Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/149 Thanks!
Good evening, everybody.
Our next speaker is known,
yeah. Our next speaker is known to
cause a little bit of fear
in recent years with
the guys from Cisco.
He's also had his focus on the core
infrastructure of the internet.
And in this talk, as you all know,
we do have lawful interception
interfaces in all the core infrastructure
running our internet.
But there's a big question could
this a lawful interception interface
pose an additional risk to
attack?
Please give a warm round of applause to
ethics.
All right.
Oh, well, Snowden
said, basically, this is the
technical side of
the lawful interception
point. Unfortunately, we
can't believe we submitted another
talk on the political side
together with the gentleman over there.
Mr. Robert Lee
Unfortunately, it was turned
on because he's with the United States
Air Force.
So, you know,
this is not censorship.
But yeah,
if you if you want to be a censor and
your intelligence should be good
and your child means that the guy who's
allowed to talk is with the NEDA
as a co-director anyway.
So what are we talking about?
What we're talking about is like
the game of lawful interception.
What actually turns out to be a pretty
much a game? So what's the justification?
Who are they looking for?
Why are they watching you watching porn?
The inherent problems with lawful
interception in,
you know, the game mapped and we play one
side, we play the other side and we
have conclusions and then we get drunk.
It's
awful.
So
this talk is IP centric.
Keep in mind that every communication
you do since
a couple of hundred years can be lawfully
intercepted, right?
So this one is IP centric,
but there's other things email,
snail mail, wired
phone lines, which we actually don't have
any more mobile phone networks
and stuff like that.
Also, keep in mind, know
I don't know shit about
this, except for
I look at it right, sir.
So this is about reading standards,
reading code, reading
books, making fun of people.
Hey, Dov, we have an empty seat on a
stage. Come on.
So what's the justification?
So basically, lawful
interception means there's a law
enforcement agency layer,
which in contrast to Star Wars,
you know, is on the bad side
in in the idea is deadly
deed. They need to listen into
communication from bad people
and it's legally
and that's really interesting, legally
rooted into the idea of,
you know, looking at.
His name out. So it's
a different thing.
If the police looks at
the envelope of your letter,
which you know, the NSA
calls meta data, or
they opened it later and look at the
letter. So that's where the
legislation comes from.
In actually lawful interception is not
in principle, a bad thing because
it's like basically if your child is
kidnaped and then the ransom note comes
by email, you're going to ask for
it. You're going to ask the police like,
can't you tell me where this fucking
man came from
in in Europe?
Whose phone is that because it's ringing?
Now, I did that a couple of congresses
ago anyway, so
in the European Union
did. The legal basis of the ad is
the council resolution from the
17 January of 1995.
So it's quite some time ago,
which again is legally
rooted into the
Maastricht Treaty and basically
demonstrative says that we have police
cooperation for the purpose
of preventing combating terrorism.
That's all of you.
Unlawful drug trafficking, which
immediately caused me to ask, like,
OK, who's lawfully
drug trafficking?
I mean, you know, you need to
know.
Supply chains and other
serious forms of international
crime and the national
legislation that then implements that
differs slightly
between different European countries.
One of the primary of things
is how much do network operators
allowed to say?
So let's
look at the game map, you know,
before you play a first person shooter,
you better learn the map, right?
Basically,
there's two side stories two people
that built the internet,
not the ones that asked for
it and how to build and pay for it,
because that's the U.S.
military. And well, if
you're surprised that they want it back,
that's your fault.
The IDF,
funnily enough, have has an RC
that is absolutely no 1984
and and that RC
basically says, you know, everyone
should encrypt everything to everything
from a point to point.
And, you know, circumventing
this encryption has no
proven benefit.
The NSA might beg to differ.
Years later, the IETF
came on where the policy on wiretapping,
where they had a
couple of interesting points.
One series is that tools
which are effective for a purpose
tend to be used for that purpose.
Oh, surprise.
However, what they're not saying is
everyone can do that.
That doesn't mean it's the people that
you build it for.
The second point being told, designed for
one purpose that are effective for
another purpose, tend to be used for
other purposes as well.
This is commonly known as HTP.
And if a vulnerability
exists in a security system, it's likely
that some will take advantage of it
sooner or later.
And that's what this talk is about.
