Welcome everyone to Bogleheads On Investing episode number 67. Today our topic is taxes. And our special guest is Kay Thomas. Kay is a longtime tax attorney who has written several books including the book we'll focus on today, Capital Gains Minimal Taxes. Hi everyone, my name is Rick Ferry and I am the host of Bogleheads On Investing. This episode, as with all episodes, is brought to you by the John C. Bogle Center for Financial Literacy, a non-profit organization that is building a world of well-informed, capable, and empowered investors. Visit the Bogle Center at BogleCenter.net where you will find a treasured rover of information including transcripts of these podcasts. Today's episode is about taxes.  My guest today is Kay A. Thomas and he knows a lot about taxes. Kay's law degree is from Harvard University where he served on the Harvard Law Review and graduated cum laude in 1980. He spent his career as a tax attorney dealing with complex matters relating to business transactions, finance, and compensation. Kay now spends his time as a writer, publisher, public speaker, and consultant on topics relating to taxation and investments. He has written several books including Capital Gains, Minimum Taxes. The book we'll be focusing on today. His other books include Go Roth, A Guide to the Roth IRA, and other Roth accounts. And Consider Your Options, A Plain Language Guide to Company Stock and Stock Option Compensation Plans. Kay also maintains a website, Fairmark.com, where he provides free plain language guidance on the taxation of investments, taxes in retirement, kids and taxes, taxes on stock option compensation, and much more. So with no further ado, let me welcome Kay Thomas. Thank you so much for having me. It's an honor to be here. You've done a fantastic job writing about taxes in plain English. It's really difficult to find good investment tax books. So I want to thank you for being on the show today. Can you tell our listeners a little bit more about you and your books? First of all, I got into taxes. That's a little bit of a nerdy area among lawyers. In the tax area, I tended to gravitate toward investment side of things. And so I found myself doing quite a lot of that, both for partnerships and individual investors and people who had stock options. So that created a locus of interesting topics for me to write about. And I became interested in the internet at a fairly early time in the 1990s. So I was trying to figure out how I could start a website and just doing it as a hobby. I was still a full-time lawyer at that time. And I started thinking about what are things that I'm knowledgeable about that people do not have very good guidance about them. And so I started writing it. And at that time, there was very little competition for this kind of thing. So the website became fairly successful. As I had written a number of topics on the website, I started to think about putting out my first book. And one of the things I had written about quite a bit was employee stock options. And that's what I chose for my first book, which was called Consider Your Options. And that came out in the year 2000. Those of us who are old enough will remember that the year 2000 was a heyday for the internet boom. And at that time, there was so much interest in stock options that this book just took off like crazy. And it also happened to be the time when Amazon was just really becoming very popular. And early adopters of Amazon tended to be people who had stock options. And so the book was one of the best sellers on Amazon for a time. And honestly, I thought publishing was very easy. I couldn't understand why people thought, oh, it's hard to make money writing books. I'd heard that many times and I couldn't understand it because it just seemed like printing money.  So then I learned it was a little bit harder. My second book was the Capital Gains book. And that was successful but nothing like the stock options book. And I learned that I had to work for a living. It is a lot of work to explain taxes in non-technical language. Make it readable, not just understandable but readable so that people don't have to slog through it in order to get to the main points. So that was a challenge but I thought I was fairly good at it and the book has done reasonably well over the years. The addition that I read was 2023 with all of the new tax information in it. Yes, I try to update all of my books. My books are tax related and people don't really trust a tax book that's been written many years earlier. And when did you write the Roth book? Go Roth. What enticed you to write that and why did you write about it? The Roth originated about the time when I was really trying to get my website going. And initially there was not a tremendous amount of information about the Roth. I thought that a book about Roth would be helpful. Initially I had another book, a more limited book about Roth IRAs. I called it the Fairmark Guide to Roth IRAs. But then I wrote this book Go Roth to go right through the lifespan of a Roth from creation of it to making contributions to managing while it's in place and then taking distributions from it. Well we're going to get to some of this later on but the focus today is going to be on capital gains, minimal taxes. The updated edition, 2023. And just to make sure we're all on the same sheet of music we do have to begin with the basics of taxation. And so I am the government, I love to collect taxes and I the government have come up with many many ways to collect taxes. Income tax, capital gains tax, net investment income tax, turn of the minimum tax. So I want to go through them very quickly. Let's say we start with just income tax. Alright we have since 2017 tax brackets that go from 10% up to 37%. Those are the basic federal income tax brackets. 10% for people with very modest income but 12% gets you into a more substantial amount. Then it's 24%, 32%, 35%, and 37%. And the break points that are most interesting there you go from 12% to 22%. That's a huge difference in tax rate. If you happen to be at the border between those two tax rates you've got a 10% difference and you need to be really paying attention to anything that you can do to avoid going up into the 22% bracket or keeping yourself down as much as possible into the 12% bracket. We also have a break between the 24% and 32% brackets. So that's 8 percentage points, another really big one. And that's an area where once again you want to be paying very close attention to whether you can manage your income. Can you make an additional 401k contribution to avoid paying that 32% rate as opposed to having all of your income tax to 24% or less. So those are the two important ones. The other ones are much smaller. Obviously 22% to 24% it's not completely negligible but it's not anywhere near as important and similarly for the other differences in tax brackets. If we have capital gains or we have dividends that are treated as capital gains that's a completely different set of brackets. Yes it is. And we have the 0, 15% and 20% brackets for capital gains. 0% roughly corresponds. It used to exactly correspond and now very closely corresponds to the 10 and 12% brackets for ordinary income. The 15% bracket takes you up into a fairly high level of income and doesn't correspond exactly to a tax bracket but in a pretty high income level is where you start paying the 20% rate. And then there's another tax on top of that. You're single and you make more than $200,000 a year or if you're married, filing jointly and you make more than $250,000 and this is kind of a stealthy tax called a net investment income tax. What is that? Net investment income tax was put in as part of the way to pay for the Affordable Care Act what some of us call Obamacare. It really kind of matches up with Medicare tax that you would otherwise pay on other kinds of income and so it's trying to make sure almost all kinds of income are going to contribute in one way or another toward healthcare. And this tax at 3.8% can hit capital gains, it can hit dividends, it can hit interest income, short-term capital gains and long-term capital gains. This is why people will say that capital gain taxes go up to 23.8% instead of just up to 20%. One point about this is that $200,000 breakpoint that you mentioned where the net investment income tax clicks in for single investors and $250,000 for married filing jointly, those are not indexed for inflation and so that's something that wears away every year a little bit and brings more people into paying it. And let's get into another tax and this is called the alternative minimum tax and this can hit people who have very large capital gains or perhaps had stock option compensation. So what is this tax? This tax originally came into existence out of a notion that there were people with very high incomes who pay either nothing or very little in the way of taxes. It seemed unfair to some in Congress that there would be this disparity where people with very modest incomes would be paying a substantial portion of that income in the form of taxes and yet people with much higher incomes would pay little or nothing. And so this tax was instituted as a way to require that everyone will pay at least some minimum amount of tax. That's where the word minimum comes from in here and the word alternative has to do with the notion that we figure out how much tax you should have to pay under how much your minimum amount of tax would be by using an alternative calculation. And so we step aside into a not entirely different but quite different set of rules for determining what your tax is. The tax rates here are 26% and 28%. You have a special deduction called the minimum tax exemption but at the same time you are denied many of the tax deductions and tax benefits that you would otherwise get under the regular income tax. And the notion being those are the deductions and credits that are allowing people who are very wealthy to avoid paying alternative minimum tax. Now this used to be a very big problem for a large number of people because the alternative minimum tax did away with certain items that were claimed by many people such as personal exemptions, the state and local income tax deduction. And so people who have a lot of those kinds of deductions would be paying alternative minimum tax even though they were not necessarily very wealthy. This was substantially changed in the 2017 tax law where the minimum tax exemption amount became much larger and the place where that starts to phase out happens at a much higher income tax level. Now the alternative minimum tax affects a much smaller number of people It tends to be mainly people who exercise a kind of stock option called incentive stock option. If you have that type of option and exercise it for a very large profit then you do need to deal with the alternative minimum tax and my book Consider Your Options talks about how to plan for that. Other types of people generally don't have to concern themselves with alternative minimum tax for the most part although it's still possible with certain types of tax benefits and particularly a large capital gain can bring someone into paying alternative minimum tax and the reason for that is that it causes a phasing out of this minimum tax exemption. I know all this is kind of abstract. It's kind of hard to talk about and understand but that's the picture. All these different taxes, the income tax, capital gain tax and that investment income tax, alternative minimum tax. There's a lot of different ways the government can tax us directly but there's also backdoor ways and that is phase outs as you make more money, your tax credits that you may get phased out the tax deductions that you may have get phased out you're a business owner and you're getting the qualified business income deduction that gets phased out also if you make more