QuickBooks Online 2023 QuickBooks Payments Overview Get ready to earn the skills needed to boost your bank books on up with QuickBooks Online 2023 Support Accounting Instruction by clicking the link below giving you a free month membership to all of the content on our website broken out by category further broken out by course Each course then organized in a logical reasonable fashion, making it much more easy to find what you need than can be done on a YouTube page. We also include added resources such as Excel practice problems, PDF files and more like QuickBooks backup files when applicable. So once again, click the link below for a free month membership to our website and all the content on it. QuickBooks Online Payments is basically an add on feature within QuickBooks Online adding a banking features integrated within QuickBooks Online, primarily geared at giving customers more payment options while simultaneously integrating and in some cases automating some of the transactions within the sales process. For example, it might have an impact on invoices, sales receipts, receive payment and deposits, possibly also helping us with our tracking of accounts receivable and more easily constructing our financial statements from the financial transactions that being the balance sheet and the income statement. So we're going to start out listing some of the benefits, then we'll go into some of those benefits in more detail. Some of the benefits of QuickBooks Online payments include help accept payments faster, providing payment options on invoices, automates the receive payment process, batches and automates deposit for easy bank reconciliation, possibly provides mobile payment possibilities, can send a payment link instead of an invoice, you can automate reoccurring sales receipts. For example, if you have a subscription model may be able to connect to e-commerce or such as a Shopify or other related types of systems. Let's go into some of these items in more detail now starting with help accept payments faster, providing payment options on invoices. This is probably the first thing that we think of when we think of the QuickBooks payments, which is we would like to be able to send out our invoices and be able to give them options to pay us as easily as possible. Because the more payment options they have, the more likely whatever payment option they are most comfortable with, they will pick and possibly be able to send our invoices or get our payments faster because of those added payment options. Now, obviously there could be fees with different kind of payment options will get into the downside and the fees related to it in a future presentation. But this is one of the major things that we would first come to our mind. Can we send out an invoice and have them basically click on it and have a bunch of payment options so they can pick their preferred payment options so that the turnaround on the invoice is going to be faster. So we get our money sooner and possibly also build confident with the customer because we're allowing them to pay us in whatever way they feel most comfortable doing so. So you got the ACH, which is an automated clearinghouse. This is basically the system used for the electronic funds transfer. So in other words, if they want to pay from a transfer from their bank, they may have that option. They've got the credit cards and I think basically all the major credit cards are there visa mastercard discover American Express. They've got the PayPal option. So some people really like their PayPal and are using it like a checking account. So that could be quite useful to some people same with the Apple pay. Some people are quite comfortable with Apple pay. It's an easy thing for them to do if we can send them an invoice and say pay us through Apple pay or PayPal or credit card. Whatever they're comfortable with and we have multiple options. It's likely that the turnaround on our invoices will be faster and that will make it easier for our accounts receivable tracking and that'll be better for our cash flows. That's one of the first things that come to mind. They also have the Venmo. OK, so next we have the Automate to Receive payment process. So when you actually send out an invoice to a customer now, you oftentimes when you think about accounting in like a textbook situation, we think of like a paper invoice and now we're in the digital area. We think about maybe an emailed invoice or something and then they still send us a payment. However, they're going to send us it, but it would be nice. Of course, if we can send them that automated invoice, possibly in an email with the link, allowing them all the payment options that they can do from that point. So that's basically what we have here because we've integrated our banking system within QuickBooks so it can more easily kind of integrate that within the invoice. So now we can kind of automate the whole the whole process on the email. So when they get the email, they will typically have something that looks something like this where they can pay the invoice. Once they hit the pay the invoice, they can generally select the payment options that they think are that they're most appropriate to them, which which they prefer. And that's the benefit. They have that variety of the payment options and the invoice can be used to just turn around and facilitate the payment much more easily. So batches and automates deposit for easy bank reconciliation. So on the bookkeeping side of things. Now, now we have the fact that we're sending out the invoice with an with an email and we gave them multiple ways to pay us through through the link because we're basically using the banking services within QuickBooks. The QuickBooks payments is basically giving us a banking facility like a checking account. Right. So now we're going to be able to track the information that's that's going from the the invoice that we're going to be tracking, which means we're going to track the accounts receivable, which hopefully we don't have to track as long because they're going to pay us faster. And then when they pay us, we should be able to track that with the QuickBooks payments because we basically have like a checking account integrated within QuickBooks through their QuickBooks payment options, which hopefully allows us to automate the payment processes a little bit faster. So payments automatically generate receive payment form linked to the appropriate invoice. We'll take a look at some examples of this in future presentations, what the normal process looks like and how this automated process may be able to simplify it. But once we receive the payment, usually if I got a check, I would have to manually input the received payment. But if I use this automated process, because QuickBooks is linked to the banking services, they might be able to record that transaction for us. Payments are bashed and recorded into the bank account in a format that makes bank reconciliation easy. Let's take a look at this on a flow chart. Now this is the desktop flow chart. We're talking about QuickBooks online, not the desktop, but the desktop homepage has this nice flow chart. And so let's kind of compare the process if we had QuickBooks payments versus if we did not have QuickBooks payments with the sales part of this flow chart. So when we do work, we typically will then send out an invoice and hope to receive payment on the invoice. Or if we did work at the same point in time, we might create like a sales receipt. That's the form you can think of if you're at like a cash register, for example, at like a restaurant. But let's think about the invoice. We did work. We're invoicing the client. We're sending our invoice, which is a bill to them. And normally we send it out and we've been able to, even if we don't have payments set up in QuickBooks, we can email them the invoice and then they would have to pay us somehow. Either they can send us an electronic transfer some other way, we can give them a way to give us an electronic transfer through PayPal or something like that. Or they send us a check or we have some other payment option that's not linked directly within the invoice with the QuickBooks payments, right? They pay us in some way, shape or form. And when they do, then we're going to record the received payment at that point in time. Now, when we have the received payment, there's an issue here sometimes depending on the different ways that they pay us. So if they pay us with just an electronic transfer, if we have some batching system like a credit card, if they paid us with a credit card, we might be collecting multiple payments from the credit card before the credit card then deposits it into our bank. And so we have this problem of batching because once it hits the bank, I want to be able to reconcile the bank account to what is in our system, the bank statement to what's in our system. And if the batching from here, if I have multiple things that got deposited together at one time, it's going to show up on the bank statement as one lump sum, which creates a reconciliation problem. And that's can be an issue depending on what your sales cycle looks like. So usually we put the money into undeposited funds, you could put it or into a clearing account payments to deposit, and then you group the deposits when you make the deposit in the same format that you expect to see them on the bank statement. Now, if you have the integration of QuickBooks payments, that process could be easier, right? Because now you send out the invoice and then when they pay us, QuickBooks may then just record the receive payment on its own, not only that, but because we're using the QuickBooks bank account, if they're batching the deposits and they're going to put the deposits in our system as a lump sum of some kind, they will properly batch out the deposits and deposit them properly so that we have deposits that will match the amounts that are on the bank statement. So that could be a huge deal, depending on the kind of complexity that you have in your receivable cycle. So we'll go into some examples of that in more detail, but that can be quite nice from the bookkeeping side, so we might dive into that in future presentation. You have the mobile payments. So obviously it's great to be able to get paid as easily as possible. So you might have these mobile payment tools that you can use in the phone or with this other card swiper. If you have a more sophisticated type of system, you can have the card swiper and that allows you to get paid. Faster possibly, send a payment link. So this is going to be an option we saw about we saw an option or an example where we send out an invoice. Maybe you don't want to send out an invoice. Maybe you just because you don't want to track the accounts receivable. Do you expect them to pay you immediately very quickly? Then instead of sending out the invoice, you might just say, I'll just send you a link, a payment link, which you might be familiar with. Like if you were to send out a payment link from some other platform or something like a PayPal or something and you're trying to get them to just pay you really quickly with a payment link. So you can send out the payment link and instead of a full