ccneill | yep | 00:02 |
---|---|---|
ccneill | unrahul: I figured we'd make some tweaks to the tests once we get all the other stuff we've been working on out of the way, so we're not running into cross-dependency/rebase nightmares | 00:03 |
ccneill | anyway, I'm out for the day. have a good one y'all o/ | 00:03 |
*** woodster_ has quit IRC | 00:09 | |
unrahul | Yeah.. That's true.. | 00:11 |
unrahul | This time everything got merged without much rebasing.. | 00:11 |
unrahul | That was a relief | 00:11 |
*** sdake has joined #openstack-security | 00:14 | |
*** trisq has joined #openstack-security | 00:18 | |
*** gfhellma has quit IRC | 00:18 | |
*** Unterd0g has quit IRC | 00:30 | |
*** browne has quit IRC | 00:30 | |
*** Unterd0g has joined #openstack-security | 00:32 | |
*** ccneill has quit IRC | 00:39 | |
*** diazjf has joined #openstack-security | 00:43 | |
*** aastha has quit IRC | 00:47 | |
*** diazjf has quit IRC | 00:57 | |
*** edtubill has joined #openstack-security | 00:57 | |
*** trisq has quit IRC | 00:58 | |
*** diazjf has joined #openstack-security | 00:58 | |
*** jass93 has joined #openstack-security | 00:59 | |
*** sdake has quit IRC | 01:14 | |
*** diazjf has quit IRC | 01:14 | |
*** edtubill has quit IRC | 01:17 | |
*** sdake has joined #openstack-security | 01:21 | |
*** trisq has joined #openstack-security | 01:24 | |
*** salv-orlando has joined #openstack-security | 01:32 | |
*** knangia has quit IRC | 01:41 | |
*** salv-orlando has quit IRC | 01:43 | |
openstackgerrit | OpenStack Proposal Bot proposed openstack/security-doc: Updated from openstack-manuals https://review.openstack.org/362521 | 01:46 |
openstackgerrit | Merged openstack/security-doc: Updated from openstack-manuals https://review.openstack.org/362521 | 02:02 |
*** austin987 has joined #openstack-security | 02:08 | |
*** jesusrodriguez has joined #openstack-security | 02:39 | |
openstackgerrit | Darren Chan proposed openstack/security-doc: OSSN-0070: bandit version < 1.1.0 have possible XSS https://review.openstack.org/355493 | 02:39 |
*** jesusrodriguez has joined #openstack-security | 02:41 | |
*** jesusrodriguez1 has joined #openstack-security | 02:43 | |
*** dave-mccowan has quit IRC | 02:44 | |
*** jesusrodriguez1 has quit IRC | 02:45 | |
*** jesusrodriguez has quit IRC | 02:46 | |
*** jesusrodriguez has joined #openstack-security | 03:00 | |
*** jesusrodriguez has left #openstack-security | 03:02 | |
*** hyakuhei has quit IRC | 03:04 | |
*** jesusrodriguez has joined #openstack-security | 03:08 | |
*** hyakuhei has joined #openstack-security | 03:19 | |
*** salv-orlando has joined #openstack-security | 03:45 | |
*** salv-orlando has quit IRC | 03:53 | |
*** mdong has quit IRC | 04:06 | |
*** mdong has joined #openstack-security | 04:06 | |
*** salv-orlando has joined #openstack-security | 04:41 | |
*** sdake has quit IRC | 05:47 | |
openstackgerrit | Michael Dong proposed openstack/syntribos: Fixed runner time log https://review.openstack.org/362480 | 05:50 |
*** sdake has joined #openstack-security | 05:50 | |
*** salv-orl_ has joined #openstack-security | 06:08 | |
*** salv-orlando has quit IRC | 06:11 | |
*** jass93 has quit IRC | 06:12 | |
*** salv-orlando has joined #openstack-security | 06:12 | |
*** jass93 has joined #openstack-security | 06:13 | |
*** salv-orl_ has quit IRC | 06:17 | |
*** salv-orlando has quit IRC | 06:17 | |
*** rcernin has joined #openstack-security | 06:19 | |
*** pcaruana has joined #openstack-security | 06:26 | |
*** mdong has quit IRC | 06:38 | |
*** sdake has quit IRC | 06:44 | |
*** liverpooler has joined #openstack-security | 06:51 | |
*** tesseract- has