money and you're retired you're more of your social security becomes taxable and you end up paying more in Medicare costs through Irma so could you kind of talk about these backdoor ways of which you can end up paying tax? Right, Irma of course is not exactly a tax but it's something that plays off of actually your adjusted gross income and causes you to pay a potentially significant amount of additional premium. So your Medicare premium can be substantially larger as a result of this. I mean if your income is just very large every year there's nothing you can do about paying this additional amount but if you have a very large amount of additional income in a particular year for example you decided to do a Roth conversion a Roth conversion can be a wonderful planning device but it can cause you to run into the additional premium that you pay under Medicare as a result of Irma. Now you can deal with that by going to the Medicare website obtaining the forms that you need to file and say look my income for this one year was higher but now my income has gone back and it's a normal income and I shouldn't be paying this higher premium because it doesn't reflect the income that I have right now. There's this two-year lag in Irma and the reason for that is that they need to have your tax information before they figure that out the only tax information they have for you right now in 2024 is your tax return from 2022 so it's two years ago that they have your tax information so there is this two-year lag you can deal with the situation if your income was very high for one year and it has gone down by the time the higher Irma Medicare premium has clicked into effect but very often you simply want to try to do planning to avoid having that happen in the first place. That form is SSA-44 just type SSA-44 into a internet search engine and a form will come up, you fill it out you send it to the Social Security Office and within a few months hopefully they will revert back to the lower premium amount. Yes, thank you for that. As to the other phase-outs there are really too many of them to comprehensively cover here but the thing that I would mention is that most of them play off against what's called modified adjusted gross income and there are different modifications for different rules but almost all of them involve foreign income if you have foreign income that has been excluded for one reason or another then you have to include that back in for purposes of that phase-out of a few of them like the Social Security Taxation we also include tax exempt income but for the most part we're talking about adjusted gross income which is your income before itemized deductions and you can think about if you're running into one of these phase-outs whether there's something you can do to your adjusted gross income and of course retirement savings boosting your retirement savings is one of the ways to do that obviously that would have to be in a traditional retirement account and not a Roth because the Roth provides no deduction. Let's go ahead and get into that the different types of ways you could save where you do get a tax benefit either now or ongoing or in the future and what I'm talking about is two different types of retirement accounts one that you can invest in pre-tax and you get tax deferral and then when you take the money out you're taxed the others are putting money in pre-tax and getting tax-free gain and then when you take the money out later on tax-free basically I'm speaking about an HSA account and then there are after-tax accounts you could put money into where it's either tax deferred or tax-free and at the end when you take the money out it's either non-taxable so just go over quickly the different types of accounts that people can put money into either reduce their current taxes or reduce taxes ongoing and investment gains or reduce taxes at the end when they take the money out There are five different potential models for taxation of investment accounts the simplest ones to understand first of all the fully taxable account your income that you have in there income and capital gains are going to be currently taxable the Roth account you get no deduction for the money going in but it's entirely tax-free if you follow the rules all your investment gains will be tax-free we have the traditional retirement account that we're used to that's the one where you get a deduction when the money comes in tax-deferred but it's going to be taxable when the money comes out and we have the HSA which as you mentioned that's the gold standard but it has somewhat limited reach right now but anyone who has it available should really give some thought to studying up on it and whether they want to be in it because it provides that unique situation going in tax-deferred growth and then the opportunity to take that money out tax-free at the end as well again, all subject to limitations but that is the one type of account for that now I've mentioned four and the fifth model is when you make a non-deductible contribution to a traditional retirement account that produces its own set of results I think one of the key things to understand here is that the taxable account isn't as bad as it might seem compared to the tax-favored accounts because you can actually get a lower tax rate with a buy and hold strategy which I know is what many Bogleheads are looking for that long-term deferral as you grow your capital gains over a period of many years in a taxable account in effect lowers the tax rate that you're going to pay on those capital gains in the end you may pay the same actual rate that 20% rate let's say if you're at the top but deferring that tax over a period of many years can have the effect of lowering that effective rate to 18% or 16% or lower depending on how long you held that stock or other investment and how well that investment performed over that period of time one of the investments that we often highlight to go into a taxable account is a simple total stock market index fund which if it's in an ETF format the one I'm thinking of Vanguard Total Stock Market ETF the ticker is VTI if this goes into a taxable account there are no capital gain distributions in the fund the dividends on it are only about 1.5% and most of that dividend is a qualified dividend which as we'll talk about in a minute is treated as a long-term capital gain so this is a very efficient broadly diversified index fund for a taxable account and usually when we're talking about investing on the Bogleheads Forum and we're talking about taxable accounts this fund often comes up I have to admit because I got into investing at a time when ETFs were really just coming out so I don't have ETFs as part of my own main investments but I do understand the advantage here because of the way they operate when people cash out of ETFs the ETF does not have to sell its own investments and create gains for its investors whereas an index fund and especially a managed fund would have to incur capital gains that have to be distributed to investors whenever their investors start cashing out the Vanguard investors the ETF and the mutual fund are the same they are just share classes of the one fund so the tax benefits extend to the opened in index funds as well and that's not true for almost all other fund companies they have a separation between their index mutual funds and their index ETFs and theoretically the index mutual fund could actually create a capital gain tax where it's that same company, same fund company had an ETF following the same index it typically wouldn't happen but with Vanguard it just happens to be that both the ETF and the fund is a unique structure they're all taxed the same and so the open index fund gets the tax benefit of the ETF and if you bought funds that had low dividend yield that works even better and of course in the end too if you own these funds when you passed away right now we get a stepped up basis on death so all of that capital gain goes on to the next generation of whomever is going to inherit the stock or the ETFs at no tax so let's just talk about that for a second that is a huge benefit for people who do hold assets that are going to pass to the next generation that are highly appreciated this has been in place for many years there was one attempt to duel away with it and for one year they did away with it I think it was the year 1979 and it was such a disaster that congress immediately did an about face and went back to having this stepped up basis at death for many years afterward we had to say well did this person die in 79 and deal with whatever problems came up as a result of that near repeal and there's still some talk about trying to do something that would reign in this tax benefit because it is such a huge benefit so this is one of the ways of completely avoiding capital gain tax another is donating appreciated assets to charity and those two are really major ways of benefiting from special treatment of long term capital gains we mentioned doing Roth conversions I want to talk about why it's more beneficial to do Roth conversions before taking social security and before hitting required minimum distribution age on your pre-tax retirement funds so can you talk first about what Roth conversions are and then when you should do them and when maybe you should not do them Roth conversion is the transfer of money or assets from a traditional retirement account into a Roth account now in the traditional account you receive the deduction when the money went in so when that money goes to a Roth you need to pay tax on those dollars and the general rule is you don't want to pay tax any sooner than necessary and so some people are immediately skeptical of even considering the idea of a Roth conversion we've just talked about the benefit of avoiding paying tax earlier than necessary on a capital gain for all the benefits that you get from deferring that capital gain so why would you do a Roth conversion this kind of starts from what I call the parity principle which is that a Roth can produce exactly the same results as a traditional retirement account if certain things are true and those things are that the tax rate remains the same at all times the dollar amount that goes into the Roth is the same dollar amount that was in the traditional account reduced by the amount of tax that is imposed on that conversion the amount of time invested remains the same and the fourth thing that has to be the same is the investment results are the same if you do all those four things together you get exact parity between those two and the tendency has been to focus on the tax rates and saying well the tax rate that is imposed on the Roth conversion should not be higher than the tax rate that you would have on withdrawal of those assets during retirement and that's generally true it's a pretty good rule of thumb but it's not the whole story the second one that I mentioned was that the dollars going into the Roth in order to achieve this exact parity have to be the same number of dollars reduced by the amount of tax and yet you're not required to reduce those dollars by the amount of tax so to make this simple if you have $100,000 in a traditional retirement account and $100,000 in a Roth retirement account that $100,000 in the Roth is worth more you're going to take that out tax-free during retirement or your heirs will that $100,000 in the Roth account is actually larger it may have the same dollar amount in it but in terms of usable assets it's larger than the traditional retirement account and that's where we start thinking about all the benefits of a Roth conversion but we would want to do these before we start taking RMDs because RMDs you cannot and maybe before you start taking Social Security because that closes the window a little bit because Social Security becomes taxable and anything