invoice. So you can make a link for payment and that'll be like a URL. They will automatically expire after customer pays you. So the URL will be for a limited amount of time and will expire after they pay you. So it's so it's just a one time type of link down and dirty quick link. If you expect them to pay you soon, that's usually when it's going to be useful. If you're giving them a long period of time to pay you, then you're going to want to give them just a normal invoice. So to give customers more time to pay the full invoice with online payment options would be best can send the link with email or possibly text the link. So a cool thing about the link is that once you have the link, you could send them an email with the link on it. But maybe everybody's on their phone. So you might be able to text a link more easily than you would be able to text like an invoice. So that might be an easier way to facilitate the payment. There's a down and dirty link. You just want to text and pay. We'll just send you a text to the link if that's what you want. So can you can also make or code to scan. I'm sorry, a QR code so you can make the link into a QR code. If you're quite high tech or you're dealing with someone that's quite high tech that wants to scan. And pay the link with their phone customer will go to a landing page where they can pay you. So obviously what happens with the link. If you're familiar with any of these payment kind of options, oftentimes you if they click on the link, they're going to have to go to a secure landing page in essence where they will be provided the payment options, which is one of the big benefits of the QuickBooks online payments. As we said, giving and providing those different payment options. The paid payment link will create a sales receipt. So you might be thinking, what is this going to do in QuickBooks if I don't make an invoice? Well, the link is basically means you're going to get paid at that point in time. And therefore instead of having an invoice, you're just going to enter the sales receipt, the form typically used when you enter something like at a cash register situation as opposed to when you do the work first and then bill the client. We might take a look at examples of these and future presentations. So next we have the automating recurring sales receipts. So you might have a situation where you have like a subscription model, for example, and you're saying we're just going to bill these people every month. Well, in order to do that, you could make an you could try to schedule invoices to send out each month and try to do that. But if you can get the agreement from the client for them to just simply pay you so you don't have to go through the invoicing and the accounts receivable process, you can just set up an automatic payment. That would be great. So you might be able to automate a model for the automatic payments, which would be a great system for a subscription based system. So you don't have to go through the billing process every month. So maybe able to connect to e-commerce like Shopify. Now, this probably isn't the first thing that that should kind of come to mind. You would think when you're thinking about the QuickBooks payments. But when you think about an e-commerce store and you're selling like inventory on us on another place at a store, then typically what happens is you're going to have to have some kind of payment processor to get then the information into the QuickBooks. So if you have Shopify, you might have Shopify payments that can help to facilitate different payment options like a credit card or a PayPal or whatever the payment options or you might have a different one like a PayPal, which is another integrated option, providing more options to the customers to be able to pay you. So you may be able to integrate something like the QuickBooks payments in order to help that process out as well. But usually with these e-commerce stores, it's not really it's not really the payments isn't the main thing that often kind of solves a lot of the problems. It's going to be it's going to be with trying to track the inventory that becomes an issue as well as trying to pull in the sales data from the Shopify store. So QuickBooks has other integrations actually within QuickBooks that you can do that to try to integrate your e-commerce store like a Shopify or an Amazon or an eBay and then you can pull in basically the sales data. When you're looking at the payment processor portals, then oftentimes your main goal might be just simply to have the least cost, you know, for the for a portal that provides basically the most the most options at the same time. So so you might want to do if you're thinking about integrated it into an e-commerce, you might want to make sure you do some comparing with that and try to make sure you're you're looking at what are the problems that you're trying to solve with the e-commerce and what are the costs of the different tools within the e-commerce. We have a whole nother course or section on e-commerce if you want to dive into that more so you could take a look at that. So then let's look at some of the downsides, of course, with the add on feature is the fees. Now, now this is the fee structure currently on the QuickBooks website. Things could, of course, change as time passes. You might talk to a pro advisor and get basically a different or or better fees possibly. But the general idea, of course, is that you are providing the ease of payment to the customer, but there's typically going to be a cost with the different kinds of payment options that they that they might be selecting. So notice in practice, then you might be saying it depends on the kind of business as to how you're going to try to be facilitating payments from customers. If you have a lot of repeat customers, then you might try to do your best to come up with a system where they pay you in a way where the fees are lowest so that you you're benefiting best between your transactions and the third party isn't benefiting. In other words, if I do a lot of business with a particular customer, then I might say, hey, look, it would be easier for me. I'm not going to get hit with charges if you pay me with if we have the same bank, maybe an electronic transfer would would have a lesser of a fee than some other kind of ways. Or maybe if they use PayPal and you use PayPal or something, it might maybe you have lesser fees or possibly even a check would be lesser would be lesser fees in some cases possibly. However, if you're dealing with new clients and or you have a lot of different clients where you don't have a lot of repeat transactions, but you have a lot of one off transactions, and your goal is is to try to try to influence or get your sales pitch in front of as many clients as possible. Then what you want is to facilitate the ease of the sale or the turnaround, the completion of the transaction as easy as possible. And that often is the case where you have, like I say, a lot of sales to a lot of customers where you don't have a lot of repeat business possibly or you're not working exclusively with them. You're not doing custom jobs with them. You're providing them this just goods and you're trying to build confidence without as much personal interaction with them. And those cases, oftentimes it might be worth it to give them as many payment options as possible and have as high tech and and professional a feel as you can, right? So in those cases, you want to send out the invoice and say, Hey, look, I'm going to give you any payment option that you want that you feel most comfortable with. And you're going to, of course, have possibly fees related to those. So there's different fees, depending on the kind of payment they choose. So you got the ACH bank payments one percent here, invoices, invoiced the card reader and then the keyed when you actually kind of punch in the information in one way shape or form. So again, if you're diving into the fee structure, you might want to, you can, you can research it at any given point in time so that you get the current fees. And you might want to talk to like a QuickBooks pro advisor to see if they have any discounts possibly on on the fees as well. Also notice the fees are basically structured here mainly when you're facilitating the transaction. So they're taking a piece when the transaction is being facilitated. So you might have, you might be thinking, do you have options then to be able to for certain clients, possibly try to try to set up certain payment options, which have less fees if you do a lot of repeat business with them and you have built trust with them and so on. And for other clients where situation might be worthwhile to incur whatever fee depending on on the whatever payment option is being chosen. Okay, so apps to facilitate accepting payments. So you could have apps that can help to kind of integrate with this. The two main apps that we might look at in a little bit more detail in future presentations are the QuickBooks online app and the GoPayment app. So first, let's take a look at the QuickBooks online app. This is basically just your QBO app. So QuickBooks online is a cloud based software. Now I typically do my work on my desktop on it, but because it's cloud based, they have the cloud based app and you can do your work on your phone. So this is basically QuickBooks modified to work well on basically a mobile phone. Therefore has all the functionality for the most part of just normal QuickBooks. It's not there, in other words, just to facilitate the receipt of payment. It's got everything you need. So this is the app that you might have if you're the owner of QuickBooks or administrator of QuickBooks. And in that case, you might be able to receive customer payments where you usually need to enter the customer name and options for transactions to add classes or custom fields. In other words, when you make a sales transaction, you might be using classes, which is an add on type of feature to better classify your income statement or custom fields. And you have more functionality to do that with the full QuickBooks online application than with the GoPayment app. So the GoPayment app is basically just for the payments now. So now you've got an app designed just to help facilitate getting the money, you know, from the customer, which might be good for the owner, but also might be good for an employee or someone, a salesperson or something like that, where you don't want to give them your full QuickBooks online app. You want them to just be able to collect payments that are going to go into our QuickBooks account, right? So basically use just for customer payments. So you got the sales receipt and payment. You may not even need a customer name, so you might be able to enter a pretty basic format in order to receive payment to get paid. Just enter the product or service or a dollar amount may be used by a sales agent who is not the owner or bookkeeper. So so that might be a system that is set up for like employee type of situation where you'd have to set them up in your in your QuickBooks system, set up the go pay and then you can give them connectivity possibly so that they can collect payments, of course, which would be great.


