So hi, I'm Katherine Fulton. I'm going to be moderating this panel and thank you all for Being willing to Come in take more in and we're going to get this to a conversation as quickly as we can I'm sure people are absorbing a lot of things We are going to be in some ways talking about impact investing What the a new research report calls impact investing 2.0 moving beyond the pioneers And we're privileged to have three Very experienced investors who are both involved themselves in investing But also working very hard to build the Domain of impact investing whether we call it a movement or a field or an industry or an asset class whatever your favorite language is I've been privileged to be at all six of these Socap conferences so far and here in San Francisco And it has been really thrilling the way in which this is all evolved and how we're really starting to build a body of practice That we can draw some conclusions from I'm joined Who are going to actually give you a little bit of their story and what they're seeing first by Jim Sorenson And Jim is from the Sorenson impact foundation And some of you may know has recently created the James Lee Sorenson Center for global impact investing At the University of Utah I'm sure we'll be hearing more about that Ron Cordes who is co-founder of the Cordes Foundation, and we'll talk some about that. I'm sure his work Investing and that impact assets and then Jean Case who is the Co-founder of the Case Foundation, but also here really as a private investor And to talk about her experience What we're gonna do is hear from each of them for a few minutes in terms of what they think is very important about the next stage developing impact investing And then we'll see what themes are emerging and have a conversation with each of you. And so over to you Thank You Catherine. It's great to be here and Really interesting to see How Socap has progressed And I'm kind of a early to Socap, but I've been involved really in the impact space before I really knew that the term was associated with social good My background is really as an entrepreneur and I think one of the the greatest successes that I had was really with an impact company and I started looking for ways to give back and What really resonated with me were those Types of philanthropy that had the potential to become scalable to become self-sustaining and Reach a much broader depth of impact then You typically see at least that I was seeing and so I really became interested Initially in philanthropy that was oriented towards these type of endeavors and Then as I moved and saw these endeavors become profitable I realized that and this is primarily in the microfinance area that they made for good potential investments, so I became an investor and Had some good success there and realized that this was something that could be a tremendous You know power for change in the world and I've since Really oriented a lot of my time and efforts in creating the foundation and most recently in endowing the center For global impact investing. This is a center that's really focused on impact investing at the University of Utah and I'll explain a little bit about the purposes and reasons But I think to set it up That anything that really is going to make a an impact for good and Belasting is going to take time so It's it's also going to require an ecosystem approach and infrastructure that That really enables a broad base of engagement and With that in mind as I've looked at my experience in the impact space and This ecosystem there's been to me a very obvious gap that That really needs to be addressed and it's the gap between the ideation the the entrepreneur or or the concept with really an innovative idea and ultimately to where that's taken and Business model has been developed. It's been tested. It's been optimized. It's been Launched and it's it's to a point where a commercial return investor will Look at it as a as a business and it will attract the capital It's needed to take it to the next level So this gap and it's often referred to as the pioneering gap is where I've chosen to focus my time and efforts and I think it's an area that is ideally suited for philanthropy and so I've looked at What philanthropy is doing in this area and what are the what are the bottlenecks? What are the barriers to? engagement I Have my own foundation and so I have a very personal view and experience from this and With that came really the concept of developing The center at the University of Utah that would provide Really, I think a double bottom line type of return for for my donation in providing students with an experiential education in the impact field But also provide I think foundations like mine high net worth investors and very early stage impact investors with services and and deal flow And support that would be difficult to get or to justify pain for and to do it all in such a way that is High quality and provides an education and potentially a career track for the students that are involved and come to the center And by the way, we found that Students are really attracted to this this opportunity. It's it is a generational shift that I think we're seeing in The way people give of their time and their their their money and resources So the center was launched last year and through that I've had six different Program related investments that my foundation has made that have been sourced the work has been done by the center students They've essentially provided investment memorandums. They've helped in the the structuring of the investments and helped Them to be qualified for program related investments And it's a it's a tremendous I Think service that's given and an opportunity to help bridge this gap I think one of the other areas that's really important to me is really involved in in policy that will help to engage more Foundations I think with foundations you need to educate