Cisco Router Security
What are the two access privilege modes of the Cisco router?
User EXEC Mode: This is the initial access mode for a router. In this mode, the user can access only a limited set of basic monitoring commands.
Privileged EXEC Mode: This mode provides access to all router commands, such as debugging and configuration commands. It requires a password for access to ensure security.
What is the approach for password for the privileged mode of the router?
enable secret [password]
uses hashing algorithm so that the password is not in plain text but encrypted
How to ensure that all passwords in the router are stored in the encrypted form?
service password-encryption
What is the difference between the Cisco router’s startup and running configurations?
How to save the running configuration into start up configuration?
Startup Configuration: Stored in the NVRAM, this configuration is used to boot the router. It remains unchanged until an administrator explicitly saves the running configuration to it.
Running Configuration: Held in the router’s RAM, this configuration is active on the router. Changes to the router’s configuration are made here and are effective immediately.
Know and be able to configure all aspects of the Cisco router covered in class. For example,
configuring the router interfaces, setting the router OSPF ID, etc.
enable
configure terminal
hostname MyRouter
interface GigabitEthernet0/0
ip address 192.168.1.1 255.255.255.0
no shutdown
exit
interface Serial0/0/0
ip address 10.0.0.1 255.255.255.252
clock rate 64000
no shutdown
exit
router ospf 1
router-id 1.1.1.1
network 192.168.1.0 0.0.0.255 area 0
exit
enable secret mysecretpassword
line console 0
password myconsolepassword
login
exit
line vty 0 4
password myvtypassword
login
exit
crypto key generate rsa
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 2
ip route 0.0.0.0 0.0.0.0 192.168.1.254
access-list 10 permit 192.168.1.0 0.0.0.255
access-list 10 deny any
Practical Routing, OSPF, and Security
What is the difference between static and dynamic routing?
Static Routing: Involves manually setting up routes in the router's routing table through configuration commands. These routes do not change unless manually updated or removed. Static routing is simple, secure, and uses less bandwidth but lacks scalability and flexibility.
Dynamic Routing: Automatically adjusts routes in the routing table based on current network conditions using routing protocols. This approach allows for more flexibility, scalability, and fault tolerance, but consumes more resources and can be complex to configure.
What is the difference between link state and distance vector routing?
Distance Vector Routing: Routers using distance vector protocols calculate the best path to a destination based on the distance and direction (vector) to nodes. Updates are shared with neighboring routers at regular intervals or when changes occur. This approach can lead to slower convergence and issues like routing loops.
Link State Routing: Each router learns the entire network topology by exchanging link-state information. Routers then independently calculate the shortest path to every node using algorithms like Dijkstra’s. This results in quicker convergence and fewer routing loops.
Distance Vector Routing: Each router computes distance from itself to its next immediate neighbors. (RIP, EIGRP, & BGP)
-Does not build a full map of the network
-Focuses more on the next hop towards the destination
Link State Routing: Each router shares knowledge of its neighbors with every other router in the network. (OSPF and IS-IS)
-Builds a full map of the network
-Each router shares information
-Maintains a database of the entire network.
Give an example of the distance vector and link state algorithms.
Distance = RIPLink State = OSPF
What type of protocol is Routing Information Protocol (RIP)? Be able to understand
examples and solve problems.
Example of a distance vector protocol
dynamic protocol
-shares routing info with neighboring routers
-an interior gateway protocol that operates within autonomous system
-oldest of all dynamic protocol; RIPv1
-widely used open standard developed by IETF
-a distance vector routing protocol
-limited to maximum 15 hops;

 how rip works -rip sends regular update message (advertisements to neighboring routers) 

-every 30 seconds that resets after each successful ack
-route becomes invalid if it has not received a message for 180 seconds
-RIPv1 (obsolete) uses broadcast, while RIPv2 uses a multicast address -Update message only travel to a single hop
downside : limitations, each router in its table can only have one entry per destination. Have to wait for advertisement for an alternative path, cannot reach hops 15 paths away, little to no security.
What type of protocol is Open Shortest Paths First (OSPF) protocol? Be able to under-
stand examples and solve problems.

• an interior gateway protocol that operates within autonomous systems to build a full map of the network.
  
• widely used open standard developed by IETF
  

-a link state routing protocol

 intra as routing with RIP 

What is the Link State Advertisement (LSA) in OSPF? What is the Link State Database
(LSDB)?
-LSA contains data about a router, its subnets, and some other network information.-OSPF puts all the LSAs from different routers into a Link-State Database (LSDB)
The goal of OSPF is to be able to determine a complete map of the interior routing path to be able to create the best route possible.
The way this is done is that OSPF finds all the routers and subnets that can be reached within the entire network. The result is that each router will have the same information about the network by sending out LSA.
How does each router in OSPF create a map of the entire network?
Step 1 : Acquire neighbor relationship to exchange network information.
Step 2: Exchange database information, neighboring routers swap LSDB information with each other
Step 3: Choosing the best routes, each router chooses the best routes to add to its routing table based on the learned LSDB information.
What is the process for two OSPF routers to become neighbors?
A. a neighbor sends out a Hello packet including the router ID along with subnets that it routes to the given multicast address to a given OSPF area ID.

this is also a way for routers to tell neighbors that they are still on and good to go. 

B. Once other routers receive this packet, they run some checks. The neighboring routers must match the following requirements:
-area id needs to be the same (also used when scaling up OSPF)
-the shared or connecting link should be on the same subnet.
-The Hello and dead timer must be the same.
-the dead timer is having enogh time before the sending router assumes that the neighbor is down.
-this timer is typically 10 secs for point-to-point and broadcast networks.
C. If all is fine, the receiving router will go into Init stage and sends a hello message of its own. This Hello packet list its own network info along with the known neighbor R1. This puts R1 into a 2-way communication status.
D. R1 sends another Hello message to R2 with the information as a known neighbor. This allows the R2 now with a 2-way communication status as well.E. We now have a 2-way neighboring routers
What is the difference between point-to-point and multi-access networks? How does OSPF
handle each case?

Point-to-Point: A network setup where each connection is between two specific nodes or devices. OSPF treats these links with straightforward neighbor relationships since there are only two routers on each segment. 

Multi-Access Networks: Networks where multiple routers can connect on the same segment, such as Ethernet. OSPF uses a Designated Router (DR) and a Backup Designated Router (BDR) on these types of networks to reduce the amount of OSPF traffic and the size of the topological database.
DR selected by the highest OSPF prio.
Be able to configure OSPF routing given a topology.
–
Example:
Consider a topology with three routers R1, R2, and R3. The routers
are connected R1 =⇒R2 =⇒R3 =⇒R1.
R1 has interface f0/0 connected to the
interface f0/0 of R2. R2 has interface f0/1 connecting to the interface f0/0 of R3.
Finally R3 has interface 1/0 connecting to the interface 1/0 of R3. Assuming all
routers are Cisco 7200 routers, configure them to use OSPF to dynamically route in
this topology (you will be given the Cisco router manual for such questions).
•
R1enable
configure terminal
hostname R1
interface FastEthernet0/0
ip address 192.168.12.1 255.255.255.0
no shutdown
exit
interface FastEthernet1/0
ip address 192.168.31.1 255.255.255.0
no shutdown
exit
router ospf 1
router-id 1.1.1.1
network 192.168.12.0 0.0.0.255 area 0
network 192.168.31.0 0.0.0.255 area 0
exit
end
write memory
R2enable
configure terminal
hostname R2
interface FastEthernet0/0
ip address 192.168.12.2 255.255.255.0
no shutdown
exit
interface FastEthernet0/1
ip address 192.168.23.1 255.255.255.0
no shutdown
exit
router ospf 1
router-id 2.2.2.2
network 192.168.12.0 0.0.0.255 area 0
network 192.168.23.0 0.0.0.255 area 0
exit
end
write memory
R3enable
configure terminal
hostname R3
interface FastEthernet0/0
ip address 192.168.23.2 255.255.255.0
no shutdown
exit
interface FastEthernet1/0
ip address 192.168.31.2 255.255.255.0
no shutdown
exit
router ospf 1
router-id 3.3.3.3
network 192.168.23.0 0.0.0.255 area 0
network 192.168.31.0 0.0.0.255 area 0
exit
end
write memory
How does OSPF authenticate packets to protect against packet spoofing and tempering?
Be able to enable it a Cisco router.
OSPF (Open Shortest Path First) can authenticate packets to protect against packet spoofing and tampering using several methods. The two main types of authentication are:
Plain Text Authentication: This is simple and provides minimal security. It sends the password in clear text.
Message Digest 5 (MD5) Authentication: This provides stronger security by using cryptographic hash functions to authenticate OSPF packets.
Plain textenable
configure terminal
interface FastEthernet0/0
ip address 192.168.12.1 255.255.255.0
ip ospf authentication
ip ospf authentication-key cisco123
no shutdown
exit
router ospf 1
router-id 1.1.1.1
network 192.168.12.0 0.0.0.255 area 0
area 0 authentication
exit
write memory
MD5enable
configure terminal
interface FastEthernet0/0
ip address 192.168.12.1 255.255.255.0
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 securepassword
no shutdown
exit
router ospf 1
router-id 1.1.1.1
network 192.168.12.0 0.0.0.255 area 0
area 0 authentication message-digest
exit
write memory
Network Defense Fundamentals
•
What is IP spoofing? Explain.
-The ip packet contains the source and destination Ip addresses.-Is it straightforward to modify the ip address of the packet.
-IP Spoofing: sender chagrin his source address to something other than his real address.
How can IP spoofing be used in security attacks?
-If the attacker sends an Ip packet with a spoofed IP, they will not receive a response form the destination: the machine with the IP matching the spoofed IP will receive the response.Ip spoofing operation - the sender spoofs the source IP address to point to another target. The receiver system replies to the spoofed IP.
•
What are the countermeasures to IP spoofing?
Ingress and Egress Filtering: Network operators should implement filtering rules on routers and firewalls to block packets with source IP addresses that should not originate from those networks. Ingress filtering blocks incoming packets with a source IP address that is not valid for the network, while egress filtering blocks outgoing packets with an invalid source IP address.
Reverse Path Forwarding (RPF): This technique ensures that the incoming packets are received on the same interface that the router would use to send traffic back to the source. If the path does not match, the packet is discarded, preventing spoofed packets from passing through.
IPsec (Internet Protocol Security): IPsec can be used to authenticate and encrypt IP packets, ensuring that they come from legitimate sources and have not been tampered with. This makes spoofing attacks significantly more difficult.
How can IP spoofing be used to perform DoS attacks?
IP spoofing is often used in Denial of Service (DoS) attacks to obscure the attacker's identity and to overwhelm the target with traffic from what appears to be multiple sources. One common type of DoS attack that utilizes IP spoofing is a Smurf Attack. In a Smurf Attack, the attacker sends ICMP (Internet Control Message Protocol) echo requests to broadcast addresses of networks, with the source IP address spoofed to that of the victim. The devices on the network respond to the echo requests, sending replies back to the victim's IP address. This amplifies the traffic directed at the victim, potentially overwhelming their network and causing a DoS condition.
•
Know how to use
hping3
for performing ping floods.
Using hping3 to perform ping floods involves sending a high volume of ICMP Echo Request packets to a target to overwhelm it.basic ping floodsudo hping3 -1 --flood [target_IP]
Using spoofed source ipsudo hping3 -1 --flood -a [spoofed_IP] [target_IP]
Controlling the Packet Sending Rateo hping3 -1 --flood -i u1000 [target_IP]Combining sudo hping3 -1 --flood -a 10.0.0.1 -i u1000 192.168.1.1
Firewalling
What is a firewall?
a filtering device on a network that enforces network security policy and protects the network against external attacks.
According to NIST SP 800-41, what are the characteristics of a firewall?
NIST standard defines the possible characteristics that a firewall can use to filter traffic.
-(IP Address and Protocol type) filtering based on source/destination IP address/ports, traffic direction and other transport layer characteristics.
-(Application Protocols)controls access based on application protocol data
-(User identity) controls access based on user identity
-(Network activity)
What are the limitations of the firewall?
Firewall capabilities: -Define a traffic chokepoint in the network and protects against IP spoofing and routing attacks
-Provide a location for monitoring the security events -Provide non-security functions: loggin internet usage, network address translation-Serve as platform for VPN/IPSec
Firewall limitations:-protect against attacks bypassing the firewall, connections from inside the organization to the outside that do not go through the firewall.-protect against internal threats such as disgruntled employees.
What is a packet filter firewall? Be able to write and interpret rules and to spot configu-
rationflaws.
Packet filtering firewall : applies a set of rules to each packet based on the packet headers.Filters based on: source/destination IP, source/destination port numbers, IP Protocol Field:defines the transport protocol, Interface : for firewalls with 3+ network interfaces, the interface from which the packet came from/going to
•
What is the difference between the default and allow and default deny policies? Which
one is the more secure one?
-when no rules apply to a packet, a default rule is applied: default deny : what is not explicitly permitted is denied default forward : what is not explicitly denied is allowed
default deny is more secure, you dont have to identify all of the cases that needs to be blocked, if one is missed, default deny will deny it.
Port 0-1023 reserved
1024-2**17 ephemeral
source port used by the system initialiatizng a connection is always chosen from the ephemeral ports
Be able to configure the packet filtering functions of iptables.
–
Example:
Write iptables rules to block all ICMP traffic to and from the system.
iptables -A INPUT -p icmp -j DROP
iptables -A OUTPUT -p icmp -j DROP
Example:
Write iptables rules to block all traffic on port 22
iptables -A INPUT -p tcp --sport 22 -j DROP
iptables -A OUTPUT -p tcp --dport 22 -j DROP
–
Example:
Write iptables rules to block traffic to host 192.168.2.2
iptables -A OUTPUT -p tcp --dest 192.168.2.2 -j DROP
iptables -A INPUT -p tcp --src 192.168.2.2 -j DROP
What are the limitations of the packet filter firewall?
-does not examine upper layer data : cannot prevent attacks that employ application specfic vulnerabilities or functions.cannot block application specific commands.
•
What is the stateful firewall and how does it compare to a packet filter?
A stateful firewall is a network security device that monitors and tracks the state of active connections, making decisions based on the context of the traffic. Unlike a simple packet filter, which examines individual packets in isolation based on predetermined rules, a stateful firewall keeps track of connections over time, distinguishing between legitimate packets that are part of an established session and potentially malicious ones. This contextual awareness allows it to block unauthorized connection attempts and prevent attacks such as spoofing and session hijacking. While packet filters, or stateless firewalls, operate faster and consume fewer resources by applying static rules to each packet independently, they lack the sophisticated traffic pattern handling and enhanced security provided by stateful firewalls.
•
What is the application-level firewall? What are its advantages and limitations?
An application-level firewall, also known as an application firewall or proxy firewall, operates at the application layer of the OSI model. It inspects and filters traffic based on the specific application protocols (e.g., HTTP, FTP, DNS) rather than just IP addresses and port numbers. limitations : increased communications overhead due to two separate TCP connections