Yeah, so I'm Ali Al-Jani, I'm from Nordic, is it recording? I know, yeah, okay, yeah, so, I'm Ali Al-Jani and I'm from Nordic Sync Conductor and we have here the audio and Ali demo. So it's basically showcasing the AutoCast feature that was introduced this month by Deepic Tech and you will be able with this feature to listen to multiple broadcasts from different streams and you can see here we have the headset connected to a receiver and two different broadcasts so this one here is basically connected to the microphone if I speak you can hear it here it's going to be different to you guys to hear it and then I have music playing on this computer and if I just press one thing here it will switch to the other stream and what's nice about this feature like once it's going to be implemented in actual products and hopefully very near future you would be able to tune, let's say you are an agent you'd be able to tune to that TV or that TV from your phone so it will make our user experience with audio very, very smooth. How is that possible? It's with the AutoCast feature so this AutoCast feature will enable broadcasting audio so AutoCast, AutoCast, what is actually going to happen? What do you have to do to pair and everything? It's going to be basically implemented in your phone so your phone, once they have the chip that's supported and once you have the operating system supported you can basically either scan for devices like scan for broadcasting devices so let's say you are in the gym and you see three different TVs it will list you that TV1, TV2 and TV3 and then you'll be able to just listen to that channel so you have different broadcasters and through your phone you can choose which one or you can also do it through NFC so you can simply tap your phone to the TV and you will be pairing to that broadcasting channel we have now support for it on our NRF5340 SoC that's a dual-core SoC and it's now broadcasting to... this one is actually the receiver but this is one of the broadcasters Nice, cool, and what's the partnership what are you doing with Zephyr, all this running with Zephyr? Yeah, so Zephyr is the core component of our SDK the NRF Connect SDK and it's a very rich ecosystem that provides developers with all the components needed to build products in a very short time and we are a member of the Zephyr project and we highly value Zephyr as a very rich ecosystem Is there Nordic chipset in the mouse? I can't comment on that but everything here, like this is the 901 it's the thingy 901 and this thing is actually running Cellular IoT so this one actually has internet connectivity and every time I shake it it actually sends data to the cloud and you can see here like this is the location of this thing and it shows you the humidity and the temperature and also gives you the location of where this thing is and it's not actually using GPS though we have GPS support here but GPS for low power application is a bit critical because it consumes energy you can still use it so we provide a service called single cell and multi cell where we get you the location from the tower so we know which tower this thing is connected to and then we provide you that your location is going to be in this proximity the multi cell, what we do in the multi cell we actually triangulate the location so we rely on multiple cells to find the location of that thing and of course you can still always use the GPS but you need to plan that ahead and expect for the power consumption that's required for it cool, awesome good stuff, no worries


Russian spy activity in U.S. and Europe higher than in Cold War. Russia has stepped up its intelligence work in the West and is innovating its spy craft. The Financial Times reported, citing interviews with analysts and intelligence officials. Last week's leak of a recording in which German Air Force officers discussed potential ways of helping Ukraine use Taurus missiles to target Russia's Crimean Bridge, while maintaining plausible deniability of involvement was Moscow's most explosive propaganda coup so far this year, the outlet said. But it was only one example of Russia's reinvigorated competence in the world of spying according to its sources. Russian activities are as high or even higher than during the Cold War, one of them said. Another described Russian intelligence as a huge machine, adding that it was back doing what it always did. Most of the interviews were conducted before the German leak. In 2022, Western nations tried to undermine Moscow's intelligence networks by expelling hundreds of diplomats on suspicions that they may be working covertly for intelligence services. In hindsight, this move may have made counterintelligence more difficult, one of the agents said. You would invite them round to the house, have drinks, introduce the family, make them realize you are a human being, cultivate trust. It was basic, the source said, explaining how having the Russians around had its benefits. Moscow has ramped up the use of illegals, agents without diplomatic cover, as well as proxy agents such as foreign nationals drawn from politics, business and organized crime, the article claims. There are also concerns in the West that critics of the Russian government, who have fled to other nations amid the Ukraine conflict, could be pressured by Moscow into cooperation. Some of the complaints were about neutral European nations, such as Austria and Switzerland, as well as Russia-friendly Serbia, allegedly serving as bases of operation for Russian officers. One source claimed that nearly a third of Russian operations on the continent are run from the safe hubs of Vienna and Geneva. Turkey and the UAE are likewise used as staging posts for Moscow's operatives, the newspaper was told. The Russians are such cruises, an intelligence source said. But the official conceded, they can also do some very sophisticated operations that, in intelligence terms, are stupendously cool. If Ukraine loses, NATO will fight Russia, Pentagon chief. Pentagon chief Lloyd Austin believes that if Ukraine loses the full-scale war with Russia, the latter will be forced to fight the entire North Atlantic Alliance. Austin said this at the US House Armed Services Committee hearing. Although the hearing focused primarily on Austin's hospitalization at the beginning of the year, about which he did not notify either the White House or Congress in advance, the congressman also asked several questions about how much US military assistance Ukraine requires. The defense secretary emphasised that the approval of additional funding for Kyiv is important to prevent a situation in the world where one country can redraw its neighbour's boundaries and illegitimately take over its sovereign territory. We know that if Putin is successful here, he will not stop. He will continue to take more aggressive actions in the region, and other leaders around the world, other autocrats around the world will look at this and will be encouraged by the fact that this happened and we failed to support a democracy, he added. Later, Austin clarified that if Ukraine loses on the battlefield, the Baltic countries may be threatened. If you are a Baltic state, you are really worried about whether you are next. They know Putin. They know what he is capable of. And frankly, if Ukraine falls, I really believe that NATO will be in a fight with Russia. The official said. Russian MFA spokeswoman Maria Zakharova commented on Austin's statement. Is this a direct threat to Russia or an attempt to come up with an excuse for Zelensky? Both are insane. Ukrainian guerrillas spot ships in Novorossiysk used by Russia to shell Ukraine. Ukrainian guerrillas have spotted Russian ships in Novorossiysk, from which the occupiers are shelling Ukraine. In particular, they took part in the attack on February the 7th, according to the Ateş guerrilla movement. Agents of our movement report the deployment of several missile ships in the port of Novorossiysk, the statement reads. In particular, the following were spotted. A small missile corvette of project 228-800 Karakurt, a small missile ship of project 21631 Buyan-M. According to the guerrillas, it was from these vessels that caliber missiles were launched during the shelling of Ukraine on February the 7th. The ships are part of the 41st Brigade of Missile Boats of the Russian Black Sea Fleet. They were redeployed from Sevastopol to Novorossiysk after successful attacks by the Ukrainian Defence Forces. However, they continue to be involved in criminal attacks on peaceful cities Ateş states. Russia launched a massive attack on Ukraine on February the 7th, using kamikaze drones and missiles. Kyiv, where four people were killed and dozens wounded. Kyiv region, Karkiv, where non-residential infrastructure was damaged. Mykolaev, where one person was killed. Novorossiysk, Nipropetrovsk region, and Drohobych, Lviv region, were hit. In total, Russia fired 64 missiles and drones at Ukraine. The Ukrainian Air Defence Forces shot down 44 targets, 26kh-101-kh-555-kh-555 cruise missiles, three caliber cruise missiles, and 15 shaheads.


From the Bellagio Hotel in Las Vegas, it's theCUBE covering UiPath. Forward 4, brought to you by UiPath. Hey, welcome back to Las Vegas, Lisa Martin with Dave Vellante. theCUBE is here live at UiPath Forward 4. Very excited to be here in person. Next topic, the smart factory. Couple of guests here to unpack that for us. Jason Bergstrom joins us, the smart factory lead at Deloitte and Thomas Hansen, the CRO of UiPath. Gentlemen, welcome to the program. Thank you. Thank you for having us. Great to have you, great to be in person. Let's talk about smart factory. Factory 4.0, what is it from Deloitte's perspective and then UiPaths? So if you think about smart factory, it's really that transition from the old kind of analog manufacturing environment to the digital operating type environment that we see today. So technology has really changed in the last three or four years. And as a result of that elevation of technology, we're able to do a lot more on the manufacturing floor than we ever could. So what used to be more analog or hybrid with a little bit of technology is now starting to shift really to end-to-end integrated manufacturing operations that are based on digital platforms and we're loving it. It's a great place to be. Great. Thomas, what's your perspective? Well, first of all, it's great to be here. Thank you for the invite. It's so nice to be away from Zoom calls or other type of calls, right? Yes. And be in person. We have an amazing partnership with Deloitte. We have worked together for years. We've done more than 400 joint engagements with large companies across the world. And in that process, we've really gone deeper from a vertical and industry perspective. And smart factory is really the starting point of going super specific in figuring out what is automation or how does automation rather play into a smart factory like a beautiful trombone, that music from a beautiful trombone? So years ago, we wrote a piece talking about the cloud as an opportunity and how to take advantage of it. And one of the premise of the piece was you got to build ecosystems. And maybe it's within an industry or within a practice and build data and different disciplines because the power of many versus the capabilities of one. This smart factory initiative that you guys have going, it feels like an ecosystem play. Can you describe that ecosystem? Who's involved? I know SAP in for AWS, but tell us more about the ecosystem. Yeah, sure. So your hunch there is a great one, right? We learned early on that trying to do this as Deloitte or Deloitte plus one, just wasn't going to get it done, right? You really needed to harness the power of the many. And so at the core of what we're doing at the smart factory at Wichita that you alluded to is about bringing an ecosystem to life. So we have 21 partners that are going to be participating out of the gate with the smart factory at Wichita. And the intent is to show a seamless solution, an actual end-to-end production facility that showcases 21 amazing technologies and partners. And we're just really thrilled about what we're able to show our clients. So Wichita. So Koch Industries owns Infor. So obviously that's the Wichita connection. Is that right? That is. So they got to be involved in this. I mean, they're amazing company, but what can you tell us about their involvement? So Koch, obviously the Infor