:50.700 --> 00:23:53.100
<00:23:50.700>going <00:23:50.816>to <00:23:50.933>do <00:23:51.050>is <00:23:51.166>I'm <00:23:51.283>just <00:23:51.400>gonna <00:23:51.516>go <00:23:51.633>ahead <00:23:51.750>and <00:23:51.866>execute <00:23:51.983>the <00:23:52.100>Java.

491
00:23:54.100 --> 00:23:56.100
<00:23:54.100>Here, <00:23:54.379>I'm <00:23:54.659>running <00:23:54.939>an <00:23:55.219>ldap <00:23:55.500>server.

492
00:23:56.800 --> 00:23:59.800
<00:23:56.800>And <00:23:57.000>at <00:23:57.200>the <00:23:57.399>same <00:23:57.600>time <00:23:57.800>I'm <00:23:58.000>my <00:23:58.200>HTTP

493
00:23:59.800 --> 00:24:01.500
<00:23:59.800>server <00:24:00.080>is <00:24:00.360>running <00:24:00.639>on <00:24:00.919>Port <00:24:01.200>8000.

494
00:24:02.400 --> 00:24:05.200
<00:24:02.400>Let <00:24:02.600>me <00:24:02.800>go <00:24:03.000>ahead <00:24:03.200>and <00:24:03.400>click <00:24:03.600>run <00:24:03.800>a

495
00:24:05.200 --> 00:24:05.300
client.

496
00:24:05.800 --> 00:24:06.200
now

497
00:24:07.800 --> 00:24:09.300
<00:24:07.800>official <00:24:09.149>client

498
00:24:10.300 --> 00:24:13.300
<00:24:10.300>If <00:24:10.427>you <00:24:10.554>see <00:24:10.681>there <00:24:10.809>are <00:24:10.936>two <00:24:11.063>files, <00:24:11.190>I'm <00:24:11.318>going <00:24:11.445>to <00:24:11.572>execute <00:24:11.700>the

499
00:24:13.300 --> 00:24:14.100
<00:24:13.300>client <00:24:13.659>as <00:24:14.020>well.

500
00:24:20.500 --> 00:24:23.800
<00:24:20.500>Okay, <00:24:20.733>so <00:24:20.966>here <00:24:21.200>I'm <00:24:21.433>executing <00:24:21.666>here <00:24:21.900>if

501
00:24:23.800 --> 00:24:24.100
<00:24:23.800>you <00:24:24.070>see.

502
00:24:25.100 --> 00:24:26.500
<00:24:25.100>The <00:24:25.415>success <00:24:25.730>build <00:24:26.045>is <00:24:26.360>success.

503
00:24:27.200 --> 00:24:30.700
<00:24:27.200>Earlier, <00:24:27.375>this <00:24:27.550>file <00:24:27.725>was <00:24:27.900>not <00:24:28.075>created <00:24:28.250>now. <00:24:28.425>This <00:24:28.600>file

504
00:24:30.700 --> 00:24:33.500
<00:24:30.700>has <00:24:30.875>been <00:24:31.050>created. <00:24:31.225>Now <00:24:31.400>what <00:24:31.575>happens <00:24:31.750>is <00:24:31.925>if <00:24:32.100>the

505
00:24:33.500 --> 00:24:34.600
<00:24:33.500>server <00:24:33.995>is <00:24:34.490>vulnerable.

506
00:24:35.700 --> 00:24:38.300
<00:24:35.700>There <00:24:35.875>are <00:24:36.050>files <00:24:36.225>that <00:24:36.400>can <00:24:36.575>be <00:24:36.750>downloaded. <00:24:36.925>So <00:24:37.100>this

507
00:24:38.300 --> 00:24:41.500
<00:24:38.300>is <00:24:38.500>the <00:24:38.700>evil <00:24:38.899>server <00:24:39.100>that <00:24:39.300>this <00:24:39.500>line <00:24:39.700>connected

508
00:24:41.500 --> 00:24:44.400
<00:24:41.500>and <00:24:41.733>that <00:24:41.966>got <00:24:42.200>Pond <00:24:42.433>now <00:24:42.666>if <00:24:42.900>you

509
00:24:44.400 --> 00:24:47.400
<00:24:44.400>want <00:24:44.575>to <00:24:44.750>see <00:24:44.925>more <00:24:45.100>let <00:24:45.275>me <00:24:45.450>go <00:24:45.625>ahead <00:24:45.800>and

510
00:24:47.400 --> 00:24:48.900
<00:24:47.400>show <00:24:47.737>you <00:24:48.075>an <00:24:48.412>interesting <00:24:48.750>thing.

511
00:24:52.200 --> 00:24:55.500
<00:24:52.200>So, <00:24:52.340>let <00:24:52.480>me <00:24:52.620>see <00:24:52.760>this <00:24:52.900>file <00:24:53.040>exist <00:24:53.180>or <00:24:53.320>not. <00:24:53.460>So <00:24:53.600>this

512
00:24:55.500 --> 00:24:58.400
<00:24:55.500>file <00:24:55.675>exists. <00:24:55.850>Let <00:24:56.025>me <00:24:56.200>go <00:24:56.375>ahead <00:24:56.550>and <00:24:56.725>delete <00:24:56.900>it.

513
00:25:02.800 --> 00:25:04.900
<00:25:02.800>And <00:25:03.500>on <00:25:04.200>okay.

514
00:25:06.200 --> 00:25:08.200
<00:25:06.200>So <00:25:06.480>do <00:25:06.760>we <00:25:07.040>have <00:25:07.320>this <00:25:07.600>file?

515
00:25:09.500 --> 00:25:12.400
<00:25:09.500>No, <00:25:09.700>we <00:25:09.900>don't <00:25:10.100>now. <00:25:10.300>Let <00:25:10.500>me <00:25:10.700>execute <00:25:10.900>Java.

516
00:25:13.100 --> 00:25:16.400
<00:25:13.100>And <00:25:13.227>I'm <00:25:13.354>trying <00:25:13.481>to <00:25:13.609>connect <00:25:13.736>to <00:25:13.863>the <00:25:13.990>server <00:25:14.118>and <00:25:14.245>see <00:25:14.372>what <00:25:14.500>happens.

517
00:25:19.700 --> 00:25:23.800
<00:25:19.700>If <00:25:19.855>you <00:25:20.011>see <00:25:20.166>the <00:25:20.322>file <00:25:20.477>has <00:25:20.633>been <00:25:20.788>created <00:25:20.944>now <00:25:21.100>if

518
00:25:22.800 --> 00:25:25.900
<00:25:22.800>server <00:25:23.500>is <00:25:24.200>vulnerable

519
00:25:25.900 --> 00:25:28.600
<00:25:25.900>and <00:25:26.366>has <00:25:26.833>a <00:25:27.300>random

520
00:25:28.600 --> 00:25:31.100
<00:25:28.600>word, <00:25:28.774>or <00:25:28.949>maybe <00:25:29.125>there <00:25:29.300>is <00:25:29.475>something <00:25:29.649>which <00:25:29.824>says <00:25:30.000>that

521
00:25:31.100 --> 00:25:33.100
<00:25:31.100>download <00:25:31.379>ransomware <00:25:31.659>on <00:25:31.939>all <00:25:32.219>the <00:25:32.500>clients.

522
00:25:34.300 --> 00:25:37.500
<00:25:34.300>For <00:25:34.455>Undertaker. <00:25:34.611>It's <00:25:34.766>the <00:25:34.922>most <00:25:35.077>coolest <00:25:35.233>thing <00:25:35.388>but <00:25:35.544>for <00:25:35.700>us

523
00:25:37.500 --> 00:25:40.500
<00:25:37.500>no, <00:25:37.780>that's <00:25:38.060>why <00:25:38.340>it <00:25:38.620>needs <00:25:38.900>an

524
00:25:40.500 --> 00:25:43.000
<00:25:40.500>upgrade <00:25:40.675>that <00:25:40.850>our <00:25:41.025>validations <00:25:41.200>that <00:25:41.375>has <00:25:41.550>to <00:25:41.725>be <00:25:41.900>checked.