 and not transparent to the client 

Application-level gateways are also known as application-level proxies.
-act as a relay for the application-level traffic.
-runs at the application layer, and examines application-layer data
Supported ProtocolsFTPSTMPHTTP
What is a circuit-level firewall? What are its advantages and limitations?
-Similar to the application-level gateway, but only tracks the state of the TCP/UDP sessions.
-Does not examine application data , simply relays TCP segments
-Allow/deny decisions based on whether a packet belongs to an established and trusted connection
Advantage of circuit-level firewall -do not filter individual packets(simplifies rules)

-fast and efficient 

Disadvantages:

-do not filter individual packets -require frequent updates: traffic is filtered with rules and policies that need regular updates for new threats and risks -the vendor needs to modify the TCP/IP implementation for thor applications to use the circuit-level proxy. 

What are the different approaches to basing the firewall?

-stand-alone machines -software modules in roosters, switches, or servers, or pre-configured security appliances. 

What are the host-based firewalls?
Host-based firewalls: a firewall software module used to secure a single host.
What are the network device firewalls?
Network device firewall = routers and switches often have firewall functions, like packet filtering and stateful inspection, to check and filter packets
What are the virtual firewalls?
-in a virtualized environment, servers, switches, and routers can be virtualized and share physical hardware. The hypervisor that manages the virtual machines can also have firewall capabilities.
What is the DMZ? How is it used for securing networks?
A Demilitarized Zone (DMZ) in network security is a physical or logical subnetwork that contains and exposes an organization's external-facing services to an untrusted network, typically the internet. The primary purpose of a DMZ is to add an additional layer of security to an organization's local area network (LAN). By isolating these externally accessible services, the DMZ ensures that if an attacker gains access to the public-facing systems, they do not have direct access to the rest of the network.
How the DMZ Secures Networks
Isolation of Public Services: Services that need to be accessible from the outside, such as web servers, mail servers, FTP servers, and DNS servers, are placed in the DMZ. These services are isolated from the internal network, which helps protect the internal systems from attacks that may exploit vulnerabilities in the public-facing services.
Controlled Access: Firewalls are used to create boundaries between the internet, the DMZ, and the internal network. The firewall rules are configured to allow only specific types of traffic to and from the DMZ. For example, incoming web traffic might be allowed to reach a web server in the DMZ, but not to access internal systems directly.
Minimal Exposure: Only the necessary services are exposed to the internet. This minimizes the attack surface, reducing the number of entry points that an attacker can exploit. Internal systems and data remain protected behind the additional layer of the firewall.
Layered Security: The DMZ provides an additional layer of defense (defense-in-depth). Even if an attacker manages to compromise a server in the DMZ, the internal network is still protected by another firewall, making it harder for the attacker to penetrate further.
Monitoring and Logging: Activities within the DMZ can be closely monitored and logged. Any suspicious behavior can be detected early, and appropriate actions can be taken to mitigate potential threats before they impact the internal network.
Traffic Filtering: The firewalls between the internet and the DMZ, as well as between the DMZ and the internal network, can filter traffic based on IP addresses, ports, and protocols. This filtering ensures that only legitimate traffic is allowed and that malicious traffic is blocked.
-if attacker compromises a server on the network, they will be able to pivot to other systems on the network.
What are the advantages and disadvantages of having the two DMZ firewalls be from
different vendors?
Using different firewall manufacturers for the two firewalls maybe a good idea, avoids possibility of both having the same vulnerability but introduces more complexity and management overhead.
Be able to write pfSense firewall rules
Penetration Testing
•
What is penetration testing?
-legal and suthorzied attempt to locate and exploit vulnerable systems for the purpose of making those systems more secure.

pen testing, pt, hacking, ethical hacking, whitehate hacking, offensive security, red teaming 

What is the objective of the penetration testing?

Use tools and techniques used by the attackers in order to discover security vulnerabilities before the attackers do. 

What is the BAD pyramid?

The purpose of a red team is to find ways to improve the blue team, so purple teams should not be needed in an organization where the red/blue teams interaction is healthy and functioning properly. 

red attack
purple defender changes based off attack knowledge
blue defend
green builder changes based on defender knowledge
yellow build
orange builder changes based on attacker knowledge
Why are the penetration tests conducted?
-a company may want to have a stronger understanding of their security footprint.

-system policy shortcomings -network protocol weaknesses -network/software misconfigurations -software vulnerabilities 

What is the difference between penetration testing and vulnerability assessment?
-two terms often incorrectly ,interchangeably used in practice.
-vulnerability assessment : review of systems services to find potential vulnerabilities-penetration testing: finding an exploiting system vulnerabilities as proof-of-concept
What is the difference between black-box, white-box, and grey-box testing.
Black-Box Testing
Tester Knowledge: The tester has no knowledge of the internal structure, code, or implementation details of the system.
-lack knowledge of system
White-Box Testing
Tester Knowledge: The tester has full knowledge of the internal structure, code, and implementation details of the system.
-very thorough , but not completely realistic
Grey-Box Testing
Tester Knowledge: The tester has partial knowledge of the internal structure, code, or implementation details of the system.
What is the difference between ethical and unethical hackers?
-penetration testers, with proper authorization of the company, help improve the security of the company.
-unethical hackers, personal gain through extortion or other devious methods, profit, revenge, fame, etc. No authorization to conduct the attacks
•Ethical vs unethical hacking, penetration testers: obtain the authorization from the organization whose systems they plan to attack unethical hackers: attack without authorization.
Know the stages of penetration testing and the importance of following a structured ap-
proach.
–
Planning and Reconnaissance:
Planning: Define the scope and goals of the test, including the systems to be tested and the testing methods.
Reconnaissance: Gather information about the target, such as IP addresses, domain names, and network infrastructure, to understand how to approach the test.
Scanning:
Purpose: Identify potential entry points and vulnerabilities in the target system.
Methods: Use tools to scan for open ports, services running on those ports, and known vulnerabilities.
Gaining Access:
Purpose: Attempt to exploit identified vulnerabilities to gain unauthorized access to the system.
Techniques: Use techniques like password cracking, SQL injection, or exploiting software vulnerabilities.
Maintaining Access:
Planning and Reconnaissance:
Purpose: Ensure continued access to the compromised system to understand the potential impact of a prolonged attack.
Methods: Install backdoors or use other methods to maintain control over the system.
Analysis and Reporting:
Scanning
Purpose: Document the findings, including vulnerabilities discovered, methods used, and the level of access achieved.
Report: Provide a detailed report to the organization, highlighting the risks and recommending steps to mitigate the vulnerabilities.
Remediation:
Gaining Access
Purpose: Address and fix the identified vulnerabilities to improve the security of the system.
Action: Implement the recommended security measures from the report to protect against future attacks.
Retesting:
Maintaining Access
Purpose: Verify that the vulnerabilities have been successfully remediated.
Process: Conduct a follow-up test to ensure that the fixes are effective and no new issues have been introduced.
Importance of Following a Structured Approach
Consistency: A structured approach ensures that each stage is systematically followed, making the testing thorough and reliable.
Comprehensiveness: Following each stage helps identify and address all potential vulnerabilities, leaving no gaps in the security assessment.
Documentation: A structured method produces detailed documentation, which is crucial for understanding the security posture and for future reference.
Effectiveness: It ensures that the penetration test effectively mimics real-world attack scenarios, providing valuable insights into how an actual attacker might exploit vulnerabilities.
Risk Management: By identifying and addressing vulnerabilities, organizations can proactively manage security risks and protect their assets from potential attacks.
Example:
What is the difference between the passive and active reconnaissance?
•
Passive Reconnaissance
Definition: Gathering information about the target without directly interacting with the target system or network. The aim is to collect data without alerting the target.
Methods:
Publicly Available Information: Searching for information that is freely available on the internet, such as social media profiles, company websites, and news articles.
DNS Queries: Looking up domain registration information (WHOIS data), DNS records, and IP address ranges.
Network Traffic Analysis: Capturing and analyzing network traffic without sending packets to the target (e.g., using tools like Wireshark in a non-intrusive manner).
Search Engines: Using search engines to find information about the target, such as employee names, email addresses, and technical details.
Advantages:
Low Risk: Minimizes the chance of detection by the target because no direct interaction occurs.
Stealth: Suitable for the early stages of reconnaissance when the goal is to remain undetected.
Disadvantages:
Limited Information: May not provide as much detailed or specific information about vulnerabilities or configurations as active reconnaissance.
Active Reconnaissance
Definition: Actively engaging with the target system or network to gather information. This involves direct interaction, such as sending packets or probing the target.
Methods:
Network Scanning: Using tools like Nmap to scan for open ports, running services, and network topology.
Vulnerability Scanning: Running vulnerability scanners (e.g., Nessus, OpenVAS) to identify known weaknesses in the target systems.
Social Engineering: Directly interacting with individuals (e.g., phishing attacks) to gather information.
Probing and Enumerating: Sending specific queries or packets to the target to elicit responses that reveal information about the system (e.g., banner grabbing).
Advantages:
Detailed Information: Provides more detailed and specific information about the target's vulnerabilities, configurations, and active services.
Identification of Weaknesses: More effective in identifying exploitable vulnerabilities that can be used in subsequent attack phases.
Disadvantages:
Higher Risk: Increases the risk of detection by the target, which could alert them to the reconnaissance activity.
Potential Legal Issues: Unauthorized active reconnaissance can lead to legal repercussions if done without permission.
Summary
Passive Reconnaissance: Involves gathering information without direct interaction with the target, resulting in lower risk of detection but potentially less detailed information.
Active Reconnaissance: Involves direct interaction with the target to gather detailed information, but carries a higher risk of detection and potential legal consequences.
Both types of reconnaissance are essential in penetration testing to understand the target's environment and identify potential vulnerabilities while balancing the need for stealth and detailed information.
Be able to use the penetration testing tools discussed in class
nmap 192.168.1.1
nmap -sS -sV -O -A 192.168.1.1-sS: Perform a stealth SYN scan.
-sV: Detect service versions.
-O: Detect operating system.
-A: Perform aggressive scan (includes OS detection, version detection, script scanning, and traceroute).