And so in the same
hour of sea, they basically sum up the
security considerations
with three points, and this
is really important for this discussion.
The system is less secure
than a copy had this function
not being present because you're
extending the attack surface right?
The system is more complex
and cool, and Kobe
had to function, not be present.
Same argument being more complex,
the risk of unintended security flaws
in a system is larger,
known as PRISM.
So basically wiretapping, even if
it's not used, therefore lowers
the security of the system in today's
world. You will see wiretapping
if it hadn't be implemented,
wouldn't allow PRISM to exist.
Why is wiretapping so difficult?
So, first of all, lawful
intercept as many government
regulated functions in
an ISP is a cost center.
So Google doesn't make
any money. What watching you?
Well, scratch that.
They make all the money.
Would watching you.
Your ISP, at least in
Europe, wouldn't make any
money watching you.
However, I mean, here's
here's a basic calculation from one
of the books on the subject.
So the one time cost of seven or
almost eight million, the
annual cost is like thirty
eight million.
And then if you're lucky, you get
twenty five million back from the
government, which by itself
is questionable.
But if you're.
Not less bad in math than
I am. You will notice this
is not a positive sum game.
The next thing is performance
in an operation, so
the operation of the target is
like the service must appear
to be unchanged.
Do you know any gamers in here?
What do you think you will do when your
ping times go down like 200
milliseconds?
Sorry.
Which was actually triggering the
naming of the talk.
So that is one part.
The next one is during interception.
A lawful intercept agencies may require
information and assistance, blah
blah blah, a.k.a.
they have no fucking clue, and they call
your network administrators.
The third part being by
the telecommunication to and from the
target service, be provided to the
exclusion of any telecommunications
that do not fall within the scope, which
means they tell you
who you're supposed to monitor and you
are fucking responsible to make sure
that you're not monitoring the wrong
people.
Wait a minute.
But then there's the basic
I.T. and networking guy.
There's basic bandwidth issues.
Transmissions forwarded to the monitoring
facility to comply with the performance
standards of the network operators.
A bullshit statement to begin with.
But let me explain why
this is really interesting.
So this is
how we actually envisioned
the internet to be right.
So, you know, you have an access
point.
What hell,
let's drink gigabytes so that one is
already over.
I've never been a plowed into getting
drunk. That's awesome.
Basically,
this is how we envision the internet
where basically this is what I ask for
is if you bomb one site with
a nuke, things still work.
So on the right side, you have the webcam
that you paid for
to use.
And on the left side, you have
the average nerd.
Me included, certainly, that
has an ideas outline.
This is what the two errors mean.
Right?
So.
Which this tries
to sum up that, you know, the military
built the internet to poor and made it
big.
Basically, this is what
the military and
famous universities worked on.
Now, a couple of years ago,
I was on a conference in China,
and after two hours
of the introduction speeches from
professors, I thought, I'm on the wrong
conference. But all the other speakers
that I knew were still there.
And I thought, I'm on the wrong
conference because they kept talking
about the censor network
as in censoring,
because the network topology changes
drastically if you're monitoring
everyone.
This is what the Chinese network looks
like.
And basically
on every single point, you need the sum
of all bandwidth that goes into
deploying and out of the plane to be
collected into your monitoring station.
And this is why the Chinese actually call
the local network.
They're censoring network because it
basically isn't censoring, not with the
C, but with a censor
like it says on its lights,
because that's the topology, and that
means completely different routing
patterns and all that things
get. OK, we understood the basic
problems.
Now what's the game plan?
So I just this is slightly
adapted explanation
from Wikipedia about
counterstrike.
Uh, it's it's we're talking about
a first person game in which the players
trying either a terrorist game, terrorist
team or the counterterrorist team
in contrast to Counter-Strike.
Not all become
specter spectators.
They do it to become spectators.
What points do we actually have, like
where could you take the data
often at work and, you know, watch
me what's important?
There's the acquisition at the source
in Germany. We call that given to you.
There's the next hop, which is the
plastic router that you get from your
ISP or your market or
whatever.
There's the most common way
of doing it in the network access layer,
which we're going to cover in
more detailed stories as the seven
probes, which is really interesting
because it allows you to monitor
phone calls and SMS and stuff like
that from across the planet.
You don't have to be in the network
stream. You can actually, you know,
tell the Seven Network,
Give me that eSIMs.