connection, Dregos, which is another Infor company as a founder within the ecosystem, which is fantastic. They play at the core. They're also an incredibly important client, right? So the Koch business on the whole is critical to how we think about manufacturing across a whole range of industries from discreet production to scaled process. They're fantastic partners and we've had a great time working with them. And you guys are just about to launch through soft launch. Can you tell us more where you are in the progression? Sure. So soft launch started two days ago. Oh wow. So the building, we have the keys. We are doing some visits with a handful of friends and family, the ecosystem partners that you mentioned. They'll be coming out to see it and to provide some feedback. And then we go live in earnest in January. And Thomas, where's UiPath fit? Well, we fit in as a key partner in this initiative. Look, we as a company, we are partner preferred partner first. We do all our business together with partners. We have run about almost 5,000 partners now globally. And then there's a few. Then there's a few in that 5,000 that are unique that really stand out. And Deloitte, of course, is one of those very, very special partners that we work with globally but also locally here in the U.S. across all the states, across all the industries. So we're thrilled to be part of this. Automation plays a key, key part of smart factory. When you think about it, the evolution of work, there's so much boring mundane work out there. Humankind is better served spending that time and effort on the non-mundane, on the innovative, on the creative. And that's what we're trying to ensure that the humans in the loop, so to speak, are focused on the innovative work, the creative work. And we have software robots, RPA automation, handle all that boring and mundane work. Right, letting the folks focus on the value add to themselves, the value add to the organization. That's right. More strategic investments. Thomas, question for you is, in terms of, you talked about this being horizontal across industries, but I'm curious about what some of the feedback is from some of your customers, 8,000 customers now. You've got a very large, what, 726 million ARR, huge. A lot of customers, over 100 million ARR. What's been the feedback from some of those guys and gals? Well, so, first of all, personally, I've been in enterprise software for more than 20 years. And what I've experienced over the years most large-scale enterprise software projects tends to be multi-year in nature, be rather complex, and the failure rate can be rather high. Then in comes RPA and automation, which is a complete different kettle of fish, in the sense that from conceptualization of identifying a process to getting it built, getting it tested, getting it into production, you're talking days and weeks only. So the path to seeing value is so fast. What I've learned yesterday and today from the 15, 16 customer meetings I've had so far is the same unique trend or learning across all industries and also from various parts of the world, and that is very fast realization of value, perhaps starting initially with five, 10, 20 processes, and then scaling super fast because they find that return on investment incredibly quickly with our solution. So that's what unifies it across geographies and across industries. When you think about the smart factory, and one of the things we've learned during COVID is there's so much unknown. So sometimes these processes aren't linear, like a trombone going back and forth in and out, but is there unknown in the smart factory processes or is it pretty well known and you can do the process mining on that known base? What's the dynamic there? So there's a few different dimensions to it. So yes, it is well known because it's a controlled environment, but one of the things that we're doing is we're actually actually introducing a lot of unknown factors to try to let the bots and the process mining kick into effect, right? So we're artificially, let's just say, injecting opportunity for us to do that. The other thing that we're doing is, and what's really unique about the smart factory at Wichita is it's one of four across the globe for Deloitte. And so we're bringing data in from the other three sites, which is data that'll be less controlled. We're going to do process mining on that to try to take advantage of some of the capabilities associated with the solutions. Okay, so when you think about process mining, do you start there or do you start, I sometimes call it paving the cow path? Taking what you've known, that linear process that hits that as the quick win and then worry about the process mining? Or do you step back and say, wait a minute, we have to rethink the entire factory experience. Where do you start? Well, I think it depends in the case of the smart factory. We've got a few different places. We're using it to do ingestion of orders. So that's obviously a very controlled environment. We're then using it to do a lot of work around inventory management and optimization as well as month-end close plays, which will be a lot more, we're learning as we go, right, so I think on the spectrum, it could be on either end. My personal belief, if you look at it more long-term or actually out in the real world, is that this is all about learning new things. It's about generating insights from data that frankly, you don't want human beings to have to go do that, and so having the ability to take advantage of an intelligent automation solution as powerful as UiPath is really a great advantage. One of the things that's misunderstood, I think, about UiPath is they look at what happened post, let's say 2015, 2016, and say, oh, just like every other Silicon Valley company, double, double, triple, triple, and that's not how you guys started. You sort of let things bake for the better part of a decade, and then got product market fit, and then exploded, and so that, to me, was a key to your success in scaling. This, I feel like you guys are building a new offering here. This is not just doing a one-off. The product market fit, it's not like a point product. It's a big thing. Can you talk about the go-to-market, your product market fit, you're testing it out now, your goals, you're trying to scale this up? What are some of the things that you can share about your aspirations? So the partnership from a UiPath perspective to Deloitte is a critical partnership, one of the select few on a global level. We have enjoyed tremendous amount of engagements together. I mentioned earlier on 400, and I believe we now have together around about 1,000 developers trained within your organization on UiPath, right? That's right, yeah. So we have a strong base that, of course, we want to build for, and hopefully put a sera behind the 1,000 to 10,000 over time. We want to make sure that it's globally inclusive, that we can serve all the marketers across the world where we have joint presence. And there's a select number of verticals and industries where we really have had success together, that we, of course, want to go and specifically zoom in on. One would, of course, now be manufacturing together, and, of course, a classic vertical. We've been very strong in together is BFSI, Banking, Financial Services, Industry. So those are good areas to go into. Jason, you're building a business out of this, right? I mean, you've got a business plan around it, and you're going to scale this thing. Oh, absolutely. Yeah, that's 100% the case. So we have Smart Factory at Wichita. That is part of our positioning in the marketplace. What we found is that telling people about tech and about solutions is one thing. Showing it to them in a production environment is altogether different, right? Giving clients the opportunity to explore the art of the possible in a real setting like that is incredibly impactful. And so you talked about go-to-market. We see this relationship with the ecosystem and what we're trying to do in Wichita. That's sort of the epicenter of building an entire business which ultimately will have huge global potential. We talk about speed for a minute, and the growth trajectory that UI Path Thomas has been on for the last five years or so. I think I was reading, I think it was analysis that Dave wrote that in 2016, revenue was a million, 2015, 2020, 600 million. So massive growth very quickly. My question, Jason, is for you, in terms of the speed, how quickly are you looking to see the Smart Factory 4.0 really impacting organizations around the globe? Because these guys are on a fast bullet train. Yeah, so I wish we had those growth rates. I will say though, selling and delivering these solutions holistically to manufacturers takes more time. So we think of our cycle as being measured certainly in many months, certainly not years. We are starting to see an acceleration of that entire sale cycle and delivery cycle just because of things like the pandemic driving organizations to just need to move faster. Frankly, if you're not moving towards digital manufacturing operations right now, you're probably behind. And so we're seeing that urgency from the market start to pick up. But we don't have that kind of growth rate, unfortunately. Well, what's interesting about Deloitte to me is you guys are, I think of you as a virtual company. I mean, I know you got a lot of bodies out there, but it's not like you got a lot of physical locations, right? And so now you're investing in a physical plant, essentially. Which is extremely exciting. We keep telling ourselves when we talk to folks, they own lots of buildings. So just because we're excited about our building doesn't mean they are. But you're exactly right, right? We're obviously a global services and products company. So this is one of a handful of buildings that are going to start to represent us as an organization and we're really excited about it. What should we watch as kind of milestones for progress, success, what are the markers that we should be paying attention to as independents? I think specifically on this rapid experiment together. I think one of the key learnings we can take away that we can apply to other companies in the manufacturing industry specifically. Look, from a UI perspective, we work with many large-scale manufacturers around the world, but we've seen amazing fast progress. With Bridgestone, for example, we implemented a smaller set of bots that helped them reduce their paperwork by 85% out to their branches. With a Turkish e-commerce retailer called Archelik, I think I get the pronunciation correctly, they put 85 processes in place with our bots and are now to date transacting or running, I think it's three million e-commerce transactions with our processes. So the impact we can have in manufacturing together with the learnings from the smart factory, I think it's just so exciting, really. Yeah, the impact, the potential there is unlimited. Guys, thank you for joining Dave and me, talking to us about Smart Factory 4.0, what it means for both businesses, how the partnership is evolving. It sounds like music from a beautiful trombone. Thank you so much for joining Dave and me today. Thank you. Thank you for having us. For Dave Vellante, I'm Lisa Martin. The queue is live in Las Vegas at the Bellagio at UiPath Forward 4, we'll be right back.


To the left of the home screen, you'll see the available folders. To select a folder on the home screen, use the left and right arrows. Your options are emergency, non-emergency and admin folders. When you receive a new message, the message folder will begin to flash and the pager alerts. Press any key to stop the alert. To view the message, press the green button to go to the new messages. You can navigate through your messages using the up and down arrows. As you can see, the circle denotes the current message selection. The ticked messages are the ones that you have read, and the messages with the exclamation mark are the messages that you haven't read. Press the red button twice to go to the home screen from any message screen. To lock a message protecting it from deletion, you press the red button, and then you use the arrow keys to select the lock icon. In order to delete a message, you must first select it, then press the red button and use the left and right navigational buttons to select delete. To read a message, you must press the green button. It will appear as red once you have opened the message.