Good evening.
We moved in to a new build house (England) on an estate in 2021. Our house is on a shared driveway, which has seven houses, and is accessible from either end of the shared driveway. We are the middle house of the seven. We own the land in front of the house, as outlined in the development plot plan.
A few months ago (February 2024), we received an email outlining that the housing building company intended to install a series of bollards directly in front of our next door neighbour. The impact of this means that we would no longer be able to directly access our house without driving around the estate to the other end of the shared drive way, and that we could not longer have enough room to reverse and turn out of our drive way.
These bollards were not present on the plot plans that were shared with us when we purchased the house.
Residents were informed by email that no action would be taken if a single resident objected to the proposals. at least three of the seven responded and did not agree to the bollards to be built.
Today, we received an email saying that despite this, they would be going ahead with the plans to install the bollards. They sent across a snippet of a plot development plan that differs than the one that we originally looked at and signed.
We are rightfully frustrated that our views have not been listened to.
Where do we stand within our legal rights for them to come and install the bollards without our express permission, and not sharing these plot development plans with us at the time of purchase?
Thank you for your help in advance.

While there's no harm in watching video tutorials (unless the videos you find suggest adding eleventy billion scripts, effects, or plugins before the video creator gets to the meaty bits of what they're trying to explain) and newer people might have a hard time finding detailed tutorials and guides, I figured I'd put this post together, that way this information is accessable for anyone who might be interested.
Most of these tutorials are written, rather than being in video format, but the people who wrote them went into a lot of detail and when they're talking about things that would benefit from including pictures, the majority of the authors do include those visual aids as well. The mapping tutorials that were written for Ace are very good, by the way-- and they can be used for any RPG Maker engine, for the most part. You might need to tweak some of the techniques for MV or MZ, but even if you do need to, there shouldn't be too many alterations to make.
95 and 98: I was not able to find anything worthwhile for them; however, since there was no coding required, both are extremely easy to learn! (I used both decades ago, but considering how long it's been since I messed with either, I would be pretty horrible at writing anything up for them.)
2K (2000): Unfortunately, it's become pretty difficult to find a ton of tutorials for 2000. However, Don Miguel's site is still online and has links to numerous tutorials (just search Google for "Don Miguel RPGMaker 2000," since posting that link here triggered the filters the first time I tried to post it.)
2K3/2003 There are two pages, but that does include a three-part beginners' guide and information about how to balance a game, so despite there not being a shitload of tutorials there, many things are covered.
Even though it's in Japanese (which I know not everyone can speak or read) YADOT has a ton of tutorials for 2K/2K3 and if you can't read Japanese, Google's translator should be able to help~
For XP There are only two pages, but quite a bit is covered there.
VXA (VX Ace) There are fourteen pages available here and they cover tons of material, from the basics and mapping, to eventing, scripting, creating puzzles and other helpful information
MV Eighteen pages can be found here and they cover tons of information
MZ There are only five pages of tutorials here so far, but they might be a good starting point!
Other Tutorials For The Older Engines Some engines only have a few tutorials here (MV and MZ aren't covered on RMRK's forums, since they ended up becoming inactive quite a while back), but they also include general guides, including writing.

Hello everyone!
I just got my 2020 Bolt EV Premier a month ago and wanted to give an update on my experience as well as ask some questions now that I have had it for a month.
First off my commute is mostly county routes. So not highways but not city. Speed limits are around 40-50 with some traffic lights and thanks to the 50-80 degree weather I'm seeing about 5.1mi/kwh over the past 800 miles of ownership. I expect this to drop as it gets hotter and A/C is needed as well as with the Chicago winters.
The big risk for me is I do NOT have access to even level 1 charging at my condo currently. That said its been mostly painless. I have a level 3 charger (EVGO) down the street which I have not needed to use yet. I work for a town that does have a small grocery chain with level 2 charging and they don't mind me charging while at work so I simply plug in and ride my scooter to work once every week or so to charge. So not having home charging is doable but definitely not for everyone!
Overall the Bolt is great. Good features, decent ride quality, decent range the perfect around the city go kart!
Onto some questions I had.
We rented at 2022 Bolt EV on a trip recently and I could have sworn that OPD worked in reverse. Is that true or am I wrong?
Is there anyway to not make it chose the radio by default? Everytime I get in the car and when I get home and disconnect android auto it switches back to the radio and blasts it. In my Camaro it wouldn't play anything until I either selected android auto or selected the radio and disconnecting at home didn't default back to the radio.
I have the EcoHitch installed for a bike rack, and some window tint to help with heat. Any other mods/addons people found helpful when they first got the car?
Thanks in advance and happy to be part of the EV community now!

Deadline: May 31st, 2024
Amount: $1,500 (2)
Description: Inquire Higher is a 501(c)(3) nonprofit organization that promotes the success of Black students and professionals through multimedia and community support.
It will award The Black Student Success Scholarship to at least two students in 2024:

• One high school senior who plans to enter college or trade school in Fall 2024
• A current undergraduate or trade school student who expects to graduate in Fall 2024 or later

Winners will also have access to college success mentorship and career guidance resources from Inquire Higher. We understand that every dollar counts, and want to provide students with the opportunity to create one less worry as they begin their college or career journeys.
APPLY HERE!

You've got this!!

Alright, so after playing around 50 games on CoH3 with all 4 factions and all game modes, here's my verdict based on a comparison to CoH2:
Positive aspects of CoH3:

Visually pleasing graphics
More realistic squad size mostly
Qol improvements (auto reinforce, autovaulting, tank riding)
More units variety and a pleasing light vehicle play
In game currency easier to reach
Includes never seen before units
Every faction has access to an ambulance and can tow weapons and recrew on front

Now, what's to be improved by priority:
1)High priority:

The sound effects, has been said a lot but man...where to start ? Well first of all the units being attacked cues should be given priority over everything else, the problem is that the battles, especially team battles are a sound-fest, the "our point is being captured" shout gave me a serious headache (literally lol), it should be down toned or selective to only the points you personally defend, or you could have the player have the option to select which point he wishes to know about constantly. The voice line could be replace by a sound cue maybe. The explosions are loud but they don't seem really well made too.
The vehicles movement! Man.. the "you always have to press reverse command" thing just doesn't want to stick with me. Maybe it's a me thing, but come on, at least on short distances we should be able to move backwards without extra micro. It's just a habit from Coh2 maybe.
Certain call ins are waaaaaay too oppressive, so much they make the game end (yes I'm looking at you Carpet Bombing) they definitely need to be toned down, call ins are supposed to be a bonus to swing the pendulum of a balanced fight your way, not a goddamn supernova that falls on your army.
Balance and game flow : so much to say here it could warrant it's own post.

2)Low priority (opinion) : I'm not gonna pretend that my opinion here should be THE opinion, but I've noticed a few things :

indirect fire takes a lot of place in the game, which forces everyone to play it and get mobile infantry only besides the fact that mobile infantry is already more useful and powerful than line static infantry due to the fact it can push, decrew team weapons or force retreats more easily, the new high health based system of combat makes them not drop models when approaching enemy defensive troops in their cover. It is a bit too much.
Faction balance in the current meta forces players into repetitive play styles : USF ranger blobs, ukf double Australian triple infantry, Dak just stalls until their late game vehicle play and has to play like pussy, wehr just spams team weapons until they can unleash a mass of pz4 or panthers. It reminds me of the funny days of coh1 back when the series was trying to find its way, the lessons from CoH2 final patches should be duly copied, the str genre is a delicate flower to balance and find a consistent pleasure in each game without it being a chore or boring or frustratingly unfair, I rq'd two times already due to a ranger blob and a carpet bombing, while I never rq'd in Coh2 ever.

TL;DR : just read the damn thing come on.
Thanks.

I feel like a lot of this sub slanders DIY HRT and why it should not be available and I guess I want to talk about honestly why it is important. I will mainly be talking about DIY estrogen as that is the form I have most experience with. I am mainly going to talk about DIY HRT for adults rather than Minors as that becomes its own ethical issue.
The biggest thing this sub fails to understand is how absolutely low quality a majority of trans care is. In my state the doctor I go to specifically is centered around catering for queer people, I know more about my own hrt and injections than he does. Now not saying its not important to seem him as obviously doing blood work and checking my levels requires a lab to go to. A majority of the time well informed trans patients know more about there own healthcare than qualified doctors.
Many people here knock DIY HRT or even informed consent and don't realize without those care is actually inaccessible for a majority of people. When I had my own gender dysphoria diagnosis from three separate therapists and tried to access care the legitimate way. There was not a single doctor within 8 hours of me to actually provide me that care. In the U.K waitimes for public access care can be up to 5 years. This sub has spoken a lot on how passing affects quality of life. Transitioning at 18 versus 23 is a big deal and reversing those effects can cost tens of thousands of dollars due to surgery. If the U.K were to ban imported HRT almost all of the trans people I know who are adults in the U.K would lose access to their care.
Most trans people acknowledge that we shouldn't have to resort to DIY HRT but there have been times in my life where the only actually prescription that works for me was not being produced. My only option to buy my Estrogen was either grey market pharmacies in Taiwan or DIY providers.
At the current moment many of us literally cannot transition without DIY HRT.

home/garage/GarageDoocommand/door open home/garage/GarageDoocommand/door open home/garage/GarageDoocommand/light on home/garage/GarageDoostatus/light on home/garage/GarageDoocommand/light off home/garage/GarageDoostatus/light off 

home/garage/GarageDoostatus/door opening home/garage/GarageDoostatus/light on home/garage/GarageDoostatus/door stopped home/garage/GarageDoostatus/door closing home/garage/GarageDoostatus/door closed 

ratgdo v2.53 for hardware v2.50 - GarageDoor 

Hello everyone,
I am currently researching the topic of using ML algorithms for Rate Adaptation (RAA) in wireless networks, specifically 802.11ax. My research objective is to demonstrate the capability and effectiveness of ML algorithms (in this case DQN) and how they are able to surpass conventional algorithms like Minstrel or Ideal in throughput.
To do this research, I am using Network Simulator 3 (NS3) as the main training and testing environment for the DQN algorithm. Then, to solve the problem of communicating between Python and NS3 (written in C++), I am using the ns3-ai module, which utilizes a shared memory pool approach to this situation.
The main problem I am encountering is the lack of implementation code anywhere on the internet on this specific topic. I have gone through a few research papers like "ns3-ai: Rate Control for Wireless LAN by Deep Q-Network.pdf&iconf=SISA&year=2022&vol=69&number=SS1-6&lang=E)", "NS3-AI: Enable Applying Artificial Intelligence to Network Simulation in ns-3", and "Rate Adaptation with Q-Learning in CSMA/CA Wireless Networks". While they did give me valuable insights, they never go in depth about how exactly the code was written.
So, my questions is, how would I go upon using DQN in NS3 and ns3-ai? How would I observe the states and perform actions in NS3? Given that it is not the typical gymnasium environment where the environment kind of "accepts" actions.
Here is what I have tried.