There's data retention,
which basically means someone
else is monitoring the stuff for you
and runs an Oracle database
that nobody cares to share about it
because it's a cost center.
And while there's
all your communications for the last half
year ender, which
I'm sure no Foreign Secret
Service will find interesting,
there is DNS triggered
interception.
This is what.
I would like to see less free countries,
but by now, I'm not really sure about
that.
U.S.
And then there's the threat actor of
the type global observer, which
as far as I know, is a term the D.A.
actually coined for designing
cryptography groups.
So we're playing on a good site now
where the counterterrorist,
which means let's
all them up and get up.
So, of course, we played a kind of
because we're all the good guards, guys,
whatever in between and an android.
This is how it looks like, so the U.S.
has a slightly different model
called Korea
in Europe, we used it as a model
at sea.
So basically that has three interfaces.
The first interface, it looks like
the computer interface, but it's actually
an interface between
people.
So yes, there is people involved.
So the other
one will,
you know, talk to the network
operators, legal people and say,
you know, we have this, this
warrant or
whatever, we're the French Secret
Service or blah blah blah.
Can we please have that interception?
The second interface
either is what we
all know as metadata.
So if you have an AI
feed that is in an email
to from subject basically the
entire head or on IP communication,
it would be the IP header.
Plus TCB or UDP if
they can recognize it.
The content of communication
means GCP dump
save everything, right?
So this is three different ways
of of dealing with that.
And as you see, with the big bubble,
it's all the fucking ISP's fault.
Yeah. The police just
wanted New Years.
This is far from complete,
but I liked it because
there's a couple of vendors,
as I say it is as far as
I know from Israel, Darren.
And there are interesting because most of
the configuration templates
that you find on a nightly,
OK, I'm running an ISP, I'm new
in my job. How do I configure
lie for blah blah?
This is what they get sent.
Now imagine you have absolutely
no clue on what you're doing,
and someone sends you a line
of configuration for your Cisco.
What do you think happens
control C Control V
Center?
So not surprisingly, as this a
pass WD is a
very common password
and
there's other vendors.
Interestingly enough, because like I
pointed out, that lawful interception is
a cost center.
Most ofthe ally vendors
actually market their stuff with
billing systems.
There's books on return of
investment.
Unlawful interception.
And this is the second
case.
I would like to point out that the
number three to five are,
you know, followed by a German
company.
And guess who's the biggest
vendor in the world?
I mean, there's this interesting
features by some.
Some companies have that feature of
so either information
is sent to you by fax.
Excuse me.
Like the next one, they have a add
on that converts voice over IP
calls into ISDN calls.
Now let me think
I can produce about 200000
voice over IP calls
per minute.
At home,
how many ISDN lines do you have?
And there's there's all kinds of
interesting stuff, so.
And here's
just the takeout from from one of
the vendors and did not
necessarily one of the mentioned.
That is things like it includes
optimal granularity to preserve
privacy.
OK, so you rebuilt
myself out of Lagos.
That's fine.
So it captures only the
traffic to and from the Entity List
and on the way around.
Yes, because that's the only traffic you
can get by legislation
poseur.
It operates at high speeds,
to be precise.
The high operation speed is measured
in jeeps.
Yes.
It ensures the blah blah blah.
The traffic interception happens
in the core network, minimizing
the number of devices
that need to be.
Let me replace that on't.
So this is what what we're looking
at right now.
What blew me away?
If if you know me for a while,
Cisco actually published.
They're lawful intercept.
Interface
with the, you know, with
the IDF.
They made an RC out of that.
The IDF went full FIFA mode.
Like, I'm not talking to you.
This is all your problem.
Have for good reason.
But what the fuck?
I mean, Cisco is the only fucking vendor
that does the right thing in
to lie interphase,
peer reviewed.
And there are parts of my worldview
start to crumble on the left side.
But then, you know, I looked at it and
I'm like, Happy because.
OK, cool. It's it's still Cisco.
The authentication design is a complete
failure simply because
the law enforcement, authentication and
authorization taps happen at
the mediation device.
Now the interception
and the question Where do you interest?
Where do you send the traffic that you
intercept that happens
on the router?
Hmm.
Let's see.
So this is this is from the I.R.S.
and so basically he one
is the nontechnical interface.
