WEBVTT 00:00.000 --> 00:13.840 Next talk is from Ryan talking about the black pants are pants for your black hat. 00:13.840 --> 00:21.320 Can you guys hear me? 00:21.320 --> 00:22.320 Sweet. 00:22.320 --> 00:27.320 How's it going? 00:27.320 --> 00:33.840 So the black pants are pants for your black hat. 00:33.840 --> 00:36.320 So this is me. 00:36.320 --> 00:40.440 I'm just a normal guy that makes open source stuff. 00:40.440 --> 00:44.360 I'm barely open source hardware. 00:44.360 --> 00:51.080 I guess a lot of stuff I also do security and pen testing and then also privacy. 00:51.080 --> 00:57.800 So you might remember me from such projects as I built a self-shocking USB drive or I put 00:57.800 --> 01:04.640 a Linux router in a wall charger, various things I've talked about in the past. 01:04.640 --> 01:09.200 Okay, so before I start talking about the black pants, I'm going to talk about the flipper 01:09.200 --> 01:10.200 black hat. 01:10.200 --> 01:14.080 So I think most people here probably know what a flipper zero is. 01:14.120 --> 01:20.400 It's a small wireless device for the cute dolphin on it. 01:20.400 --> 01:25.280 In my opinion, it's just a nice compact thing that you can carry around. 01:25.280 --> 01:27.400 It has also two different radios on it. 01:27.400 --> 01:31.320 I think it's a lot of different things to a lot of different people. 01:31.320 --> 01:34.320 Definitely a good educational tool. 01:34.320 --> 01:38.720 So a while back, let's see if I want to see it. 01:38.720 --> 01:43.440 So a while back, I decided that I had one of these little flipper guys and I wanted to make 01:43.440 --> 01:48.960 a module for it and since I do open hardware, so obviously be a complete open source thing. 01:48.960 --> 01:53.280 So I have the community like what do you guys want, like what's cool. 01:53.280 --> 01:57.960 And this one guy said a Wi-Fi board that does the current evil portal attack, but also 01:57.960 --> 02:03.680 sends the user to the internet like the Wi-Fi pineapple from hack-5. 02:03.680 --> 02:09.080 So those of you that don't know what evil portal attack is a fishing attack where you 02:09.080 --> 02:13.360 put up a fake Wi-Fi and you try to fish people's credentials. 02:13.360 --> 02:17.880 And this is all for educational and ethical purposes only, but I might as well mention 02:17.880 --> 02:18.880 that. 02:18.880 --> 02:26.720 And then this person is asking for a specific variant of that where after your target is fish, 02:26.720 --> 02:28.480 they get pushed through the internet. 02:28.480 --> 02:32.480 So implementing something like this on Linux is super easy. 02:32.480 --> 02:37.840 You're basically just doing things with NF tables and networking and there's even Python 02:37.840 --> 02:42.040 packages and tons of kits and stuff you can do this with. 02:42.040 --> 02:47.400 Most of the Wi-Fi boards that existed for the Flip R0 are based on ESP32, which is super 02:47.400 --> 02:52.160 cool because they're low power and they boot right away and have a whole bunch of advantages. 02:52.160 --> 02:57.640 But implementing something like this on an ESP32 is probably possible, but yeah, I don't 02:57.640 --> 02:58.640 know. 02:58.640 --> 03:01.440 So what's the plan? 03:01.440 --> 03:05.840 So are we actually going to put a Linux and able SSC on top of the Flip R0? 03:05.840 --> 03:09.240 Yeah, why not? 03:09.240 --> 03:11.080 So I'm just going to use a Raspberry Pi. 03:11.080 --> 03:14.080 No, let's roll our own SPC. 03:14.080 --> 03:15.080 Cool. 03:15.080 --> 03:19.600 So the part I chose was an all-winner A33, it's a little bit long in the tooth now. 03:19.600 --> 03:21.960 It's about 10 years old or something like that. 03:21.960 --> 03:28.640 All-winners, the Chinese company that creates various parts super cheap for tablets and 03:28.640 --> 03:29.640 stuff. 03:29.640 --> 03:33.800 There's quite a few members of the Linux sun-seek community that come to Fauston, which 03:33.880 --> 03:39.680 is the not affiliated with all-winner, but the people that actually merge the changes into 03:39.680 --> 03:41.840 the Linux kernel. 03:41.840 --> 03:44.160 So this is the chip I wanted to use. 03:44.160 --> 03:51.360 It's a quad core 4a7s and then it has all kind of the standard stuff. 