joined #openstack-security | 07:07 | |
*** shohel has joined #openstack-security | 07:31 | |
*** vinaypotluri has quit IRC | 07:42 | |
*** austin987 has quit IRC | 08:23 | |
*** aastha has joined #openstack-security | 08:31 | |
*** markd_ has joined #openstack-security | 08:40 | |
*** hyakuhei has quit IRC | 08:59 | |
*** hyakuhei has joined #openstack-security | 08:59 | |
*** hyakuhei has quit IRC | 08:59 | |
*** hyakuhei has joined #openstack-security | 08:59 | |
openstackgerrit | OpenStack Proposal Bot proposed openstack/security-doc: Updated from openstack-manuals https://review.openstack.org/362728 | 09:28 |
*** salv-orlando has joined #openstack-security | 10:27 | |
lhinds | ping hyakuhei | 10:43 |
hyakuhei | Hey lhinds | 10:44 |
lhinds | hi mate - are you able to get this email changed: | 10:44 |
lhinds | https://review.openstack.org/#/admin/groups/347,members | 10:44 |
lhinds | It has an old one on there (nsn = nokia soltuions and networks) | 10:44 |
lhinds | 'openstack-security-notes-core | 10:45 |
lhinds | ' | 10:45 |
lhinds | ^ that is correct | 10:45 |
hyakuhei | one second I'll take a look | 10:45 |
lhinds | only security-doc-core that is wrong | 10:45 |
hyakuhei | done | 10:46 |
lhinds | cool! thanks | 10:46 |
hyakuhei | Sorry for the confusion. | 10:46 |
lhinds | np at all | 10:46 |
lhinds | hyakuhei: so I think vinays note is good to go: https://review.openstack.org/#/c/356712/ so I will + 2 this and merge, and send out the signed email / populate wiki entry | 10:48 |
hyakuhei | For an OSSN to be published it should have a +2 from two Security folks and a +1 from a core on the project it affects. | 10:49 |
hyakuhei | I'll go take a look at it now | 10:49 |
lhinds | ahh, noted, thanks! | 10:49 |
hyakuhei | so is there a fix out for this issue now? | 10:49 |
lhinds | yes, nova disables ipv6 | 10:51 |
lhinds | so the note is to insure operators don't turn it off without being aware that it can bypass to the host | 10:51 |
hyakuhei | Good stuff. | 10:51 |
hyakuhei | Sure, though I should be able to get that from the note ;) | 10:51 |
lhinds | Dustin submitted the patch which was merged | 10:51 |
hyakuhei | which I haven't finished reading yet. | 10:51 |
*** salv-orl_ has joined #openstack-security | 10:52 | |
lhinds | Instructions: | 10:52 |
lhinds | IPv6 is now disabled by default using root_dev.disable_ipv6() in interface.py | 10:52 |
lhinds | which calls the method common.ip_utils.is_enabled() | 10:52 |
*** salv-orl_ has quit IRC | 10:54 | |
*** salv-orlando has quit IRC | 10:56 | |
*** aastha has quit IRC | 10:57 | |
*** trisq has quit IRC | 11:12 | |
openstackgerrit | Merged openstack/security-doc: Updated from openstack-manuals https://review.openstack.org/362728 | 11:48 |
openstackgerrit | Merged openstack/security-doc: OSSN-0070: bandit version < 1.1.0 have possible XSS https://review.openstack.org/355493 | 12:32 |
*** markvoelker has joined #openstack-security | 12:52 | |
*** trisq has joined #openstack-security | 12:57 | |
*** jesusrodriguez has quit IRC | 13:01 | |
*** markvoelker has quit IRC | 13:17 | |
*** dave-mccowan has joined #openstack-security | 13:24 | |
*** markvoelker has joined #openstack-security | 13:40 | |
*** vinaypotluri has joined #openstack-security | 13:42 | |
*** markvoelker has quit IRC | 13:45 | |
*** woodburn has left #openstack-security | 13:46 | |
*** liverpooler has quit IRC | 13:53 | |
*** hockeynut has joined #openstack-security | 14:03 | |
*** shohel has quit IRC | 14:05 | |
*** browne has joined #openstack-security | 14:07 | |
*** sdake has joined #openstack-security | 14:08 | |
*** cleong has joined #openstack-security | 14:09 | |
*** woodburn has joined #openstack-security | 14:11 | |
*** sdake_ has joined #openstack-security | 14:12 | |
*** sdake has quit IRC | 14:13 | |
*** mvaldes has joined #openstack-security | 14:25 | |
*** dikonoor has joined #openstack-security | 14:34 | |
*** woodster_ has joined #openstack-security | 14:34 | |
*** _elmiko is now known as elmiko | 14:43 | |
*** sdake_ has quit IRC | 14:47 | |
*** knangia has joined #openstack-security | 15:01 | |
*** sdake has joined #openstack-security | 15:09 | |
*** nkinder has quit IRC | 15:12 | |
*** aastha has joined #openstack-security | 15:15 | |
*** nkinder has joined #openstack-security | 15:25 | |
*** sdake has quit IRC | 15:31 | |
*** salv-orlando has joined #openstack-security | 15:40 | |
openstackgerrit | Merged openstack/security-analysis: Report sphinx errors https://review.openstack.org/361168 | 15:45 |
*** ccneill has joined #openstack-security | 16:04 | |
*** mdong has joined #openstack-security | 16:10 | |
*** mwturvey has joined #openstack-security | 16:14 | |
*** mwturvey has quit IRC | 16:14 | |
*** ccneill has quit IRC | 16:30 | |
*** ccneill has joined #openstack-security | 16:30 | |
*** hockeynut has quit IRC | 16:33 | |
*** trisq has quit IRC | 16:37 | |
ccneill | +1'd your CR, mdong | 16:45 |
ccneill | keystone API docs for anyone who needs them: http://developer.openstack.org/api-ref/identity/v3/ | 16:45 |
*** liverpooler has joined #openstack-security | 16:50 | |
*** gfhellma has joined #openstack-security | 16:53 | |
*** gfhellma1 has joined #openstack-security | 17:01 | |
*** gfhellma has quit IRC | 17:03 | |
*** rcernin has quit IRC | 17:12 | |
ccneill | unrahul / vinaypotluri : can one of y'all +2 mdong's CR when you get a chance? https://review.openstack.org/#/c/362480/ | 17:13 |
ccneill | then I think we're good on CRs until we get further in our testing :) | 17:13 |
*** tesseract- has quit IRC | 17:14 | |
*** tesseract- has joined #openstack-security | 17:24 | |
*** pcaruana has quit IRC | 17:25 | |
*** sdake has joined #openstack-security | 17:27 | |
*** tesseract- has quit IRC | 17:28 | |
*** hockeynut has joined #openstack-security | 17:42 | |
*** markvoelker has joined #openstack-security | 17:54 | |
*** gfhellma1 has quit IRC | 18:05 | |
*** tesseract- has joined #openstack-security | 18:05 | |
*** tesseract- has quit IRC | 18:05 | |
*** tesseract- has joined #openstack-security | 18:06 | |
*** gfhellma has joined #openstack-security | 18:06 | |
*** salv-orl_ has joined #openstack-security | 18:08 | |
*** tesseract- has quit IRC | 18:08 | |
*** tesseract- has joined #openstack-security | 18:10 | |
*** salv-orlando has quit IRC | 18:11 | |
*** dikonoor has quit IRC | 18:15 | |
*** dikonoor has joined #openstack-security | 18:16 | |
ccneill | hmm.. so this is interesting | 18:20 |
ccneill | http://developer.openstack.org/api-ref/identity/v3/?expanded=assign-role-to-user-on-projects-owned-by-domain-detail,create-policy-detail,show-credential-details-detail,list-credentials-detail,create-credential-detail#create-credential | 18:20 |
ccneill | when creating an EC2 credential like that | 18:20 |
ccneill | keystone does SHA256() on the "access" key, and that becomes the "unique ID" instead of using a uuid4 | 18:20 |
ccneill | https://github.com/openstack/keystone/blob/master/keystone/credential/controllers.py#L36-L60 | 18:20 |
ccneill | so if you look at those examples in the docs, for example, `echo -n "181920" | openssl dgst -sha256` = 3d3367228f9c7665266604462ec60029bcd83ad89614021a80b2eb879c572510 | 18:21 |
*** markvoelker has quit IRC | 18:22 | |
ccneill | "blob": "{\"access\":\"181920\",\"secret\":\"secretKey\"}", | 18:22 |