• I have tried to understand/reverse-engineer the sample code provided
• I have read through their tutorial, but it only describes a simple scenario of sending data back and forth between Python and C++, disregarding the NS3 simulation environment.
• The creator says that there is skeleton code but I can't find it.

I would highly appreciate any help I get!

Efficient Bookkeeping Services: Streamlining Your Financial Management with Parsh.ae

In the realm of business, the meticulous management of financial records is not merely a mundane task; it is the backbone upon which successful enterprises thrive. In the dynamic landscape of Dubai's bustling economy, where businesses flourish and evolve at a rapid pace, the significance of robust bookkeeping services cannot be overstated. This is where Parsh.ae steps in, offering unparalleled expertise in accounting and bookkeeping services tailored to meet the diverse needs of businesses in the UAE.

Precision in Practice:

At Parsh.ae, precision is not just a virtue; it's a standard that defines our approach to bookkeeping. With a team of seasoned professionals adept at navigating the intricacies of financial documentation, we ensure that every transaction, expense, and revenue stream is accurately https://parsh.ae/bookkeeping.phprecorded and meticulously organized. By maintaining pristine records, we empower businesses to make informed decisions, identify areas for growth, and optimize their financial performance with confidence.

Tailored Solutions for Every Need:

Recognizing that each business is unique, Parsh.ae offers bespoke bookkeeping solutions designed to align seamlessly with the specific requirements of our clients. Whether you're a startup seeking to establish a solid financial foundation or a well-established corporation aiming to streamline your accounting processes, our customizable services cater to businesses of all sizes and industries. From basic bookkeeping tasks to comprehensive financial analysis, we adapt our approach to suit your objectives, ensuring maximum efficiency and effectiveness.

Embracing Technology for Efficiency:

In an era defined by technological innovation, Parsh.ae leverages cutting-edge tools and software to enhance the efficiency and accuracy of our bookkeeping services. By harnessing the power of automation, cloud-based platforms, and integrated accounting systems, we streamline mundane tasks, minimize errors, and provide real-time access to financial data. This not only saves time and resources but also enables businesses to stay agile and responsive in an ever-evolving market landscape.

Compliance and Confidentiality:

In the realm of finance, adherence to regulatory standards and data confidentiality are non-negotiable principles. At Parsh.ae, we uphold the highest standards of compliance, ensuring that our bookkeeping practices align with the latest regulations and guidelines set forth by relevant authorities. Moreover, we prioritize data security and confidentiality, implementing robust measures to safeguard sensitive information and instilling trust and peace of mind in our clients.

Unrivaled Support and Expertise:

Beyond mere bookkeeping, Parsh.ae serves as a trusted partner and advisor to businesses seeking to navigate the complexities of financial management. Our team of experienced professionals brings a wealth of knowledge and expertise to the table, offering insights, guidance, and strategic recommendations to help our clients achieve their financial goals and unlock their full potential for growth and success.

In conclusion, at Parsh.ae, we understand that effective bookkeeping is more than just a routine task—it's a cornerstone of financial stability and business success. With our unwavering commitment to precision, customization, technological innovation, compliance, and expert support, we empower businesses across the UAE to take control of their finances, make informed decisions, and thrive in today's competitive landscape. Discover the difference that Parsh.ae can make for your business and embark on a journey towards financial excellence today.

Hoping someone can help. PfSense is not responding on the web gui after I made some changes to bandwidth limiters (at least that's what I think I did). Tried to access the serial console to load a backup and logged in as an account with admin privileges (admin is kept disabled).
I bring up the serial console using /etc/rc.initial but none of the console menu options will execute and all throw a series of errors - see below. Am I missing something (I'm a noob at the BSD console), or is the box bricked (and is there anything I can do to recover)?
Thanks in advance!
0) Logout (SSH only) 9) pfTop
1) Assign Interfaces 10) Filter Logs
2) Set interface(s) IP address 11) Restart webConfigurator
3) Reset webConfigurator password 12) PHP shell + pfSense tools
4) Reset to factory defaults 13) Update from console
5) Reboot system 14) Enable Secure Shell (sshd)
6) Halt system 15) Restore recent configuration
7) Ping host 16) Restart PHP-FPM
8) Shell
Enter an option: 4
PHP Fatal error: Uncaught TypeError: array_path_enabled(): Argument #1 ($arr) must be of type array, null given, called in /etc/inc/config.lib.inc on line 1250 and defined in /etc/inc/util.inc:3662
Stack trace:

0 /etc/inc/config.lib.inc(1250): array_path_enabled(NULL, 'notifications/s...', 'disable')

1 /etc/inc/notices.inc(379): config_path_enabled('notifications/s...', 'disable')

2 /etc/inc/notices.inc(662): notify_via_smtp('No config.xml f...')

3 /etc/inc/notices.inc(151): notify_all_remote('No config.xml f...')

4 /etc/inc/config.lib.inc(95): file_notice('config.xml', 'No config.xml f...', 'pfSenseConfigur...', '')

5 /etc/inc/config.inc(137): parse_config()

6 /etc/inc/gwlb.inc(25): require_once('/etc/inc/config...')

7 /etc/inc/functions.inc(35): require_once('/etc/inc/gwlb.i...')

8 /etc/rc.initial.defaults(32): require_once('/etc/inc/functi...')

9 {main}

thrown in /etc/inc/util.inc on line 3662
Fatal error: Uncaught TypeError: array_path_enabled(): Argument #1 ($arr) must be of type array, null given, called in /etc/inc/config.lib.inc on line 1250 and defined in /etc/inc/util.inc:3662
Stack trace:

0 /etc/inc/config.lib.inc(1250): array_path_enabled(NULL, 'notifications/s...', 'disable')

1 /etc/inc/notices.inc(379): config_path_enabled('notifications/s...', 'disable')

2 /etc/inc/notices.inc(662): notify_via_smtp('No config.xml f...')

3 /etc/inc/notices.inc(151): notify_all_remote('No config.xml f...')

4 /etc/inc/config.lib.inc(95): file_notice('config.xml', 'No config.xml f...', 'pfSenseConfigur...', '')

5 /etc/inc/config.inc(137): parse_config()

6 /etc/inc/gwlb.inc(25): require_once('/etc/inc/config...')

7 /etc/inc/functions.inc(35): require_once('/etc/inc/gwlb.i...')

8 /etc/rc.initial.defaults(32): require_once('/etc/inc/functi...')

9 {main}

thrown in /etc/inc/util.inc on line 3662
PHP ERROR: Type: 1, File: /etc/inc/util.inc, Line: 3662, Message: Uncaught TypeError: array_path_enabled(): Argument #1 ($arr) must be of type array, null given, called in /etc/inc/config.lib.inc on line 1250 and defined in /etc/inc/util.inc:3662
Stack trace:

0 /etc/inc/config.lib.inc(1250): array_path_enabled(NULL, 'notifications/s...', 'disable')

1 /etc/inc/notices.inc(379): config_path_enabled('notifications/s...', 'disable')

2 /etc/inc/notices.inc(662): notify_via_smtp('No config.xml f...')

3 /etc/inc/notices.inc(151): notify_all_remote('No config.xml f...')

4 /etc/inc/config.lib.inc(95): file_notice('config.xml', 'No config.xml f...', 'pfSenseConfigur...', '')

5 /etc/inc/config.inc(137): parse_config()

6 /etc/inc/gwlb.inc(25): require_once('/etc/inc/config...')

7 /etc/inc/functions.inc(35): require_once('/etc/inc/gwlb.i...')

8 /etc/rc.initial.defaults(32): require_once('/etc/inc/functi...')

9 {main}

thrownPHP Fatal error: Uncaught TypeError: array_path_enabled(): Argument #1 ($arr) must be of type array, null given, called in /etc/inc/config.lib.inc on line 1250 and defined in /etc/inc/util.inc:3662
Stack trace:

0 /etc/inc/config.lib.inc(1250): array_path_enabled(NULL, 'notifications/s...', 'disable')

1 /etc/inc/notices.inc(379): config_path_enabled('notifications/s...', 'disable')

2 /etc/inc/notices.inc(662): notify_via_smtp('PHP ERROR: Type...')

3 /etc/inc/notices.inc(151): notify_all_remote('PHP ERROR: Type...')

4 /etc/inc/config.lib.inc(1154): file_notice('phperror', 'PHP ERROR: Type...', 'PHP errors')

5 [internal function]: pfSense_clear_globals()

6 {main}

thrown in /etc/inc/util.inc on line 3662
Fatal error: Uncaught TypeError: array_path_enabled(): Argument #1 ($arr) must be of type array, null given, called in /etc/inc/config.lib.inc on line 1250 and defined in /etc/inc/util.inc:3662
Stack trace:

0 /etc/inc/config.lib.inc(1250): array_path_enabled(NULL, 'notifications/s...', 'disable')

1 /etc/inc/notices.inc(379): config_path_enabled('notifications/s...', 'disable')

2 /etc/inc/notices.inc(662): notify_via_smtp('PHP ERROR: Type...')

3 /etc/inc/notices.inc(151): notify_all_remote('PHP ERROR: Type...')

4 /etc/inc/config.lib.inc(1154): file_notice('phperror', 'PHP ERROR: Type...', 'PHP errors')

5 [internal function]: pfSense_clear_globals()

6 {main}

thrown in /etc/inc/util.inc on line 3662
PHP Fatal error: Uncaught ValueError: Path cannot be empty in /etc/inc/notices.inc:135
Stack trace:

0 /etc/inc/notices.inc(135): fopen('', 'w')

1 /etc/inc/config.lib.inc(95): file_notice('config.xml', 'No config.xml f...', 'pfSenseConfigur...', '')

2 /etc/inc/config.gui.inc(53): parse_config()

3 /etc/inc/auth.inc(34): require_once('/etc/inc/config...')

4 /etc/inc/openvpn.inc(36): require_once('/etc/inc/auth.i...')

5 /etc/inc/filter.inc(30): require_once('/etc/inc/openvp...')

6 /etc/inc/ipsec.inc(25): require_once('/etc/inc/filter...')

7 /etc/inc/gwlb.inc(27): require_once('/etc/inc/ipsec....')

8 /etc/inc/functions.inc(35): require_once('/etc/inc/gwlb.i...')

9 /etc/inc/notices.inc(26): require_once('/etc/inc/functi...')

10 /etc/inc/config.inc(37): require_once('/etc/inc/notice...')

11 /etc/rc.banner(27): require_once('/etc/inc/config...')