03:51.360 --> 03:54.800 But I mean, for what I'm doing, I'm just interested in the cores. 03:54.800 --> 03:58.120 Yeah, I guess more detailed specs. 03:58.120 --> 04:01.760 Yeah, I don't have to go over all this. 04:01.760 --> 04:15.760 I guess quad core, 1.5 gigahertz, DDR3 controller, so all-winner makes the A33 wants to get 04:15.760 --> 04:17.720 into the details here. 04:17.720 --> 04:23.320 The A33 wants five voltage rails and they sell a PMIC, where that actually just provides 04:23.320 --> 04:27.560 all of this, but I didn't want to use that, I don't know, I guess I'm nervous about it going 04:27.560 --> 04:30.000 out of stock. 04:30.000 --> 04:38.800 I chose these TI-box supplies and each one of these guys needs to come up in a certain 04:38.800 --> 04:39.800 sequence. 04:39.800 --> 04:43.840 So there's a little capacitor, C8 down there that's connected to the SS pins, so that 04:43.840 --> 04:48.560 all these things sequence up to the correct order. 04:48.560 --> 04:54.560 For the Wi-Fi radio, I chose a RTL 88723, which I believe has talked about a few talks 04:54.560 --> 04:59.360 ago, and yeah, this does, from a scarce mode, and all these things that people like 04:59.360 --> 05:00.360 for pen testing. 05:00.360 --> 05:05.320 This is connected over, this is actually, I've never used a Bluetooth on it before, but 05:05.320 --> 05:12.400 this has, yeah, this is Bluetooth and Wi-Fi, and then Wi-Fi, use the STIO bus, whilst 05:12.400 --> 05:15.000 Bluetooth uses the UART bus. 05:15.000 --> 05:20.800 I think Bluetooth should work, I've just never tried it before. 05:20.800 --> 05:28.720 Yeah, so I want to add more radios, so I quite like the RTL 887C use, so this is cheap 05:28.720 --> 05:34.320 little USB dual band, that also, again, you have supports, modern mode, primiscus, motor, 05:34.320 --> 05:39.000 all these sorts of things, and I just put USB-A ports on the board, so users can plug in 05:39.000 --> 05:53.080 like whatever USB devices they want, yes, radios, miceke, whatever, yeah, so there's USB 05:53.080 --> 05:59.160 C port on the board, this, this just connects to one of these CH 340s, which is the USB 05:59.160 --> 06:08.240 UART chip that everyone in the world seems to use, yeah, and this, so the way that I wanted 06:08.240 --> 06:15.720 to talk to the Flip or Black Hat from the Flip or Zero is over UART, but I also want to 06:15.720 --> 06:22.160 access to the same UART bus, so I basically just ended the TX pins, so you can either get 06:22.160 --> 06:26.280 data from the Flip or you can plug into the USB-C and then you get the same thing, and 06:26.280 --> 06:35.920 you'd also monitor what the Flip or Zero is sending to the device, yeah, DSI, so I was 06:35.920 --> 06:40.440 never planning to use a screen with this device, like we'll get into that later and scope 06:40.440 --> 06:50.160 creep everything, I just threw it on an FFC and a backlight, boost controller, and 06:50.160 --> 06:58.640 that would potentially future holds put a screen on, so yeah, so I mentioned as DDR3, so I 06:58.640 --> 07:04.640 think this was a little while ago, maybe this keycad 7 or 8 or something, but at the time 07:04.640 --> 07:12.200 it had a trace length matching, which is needed, when you want to do a high-speed signaling 07:12.200 --> 07:19.200 like DDR3, and this worked quite well, just shadowed to kayak pad is pretty impressive 07:19.200 --> 07:25.920 what you can actually build now in some of this shit, yeah, so this is the layout for the 07:25.920 --> 07:34.920 buck controllers, yeah, it's basically this times 4, that's the actual socket self, 07:34.920 --> 07:41.440 so I was able to get away with a 4-layer board, I feel like if you're to fan out more 07:41.440 --> 07:46.000 pins, you probably need to go for a 6-layer potentially, the nice thing about this part 07:46.000 --> 07:52.680 is it's a 0.8 millimeter pin pitch, which is like it's either typically BJs can also 07:52.680 --> 08:00.280 be like 0.65, and when you go to 0.65, you then need microveas, which is a little bit 08:00.280 --> 08:04.000 more expensive, and I mean all winter makes these parts, so the boards can be cheap, like 08:04.000 --> 08:07.800 you see there's missing