525
00:25:44.100 --> 00:25:47.500
<00:25:44.100>So <00:25:44.300>we <00:25:44.500>talked <00:25:44.699>about <00:25:44.899>prototype <00:25:45.100>pollutioning <00:25:45.300>we <00:25:45.500>talked

526
00:25:47.500 --> 00:25:50.700
<00:25:47.500>about <00:25:47.700>log4j <00:25:47.900>attacks. <00:25:48.100>Now <00:25:48.300>we <00:25:48.500>need <00:25:48.700>to <00:25:48.900>know

527
00:25:50.700 --> 00:25:53.400
<00:25:50.700>about <00:25:50.875>what <00:25:51.050>we <00:25:51.225>have. <00:25:51.400>So <00:25:51.575>all <00:25:51.750>of <00:25:51.925>these <00:25:52.100>things

528
00:25:53.400 --> 00:25:56.500
<00:25:53.400>always <00:25:53.680>tells <00:25:53.960>about <00:25:54.240>very <00:25:54.520>very <00:25:54.800>important

529
00:25:56.500 --> 00:26:00.000
<00:25:56.500>to <00:25:56.700>know <00:25:56.900>about <00:25:57.100>your <00:25:57.300>own <00:25:57.500>content. <00:25:57.700>Now, <00:25:57.900>let

530
00:25:59.100 --> 00:26:02.700
<00:25:59.100>me <00:25:59.300>show <00:25:59.500>you <00:25:59.699>another <00:25:59.899>demo <00:26:00.100>now. <00:26:00.300>This <00:26:00.500>also

531
00:26:02.700 --> 00:26:06.100
<00:26:02.700>is <00:26:02.875>recorded <00:26:03.050>because <00:26:03.225>sometimes <00:26:03.400>my <00:26:03.575>virtualbox <00:26:03.750>doesn't <00:26:03.925>help <00:26:04.100>me

532
00:26:06.100 --> 00:26:09.000
<00:26:06.100>out <00:26:06.274>or <00:26:06.449>sometimes <00:26:06.625>my <00:26:06.800>Democrats <00:26:06.975>don't <00:26:07.149>shower <00:26:07.324>the <00:26:07.500>blessings.

533
00:26:09.900 --> 00:26:12.200
<00:26:09.900>Here <00:26:10.075>what <00:26:10.250>I <00:26:10.425>have <00:26:10.600>done <00:26:10.775>is <00:26:10.950>I've <00:26:11.125>set <00:26:11.300>up

534
00:26:12.200 --> 00:26:15.600
<00:26:12.200>a <00:26:12.355>demo <00:26:12.511>poc <00:26:12.666>in <00:26:12.822>my <00:26:12.977>Alpine <00:26:13.133>Linux <00:26:13.288>VM <00:26:13.444>and <00:26:13.600>in

535
00:26:15.600 --> 00:26:19.500
<00:26:15.600>that <00:26:15.774>I <00:26:15.949>have <00:26:16.125>created <00:26:16.300>a <00:26:16.475>demo <00:26:16.649>environment <00:26:16.824>and <00:26:17.000>I'm

536
00:26:18.500 --> 00:26:20.700
<00:26:18.500>using <00:26:19.200>Python <00:26:19.900>3.

537
00:26:21.700 --> 00:26:24.800
<00:26:21.700>And <00:26:21.840>in <00:26:21.980>that <00:26:22.120>I'm <00:26:22.260>I've <00:26:22.400>set <00:26:22.540>up <00:26:22.680>an <00:26:22.820>environment <00:26:22.960>too <00:26:23.100>or

538
00:26:24.800 --> 00:26:27.600
<00:26:24.800>environment <00:26:25.149>and <00:26:25.500>activated <00:26:25.850>that <00:26:26.200>in

539
00:26:27.600 --> 00:26:30.800
<00:26:27.600>the <00:26:27.879>environment. <00:26:28.159>I <00:26:28.439>have <00:26:28.719>a <00:26:29.000>celery

540
00:26:30.800 --> 00:26:32.000
<00:26:30.800>which <00:26:31.340>is <00:26:31.880>a

541
00:26:33.300 --> 00:26:36.500
<00:26:33.300>which <00:26:33.416>is <00:26:33.533>one <00:26:33.649>of <00:26:33.766>the <00:26:33.883>dependency <00:26:34.000>as <00:26:34.116>part <00:26:34.233>of <00:26:34.350>the <00:26:34.466>Python. <00:26:34.583>Oh <00:26:34.700>my

542
00:26:36.500 --> 00:26:39.300
<00:26:36.500>God, <00:26:36.780>it's <00:26:37.060>right. <00:26:37.340>So <00:26:37.620>I'm <00:26:37.900>using

543
00:26:39.300 --> 00:26:43.200
<00:26:39.300>celery <00:26:39.475>and <00:26:39.649>so <00:26:39.825>the <00:26:40.000>python <00:26:40.175>is <00:26:40.350>not <00:26:40.524>vulnerable <00:26:40.700>celery

544
00:26:42.200 --> 00:26:44.200
<00:26:42.200>is <00:26:43.600>vulnerable.

545
00:26:44.800 --> 00:26:47.600
<00:26:44.800>There <00:26:44.975>is <00:26:45.149>a <00:26:45.325>remote <00:26:45.500>code <00:26:45.675>execution <00:26:45.850>there. <00:26:46.024>So <00:26:46.200>I'm

546
00:26:47.600 --> 00:26:49.800
<00:26:47.600>going <00:26:47.800>to <00:26:48.000>be <00:26:48.199>starting <00:26:48.399>the <00:26:48.600>salary <00:26:48.800>task <00:26:49.000>worker.

547
00:26:50.400 --> 00:26:53.300
<00:26:50.400>When <00:26:50.527>you <00:26:50.654>start <00:26:50.781>the <00:26:50.909>salary <00:26:51.036>trust <00:26:51.163>worker <00:26:51.290>there <00:26:51.418>is <00:26:51.545>some <00:26:51.672>information <00:26:51.800>that

548
00:26:53.300 --> 00:26:56.100
<00:26:53.300>you <00:26:53.533>get <00:26:53.766>so <00:26:54.000>salary <00:26:54.233>task <00:26:54.466>worker <00:26:54.700>is

549
00:26:56.100 --> 00:26:58.500
<00:26:56.100>running, <00:26:56.449>but <00:26:56.800>I'm <00:26:57.149>using <00:26:57.500>mongodb.

550
00:26:59.300 --> 00:27:01.500
<00:26:59.300>Because <00:26:59.455>there <00:26:59.611>has <00:26:59.766>to <00:26:59.922>be <00:27:00.077>a <00:27:00.233>database <00:27:00.388>in <00:27:00.544>the <00:27:00.700>backend.

551
00:27:02.100 --> 00:27:06.000
<00:27:02.100>So <00:27:02.216>here <00:27:02.333>what <00:27:02.449>I <00:27:02.566>have <00:27:02.683>done <00:27:02.800>is <00:27:02.916>that <00:27:03.033>I <00:27:03.149>am <00:27:03.266>running <00:27:03.383>this <00:27:03.500>POC.

552
00:27:05.300 --> 00:27:08.100
<00:27:05.300>So <00:27:05.475>I'm <00:27:05.649>gonna <00:27:05.825>attacker <00:27:06.000>I'm <00:27:06.175>running <00:27:06.350>it <00:27:06.524>on <00:27:06.700>the

553
00:27:08.100 --> 00:27:08.200
server.

554
00:27:08.900 --> 00:27:11.500
<00:27:08.900>So <00:27:09.075>I've <00:27:09.250>tried <00:27:09.425>to <00:27:09.600>run <00:27:09.775>this <00:27:09.950>and <00:27:10.125>I've <00:27:10.300>got

555
00:27:11.500 --> 00:27:14.700
<00:27:11.500>a <00:27:11.675>task <00:27:11.850>ID <00:27:12.025>because <00:27:12.200>salary <00:27:12.375>was <00:27:12.550>running <00:27:12.725>and <00:27:12.900>I've

556
00:27:14.700 --> 00:27:17.900
<00:27:14.700>got <00:27:14.933>a <00:27:15.166>task <00:27:15.400>ID <00:27:15.633>now <00:27:15.866>because <00:27:16.100>celery

557
00:27:17.900 --> 00:27:21.300
<00:27:17.900>was <00:27:18.100>vulnerable <00:27:18.300>version <00:27:18.500>was <00:27:18.700>running <00:27:18.900>so <00:27:19.100>my <00:27:19.300>python

558
00:27:20.300 --> 00:27:23.700
<00:27:20.300>script <00:27:20.475>got <00:27:20.649>executed <00:27:20.825>there <00:27:21.000>and <00:27:21.175>I <00:27:21.350>had <00:27:21.524>a <00:27:21.700>sign