Thanks very much for joining us Mr. Franco, you know let's begin with what the RBI has said it has asked the banks to keep a bigger buffer in case where it is giving loans, unsecured loans in particular to personal borrowers. Why do you think this is being done? Is it to slow down the credit off take? Is it in order to be able to manage the liabilities that are there so far? What could be the reason? I am glad that RBI has opened up but this indication has been there for quite some time. The loans which are increasing is the personal loans to some extent MSME loans and large credits are given to the non-banking financial companies. So now RBI has said that you should keep a better buffer for the personal loans and also for the non-banking financial company loans. There was a time non-banking financial companies were not given finance with a principle that the banks should not lend for on lending to somebody else. They should lend it directly but now that has been given up and almost one third of the loans in the market is given by the banks to the non-banking financial companies at a cheaper rate and they are giving it at a very high rate that is 6 percent 40 percent and that is affecting the people as a whole and these are the loans which are not likely to come back also. Why do you say that they are not likely to come back? See the economy is not doing well though some of the claims show that we are doing very well and all. In fact just today we have the Q2 GDP data which paints a rather positive picture on many fronts. Yes that is because sometime back they have changed the criteria of collecting the data and certain data they don't allow to be collected like the national sample survey data they have not disclosed it when it was done last time because it was not satisfactory for them. You mean the consumption data? Yes yes. So now the first of all loans if you look at the figures that is alarming. The just an analysis within four years which Mr. Subhash Chandra Garkh former economic affairs secretary who was also a finance secretary has written an article which shows that in four years it has increased from 23 lakh crores to 48 lakh crores just in four years more than doubled. This is your outstanding personal loans? Yes. Right. And out of this what is more dangerous is the unsecured loans for which there is no collateral there is nothing to fall back for the bank that has increased from 7.4 crores to 16 lakh crores. Right just over 16 lakh crores yes. This can go bad as I said the economy is not doing well the non-banking financial companies they give without any proper assessment and when the people are not able to earn money to repay they will default same thing will happen with the personal loans and the huge interest rate adds to the burden. Right. And the tendency to default increases. Right. So this is the danger one of the dangers which are. Now these unsecured personal loans the RBI has actually exempted a lot of loans your home loan your car loan your loan taken against gold or gold jewelry all of this will not be under the higher buffer rate it is only for the loans which have absolutely no collateral. Yes. Which means somebody needs. Which is called the unsecured loans. Would something like a government scheme like mudra also be under a higher level of scrutiny now after this. Already there has been a scrutiny recently the finance minister herself had a meeting with the managing directors and chairmen of the bank to have a look at the in the presence of RBI to have a look at the MSME loans together. Right. And mudra loans in particular because the number of mudra loans which the banks have given at the last seven years it is of disproportionate scale. I think you have some figures for that. Yes. 44 lakh sorry 44 crore beneficiaries accounts 44 crore customers have been given a loan the loan outstanding is 24 lakh crores which is very huge in the last seven years. Now if we compare the number of loans with the number of households as per the 2011 census data after that no census has been done the number of households in the country is 24 crores. Right. So if we have given 44 crore loans so almost every household two people would have got the loan. Almost that is right. Where is that loan? How are we seeing so many enterprises flourishing in the country? Well because the enterprise survey is the industry survey is another survey I think which has not been conducted. Yes. So we don't really know. Yes they keep looking at the figures of that Udyog portal there is compulsorily everybody has to register if they start a small enterprise and that is taken as a data but that enterprise may not be surviving. We have seen that in the case of mudra loans quite a number of borrowers they are not able to run that business and it closes down very quickly. The loan amount is also small 50,000. That's right. 5 lakhs maximum is 10 lakhs. So somebody who is taking a 50,000 rupee loan one can safely assume that this is a home based enterprise right and so unless the government does a census or a survey will not really know how many of them survived or did well or did not manage to you know do what they took the loan for. Yes, urgently there is a need for a survey to find out the reality. How many of these enterprises are surviving if they have not survived why they have not survived then only you can bring a solution as to why they needed the loan. Yes. So now tell me why are personal why is the RBI so keen to control the you know the giving out of personal loans is it that the banks have been careless or is it that it feels that there is a larger risk to the economy what could be the. It is because there is a larger risk to the economy. Banks have not been careless banks have sufficient deposits so they have to give loan and it is the same RBI which has been compelling banks to give loans to the non-banking financial companies. Right. They have not put any restriction on personal loan earlier. Right. Whereas there are some banks which still have a criteria that unless your salary is credited to your account in that particular bank branch they are not entitled for a personal loan that is a secured loan. Salaries attached to that. Right. But what I called the unsecured loans there is no such kind of a tie-up with the bank.  Yes now the app based loans are also given you do not have to go to even the bank the public sector banks private sector banks have also introduced that scheme. You know Mr. Franco why I am asking you questions related to this again and again is because there are two ways of looking at it one is that you know there is this huge unleashing of entrepreneurial spirit and the other is that well people do not have enough money to manage their day to day expenses whether for the enterprise or even for the home and that is why they are taking the loan. How do we clearly assess what is going on in the absence of consumption data in the absence of industrial survey. So is it really are we shooting in the dark are we forced to shoot in the dark. We are shooting in the dark because we have not created an atmosphere for the enterprises to grow. If the enterprises have to flourish you have to create an atmosphere you have to help them in marketing I will just compare it with Israel. I had been there for a training and when I questioned an resource person who was sharing the enterprises the startups which are increasing in Israel it is known as the startup nation. So I said that see I am a banker I am very worried when I have to give a loan to a new enterprise. So here how do you get the money. She said that there is no need for the bank to give loan. If you have a good proposal the government gives the money for starting up enterprise then subsequently you have established it and you want to grow it gives loan at 2 percent. Once it is established well and survived in the market bank goes to the person says that you expand we will give you loan. But here we don't have that we do have some money as seed money which is very meager most of the people do not have access to that so the enterprises are not able to survive. Is this something like the ECLGS scheme where the government during the COVID lockdown actually gave you know asked people to take these loans and and you know what has been the repayment pattern over there because the government there actually built into the scheme the whole idea that about 2.5 lakh crore would be written off it's as a first off you know sort of write off was is this comparable with what you saw in Israel. No this was a short term master when the economy was in crisis COVID you know that the enterprises could not run that time it was given as a short time credit and that too the MSME representatives they keep accusing the government that you allowed this finance to go to enterprises which were already doing well you were not giving this to the real people who were really into a crisis so account which is standard and doing the doing well they were given that assistance that was a temporary assistance in the Israel's instance what I'm saying is to encourage new enterprises to flourish the government takes the risk China they ask the development banks to fund these enterprises new enterprises let it come back universally there is a study which says that across the world new enterprises only 10 to 15 percent they survive right so the rest how you have to take care the Chinese banks are given funds that okay even if 15 percent survive it creates employment that is good for the economy the rest which is not surviving we will take care we'll write down okay so let's move from the personal loan and the MSME loan segment to the so so one of the things that is mentioned in the article by Subhash Chandigarh the former finance secretary is that you know the loans to the large enterprises as well as to the infrastructure sector those are actually not as big a share of the loans that the banks are providing what is happening there see number one there was lot of loans given to the infrastructure with the banks there was a credit mismatch in the sense the deficits which you are taking is for a short term maximum is five years whereas the long-term credit it is nine years ten years twelve years so there is a mismatch and this large enterprises road construction road energy electricity refinement was not coming right so the banks have reduced lending to them they have become little more careful cautious because you know about the RBI recommending 12 big loans to the national company law tribunal it had the ocean steel, ocean power, SR steel, SR power, Anil Ambani's one group so like that huge credit was given for infrastructure telecom too and that was not coming so the banks have become little careful but in spite of that banks have given quite a lot of large credit in fact 2017 RBI issued a circular it gave a notification that by 2000 no corporate should be given loan more than 10,000 crores okay they clearly explain that the NPA is increasing if you are doing well you can go to the market bond market security market share market there you raise your funds right banks should not lend more than 10,000 crores as a consortium to one corporate but that has not been implemented so because of that maybe today's the outstanding of instance Adani's group will be more than 2 lakh crores such kind of big credits are given once they go bad they affect the economy we can't predict that these enterprises will always do well that dangers can suddenly come we have seen in the 2008 crisis 2000 Asian financial crisis that nobody was predicting that something is going to happen but suddenly collapse comes so that way in my understanding the large credit the infrastructure credit should be given by the development financial institutions this government has killed not only this government even before that they started killing them they converted them into commercial banks so all the commercial banks have been forced to give long-term loans so this large credit can always lead to a crisis if even one industry goes well basically because the total number of large borrowers is small but the total figure of the loans they have is very very large yes so even one or two enterprises falling back on their payments means that the it can send a ripple through the backing RV data shows that 15,340 borrowers have been given loans above 100 crores which the credit is 7 lakh crores and the outstanding is 4.5 lakh crores which is huge so even if one enterprise with an outstanding credit of 1000 crores goes where it will affect the balance sheet of a smaller bank that's right except state bank of India it has large balance sheet they can afford but other banks they cannot so what you are