pins and stuff, like they put those are intentionally put there, 08:07.800 --> 08:16.520 so you can get away with cheap boards, that's the power distribution, we can see basically 08:16.520 --> 08:24.280 all the buses there and how they're routed on internal layer, assembly, so this is a 08:24.280 --> 08:29.560 different project using the same A33, but I just wanted to mention that, like you can actually 08:29.560 --> 08:36.840 hand assemble these, so there's me and my garage reflong boards, yeah, so again different 08:36.840 --> 08:42.720 projects, but yeah, there's similar A33 about the DDR3, I think X, everything, this was actually 08:42.720 --> 08:48.240 the wall charger, I built a while ago, and I forked this, and then that's how the flip 08:48.240 --> 08:54.480 of black hack came about, assembly, shit, this is, mass assembly, yeah, you should taste 08:54.480 --> 08:58.200 on one to make them, and yeah, so this is the final device, so this is the flip of black 08:58.200 --> 09:07.880 hack, yeah, pretty much everything, I just said, yeah, so I gave it a talk about this device 09:07.880 --> 09:16.520 at Y-2025, and people, someone in audiences is like, why do I need a flipper, and I'm like 09:16.520 --> 09:25.080 you're totally right, this is ridiculous, it's the STM32WB connected to like this giant 09:25.080 --> 09:31.520 thing, so the black pants are pants for the black hat, so the idea was we can ditch the 09:31.520 --> 09:38.520 slipper, and we can completely replace, we can replace the flipper with another device, 09:38.520 --> 09:45.120 and then you don't need a slipper anymore, okay, yeah, so anyways, this was received pretty 09:45.120 --> 09:54.400 well, yeah, people like it's going, I have some more details, so basically shout out to 09:54.400 --> 09:59.640 build route, so this is what I first used to get it booting, so if you're not familiar 09:59.640 --> 10:03.400 with embedded Linux devices, you need, there's a whole bunch of things you need to bring 10:03.400 --> 10:08.920 together to get it to boot, you need a boot loader, you need a kernel, you need user space 10:08.920 --> 10:14.680 applications, and it is to finally assemble all these things into one, binary that you 10:14.680 --> 10:20.400 can then flash to NSD card, plug it in and boot, if you don't want to do that by hand, 10:20.400 --> 10:28.680 you can use Builder, which is a great project, so I started off with Builder, and this 10:28.760 --> 10:33.000 worked really well for a while, but the one issues that I don't have experience with 10:33.000 --> 10:40.280 Builder, no, okay, so the one thing is Builder doesn't make binary packages, so Builder 10:40.280 --> 10:45.880 everything is configured at BuildSmart, like when you're building on your host machine, 10:45.880 --> 10:50.080 and it's going to do all the dependency resolution in the blah, and then it's going to just 10:50.080 --> 10:55.320 drop all the files into the file system and give you a final route of S, but I had customers 10:55.320 --> 11:01.880 like, I want to install this thing, I'm like, wow, okay, you can, like, SSH5, it worked 11:01.880 --> 11:07.880 well for what it is, but it doesn't really build an OS, for say, it's literally in the 11:07.880 --> 11:15.880 name what it does, it builds root file systems, so yeah, I recently moved to ARMBN, which 11:15.880 --> 11:20.680 is a really cool project, so ARMBN is, I mean, two different schools of thought, right, 11:20.680 --> 11:25.720 so you have BuildRoot where you're constantly recompiling the whole thing and making an 11:25.720 --> 11:30.600 extremely lightweight image, a wealth ARMBN, a lot of people just grab an image flash into 11:30.600 --> 11:36.840 their device and then configure from there, so yeah, so we have access to Debian packages, 11:38.200 --> 11:42.920 and you just can just app get install, just like you would on them to, or whatever operating system 11:42.920 --> 11:49.480 you want, and this worked really well, and I was able to basically take the stuff I did on BuildRoot 11:49.480 --> 11:56.520 and implement, move a device tree files over, and then this just gives the image and it just 11:56.520 --> 12:04.120 booted very well, super cool, a lot of presentations kind