559
00:27:23.700 --> 00:27:26.900
<00:27:23.700>certain <00:27:23.875>tasks <00:27:24.050>there <00:27:24.225>here. <00:27:24.400>If <00:27:24.575>you <00:27:24.750>see <00:27:24.925>the <00:27:25.100>task

560
00:27:26.900 --> 00:27:29.300
<00:27:26.900>ID <00:27:27.027>has <00:27:27.154>been <00:27:27.281>generated. <00:27:27.409>What <00:27:27.536>I'm <00:27:27.663>going <00:27:27.790>to <00:27:27.918>do <00:27:28.045>is <00:27:28.172>I'm <00:27:28.300>gonna

561
00:27:29.300 --> 00:27:33.100
<00:27:29.300>go <00:27:29.455>ahead <00:27:29.611>and <00:27:29.766>put <00:27:29.922>the <00:27:30.077>task <00:27:30.233>ID <00:27:30.388>or <00:27:30.544>manage <00:27:30.700>the

562
00:27:33.100 --> 00:27:35.700
<00:27:33.100>task <00:27:33.333>ID <00:27:33.566>as <00:27:33.800>part <00:27:34.033>of <00:27:34.266>the <00:27:34.500>whole

563
00:27:36.500 --> 00:27:39.400
<00:27:36.500>Ecosystem <00:27:36.780>wherein <00:27:37.060>any <00:27:37.340>time <00:27:37.620>I <00:27:37.900>want

564
00:27:39.400 --> 00:27:41.800
<00:27:39.400>to <00:27:39.527>get <00:27:39.654>some <00:27:39.781>information <00:27:39.909>I <00:27:40.036>get <00:27:40.163>it. <00:27:40.290>So <00:27:40.418>here <00:27:40.545>if <00:27:40.672>you <00:27:40.800>see.

565
00:27:42.600 --> 00:27:46.000
<00:27:42.600>I <00:27:42.774>tried <00:27:42.949>to <00:27:43.125>get <00:27:43.300>some <00:27:43.475>information <00:27:43.649>like <00:27:43.824>uid <00:27:44.000>GID

566
00:27:45.300 --> 00:27:48.400
<00:27:45.300>group <00:27:45.500>so <00:27:45.700>so <00:27:45.899>many <00:27:46.100>information <00:27:46.300>about <00:27:46.500>it <00:27:46.700>so

567
00:27:48.400 --> 00:27:51.500
<00:27:48.400>much <00:27:48.540>information <00:27:48.680>about <00:27:48.820>it. <00:27:48.960>So <00:27:49.100>it <00:27:49.240>is <00:27:49.380>the <00:27:49.520>server <00:27:49.660>information <00:27:49.800>that

568
00:27:51.500 --> 00:27:51.800
<00:27:51.500>I've <00:27:51.770>got.

569
00:27:52.600 --> 00:27:55.700
<00:27:52.600>So <00:27:52.800>it <00:27:53.000>is <00:27:53.199>interesting <00:27:53.399>that <00:27:53.600>just <00:27:53.800>by <00:27:54.000>being

570
00:27:55.700 --> 00:27:57.700
<00:27:55.700>one <00:27:56.400>vulnerable <00:27:57.100>API.

571
00:27:58.500 --> 00:28:00.600
<00:27:58.500>It <00:27:58.700>is <00:27:58.900>creating <00:27:59.100>issue <00:27:59.300>for <00:27:59.500>the <00:27:59.700>whole <00:27:59.900>ecosystem.

572
00:28:01.500 --> 00:28:04.700
<00:28:01.500>Now <00:28:01.655>what <00:28:01.811>kind <00:28:01.966>of <00:28:02.122>environment <00:28:02.277>we <00:28:02.433>should <00:28:02.588>have <00:28:02.744>so <00:28:02.900>then

573
00:28:04.700 --> 00:28:08.600
<00:28:04.700>the <00:28:04.840>environment <00:28:04.980>where <00:28:05.120>devs <00:28:05.260>don't <00:28:05.400>need <00:28:05.540>to <00:28:05.680>think <00:28:05.820>about <00:28:05.960>an <00:28:06.100>issue

574
00:28:08.600 --> 00:28:12.000
<00:28:08.600>when <00:28:08.833>a <00:28:09.066>breach <00:28:09.300>happens <00:28:09.533>or <00:28:09.766>vulnerability <00:28:10.000>comes

575
00:28:11.300 --> 00:28:14.100
<00:28:11.300>they <00:28:11.440>were <00:28:11.580>like, <00:28:11.720>okay. <00:28:11.860>I'm <00:28:12.000>ready <00:28:12.139>for <00:28:12.280>it <00:28:12.419>because <00:28:12.560>I <00:28:12.700>know

576
00:28:14.100 --> 00:28:15.300
<00:28:14.100>my <00:28:14.460>environment <00:28:14.820>so <00:28:15.179>well.

577
00:28:16.400 --> 00:28:17.300
<00:28:16.400>What <00:28:16.602>I <00:28:16.805>have <00:28:17.007>in <00:28:17.210>environment.

578
00:28:18.300 --> 00:28:21.500
<00:28:18.300>And <00:28:18.475>the <00:28:18.649>most <00:28:18.825>important <00:28:19.000>thing <00:28:19.175>let's <00:28:19.350>connect <00:28:19.524>with <00:28:19.700>the

579
00:28:21.500 --> 00:28:24.700
<00:28:21.500>community <00:28:21.640>so <00:28:21.780>that <00:28:21.920>we <00:28:22.060>get <00:28:22.200>to <00:28:22.340>know <00:28:22.480>about <00:28:22.620>these <00:28:22.760>news. <00:28:22.900>We

580
00:28:24.700 --> 00:28:27.800
<00:28:24.700>get <00:28:24.875>to <00:28:25.050>know <00:28:25.225>about <00:28:25.400>software <00:28:25.575>security. <00:28:25.750>So <00:28:25.925>oasp <00:28:26.100>is

581
00:28:27.800 --> 00:28:29.000
<00:28:27.800>one <00:28:28.070>of <00:28:28.340>them <00:28:28.610>and <00:28:28.880>then

582
00:28:30.800 --> 00:28:33.200
<00:28:30.800>dependencies <00:28:31.149>are <00:28:31.500>problematic. <00:28:31.850>There <00:28:32.200>are

583
00:28:33.200 --> 00:28:36.200
<00:28:33.200>issues. <00:28:33.400>There <00:28:33.600>are <00:28:33.800>attackers <00:28:34.000>what <00:28:34.200>targeting <00:28:34.400>opens <00:28:34.600>those

584
00:28:36.200 --> 00:28:39.100
<00:28:36.200>ecosystems <00:28:36.550>and <00:28:36.900>application <00:28:37.250>security <00:28:37.600>is

585
00:28:39.100 --> 00:28:42.400
<00:28:39.100>no <00:28:39.216>doubt <00:28:39.333>challenging <00:28:39.449>because <00:28:39.566>we <00:28:39.683>have <00:28:39.800>one <00:28:39.916>foot <00:28:40.033>in <00:28:40.149>the <00:28:40.266>open <00:28:40.383>source <00:28:40.500>one

586
00:28:42.400 --> 00:28:45.200
<00:28:42.400>in <00:28:42.540>the <00:28:42.680>cloud <00:28:42.820>native <00:28:42.960>environment. <00:28:43.100>But <00:28:43.240>what <00:28:43.380>we <00:28:43.520>can <00:28:43.660>do <00:28:43.800>is

587
00:28:45.200 --> 00:28:48.200
<00:28:45.200>we <00:28:45.355>can <00:28:45.511>make <00:28:45.666>it <00:28:45.822>easier <00:28:45.977>develop <00:28:46.133>a <00:28:46.288>friendly <00:28:46.444>and <00:28:46.600>actionable.

588
00:28:48.900 --> 00:28:51.500
<00:28:48.900>Let's <00:28:49.133>have <00:28:49.366>best <00:28:49.600>practices <00:28:49.833>for <00:28:50.066>open <00:28:50.300>source

589
00:28:51.500 --> 00:28:51.900
ecosystem.