saying is that the risks of to the banking sector arise from both the large number of personal loans that have been given out which the RBI seems to be now trying to control as well as the fact that even though the credit offtake for the large enterprises is not growing at the same pace as earlier but those old risks have not been dealt with yet so what are the solutions how does one go forward one more factor is there right see this government had been forcing banks to give large number of Mudra loans now as per the September data of 2023 RBI data there are more than 44 crore customers given loan under the Mudra loan scheme okay Shishu, Kishu, Darun three schemes are there the outstanding they loan given was little more than 24 lakh crores and many of this enterprises are not surviving so they are also the the MSME NPA which Mr. Garg had mentioned mainly it is attributed to the Mudra loans and the 44 crore people if we have financed this should have been like once upon a time when there was a scheme like IRDP integrated rural development program people used to say that the number of cows financed by the bank if they are there there won't be any place for people to walk okay so in our country with 24 crore households if 44 crore people have got this Mudra loan everywhere you should be seeing enterprises flourishing which is not happening so there again the default is increasing and so that is also going to it is an indicator that it can lead to a crisis so even the middle you're saying is at risk not only the top and and the bottom but even at the middle of the the small borrowers the individual personal borrowers as well as a large enterprise borrowers all three things are where the government needs to pay greater attention to what's happening definitely the government has to pay attention the RBI has to have closer scrutiny and banks themselves have to wake up they should clearly analyze where they are going are you saying this based on the NPA data is this because we know already that the rate at which people are hoping that the loans will be written off and then later become NPAs is increasing yes see in the case of Mudra loans the political party representatives themselves are telling people that this is given by the prime minister right so even if you don't pay nothing will happen so people tend to not to refay only thing they don't know that their name has already been entered in the civil so if they don't refay tomorrow they will get into a problem they will not get a fresh loan and it's not just that now you have a whole host of legal problems which can hit you if you do not repay you have not just civil you have the surfecy act you have you know the deposit you know any borrower is going to be liable to a certain extent and then you also have this entire hordes of people who collect loans from individuals right if they don't repay they could be in other kinds of trouble legal or not yes see especially the loans which are given by the non-banking financial companies and also now the banks have been allowed to have coal lending model in which the bank is giving the loan 85 percent of the loan is given by the bank but it is a non-banking financial company like Adani capital who will identify the borrower and disperse the loan right and if it is not coming back who is going to be responsible you tell me what is the legal framework for that see now for that we really don't have any legal framework the only what is the surfecy act which you are saying that the recovery tribunal it is for higher loans that's NCLT is for more than 10 crores that's right but the surfecy act can be used against any borrower no but we see so many reports and it's very concerning that you know there are these people who have borrowed and then they get these calls and they are harassed some app you know they have used which they have borrowed money from and then you know there have been suicides as well over these small loans which people take so the risk to society might be much bigger if no legal structure is in place for both lending and returning the money after borrowing yes that danger is very visible lot of loans apps have come right they offer you loan without any collateral right and people when they are in need of money without looking at anything else they just apply through the app right and the apps have very dangerous provisions like there is a very detailed report by BBC which shows that once you log into that app they get access to all your contacts right so they use that contacts to pressurize for recovery of the loan right and that is what has led to many suicides not only one suicide right in Tamil Nadu itself the DGP of the police had to give a public statement that please don't get into these apps loan loan up same thing happened at a larger scale in Gujarat the DGP Gujarat had to come and tell the public please not to use but this would have been controlled earlier itself by the Reserve Bank of India how do you allow people to have access to the bank data because of the UPI platform and that is used to get all the details of the borrower and that has led to this problem and we do not have a real legal mechanism to monitor this kind of misuse all right you just download an app and do something yourself yes Kundas are being used yes they go and threaten at home they phone up and talk in such abusive languages right ladies have committed suicide because of the language which was used against right so so what you're saying so let's come to the quickly to these solutions part you know earlier the NPAs in the in the banking sector came from the very you know sort of a loan party which was held you know about a decade earlier now you're saying it's the opposite the loan party is happening but it's happening at the bottom at the middle level for the small borrowers so how does one how does the RBI approach it what should the government do see number one the small borrowers should be given credit by the banks not by the non-banking financial companies they should be eligible for cheaper credit not the corporates who are now able to get four percent five percent rate of interest housing loan you are paying a huge interest that's right education loan you are paying a huge interest so the small loans if it is given by the banks especially by the public sector bank it can create a demand in the economy also and it can really help the people that is not happening once you are giving through the NPFCs it is huge interest rate and all kind of harassment and the NPFCs also don't have to follow the same capital requirements that a bank has they do have a capital requirement but it is a diluted one right so most of them are dependent on banks too for the funds they don't have their capital to learn right and most of them are not allowed to collect deposits also right so they depend only on the mainstream banking system to get then just they have become like brokers moneylenders only so this is one thing which has to be done secondly the personal loans personal loans should be encouraged with security like the housing loan and for that the interest rate should be lesser at least for smaller houses like somebody is taking a house 20 lakh loan he should be given a concessional rate larger loan of one crore two crores you charge more no harm but it's a secure loan there it can help the economy because it creates employment right steel cement all kind of uh necessities are used for the house construction so it helps the economy but instead of that if you are giving large corporate loans that is not going to create employment the third thing is that the long-term finance that has to be addressed by the development financial institution now they have started on but not operating very well so far we need more development financial institution especially say large credit for food processing that there be a separate bank ms me should be the original role it is not playing right idbf was converted into a bank so that place has to be occupied by another development financial institution housing hgfc was for a housing finance alone right conducted due to the bank right now both are merged also so it's a normal commercial bank so who is going to take care of the housing demands you require a development financial institution because that those loans are for 15 years 20 years even the commercial banks are giving that because there the security is so strong the house is there but then for the msm is you have to create an atmosphere adequate support has to be given subsidized credit needs to be given subsidies need to be given infrastructure support has to be given concessional rate of electricity should be given then only the msm is can flourish the entire ecosystem yes and that can create much more employment so that is one finally the interest rate which is being used in the country it was controlled by rba earlier now they have left it to the freedom of the banks so unless that control is brought in today you are giving lesser interest for the depositors it is the depositors whose money is being lent and without that banks cannot serve right if one fine day every depositor decides that there is no adequate income and this bank may give back me money which may not if that faith in the system is getting reduced it got reduced by the demonetization further it got reduced during the introduction of the frda will financial resolution and the positons will people started withdrawing like that if with some of these articles coming if people lose the faith in the system and start withdrawing then the system can collapse we were giving at one point of time 16 percent interest that did not affect the bank that time so why not we kill small depositors higher rate of interest and use that money for appropriate purposes which is the priority now priority sector itself has been reduced to a margin the government's role the rba role should be to build up the economy for which you have to channelize credit that was the original purpose of nationalization now everything is free which is what mr garg's article also points out exactly you're not channeling credit you are giving personal loans and that might not be very good very healthy for the economy in the longer yes all right mr fango thanks very much for joining us thank you very much


All right, welcome everyone. I'm going to be talking about rail security and the history of rail security. My name is Justin Collins. I'm president beef on the internet. I have not like a ton of slides but more than I'm normally comfortable with and there's a lot of information. So I probably explain some things too much and some things not enough. So I say if I say something that you don't understand or a term that you've never heard of take that as an opportunity to like go Google it and learn about it. The slides also have like a ton of links in them. So I always post all my slides online on my website so you can go back and like click through those links and learn more, get into the details of things. There's going to be like two parts. The first part is essentially a bunch of security issues that rails has had in the past. And then the other part is some of the features that have been added over the years. So you're supposed to do one of these slides. I also calculated, this is my sixth RailsConf fifth time speaking and also second time sponsoring but not enough to get on the big screen that you saw at the beginning of the conference. I've been doing application security for eight years about eight years at some different companies. Same eight years working on a security tool for Rails called Breakman. Does anyone here use Breakman? Okay, so everyone who didn't raise your hand if you're working on a Rails app you should probably go and try Breakman. I'll give you a very short tutorial in the middle of the talk. And I've also been working on Breakman Pro which is like Breakman except it's more pro as implied in the name. So this conference already like I think has addressed a lot of history about Rails. So some of this might be your repeat, sorry. But July 2004 Rails was released. This was the email from DHH to the mailing list. Rails 0.5, it is no longer vaporware. So it was out 2004. End of 2005 Rails 1.0 was released. Here's the blog post. It's out, great. August 2006, so less than a year later the first CVEs for Rails were announced. And if you're like what are those things? What are CVEs? I will tell you that I always forget what CVE stands for because in the security world we just call them CVEs but they're actually CVE identifiers and CVEs are common vulnerabilities and exposures which is a registered trademark of a company called MITRE which essentially manages these