ccneill | "project_id": "731fc6f265cd486d900f16e84c5cb594", | 18:22 |
ccneill | "type": "ec2", | 18:22 |
ccneill | "id": "3d3367228f9c7665266604462ec60029bcd83ad89614021a80b2eb879c572510" | 18:22 |
ccneill | from the docs | 18:22 |
ccneill | so I'm curious.. what do AWS "access" sections typically look like? from OS docs, looks like MD5s and tenant IDs(?), but on AWS' docs it looks like they're completely different | 18:23 |
ccneill | https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSGettingStartedGuide/AWSCredentials.html | 18:24 |
*** sicarie has joined #openstack-security | 18:28 | |
*** tesseract- has quit IRC | 18:30 | |
*** tesseract- has joined #openstack-security | 18:30 | |
*** tesseract- has quit IRC | 18:30 | |
*** tesseract- has joined #openstack-security | 18:31 | |
*** tesseract- has quit IRC | 18:37 | |
*** sicarie has quit IRC | 18:37 | |
*** sicarie has joined #openstack-security | 18:44 | |
*** salv-orl_ has quit IRC | 18:49 | |
*** mvaldes1 has joined #openstack-security | 18:49 | |
*** bknudson has quit IRC | 18:51 | |
*** mvaldes has quit IRC | 18:52 | |
*** mvaldes has joined #openstack-security | 18:56 | |
*** bknudson has joined #openstack-security | 18:56 | |
*** mvaldes1 has quit IRC | 18:59 | |
*** salv-orlando has joined #openstack-security | 18:59 | |
*** sicarie has quit IRC | 19:00 | |
*** mdong_ has joined #openstack-security | 19:03 | |
*** jesusrodriguez has joined #openstack-security | 19:06 | |
*** jesusrodriguez has left #openstack-security | 19:06 | |
*** mdong has quit IRC | 19:07 | |
*** mdong_ is now known as mdong | 19:07 | |
*** tmcpeak has joined #openstack-security | 19:17 | |
*** sicarie has joined #openstack-security | 19:26 | |
openstackgerrit | Michael Dong proposed openstack/syntribos: Fixed bug where CLI failure counts were cumulutive https://review.openstack.org/363158 | 19:28 |
*** rcernin has joined #openstack-security | 19:39 | |
*** hockeynut has quit IRC | 19:49 | |
*** gfhellma has quit IRC | 20:05 | |
*** gfhellma has joined #openstack-security | 20:06 | |
*** dikonoor has quit IRC | 20:10 | |
*** sdake has quit IRC | 20:11 | |
*** mvaldes has quit IRC | 20:11 | |
*** sdake has joined #openstack-security | 20:12 | |
*** mvaldes has joined #openstack-security | 20:12 | |
*** rcernin has quit IRC | 20:33 | |
*** rcernin has joined #openstack-security | 20:33 | |
*** diazjf has joined #openstack-security | 20:35 | |
ccneill | any knowledgeable haxors want to check out my take on this keystone bug? https://bugs.launchpad.net/keystone/+bug/1618615 | 20:36 |
openstack | ccneill: Error: malone bug 1618615 not found | 20:36 |
ccneill | tmcpeak / hyakuhei / tristanC ? | 20:37 |
*** mdong has quit IRC | 20:38 | |
tmcpeak | ccneill: I don't have access either | 20:38 |
*** Oshino has quit IRC | 20:39 | |
ccneill | sec | 20:39 |
ccneill | boom | 20:39 |
ccneill | should have access now | 20:39 |
* tmcpeak looks | 20:40 | |
ccneill | probably shouldn't have used an XSS payload in my example lol O:-) | 20:40 |
unrahul | hey ccneill | 20:41 |
ccneill | sup unrahul | 20:41 |
tmcpeak | ccneill: you're just fun like that | 20:41 |
ccneill | ;) | 20:41 |
ccneill | a wiiild and crazy dood | 20:41 |
unrahul | I got a 500 error for a req when the body was a bufferoverflow payload | 20:41 |
unrahul | can u take a look at our google sheet | 20:41 |
unrahul | and see if we should raise it | 20:41 |
ccneill | nice | 20:42 |
*** Oshino has joined #openstack-security | 20:42 | |
ccneill | we should probably aggregate 500 errors together so we don't overload them with bug reports, but yeah I think that's worth reporting | 20:42 |