you need to engage them and then you need to facilitate the their involvement in this field and I think that program related investments are a Great tool and opportunity for foundations to engage and and participate in in in the funding gap and less than 1% of the philanthropy and in The country today is oriented towards program related investments. I'd like to see that change And I think a big step towards that is really a more of a policy, you know tax issue and that is You know getting behind the philanthropic Facilitation Act, which is an act that is Right now in the in the early stages that would essentially provide Foundations with the same kind of designation that they have and they receive when they give to charities or Non-profits in terms of 501c3 letters It would provide that kind of designation for program related investments of these social enterprises that then removes I think a lot of the uncertainty and Concern that foundations rightly rightfully have when they make these With these types of investments. So these are areas that are really important to me and and I'm focused on right now, and I think ultimately there are many other pieces to this Ecosystem and infrastructure that need to be put together, but this is where I focus my time. Thank you. Good. Thank you. I Think that's you run We were assured in the back that this entire structure is rated for winds up to 70 miles an hour And as of today they've been barely in the high 60s. So we should be good So seven years ago this month actually Couple of partners and I had the opportunity to sell a business in the investment space that we built over 20 years and my wife Marty and I did something that we'd always wanted to do we created a family foundation and If you'd have asked me at the time How I would have envisioned myself as an impact investor. I'd have first I had to ask you what is an impact Investment the field was so new the term hadn't even been introduced We became impact investors. I would say originally somewhat out of frustration And it was frustration that as we began to get all of the type of consulting advice one gets in setting up a family foundation All of the advice was around how we could do good in our grants budget the five or six or seven percent per year We chose to allocate and the idea with the other 95 was you know You're an investor go invest it, but this is where you do good is in the grants budget and We kept saying to these folks that we were bringing in for advice We want to catalyze a hundred percent of the assets that we'd set aside. How can we do that? But over time we began to meet social entrepreneurs We began to see business models that made sense and we began to see investable opportunities So in late 2007 We challenged our board That over the next 12 months we wanted to invest 20% of our capital of our total endowment And what we defined at the time is social enterprise investments because a lot of the great work that's been done by Rockefeller and others Hadn't been completed yet. So the term impact investing Didn't exist What also didn't exist in 2007 was any infrastructure to support the field So we went out with a team of MBA interns looking for impact investments And my business had been all about creating investment funds and working with fund managers So I thought the corollary for our foundation would be that we would make some great seed investments in a number of impact investment funds The problem was there was no organized way to find any of them There were no databases that existed and short of Google searches There was so cap didn't really exist yet There was no way that these managers were starting to come together yet and what I realized was That what the space was lacking was the type of infrastructure that every other asset class in category venture capital private equity hedge funds had developed to effectively connect investors with capital with capital opportunities We did in fact become fully invested with that 20% and we were very proud of the fact that by September of 2008 We'd invested that entire 20% across an impact portfolio that included both debt and equity Now many of you may recall what happened in September of 2008. I Had told my board in December of 2007 that because this was a new field We may indeed lose a little money on these investments But we wanted to lose it as field builders and we wanted to lose it intelligently and as we got into late 2008 and we saw what was happening in the global financial markets I was concerned about what that portfolio return may look like over our first year Wouldn't you know when we marked our portfolio at a market at the end of 2008 Not only did our impact investments not perform worse than our traditional investments But that 20% actually outperformed the rest of our portfolio And what I learned out of that was in a world where everything else had become incredibly interconnected Many of the impact themes that we were investing in global microfinance SMEs in the developing world Weren't connected with the global financial crisis. And so what I began to see as an investor is We were making impact. We could see that we could feel that we were starting to measure that and it also made sense as an investment So stepping back we made the decision to go from 20% to 30 to now ultimately 40 And we're on a path that we hope will take us to a hundred percent investment for impact in our portfolio And we're doing that somewhat as a demonstration project if you will we see our portfolio as an R&D lab to prove that this works But we've also funded and helped to create which Catherine had mentioned an entity called impact assets and Impact assets was our attempt to try to build some infrastructure in the field that didn't exist in 2007 When we began investing The research that we've done at impact assets and that we've sponsored by their organizations has basically demonstrated