12 {main}

thrown in /etc/inc/notices.inc on line 135
Fatal error: Uncaught ValueError: Path cannot be empty in /etc/inc/notices.inc:135
Stack trace:

0 /etc/inc/notices.inc(135): fopen('', 'w')

1 /etc/inc/config.lib.inc(95): file_notice('config.xml', 'No config.xml f...', 'pfSenseConfigur...', '')

2 /etc/inc/config.gui.inc(53): parse_config()

3 /etc/inc/auth.inc(34): require_once('/etc/inc/config...')

4 /etc/inc/openvpn.inc(36): require_once('/etc/inc/auth.i...')

5 /etc/inc/filter.inc(30): require_once('/etc/inc/openvp...')

6 /etc/inc/ipsec.inc(25): require_once('/etc/inc/filter...')

7 /etc/inc/gwlb.inc(27): require_once('/etc/inc/ipsec....')

8 /etc/inc/functions.inc(35): require_once('/etc/inc/gwlb.i...')

9 /etc/inc/notices.inc(26): require_once('/etc/inc/functi...')

10 /etc/inc/config.inc(37): require_once('/etc/inc/notice...')

11 /etc/rc.banner(27): require_once('/etc/inc/config...')

12 {main}

thrown in /etc/inc/notices.inc on line 135
PHP ERROR: Type: 1, File: /etc/inc/notices.inc, Line: 135, Message: Uncaught ValueError: Path cannot be empty in /etc/inc/notices.inc:135
Stack trace:

0 /etc/inc/notices.inc(135): fopen('', 'w')

1 /etc/inc/config.lib.inc(95): file_notice('config.xml', 'No config.xml f...', 'pfSenseConfigur...', '')

2 /etc/inc/config.gui.inc(53): parse_config()

3 /etc/inc/auth.inc(34): require_once('/etc/inc/config...')

4 /etc/inc/openvpn.inc(36): require_once('/etc/inc/auth.i...')

5 /etc/inc/filter.inc(30): require_once('/etc/inc/openvp...')

6 /etc/inc/ipsec.inc(25): require_once('/etc/inc/filter...')

7 /etc/inc/gwlb.inc(27): require_once('/etc/inc/ipsec....')

8 /etc/inc/functions.inc(35): require_once('/etc/inc/gwlb.i...')

9 /etc/inc/notices.inc(26): require_once('/etc/inc/functi...')

10 /etc/inc/config.inc(37): require_once('/etc/inc/notice...')

11 /etc/rc.banner(27): require_once('/etc/inc/config...')

12 {main}

thrownPHP Fatal error: Uncaught ValueError: Path cannot be empty in /etc/inc/notices.inc:135
Stack trace:

0 /etc/inc/notices.inc(135): fopen('', 'w')

1 /etc/inc/config.lib.inc(1154): file_notice('phperror', 'PHP ERROR: Type...', 'PHP errors')

2 [internal function]: pfSense_clear_globals()

3 {main}

thrown in /etc/inc/notices.inc on line 135
Fatal error: Uncaught ValueError: Path cannot be empty in /etc/inc/notices.inc:135
Stack trace:

0 /etc/inc/notices.inc(135): fopen('', 'w')

1 /etc/inc/config.lib.inc(1154): file_notice('phperror', 'PHP ERROR: Type...', 'PHP errors')

2 [internal function]: pfSense_clear_globals()

3 {main}

thrown in /etc/inc/notices.inc on line 135

Hey, I managed to get Headscale set up last night and it all works well so far! I have some docker container services such as Portainer and Homepage and would like to just use a nice domain name like portainer.domain.com rather than Tailscale client IP:port. Can I do this with Tailscale (as it has Magic DNS), or would I have to set up a Reverse proxy or similar?
My Headscale server is on a VPS, as I can't really port forward where I live in.
Ideally, I won't have any ports open on my home server. And all the services and NAS, etc. I would access are in my home network.

TL/DR
Current YouTube Dislike Counter extensions work by taking data from those who have the extension and extrapolate information from there. The issue is that those who have the extension are individuals who are more likely to dislike, skewing the sample size to those who are more likely to dislike than the casual viewer.
A better look into those details would be comparing the publicly available Likes to View and calculating a percentage based on how likely someone is to Like a video while viewing. A simple calculation is Like / View. Reversing it to Views / Likes shows how many views it takes to receive 1 like.
This calculation doesn't magically make RoP the most successful trailer ever. Far from it, but it does better reflect the data and I believe it to not be skewed one direction or the other.
Rings of Power Data*

Link	Views	Likes	Chance of Like per View
Season 2 Teaser Trailer	5,441,810	74,010	1.36%
Season 2 A look Inside	202,616	7,158	3.53%
Season 1 Main Teaser	12,479,810	79,395	0.64%
Season 1 Teaser Trailer	31,555,692	130,915	0.41%

^{See limitations of method section}
Season 2 (so far) is faring much better than season 1 in this comparison.
 
INTRODUCTION
YouTube statistics, specifically likes/dislikes, is a common point in many online discussions when talking about upcoming media. Rings of Power Season 1 & 2 are not exempt from this. Since YouTubes removal of a dislike button in 2021 different extensions have come into play to replicate that. Most commonly the "Replace YouTube Dislike Button" Extension for Chrome (and probably other Browsers). My hope here is to
1) Point to the flaws that are associated with that extension.
2) A better way to measure Like/dislike engagement with publicly available data. By dividing the Likes by the Views to see how likely someone is to like the video.
3) The flaws associated with this method.
 
1) THE RETURN THE YOUTUBE DISLIKE EXTENTION (RYD)
Being made after YouTube removed the Dislike button in late 2021, this extensions goal was to return the dislike to YouTube (Duh). On release, Dislike data was still reported by YouTube API. So it began as a pretty straightforward app that simply called that data from the API and inserted it into the web page. Shortly after, YouTube removed that data from the API all together. Creators could still privately view their like/dislike, but that data couldn't be accessed by a 3rd party.
To counter that the app started working in a new way, it 1) Pulled as much information from the API that it could to have a "Base" set of data for videos posted before the removal. 2) Recorded when it's users interacted with the like/dislike buttons and added it to the data base. According to their GitHub FAQ #5 videos uploaded AFTER the API was shutdown is calculated by (RYD User Dislike Count)(RYD User Like Count) * Public Like Count. Simply put. It gets the ratio of it's users likes/dislikes and applies that ratio to the public count.
It's honestly not a bad system, but it has a pretty major flaw. The extension is more likely to be used by those who downvote more often. This simply skews the data to be Dislike heavy. This is pretty verifiable by doing a simple Google Search and reading up on what different YouTube Creators are saying. This Creator is claiming that the extension reports 50+ dislikes while YouTube reports 15! a ~230% increase!
The Return the YouTube Dislike Extent ion could be great, if people who are casual viewers & those who commonly like videos would download and use it as well. However, that's not the case and the result is a large group of their users are those who are more likely to downvote and want to see those numbers.
 
THE BETTER METHOD
I believe a better method to see the positive engagement of a video is looking at how likely someone is to "Like" the video per view. This is easily calculated by Getting the Like count and dividing it by the view count. You can also reverse that to calculate how many views it takes to get a like on overage. Since both of these numbers are publicly available, we can be much more confident that the numbers aren't skewed by an outside 3rd party group.
Lets look at different recently released trailers, Most "Successful" with this method to least.

Link	Views	Likes	Chance of Like per View
Wicked - Official Trailer	2,019,551	103,339	5.12%
The Boys – Season 4 Official Trailer	9,202,858	426,627	4.64%
House of the Dragon Season 2 Official Trailer	3,094,267	126,642	4.09%
RoP Season 2 A look Inside	202,616	7,158	3.53%
Dune: Prophecy Official Teaser	1,795,601	60,603	3.38%
The Penguin	3,648,089	4,650	2.99%
The Acolyte Official Trailer	10,576,120	193,683	1.83%
RoP Season 2 Teaser Trailer	5,441,810	74,010	1.36%

Using this method, We can easily see the level of "Excitement" there is behind each trailer based on how likely someone is to like the video, and we can easily compare these numbers as well if you're so inclined.
 
LIMITATIONS OF LIKE/VIEW METHOD
As time progresses, opinions change. What might have been a highly anticiped tv show or movie could have been a dud and gotten a bunch of dislikes after the release. Or something could have flown under the radar, turned out great and so people are going back to the trailer and liking it out of excitement of the finished product. Because of this, this method shouldn't really be used to compare new and old videos as too many variables come up as time progresses. I did this in my TLDR section to compare season 1 & 2. A workaround for this would to pull the data from Waybackmachine for the same time period in relation. So what I should of done in my TLDR is grab a capture 2 days after reveal of the data. So a more accurate table would look like this...

Link	Views	Likes	Chance of Like per View
Season 2 Teaser Trailer	5,441,810	74,010	1.36%
Season 2 A look Inside	202,616	7,158	3.53%
Season 1 Main Teaser (July 16th 2022)	4,535,187	53,000	1.16%
Season 1 Teaser Trailer(Feb 16th 2022)	18,754,323	84,000	0.44%

This didn't change the Season 1 Teaser Trailer much, but there was a significant change in the Main Teaser Percentage.
 
CONCLUSION
None of this really matters. If you like the show, great! If you don't, great! Either way, touch grass and hug a loved one (I know I need to after writing all of this lol). It's what J.R.R Tolkien would have wanted.
I like data and a major way people are comparing trailers is flawed with the possible fairly biased sample size. I think comparing Likes to views is a better way. This doesn't Magically make RoP somehow the most popular & well liked media ever produced. Far from it. But it is a better look at how it's trailers compare to other recent trailers.

I'm curious how other Citrix admins are handling app management with a decent amount of apps. We're merging a couple of farms and have maybe 1,200 apps total.
The first farm assigns an AD group to each app and then the helpdesk puts users in groups, when requested. New users are automatically added to certain AD groups based on their role/department. For common apps that all users need, they assign the app to Domain Users (or let it inherit from delivery group, which is configured for Domain Users). This method is very straight-forward (one AD group per app), it is easy to explain and everybody understands how it works.
The biggest negative is it is not clear who "owns" each app so there is no clear approval process. That previously wasn't huge deal because the helpdesk was really good and typically knew who owned each app, or could find out quickly. They have since outsourced the helpdesk so now every app request is a headache. Admittedly, that's not a Citrix problem but an internal process problem.
The second farm does a little bit of everything. Some apps inherit from delivery group (which are configured for a mix of AD group(s) or individual users), some are locked down by AD group, some have a bunch of individual users assigned to the app, and they also have a bunch of application groups in Studio.
The biggest negative is almost nobody understands how it works. And even if everyone understood application groups, how they provide access is not consistent across apps and delivery groups. As someone not familiar with the farm, I sort of feel like I need to reverse engineer how to give an app to a new user. I could drop them in a AD group assigned to an application group, but then what else does that give them access to?
We are slowly migrating apps from the second farm (mix of methods) into the first farm (one AD group per app). The Identity team has already said they absolutely do not want to manage 1,200 AD groups. The CISO (who the Identity team reports to) has said he wants everything "really locked down". If a user doesn't need an app for their job, they shouldn't even see it in Workspace. CISOs tend to wake up and go to sleep thinking about ransomware, so I get it.
Anyway, I'd love to hear how others handle app management as well as managing new requests, especially with large number of apps.
We also use ServiceNow and I have repeatedly mentioned looking into the ITSM Adapter, but that IT team is always buried.

