[Music]
so right everyone welcome to mch 2022
the abacus stage and i'm very happy to
introduce breno davinta uh talking about
open cat security through cat's eyes so
take away breno
[Applause]
uh thank you very much yeah um you are
going to see a lot of
cat pictures in this presentation so be
alert and be aware
if you hate cats bad luck for you
um i'm brendon winter i'm the harbor
master and at the ministry of
health welfare and sports i'm the chief
security privacy operation for the
corona tech we talked about it yesterday
just a quick reminder this is my kid
brani
brani benani is how i cuddle her
and that was the name of a project so we
started the website then people said
like that's kind of stupid this is uh
hiro branni and kaiko in a government
system it looks like this then somebody
said like stop using cat names then the
minister said you can use cat names so
this is what we are going to talk about
today and with the corona tech there are
a few
[Music]
projects that we have to do
contact racing contact racing app
the
i talked about
the
the eu dcc the qr codes
um we built a
ehr for hospitals
in six weeks times we have exception
routes um we do fraud protection red
teaming and we are also supporting the
other nations in our kingdom
aruba and sid martin so that's a lot to
deal with and then what do we need to do
of course the continuous monitoring
and you have all the occasional issues
the shortage of people the high stress
level
especially the political environment
that you're in and then all the tasks
you have to do starting with pen testing
code reviews ending with your risk
assessments and your weekly starting at
7 00
pm on a saturday
ddos it's those standard things you have
to deal with all the time and with a
small group of people doing that that is
kind of a hard
thing
now i've been in security for over 30
years and
over 40 nearly 40.
and um one of the things i've learned
from the thousands of incidents i saw is
whenever hits the van
a
configuration management database is
totally different from reality on the
left hand side you see amsterdam in 1538
and that is generally the map when you
end up at an incident that they give you
this is amsterdam in reality
so
yeah and and for my colleague cleo sorry
but uh this is the harsh reality
so
this needs to change and this is an
issue for us as well and then
what we're doing to prevent incidents is
basically finding the famous needle in a
haystack
and as i've shown you we've got all
sorts of projects going on and different
nations to support so basically i'm
searching in more haystacks than
basically would fit on a powerpoint
slide
so far so good then the game this day
when we had this corona testing facility
that was hacked by the dutch news author
outlet rtl news
and basically what they found was a
google firebase that was in development
mode
and yeah then you can go through all the
data
and parliament said um to the minister
you have to
investigate all these parties yeah but
it's not a job yes you have to
so we started continuous monitoring and
that was for up to 70 companies at the
same time
there isn't a single security company
that will say like oh sure we'll help
you with this one
um because it's highly political
sensitive it's all open so there we were
so we did
a lot of manual scanning in a weekend
found hundreds of vulnerabilities at
these
at these facilities
and then the next
question came okay now we've sent the
information over
how do we know for sure that it was all
fixed and then you start scanning again
and then this company will go like no no
no there was nothing wrong it's a false
positive
of or
it wasn't really a problem
and then we found other stuff as well
for instance one of these
facilities basically said like okay
we've got secure meal
for healthcare applications
we let them
be part of our system
and then somebody by accident discovered
that they turned that off because you
have to buy a subscription of a couple
of euros per month that apparently was
too expensive
how do you monitor that altogether
so
there were a lot of issues and it's not
even that simple because there's one
other issue as well it's not only about
security it's also about what makes
us as team but also the minister
vulnerable
and that might also be security issues
that aren't there
so we stopped talking about security and
we started to talk about everything that
makes you vulnerable
that really doesn't scale down the
problem
so we decided to go for a tool and
since we're talking about
vulnerabilities the dutch word is quetz
by hayden
and we want to analyze them and it's a
tool so we call it the quest behavior
analysis tool
and for behold that's the dutch word cat
for the ones that were in my lecture
yesterday
this is our team logo that
is perfectly fine for the tool as well
so we learned a couple of lessons and
one of the things that we should do
is prove that if we found something
that this is really true
and if something changes i want to be
alerted