I assume that by now, the L.A.
administration function is a web
interface that both company lawyers
and police
address.
I wonder how
in this configures in the center,
there's the mediation device,
so the mediation device talks to
irate meta data collection.
As far as I know, Cisco doesn't have any.
You've got to be fucking kidding me.
OK, I apparently need to hurry
up in
so the rest happens there
to.
Let pictures speak faster than I
do.
This is basically how it looks like.
And oh
my God, I'm
a slight 20 or 44 and
50 minutes left.
Good.
So this reference model basically
says Sears as an v three.
That's common well-controlled.
Everyone knows exactly what they do.
You need authentication.
But the thing is, everything you do is a
single UDP packet.
The mediation device does all
the bullshit and it manages
whatever, and the router only does what
it's supposed to do.
Well, Ally
basically violates the basic,
absolutely pure basic
design principle of the router
because ally matching happens
in what's called the critical path.
Why do you buy a router?
Take packet from here.
Move it here as fast as you
can. Alternatively, look
at it.
That means your porn feels
like in the 80s.
So.
And that's illegal, as I told you.
So voters are not meant to do
that. So the way Cisco implemented
that and that's actually not stupid
is the closest they've found was
access control lists.
The problem is every time they invent a
new performing technique.
A year later, there's a Cisco
advisory saying, oops.
Access control lists are not matched on
this
yet. So for deception purposes,
they actually built them on the fly.
Hmm. Let's see.
So this is how a mediation device looks
like this is a tech version.
So you basically say who, what?
When porn?
How do you protect that interface?
Authentication was actually required, so
you can't, no matter how stupid
you are. You can't configure
S&P V three you
for L.A.
without authentication.
And there's a couple of other values
that you need, basically.
There's also access control lists for
so-called infrastructure accords in
place, so not everyone in the world can
talk to you.
S&P Hopefully
you can bind
us to user groups.
Nobody cares.
You can encrypt is nobody cares because
it's a lie and nobody fucking cares.
We want to run a network.
Then came IPv6.
A different story
and there's notification, so
it tells you when there's lawful
interception going on.
But this is not meant for network
operators.
This is meant to be sent to the mediation
device.
You know, it holds its as
it's had out of its ass.
So Contreras
went right.
That was the point.
This is why we put this all in place
now just
for educational purposes
as a thought experiment.
We're going to play the other side.
The options that we have is
point one.
Do whatever terrorist known on the world
does not using
the internet.
For.
It took me a couple of years to realize
that those meals are not actually
transporting IP traffic.
So it turns out tively,
what we can do is use traffic
that is not intercepted detecting
deception or take over
things.
In traffic, not intercepted
is not something we
really have to do much for, because
so here's a couple of
bags that showed up.
So in extreme,
the lawful intercept feature
needs a license they
turn to expire.
And keep in mind, this is something
nobody fucking cares about it.
The Europe based interception
VR as a virtual writing frame
works basically,
if your company is like, we don't need
encryption because we have an MPL
where service provider virtual
private network over the internet.
Those are not encrypted.
And even if they are dare
encrypted between point and point.
So if the
lawful interception agency
wants to listen to your traffic,
here they go, right?
The thing is, keep in mind
the usual notice that this
happens.
Things break like
minor things like policy based writing,
and nobody uses that
server load balancing.
Whoever has a web farm has never heard of
it.
You know, basic facts
then ally in general, is
prioritized over other features.
So other features that break
optimized ACL logging.
I imagine this guy at Cisco going like
as if we have to optimize to see how
logging and they see
the interceptions going on because we
built a scouts to
there's other ACL matching.
Whatever really like is the
bug report makes a very
honest statement intrusion detection
systems, ideas not functioning
properly,
which is a general statement I'm fine
with. But the funny thing is
you're running a provider network.
Someone gets monitoring your i.d.s
only sees the monitored guy anymore.
That's the only guy they see.
So basically, all you need to do
is call someone else far
enough so they get intercepted and then
you can do whatever you want.
What the fuck?
That there is there's other things,
right? So here's the
Cisco back.
And if you actually buy additional
hardware and put it, you look so
cute with
you and you put an additional line card
in your access router
just for zips.
The police can listen better to VoIP
calls.
And you know, the result is
don't work anymore.
And there's also, you know,
this other back that a rally
to basically the S&P
communication doesn't work anymore.