of all over the place, yeah, so yeah, I was 12:04.120 --> 12:09.720 mentioned the SunCee people earlier, so there, the people that basically merge changes into 12:09.720 --> 12:15.960 Linux kernel, such that we have like, super, really good support for basically the all-winter 12:15.960 --> 12:23.800 ships, so yeah, thank you to this team, and yeah, thanks to them, we have the most recent kernel, 12:24.600 --> 12:33.400 we're not running some old 5.1 something crossed. Yeah, I guess it's just a random bit about 12:33.400 --> 12:42.520 device tree, so if you're not familiar with device tree, it's basically a structured text file, 12:42.600 --> 12:50.360 and this is going to describe your hardware, so I mentioned I had this RTL 8723 Wi-Fi chip earlier, 12:50.360 --> 12:55.640 so basically you edit your device tree file, and you just nest that right in there, the MMC bus, 12:55.640 --> 13:04.200 because as I said, it's connected to EMR, the MMC bus, and you basically fired up, and you have a 13:04.280 --> 13:11.240 W-line zero device. Well, everyone's doomed, that's nice, that's normally the first question I 13:11.240 --> 13:18.840 get. Yeah, this was an application I wrote, so it's basically just a big bash script, and 13:19.560 --> 13:25.560 the idea was to drive this application, you can do it manually, but the idea was the 13:25.560 --> 13:30.440 flip or black hat would then send these commands to the device to connect to our 550 minutes for 13:30.600 --> 13:41.320 it cool. Connection, I got to beat up. Yeah, so the flip or, I don't, I don't know where this 13:41.320 --> 13:48.200 is already, the flip or we'll talk to the black hat over Europe. Flip or app, so this is a small 13:48.200 --> 13:53.160 C application that I wrote that actually runs on the flip or zero, this is merged into the momentum 13:53.160 --> 13:57.320 firmware, so you can basically just grab that flash that you'll have the app, and this is going to 13:57.320 --> 14:01.400 talk to the, talk to the black hat, and run your exploits, and run your scripts, so you can figure 14:01.400 --> 14:07.320 everything. A script launcher, yeah, this is just some additional few things, so there's a way to run 14:07.320 --> 14:11.560 run Python scripts on the black hat from the Flip or zero itself using this app, I was talking 14:11.560 --> 14:15.800 about earlier, which is nice because you can run all sorts of whatever you want, basically. 14:17.000 --> 14:21.960 Data loader data thief, so this was a pen testing thing I wrote basically, so if you're like 14:21.960 --> 14:25.960 red teaming a building and you find a USB driver and plug it in and then steal the data on 14:25.960 --> 14:32.680 off of it onto your device or potentially load malware, yeah, I'm not going to talk about that. 14:32.680 --> 14:39.320 So there are a few cases that were built by the community, this is the Edgar case, it's called 14:39.320 --> 14:48.520 the Edgar case, because Edgar rated, and then we decided to, yeah, go with the screen, because 14:48.520 --> 14:52.120 everyone was talking about that, I'm like, okay, I guess this is something people want, so now 14:52.120 --> 14:59.800 we have a giant screen connection with it. And yes, that's the R&B in build, and I actually 15:01.640 --> 15:06.840 change the sources list thing you see, you can install whatever from Cali, and it runs 15:06.840 --> 15:11.880 Debbie and Sid, which is like the most recent unstable distribution, and Cali's a really 15:11.880 --> 15:17.720 rolling distro, so this kind of works. Yeah, okay, yeah, so this is what I'm talking about earlier 15:17.720 --> 15:21.560 to what's pointed for, 0, I don't think it's necessary anymore, enter the black pants, 15:23.080 --> 15:30.760 so I talk at Y 2025 about this device, was anyone else there? Y25? Ah cool, nice. So 15:33.160 --> 15:38.360 someone in the audience asked what's the point of the puzzle, and I'm literally like have my Y25 15:38.360 --> 15:43.880 badge, and I have my device, I'm like, man, okay, this is fully open source, so basically I forked this, 15:44.840 --> 15:51.720 the kind of board of the design to the Y25 badge, it's open source, so yes, forky forky, 15:52.280 --> 15:57.400 I removed everything except for the