and i don't know what can change but if
anything changes i want to be alerted
and then we found that there were
basically no tools that really
understood the dutch context properly
let alone the medical context so long
story short
um we needed something that
would be able to scan would be able to
do other stuff but um
also doesn't violate the dutch laws
all one could say i was looking for an
aya lake in the world miksao
so how do i realize this
help
so i phoned my friend jan klopper
and said like yum help and john is a
hacker
oh
[Applause]
i have i know i have aged a bit yes it's
true
um
so yeah we had a problem
and and bennett decided on calling me i
don't know why but you know these things
happen well i picked you because you
were allergic to cats this is true yes
uh but you didn't know that back then
yeah and the first thing you say said
was
stop throwing data away
yep
so what we see in
the general availability of security
tools that you
start scanning and the end product is
always you know the vulnerability that
you find the end product is always this
report saying you have to fix this you
have to fix that
but to get there you're probably gonna
you know do a lot of queries collect a
lot of information
and
all of these tools next to each other do
that again and again every time they you
know do a dns query do a you know
connection to the server collect some
information parse it in their own way
make their own answers put the answer in
the report and you get only the answer
from the report and we decided to
do it a bit differently and say okay
each one of these little steps
should be should be a little program by
itself the unix philosophy
and every time we do
one of these little loops we're going to
collect the information
both raw so we can actually prove that
we did it
and we're going to collect whatever
comes out of it in the database
how do we prove it
good question
um
so we decided on running all the tools
in containers
very fancy
but it you know it it's not a means to
an internet it's actually something that
helps us
and we run the container for example
nmap very simple tool we run it we
collect the information that goes into
the container the ip address
we collect um the version the hash of
the image
and we collect whatever comes out of it
and that gives a pretty good pretty good
complete answer of what the tool did
and then we allow someone else an
external party to sign that package hash
it sign it timestamp it so make sure you
prove what we did so basically the
external timestamp surface make sure
it's forensically sound
correct and then we do that for every
step along the way
while collecting information to build
this graph
yeah and this graph we built
in a cross-time database so that we can
see the status of an object in all
moments in time
so i can
compare an object on january 1st
around midnight to the status of the
object right now
yeah so we have the graph
and the graph that we have today might
be slightly different than the graph we
had yesterday and that allows us to
obviously see the differences
but since we have this database of
information we have all the little nodes
of information we can use that graph to
then and only then
start looking for patterns start looking
for objects start looking for things
that we don't like in our graph in our
reality
um within our set of business rules so
if you
if you put everything in objects you put
needles with needles and hey with hay
yep so if you say i'm looking for a
needle then basically you can say hey
here's a better here's your bunch of
needles yes
okay
the question is how do we get the daiita
and we get
data with buffus you're going to
to you're going to learn a little bit of
dutch as well buffy is the dutch word of
rescue
and basically it's a plugin yeah so we
have a bunch of different plugins and
buffies is the first one
and it's the one that goes out and gets
data um it goes on the internet or it
goes you know look at the various tools
or apis
um or maybe in internal or external
databases and it only you know it has a
question it goes and fetch the raw data
doesn't really matter which format it is
in
and it collects it to be stored in our
forensic database
they are just facts
so
in a regular tool
for example if you run nmap um and a lot
of tools will immediately say oh you got
port 22 open don't do that
i don't care about party you know it's
fine do whatever you want
i get that a pen tester you know
probably has a reason not to do port 22
on the internet
but that's a business rule
and the business rule comes later
because we made a distinction between
facts and conclusions i have got this
guy walking around along canada and he's
basically always doing a finding and
then saying like okay
you have to decide if it's important for
you or not so he says like okay breno
i'm looking at your house
i see
smoke coming out of the roof and flames
if this is important to you
the logic step would be to dial one one
two and ask for the fire brigade