that you take out of a retirement account just increases your ordinary income which could make more of your Social Security taxable so could you talk about say you retired early should you start then it's one of these very forward-looking planning ideas of making the Roth conversion as you said before Social Security I do want to mention though that there are circumstances where you can do a Roth conversion even in retirement and it can be beneficial even after you started RMDs and you're into that whole later years of your retirement you can still potentially benefit from a Roth conversion you do have to be careful the first dollars that come out of your traditional account are going to be treated as your RMD and so if you make a mistake and convert the first dollars that you take out do the conversion before taking your RMD that's a mistake I've seen fairly often then you've got a bad conversion because you have converted dollars that you're not allowed to convert because you cannot convert RMD dollars after you get beyond that you've taken your RMD now you take your Roth conversion what you're doing if you can pay tax on that conversion with dollars that you have otherwise sitting in a taxable account now in effect you've moved dollars out of your taxable account and into a Roth IRA and that of course is a very beneficial thing to be doing the impact may not be huge but again it's one of those little tax planning scenarios that people tend to overlook because they're getting into those years when they think a Roth conversion is no longer for me I want to take a moment here to talk about qualified charitable distributions and this is where if you're a 70 and a half you can take up to 100,000 dollars per year per person from your IRA and donate it directly to a charity it can't go to a donor advice fund it has to go directly to a charity and you're not taxed on this money now when you hit RMDA at either 73 to 75 then the amount that you gave to charity as a qualified charitable distribution is deducted from your RMD amount so if you gave 25,000 dollars to a charity directly from your IRA and your RMD was 35,000 you would only have to take a 10,000 dollar RMD now the trick here though is you have to make the contribution to the charity first and then you make the RMD second you can't do it the other way around you can't do the RMD first and then the charitable contribution second which is by the way the exact opposite of what we just talked about which is if you're going to do a Roth conversion from your IRA that after doing your RMD not before so remember QCDs must be done before you do your RMD whereas Roth conversions are done after you do your RMD clear as mud as we used to say in the Marine Corps I've got one other K so let's say that you are past required minimum distribution age but you're still working for a company this is a company that you do not own more than 5% of could be a non-profit and it's a 403B they could have a 401K but you are working for this company and you're participating in their 401K or their 403B you do not have to take required minimum distributions from that 401K or 403B for as long as you work there so if you work there until you're 85 you don't have to do RMDs from that account the IRS also allows you to take IRA money and old 401K or 403B money and roll it into your current employer's 401K so technically any money that you roll into that 401K also you wouldn't have to take an RMD from that's right Rick and you're making it sound attractive for me to go back to working a law firm but the prospect of doing all those billable hours just makes that hard and I have to mention here that anything we talk about on this podcast is strictly informational you need to check with your tax advisor to see if these strategies work for you alright let's get into the title of your book Capital Gains and here it can get complicated we have long term capital gains short term capital gains how do the taxes work so short and long term capital gains are basically the differences between whether you've held your investment for more than a year and we have to be specific about saying it is more than a year and not just one year you have to sell no sooner than the anniversary of the day after you acquired your asset in order to have a long term capital gain there are various circumstances that can cause an adjustment in your building period but that's the basic rule now generally speaking a long term capital gain is going to be more favorable than a short term capital gain because of the favorable tax rates that we spoke about earlier for long term capital gains short term capital gains are going to be taxed at the same rates as ordinary income but there are various rules that cause these to interact if you have a combination of short term and long term capital gains and capital losses then you're going to net the long term capital gains against your long term capital losses and this is why a capital loss is actually more favorable if it's short term whereas a capital gain is more favorable if it's long term adding out if you have a net long term capital gain that's when you get the favorable tax result and if you have a capital loss it's going to be deductible but only to the extent of $3,000 and this by the way is one of those strange items that is not indexed for inflation almost all of the dollar amounts that are in the tax law are indexed for inflation but this one is not and so we've had this $3,000 going back to the Reagan administration and if you adjusted this for inflation since then I don't know what the dollar amount is now it's probably $15,000 or more but we're still stuck with only $3,000 as a potential deduction for capital loss that's an important fact for people who have variation in their capital gains and losses that they recognize because if you have a large capital gain one year and a large capital loss the next year there's no carry back you've already paid tax on your capital gain and this capital loss you're only going to deduct $3,000 of it and so this is what we call a capital loss whipsaw and it's a very unfavorable situation the opposite is not as much of a problem with capital loss one year you do carry it forward and you can use that against capital gain in the next year so it's very important if you have these kind of variations in your capital gains and capital losses to keep this in mind that you can only deduct $3,000 of your loss now a lot of people think incorrectly that the dividends you get from stock which are treated as long term capital gains some of them are the qualified dividends that you get are treated as long term capital gains for tax purposes but they don't get offset by capital losses correct? yes, that's absolutely right long term capital gains do get offset by capital losses including even short term capital losses if they exceed your short term capital gains but none of that will offset a qualified dividend benefits from the long term capital gain rates but not the full capital loss treatment so I want to get into something that would help if you had capital gain and that is to have done tax loss harvesting which is basically if something goes down in value and you've got a capital loss sell it and replace it with something that is close but not substantially identical so could you cover tax loss harvesting and what substantially identical actually means? well the concept of tax loss harvesting is as you describe something has gone down in value you're going to sell it and a lot of people think about doing this just at the end of the year they're reviewing their investments should I sell something before the end of the year in order to get a deduction but the reality is that tax loss harvesting that is done throughout the year can be more beneficial I've seen some research on this where they did projections and worked out that a portfolio in which tax loss harvesting is done at reasonable intervals you don't want to be doing it every day can outperform a simple buy and hold portfolio for a number of years by up to 1 percentage point 100 basis points that gradually wears away over a number of years and that's for the simple reason that the stock market over many years will go up in value and most of what you have in your portfolio will be stocks that have gone up and so your opportunity to be benefiting from tax loss harvesting does kind of wear away over a period of time but on a brand new portfolio tax loss harvesting can produce a very substantial benefit and Vogelhead certainly know that 1 percentage point or 100 basis points is a really big deal and to be able to do that over several years can be highly beneficial to your long term financial health so that's basically the idea now what constrains this primarily is something called the wash sale rule and in simple terms the wash sale rule says that if you sell a security at a loss and buy a substantially identical security within 30 days before or after then you don't get to claim that loss the loss gets added to the basis of whatever you bought as a replacement but you don't get to claim that loss on your tax return and so this creates something of a big block for the people who are into tax loss harvesting we have a 61 day period okay it's the day of the sale 30 days before and 30 days after so you have to be very careful about measuring that if what you're looking to do is sell and then go back to the same exact investment or something that is substantially identical in your book you gave March 31st as a good example if you sold it on March 31st it means you couldn't have bought it in March or you couldn't have bought it in April which is only 30 days and I thought it was a great example right well thank you for that so substantially identical yeah substantially identical is something that has not been fully defined ever and there is one ruling out there where the IRS talks about a situation where a takeover is pending and it has not yet closed and the two stocks that are involved in the takeover are going to trade exactly in tandem they say that even though these are different stocks they are going to be treated as substantially identical and that makes a lot of sense that you shouldn't be able to sell one at a loss and buy the other one when you are really trading into the same situation that you treated out of the place where questions come up a lot is neutral funds and particular index funds can I sell one total market index fund and buy a different one from a different company and will those be considered substantially identical and the IRS has never ruled on this and of course there are related questions about index overlapping index funds or you take a total market fund and replace it with a small cap and a large cap index fund that together add up to that that total market fund there are no rulings on this what I say in my book is that unless you want to be a wise guy and play loose with the rules you are going to treat it as substantially identical if the two investments once you lay one on top of the other they are going to perform exactly the same if you know the investments are going to perform the same that was the basis for that one ruling that I mentioned by the IRS and so those are what are going to be or should be treated as wash sales situation the IRS doesn't have a way of tracking this realistically but if you return gets audited for some other reason and they see that you are kind of a wise guy so they decide to go after you hmm ok well I am a wise guy if I sell the vanguard total stock market index fund which is run by vanguard and tracks the crisp total stock market index which is the center for research and security prices an affiliate of the university of Chicago and I take a loss the fidelity total stock market index fund which tracks the Dow Jones total stock market index which is owned by standard and