590
00:28:52.800 --> 00:28:55.600
<00:28:52.800>Thank <00:28:52.955>you <00:28:53.111>so <00:28:53.266>much <00:28:53.422>for <00:28:53.577>listening <00:28:53.733>to <00:28:53.888>me. <00:28:54.044>I'm <00:28:54.200>so

591
00:28:55.600 --> 00:28:58.400
<00:28:55.600>glad <00:28:55.800>to <00:28:56.000>be <00:28:56.199>speaking <00:28:56.399>at <00:28:56.600>The <00:28:56.800>Forum. <00:28:57.000>Thank

592
00:28:58.400 --> 00:28:58.400
you.

593
00:29:05.300 --> 00:29:08.700
<00:29:05.300>Antenna. <00:29:05.766>Hey <00:29:06.233>Welcome <00:29:06.700>Back

594
00:29:08.700 --> 00:29:11.100
<00:29:08.700>to <00:29:08.933>Life <00:29:09.166>stage. <00:29:09.400>Thank <00:29:09.633>you <00:29:09.866>so <00:29:10.100>much.

595
00:29:11.100 --> 00:29:15.500
<00:29:11.100>Thank <00:29:11.300>you. <00:29:11.500>I <00:29:11.699>hope <00:29:11.899>the <00:29:12.100>presentation <00:29:12.300>was <00:29:12.500>fine.

596
00:29:14.500 --> 00:29:17.000
<00:29:14.500>And <00:29:14.966>please <00:29:15.433>let <00:29:15.900>me

597
00:29:17.100 --> 00:29:17.900
<00:29:17.100>know <00:29:17.280>if <00:29:17.460>there <00:29:17.640>any <00:29:17.820>questions.

598
00:29:18.700 --> 00:29:22.300
<00:29:18.700>Until <00:29:18.933>it <00:29:19.166>was <00:29:19.400>perfect. <00:29:19.633>No <00:29:19.866>worries. <00:29:20.100>So

599
00:29:21.300 --> 00:29:25.000
<00:29:21.300>and <00:29:22.000>yes, <00:29:22.700>actually

600
00:29:24.200 --> 00:29:27.300
<00:29:24.200>we <00:29:24.480>have <00:29:24.760>some <00:29:25.040>questions <00:29:25.320>maybe <00:29:25.600>to

601
00:29:27.300 --> 00:29:30.400
<00:29:27.300>you. <00:29:27.475>Also. <00:29:27.649>Do <00:29:27.825>you <00:29:28.000>want <00:29:28.175>to <00:29:28.350>tell <00:29:28.524>the <00:29:28.700>audience

602
00:29:30.400 --> 00:29:33.300
<00:29:30.400>how <00:29:30.575>your <00:29:30.750>Tech <00:29:30.925>Career <00:29:31.100>has <00:29:31.275>started <00:29:31.450>how <00:29:31.625>you <00:29:31.800>became?

603
00:29:33.900 --> 00:29:35.300
<00:29:33.900>The <00:29:34.215>person <00:29:34.530>you <00:29:34.845>are <00:29:35.159>today.

604
00:29:36.500 --> 00:29:39.300
<00:29:36.500>Sure, <00:29:36.700>so <00:29:36.900>I <00:29:37.100>started <00:29:37.300>my <00:29:37.500>career <00:29:37.700>17 <00:29:37.900>years

605
00:29:39.300 --> 00:29:42.300
<00:29:39.300>back <00:29:39.475>where <00:29:39.649>I <00:29:39.825>don't <00:29:40.000>know <00:29:40.175>if <00:29:40.350>I'll <00:29:40.524>be <00:29:40.700>in

606
00:29:42.300 --> 00:29:45.600
<00:29:42.300>cyber <00:29:42.427>security <00:29:42.554>because <00:29:42.681>all <00:29:42.809>of <00:29:42.936>my <00:29:43.063>friends <00:29:43.190>at <00:29:43.318>that <00:29:43.445>time <00:29:43.572>wanted <00:29:43.700>to

607
00:29:45.600 --> 00:29:48.900
<00:29:45.600>be <00:29:45.774>a <00:29:45.949>developer <00:29:46.125>tester <00:29:46.300>and <00:29:46.475>that's <00:29:46.649>how <00:29:46.824>it <00:29:47.000>was

608
00:29:48.900 --> 00:29:52.200
<00:29:48.900>the <00:29:49.133>it <00:29:49.366>environment, <00:29:49.600>but <00:29:49.833>then <00:29:50.066>I <00:29:50.300>would

609
00:29:52.200 --> 00:29:55.200
<00:29:52.200>say <00:29:52.340>it <00:29:52.480>was <00:29:52.620>a <00:29:52.760>Serendipity <00:29:52.900>where <00:29:53.040>I <00:29:53.180>was <00:29:53.320>given <00:29:53.460>a <00:29:53.600>project

610
00:29:55.200 --> 00:29:58.700
<00:29:55.200>in <00:29:55.375>the <00:29:55.550>first <00:29:55.725>few <00:29:55.900>months <00:29:56.075>for <00:29:56.250>a <00:29:56.425>development <00:29:56.600>project,

611
00:29:58.700 --> 00:30:02.100
<00:29:58.700>but <00:29:58.840>then <00:29:58.980>the <00:29:59.120>project <00:29:59.260>was <00:29:59.400>wrapping <00:29:59.540>up <00:29:59.680>so <00:29:59.820>they <00:29:59.960>said <00:30:00.100>we

612
00:30:01.100 --> 00:30:04.800
<00:30:01.100>have <00:30:01.333>an <00:30:01.566>opening <00:30:01.800>in <00:30:02.033>a <00:30:02.266>network <00:30:02.500>security

613
00:30:04.800 --> 00:30:07.200
<00:30:04.800>project. <00:30:04.955>So <00:30:05.111>I <00:30:05.266>was <00:30:05.422>put <00:30:05.577>into <00:30:05.733>that <00:30:05.888>and <00:30:06.044>I <00:30:06.200>think

614
00:30:07.200 --> 00:30:10.200
<00:30:07.200>that <00:30:07.400>Serendipity <00:30:07.600>led <00:30:07.800>me <00:30:08.000>to <00:30:08.200>what <00:30:08.400>I <00:30:08.600>am

615
00:30:10.200 --> 00:30:13.300
<00:30:10.200>today <00:30:10.355>because <00:30:10.511>I <00:30:10.666>realized <00:30:10.822>I <00:30:10.977>have <00:30:11.133>a <00:30:11.288>knack <00:30:11.444>for <00:30:11.600>security.

616
00:30:13.300 --> 00:30:16.500
<00:30:13.300>There's <00:30:13.455>something <00:30:13.611>new <00:30:13.766>that <00:30:13.922>I'm <00:30:14.077>learning <00:30:14.233>every <00:30:14.388>day. <00:30:14.544>There <00:30:14.700>are

617
00:30:16.500 --> 00:30:19.200
<00:30:16.500>so <00:30:16.675>many <00:30:16.850>new <00:30:17.025>incidents <00:30:17.200>that <00:30:17.375>keep <00:30:17.550>happening <00:30:17.725>but <00:30:17.900>then

618
00:30:19.200 --> 00:30:22.600
<00:30:19.200>the <00:30:19.327>development <00:30:19.454>environment <00:30:19.581>is <00:30:19.709>so <00:30:19.836>close <00:30:19.963>to <00:30:20.090>me <00:30:20.218>that <00:30:20.345>I <00:30:20.472>understand <00:30:20.600>keep

619
00:30:22.600 --> 00:30:26.200
<00:30:22.600>learning <00:30:22.800>new <00:30:23.000>things <00:30:23.199>and <00:30:23.399>keep <00:30:23.600>myself <00:30:23.800>near <00:30:24.000>and

620
00:30:26.200 --> 00:30:30.000
<00:30:26.200>dear <00:30:26.327>to <00:30:26.454>the <00:30:26.581>whole <00:30:26.709>ecosystem <00:30:26.836>so <00:30:26.963>that <00:30:27.090>I <00:30:27.218>keep <00:30:27.345>learning <00:30:27.472>new <00:30:27.600>bugs

621
00:30:29.400 --> 00:30:32.200
<00:30:29.400>new <00:30:29.600>issues <00:30:29.800>and <00:30:30.000>what <00:30:30.200>are <00:30:30.400>the <00:30:30.600>new <00:30:30.800>things

622
00:30:32.200 --> 00:30:35.700
<00:30:32.200>which <00:30:32.307>are <00:30:32.415>coming <00:30:32.523>it <00:30:32.630>was <00:30:32.738>still <00:30:32.846>that <00:30:32.953>I <00:30:33.061>don't <00:30:33.169>know. <00:30:33.276>I <00:30:33.384>can't <00:30:33.492>help <00:30:33.600>out.