optionally optionally optionally you
know i don't i don't know what you're by
the way i call him my chief conspiracy
officer
um
we have a whole bunch of
plugins already we need a lot more so
um
i'll do the shout out now come to open
cat
tent and join uh join the scene
but then i've got data and data is still
something that is unstructured
yep
so by now we've ran all these buffers
and we collected all this raw
information probably just command line
outputs or json blobs from somewhere
and
in that data is a lot
extra information
we need to process that to actually you
know make sense of make needles
and what we do is we have a separate set
of plugins normalizers or whiskers as we
call them and we
you know we couple each whisker either
to a buffer to a mime type and say oh
let's see we have text html forensic
proof what can we do with that we have
nmap output what could we do with that
and we scan that data
from the store
check it and if we find something that
we understand then we add it to the
database
but
today i understand only so much
and then all these people are going to
help and then i understand i know more
yes i know that's very interesting
so imagine having this you know vault of
data that you collected over many many
years over systems that you you know
have in production
um
and and
you know you had done this as you would
because brendo asked you to
and
it's a good morning you wake up and you
notice there's something wrong with your
website cpus are spiking every time a
browser visited and you find um
a bit of javascript code in there and
it's bitcoin mining
so it's essentially destroying the
planet
um
you find that bit of bitcoin code the
cryptominer and and you notice that you
you obviously missed it because you
didn't know it was there
what you can do from that point on is
you know collect that information you
write a normalizer that looks for this
specific bit of javascript
add it to cut to open cut and it will um
probably find another few of these you
know injected bits of html or javascript
in your various sites
because we had already downloaded all
the html we had already you know
collected the proof
so you can immediately start fixing
these things
but
you also have all the historic
information in your forensic store so
now the normalizer can start working
backwards over all that over all that
collected data and you know pinpoint the
moment in time because you know we have
a
crosstime database
where you know where we saw that bit of
javascript for the first time
and this obviously helps with
pinpointing you know when you were
attacked
um and by having that you know specific
moment you can probably also
dumb it down and you know look at other
log files to see how the hell they came
in because you know
seeing a bit of javascript in your
website is one thing knowing how they
got in is probably you know very
expensive
research yeah a bit of expensive
research yeah yeah and then we store all
the data in bytes is that one of my cats
definitely not it's simon's
but we store it forensically in our data
store
and then basically we go for the
business rules
yeah so business rules
very enterprising name i know um
business rules are
more or less like complex css queries
and
you have a set of data you have a tree
of information and what a business rule
actually does um we have one on screen
here it says okay every time an ip
address is added to the graph
i'd like to be ran
so it's more or less a state machine and
it does collect some other additional ip
information so ap port and websites
might be related to this ip address
and then we do some python magic
run over some crates and websites
we collect some ports and
you know if we have all the ports at
this computers and we can do this bit of
logic saying okay
if port 80 is open or port 443 is open
or not
you know then there's probably something
wrong
if so we'll add a finding yield defining
to the database and what this does is it
creates a new object in the graph
so if a exists b must also exist
but a or b or c you know this might be
more complex queries we try to keep them
simple and that opens up for instance
one possibility is that you say like
okay yesterday you had five ports open
today it's 12
maybe your firewall configuration is no
longer good yep but there's more
if i see that you're running a bit of
software for example wordpress
i can do you know
a query over all software instances i
can see that you're running wordpress if
this is wordpress
then there must also exist these other
1568 dependencies
it's deduction it's very simple
it's a simple business rule
and the business rule feeds on external
information and it you know it handles
every bit of wordpress in your site or
whatever you want yeah right there is
this nice example of the this this
corona test street they were using
wordpress and a new
common film nobility exposure came out
and that basically um
gave a cvss score of 9.8 which is kind
of serious