pours neither the index provider nor the index fund provider are similar or affiliated and to me that means they are not substantially identical but again I am a wise guy and I have no problem with that and perhaps using the wise guy forget about it forget about it I don't mean to say imply that that means you are cheating you are playing in an area where the IRS probably wouldn't like it I will put it that way if they took a close look at it as you said the IRS has never said anything about mutual funds or particularly index funds which have been around now for 45 years I would say something and just get it over with but so far we have heard nothing so it is up to each person to make their own decision with the help of their tax advisor of course in the last few minutes we have left I want to talk about dividends there are different types of dividends we are all getting our 1099s we already got them 1099div or 1099int which is for interest and there is ordinary dividends there is capital gain distributions unqualified dividends exempt dividends for the most part individual stocks are going to pay ordinary dividends which will be qualified if you hold the stock for 61 days you don't have to hold it for 61 days before the dividend but you have to hold it for a total of 61 days in order to get that qualified dividend treatment mutual funds their dividends can include a variety of items if the mutual fund has interest income that will come out as an ordinary non-qualified dividend so technically it is not interest but it is treated essentially the same as interest it is ordinary income and it is going to be taxed at ordinary rates if the mutual fund has received qualified dividend then that qualified dividend can be passed through to the shareholders of the mutual fund those shareholders again will hold for 61 days in order to get the qualified treatment we get into more interesting aspects with for example if you have a mutual fund that pays out tax exempt income if the mutual fund invests in municipals then it is going to have tax exempt interest it can pass that through as tax exempt interest and that interest can be tax exempt federal it can be tax exempt on your state income tax if that is applicable depending on the rules of your state and what state municipals that the mutual fund invests in so those are other possibilities there is a special rule for mutual funds that says that if you have invested in that mutual fund for a period of less than 6 months you will receive a capital gain distribution from that fund you can treat that capital gain distribution as capital gain on your tax return but if you sell that mutual fund within 6 months and you sell it for a loss then that part of that dividend is going to be converted into a short term capital gain instead of a long term capital gain now the reason for this is if you have a clever a wise guy who is investing in mutual funds and selling and trying to get a tax advantage you buy the mutual fund immediately before it pays out a capital gain dividend you treat that as long term capital gain and then you immediately sell that mutual fund for a loss and it would be a loss immediately after the dividend pays out because that dividend pay out reduces the net asset value of the mutual fund so you sell it for a loss and you claim a short term capital loss because you held it for less than a year well that would create an artificial advantage for someone who did that they are getting a long term capital gain and immediately turning around and getting a corresponding short term capital loss so now we have a rule that says you don't have to wait a year but if you wait less than six months before selling that mutual fund at a loss you are going to get this corresponding treatment that wipes out the benefit you would get from that and the same thing happens to a tax exempt pay out from a mutual fund if you sell with an at a loss within six months after receiving one of those then you are going to get a treatment that wipes out that loss up to the extent the tax exempt dividend that you received well the very last thing I would like to talk about is gifting gifting of appreciated stock gifting it to charity or gifting it to say your children the benefits of that or the disadvantages of gifting of appreciated assets well when you gift appreciated assets long term appreciated assets to a charity then you can subject to limitations treat the value of that gift as a charitable contribution deduction without having recognized any gain so you are getting the same deduction that you would get as if you sold the stock or other investment and then gifted the proceeds but you are getting that benefit in terms of charitable contribution deduction without having to report gain on a sale so that is a very beneficial way of dealing with substantial charitable contributions I say substantial because nowadays small ones don't produce benefit for most people because most of us are not itemizing anymore that is a really important point because a lot of people they might only have their state and local taxes as a deduction and that is limited to ten thousand dollars and the house is paid off so they don't have any mortgage expense on their house and maybe they don't have high medical expenses so the only other thing is a charitable contribution and so if you are married finally jointly your standard deduction this year is almost thirty thousand dollars and so the first twenty thousand that you would donate to charity wouldn't be a tax deduction because you are not going to be itemizing you have to get over that amount that is correct standard deduction again this goes back to the 2017 tax law a huge reduction in the number of people who itemize and it is in a sense a great benefit for those people who would rather take a thirty thousand dollar standard deduction than a twenty thousand dollar itemized deduction but it also means that deductions of this kind like charitable deductions are of no benefit to a large number of people what we do talk about a lot with the and the mogul heads is bunching of these charitable deductions and putting them into a donor advice fund and I know I don't have a lot of time to get into what donor advice fund is but if you are going to be giving twenty thousand dollars to charity every year and you are going to be giving appreciated stock that it is better to give a hundred thousand dollars in one year and put it in a donor advice fund you get a hundred thousand dollar deduction on that because now you are above the standard deduction plus your state and local taxes so call it a hundred and ten thousand dollars and so you would be able to take all of the amount of the deduction above the original twenty thousand that you donated can be a tax deduction this is if you are in a high tax bracket because only thirty percent of your AGI would qualify for this and then you put it in a donor advice fund and then over the next five years put twenty thousand dollars a year to the charity that you want to give to now you don't get a deduction in the following years but you do get to deduct a large portion of that hundred thousand dollars rather than every single year putting twenty thousand to the charity and not getting any deduction for that hundred thousand yeah the donor advice fund has been a huge benefit for people who want to do bunching or simply just want to be putting money into a charitable vehicle without having chosen those charities yet and paid that money out yet it is in a sense kind of a workaround from the private foundation rules private foundation is another way of doing a similar thing but at a far more expensive level but with greater control by the individual who is setting it up this is all great for charity given appreciated property to charity but it's not something you may want to give to your children correct? well they will still have to pay tax on the gain so you're not avoiding that gain and it's property that you otherwise would be able to pass to your children at death if you hold on to it and so you know I've seen people make this mistake they're in their leader years and they think oh I should benefit my children by giving them this appreciated property that's step up in basis so it can be one of the classic mistakes that people make we could be talking about this for hours if not days all of the different things that we could do to lower our taxes I do have a saying that if you hate paying taxes then you should love to learn about taxes because that's how you can reduce your taxes so with that in mind I want to thank you so much for being with us today I learned a lot and hopefully our listeners did also it's been a great pleasure being here thank you for having me this concludes this episode of bogelheads on investing join us each month as we interview a new guest on a new topic in the meantime visit bogelcenter.net bogelheads.org the bogelheads wiki, bogelheads twitter listen live to bogelheads live on twitter spaces the bogelheads youtube channel bogelheads facebook reddit join one of your local bogelheads chapters and get others to join thanks for listening


T. F. N. N. Headline news update. Good afternoon, folks. Steve Rhodes coming to you live from the shores of sunny Delray Beach, Florida. This year, 2 p.m. update, clearly of all U.S. and C's trading to the downside. That was up 361 percent. The S&P nine-tenths or 39 points. The NASDAQ eight-nine-tenths as well, 130 points. Russell's off one and a quarter percent, 25 points in the downside. Semmys down 65. They're printing out at 3381. Gold's up 16 bucks. 1937 is its print. Silver's trading up 29 cents. 25.20. Lights we crude up 450 or 113.77. Let's go spend a little time with our indices charts out there. Momentarily, you'll see these white panel charts, the upper left-hand side. You will see the Dow. Now, the Dow needs to close today above 344.80. We're 344.49. If price closes below 344.80, the TD-9 count pattern that's in play out here will vanish. It'll go away because it will not have met all of the requirements. So that's really the level to watch. If price closes above 344.80, then you have a valid TD-9 count top. Now, the high could still come tomorrow, but forming a TD-9 count top below TD-9 count breakdown resistance was at 35, 431. It's usually a bearish message. I mean bearish directionally speaking. That would then say that price should go seek out its oscillator and change line currently in the 33A29 level. We do not have a topping signal inside the S&P 500. With the topping pattern, I should say, we may have a signal and that price got back to its breakdown level 4526. So that's where a countertrend rally could end. And then if you go down to the spot ball utility next, you're going to see that yesterday was bar number nine. Today's the bar following them. Bar number nine. So this is going to have a confirmed TD-9 count top out there. Normally, I say that price will go target an oscillator and change on it. Maybe that's what its intention is. But the first place where price should target inside the spot ball tunics would be the 50-day exponential moving average, 2651. Back up top, the NDX 100. No top in place. And inside bar, so to speak, says the price wants to make a move to 14769. I believe we looked at Apple and the longer term will look like it wanted to move higher. So, you know, as Apple goes, maybe the NDX 100. The Russell 2000, even though it's struggling, it's just been in a sideways consolidation stuff towards the upper end of that consolidation. The semis certainly pulling back. They could pull all the way back to 3276. No topping signal there. Folks, stay tuned. Your favorite polar bear, David White. He's back in town. He's up next. Tom O'Brien, he'll take us on home and I'll be back with you tomorrow on terrific Thursday. Have a wonderful Wednesday. Thanks so much for joining us.