In 2016, a game called "The Culling" came out. Today it's a little-known part of the history of the Battle Royale genre - and a sad story about what might have been. The Culling was the first standalone game in the genre and brought in a set of fresh ideas that had players hooked. Highlights:

• It relied relatively little on classic ranged gunplay, focusing more on melee weapons
• Combat mechanics were deep and with a huge risk/reward. You could block every attack without taking damage if you did the timing perfectly. That made each encounter adrenaline-rich, even vs supposedly lower opponents
• It had a strong identity: The game maps were stages of a supposed TV show with the players as contestants. It was all over the top with a lot of slapstick humor from the announcer
• It had a bunch of other new ideas. It introduced crafting into the genre. And you could airdrop in equipment (yes, really)

The players and streamers loved it - to reference a common sentiment back then: "PLEASE don't fuck up". But they did. They didn't understand their own game, didn't understand what made it so fun. Every update released fucked with the balance. They made classic shooting guns OP, they completely destroyed their own innovative block mechanic. And a few things more I don't remember. The community was not happy, begging for reversal. They eventually did release "The Culling: Origins" which was the game at its initial early access state - a testament to how much went wrong. But it was way too late obviously. When players aren't complaining any more, they also don't play anymore - they move on. PUBG and Fortnite were already released by then and we all know how that went.
This isn't really about The Culling, obviously. It's a tale about how difficult it can be to make games feel right. To not just catch lightning in a bottle, but also keep it in. Resemblance to other games is not coincidental, make of this what you want :>

(continuation of part 4)
I already considered this piece the second greatest musical evidence for Clerith after the London Symphony Orchestra’s Final Fantasy VII Symphony’s second movement “Words Drowned by Fireworks” and its guide, but now that I know about the Clerith reunion that was baked into the ending, the gap between the two is narrower. Each time I hear Cloud begin to call out for Aerith in part 3 (3:04), I immediately start crying. It sounds so much to me like Cloud’s voice in the dark saying “Aerith…?”, meek and scared. If you’ve read everything so far, you know how long Cloud has been looking for Aerith, lost without her, searching relentlessly for decades in real-life time. Through FFT, DFF, Advent Children, MFF x FFVII… all of it spent looking for his Promised Land. In OG, Cloud was so tormented by Jenova’s manipulation and so consumed by the chase for Sephiroth that he could not realize what or how much he felt for her until she was taken away forever. The piece we’ve just analyzed tells the story of Cloud and Aerith intertwining and separating against their will, and you can truly feel Cloud’s anxiety as he struggles to wrench Aerith out of fate’s cruel grasp. Perhaps it is because of Aerith’s ultimately fatal responsibility, inherited from her mother, that this iteration of her theme is called “The Cetra”.
Though in part 5, Cloud and Aerith reunite… could this reunion symbolize their meeting again in Remake, or something more permanent? I think it’s meant to leave us wondering.
I’m very sensitive to music, and as I’m typing this, I’m crying a bit. I wanted to share my interpretation of “Aerith’s Theme - The Cetra” with you very badly, because it makes me feel so much and really enhances Clerith’s story. I’m overjoyed to have found out about the reunion at the very end. And it’s all because you guys showed love for my last analysis! You guys are giving me gifts every day.
V. b) i. 3) Combined Analysis
Please listen to and watch the scene of Cloud’s MOTF 6 (4:21-8:46) again, and consider section “V. b) i. 2)”. What is Uematsu telling us? Similarly to how main world theme of FFVII informs us that Jenova is sabotaging Cloud’s identity far before it becomes a plot point in OG, “Aerith’s theme - The Cetra” is telling us what not even Remake Cloud consciously knows at this point: he’s been searching desperately for her, and fears losing her once more.
As if that wasn’t proof enough, the timing of the shots and musical phrases is absolutely damning. Recall that part 3 of “Aerith’s theme - The Cetra” specifically symbolizes Cloud’s anxiety surrounding Aerith’s safety. It is this particular part of the piece that plays for the entirety of Aerith’s allusions to her murderers and her death (7:25-7:54), including the very moment where “Cloud feels his chest constrict tightly” (7:51-7:54). What’s more, part 5 the piece, which specifically Cloud freeing Aerith from the restraints of fate, coincides with the moment Tifa grabs Aerith’s hand and pulls her out from the circle of Whispers closing in on her (8:42-8:45). This moment leads me to believe that the reunion in part 5 of the piece indeed symbolizes Cloud succeeding (perhaps with Tifa’s help) in saving Aerith from her tragic fate and reuniting with her for good.
It’s heart-wrenching and brilliant. Our theory stands strong.
V. b) ii. Credits: Piece Inclusion
I find it very telling that the character themes included in the credits of Remake are Cloud’s “Hollow” (0:00-5:24), an orchestral arrangement of Aerith’s theme (5:24-9:24), and an orchestral arrangement of the main world theme, (9:24-14:27) which of course includes Cloud’s true theme. No other character themes appear during the rest of the credits (14:27-18:09). This is telling: the credits are communicating to us that Remake is about Cloud and Aerith. Our Mission Theory only gets stronger.
V. b) iii. Showing Relationships Through Music: Intermingling Character Themes
This doesn’t have to do with the Mission, but here’s a pretty good anti-Cloti argument while we’re here.
As shown in section “V. a) i.” where we explored the roles of Cloud, Jenova and Sephiroth’s themes within the FFVII world theme, the way character themes interact in a piece can tell you a lot about those characters’ relationships. This is certainly the case in “Aerith’s Theme - The Cetra” as well (see section “V. b. ii. 2)”).
I’d like to mention that in all of my listening to the Remake OST and rewatching playthroughs of Remake, I’ve never encountered a single piece that united Cloud and Tifa’s themes. Not once. Let alone a piece that depicts them as intimately or emotionally as “Aerith’s Theme - The Cetra” depicts Cloud and Aerith. Even the most Cloti cutscenes in Remake aren’t supported by pieces mixing or even juxtaposing Cloud and Tifa’s themes. I can’t find any of Cloud’s motifs anywhere during the orchestral arrangement of Tifa’s theme that plays during her resolution scene in chapter 14. I can’t find either of their motifs in the track the plays when Cloud calls Tifa beautiful at Seventh Heaven in chapter 3. A motif from Tifa’s theme does appear in the track that plays during the childhood promise scene in chapter 4, (0:00-0:25), but it never plays at the same time as or even near Cloud’s motifs (1:23-1:47 and 2:03-2:29). They’re distant or otherwise unaffiliated.
The only exception is that an altered version of Cloud’s theme’s section A phrase 1 appears in the background of Tifa’s theme (1:17-1:23). This symbolizes her connection to Cloud and how much of her attention and worry revolve around him— a reference to how she cares so much that it borders on dependency. Of course, it doesn’t go both ways: Tifa isn’t in Cloud’s theme at all. To me, this lack of reciprocity concerning the inclusion of Cloud’s motif in Tifa’s theme signifies that the only time Cloud and Tifa are together is in her head. She does think about him a lot, which we witness in her chapter of Trace of Two Pasts. Tifa loses sleep over him even two years after he left Nibelheim, despite the fact that she barely knew him at all:

“The moment she heard the word “Soldier”, the few memories she had with Cloud Strife came flooding back. He never contacted her after they parted ways two years ago […]. She tossed and turned all night. When she counted them again, her memories with Cloud were so surprisingly few that others might find it hard to believe that they grew up as next-door neighbors” (Trace of Two Pasts, translated by pekotranslates on Tumblr).

FFVII Remake Ultimania also comments on the superficial nature of Cloud and Tifa’s water tower promise, and how regardless of its naïveté, it became fundamental to Tifa:

“Though rooted in a jejune heroine fantasy of being rescued in a pinch by her hero, this promise is clearly etched in Tifa’s memory” (Tifa’s profile in section 01 of “Character & World”, “An Enduring Childhood Promise” in “Topics of Tifa” page 20).

You could argue that “Aerith’s Theme - The Cetra” is only one song wherein Cloud and Aerith’s themes interweave, but you’d be proven wrong by the Rebirth OST…
V. c) The Rebirth OST
Unfortunately, the full Rebirth OST isn’t out and available where I can listen to it right now. However, based solely on the incomplete OST that’s available to me right now, I can tell you with certainty that the composers were told to incorporate Clerith into the musical storytelling: Cloud and Aerith’s themes intermingle in multiple pieces. I can’t imagine what else I’ll discover once I listen to the full OST. For now, I checked out what was available on YouTube and listened to cutscene audios. This section would be eternal if I included every time Cloud and Aerith’s motifs interact, especially in chapter 14. Trust me, I’d love to talk about every single one, but this thing is long enough already, so let’s just address what pertains to our Mission Theory specifically rather than stopping at every single Clerith reference in the OST.
V. c) i. Ending Cutscene Music
Ending cutscenes are often used to address the next step the characters will be taking as well as their emotional and mental state. They also open up new questions to make the player curious. Indeed, Rebirth’s ending cutscene (18:56-25:00) gives us an impression of how the party members feel by the end of the game: everyone misses Aerith. Barret looks upset and confused at the mention of her (19:35-19:45), the girls are crying and Nanaki is mourning (19:58-20:35). Additionally, we are shown the empty White Materia and Black Materia in Cloud’s possession (20:40-21:24), foreshadowing that they will come to be important in part 3. Cloud and Aerith share a warm goodbye, and exchange promises: Aerith will send smoke signals if something happens to her so a worried Cloud can remain updated on her well-being and she will stop Meteor, and Cloud will stop Sephiroth (23:00-25:00). The fact that this scene is animated in CGI is enough to tell us that the devs consider it narratively important, just like they do Bugenhagen’s observatory and the party’s advance into the Forgotten Capital CGI cutscenes. What did the composers decide to communicate with us about the end of Rebirth and the plot going forward?
Big surprise: Clerith.
During the entire cutscene, only two themes play: Cloud’s and Aerith’s. The cutscene’s music begins only when Cloud notices Aerith among the party members and begins watching her (19:21). She interacts with the rest of the party without their knowledge, different segments of her theme playing one after another. Her theme only stops when Cloud finally looks away from her and to the empty White Materia in his hand (20:45). The music focuses on the mystery and ominousness of these materia, only returning to Aerith once Cloud hears her voice and repeats her message to the party (21:30).
Cloud’s theme appears when he asserts that Barret needn’t worry about him (section A of Cloud’s true theme, 22:41), though soft and tentative, only swelling when Barret and Tifa climb aboard the Tiny Bronco and Cloud finds himself alone with Aerith again (22:57). As he asks Aerith if “[she’ll] be okay getting back” (23:08), the final phrase of section A of his theme plays, but without its concluding note, the tonic. He waits for her to answer him as his theme waits for hers to complete and answer it, that final note dragging long over the seconds (23:09-23:13). She answers with a teasing remark that references their unwillingness to part from each other back in Remake’s Evergreen Park:

“[Cloud has] a chat with Aerith, from whom he’s reluctant to part” (chapter 9 in section 04 “Scenario”, “Main Story Digest”, “4. Saying Goodbye”, page 275)”.