that the problem with Growing this field isn't lack of demand from investors It's not the lack of an adequate supply of investable deals and the capacity to put capital to work It's the fact that the entire investment ecosystem is not yet built in the middle of it much as Jim referred to in the work That he's doing so impact assets is a nonprofit financial services company We're designed specifically to be a field builder, but we're also designed to put capital to work today We have over a hundred million of capital at work through a donor advice fund that we sponsor that makes it a very easy Vehicle for individuals and even foundations who come to us wanting to begin Investing for impact and using our balance sheet and our vehicle as a way to do it We're also building out products for financial advisors We have a relationship with now one of the largest financial advisor networks in the country and the idea is Working through financial advisors working through family offices wealth advisors How do we build that infrastructure that connects the interested investor? The investor today that's interested in connecting their values or as I call it their passions with their portfolio With the myriad of investment opportunities We're certainly seeing over this four or five days the investment opportunities that exist in individual deals and in funds That absolutely as we've proven in our small foundation portfolio can make sense as investments So we're on a mission and impact assets to democratize this industry We're looking where we're hoping to come out with some products later this year that will bring the investment Minimums down to twenty five thousand for a number of investment vehicles that today are at two fifty Five hundred or a million and allow a category of investors to begin investing investing directly That find it very difficult today and at the same time we're working with a lot of other family foundations Around this concept and tomorrow. I'm on a panel tomorrow afternoon about a hundred percent for mission Around this concept that as a family foundation We should all be doing better than just granting five percent per year We should all be looking at that corpus of assets that we have with the responsibility to use as much of that as possible To move forward the issue areas that are important to us So I look forward to a further conversation and thank you for your time Hi folks, I'm Jean case. I'm CEO of the case foundation and I'm also a private investor And I think my real role on the stage here today is the title moving beyond the pioneers Because although my husband and I have been making impact invest investments for over a decade We're fairly new to the impact investing sector In fact, we'd been kind of doing our thing for a number of years Not even knowing that pioneers had gone before us and lots of work with a pick and an axe to figure it all out and Lay the groundwork had taken place And I'm delighted to be on the stage with pioneers and thankful to folks like Omitia and the Rockefeller Foundation Who play a central role at this conference, but have served as real mentors to us as we've gotten more engaged so our own role in impact investing really has evolved and Much like Ron just said when we got started in it. We didn't call it impact investing We just said we were making impact investments with the intent to have impact and I think what's really surprising to me as I come into the sector is To realize you know what we still have a lot of definitions impact investing can mean a lot of things to a lot of different people I bet if I stopped and said what's your definition? What's your definition? What's yours? We might hear three different definitions around impact investing and I think that's okay because our own Experiences when you're trying to build a movement and you're trying to create a revolution It's really messy in the beginning and you kind of want that messiness so that you can figure out What's gonna make sense in the long run? What things should we try that will actually get traction and what things will we find out? Well, that's not really what we want to do Well, we do see a great need for for definition as we go forward and as I talk about our own impact investments I'm talking about specific investments made with the intent to have impact That's measurable and I'll give you an example of some of the things that we've done We've invested in something called Siddharah ventures My work as co-chair of the US Palestinian partnership brought together a number of different investors to create a fund Basically to fund the IT sector in the West Bank It was an economic development play to condition the region for peace It turns out there's ten that tens of thousands of English speaking talented engineers in the West Bank Who get a great education develop their skills and have nowhere to go no jobs no capital opportunity So the fund was put together fund was raised successfully and is now You know some of the first investments are going out in the West Bank and that was called Siddharah ventures That to me is a pretty pure impact investment by almost anyone's definition of impact investment We also did something called the brain trust fund and there we had been involved in creating and funding a nonprofit called Accelerate brain cancer cure for some time and what we saw was a gap in the market We were trying to bring new therapies forward in brain cancer There really hadn't been any new therapies and there were a lot of small companies doing some really cool and interesting things But because of the risk involved they weren't getting the capital. So we put a fund together We were extremely transparent about the risk involved Many of the investors were also philanthropic investors in the case And they jumped in and played a role as well. And so the brain trust fund today funds innovative therapies for any form of brain