Hey everyone, welcome to another live video. The narcissist has to see you as the bad guy.  Everything you do is great.  You can't do anything wrong. Even if they do notice something like a fault or a mistake that you make, they'll quickly forget about it.  They just see you as though you're perfect. Everything you do is great. But then as time goes by, they begin to become more sensitive to everything you do. Any little thing you do wrong and sometimes you might not even do anything wrong. They just see it as though whatever you're doing isn't good enough. It's like no matter what you do. No matter how much you do for a narcissist, it's never going to be enough. As we know, there are millions and millions of people around the world who have been in relationships with narcissists and I've never heard of a single situation where anyone has ever made a narcissist happy. I've never heard of a narcissist who was satisfied. They always want more.  I'm not saying that. The difference is a healthy person wants more from themselves. A narcissist always wants more from the people around them. Many people think, okay, so the narcissist thinks that what I'm doing isn't good enough. That's fine. All I have to do is do more. Do more things to make them happy. Maybe help around the house a bit more. Give them more money, whatever it is, just do more of it. And the narcissist will tell you, yes, that's what you've got to do. That's why I've been so angry towards you because I want you to do more. I want you to help me more. I want you to give me more money and they'll make you believe that if you just do a little bit more, all of these problems will disappear. You won't have to deal with the rage anymore, the fly monkeys, the smear campaigns, the gossiping. But you've only got to remember, as I said earlier, there's millions and millions of people in this world who have been involved with narcissists. All kinds of people. There's people who might be in a relationship with a narcissist who says that they don't spend enough time around them. So the narcissist might manipulate them into quitting their job, but it doesn't make a difference. The narcissist will just find something else that's wrong. Or any time that you spend, like, maybe you just want to take some time out to take care of yourself. Maybe you need more sleep, whatever it is. They'll just complain about that.  So even if you spend every second of your day with them, it's not going to be enough. And then another scenario is just think about how many narcissists there are out there who are with millionaires, even billionaires. Because those are the type of people that they target. People who are wealthy, powerful, successful. So just think about that. Think about how many narcissists are with millionaires and billionaires. And think about how much money they spend on these narcissists. I've heard plenty of situations myself of multimillionaires who have been with narcissists. And no matter how much money they spend, it's never enough. They are never satisfied. So there's two examples for you. No matter how much time you spend with them, no matter what you do for them, no matter how much money you give to them, whatever they're asking for, whatever they want more from you, you can give it to them as much as you want until you're starving, until you're dying, until you're in need. And they're still going to be miserable. It's still not going to be enough for them. And if anything, they'll just take everything that you gave to them and they'll just go find someone else and do the same thing again. It's not finally going to make them respect you. It's not going to make the argument stop. It's not going to end the rage. It's not going to end the gossiping and the spear campaigns because the narcissist has to see you as the bad guy. They saw you as perfect in the beginning. But as time goes by, in any relationship, whether you're with a narcissist or not, there will be complications. There will be things that go wrong. That's natural. Things go wrong in every relationship. There will be arguments and disagreements. All of these things are normal. But when things go wrong, people should accept the faults that they have made.  You've got to look after yourself too. No one's going to look after you more than you do. No one else is going to put you first. So if you don't put yourself first, you're going to be left behind. You could put a narcissist first. They're not going to put you first. No, that only works one way. So you put them first and you'll end up getting the short end of the stick. You will be the one who's losing out. But of course they want you to put them first. They want you to spend all of your time catering to them, making their lives easier. But that's not going to make things easier for you. Whatever happens, they have to see you as the bad guy. Because it's either you or them. When things start to go wrong, they don't want people looking at them. Like they've messed up again because you could be sure that they've had so many failed relationships and they just see it like they already know as soon as it starts going wrong. They're thinking in their minds, it's happening again. For like the fifth, tenth time in a row, they're already anticipating another failed relationship. They already know what's about to happen. So as soon as they can, the first thing they're going to do is point the finger at you and blame you for everything. And that's always a red flag. When someone blames you for everything and someone tells you that you've done nothing, when someone tells you that they do everything and that they do everything right, when someone sees these things, that's when you should know that there is something loosely wrong. Because while the narcissist may have seen you as being perfect in the beginning, we all know that no one in this world is perfect. We all have flaws and imperfections. We all make faults and mistakes. And just as no one in this world is perfect, no one in this world is inherently flawed. In any situation, no one makes all of the mistakes. There's always other people who have a responsibility. There's always other people who should be holding themselves accountable. But no, the narcissist just wants to pass it all on to you. They want you to think that you're to blame for everything when it just doesn't happen that way. They want you to think that you're inherently flawed and you're to blame for everything. When they have a responsibility, they should have been holding themselves accountable for things too. But they just want to pass it all on to you. Because in their minds, it's dualistic thinking. Everything's black or white. Everything's good or bad, right or wrong. And they have to see it as though you're wrong for them to be right. You have to be the bad guy for them to be good. That's just how they think. It's a very immature way of thinking. They're emotionally underdeveloped. And that's why when you speak to them, nothing ever gets resolved. Because they're always speaking from their own emotions rather than any logical reasoning. And whenever you try to get a point across, it's never going to get through to them.  The only thing they're hearing is the narrative in their minds of what they think is going to happen if they listen to you, if they do take in your point of view. And they just can't do that because all the narcissist really wants is to get what they want. They just want everything they want from you. And they want the situation to work out in their favor. And the problem they have is that if they even begin to listen to what you have to say, the chances are they're not going to get what they want because they already know that they're wrong. And that's why they don't want to entertain anything that you're saying. That's why they have this all-or-nothing mentality where you're to blame for everything, where you do everything wrong. Someone like that who takes no accountability for anything, that kind of person is just trying to get what they want. At any cost, they don't care about how it affects you. They don't care if they're lying. They don't care if they're being deceptive because they're self-absorbed and they lack empathy.  There's no alcohol in this, by the way. I don't drink. I just like the taste. But yeah, these narcissists, all they care about is what they want. That's really all it is. Every argument you have with them, most of the time, they already know that they're wrong. They just don't care. They don't care about what's right or what's wrong. What overrides that is that they just want what they want. And that's why there's no getting through to them because when someone doesn't care about what's right or wrong, there's nothing you can tell them. That's why when you think you're really covering all bases, you've got all of the points. You bring evidence to them, whatever it is. But it's never enough. It never gets through to them. It's never good enough to get them to see where you're coming from. And that's when you know that you're dealing with someone who is not of a sound mind. Hello? Hi, do you do the work across the road? No, no, I'm not. Well, they're locked in the car park now over here. All right. Thanks. Please leave now, please. Okay, I'll go. Sorry about that. Anyway, I've got to go and be kicked out of this car park now. Thank you all for joining. And I'll talk to you soon.