so after they after we downloaded it
i phoned the director of that testing
street and
within 10 minutes of getting the alert
the website was fixed i can't prove
that we prevented the hack but likely it
we did
yeah so the business rule was triggered
again when we renewed the list of cves
and
the second that happened we added all
the extra facts to the database yeah
there's only one thing you know the
buffers get the data
the bites feed them to the whiskers the
octopus
octopus is what we call the
the system that basically um does all
all the handling of the data and then
ultimately it ends up with bits
and bits is basically uh i'm sorry we we
run the bits and then basically you can
do your reporting etc we've obviously
got the interface for that
um
one of the interesting things yeah i'm
not happy oh yeah
one of the interesting things about
these bits is that like i said they add
data and objects back into the graph
they don't have to be findings but you
know they could be
and
once you alter the graph
you can then you know have another set
of bits
looking at that data again and say oh
wait a minute if you have that little
technical issue
then you're not compliant with for
example internet.nl and if you're not
complied with internet i don't know
we've added a finding for this saying oh
you're not compliant with this
then we can add you know another
business rule saying oh if you're not
compliant with internet rnl you're not
compliant with um nta
75 65.6 which is safe email for the
healthcare yeah so you can you build
these really big compliancy questions
and you know strip them down into
smaller technical questions simple
queries
yeah there's only one thing that i'm
totally not happy about
and that is um so far i have to do
everything myself start it click it
so
we've got a scheduler
mula another cat of one of the
developers
mula is our scheduler and we're now kind
of in you know in the
volume of search engines um
so we have lots of objects and every
object that we add to the graph either
triggers a bit or business rule but they
can also
be input for another set of buffers
if we find a hostname doesn't matter
where we collected it from
then we can probably do a bunch of
things like you know
dns queries we can try and see if
there's any sub-domains we can look for
certificates
via transparency um records so deciding
on which booth used to run
and in what you know what order
is something that the scheduler does
also deciding on when to rescan
some things don't need to be resched
every day some do
so if we're re-scanning then i can also
see that if somebody fix something it is
fixed correct yeah
so if we see something broken today
we collect proof of that and by the time
we rescan either manually or through the
scheduler
we also collect evidence on when you
fixed it
which is obviously very very useful
yeah but now we need to use the real
life practices and we need yeah need
some help for that
because i don't know how to do that so i
would like to invite oscar kuro
if he still dares
well actually the joke the actual joke
is
[Applause]
the actual joke is that this is a
government-approved picture in an actual
uh
interview that i gave
but let's face it
with respect to what my day job is
because my night job is yeah well having
fun and doing stuff but uh on the day
job site my responsibilities for an
entire ministry
consists out of uh depending on how you
count either 11 or 25 or even more
organizations
so i know what kind of things are
coming to me with respect to uh how to
prove that you're compliant how to prove
that you have your security in control
that you prove that your privacy
controls are if you can test them with
technical means that they are okay
yeah but before we do that now that we
are the three of us
um we need to get the op cut out
yeah and that needs to be published
so
when did we do that
uh we did it we did that on july 1st um
at 2200 hours and in the next morning we
got a call from davide
the nice guys who were before us and
good going
and we had the information disclosure so
i dare to say open source seems to work
yeah so thanks to the work of them that
they actually looked at the code so
quickly so fast and found something that
we've missed
it's that's the thing that i think it's
it's what open source should be well not
just us
i think it speaks to you know why we do
open cut
yeah many people have been looking at
you know at open cut
including some companies yeah
and we all missed it
and i think this is also one of the
examples again because we've seen all
kinds of other improvements that we've
had in the talk that we've had with
breno and and ron
in other days
that open source can work if you
actually put your mind to it and do the
right steps and then this can work again
so it's really appreciative okay but
your mission is really to make cat
holistic mch
um
[Music]
make cat holistic i'll slide you know
i'll let it slide that this one is not
with decay
[Applause]
so one of the goals is that we can scan