disease Another what we consider kind of pure play in terms of its impact definition But then we get into some areas that maybe get a little bit squishy and start to challenge Is that impact or is that non-impact and I'll give you an example We've invested in We you know ron talked about democratizing impact investment. Absolutely. I think we all want to see that We wanted to democratize philanthropy or help democrat democratize philanthropy So we put about four million dollars of investment into three different giving platforms online And together those three platforms to date have represented over a billion dollars in micro donations You know and when we got started with that it reminded me a lot of the kind of talk that we have at this conference and around impact investing It's well, how do you know people will give what makes you think there's a bigger audience out there? You know, how are we sure anything meaningful is going to really be there? So that's been exciting for us, but in my mind that would be sort of in this squishy territory Do you call it impact investing? We can definitely measure the impact of what those companies and that investment has done And in our investment company revolution that my husband funds we funded zip car So it turns out zip car for every zip car takes seven other cars off the road Now in our family, we don't have agreement on some of these impact investments My husband wouldn't call zip zip car an impact investment. I would I think it has Real measurable social return that I feel good about and so what we realized was in our own family We're kind of like the market of investors out there And that we'll all bring a different risk tolerance We'll all bring a different view on what's being measured what has to be present in the company What has to be present in terms of its social impact, etc In order to make the screen or the cut You know, but in general we think there's room for all of this and the challenge really is Defining it making it clear for investors so they can jump in and beginning to measure and report what the experience is going to be But it shouldn't surprise you that we're big believers and movements and revolutions We had the really wonderful opportunity to take a company forward That when it got started, nobody saw the potential either I started my career in technology and some startups that had a vision to democratize access to information Communication ideas what we know today really is the internet So I landed at a startup called America online that my husband and I had the opportunity to take forward It was the first company to go first internet company to go public After the merger which you know the merger generally has not been seen as a positive thing The return to aol shareholders on the stock price was 10,000 percent So, you know, even though it sort of dealt with some hiccups along the way the aol shareholders really really We're able to to look at that as a positive value-growing opportunity for them But when we think about aol and if you talk to anybody that's not how we judge its success How we judge its success is when i'm standing here today and I see Maybe you're tweeting maybe you're texting and maybe you're sending email and I say that's great Because that was really the vision and the mission Of the company and you know, we didn't do it alone But we definitely definitely played a central pioneering role in taking forward What probably has been world changing for all of us in terms of access to ideas communication and information So the view really from someone new to this is there really is a lot to be figured out And i'm really looking forward to our conversation But I think we're really undaunted by that as we got started You know people were spending one hour a week online And so you know people didn't even own computers in their homes if they did they didn't have modems if they had modems or Communications device they didn't have the software to connect if they had the software the network might not have come to their home So it would have been easy looking back in those early days to say there's just no way this is going to be mainstream You know, what are you guys smoking? But we believed and I think what I'm feeling at SoCAP and what I love Is this is a community of believers we can democratize impact investing. Yes, we have a lot of work to do Yes, we have a lot of groundwork to lay but the way we look at it is Most investors want to make more money I think what separates the people in this room Is they want money to make more basically they want money to do more to basically Be more productive more beneficial Bring more of a return that they can feel not only in their pocket book But in their heart and their soul as well. So looking forward to the conversation. Thanks for having me today So let's actually pick up on a couple of these things and especially on gene's challenge there and envision a little bit about where this all could go next I sit on the board of the global impact and investing network the gen that was that came out of the Was founded about the same time as SoCAP was was getting started And we've been looking ahead and trying to figure out where things are going. There was a great Preview this morning of a new research study. I want to make sure everybody pays attention to because I think it's going to be very important It's coming from the from the case Center at duke from impact assets the organization that ron founded and from pcv And it's on impact investing 2.0 and they gave us a preview this morning of four or five of the The characteristics of successful impact funds. They've studied 13 funds Investing three billion dollars in 80 countries and they're actually Beginning to be able to see how the messiness is clarifying and the things that are actually true of most successful Impact investments. I think they're doing a session this afternoon