So We're going to talk about content security policies, which is I think a fascinating Approach to security, but of course it's also incredibly geeky and Nerdy, so I hope you guys find it interesting on some level I'll just tell you a little bit about myself was this working No, okay fingers it is Yeah, so I founded WordPress development agency based out of Jerusalem Israel and I did that for About 12 years and we worked with leading tech companies and universities nonprofits in Israel Wrote a blog that was widely read but stop blogging which I'm sad about I don't I mostly post on Facebook If anything or Twitter and no more long blog posts, but I see that pretty pretty well And a lot of the tips there were followed by people in the WordPress community I basically documented my WordPress discovery journey. I thought if people helped me That's how I learned right in the WordPress community from other people's posts I'm going to write what I learned and then hopefully that can help others so Yeah, so I wrote that for a while and organized work at five times in Israel Until they made a policy that you can be the lead organizer up to two times So I kind of surpassed that and it was actually really good timing because I really needed a break like organizing it five times Bit much someone else was supposed to take it over it didn't really happen So hopefully we've restarted the WordPress community meet-ups in Jerusalem We were having monthly meet-ups, which is great and hopefully we're going to do a word camp in 2019 So stay tuned if you want an opportunity or an excuse to come visit Israel and now and then oops and since then I founded a startup called static Serverless and static publishing for WordPress. I can tell you more about that and here are my other seven startups Yes, I have seven children Yeah, and they're the joys of my life. So anyways, that's about me. So What happens when you load a web page? What happens is that the browser? identifies what it should be loading into the browser and displaying and that can include a lot of assets that Aren't necessarily on the server with the website Some of them are some of them aren't some of them are loading from different domains, etc And what you will see is that if you look at the page source of a lot of websites This is a very prominent news site They will be loading assets from all different sources and you can see here, you know bounce exchange Adobe Amazon etc and Recent studies showed that on average websites are loading 42 scripts that are external at any given time So we're depending a lot on third-party services and third-party scripts in order to make our web pages functional and Over 50% of all page requests are third-party calls. So Without us really noticing We're adding more and more to our websites that we don't actually really have control over There's a big trust factor here, but it's just so easy. You just insert a JavaScript You know peace and you're good to go and you've got some new functionality or new tracking And and that's what we're all doing to our websites including the very large ones How do web apps get compromised? So first of all it can be on the server side, which is like SQL injections which target the entire website, right? And it will compromise the files or the database and That's seventy percent seventy six percent of total exploits are that kind of attack the other kind is on the client side and those are called cross site scripting attacks and Cross site scripting attacks are kind of the oldest Method of compromising a website. They've been around basically since the dawn of the internet And it's one of the most widespread you would think that if it's been around for so long It would be less of a threat, but that's not how the internet works necessarily There's constant efforts to try to mitigate it, but it still continues to be a very serious threat what it does is it allows an attacker to run a script in the user's browser and The browser can't tell the difference between a script that is authorized to run and a script that is malicious So this is what happens Browser allows all the assets including this terrible evil JavaScript and the browser accepts it and runs it and then it can do all sorts of terrible things to the site and because it's To the user actually and because it's accepted in the browser. It actually has the same permissions and access as the browser has so cookies web storage You know forms the DOM. It's all got the same permissions As as the site itself It's been in the OAS Top 10 forever. It's now in position seven And it's the second most prevalent issue It's found in two-thirds of all applications, you know At any given time huge amounts of websites have cross-site scripting vulnerability so with cross-site scripting the Unlike the server-based type of attack where it modifies something on the server or the database or the files Here the victim is actually the visitor of the website And here are just some of the things that can be done to a visitor to a website like this Session hijacking cookie theft account takeover redirecting traffic Stealing accounts credentials displaying unwanted ads virus and malware infections key logging Etc. So lots of fun stuff and these are things that we definitely want to be preventing so that our browser our visitors can safely browse our websites One example of a recent attack like this that used a third-party service to Infiltrate websites was a hack called the browse allowed so browse allowed is an add-on That a lot of British government websites added to their sites It's an accessibility add-on. It's text-to-speech. That's very useful and nice and good for a government for trying to make their sites more Accessible in Israel. That is not the case. So that's great but what happened was the sites are all loading this third-party script which they trusted and then the script was Modified by hackers and all of those sites instead of being text-to-speech Accessible became crypto miners. So, yeah and you're talking about How many sites was it? Let's see thousands thousands over 5,000 sites Got this vulnerability and we're mining cryptocurrency when visitors Using visitors CPU and resources when they were visiting these British government websites. So That's just one example Why is that bad? Okay crypto mining like whatever because it slows down the devices. It can take CPU to Higher levels if you're anything like me, you might have a lot of browser tabs open So you can't afford to have your CPUs anymore battery drain overheating You know puts a load on your on your device etc. So and of course a government should not be mining cryptocurrency We had that actually in the WordPress community. There was a Weather widget that was in the plug-in repository and the person who developed it didn't realize that the Resource that they were using to display the weather was also a crypto mining Yeah, thanks. So that's another example, but the very biggest most significant type of attack Is the Magikart one? It's very interesting and very widespread so basically Magikart Has been going on for the last three years. It took a really long time for anyone to realize that this was happening and It's a group that nobody really knows who they are and what they do is They identify third-party scripts or services that websites are using and then they hack those So at first when Magikart started out, they would actually hack direct the site directly But then they came up with this approach where they would identify a tool that was Maybe easier to Hack and then they would hack that and then they were able to apply their hack to the sites that had that script installed on it So these are just some examples And what they did was they became credit card skimmers so when people fill in the credit card form on any of these sites they were able to grab the credit card information and Of course use it for malicious purposes and They it's estimated that thousands I think thousands of sites have been affected by Magikart and It's really hard to track because they're very smart. They In they modify the script in a way that looks like it's meant to be there. It's so it's difficult to to identify it Okay, so that brings us to content security policies The idea behind content security policies is that Okay, so we're in this world of the web where we're all installing who knows what on our sites I'm guilty of that too. Just two days ago. I found a shiny new tracker thingy and I installed it on our site And then I was trying to Debug it. I was like, why isn't it working? And I was like, oh right because we have a content security policy That's not allowing me to be responsible. Good so what it does is basically you You whitelist sources that you have deemed to be trustworthy and okay to load on your site and Then anything that's not that will get blocked by the browser. So it's a it's a header that talks to the browser and The modern browsers Except for of course Microsoft Microsoft has partial support they all support the content security policy header and they will respect it and so It will load whatever you say that it can load when the viewer loads the web page and it will block anything else so Basically the way that it works is okay. I'm loading a web page and I've authorized Google fonts I've authorized Google analytics. I've authorized my own images and Then I have not authorized this other resource and the content security policy won't allow it to load and if these websites had had content security policies properly implemented Magikarp would not have been possible So in terms of browser support levels, there's a really useful site called can I use if you're ever wondering what is Supported in browsers in general and you can check out which browsers support content security policies and which version This is these are this is the support for content security policy level two But in October ish. Yeah, October level three was rolled out But Chrome and Firefox support it, you know Safari 2. I think of course Microsoft always lags behind So how does content security how do like how does the content security policy work? What do you have to do in order to create one and implement it on your site? So there's two parts to it. There's the directives, which are the type of assets that you want to Limit or control so you can tell by their names kind of what they are, you know fonts Frames like iFrames images media the media is like video and Objects objects are flash type of content Scripts, which is JavaScript styles, which are of course style CSS and then you say, okay Now for this font for the fonts I will only I only want the site to load a fonts from let's say my website or Not at all right like for the the object source a lot of content security policies will say none Because you don't want any iFrames loading those are those tend to be a pretty popular way to breach a site Self self is my own domain so anything that's sitting on let's say my my site comm Slash whatever then that's accepted Stars a wild card use that carefully And unsafe in line unsafe evil, which I'm going to talk about So this is The default content security policy so when you start out You could do Content security policy default source none, and that's a good way to actually try to identify Through the console and I'll show you how what assets are trying to be loaded and then you can say okay This I need to whitelist this I need to whitelist that Or you could start with self because it's probably the case that you do want to load assets from your own domain What this actually means the default source is it covers these directives and they and makes them all self Okay, it used to be that it didn't cover