And the workaround I love
you may be able to restart.
Yes, S&P he managed to force the timer
for S&P and be synchronized.
Note, however, that doing so costs
us a 100 percent
outage for all wiretaps that are served
to the S&P manager.
If you cannot restart the S&P manager
there, there's no workaround.
This is verbatim quote.
And now, if you have so much failed
and you know, there's the tendency to
look for, can I make more fail?
So stateful switch over
and nonstop forwarding our major
selling points for a writer
in this case, the naming of Cisco.
But for Radovan in general,
if you have a site that is somewhat
interesting, you actually have more than
one router and you have, you know, I'd
stand by it.
The thing is, this
doesn't support light.
So if you have a switch over,
all the taps are lost.
Interestingly enough, if you
also switch over, every
router vendor in the world will tell you
it's not a security issue as long
as the other side took over.
It's not a security issue, it's an ally
issue, but that's not your problem.
And the other thing that I've found is
that the domain name for both the router
and the mediation device.
I hope nobody gets
phone transfers from ISP's
are actually registered with a DNS,
and I defer to Dan Kaminsky to
tell you what's wrong with that.
Now, size doesn't
matter
if she told you otherwise.
She lied.
So Leah
has the problem of like
bi requirement.
They want to have the same
bandwidth as you have.
And not everyone does interesting
things from home.
You know, there's people that have big
pipes at work right
in and there's there's interesting
stories about especially the
German police intercepting
where they're not saying like, give me
there's traffic, but you say,
we don't know what this guy does, give me
everything.
And then they call 10 minutes later and
say, What if we only
have a pension? One, turn this shit off.
That's what I was trying to point out,
what the center and I were, so
also.
Somehow the vendors
managed to
negotiate.
That's what you have lobbyists for a
top level load on the IRS
because nobody wants to pay for the
police watching you watching porn, right?
So basically,
here's some examples the
you can only intercept two
percent of the cards, given the fact
that running a VoIP gateway
is a relatively cheap thing
to find some other eight
people that generate interesting
stuff.
And there's also bandwidth
problems, so they really
fucking hate you to mirror
the world and then, you know, go
partying
and numbers do matter.
There's other interception mechanisms
that are not Cisco that
use flow tracking.
Now, flow tracking is random sampling.
If you download another
documentation
records of the talks here,
this one little email is
very unlikely to be caught.
And then there's the compromised observer
problem, because basically now you
have two IP stacks that need
to understand what you are talking.
And that's why it's doesn't work.
This is why IP doesn't work
derriere, because now you have a
combination of two
recipients, so there's many different
ways to fuck this up.
Basically, it's like with an antivirus
solution. The antivirus solution can't
unpack the zip file your
windows zip tool can wear
unzip on Linux can.
So the antivirus solution has no fucking
idea what you're looking at and you get
infected.
This is all lang sick.
If you haven't understood that,
keep getting out,
but it's the wrong direction.
Fat fingers.
So what I said about the code in the
critical path.
Basically, what it means is
the the people at the router vendors
tried to get out of the code
for Ally as fast as possible because
they are not liable.
Neither the ISP nor the router vendor
is liable for not
intercepted packets when they're
not well defined.
So this, for example, looks for
how IPv4 cool mean IPV six
go. Let's go
now. IPV five is what I call
a laser packet
because lasers
lasers don't pass through prisms.
Take a prison. Take a laser.
Try it.
I'm boring for comedy, I'm sorry.
So basically what I try,
it was take a regular IPv4 packet
or packet stream and just
like replace diversion to
number five.
What's funny is there is a number of
routers that are to forward that, and
there is a number of recipients that
actually enter.
That doesn't make sense unless you
look at the entire ozone
layer stack because
on on the data link layer on layer two,
there's a number of protocols
that hint on what is the transported
protocol, right?
So the example for Ethernet
IPv4, we all know
IPv6.
I actually learned from a professor that
why is IPv6 better at transporting
porn? Because it's 86
double-D?
That's not my thing.
His response was, how else do you make
the students remember?
So basically, they take
the hint from the layer two protocol and
ignore half of the IP header
just to get rid of the packet faster
because they're built to
get out, get rid of the up.
How do you get around interception?