As soon as Aerith answers Cloud’s question with this romantic callback, her theme answers his too: section C of Aerith’s theme begins with the key’s tonic, resolving Cloud’s incomplete phrase (23:13): she gives him resolution. He chuckles, getting her reference, and the music swells (23:16). The music ebbs and flows thusly, following the rhythms and underlying emotions of their conversation. Finally, the piece ends with phrase 2 of of section A of Cloud’s true theme, following a strong repetition of the first half of Aerith’s theme’s section A. The two make their promises to each other, and “No Promises to Keep” begins, leading us to the credits. This is most definitely a Clerith song, but more on that later.
What this shows us is that Cloud and Aerith’s relationship is fundamental to the plot of Rebirth and will also be fundamental to the plot of part 3: they are isolated one one-on-one in this cutscene, and the music depicts their warm, sweet interaction as well as the strength of Aerith’s character to contrast with Cloud’s somewhat meek personality. The composers are telling us that these two, specifically, together alone, are hugely important to the plot here. This was already true in OG, but no such emphasis was ever placed on their interactions and relationship in its music. Something is different, deeper, more intense now. The Mission Theory explains why. It also suits our theory that the composers are emphasizing the centrality of Clerith in the plot of the Remake trilogy. Cloud’s love for Aerith is the reason for the trilogy’s existence, and it will be the greatest motivator for Cloud in part 3. It’s a grand announcement.
Just like in Remake, I could not find a single instance of Cloud and Tifa’s themes interacting in Rebirth, apart from at the end of the intimate Skywheel date— but every girl receives this treatment in their intimate dates, so each of these instances can be crossed out. Additionally, the Tifa date is not the canon one, but I digress…
V. c) iii. Credits

1. Piece Inclusion

Once more, I find it very telling that of all the pieces included in the credits of Rebirth, the only character themes are Cloud’s and Aerith’s. We start with a song about Aerith’s point of view to mirror *Remake’*s “Hollow”, “No Promises to Keep” (5:18-11:10), followed by the FFVII world theme (11:10-16:12) which of course contains Cloud’s true theme, then we move into a piece whose unofficially translated title is “Parade Battle Ceremony - The Dawn of a New World” as an arrangement of the parade ceremony theme from chapter 4 (16:12-19:03), followed by a theme for the Lifestream springs whose name I don’t have (19:03-21:38), “Junon - Fortified Metropolis” (21:38-24:28), and finally, a gorgeous arrangement of Aerith’s theme (24:28-28:47). No other character is referenced in the credits music: the credits are telling us Rebirth is about Clerith. Our Mission Theory explains why.
V. c) iii. 2) “No Promises to Keep”
At the very end of this song written and performed by Aerith, we’re treated with a sweet little piano conclusion (10:46-11:10): it begins with a variation on Aerith’s theme’s section A (10:46-11:01), and concludes with two ascending arpeggios, each four notes long (11:01-11:10). Each of these ascending arpeggios is a variation of the phrase 1 of Cloud’s true theme’s section A. The differences are minimal. The phrase is usually five notes long rather than four, the first arpeggio ends on the tonic rather than Cloud’s iconic subtonic, and the second arpeggio starts on the subtonic rather than the tonic. The song Aerith wrote concludes with Cloud’s most famous motif. This is also the case in her Gold Saucer performance (3:31-3:41).
V. c) iii. 3) Arrangement of Aerith’s Theme
The final piece in the credits is an arrangement of Aerith’s theme (24:28-28:47) which has noticeably similar elements to the version of her theme that plays during the Jenova Lifeclinger battle in chapter 14 (0:12-3:36), such as the female choirs. Since these female choirs are only heard in the Forgotten City version of Aerith’s theme, and since the credits arrangement of her theme plays at the same time as clips from her chapter 14 pseudo-death roll across the screen, I estimate that this credits arrangement specifically reflects the event of Aerith’s pseudo-death. Recall that composers had access to the credits video as they composed, meaning this piece is specifically written for Aerith’s pseudo-death in Rebirth.
What I find fascinating is that, just like the arrangements of her theme that play during Aerith’s pseudo-death and the Jenova Lifeclinger battle, this credits arrangement contains the sound of Cloud’s pain, rage and protest. Phrase 1 and the first three notes of phrase 2 of Cloud’s true theme section A play on the strings and brass quite loudly and insistently, just as Cloud blocking masamune appears on the credits screen (25:11-25:21). Sephiroth’s dissonant, high and screechy violins appear just as his face comes onto the screen (26:33), and almost as a protective response, phrases 1 and 2 of Cloud’s true theme’s section A return (26:47-27:00). Finally, similarly to what we hear in part 5 of “Aerith’s Theme - The Cetra”, a slightly modified section A phrase 1 of Cloud’s true theme play along with section C phrase 3 of Aerith’s theme (oh wow section A and C section Aerith for Cloud’s theme and section Cloud for Aerith’s theme I just realized that’s such a cute coincidence), though unfortunately they do not meet in the middle like last time since they start two octaves apart (28:20-28:25). I’ve recreated it for you once more here so you can really appreciate it. The fact that their motifs don’t truly reunite like in “Aerith’s Theme - The Cetra” is sad, but the very last thing you see onscreen is Aerith’s goodbye to the Tiny Bronco (27:10-27:42), so it makes sense that this piano conclusion implies that Cloud and Aerith aligned, but not yet reunited for good. That’s exactly what you get from the ending cutscene. It does seem to imply that they will be reunited in part 3, as both the ending cutscene and this piano conclusion read as a “till we see each other again” rather than a “farewell”.

VI. Textual Evidence

Now that the musical evidence is done, let’s compile some textual story evidence that supports our theory!
VI. a) Remake Trilogy (Thus Far) Handholding Explained?
As I’m sure you’ve noticed, handholding is a motif in Cloud and Aerith’s relationship— and an extremely symbolic one at that! When researching for info to validate my theory, I found that this Clerith motif was extremely helpful! Its inclusion in the Remake trilogy, and especially in Rebirth, is hugely significant in my eyes.
VI. a) i. Pre-Remake Trilogy: Aerith’s Initiative
Before examining the significance of Clerith handholding in Remake and Rebirth, we should establish the meaning of this motif in OG and Advent Children.
Cloud and Aerith have reached out to take each other’s hands many times since 1997. Aerith used to literally drag him by the hand a lot, shocking the cold and distant merc, before she left. After her death in OG, Cloud surely longed to be able to feel her hand take his again, cursing himself for not enjoying it while she was alive, and for never being the one to grasp her hand first: he never got to tell her how he feels about her, or to save her. It was always her reaching out for him, saving him.
This is why the scene in OG when Aerith reaches for him from the Lifestream after Cloud defeats Sephiroth in chapter 3 of disk 3 is so touching: Cloud sees her hand and reaches out to take it, so close to finally establishing that mutual connection, but she soon fades, and replaced by Tifa’s hand in the tangible world. He doesn’t get to hold Aerith’s hand again.
That is, not until Advent Children, where near the end of his battle with Bahamut Sin, he sees Aerith reach out to him once again (1:08-1:30). Cloud finally gets to hold her hand for the first time in two years when he lost her. This moment was given extra importance by the devs. In fact, Nojima told us the following:

“The ending scene of the battle with Bahamut, the scene where Aerith reaches out her hand, is an homage to the last scene from a previous production. It was [Nomura]'s idea” (FFVII Reunion Files, “Story Digest”, “Summoned Beast”, page 113).

VI. a) ii. The Remake Trilogy (Thus Far): Cloud’s Initiative
As I’ve said before, if I’m right that Remake is all about Cloud stepping up to be more attentive and active in his relationship with Aerith in order to save her, there should be concrete evidence of this in the Remaketrilogy thus far. If OG Cloud’s memories of and love for Aerith exist somewhere within Remake Cloud’s subconsciousness, then Remake Cloud should be far more active in the Clerith dynamic than OG Cloud was— after all, he’s supposed to know better this time around. Thankfully, the motif of handholding can help us evaluate this. Since we know pre-Remake Cloud was quite passive when it comes to handholding, Cloud initiating handholding in the Remake trilogy would be a strong indication that our theory has validity. Keeping this in mind, let’s see what we can find thus far in the Remake trilogy in relation to handholding, and if Cloud is indeed more active than he was in OG.
VI. a) ii. 1) Hollow Hands
Remake’s theme song “Hollow” makes allusions to the handholding motif: “This time, I will never let you go” is pretty clear. And so is “No Promises to Keep”, wherein Aerith speaks of Cloud “[taking her] hand and never [letting her] go” multiple times. Interestingly, these theme song lyrics seem to suggest that Cloud will be much more active in the Remake trilogy than in OG. “Hollow” even promises that Cloud will come to his senses and take charge of the situation: “this time, [he] will” be the one to offer his hand to Aerith, unlike in OG and Advent Children. This makes a lot of sense with our theory: now that Cloud has lost Aerith once, “this time for sure, [he]’ll” be the one to reach for Aerith’s hand, take initiative and save her the way she saved him.
Even though theme songs are extremely telling of a game’s main themes and intentions, lyrics are still all talk and no proof. What about the game itself? Do Remake and Rebirth deliver on this promise? Let’s see!
VI. a) ii. 2) Resolution Hands
The only significant time Cloud initiates handholding in Remake is during Cloud’s resolution scene in chapter 14 (5:18-5:40), wherein he tries to grab Aerith’s hand but is unable to keep her with him. He fills with determination and tells her in no uncertain terms that he’s coming for her. Just as we predicted, Cloud is the active participant in this iteration of the Clerith handholding motif: he’s even explicitly insisting against Aerith’s wishes that he should “get a say in all this” and that he’s “coming for [her]”. Let’s not forget that Cloud’s resolution is meant to reflect not only Aerith’s kidnapping by Shinra, but also her fated death. Nojima implied this by commenting the following on Aerith’s “Even if you think you have, it’s not real” line:

“Those who know what befalls Aerith later on will find the line really heart-wrenching” (FFVII Remake Ultimania, section 08 “Secrets”, “Development Staff Interviews, Part 2: Tetsuya Nomura, Yoshinori Kitase, Kazushige Nojima”, page 744).