623
00:30:36.400 --> 00:30:39.200
<00:30:36.400>So <00:30:36.680>then <00:30:36.960>I <00:30:37.240>became <00:30:37.520>part <00:30:37.800>of

624
00:30:39.200 --> 00:30:43.100
<00:30:39.200>Open <00:30:39.480>Source <00:30:39.760>communities <00:30:40.040>and <00:30:40.320>now <00:30:40.600>I

625
00:30:42.100 --> 00:30:45.200
<00:30:42.100>am <00:30:42.449>currently <00:30:42.800>chairing <00:30:43.149>over <00:30:43.500>asp.

626
00:30:49.200 --> 00:30:52.400
<00:30:49.200>Thank <00:30:49.400>you, <00:30:49.600>and <00:30:49.800>we <00:30:50.000>have <00:30:50.200>a <00:30:50.400>question <00:30:50.600>from

627
00:30:52.400 --> 00:30:55.900
<00:30:52.400>David <00:30:52.633>who <00:30:52.866>wants <00:30:53.100>to <00:30:53.333>know? <00:30:53.566>Why <00:30:53.800>do

628
00:30:55.900 --> 00:30:57.700
<00:30:55.900>you <00:30:56.250>prefer <00:30:56.600>pipe <00:30:56.950>for <00:30:57.300>scripting?

629
00:30:58.900 --> 00:31:01.900
<00:30:58.900>Oh <00:30:59.100>python, <00:30:59.300>I <00:30:59.500>love <00:30:59.700>it <00:30:59.900>because <00:31:00.100>there <00:31:00.300>are

630
00:31:01.900 --> 00:31:04.400
<00:31:01.900>many <00:31:02.016>things <00:31:02.133>that <00:31:02.250>you <00:31:02.366>can <00:31:02.483>play <00:31:02.600>around <00:31:02.716>it. <00:31:02.833>And <00:31:02.950>if <00:31:03.066>I <00:31:03.183>if <00:31:03.300>I

631
00:31:04.400 --> 00:31:07.400
<00:31:04.400>wear <00:31:04.633>a <00:31:04.866>security <00:31:05.100>hat <00:31:05.333>security <00:31:05.566>person <00:31:05.800>had

632
00:31:07.400 --> 00:31:10.200
<00:31:07.400>because <00:31:07.866>it's <00:31:08.333>easy. <00:31:08.800>It's

633
00:31:11.900 --> 00:31:14.900
<00:31:11.900>Interesting <00:31:12.055>and <00:31:12.211>you <00:31:12.366>can <00:31:12.522>build <00:31:12.677>the <00:31:12.833>tools <00:31:12.988>easily. <00:31:13.144>I <00:31:13.300>mean

634
00:31:14.900 --> 00:31:17.100
<00:31:14.900>that's <00:31:15.100>simple <00:31:15.300>words <00:31:15.500>because <00:31:15.700>if <00:31:15.900>I <00:31:16.100>have <00:31:16.300>to

635
00:31:17.100 --> 00:31:20.600
<00:31:17.100>create <00:31:17.274>a <00:31:17.449>script <00:31:17.625>and <00:31:17.800>just <00:31:17.975>create <00:31:18.149>an <00:31:18.324>exploit. <00:31:18.500>It

636
00:31:20.600 --> 00:31:23.800
<00:31:20.600>is <00:31:20.755>super <00:31:20.911>fast <00:31:21.066>and <00:31:21.222>easy <00:31:21.377>to <00:31:21.533>create <00:31:21.688>and <00:31:21.844>python <00:31:22.000>because

637
00:31:23.800 --> 00:31:25.100
<00:31:23.800>it's <00:31:24.385>easily <00:31:24.969>exploitable.

638
00:31:29.300 --> 00:31:33.700
<00:31:29.300>Okay. <00:31:29.475>I <00:31:29.649>hope <00:31:29.825>that <00:31:30.000>answers <00:31:30.175>the <00:31:30.350>question. <00:31:30.524>Also, <00:31:30.700>we

639
00:31:32.700 --> 00:31:35.500
<00:31:32.700>mentioned <00:31:32.980>that <00:31:33.260>you <00:31:33.540>work <00:31:33.820>as <00:31:34.100>a

640
00:31:35.500 --> 00:31:38.400
<00:31:35.500>security <00:31:35.733>relations <00:31:35.966>leader <00:31:36.200>at <00:31:36.433>sneak. <00:31:36.666>Maybe <00:31:36.900>you

641
00:31:38.400 --> 00:31:41.500
<00:31:38.400>want <00:31:38.540>to <00:31:38.680>tell <00:31:38.820>us <00:31:38.960>one <00:31:39.100>or <00:31:39.240>two <00:31:39.380>things <00:31:39.520>about <00:31:39.660>your <00:31:39.800>daily

642
00:31:41.500 --> 00:31:42.700
<00:31:41.500>daily <00:31:42.040>business <00:31:42.580>there.

643
00:31:43.800 --> 00:31:46.000
<00:31:43.800>Sure. <00:31:44.080>So <00:31:44.360>what <00:31:44.639>I <00:31:44.919>do <00:31:45.200>is

644
00:31:46.300 --> 00:31:50.900
<00:31:46.300>I <00:31:46.440>am <00:31:46.580>more <00:31:46.720>of <00:31:46.860>a <00:31:47.000>devrel <00:31:47.139>and <00:31:47.280>I <00:31:47.419>also <00:31:47.560>work <00:31:47.700>with

645
00:31:50.900 --> 00:31:53.600
<00:31:50.900>a <00:31:51.075>lot <00:31:51.250>of <00:31:51.425>communities. <00:31:51.600>I <00:31:51.775>work <00:31:51.950>with <00:31:52.125>security <00:31:52.300>research

646
00:31:53.600 --> 00:31:56.700
<00:31:53.600>team <00:31:53.774>at <00:31:53.949>sneak <00:31:54.125>at <00:31:54.300>the <00:31:54.475>same <00:31:54.649>time. <00:31:54.824>I <00:31:55.000>connect

647
00:31:56.700 --> 00:32:00.000
<00:31:56.700>with <00:31:56.900>a <00:31:57.100>lot <00:31:57.300>of <00:31:57.500>see <00:31:57.700>so <00:31:57.900>as <00:31:58.100>with

648
00:31:59.200 --> 00:32:02.300
<00:31:59.200>or <00:31:59.480>security <00:31:59.760>leadership <00:32:00.040>people <00:32:00.320>so <00:32:00.600>that

649
00:32:02.300 --> 00:32:06.000
<00:32:02.300>we <00:32:02.533>talk <00:32:02.766>about <00:32:03.000>software <00:32:03.233>related <00:32:03.466>issues <00:32:03.700>software

650
00:32:05.100 --> 00:32:08.300
<00:32:05.100>security <00:32:05.300>issues <00:32:05.500>and <00:32:05.699>we <00:32:05.899>are <00:32:06.100>so <00:32:06.300>my <00:32:06.500>job

651
00:32:08.300 --> 00:32:11.300
<00:32:08.300>role <00:32:08.533>is <00:32:08.766>to <00:32:09.000>make <00:32:09.233>sure <00:32:09.466>that <00:32:09.700>I

652
00:32:11.300 --> 00:32:14.900
<00:32:11.300>help <00:32:11.500>developers <00:32:11.700>understand <00:32:11.899>security <00:32:12.100>rather <00:32:12.300>than <00:32:12.500>forcing <00:32:12.700>Security

653
00:32:14.900 --> 00:32:15.400
<00:32:14.900>on <00:32:15.350>them.

654
00:32:16.500 --> 00:32:19.800
<00:32:16.500>So <00:32:16.616>that's <00:32:16.733>my <00:32:16.850>main <00:32:16.966>role <00:32:17.083>so <00:32:17.200>that <00:32:17.316>I <00:32:17.433>can <00:32:17.550>be <00:32:17.666>friend <00:32:17.783>to <00:32:17.900>developers

655
00:32:19.800 --> 00:32:21.100
<00:32:19.800>rather <00:32:20.190>than <00:32:20.580>an <00:32:20.969>enemy.

656
00:32:23.100 --> 00:32:23.900
<00:32:23.100>So <00:32:23.460>that's <00:32:23.820>fantastic.

657
00:32:24.600 --> 00:32:27.300
<00:32:24.600>So <00:32:24.833>we <00:32:25.066>got <00:32:25.300>another <00:32:25.533>question <00:32:25.766>from <00:32:26.000>Pete.