ccneill | I wouldn't have reported the first one I found if it hadn't affected so many different endpoints | 20:43 |
tmcpeak | ccneill: nice, found using Syntribos? | 20:43 |
ccneill | or at least, would've reported it together with other 500 errors we've found | 20:43 |
tmcpeak | looks like an interesting design decision at least | 20:43 |
ccneill | tmcpeak: nah, just dumb brainmeat :P | 20:43 |
ccneill | started looking at API docs today, then looked at code | 20:43 |
ccneill | at first I was like "huh.. that looks like a huge id. maybe I can try to do a timing attack to determine existence of a given key" | 20:44 |
ccneill | but then I realized it was a SHA256() of a knowable value and I was like O_o | 20:44 |
ccneill | almost made it to writing a test for Syntribos, buut I think this is more interesting | 20:45 |
unrahul | okay ccneill I shall list all the 500 errors and may be we can raise a bug in the evening. | 20:45 |
ccneill | unrahul: sounds good! | 20:46 |
ccneill | I have a feeling we'll find plenty :) | 20:46 |
tmcpeak | yeah, ccneill good bug :) | 20:48 |
ccneill | :D | 20:49 |
ccneill | I was hoping so | 20:49 |
*** diazjf has quit IRC | 20:50 | |
unrahul | ccneill: :D , after few weeks of dev I am kinda liking this.. | 20:53 |
ccneill | yep, it's a change of pace for sure haha | 20:53 |
ccneill | I've missed it >:) | 20:53 |
ccneill | writing security tools is fun. using them is more fun | 20:54 |
unrahul | hehe.. true.. I get it now. | 20:54 |
unrahul | hey ccneill vinaypotluri is the tool really slow now? | 20:54 |
vinaypotluri | nope | 20:55 |
unrahul | are we making too many requests?? | 20:55 |
unrahul | ccneill: we need a pause option for syntribos... | 20:56 |
ccneill | agreed.. | 20:57 |
unrahul | how involved will it be any idea? | 20:57 |
*** julian1 has joined #openstack-security | 21:03 | |
*** diazjf has joined #openstack-security | 21:06 | |
*** jamielennox is now known as jamielennox|away | 21:06 | |
*** jmckind has joined #openstack-security | 21:06 | |
tmcpeak | are you guys using queuing like celery? | 21:07 |
tmcpeak | should be relatively easy if so | 21:07 |
ccneill | tmcpeak: not at this point :( | 21:10 |
tmcpeak | ahh ok | 21:11 |
tmcpeak | may be a bit more challenging then... | 21:11 |
*** hockeynut has joined #openstack-security | 21:17 | |
unrahul | I was thinking of caching the templates calls and keeping a note of it.. at the bare minimum and if there is an interrupt run from the last known template detail.. | 21:23 |
ccneill | hmm.. not sure we can resume that generator in a reasonable way if you ctrl-c it | 21:26 |
*** sdake has quit IRC | 21:26 | |
ccneill | https://stackoverflow.com/questions/13381466/how-to-gracefully-stop-python-unittest | 21:26 |
ccneill | was reading this, not sure if it would work for us | 21:26 |
*** salv-orlando has quit IRC | 21:26 | |
unrahul | :/ | 21:30 |
unrahul | will need to remove unittests | 21:30 |
unrahul | and do some celery magic>?? | 21:30 |
tmcpeak | CELERY MAGIC! | 21:30 |
*** hockeynut has quit IRC | 21:31 | |
ccneill | :{ | 21:31 |
unrahul | ah.. when I thought it was over.. they pulled me back in! :/ | 21:31 |
ccneill | we probably should get rid of unittest at some point | 21:31 |
tmcpeak | say "celery magic" three times and gmurphy appears like beetleguise | 21:31 |
*** sdake has joined #openstack-security | 21:32 | |
knangia | :D | 21:32 |
ccneill | not sure we have time right now with our current testing schedule though x_x | 21:32 |
unrahul | hehe.. need to check it out. | 21:32 |
unrahul | yeah.. | 21:32 |
unrahul | I dont suppose we can do anything now | 21:32 |