everything, but now I think it pretty much covers all of the directives So you've covered that and you said okay, those are all self and then you can tweak it further So you can say okay self for the script source But also I want Google Analytics to work So I need to authorize that with a by whitelisting it fonts same Object source like I mentioned probably best to do none unless for some reason iFrames are important You can also by the way tweak it so that on a per-page basis it will accept things So if you know you have an iFrame on one page you can have a different security header on that page doesn't have to be site-wide This is my favorite content security policy directive Basically what it does is if you Have a site and has mixed content right now that we all need to have HTTPS on our sites and it's very important You might end up having a site a legacy site or whatever a migration that didn't go 100% smoothly And it still has some assets that are HTTP like an image or who knows what? And then you won't have the padlock on that page, which is very sad So this instead of going and finding it all what you can do it Says load all assets is HTTPS even if they're HTTP. So it's like a one-step HTTPS for everything Directive and it's 100% effective. So it's it's great. So that gets big emoji from me Defaults oh right the reporting. Sorry. Okay, so what's really useful about the content security policy is that there's an understanding that websites are dynamic they change we add things we remove things and It's really hard to keep track of it, especially the site gets larger So there's a reporting capability where you can have this directive and it will collect information about violations of your content security policy now violations don't necessarily mean that someone's trying to hack you it might mean You know you now have a YouTube video Embedded in your site and you haven't authorized that you haven't whitelisted it and so it's violating the content security policy And then you can whitelist it and then your YouTube video will now appear on your site So and then what it does is it collects the data and sends it as a JSON to the URL that you define So here it could be CSP reports or something like that If you start to do research about content security policies online The problem is that there's not a lot of information out there and some of its outdated, you know, they've been around since 2012 they're not widely used and people aren't really familiar with it and The documentation well, there's the standard documentation from the w3c, but that documentation is never ever legible I don't know if you ever tried to read the documentation, but it's the worst you just go in circles and like they use English I don't know who's writing it, but Google has some really good documentation, but even their documentation is not updated to CSP level 3 in some places so what you might find is some mentions of these directives and Is that six hours? Okay CSP directives that look like this the X ones and They are no longer supported supported, but you might see Document like tutorials or whatever they'll say use it don't use it Okay But the irony is that even after you've whitelisted everything all of us are going to have inline Scripts Google Analytics is a perfect example despite the fact that Google is a huge advocate of CSPs and The bottom line of CSPs is that your assets need to be an external file and not inline Google Analytics and other Google tools are in line and In order to enable that to work you need to use something called Unsafe inline and unsafe eval just the names are like who you're doing terrible things to your site I'm allowing my site to be unsafe, but in order for Google Analytics to actually work You need to add this these directives of unsafe inline In order for the script to be accepted by the browser and once you add that then inline script injections are possible and Despite all our hard work on the CSPs our sites are still vulnerable I gave this talk first version of it at work camp Europe and I and we you know We implemented this for ourselves and for our clients and this really bothered me I was like so what are we supposed to do? We're all supposed to take our inline assets and and you know make them external That's a huge job and we'll take a huge amount of debugging and and the internet's actually like the way it is We just this does not build that way. That's a crazy expectation. So other people thought that obviously This is what the directive looks like if you want to have unsafe inline and unsafe eval so one way to get around this is to create a nonce for every script and But it has to be randomly generated on every page load. It's not so simple but you have one and then it's applied to all the scripts that you authorize to load and That can protect you from the inline script because any inline script won't have that randomly generated nods. It's unguessable And yeah, so so that's one solution that but that came up But there's a challenge with that which is caching right you can't really cash a page in that case because You have to change it every time Hashes is another thing that you can do which is you create a hash of the script the inline script that you want to authorize So That is it's that way if it it's changed in any way then the hash no longer matches the script And then it won't be accepted by the browser But the problem with that is that if you're using a third-party script Then they're it's ass right so they're generally updating it and so then the hash if they make one update your Your scripts gonna stop working And sub resource integrity is A way also to say this is a script and it's like this is like a kind of a stamp on it and you know But also it it's problematic in terms of maintaining it so researchers at Google identified this and they took a look at the content security policies that were implemented on like 1.6 million websites and they found that 94 percent of them are bypassable because of the Issue of the inline script So they came up with this directive called script dynamic Which on the one hand is not the simplest things implement But on the other hand it means that it reduces the challenges in a number of ways. So basically I'll just explain how it works You do the nonce and they have documentation explaining how to do it Random site generator let random number generators, etc Inline event handlers is the most challenging thing here Because they need to be refactored and on every page load right generally to do not so they're recommending the the nonce approach Despite the issue with caching. They don't address that but basically what this approach does is it takes everything that I just told you about which was CSPs until like a few months ago and says Okay, we don't all have to try to figure out what we need to whitelist because that's really challenging to keep on top of it It means consistently analyzing your pages And knowing what you've added and adding it to the CSP and doing that properly And then there's the inline script issue. So no more of that. You create this kind of like one policy Called strict dynamic and that applies to everything always It's kind of like a one-step Solution to the CSP craziness And this is like an example of how it looks. So you do the script source nonce and then some random number That will be the non-set-up peers. That's like appended to every script on your site that you're okay with Strict dynamic report sample, whatever unsafe in line The reason unsafe in line is there is for browsers that don't yet support level three of CSP So then it will be implemented and then you go back to having at least a CSP with unsafe in line But it's better than nothing object source none etc. So That's their new like recommendation about how to implement CSPs So there's the challenging part of doing the random number, but on the other hand, like I said, it's instead of Consistently trying to maintain an update You just add a random number to all the scripts that you are okay with and from that point on You're good to go like it's just it's much easier as someone who's been maintaining CSP for for us and others This is much easier Google has a few tools This is like a cool tool that allows you to see what your browser supports So it's the strict dynamic test bed and if when you load it in your browser if you see These squares then it means that it supports that level the strict dynamic Okay, so how do you add it to your site? So there's HTTP headers right so you do it on the server level. That's the ideal way to do it You can actually do it in your functions of PHP file that will work too and you can also do it with a meta tag So the meta tag can be useful if you need to do like per page tweaking It can make it easier But the meta tag doesn't support some directives most of them it doesn't support I can't remember which ones but like the most important ones that supports. Oh here frame ancestors report your eye or stand box You can do an HT access Yeah, but the most recommended way of doing it is as a as an HTTP header that's deployed to the pages on your site Some tools that can make your life easier the console In the browser That is your friend So if you're ever trying to figure out why something's not working or whatever go in there and it will First of all, you can see the content security policy in the console. There's It's under network, right? Yes, and you can see the whole set up there of your site and any other site And and also it will help you debug because it will show you very bright red errors if it's trying to if something's trying to violate the CSP This is another tool for checking your HTTP response headers This is a Google tool What it does is it identifies parts of your application which are not compatible with CSP because that's like the hardest part figuring out what needs extra Loving care and helps make necessary changes before you deploy your CSP The CSP evaluator is a very simple tool from Google. Just plug in a URL and it will say You don't have a CSP or you do have a CSP and if you do it will give you some recommendations This is like the best and easiest to use tool It was created by Scott Helm. I think he's a big security guy Very interesting to read his his work So you just plug in a URL and then you get a report. So this is actually the White House They get a big ol red F So I'm showing that to you just because a ha ha and B You can feel better about your own site because if you have anything better than an F You're doing better than the White House There's some WordPress plugins that will help you manage your CSPs So it will help you Create the meta tags and there's some other tools that are useful in terms of managing them Some of them haven't been updated for so long. So I don't necessarily recommend using it But it's an easy way to get started and maybe just start testing it out This is another one I'll put this online and all of these link to the resources and stuff all these images This is an amazing tool the report to URI so they have like a wizard for creating your CSP And you just you say okay I want this to be self and this to be this asset and this to be that asset and then it gives you something They could just plug in to your site and that's really useful The reason why it's recommended to still have a white list is because of the browser compatibility issues So that way, you know, if it doesn't do the strict dynamic then you've got the white list This is a great tool, but sadly it only runs on Windows It also it will analyze the page and tell you it like give you like an output of all the the assets there that you might want to White list for your CSP in terms of