658
00:32:28.200 --> 00:32:31.600
<00:32:28.200>Who <00:32:28.355>wants <00:32:28.511>to <00:32:28.666>know <00:32:28.822>currently? <00:32:28.977>I'm <00:32:29.133>still <00:32:29.288>at <00:32:29.444>University <00:32:29.600>doing

659
00:32:31.600 --> 00:32:34.100
<00:32:31.600>computer <00:32:32.066>science. <00:32:32.533>Do <00:32:33.000>you

660
00:32:34.100 --> 00:32:37.700
<00:32:34.100>have <00:32:34.274>any <00:32:34.449>tips <00:32:34.625>to <00:32:34.800>get <00:32:34.975>started <00:32:35.149>in <00:32:35.324>in <00:32:35.500>cyber

661
00:32:37.700 --> 00:32:40.800
<00:32:37.700>SEC <00:32:37.900>or <00:32:38.100>any <00:32:38.300>must <00:32:38.500>Do's <00:32:38.700>or <00:32:38.900>maybe <00:32:39.100>also

662
00:32:40.800 --> 00:32:42.400
<00:32:40.800>some <00:32:41.500>mustard <00:32:42.200>tones?

663
00:32:43.300 --> 00:32:46.900
<00:32:43.300>There's <00:32:43.649>no <00:32:44.000>don't <00:32:44.350>accept <00:32:44.700>if

664
00:32:46.900 --> 00:32:49.600
<00:32:46.900>you <00:32:47.055>try <00:32:47.211>and <00:32:47.366>exploit <00:32:47.522>a <00:32:47.677>server, <00:32:47.833>which <00:32:47.988>is <00:32:48.144>live <00:32:48.300>on

665
00:32:49.600 --> 00:32:53.100
<00:32:49.600>the <00:32:49.800>internet. <00:32:50.000>So <00:32:50.199>the <00:32:50.399>do's <00:32:50.600>are <00:32:50.800>connect <00:32:51.000>with

666
00:32:53.100 --> 00:32:57.300
<00:32:53.100>the <00:32:53.255>fellow <00:32:53.411>people <00:32:53.566>who <00:32:53.722>are <00:32:53.877>very <00:32:54.033>interested <00:32:54.188>for <00:32:54.344>example, <00:32:54.500>ovas

667
00:32:56.300 --> 00:32:59.300
<00:32:56.300>and <00:32:56.533>many <00:32:56.766>other <00:32:57.000>security <00:32:57.233>communities <00:32:57.466>look <00:32:57.700>for

668
00:32:59.300 --> 00:33:02.200
<00:32:59.300>security <00:32:59.475>communities <00:32:59.649>around <00:32:59.825>you. <00:33:00.000>I'm <00:33:00.175>sure <00:33:00.350>you'll <00:33:00.524>find <00:33:00.700>one

669
00:33:02.200 --> 00:33:05.100
<00:33:02.200>and <00:33:02.355>if <00:33:02.511>you're <00:33:02.666>not <00:33:02.822>able <00:33:02.977>to <00:33:03.133>find <00:33:03.288>one, <00:33:03.444>let <00:33:03.600>me

670
00:33:05.100 --> 00:33:07.500
<00:33:05.100>know. <00:33:05.274>I'll <00:33:05.449>be <00:33:05.625>able <00:33:05.800>to <00:33:05.975>help <00:33:06.149>you <00:33:06.324>out. <00:33:06.500>So

671
00:33:09.100 --> 00:33:13.100
<00:33:09.100>So <00:33:09.227>what <00:33:09.354>we <00:33:09.481>can <00:33:09.609>do <00:33:09.736>is <00:33:09.863>we <00:33:09.990>can <00:33:10.118>connect <00:33:10.245>with <00:33:10.372>each <00:33:10.500>individual

672
00:33:12.100 --> 00:33:15.200
<00:33:12.100>as <00:33:12.274>part <00:33:12.449>of <00:33:12.625>the <00:33:12.800>community <00:33:12.975>for <00:33:13.149>me. <00:33:13.324>I <00:33:13.500>was

673
00:33:15.200 --> 00:33:18.400
<00:33:15.200>just <00:33:15.375>working <00:33:15.550>on <00:33:15.725>the <00:33:15.900>environment <00:33:16.075>like <00:33:16.250>office <00:33:16.425>and <00:33:16.600>that's

674
00:33:18.400 --> 00:33:21.200
<00:33:18.400>all <00:33:18.540>was <00:33:18.680>my <00:33:18.820>life. <00:33:18.960>But <00:33:19.100>then <00:33:19.240>when <00:33:19.380>I <00:33:19.520>got <00:33:19.660>introduced <00:33:19.800>to

675
00:33:21.200 --> 00:33:24.800
<00:33:21.200>overspend <00:33:21.375>the <00:33:21.550>some <00:33:21.725>other <00:33:21.900>local <00:33:22.075>communities <00:33:22.250>like <00:33:22.425>null <00:33:22.600>I

676
00:33:24.800 --> 00:33:28.300
<00:33:24.800>realized <00:33:25.000>there's <00:33:25.200>much <00:33:25.399>more <00:33:25.600>to <00:33:25.800>learn <00:33:26.000>in <00:33:26.200>cybersecurity

677
00:33:27.300 --> 00:33:30.600
<00:33:27.300>in <00:33:27.500>in <00:33:27.700>the <00:33:27.899>world <00:33:28.100>in <00:33:28.300>it <00:33:28.500>because <00:33:28.700>you

678
00:33:30.600 --> 00:33:33.200
<00:33:30.600>you <00:33:30.727>are <00:33:30.854>you <00:33:30.981>can <00:33:31.109>be <00:33:31.236>a <00:33:31.363>developer. <00:33:31.490>You <00:33:31.618>can <00:33:31.745>be <00:33:31.872>a <00:33:32.000>security

679
00:33:33.200 --> 00:33:36.400
<00:33:33.200>person. <00:33:33.307>You <00:33:33.415>can <00:33:33.523>be <00:33:33.630>a <00:33:33.738>tester. <00:33:33.846>You <00:33:33.953>can <00:33:34.061>be <00:33:34.169>a <00:33:34.276>security <00:33:34.384>person. <00:33:34.492>So <00:33:34.600>this

680
00:33:36.400 --> 00:33:39.100
<00:33:36.400>security <00:33:36.600>attached <00:33:36.800>to <00:33:37.000>everything <00:33:37.200>even <00:33:37.400>in <00:33:37.600>our <00:33:37.800>phones

681
00:33:39.100 --> 00:33:42.500
<00:33:39.100>a <00:33:39.300>laptops <00:33:39.500>everything <00:33:39.699>needs <00:33:39.899>security, <00:33:40.100>right? <00:33:40.300>So <00:33:40.500>you

682
00:33:42.500 --> 00:33:45.200
<00:33:42.500>get <00:33:42.655>connect <00:33:42.811>with <00:33:42.966>those <00:33:43.122>people <00:33:43.277>and <00:33:43.433>they <00:33:43.588>teach <00:33:43.744>you <00:33:43.900>so

683
00:33:45.200 --> 00:33:47.300
<00:33:45.200>many <00:33:45.327>new <00:33:45.454>things <00:33:45.581>and <00:33:45.709>you <00:33:45.836>teach <00:33:45.963>them <00:33:46.090>a <00:33:46.218>lot <00:33:46.345>of <00:33:46.472>new <00:33:46.600>things.

684
00:33:48.200 --> 00:33:51.300
<00:33:48.200>So <00:33:48.355>Community <00:33:48.511>is <00:33:48.666>one <00:33:48.822>place <00:33:48.977>where <00:33:49.133>you <00:33:49.288>should <00:33:49.444>start <00:33:49.600>off

685
00:33:51.300 --> 00:33:54.300
<00:33:51.300>look <00:33:51.500>for <00:33:51.700>communities <00:33:51.899>the <00:33:52.100>cyber <00:33:52.300>security <00:33:52.500>communities <00:33:52.700>on

686
00:33:54.300 --> 00:33:57.700
<00:33:54.300>Meetup <00:33:54.440>and <00:33:54.580>events <00:33:54.720>right <00:33:54.860>many <00:33:55.000>other <00:33:55.139>places <00:33:55.280>and <00:33:55.419>then <00:33:55.560>we <00:33:55.700>are

687
00:33:57.700 --> 00:34:00.300
<00:33:57.700>devs <00:33:57.827>is <00:33:57.954>there <00:33:58.081>where <00:33:58.209>there <00:33:58.336>are <00:33:58.463>so <00:33:58.590>many <00:33:58.718>security <00:33:58.845>events <00:33:58.972>are <00:33:59.100>hosted.