on that So there's a we really are kind of at the at the crest of of of things Breaking open in new ways and I just want to pick up on a Few of these things mom. Let's start with you for a second Play out a little bit in terms of what you guys are building at impact You basically have this the two acorns here One of them is the infrastructure that's actually going to create products That will be accessible to more people and the other is getting more foundations to Do and use use more of their assets How quickly you think that I mean five three five years. Well, where could that be paying us a picture of where that could be A challenge our imaginations in the way that gene Suggested here. Thank you Well, jean, I love your analogy It's funny. I was explaining to my 23 year old daughter two weeks ago I'm not exactly sure why I was explaining my first portable computer was a compact I don't know how many which was very an inappropriately named computer because it was the size of a suitcase Too large to put an overhead compartment and you'd lug this thing home The only thing it plugged into was the 110 outlet in the wall About 1980 or 82 or something in there. Yeah So I think we are still very much in the early days of this impact investing space But I feel strongly and it's just maybe it's a gut feeling But I feel strongly that the movement is happening and we are continuing to move forward And we're going to see the same type of evolution in this space that we've seen in the technology space A lot of it because the gen Y millennials are driving it They they don't see why it's not possible to connect your money with your meeting your portfolio with your passions And as they begin to have money to invest They're all looking to do it that way So at impact assets what we're trying to do is help to build Some of that infrastructure help to make it easier for people to make the connections And I would say that the market we've tried to go after our financial advisors The early research that we did indicated that one study money for good done in 2009 a great study It's available online on our website or the gins showed that I think was 48 of the respondents individual investors Were interested in very interested in impact investing 40 percent were somewhat interested only 12 percent Not so much at all But yet less than 1 percent were doing anything and the reason for that wasn't lack of interest and wasn't lack of potential products or investment Opportunities available. It was because they just had never been connected. No one had explained it to them They didn't know where to go to get it and if you really drill down the financial advice industry the intermediaries the gatekeepers Have been largely responsible for keeping the gates closed So we spent a lot of time at impact assets working with those financial intermediaries To really share with them the opportunity that's there and from an enlightened self-interest perspective that this is a business Opportunity in much the same way as firms companies that embrace the internet and that technology early Built wonderful business opportunities for themselves We're working with financial advisor firms including some very large networks and saying early adopters here Will find resonance in this space and we're finding that there's interest So it's you know, somebody asked me a couple weeks ago if this was a baseball game What inning would we be in today? And i'm not sure that you know, I think we're probably still at batting practice, right? But but the but the game has been scheduled it's going to start the stands are filling up We're moving forward and I think things never tend to happen as quickly as we would like So it's always great to kind of think back on the perspective of things like the evolution of the internet To realize that that's taking us a 20-year journey to get us where we've gotten And we're early in that journey with impact investing But I don't see any direction but but forward for this the truth is we're still early in the technology direction too I think in its own way Well in the 2018 so cap conference will all be here as holograms, so you know the um, but but so They're going to be a number of things that unlock this potential, right? So one of them is going to be decreasing you know getting that connection made better um, and and it's I'm really intrigued with this philanthropic facilitation act I mean that the the small mean we all know that the community development finance sector was unlocked by You know changes in the regulatory and tax structure Um, this is this could be really big Can you just tell us a little more about that and where that is and if people want to help what they can do? Sure, let me let me add a little context to it because you know There are so many acronyms and different types of investments That sometimes you have to navigate your way around To really understand where everything fits and it really is an ecosystem. It really is Something that takes time to develop I think what what ron is doing is something that would be very valuable to my foundation because i'm looking at ways To invest my corpus In mission related investments different from program related investments mission related investments That drive impact and so to have can you just because there may be people here don't understand that Can you make make make the difference clear for people? So? There are certain requirements as a foundation that you need to make and managing your corpus and and the Basic concept that guides it is something that's prudent an investment that is prudent To essentially meet the purposes of the of the foundation and in most foundations you're looking for A prudent investment that's going to generate a return And when you look at that you're looking at typical measures that A typical investor would look at like, you know, what's the risk? What's the track record? What's