all the resources that we can actually
get from the infrastructure and if we
can't then use the agent services
which is going to be a lot because the
amount of organic organizations that you
have to deal with with the pandemic
that's fine that's a lot but the
ministry itself has at least
it's a bit bigger and i've got more
suppliers even to deal with and each of
them need to be compliant and the
compliance
rules and regulations will improve
because of all the yeah this thing only
works if the objects are being filled so
if you've got sufficient assets
to add discover assets well if
this is one of the things that i had to
do myself in the weekends because that's
the night job is try to scan
the infrastructure itself and then
discover oh my gosh we have more apis we
have more things to do more things to
control and everything is getting more
and more
so we need to have scale
in what we do
and this is why i think this is a cool
thing that we have
now is that we have the opportunity for
scaling
yeah and the cool thing is if you really
understand this um
think of log4j
what did most organizations do they
started scanning the moment the house is
on fire
collecting you know collecting where
log4j was
even included
um we didn't know i didn't know what it
was i mean i know java but that's about
it
but we already knew where it was yeah so
one of the yeah fridays if i'm not
mistaken i looked at the code kudos to
the northwave guys because i thought
that was the most readable python
implementation of scanning log4j then
extending that and then well telling to
the guys hey look i've scanned
the entire ministry at least from what i
could get
please help me
i need to make it into the service
yeah
and sharing is caring sharing is caring
so
so and yeah what
we also do is we also have to be open to
parliament and state look this is what
we do
and one of the important thing is that
we don't just keep it to ourselves and
but also make it available for all the
other ministries who have the same
challenges well not just ministries i
mean
and then we can go big
bigger
and why why limit ourselves to that yeah
there's all the friends that see cert
who
are going to scan hospitals with it
so that's kind of cool
there are so many opportunities
yeah
well this is basically the overview if
you want to know more there is time for
questions we did deliberately um left
some time for questions if we can think
we can understand if it's hard for you
to think about questions so we thought
of a couple of questions
um for you i still have questions so you
should have questions as well
exactly and if you don't dare to ask
questions now come to the open cut tent
and ask um questions then
any questions
hi
i was wondering if there's uh
there are plans for an api
yeah um so
the question was if we have any plans
for apis and i'm guessing you you mean
to extract data from cat and use it
somewhere else right
yeah also to configure it
um yeah sure sure so uh cat is open cut
is built out of various containers um as
you saw you know we have bytes the
forensic store you can use and interact
that with that
if you
skip the buffiest part and inject data
right into bytes the normals will pick
them up
you can also query bytes as well and you
know get data out of it
octopus same story you could add objects
there you can
query octopus for objects at any time
yeah just as with granny bernani what we
did is
make a big problem
and that's actually what i learned from
mendel moba
if you have a big puzzle make it a bunch
of small puzzles so what we did is
that's why we have all these little
projects
so that you make it a little bit smaller
yep
hello congratulations on building and
releasing such an excellent tool i have
a question regarding the forensics
collection and the keeping data
why discard it do you keep pcaps of all
your scans and if not why not
very good very good question thank you
yes it's on the roadmap and yes we have
promised this and no we don't do it yet
so
since we're running all the containers
with the buffets in there um it's a very
logical question and a very logical
thing to also collect all the network
traffic that is being generated because
you know
nmap might just output something but it
you know might have seen something else
it might have been collecting data
and once we have that data we could
easily make normalizers to scan through
that data as well scan through the pcap
files and you know
pick them apart and and collect even
more data points from there because we
might not know what we're looking for
you know until we discover this in the
future and also have the proof on what
kind of data we've actually sent out
over the network per scan or in this
case repair per container yeah so one of
the reasons we do this uh there's
actually two main reasons why we why we
do this we
want to make sure that
if we scan
that we have a proof of that we actually
scanned
this is something that's missing from
lots and lots of uh