things. And the reason that they do that is because otherwise I would be up here saying okay, so like in 2006 there was like a security issue and it was like this thing and you'll be like oh this one and I'm like no, no, no, not that one the other one and it gets really confusing. So essentially you can assign these identifiers to publicly announced vulnerabilities so that we can all talk about them in a coherent way. And you may have noticed the middle number is the year and usually that's the year it comes out. Sometimes it's the year they requested the number and things come out a little bit later. So 2006 there were two CVEs that came out for Rails and I really like the post around it because I think, well at least for those of us in the security world this is like a bit of looking back at the way things used to happen and they don't go like this anymore. So there was a post by DHH August 9th, 2006 evening says look hey we're working on Rails 1.2. However there's a mandatory upgrade that you need to do because there's a security issue. However it's so bad we won't tell you what the security issue is. And that's something in 2018 like doesn't happen anymore. When they're released they're released and typically a lot of details along with them so everyone can understand what's going on, the impact and so on. But in this post it's just like look just like we can't go into specifics just upgrade. Please, please, please upgrade. The next day August 10th and I don't know if 3.38 AM was the local time for DHH when you posted this but it was kind of like a midway update. Like okay there's only a few versions that are affected but it's extremely serious. We're all working on it. Thanks for being understanding. Sorry this is so terrifying. About 13 hours later there's another post that says look okay so people kind of figured out what's going on. We didn't fully fix it the first time with 115, here's 116 and I kind of left out the stuff if you were in Michael Hartle's talk a lot of stuff below this is like this is how you upgrade rails and this is how you can fetch a gym and kind of a lot of the deployment stuff that we don't really worry about so much and also stuff about how to change I think mod ruby or something so that you avoid this problem. Again there's the link you can go look at sort of the historical stuff but even though it says here's the full disclosure edition it doesn't really say what the problem is. It's something like okay well you could load the profiler which doesn't really make a lot of sense. So all I really got from this was like it was like full on panic just there's something wrong and this happens to a lot of software teams you have a security issue and you actually have never gone through it before and you have no idea how to handle it and that's exactly what I saw in these blog posts. I looked around and Evan Weaver had a blog post from that time he and also I recently tried to look at the diffs between 114, 115, 116 to figure out what the security issue was and it's like who knows what's going on it's really difficult to tell so he did he instrumented his app and tried to figure out it was something about how files were being automatically loaded and if you look the URL here is slash db slash schema and if you look down at the bottom you see it says hey I found a file that matches slash db slash schema I'm gonna load it and essentially the vulnerability was the routing layer would look pretty much anywhere in your Rails app for a matching file and then it would load that file and then it might go oh well that wasn't a controller I guess 404 or something but it would still load and execute the file and that included by the way the at the time if you had like public slash uploads or imagine any Ruby file that might be on the server you could execute it so that was pretty bad this is what we call RCE or remote code execution basically the top of the pyramid for security issues I can run arbitrary code on your server all right 2007 CVE 2007 5380 this one was kind of interesting because they basically just dropped a feature so I don't know if you remember 2007 but it was really common to see like J session ID or PHP session ID or in this case like underscore session ID in the URL and that was your session it's a very bad idea to pass around sensitive values in the URL in 2007 you may recall having HTTPS was kind of like a luxury so these URLs very easy to find intercept replay steal et cetera so when the CVE came out they actually just drop this feature they're like you can no longer pass sessions in the URL as a query parameter only cookies something else caught my eye not security related it used to be slash person slash one semi colon edit was what the URL would look like and I wasn't around Rails in 2007 so I was like what like this looks insane to me and they blamed it on libraries interpreting semi colon edit as like part of the query parameters but I think they're like totally justified in saying like okay you shouldn't have semi colon as part of your URL just that was just a side thing all right jumping ahead to 2011 there was a CVE this one so this one's interesting for a reason that I'll get to you in a second first up cross site request forgery works like this I log into my bank account that's my current balance I just come here for fun I log into the bank account and then I go and visit some other website while I'm logged in in the sound browser I go visit another website that website makes a request to my website not my website my bank website so quick someone shouted out how does an evil website make a request to my website? Yes image tag thank you right on easiest way image tag URL of course that makes a get requests most people kind of realize like it's way too easy to make get requests and we know rest we should not have state changing actions behind get requests so you put it behind a post but it's almost as easy to make a post request across so if I had a URL like this and I know it looks ridiculous but trust me there were issues that look just like this so I'm like okay I'll just like transfer some amount from the sign in account whoever that is to my account as the attacker now I'm the attacker sorry I changed rules it's a one-man play up here so can anyone tell me why this works maybe the guy who shout out image tag okay yeah exactly cookies so when you make a request to a site regardless of where the request is coming from the browser will send the appropriate cookies for that site I will say this is changing relatively soon there's a new thing called same site cookies where this it essentially gets rid of cross-site request forgery that's not part of Rails yet though as far as I'm aware okay so that's cross-site request forgery, great this is how Rails takes care of it and used to take care of it as well as fancy name is synchronizer token pattern I put a token in the session I put a token in my forms for my post requests and then when I get a post or delete or patch or put or whatever I check those two against each other and if they match great if they don't reject the request so that's awesome we didn't cover get but again you shouldn't put state-changing things behind get this is kind of what it looked like you're probably familiar this is what it used to look like now the token is much longer what about like javascript requests well the feeling in 2007 2011 also 2007 was it's fine because an attacker can't make a cross-domain XHR request and you can't forge it because in the context of CSRF you can't write the headers in the request so it's fine however this came out in flash there was a vulnerability where you could do this you could essentially set the headers on a post request forwards an XHR request and Rails would accept it because it trusted all XHR requests I won't go into the details of how this worked except to say in flash you have to have a cross-domain.xml file to allow things to happen cross-domain and the check for that happened after flash made the request it checked but too late so you can go read up on that as a result Rails changed how it did the protection now you have these meta tags and you have to send the token on every not get request but every kind of request including XHR and you may be familiar it looks like this and this allows javascript to pull out those tokens and send it along with the proper request great I just want to point out that the timer didn't start and I didn't start my timer so I have no idea where I am on this all right so 2012 mass assignment Michael Hardell mentioned it he didn't mention the GitHub side or Igor Homikov and Igor Homikov would probably be I don't know how we'd feel about the fact that we're still talking about him in 2018 in relation to this event but if you're around in 2012 you may have been aware of the drama that happened around this something like this first we have to understand what mass assignment is it looks like this your updating attributes you pass in prams and if someone comes along and they're like okay great I'm just gonna set user admin to true as part of this update and then Rails will happily accept that and I want to point out this wasn't like a all only Rails thank you this was not just Rails like PHP had this feature called different things it wasn't just like a Rails thing but it was something that Rails did okay so Homikov came along he was 18 at the time and he said hey Rails has protection against mass assignment but how do we make sure that people use it and he didn't feel like he got the appropriate response to his question let's put it that way so he started playing around and he's like well GitHub is on Rails maybe they have mass assignment his first attempt he was able to open an issue 1001 years in the future at the time simply by changing if you imagine like issue and then like date or something as one of the options he set the date to the future so he's like oh that's cool and then he was like well and you can read his blog post but it sounded like he kind of went to bed and was like wait a second I feel like I could do even more with this so you can look this was I took the screenshot recently 261 comments like people keep commenting on this for some reason so he made a commit to master in the Rails repo and he wasn't like super tactful about how he did this so how did he do it I pulled this from a post from Peter Nixie I guess and this is kind of like okay maybe the code on the GitHub side look like this this is the code to update your public key now I looked and I looked and I can't find any record of being able to edit your SSH keys on GitHub but everyone around the time was talking about doing that so I guess I trust them so imagine there was a controller like this and basically it was just like the example I showed you before mass assignment when setting the public key so what he did was like okay you know maybe there was a form that looked like this where you could change the name on the key he's like okay I'll just change the user ID on the key so he controlled the key it was his key but he assigned it to the Rails account and then he was able to push to Rails very quickly mass assignment over time I pulled this from previous talk Rails 2 like you could white or black list in the model actually accessible actually protected Rails 3.1 you could force all models to have to white list in Rails 3.2.3 if you generated a new app you would get that by default and then Rails 4 we got strong parameters which we'll talk about great so now 2013 if you were around and doing Rails in 2013 you probably went through this pain I was at Twitter at the time we experienced a lot of pain and a lot of sleepless nights over this so what happened first of all you can serialize arbitrary Ruby objects to YAML so here I'm dumping an object and then I load it back up great well if you can deserialize something probably you can figure out a way to execute code during the deserialization process and you can go to this post and it's like it walks through all this it's like very long and complicated and pulls out a lot of like weird classes that Rails had in order to achieve this but you could do it however how do you get the YAML to the server I know you saw the next slide but I'm gonna say something different so you could say content type YAML and send a request to the server and Rails would accept that if you turn that feature on which I don't think very many people did so that was out but you could put your YAML in XML and send that to the server and Ruby would deserialize the Ruby object and now you're back to RCE so basically we all went through and turned that off where we could or disabled this YAML thing inside of XML however there was like a part