Given this note by Nojima, it looks like we’re supposed to watch Cloud’s resolution scene with Aerith’s fated death in mind. Considering this, Cloud’s “I’m coming for you” line sure seems like an subconscious promise that he will save Aerith from her tragic fate. This subconscious promise could be the result of post-OG Cloud’s feelings and intentions rising to the surface. Nevertheless, he’s absolutely determined and he’s staying true to the promise he made in “Hollow”. I think it’s fair to say that this instance of the handholding Clerith motif does indeed fit perfectly with our theory. This is only one strong example though, and we need a pattern in order to pat ourselves on the back on this. So, let’s keep looking! There isn’t any handholding initiated by Cloud beyond that point in Remake. At this point in my research, I moved on to Rebirth to go digging for handholding there.
Hoo boy. I was not disappointed.
VI. a) ii. 3) Golden Hands
Let’s begin with the obvious. In their high-affinity gondola date in chapter 12, Cloud bravely interlaces his fingers with Aerith’s: Cloud’s taken charge not only of handholding, but the most intimate kind of handholding. I’m sure you’ve encountered the phrase “こいびとつなぎ” or “koibito tsunagi by now (literally translates to “lovers’ tie” or “lovers’ connection”); this is the term used in Japanese to refer to the type of handholding Cloud initiates with Aerith on the Skywheel. It’s considered the most intimate form of handholding. In Japan, skinship is normally considered quite significant and indicative of the closeness between two people— you could say it’s a big deal. Cloud also offers Aerith his hand when they step off the Shywheel, once more making the first move. Though some might say that the Skywheel dates shouldn’t be counted as canon, I believe Aerith’s date is indeed canon (I have my reasons but this post is long enough). Even if we discount the Skywheel date however, Clerith's use of the koibito tsunagi returns in a non-optional scene we will touch on later.
For what it’s worth, Alfreid offers Rosa his hand in the Loveless play too. I can prove that Aerith is the canon Rosa too, but I’m going to save that for my next analysis! You can take my word for it now, or just wait for that analysis to drop. Take it or leave it!
VI. a) ii. 4) Meta Hands
However, the narrative weight of these Clerith handholding instances doesn’t even come close to my very favorite iteration of the handholding motif in Rebirth. I’m referring to what I consider a severely underrated Clerith moment in chapter 13. First, some context: Sephiroth manipulates Cloud into giving over the Black Materia. Cloud seems to be firmly under Sephiroth’s control. However, the sight of Aerith being swarmed by Black Whispers snaps Cloud back into the driver’s seat: he breaks out of Sephiroth’s grasp to run to her and save her. Aerith gets knocked off into a fatal free-fall by a Black Whisper before Cloud can reach her, but he won’t have it: he lunges forward, hand extended. What results is a beautiful shot of their outstretched hands (56:25-56:27).
Let’s analyze this great shot. Notice how the seconds where Cloud is reaching downwards to grasp Aerith’s hand are treated. This key moment is stretched longer by a slow-mo effect, building up the tension and drawing the audience’s focus to the distance between their hands before Cloud actually catches Aerith’s in his, fulfilling the promise he made in “Hollow”. Their hands take up the whole screen in a deliberate close-up shot. All the ambient noises of the scene go quiet: Aerith’s theme is all we hear as Cloud reaches desperately for her. These are blatant audiovisual cues, signalling to the audience that whatever is happening on screen is especially significant. We should therefore examine this specific instance of the Clerith handholding motif to see what the devs are trying to tell us, and maybe it will fit with our theory!
We should begin by comparing this Clerith hand-reach shot to previous ones. If you compare it to the Advent Children’s hand-reach that occurs during Cloud’s battle against Bahamut Sin, it’s evident that Cloud and Aerith’s roles are reversed: just as our theory states, Cloud gets out from inside his head and reaches for Aerith this time. She saved him and the world in OG, and now it’s his turn to save her. This change becomes especially evident when you juxtapose the two scenes and notice how their hands have switched places, reaching from above and below, from left and right. I think the Rebirth hand-reach was deliberately made to look like the Advent Children one —and even the OG one in disk 3, chapter 3—, just to highlight this role reversal.
This Rebirth hand-reach is my favorite out of all because it shows that Cloud is much more conscious and attentive toward Aerith in Rebirth than he was in OG. At this point in OG (disk 1, chapter 25), Cloud is meant to be beating Aerith up at Sephiroth’s command, to the horror of the rest of the party. In fact, a few minutes before Cloud rushes to save Aerith in Rebirth, he has absolutely no problem violently shoving Tifa to the ground when she gets in Sephiroth’s way (53:27-53:33). This shove and Cloud’s earlier attack on Tifa in Gongaga (Rebirth, chapter 9) proves that Sephiroth is just as capable of making Cloud hurt his party members as he was in OG… though Sephiroth can’t seem to make Cloud hurt Aerith. Why is this? Why is it that Cloud beats Aerith in OG, but doesn’t even lay a finger on her —and snaps out of Sephiroth’s control at the mere sight of her in trouble— in Rebirth?
Our theory provides the answer. In disk 1, chapter 25 of OG, Cloud had not yet realized he loved Aerith. Sephiroth was therefore able to make him hurt her. But things are different in Rebirth. The Cloud we see in the Remake trilogy has gone through the OG timeline and traveled back in time, kicking off Remake as his second try at the OG timeline— and he did this precisely because he loves Aerith. His love for her is clearer and stronger in the Remake trilogy than in OG because Remake Cloud is an amnesiac, post-OG, time-traveler Cloud. He’s been through the OG before, has fallen in love with Aerith and realized it before, so this time around, he can’t even lay a finger on her. This is made evident by how closely the moments where Cloud pushes Tifa and saves Aerith are juxtaposed, separated by mere seconds of gameplay. Merely seeing Aerith in trouble wrenched control from Sephiroth and put it in Cloud’s hands again— Sephiroth probably couldn’t have gotten Cloud to attack Aerith if he tried.
This isn’t the only time we get evidence of this though! As Cloud approaches Aerith’s praying form in the Forgotten City, Sephiroth’s Black Whispers swirl around the buster sword: Sephiroth is trying to kill Aerith with it, while Cloud’s struggle to wrench it away plays out visibly on his face. Interestingly, Cloud is not being controlled by Sephiroth here. We know this because we can quite literally see the Black Whispers trying to move his sword, but also because every time Cloud is being controlled by Sephiroth in Rebirth, he has an empty-eyed, zombie-Cloud look on his face. Either that or he laughs or smiles somewhat maniacally. There is never any resistance on his part. To see an example, simply pay attention to Cloud’s blank face as he attacks Tifa in Gongaga in chapter 9 (19:20-20:30). You’ll see the very same expression on his face if you watch this video of Cloud following Sephiroth’s orders in chapter 13 (53:36-54:15). Additionally, look at how strangely Cloud smiles (41:01) as he grasps the Black Materia. Cloud makes none of these faces as the Black Whispers try to take control of his sword: quite the opposite. Cloud looks like he’s trying his hardest to pull his weapon back down and away from Aerith, a horrified look on his face as he grunts from the effort. Once more, Sephiroth is unable to make Cloud hurt Aerith.
Back to my favorite handholding moment. Think about this devs intention for this shot for a minute. The devs have been teasing us as to whether or not Cloud will succeed in saving Aerith in the Remake trilogy since it was first announced, and this slow-mo shot of Cloud catching Aerith’s hand as she falls to her death is a reflection of this tension. The audience holds their breath during those slow-moed seconds, all that hope and fear hanging in the balance. This instance of the handholding motif is a meta way for the devs to reassure us that Cloud will indeed save Aerith. I firmly believe this.
VI. a) ii. 5) Self-Sacrificing Hands
Alright, alright, enough about my favorite! Let’s move to chapter 14 of Rebirth! There’s evidently a lot going on with Clerith in this chapter. Let’s address the Sector 5 date. The handholding is first initiated by Aerith as she tugs him toward the candy vendor and Cloud reacts with a quiet gasp (4:07-4:17). Soon, it becomes a reciprocal embrace: Cloud holds his hand out for Aerith’s and tightens his fingers around hers, smiling at her before they head to the photographer (7:07-7:17).
Then of course, when Aerith pushes Cloud into a portal in her church, you can see Cloud reach his hand up toward her desperately as he falls (17:38-17:58). What I find particularly emotional about this moment is that Aerith pushing Cloud away from her is kind of the opposite of reaching for his hand: it symbolizes Aerith accepting her fate and giving up on a life where she can be with him. This Aerith seems to be a post-OG Aerith who exists separately from the main world we experience in Rebirth, meaning she knows all too well that her fate is to die. In fact, it looks like she is the very same or a similar Aerith to the one who appeared to Cloud in his resolution scene in Remake. By literally pushing Cloud away, just like she figuratively did in Cloud’s resolution scene, she is sacrificing both herself and the happiness she could share with Cloud. She’s going against her heart’s wishes, just like she did in Cloud’s resolution scene when she would not let Cloud take her hand. Indeed, post-OG Aerith seems to be resigned to her fated death and completely devoid of hope: she only wants to ensure the planet’s survival, because she thinks she knows there is no way she can or should be with Cloud. In contrast, Cloud reaches his hand out toward Aerith as he falls into the portal, and even though he does not know that her push symbolizes her self-sacrifice, his outstretched hand represents his protest. So far, our theory is fitting beautifully.
VI. a) ii. 6) Grieving Hands
Later in chapter 14 of Rebirth, after Aerith’s death/non-death, there is more handholding. As Cloud cradles Aerith’s body close to him at the Forgotten Capital, Aerith places her hand on his cheek. Cloud covers it with his, curling his fingers around it (1:03:33-1:03:53). Before he leaves her lying down on her back to go fight Sephiroth, he squeezes her hand as he tells her “I got this”— or, per the Japanese version, “Wait for me”, meaning he’ll reunite with her once he’s done (1:04:56-1:05:10).
VI. a) ii. 7) Hero-Heroine Hands
Next, the koibito tsunagi returns as Cloud and Aerith interlace fingers back to back in a classic hero-heroine pose, right after their two-versus-one fight against Sephiroth. This time, they both reach for each other simultaneously (7:42-8:18), without even having to look down at their hands or talk to each other, as though perfectly in sync. As you can see, Aerith and Cloud are now on the same page. This is different from post-OG Aerith’s attitude in the Sector 5 church earlier in chapter 14, as well as in Cloud’s resolution scene in Remake— my interpretation of this mutual koibito tsunagi is that both of them are agreeing to hold onto each other now, with neither of them pulling back or being inattentive of the other: their priorities are now the same. It seems now they are aligned, and hopefully this means that Aerith will be working together with Cloud so they can reunite again in part 3. Even if she doesn’t prioritize her life and happiness though, we know for sure Cloud will.
VI. b) Blocking Masamune Explained?
Another piece of evidence that Cloud has been through the events of OG before is the fact that he is able to block masamune. Cloud looks up and sees Sephiroth descending with his blade poised to kill Aerith. Screaming, Cloud instantly rips the buster sword from the Black Whispers’ hold and successfully blocks masamune. Hatred and determination fill his eyes as he rallies his strength and successfully pushes Sephiroth away, saving Aerith’s life (6:00-7:26)— at least, in one reality.
Obviously, something about Cloud is different in Rebirth from in OG, otherwise, the events of Rebirth’s chapter 14 would be the same as the events of OG’s disk 1 chapter 28. In my opinion, what happened here is that upon seeing Sephiroth swoop down with masamune, Cloud remembered Aerith’s death in OG, and the post-OG Cloud’s determination to stop it came surging up from within him. This is frankly the very best proof there is that Cloud is far more ready, stable, determined, and clear-headed about Aerith in the Remake trilogy than in OG. Our theory explains why! In fact, this very moment is what our entire theory banks on: Cloud saves Aerith in one reality, as is shown by the rainbow effect produced by the event, and just like that, the promise made in “Hollow” has been fulfilled! However, now we face the question of how to make sure that Aerith is alive and by Cloud’s side when the multiverse converges again into one protected timeline. I’m sure it will be done; we will see how in part 3.
VI. c) Theme Song Lyrics
What the theme songs’ texts have to say about the trilogy so far is quite important, as they summarize the feelings of the characters they represent: Cloud and Aerith. We can glean a lot from their perspectives that could help support the Mission Theory.
VI. d) i. “Hollow” Lyrics
“Hollow”, Remake’s theme song, was written about Cloud’s feelings and rumination. Nojima confirmed that, when he was given directives for the lyric-writing, “Nomura just gave [Nojima] the keywords: ‘told from Cloud's point of view’ and ‘standing in the rain’. [Nojima] interpreted that as ‘a ballad for a man who lost something/someone important’” (Nojima and Uematsu interview “‘I wanted to put the word ‘empty’ in the theme song of Remake. That was how it started’ - Music-Related Interview Part 6: Kazunari Nojima”, by Famitsu). Our theory is about Cloud’s motivations and mission to save Aerith, so “Hollow” is especially relevant.
Let’s run through the lyrics and analyze, starting with the song’s first verse:

“I would be lost, drifting along
Floating up high, time after time
And there you'd be, shining brightly
Your smiling face to guide my way
Bloody and bruised, brought to my knees
When beaten down, when broken up
You would appear, reach out to me
Heal every wound and make me whole”

Makes sense with our theory in mind, doesn’t it? This is post-OG Cloud remembering Aerith and what she means to him. “Hollow” seems to be told from the perspective of the post-OG Cloud hidden somewhere in Remake Cloud: a suppressed or eroded part of him that remembers Aerith clearly. Or maybe it’s told by Cloud after the events of the MFF x FFVII Remake collaboration and before the start of Remake, asserting his mission to save Aerith.
Next, here are the pre-choruses:

“Was it all, a dream? Will I never know?
Foolish and blind to everything
Had I realized, had I thought it through
Would you be here in my embrace?”

&

“With your every smile, hiding something more
Dark mysteries lurking beneath
But I was consumed with this emptiness
This selfishness, this void to fill”

(continued in