pen testing reports did you actually
scan this i don't know
so if for example you do n mapping on on
an ip address and if it doesn't return
any ip addresses or ports does it show
up in your pen test
i'm guessing not
um how do you prove that you've actually
scanned it
by showing that you know you have the
input you have the output you probably
have the pcap file somewhere then you
have actual proof
that you've done your work and that you
didn't find anything
but if for someone like a reason nmap is
broken in that version and it
skips port 22
um
i want to make sure that i have proof of
you know running that specific version
and doing my job
i have run yeah there is a very good
reason for that there was this one case
where i was involved in this incident
with the city
with a city in the east of the
netherlands and they got fully
ransomware and then there i
stumbled across this
pen test and it didn't say that rdp was
open
but the funny thing was when you went to
showdown i could see that all the days
of the pen test
except one or two this port actually was
open so how can that be
and this is why you want to have that
proof
excellent answer thank you um also if
you're negotiating secure connections
like tls keep a copy of all the keys
that you've negotiated we do yes thank
you thank you
yeah so
my question was about your cmdb you said
it was not complete enough is open cut
more complete than you seem to be
there or is it more than it is
no it but
no i would not say that at this moment
definitely not but um this is why we are
focusing on the asset management
um because this is what you really want
and of course we'll draw all your
inferences from that
modern cmdbs have extra modules to scan
the network and have from actual
collections of whatever agents or
whatever data input you can then state
oh look the cmdb is not completing these
kinds of elements but today yeah and
today we got actually an offer of
somebody who um
who is looking in making in a buffer
that connects to ac cmdb so yeah this is
what we want to trigger as well
yeah there's two two rounds there
actually so you can use
you know you can use your existing cmdb
or
admin panel or whatever to feed into
open cut saying hey i have these assets
please scan them
you could go the other way as well and
say
let's scan everything that we can find
and then have a business rule saying
if there's something in the open cap in
octopus in the database which is not
present in my cmdb
there's a finding right something's
missing in your cmdb so
you can use both ways you know whatever
you want to do with it
um you said you scanned log files and is
that from outwards inwards the reason
for the question is like um if you have
normal users using the system you log ip
addresses and then maybe the gdpr comes
into play
if you say you have them hashed uh uh
subscribed that this is uh wasn't
changed how do you handle that
we're just looking at her we're not just
you know figuring out the answer um
[Laughter]
so a bunch of questions in there
actually so yes we are currently
scanning from the outside in
and
that means that we're not collecting
information on clients for example
but
we are working on um having more run
times so internal run times like uh in
your network in your vlans possibly even
agents
um that are on your
and collect raw files like forensic
information and then we can normalize
that and build the graph
once you start doing that obviously you
might you know
get personal information in there and
then you obviously have to deal with
that
the way
you do that is
defined in the model
um and you can we don't have it yet but
we can probably add something like
encrypted models saying this has a you
know a key rollover after so many months
and it you know gets destroyed
through that means um
at the moment we don't use any
we don't have any objects that actually
collect
private information
because we as the ministry don't want to
do that
nothing's stopping you though from
creating these models and adding these
boofies yourself and also of course we
already have the name spacing that makes
it possible to do internal scanning as
well and we've already got the project
name for that and that is kitten
cat on a pie small cat kitten
okay thank you
[Music]
hello and congratulations on this
beautiful product
and
my question is really since this does
look like a bunch of awesomeness
this is bound to take off
it means that more people want an open
cat
and one day a different ministry or
hospital is going to come along and says
we would like to get an open cat
instance
but we would like to get help with that
is there a company that can do that for
me and the question is have you
given any
thought about a
hybrid commercial ecosystem
around this because it is the question
is going to come um
yeah john
ian and i had a lot of thursday evenings
so one of the bullet points missing on
my slide is cereal entrepreneur um
because it's so cheesy
um
my mic is cancelling sometimes but yeah