688
00:34:03.900 --> 00:34:07.800
<00:34:03.900>So <00:34:04.100>as <00:34:04.300>softness <00:34:04.500>a <00:34:04.700>group <00:34:04.900>effort, <00:34:05.100>so <00:34:05.300>and

689
00:34:06.800 --> 00:34:09.400
<00:34:06.800>with <00:34:07.266>another <00:34:07.733>question <00:34:08.199>from

690
00:34:09.400 --> 00:34:09.800
David.

691
00:34:11.100 --> 00:34:14.600
<00:34:11.100>And <00:34:11.299>can <00:34:11.500>you <00:34:11.699>comment <00:34:11.900>about <00:34:12.100>social <00:34:12.299>engineering <00:34:12.500>is

692
00:34:14.600 --> 00:34:17.000
<00:34:14.600>it <00:34:14.833>the <00:34:15.066>biggest <00:34:15.299>threat <00:34:15.533>now <00:34:15.766>in <00:34:16.000>security?

693
00:34:26.300 --> 00:34:30.000
<00:34:26.300>It's <00:34:26.427>one <00:34:26.554>of <00:34:26.681>the <00:34:26.809>biggest <00:34:26.936>thread <00:34:27.063>I <00:34:27.190>wouldn't <00:34:27.318>say <00:34:27.445>it's <00:34:27.572>one. <00:34:27.700>It's

694
00:34:29.100 --> 00:34:32.600
<00:34:29.100>the <00:34:29.239>biggest <00:34:29.380>threat <00:34:29.520>but <00:34:29.659>it's <00:34:29.799>one <00:34:29.940>of <00:34:30.080>the <00:34:30.219>biggest <00:34:30.360>threats <00:34:30.500>because

695
00:34:32.600 --> 00:34:35.300
<00:34:32.600>social <00:34:32.833>engineering <00:34:33.066>is <00:34:33.299>so <00:34:33.533>common <00:34:33.766>these <00:34:34.000>days

696
00:34:35.300 --> 00:34:38.600
<00:34:35.300>and <00:34:35.427>then <00:34:35.554>you <00:34:35.681>have <00:34:35.809>so <00:34:35.936>much <00:34:36.063>information <00:34:36.190>lying <00:34:36.318>over <00:34:36.445>the <00:34:36.572>Internet. <00:34:36.700>So

697
00:34:38.600 --> 00:34:41.700
<00:34:38.600>it's <00:34:38.799>easy <00:34:39.000>to <00:34:39.199>get <00:34:39.400>those <00:34:39.600>information. <00:34:39.799>So <00:34:40.000>that's

698
00:34:41.700 --> 00:34:44.500
<00:34:41.699>why <00:34:41.875>it's <00:34:42.049>it <00:34:42.225>becomes <00:34:42.399>easy. <00:34:42.574>And <00:34:42.750>then <00:34:42.924>those <00:34:43.100>fishing

699
00:34:44.500 --> 00:34:47.900
<00:34:44.500>attacks <00:34:44.675>all <00:34:44.850>those <00:34:45.025>things <00:34:45.199>become <00:34:45.375>even <00:34:45.550>more <00:34:45.725>easier <00:34:45.900>because

700
00:34:47.900 --> 00:34:48.300
<00:34:47.900>of <00:34:48.260>that.

701
00:34:49.200 --> 00:34:52.300
<00:34:49.199>But <00:34:49.339>it <00:34:49.480>I <00:34:49.620>wouldn't <00:34:49.759>say <00:34:49.899>that <00:34:50.040>it <00:34:50.179>is <00:34:50.319>the <00:34:50.460>biggest <00:34:50.600>but

702
00:34:52.300 --> 00:34:56.000
<00:34:52.300>it's <00:34:52.407>one <00:34:52.515>of <00:34:52.623>the <00:34:52.730>biggest <00:34:52.838>because <00:34:52.946>there <00:34:53.053>are <00:34:53.161>many <00:34:53.269>other <00:34:53.376>attacks <00:34:53.484>like <00:34:53.592>malware's <00:34:53.700>security

703
00:34:55.900 --> 00:34:58.100
<00:34:55.900>misconfigurations <00:34:56.133>and <00:34:56.366>many <00:34:56.600>other <00:34:56.833>things <00:34:57.066>which <00:34:57.300>are

704
00:34:58.100 --> 00:34:59.500
<00:34:58.100>also <00:34:58.730>equally <00:34:59.360>important.

705
00:35:04.100 --> 00:35:07.500
<00:35:04.100>All <00:35:04.333>right. <00:35:04.566>Thanks <00:35:04.799>for <00:35:05.033>that. <00:35:05.266>Another <00:35:05.500>question

706
00:35:07.500 --> 00:35:10.400
<00:35:07.500>from <00:35:07.780>Stefan. <00:35:08.060>Have <00:35:08.340>you <00:35:08.620>any <00:35:08.900>books

707
00:35:10.400 --> 00:35:11.700
<00:35:10.400>or <00:35:10.790>blocks <00:35:11.180>to <00:35:11.569>recommend?

708
00:35:13.400 --> 00:35:16.900
<00:35:13.400>Oh, <00:35:13.600>yes. <00:35:13.800>Absolutely. <00:35:14.000>I <00:35:14.200>would <00:35:14.400>say <00:35:14.600>blogs <00:35:14.800>by

709
00:35:16.900 --> 00:35:19.400
<00:35:16.900>tannage <00:35:17.180>anchor <00:35:17.460>are <00:35:17.740>amazing <00:35:18.020>specially <00:35:18.300>around

710
00:35:19.400 --> 00:35:22.300
<00:35:19.400>app <00:35:19.575>security <00:35:19.750>you <00:35:19.925>would <00:35:20.100>totally <00:35:20.275>love <00:35:20.450>them. <00:35:20.625>And <00:35:20.800>if

711
00:35:22.300 --> 00:35:25.400
<00:35:22.300>you <00:35:22.440>want <00:35:22.580>to <00:35:22.720>know <00:35:22.860>more <00:35:23.000>about <00:35:23.140>app <00:35:23.280>security <00:35:23.420>or <00:35:23.560>anything <00:35:23.700>if

712
00:35:25.400 --> 00:35:28.300
<00:35:25.400>you <00:35:25.540>want <00:35:25.680>to <00:35:25.820>break <00:35:25.960>into <00:35:26.100>infosec <00:35:26.240>or <00:35:26.380>cyber <00:35:26.520>security. <00:35:26.660>I <00:35:26.800>have

713
00:35:28.300 --> 00:35:31.200
<00:35:28.300>a <00:35:28.416>YouTube <00:35:28.533>channel, <00:35:28.650>you'll <00:35:28.766>search <00:35:28.883>with <00:35:29.000>my <00:35:29.116>name. <00:35:29.233>You'll <00:35:29.350>be <00:35:29.466>able <00:35:29.583>to <00:35:29.700>find

714
00:35:31.200 --> 00:35:34.700
<00:35:31.200>it. <00:35:31.355>There <00:35:31.511>are <00:35:31.666>so <00:35:31.822>many <00:35:31.977>videos <00:35:32.133>Guru <00:35:32.288>over <00:35:32.444>Jeet. <00:35:32.600>There's

715
00:35:34.700 --> 00:35:37.400
<00:35:34.700>so <00:35:34.875>much <00:35:35.049>so <00:35:35.225>much <00:35:35.399>resources <00:35:35.575>out <00:35:35.750>there. <00:35:35.924>You'll <00:35:36.100>be

716
00:35:37.400 --> 00:35:40.700
<00:35:37.400>able <00:35:37.600>to <00:35:37.800>find <00:35:38.000>projects <00:35:38.200>chapters <00:35:38.400>and <00:35:38.600>whatnot <00:35:38.800>everything

717
00:35:40.700 --> 00:35:40.900
there.