Now one of the things is
what you just saw here, but I'm
skipping this for time
reasons. People had us killed to me
to punt a packet.
This is what this thing here shows
like we can't figure out, and
we punt to punt a packet
means you're handing like we're talking
about rather just size and you're handing
the packet all the way up
to the main CPU.
Now, the main CPU is
actually not dared to forward
packets.
It's basically like when you have a
company with a couple of hundred
employees and everyone escalates every
problem to the CEO at some
point a CEO, reboots
or.
Where, you know, gets gets
handed off to medical people.
This happens with Ciscos as well.
So it did.
The interception targeted can basically
just produce perfectly legal
packets and sent
to whoever it was.
I'm not a lawyer, but this should
actually even be legal in Germany.
This pushes the CPU to 100 percent load
like Java.
And
there's in contrast to your PC
or Mac.
Does watchdog process on Cisco that
killed the machine and reboots
it when the CPU is hanging on 100 percent
a?
Now consider the following
You have a communication partner.
Let's say
he's he's an embassy
in London and
you want to have a secure communication
with him, so you trace route to
his IP address.
Then you send like 10000
packets, which is not a lot,
and then you trace route again.
If the trace rule changes
usually to first
to third or fourth hop, there's
an access router on ISP
just rebooting.
The thing is, you don't have to be fast
because they actually take about 20
minutes to reboot.
Now, if you if you
come up with the idea, well, let's take
over the lawful intercept device.
That's a really bad idea.
Also like Windows 2000, where
Santa Larry's is a prop.
Here's all the holiday itself for that.
That's not a good idea
to know because there's people
that are called compliance people
in almost it.
And you know, they hate you because
their job is to watch the compliance
of this device and root shells on that
device are not good if you plan
to attack the basically
police.
I could just like forget
taking over the
interception point
being the router.
Well, there's this back from 2008,
and writers are not commonly updated,
which you know, takes as an MPV
three years to make coming in.
I love you, thank you.
Here's to Matt coming in.
Here's the make that we have stored.
We're allowed by our seed to compare
subset.
Nice.
If the packet says the length
is one, then the attacker only
sends 256 packets
and is certainly authenticated.
And interestingly enough,
Tom Cross found out that of all
Cisco Images, everything
was vulnerable, except for
most of the ones that had ally
functionality, which is interesting
by itself,
but also as an MPV suite gives very
detailed feedback on the authentication
failure. So how you use the name, not
known password, not known,
you're coming from the wrong address.
Blah blah blah.
When we talk about the NCAA, let's
remember that we are talking about UDP,
so the best practice,
best common practice document for
providers say prevent spoofing
from everywhere outside your network,
your entire network, your
their customer.
And apparently people have
covered attacking Cisco as before.
I don't know.
Anyway, so
what does that mean?
Terrorists win?
So the German term is
allegedly going to excitable.
So you're basically just waiting
for everyone else to put more
interception code in.
But in fact, wait, I don't
think anyone in this room is a terrorist
unless they're paid
for it.
So is this is what we're actually looking
at.
Nobody would like
no terrorist organization would
hire a hacker.
First of all, you know, they smell funny.
And second of all, they actually think
about the mission they're send on.
But you can make them do things, and
that's the big risk in this.
So conclusions.
First of all, Reuters
shall not pass packaged
payloads.
Please do me a favor like anyone
read the fucking manual this time.
Start with the list I
model.
You're not allowed to pass anything
except for
the app before destination address.
Once you're done with that.
Call me back.
I tell you what to do with V6.
Evading lawful interception
seems to be about as challenging as
evading antivirus.
In 2008, we had the race to zero.
How long does it take to
take a well-known virus to evade
antivirus engines?
Every single known one?
That was a question of minutes.
I'm like tempted to do that for an
defcon, but
the real point here being weakening our
critical infrastructure for everyone,
just because some lobbyist
told some company this is a good idea.
And yet you will see when
this guy downloads the app.
Three A
disproportionate measure.
We don't do that for any other
criminal case, even
the bigger ones.
Why would the internet be different?
So basically, to sum up, like
how this is built?
And if you want
to thank the person that like,
gave this as a sticker to me, go
to the info desk when Momo is there.
Yeah. I couldn't describe it better.
My recommendation, actually.
How about we just fucking stop
and start fucking
and without?
Thanks for giving me the extra time.