P-MIC and the battery charger, the key is the coupe super cool 15:57.400 --> 16:05.800 project, so if you know the solder party potentially, he, they created with the first people to do 16:05.800 --> 16:11.160 this stuff with the old blackberry keyboards, basically reverse engineer in the protocol, but then 16:11.960 --> 16:18.280 the blackberry keyboards ran out, so he ended up developing the keyboard, his own keyboard, 16:18.280 --> 16:22.280 and this is basically a membrane, so it can membrane, and then there's domes, which is under, 16:22.280 --> 16:27.080 and you just got to put a certain layout on your PCB, and you have a full working keyboard, 16:27.080 --> 16:34.040 basically, which is super cool. Yeah, getting into some of the details, so the keyboard controller 16:34.920 --> 16:42.760 is an STM32 F-0-4 powered by QMK, the open source keyboard firmware project, I don't know what 16:42.760 --> 16:49.000 stands for, quantum mechanical keyboard, initially, and now it's the STM there, and then you can see 16:49.000 --> 16:57.320 on the flip side, that's where all the pads would be that the domes, which is activate. Okay, 16:57.320 --> 17:03.560 that should not stay powered by QMK. There's USB-2 hub, and I'll talk about that's how that's 17:03.880 --> 17:12.680 connected a little bit. Okay, hack number one, so if you notice the MIPI DSI can actually, that 17:12.680 --> 17:17.960 FFC is totally in the wrong spot, because if we want to put the black hat in the black pants, 17:17.960 --> 17:27.000 we then need to like, route DSI up and around, so this is like a, there's basically the screen, 17:27.000 --> 17:30.600 we'll plug into one of these, and this does like a right angle adjustment, such that we can have 17:30.600 --> 17:36.920 a small FFC jumper. Yeah, nice. So I never designed this thing to be plugged into anything 17:36.920 --> 17:44.280 of the flip or zero, so we had to get creative. Hack number two, USB contacts, so I need to connect 17:44.280 --> 17:51.080 the keyboard to basically to the USB port, and then I have these USB hub that I also need to connect 17:51.080 --> 17:57.160 to that. So on this side, we see some spring contacts, it's really hard to see, sorry, but 17:57.720 --> 18:05.160 yeah, it's okay, you can laugh this supposed to be funny. And basically, the spring contacts, 18:05.160 --> 18:11.800 which are meant for like a RF shield or something, basically make contact to the, and actually 18:11.800 --> 18:17.480 works pretty well. And then yeah, here you can see the, can you see my pointer? Oh, yeah, cool. 18:17.480 --> 18:21.400 You can see the FFC hack, where there's just a small jumper that goes to the board, 18:21.400 --> 18:29.640 10 minutes now, would you? Hack number three, the holder downer, so it's, yeah, you need something 18:29.640 --> 18:35.080 to hold it down, so basically, build this little plastic thing that pushes the PCB down and 18:36.200 --> 18:44.200 makes contact with the USB, those pat, those spring, spring contacts. So that's the final assembly. 18:44.200 --> 18:51.160 So the, yeah, there's basically, I mean, you can see what it is, but it's a front panel, 18:51.160 --> 18:57.480 and then the key goes in, the spring goes behind, and then this keyboard or the PCB is sandwiched 18:57.480 --> 19:05.240 in the middle, and then there's a back, back thing, but back casing, which is going to cover up 19:05.240 --> 19:11.560 your 18650 and kind of roll it in the final device. And you basically just plug your black hat 19:11.560 --> 19:16.360 into your black pants and you have a fully functioning handheld Linux device. Here's some of the 19:16.440 --> 19:22.840 glamor shots. You want to see some of these posted on Reddit or various social media. 19:22.840 --> 19:30.040 Things that's at running router split, which is a pen testing kit for embedded or like IoT stuff, 19:30.920 --> 19:41.480 because as we all know, the S and IoT stands for security. So, yeah, so that's the final device, 19:41.560 --> 19:47.480 and here's the glow up from the board that plugs in the foot of zero throughout the cases, 19:47.480 --> 19:52.840 and then the final device. I wanted to thank the Kai-Cad team, Linux and C community, 19:52.840 --> 19:58.840 you can do Linux, Y2125 badge team, flip the black hat supporters, Edgar, for making the case, 19:58.920 --> 20:04.520 son of party, and you guys are watching. I think that's it. That's the last slide. So I think I'm really 20:05.080 --> 20:09.080 sorry. 