718
00:35:43.200 --> 00:35:46.700
<00:35:43.200>All <00:35:43.375>right. <00:35:43.549>Thanks <00:35:43.725>so <00:35:43.899>that <00:35:44.075>as <00:35:44.250>well <00:35:44.424>Pete. <00:35:44.600>Oh,

719
00:35:46.700 --> 00:35:49.100
<00:35:46.700>that's <00:35:46.980>no <00:35:47.259>question. <00:35:47.540>But <00:35:47.819>I <00:35:48.100>read

720
00:35:49.100 --> 00:35:52.800
<00:35:49.100>it <00:35:49.255>to <00:35:49.411>you <00:35:49.566>regardless. <00:35:49.722>Thank <00:35:49.877>you <00:35:50.033>so <00:35:50.188>much <00:35:50.344>really <00:35:50.500>loved

721
00:35:52.800 --> 00:35:55.400
<00:35:52.800>your <00:35:53.150>presentation. <00:35:53.500>Thank <00:35:53.850>you. <00:35:54.200>Thank

722
00:35:55.400 --> 00:35:56.900
<00:35:55.400>you <00:35:55.670>big <00:35:55.940>fan <00:35:56.210>here. <00:35:56.480>And <00:35:56.750>then

723
00:35:58.300 --> 00:35:58.700
<00:35:58.300>Thank <00:35:58.660>you.

724
00:36:00.300 --> 00:36:00.400
so

725
00:36:02.600 --> 00:36:05.500
<00:36:02.600>Also, <00:36:02.833>maybe <00:36:03.066>you <00:36:03.299>you <00:36:03.533>mentioned <00:36:03.766>that <00:36:04.000>you

726
00:36:05.500 --> 00:36:08.200
<00:36:05.500>went <00:36:05.700>to <00:36:05.900>a <00:36:06.100>lot <00:36:06.300>of <00:36:06.500>communities <00:36:06.700>in <00:36:06.900>your

727
00:36:08.200 --> 00:36:11.500
<00:36:08.200>early <00:36:08.375>days <00:36:08.549>as <00:36:08.725>a <00:36:08.899>tech <00:36:09.075>woman <00:36:09.250>and <00:36:09.424>maybe <00:36:09.600>do

728
00:36:11.500 --> 00:36:14.200
<00:36:11.500>you <00:36:11.700>remember <00:36:11.900>what <00:36:12.100>your <00:36:12.300>first <00:36:12.500>computer <00:36:12.700>was <00:36:12.900>or

729
00:36:14.200 --> 00:36:16.500
<00:36:14.200>maybe <00:36:14.399>the <00:36:14.600>first <00:36:14.799>machine <00:36:15.000>you <00:36:15.200>worked <00:36:15.399>on <00:36:15.600>on?

730
00:36:18.400 --> 00:36:21.600
<00:36:18.400>I <00:36:18.633>remember <00:36:18.866>using <00:36:19.100>Windows <00:36:19.333>NT. <00:36:19.566>Oh <00:36:19.800>my

731
00:36:21.600 --> 00:36:24.600
<00:36:21.600>God, <00:36:21.775>that <00:36:21.950>was <00:36:22.125>so <00:36:22.299>slow. <00:36:22.475>And <00:36:22.650>and <00:36:22.825>yeah <00:36:23.000>and

732
00:36:24.600 --> 00:36:27.300
<00:36:24.600>Windows <00:36:24.799>NT <00:36:25.000>and <00:36:25.200>if <00:36:25.400>I <00:36:25.600>think <00:36:25.799>about <00:36:26.000>it

733
00:36:27.300 --> 00:36:30.400
<00:36:27.300>now, <00:36:27.500>we <00:36:27.700>have <00:36:27.900>so <00:36:28.100>much <00:36:28.300>fastest <00:36:28.500>internet <00:36:28.700>and

734
00:36:30.400 --> 00:36:33.500
<00:36:30.400>the <00:36:30.750>systems <00:36:31.100>earlier <00:36:31.450>20 <00:36:31.800>gigs

735
00:36:33.500 --> 00:36:36.500
<00:36:33.500>was <00:36:33.655>like, <00:36:33.811>oh <00:36:33.966>my <00:36:34.122>God <00:36:34.277>what <00:36:34.433>we've <00:36:34.588>got <00:36:34.744>and <00:36:34.900>whatnot,

736
00:36:36.500 --> 00:36:36.900
right?

737
00:36:37.900 --> 00:36:40.600
<00:36:37.900>Now <00:36:38.180>it <00:36:38.460>is <00:36:38.740>nothing <00:36:39.020>with <00:36:39.300>the

738
00:36:40.600 --> 00:36:43.700
<00:36:40.600>we <00:36:40.775>have <00:36:40.950>had <00:36:41.125>this <00:36:41.299>which <00:36:41.475>are <00:36:41.650>in <00:36:41.825>TBS. <00:36:42.000>So

739
00:36:43.700 --> 00:36:46.400
<00:36:43.700>I <00:36:43.933>remember <00:36:44.166>using <00:36:44.399>those <00:36:44.633>slow <00:36:44.866>modems <00:36:45.100>and

740
00:36:46.400 --> 00:36:49.400
<00:36:46.400>lap <00:36:46.750>desktops <00:36:47.100>and <00:36:47.450>what <00:36:47.800>no

741
00:36:49.400 --> 00:36:53.300
<00:36:49.400>what <00:36:49.633>not <00:36:49.866>and <00:36:50.100>then <00:36:50.333>typing <00:36:50.566>learning <00:36:50.800>typewriters

742
00:36:52.300 --> 00:36:55.500
<00:36:52.300>so <00:36:52.455>that <00:36:52.611>we <00:36:52.766>can <00:36:52.922>have <00:36:53.077>a <00:36:53.233>good <00:36:53.388>speed <00:36:53.544>and <00:36:53.700>whatnot.

743
00:36:56.900 --> 00:37:00.300
<00:36:56.900>On <00:36:57.250>typewriters <00:36:57.600>actually, <00:36:57.950>well, <00:36:58.300>that's

744
00:36:59.300 --> 00:37:00.600
interesting.

745
00:37:02.400 --> 00:37:05.200
<00:37:02.400>So <00:37:02.866>and <00:37:03.333>do <00:37:03.800>we

746
00:37:05.200 --> 00:37:08.600
<00:37:05.200>have <00:37:05.307>another <00:37:05.415>our <00:37:05.523>era? <00:37:05.630>I <00:37:05.738>don't <00:37:05.846>know <00:37:05.953>if <00:37:06.061>you <00:37:06.169>can <00:37:06.276>read <00:37:06.384>it. <00:37:06.492>But <00:37:06.600>a

747
00:37:08.600 --> 00:37:11.600
<00:37:08.600>lot <00:37:08.727>of <00:37:08.854>people <00:37:08.981>are <00:37:09.109>complementing <00:37:09.236>you <00:37:09.363>in <00:37:09.490>the <00:37:09.618>chats <00:37:09.745>that <00:37:09.872>you're <00:37:10.000>awesome

748
00:37:11.600 --> 00:37:14.200
<00:37:11.600>and <00:37:11.775>awesome <00:37:11.950>presentation, <00:37:12.125>and <00:37:12.299>they're <00:37:12.475>thanking <00:37:12.650>you <00:37:12.825>for <00:37:13.000>it.

749
00:37:15.100 --> 00:37:16.600
<00:37:15.100>And <00:37:15.437>thank <00:37:15.775>you <00:37:16.112>so <00:37:16.450>much.

750
00:37:17.900 --> 00:37:18.000
So

751
00:37:19.500 --> 00:37:22.500
<00:37:19.500>Montana <00:37:19.640>thank <00:37:19.780>you <00:37:19.920>so <00:37:20.060>much <00:37:20.200>for <00:37:20.340>the <00:37:20.480>awesome <00:37:20.620>presentation. <00:37:20.760>It <00:37:20.900>was

752
00:37:22.500 --> 00:37:23.500
<00:37:22.500>a <00:37:22.725>pleasure <00:37:22.950>having <00:37:23.175>you <00:37:23.400>today.

753
00:37:24.400 --> 00:37:27.200
<00:37:24.400>I <00:37:24.540>wish <00:37:24.680>you <00:37:24.820>very <00:37:24.960>well <00:37:25.100>and <00:37:25.240>hope <00:37:25.380>to <00:37:25.520>see <00:37:25.660>you <00:37:25.800>soon.

754
00:37:27.200 --> 00:37:29.000
<00:37:27.200>Greetings <00:37:27.666>to <00:37:28.133>India, <00:37:28.600>right?

755
00:37:30.400 --> 00:37:30.800
<00:37:30.400>Thank <00:37:30.760>you.