*** cleong has quit IRC | 21:35 | |
unrahul | eeh ccneill so there is a bug in our logging (again :/) , if we have subdirs then as there is option to create that subdir dir given, the logger would fail.. I am working on a patch ryt now..will put a cr out.. | 21:36 |
unrahul | u guys got this? | 21:36 |
unrahul | it will only happen when templates are in subdirs | 21:36 |
unrahul | ccneill: i guess it is becuase we have relative paths for the templates now.. | 21:41 |
ccneill | >_< d'oh | 21:41 |
ccneill | my bad :( | 21:42 |
unrahul | :D .. I dont suppose we need subdirs for logs as well.. trying to find a short cut and append it. | 21:42 |
unrahul | hey ccneill I think its a quick fix | 21:43 |
*** gfhellma1 has joined #openstack-security | 21:44 | |
*** diazjf has quit IRC | 21:44 | |
*** gfhellma has quit IRC | 21:44 | |
*** gfhellma has joined #openstack-security | 21:48 | |
*** salv-orlando has joined #openstack-security | 21:49 | |
*** gfhellma1 has quit IRC | 21:50 | |
openstackgerrit | Rahul U Nair proposed openstack/syntribos: Fixing bug in logger https://review.openstack.org/363290 | 21:50 |
*** diazjf has joined #openstack-security | 21:50 | |
openstackgerrit | Rahul U Nair proposed openstack/syntribos: Fixing bug in logger https://review.openstack.org/363290 | 21:51 |
*** mvaldes has quit IRC | 21:51 | |
unrahul | hey ccneill I have uploaded a patch, should be generic and check for all non alphabets/numbers or does this patch look alryt..? | 21:55 |
ccneill | unrahul: sorry, responding to the keystone bug | 21:56 |
ccneill | will check it out in a sec | 21:56 |
unrahul | oh yup! | 21:56 |
*** jmckind has quit IRC | 22:03 | |
*** diazjf has quit IRC | 22:31 | |
*** diazjf has joined #openstack-security | 22:31 | |
unrahul | hey ccneill u there? | 22:32 |
ccneill | yep | 22:32 |
ccneill | just commented on your CR | 22:32 |
unrahul | should we use the seprator as "::" ? | 22:32 |
unrahul | as - and _ would look weird.. | 22:32 |
unrahul | what do u say? | 22:33 |
unrahul | sep - :: | 22:33 |
ccneill | hmm | 22:33 |
unrahul | so..?? | 22:34 |
ccneill | I'm not sure if : would behave weird on windows | 22:34 |
ccneill | as if it were a drive or something | 22:34 |
ccneill | I agree : would probably be clearer though | 22:34 |
unrahul | oh.. | 22:35 |
unrahul | I shall keep this for now.. and may be we can file a bug.. if something happens later.. | 22:35 |
ccneill | for ":"? sounds fine for now | 22:36 |
*** sdake has quit IRC | 22:36 | |
ccneill | I need to go get my car inspected lol >_<, I'll be back online a bit later | 22:37 |
*** gfhellma has quit IRC | 22:38 | |
unrahul | yup. | 22:38 |
unrahul | alryt ccneill will see u later. | 22:38 |
*** gfhellma has joined #openstack-security | 22:39 | |
openstackgerrit | Rahul U Nair proposed openstack/syntribos: Fixing bug in logger https://review.openstack.org/363290 | 22:44 |
*** sicarie has quit IRC | 22:48 | |
openstackgerrit | Rahul U Nair proposed openstack/syntribos: A nit in seperator https://review.openstack.org/363306 | 22:52 |
*** diazjf has quit IRC | 23:08 | |
*** elmiko is now known as _elmiko | 23:13 | |
openstackgerrit | Merged openstack/syntribos: A nit in seperator https://review.openstack.org/363306 | 23:20 |
*** salv-orlando has quit IRC | 23:21 | |
openstackgerrit | Merged openstack/syntribos: Fixing bug in logger https://review.openstack.org/363290 | 23:27 |
openstackgerrit | Merged openstack/syntribos: Fixed bug where CLI failure counts were cumulutive https://review.openstack.org/363158 | 23:28 |
*** rcernin has quit IRC | 23:35 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!