20:12.280 --> 20:14.280 Questions? 20:18.600 --> 20:21.560 Cowards. 20:26.920 --> 20:29.240 What's the sort of build cost for it? 20:30.200 --> 20:37.480 So, yeah, it really depends how you do it. I get the whole things, so it's mechanical, 20:37.480 --> 20:41.720 everything, it's all open source. So it's possible to 3D print the parts, and then hand 20:41.720 --> 20:52.360 assemble the black pants board, but I think if you go into a shop to get the boards done, 20:52.360 --> 21:00.200 you're looking at a bomb cost, or maybe 40 bucks, yeah, and components, and then plus the assembly 21:00.200 --> 21:04.440 cost and everything, so something like that. 21:09.080 --> 21:09.800 Number one. 21:13.080 --> 21:17.560 Great talk. Thank you. Just leaving them for the last question is, I mean, is anybody planning to 21:17.560 --> 21:22.360 sort of make them? Is that acceptable under the license also? 21:22.360 --> 21:27.000 Oh, yeah, for sure. Yes, for anyone who's welcome to make them, I make them, so there's me, 21:28.680 --> 21:31.960 and I have a small shop where I sell some of this stuff as well. 21:33.480 --> 21:40.440 Yeah, I haven't found anyone in the wild that's made their own yet, but I mean, hopefully, 21:40.440 --> 21:44.040 hopefully, there's a few people. 21:48.520 --> 21:58.200 This device looks really cool. What's that screen? Where can I buy that screen? 21:58.920 --> 22:05.400 So that screen is a 480, but 480, TFT screen. 22:09.240 --> 22:14.920 I have a few of them in my shop, so it's possible by for me, or if you look around on LXpress, 22:14.920 --> 22:18.680 you should be able to find them. Yeah, thank you. 22:25.080 --> 22:25.800 All right. 22:34.120 --> 22:39.000 All right, so there was a slide somewhere in there where it said something like, 22:39.880 --> 22:47.000 pay a manufacturer to populate your board. So I just want to hear your experiences that 22:47.000 --> 22:57.080 made you made that slide. Oh, yeah. I mean, I don't sell a lot of hardware, but if I was to actually 22:57.080 --> 23:04.920 hand assemble these boards to sell, that would be basically a full-time job. So no pitfalls with 23:05.080 --> 23:10.520 manufacturing in your own shop or anything. Oh, yeah. It's an all-wintered ship. It's pretty 23:10.520 --> 23:15.640 and all the other stuff. Yeah. It's a difficult? Well, I mean, normally you build five and you 23:15.640 --> 23:20.520 turn on one and that one catches on fire and then you have like one that works, type of thing. 23:20.520 --> 23:27.480 But I mean, yeah, it is, I guess it would be the most complex board to hand assemble, but we are 23:27.480 --> 23:32.520 talking about BJF packages, like 200 or something pins. So it's just like the probability of something 23:32.600 --> 23:40.920 shorting or something going awry is quite high. But it is possible. There's a very good 23:40.920 --> 23:48.120 blog, a person named Jay Carlson or Jay Carlton, and he made a blog that was Carlson, you want to build 23:48.120 --> 23:55.640 unimbedded Linux device. And super good. He made like like five or six different boards, 23:55.640 --> 24:01.800 always socks and ram and stuff like this. And that was the original thing that motivated me and he 24:01.880 --> 24:09.720 talked in this tone that said, you know, there's a lot of, you know, professionals out there 24:09.720 --> 24:14.760 that say like, like every time I tell a professional, like someone that I work with that I hand 24:14.760 --> 24:19.240 populated a 250 pin BJF package, they don't even believe me. And I'm like, no, it's actually not that bad. 24:19.240 --> 24:24.360 You can just do it. And this Jay Carlson person spoke to that same narrative that personally motivated 24:24.440 --> 24:28.760 me to pursue this thing. Cool. Yeah, thank you. Yeah, thank you. 24:31.720 --> 24:40.200 Clement. Anybody else in the front row? If you may as well, or in the middle, middle, the 24:40.200 --> 24:50.360 middle. All right, thanks Ryan. Our next talk starts at 1 o'clock.