You know where what what asset allocation does this fit in? And that's the world that foundation managers particularly the investment side of those foundations live in And if you are not careful In what you select it can become a jeopardizing investment in other words The irs can look at that and say that was a foolish investment You should never have made that investment. It could potentially jeopardize your foundation And the corrective action is that you have to sell that within a relatively short period of time And oh by the way since we didn't discover that until after five years that it was made There's a penalty of 10 that ratchets up by 10 every year That we assess upon the directors and the Officers of the foundation or those that made that decision. So it's a fairly draconian event and this this is the the context the foundations have in making the decision that You've I think made And it was a very courageous decision that we're going to move The corpus in a very methodical way From what would be probably zero in most foundations To 20 I mean people don't understand that's hard to do When you when you have the context of these irs regulations that you have to comply with And so you're you're paving the way to provide for my foundations alternatives That is mission related alternatives prudent investment decisions that Are aligned with my mission You and tri-link global and there are a few other funds that have seen this and now that are doing this And it's it's one thing to have Something that you find but another thing to have a fund that you get on the the platforms of the investment banks and in the hands of The wealth managers and get them educated to where They're now presenting these alternatives To clients and there's demand I think from clients out there. They just need to have The product to invest in so I really look forward to following that on the other end of the spectrum You have the five percent of the foundation money that's given away each year And that can be made in the form of what's called program related investments or pris These essentially count towards the five percent that needs to be given away every year And this is is I think philanthropy that can be very catalyzing to very early stage These are not the types of investments that would be a mission related investment because they're too high risk They're essentially you're dealing with You know first money in you're dealing with situations where You you're not primarily in it for financial return I mean, that's one of the requirements of a program related investment You're in it for the mission And the impact And uh, that's the area that the philanthropic Facilitation act It addresses to make it much easier for these enterprises To have kind of a safe harbor so to speak that they can take To foundations like mine that are interested in making program related investments these very early stage catalytic investments to new entrepreneurs new enterprises That ultimately if as they grow up and use to look at the overall spectrum They become candidates for The type of investments that that are mission related and and typical return oriented investments Where that act is it's in the early stages. We have Two senators or two legislators in colorado that are championing it on the house side I'm working with my in congress in congress. I'm working with my My own state senator oren hatch Who's the ranking man or a member of the senate finance committee? To kind of build the coalition. We have A lobbyist engaged and we're really looking to I mean, what's going to take To get this through is people educated aware their support from constituents as well as on the house And on the senate side A pretty good level of education And You know, I think enough support to where you overcome the inertia that you have on any new So if we think about the things that are going to drive us forward We've got some of the infrastructure things some of the regulatory things Jean, what are you seeing as you all have gotten into the practice? What what do you think would really unlock this from your perspective? Yeah, so I think I mean I was very honest about the fact that we had been doing impact investing and didn't know There was really a sector and I think in my own experience as we walk around and spend time with other investors It's amazing to me. Who's not aware of impact investing At any of its definitions and I talked about this a little bit yesterday if you were in the room Two really good examples in my mind We did a learning series with the giving pledge and the giving pledge of course represents people who Have agreed to give half of their wealth away Um, and we thought that was a really terrific opportunity to talk to very sophisticated investors About impact investing And I think our jaws were on the table when you know names you guys know And many of us follow in terms of their investing patterns Said what is this? I've never heard of this. This is so awesome. This is you know, how can we get engaged? And it was an eye-opening experience to realize that while many of us feel great about the momentum We are in super early days. There are still so many significant Influencers and investors that people follow who are just now learning that this exists similarly up in the new york stock exchange Did a fireside chat with their ceo? And he asked you know about some of the things we're engaged in I talked about impact investing and he said What's impact investing? I've never heard of it the ceo of the new york stock exchange So I do think we have some work to do but this this sort of ecosystem structure thing I think is important. I think definition is important and and I don't think it's going to be one You know the analogy we use and we like to look at movements that have crossed the chasm right Started out small and now is sort of in the ether And if you think about