have been thinking about this um
but obviously we just want to do this
within the industry first um someone
else is bound to you know take the
source and you know take it build some
some cloud platform out of this we don't
know we do have the name for it though
it's gas
get there's a surface yeah
so you know
we
we have in fact done half the work
already but uh breno how much
introductions and stories do you tell
how much presentations do you
give about
cut to how many people we have
don't like dozens and dozens of
presentations which time frame i think
dozens per i think we've done about 150
demonstrations uh in the last so so that
means you are lighting a fire
of enthusiasm oh yeah
and i speak from from experience i would
very much urge you to
get the thinking done barely but it's
open so hey here's your commercial
option but i must say look open yeah but
it's not open look it's on github
download clone do what you want no no
it's it's
the thing that i like about this is that
it's being told there's a story being
told there's a story behind it why a
philosophy
and this is also being told at each of
the presentations
not just to look how cool this quote
this tool is no why did we do it and how
do we do it and this is also one of the
first well let's face it tries from a
ministry perspective to
share something that we've built for
ourselves to a wider community way
beyond the scope of what we do this is
not quite the place to hash this out but
let me
i want to tell you i'm super
enthusiastic and i'm more worthy that it
will be
that it will get too hot and
so i have a i have a theory about this
um
if you're in
in this kind of space and you're
innovating um what happens is as soon as
a commercial company
stumbles on something that makes
money the sales drones come in that
could become terrible but let us yeah
well i'm i'm available for further
discussions because i i did it once and
it nearly failed
but i've got the feeling that we are
going to have some grappa at the entire
i'm looking forward to it
but
yeah
thank you
this is my cue
urgency
there is a grappa emergency going on on
mch there is no more grappa at the
italian embassy what
so tonight at 10 we will be having fun
at the opencut village
because we need to
and because
jan was so kind
to present the original design of her
so this is the original original this is
the only one do you know why my sister
is the designer of this
she made this
um
and we'd like to opt it off for you know
the good cause
um it's the only one in existence
so and niels
is doing kick-ass stuff going back and
forth delivering ambulances to the
ukraine delivering all sorts of um
there that they really really need can i
start bidding now
i have already made a 250 euro bit
so 250 from this gentleman here yeah who
is offering more i'm offering 300 open
cuts we can do that later
but tonight at 10 open cut village
guys come over we'll have a blast
together
[Applause]
and
stealing your mic to auction it off
i i have a very
serious question
and that is uh what is free cut and how
does it
work frequent is stupid because it's the
cop website made by anian
and um
i don't like it the funny thing is
anion presented free cut to us after we
you know launched the open cut website
and i couldn't resist and put free cut
uh nl in open cut the software
um
[Music]
and then asked anayan what are these
and he's like oh is that said online
yeah exactly
older than the the poster
so in that case is the relation between
free cat and open cat comparable to the
relation between free bsd and open bsd
no
[Laughter]
at this moment
it's politically charged
i think it's complicated that'll be the
status okay i have one statement and one
silly question the first statement is i
have some experience in open source
stuff and government
uh please listen to baird
[Laughter]
please we we will
uh
so why the comic sans i'll give you the
question
[Music]
why was one slide because it's really
honest i actually find the content of
the comic slide
kind of interesting
yeah the the comic sans was basically
made um because i wanted to annoy anyone
because i can
and there we have him hey
it's so good to see you yes i still have
one more question that is why was
freakout released five minutes before
open cut
[Laughter]
i'm guessing foresight
[Applause]
it's complicated
thank you
i guess there are no more questions
i've got a question actually so if we
want to implement um cat ourselves is
there a kitkat to help us do that
the name
[Laughter]
i don't know if you get those over here
hopefully
[Applause]
i try
yeah
that's been really interesting thank you
very much
thank you so much eddie asked comments
and the auction just to repeat i i just
wanted i ever expected really somebody
to ask the question is mch 2020
too in control but nobody did tell us
no we don't think so because those are
all the findings but there we go
i think that's the false positives
unlikely
thank you very much indeed for a very
interesting talk thank you
[Applause]