adoption. So this is from February and the top million websites Only 23,000 have content security policy in it. So you can see that adoption is really low I mean there's more by now, but It's it's not growing very quickly, but as front-end client-side threats and threats like the Magikarp become more prevalent People are going to start implementing it more and also with the new approach from the researchers at Google with a strict dynamic I think it will make it something that's also much more possible for people to implement So this is a little example of what happens when a site doesn't have a content security policy I injected something on the front end. I Did not hack their site. It was just on my end, but this is just I Would not be here actually I would have been stopped at the border. They let me through but it's just an example of Like how if you if you don't have a content security policy you can actually inject whatever you want into a site and Let's see if this will have sound. Oh Is that anyways? What happens is I inject the script and it plays the Harlem shake remember Harlem shake and Then it makes the whole web page dance. It's very entertaining. Well, you'll have to trust me on that That's something I can't really do a demo for so but anyways. Yeah, so that's just an example of how a lack of CSP enables you to inject What could potentially be much more malicious? On a site so the White House should implement a CSP. I mean At least on that from that point of view And I think that was my last slide so, yeah CSP is for the win. They're crazy, but they make a difference and They're increasingly important and we're going to see more and more threats on that level Just one thing that I didn't mention is that it's not it doesn't prevent the cross-site scripting what it is It's called defense in depth. It's like another layer So what it is is if your site is breached because cross-site scripting is so difficult to identify and control you've got this extra level and And then it will protect your users and then like protect your brand Protect yourself from being sued for credentials being stolen etc. Etc. So Yeah, I think this is kind of part of the future of where the internet's going and it's very interesting and It's worth keeping eye on it and I hope that was helpful to you And if anyone wants to see the video later, I'm happy to show you the White House through the Harlem Shake. So thank you We've got a couple minutes for questions. So Does the content security policy actually prevent the types of problems that you were talking about with the You know a script a script that's being loaded from a third-party changing without my knowledge Right. Yeah. So If the script is changing in order for them to inject into your site, they would have to know what the nonces And they can't because if it's set up properly, it's randomly generated It should be long enough and complex enough and etc. But You know, it's unguessable. So so it prevents that and if they try to inject anything That's for something that exists and if it doesn't exist yet on your site Then also there's no nonce there that matches the header. So nothing. I can't they can't do anything so the nonce is generated in the head and In the HTML So that's like in my opinion the next thing that has to be tackled because we want to be caching things Right and to have to like generate a new page load on every visit. It's resource-intensive slow, etc It's like that's not where we want to go But I imagine that there's going to be fixes for that because the internet isn't place of caching today You can't you can't work that way, but in the meantime, that's that's how it is. Yeah Any other question? Yeah How important is this for the average, you know users website versus a larger organization that's probably taking data from people? so like everything with regards to security after Do the pros and cons like is it worth it for me to invest the time? How big is the threat? It's possible that on small websites It's not so critical, but as it gets easier to do it's kind of like HTTPS right like how critical is HTTPS for a small website? it's critical and You know, we should be making every effort to protect our users also so Yeah, it's like it's a pain, but it's definitely worth keeping in mind and I do think will become easier to implement because It has to it has to be something that we all can basically implement as easily as possible And that's generally how things go so Yeah, it's like you have to do the cost-benefit analysis for yourself anyone who's doing transactions of any kind or even Capturing user information in some way through form probably should be doing that Thanks, Mary. I'm great talk. I wanted to ask and build on the other person's question who asked about if the script changes without your knowledge Maybe not so concerning if it's like Google Analytics and you probably trust the code They're pushing on to your site, but if you've got third-party scripts from developers that maybe you know They, you know, stop developing the project and or they somehow get into malicious hands Is there anything that content security policies can do to help with that? Or is there anything that you would recommend to be able to know if that's happening? Well, if you've implemented the content security policy and the script gets into malicious hands Then they can't do what they want to do because again comes back to the nonce and not being there And so any changes that they make won't be accepted by the browser. So the functionality will stop working all together But that's better than you know malicious activity. So yeah Hi, good morning. Thank you for your talk My interest is is with Apache or n Gen X. How is that implemented at the server level if you could speak about that a little bit? So that's like You probably need web developers to do that It's different for each one and it's how you would manage your HTTP headers. So it's it's It's on the server level. It's not like something that can be easily explained right here Thank you for the information. So when you're writing your rule set for this I saw you had like seven different Images videos, whatever Do you have to write a new rule for each content that you want to protect or can you combine it all into a single rule? And if you have to write multiple is that resource intensive at all to the users browser? so There's two sides to it. There's the one side which is If you don't if you have a content security policy and let's say it says Self then like a YouTube video won't work So if you want functionality to work on your site, then you have to create a directive for it and That's that's from that point of view of just enabling functionality to even work if you do a content security policy, that's too broad and Allows everything then you might as well not have one, you know I'm not sure if that answers your questions, but like it's like if you have one you need to author whitelist Assets if you want them to work And then the bad stuff won't work because it's not authorized I'm not sure if I'm answering your question. Oh So it depends on your use case like and also how much you want to protect it like let's say object source Which is flash and stuff you should probably just put in None just to you know be safe And it depends how much you care like let's say the fonts you could say only let's say Google fonts If that's what you're loading or you could just leave it and then theoretically it could load a malicious font But you know is that gonna happen? I don't know You don't have to define them all and that default source if you do default source self Then that covers everything more or less in terms of saying anything coming from my domain is okay But then again if you add something that's not from your domain and you want it to work then you're gonna have to Tweak the related the relevant directive for that. Thank you for the talk The plug-in that you mentioned does it have does that add the nonsense that you were talking about no So that doesn't exist yet in an easy way Yeah, unfortunately It's also relatively new and these are kind of old and not so well maintained the plug-ins Isn't that lead there will be a hacker day on Sunday if anyone wants to try adding it in Any other questions Hands-high please Okay, thank you, Mary you pleasure. Thank you


I think it should matter to the United States Navy because it's the law, it's a UN Security Council resolution, but most importantly, because it's important to our national security. There's been plenty of research to show that having more women and diversity of views helps our peace process. It helps consider elements of the war that we need for our lasting peace and security. So I think for that perspective, and really for that we have the force we need for the future, as more issues attracting folks into the military and retaining them, we need to go for everybody. And women are probably about 50 percent or so, but there are 60 percent of the folks getting our college degrees and our graduate degrees. So it is critical that we're getting the best minds to protect our nation and work on our national security. So this is really a difference between when we talk about DEI, diversity, equity, and inclusion, vice, women, peace and security. So when we're talking about having where women can actually be decision makers or have access to decision makers, DEI just looks at the numbers saying, okay, we have enough females in the force, but if they're not actually where they can impact the decision makers or are the decision makers, then there won't be change and if we don't have a good grouping in them, if you just have one or two as your decision makers or with access, there still won't impact change. Studies have shown that it takes about 20 to 30 percent to have really a quorum and make an impact and change. I think it's important that we do implement it in joint professional military education because DOD is directed that we will include the WPS framework in what we do. And if we don't teach our officers and our senior enlisted on how to use it or what it is, a lot of my fellow faculty don't even understand what it really is. So getting that understanding and then implementing the law, JPME is one of the best ways to be able to do that. Why is it hard to implement? I think a lot of things is fear and really a lot of things in the military come down to rice bowls. People see things as a zero sum game and oh, if we're going to let more females in the leadership or if we're going to think that perspective, well, what happens to what I do or what's important or we got to take away books written by males or they see it as a zero sum game and fear of what it means to them, the future, and also we still have a lot in our culture that sees security as a male dominated area. I think you see it in several different areas. So we have the males that are supporting us at home. Males really a lot of things taking care of the house and children still primarily falls on females. So we need males to step up and carry the burden at home. A lot of us who are senior female officers, we have a very strong supportive husband at home or the same gender spouse, but we have somebody there who's supporting us and encouraging us and then in the workplace. So our peers can make sure women come and take a seat at the table often study they'll show women will sit against the wall so they can encourage folks. There's another thing called amplification.  Until a male says it, well a male can say as Captain Higgson said and encourage folks to realize who actually should be attributed to. And just educating themselves and becoming more knowledgeable about the issue.