two to this I hope you're already please pay attention to this right here if you're not paying attention okay part two when Rails parsed JSON it converted it to YAML and then parsed the YAML yes it converted the JSON to YAML and then parsed the YAML so you could basically send up YAML tell it it's JSON it would try to convert it to YAML but it was already YAML and then you're back to where you started wow okay whew okay more RCE this is two different CVEs honestly it should have been one but that's a whole nother drama that you can maybe read about online start here if I have something like this and I'm passing I'm essentially allowing users to control what I render on the server side classic directory traversal looks like this dot dot dot dot dot go back up somewhere and then go back down some other directory so in this case hey render your gem file so I can see your dependencies not super exciting however until quite recently render with default to ERB so if it looked at a file and it's like I don't really see an extension I recognize I'll just treat it as ERB and if you have ERB then you're executing code okay that's step one actually I guess that's step two first was directory traversal second is I can render things as ERB now let me provide a payload to the server that will get written to a file that I know about how about the log file so I'll send up a request it'll be like nothing will happen with this parameter but it'll get logged as you can see down there down there parameters get logged there's ERB in the parameter now I render the log file now I'm executing this code on the server I'm back to RCE now the way to get this to happen the reason there are two different CVs one had to do with if you use these glob routing this glob routing feature and then the other one was render essentially being able to render any file on the server but I thought the cool part was putting code in the log file and then rendering the log file to execute it I don't know what happened in 2017 everything was cool I don't know quick tangent when you're talking about preventing cross-site scripting which I'm not gonna talk about you can go read about cross-site scripting if you don't know what it is there are kind of two things you can sanitize or you can escape and these two things get mixed up all the time even libraries will call sanitizing escaping or escaping sanitizing I wanna clarify this for you sanitizing means you take the input and you try to strip out the bad stuff escaping means you take the input you change special characters to safe versions of those characters and it's encoded and when it renders let's say an HTML they'll be treated just kind of like text and displayed properly why does that matter well because sanitizing is extremely hard we get it wrong all the time it's so difficult to figure out what's dangerous pull it out and make sure that when you pull it out that was a safe thing to do and the string you end up with is still safe very difficult escaping is extremely easy it's so easy you just walk the string replace this character with those characters and you're done that's it as long as you escape the right things it's so easy it's like 10 lines of code you're done why do I mention that here are all the CVEs I happen to find that are related to sanitizing methods in short avoid using sanitizing methods these ones or any other ones escape if possible otherwise you're probably gonna end up having to do fix something because of these alright is that really the time I have left? okay let's go Rails 1.2 2007 I ran across this 1.2 added parameter log filtering when you log stuff it can get filtered awesome Rails 4 this got upgraded from application level to sorry from controller level to application level this is the default configuration initializer that gets generated for you filter out passwords put your sensitive parameters in there and Rails will filter the logs for you awesome August 2010 I have to mention breakman 0.0.1 was released I mentioned I'd give you a quick tutorial here it is install it running good a few days later Rails 3.0 was released so it gives you a sense of like the vintage here I didn't realize that until I went back and looked what happened in Rails 3? Michael Harrell mentioned it we went from manually escaping things to automatically escaping things it was a little bit painful for some people to do that upgrade but overall that was like an amazing security upgrade for Rails really amazing now we kind of take it for granted and that's awesome that we do jumping ahead again 2011 well not jumping ahead one year later sorry Rails 3.1 what happened? we got has secure password awesome adds a password attribute to your user model automatically hashes it with bcrypt we get an authenticate method we'll do the comparison for us all our authentication problems are solved awesome nobody laughed okay well anyways it was a good thing to add in Rails 3.1 config.force.ssl was added in Rails 3.1 this just meant all your requests were redirected to HTTPS as of 5.2 and probably earlier I'm sorry I didn't get the exact version number on this redirects requests to HTTPS it says the secure flag on your cookies and it sends the strict transport security header very quickly the secure flag tells the browser do not send this cookie on any request that is not HTTPS that's it that's all the security you get for the security flag but it prevents people from eavesdropping and grabbing cookies the strict transport security header also called HSTS is a response header which tells the browser hey within some time window usually people say it's like a year or two every time your browser makes a request to this domain you're going to use HTTPS doesn't matter if I'm clicking a link or typing it in doesn't matter the browser will automatically change it to HTTPS and if you try to do HTTPS the browser will just stop you nope, won't work there's more details around that please take a look in particular be aware that if you set this you cannot have mixed content on your site which is a good thing that you don't have it anyway but just be aware it actually has some side effects June 2013 Rails 4.0 hooray strong parameters probably everyone here has a pretty good grasp of this because you're forced to deal with strong parameters but before this parameters were hashed within different access and what's cool about having it be its own thing now is you can start layering some security things on for example redirect2 now checks to make sure that you're not passing in params directly to it same with URL4 and also you can do things I didn't put in these slides but I've seen people do things with actually putting params into SQL you can kind of do it safely not into SQL queries but passing into like active record methods because it will be converted to a hash automatically and that prevents some SQL injection issues that's like an advanced usage I guess but this is awesome and we could probably build more on top of that Rails 4.0 we also got encrypted session cookies so before Rails 3 session cookie was marshaled and it was signed it was also like URI encoded and base64 encoded which was great in the sense that you couldn't forge cookies very easily but you could read them just fine so if people put sensitive values into the session cookie you could read them and sometimes that led to bad things in Rails 4 session cookie was no longer marshaled it was JSON which is good because serializing and deserializing things is dangerous still signed and it's encrypted so you can't easily read it also base64, URI, etc but this was good a lot of people were kind of looking for this however you should not put your session values into cookies anyway even though it's encrypted if your application becomes successful you will start feeling a lot of pain around that just a side note Rails 4.0 also added some default headers and they're all security headers which is great X-Frame options prevents a site from putting your site inside of an iframe and performing clickjacking attacks awesome XSS protection header is useless however we said it anyway this basically tells the browser turn on your XSS protection which all browsers do by default anyway let's just be safe X content options it tells Internet Explorer stop guessing that JSON is actually HTML even when I'm telling you that it's JSON Rails 5.0 added per form CSRF tokens so if you don't turn this on essentially a user has one token that they use for all their posts requests for their whole session you turn this on each form gets its own so if I steal one CSRF token from a page I can only use it for that one form so it kind of restricts the use of stolen CSRF tokens which are pretty hard to steal anyway honestly one added encrypted secrets there was a talk yesterday from Christopher Rieger Rieger he also wrote these blog posts so you can go read about it I won't talk about it that much but now you can encrypt your secrets 5.1 was like no never mind encrypt your credentials instead and Christopher mentioned in his talk that this is still like an ongoing discussion so in 5.3 maybe you'll see it's great that people are thinking about it and working on ways of safely storing credentials along with the source code yeah 5.2 also added more default headers and they're all security related so X download options tell us internet explorer when someone tries to download something don't show the open button just show the save button that's good I guess X permitted cross domain policies tells the browser hey if you're using flash and you're looking for a cross domain.xml we mentioned that earlier don't accept it even if I send it to you don't accept it don't accept any cross domain.xml don't allow any flash to be making cross domain requests for my domain so that's good refer policy is a privacy header essentially controls what the browser sends in the refer header and there are a whole bunch of options the default for Rails is this strict origin when cross origin which basically says if I'm on my origin my site, my domain and I'm going HTTPS to HTTPS send the whole refer no problem if I'm going to a different domain that's also HTTPS you can send basically any name and domain but not the path or parameters or anything if I'm going from HTTPS to HTTPS send nothing so that just protects privacy a little bit Rails 5.2 also added a DSL for content security policy content security policy is a response header which could probably take up a full day workshop easily insanely complicated not on the face of it when you first look at it, you're like this thing is awesome I'm going to use it and then you realize it has all kinds of crazy side effects different browser implementations I'm sorry it sounds like I'm trying to talk you out of using content security policy I'm not, it's an awesome header you should try to use it if you're trying to retrofit it onto a legacy application you are going to feel so much pain if you're writing a new application put it in place, get a reasonable policy and work from there the promise of content security policy is preventing XSS the overall sort of base level of content security policy is controlling what happens on your site what images are loaded what fonts are loaded what objects are loaded what plugins are loaded what scripts are loaded what those scripts can do and then there's like a whole bunch of other things as well so please look into content security policy but please be aware that it's like a deep subject with some weird edge cases you can Mozilla has the best documentation for content security policy there's like I don't know 20 directives, that's probably wrong but there are a whole bunch of directives that you can use much more than just these ones and essentially you just say where you can load things from and so on so please take a look at that and like I said it's built into Rails now not that it will create one for you but the DSL is there to set up the policy and you can also do like per controller I think policies as well as site-wide okay so typically on this slide I have like a whole bunch of links however the Rails security guide which has always been really good it seems like it's been updated recently so this is actually the best place to go to learn about Rails security and Rails security features it's like the most up-to-date at the moment resource and it's really good so definitely go check that out that is the end of my talk you can find me on the internet and at these places please check out Breakman and also I have Breakman stickers up here if this is your first RailsConf you should be aware that it's a requirement the speakers give out stickers unofficial requirement I guess thank you very much for attending