sustainability and you think about Lead certification it really started to see some scale when people could understand it. You understood Okay, I'm going to do this building This I'm going to put this and oh, that's platinum. Oh, that's gold. Oh, that's bronze And I'm not suggesting we go platinum gold silver bronze here But that kind of organization My work here and might be a simple framework to help investors Understand what it is they're looking at and where in that risk profile they might want to play the second piece that I think There's an urgent need and our foundation has been working together with other foundations to look at whether we can't do a measurement Projects so that you know today if you ask well, what's been the experience of investors and impact investing There's really not a lot of data And we believe data helps drive decision making for investors And I think there's a lot of things that aren't existing here that investors rely on in other places as they make decisions But I I'm not sure we can really get to that next level until we have a body of data That begins to let investors know what the experiences have been You know, the the definitional thing is so hard. Um in in two in two ways. I think the um You know give me the definition of a social entrepreneur Right, right. Uh, you know, I mean there are lots of things that it's language We use all the time that if we spend a lot of time worried about agreeing on a definition So in that sense, I you know, that's correct on the other hand Um, I think we we're at a particular moment where the hype around impact investing has been such And the language is so taken off As it as it takes off in the next stage everybody's gonna say oh, I'm an impact investor Right, right. And then you get the kind of greenwashing phenomenon of anybody can call them, you know So so there is the need for some rigor And I think there are our The research study that I mentioned and some work that the gen is doing and other people And it's not like you're going to try to get everybody to agree I mean I get that and there's always going to be some some cleavages In in things it's a it's a but it's tricky. I am I am I really am worried about the dilution That it becomes meaningless over time as well, right? I mean, I you know that it's I mean, there's there's there is that danger Everything to everybody, which we yeah, exactly. Um, and so Is there I want to open it up to to folks here But I I love sort of painting this picture of what it's gonna it's early days But what is it going to take to unlock and what are the what are the shows that we have to walk through And things we have to avoid as weather as as well as the things that we want to That we want to unleash is there anything else any of you guys want to put on the table as something you really want to See happen before we before we open it up To unleash things, you know, I would just add that in our in our other movements that we've been a part of The power of the ask Is a really big deal And this ranges from everything from investment to volunteering So if you ask someone the number one reason they volunteered Because someone asked them and I think you know, if you're sitting we talked a little bit about this from the stage yesterday If you're sitting in this audience this morning chances are you're a true believer So who have you brought who have you brought into the tent? And I think you know together working with partners I think we do need to build a clear language set And find a way for all of us to make the ask and for people to understand what is the ask we're making And it sounds simple, but it's actually pretty profound And because this is so happened because this is the core the nucleus and the pioneers Chances are you already have but I know we even in our own work feel like we have some more to figure out Before we sit with other investors and say jump in this is what we're asking you to do and some of that work is finding comfortable on ramps And doing some work in almost a getting started guide if you will some way to basically hold their hand and say Here's what it's all about and here's some opportunities for you to play And I think until we have some of those things developed. We're not going to really see it Yeah, these guys are trying to and you're going to train the next generation of people How about anything else you guys want to put on the table? What so on the definition of impact one of the things we did at impact assets in 2010 Was we launched the first publicly available database of the leading impact investment managers We had 400 submissions we launched at the clinton global initiative And the idea was to aggregate together for the first time the 50 leaders ranked by assets that they managed And the biggest issue that we had wasn't figuring out the assets That's all math but figuring out what was really an impact investing firm And jet emerson is part of our team at impact assets actually led a group That developed a concept that he wrote up in an issue brief That's on our website called firm impact capacity And the idea was we had 400 firms submit to be part of this first database We had one firm I remember that when they when asked what do you believe qualifies you as an impact investment firm They said well if we're selected we would agree to sign the un pri If selected and only if so In developing a firm impact capacity We focused on a couple of things one was intentionality That if you're going to be an impact investor it can't happen accidentally So the idea was to have an articulated thesis of change that says this is the type of change that we're attempting To implement with the investments that we're making Second is to have a measurement process to measure that change and then third is to publish the results And some of those measurement processes now are the iris and the gears measurements through Gen which are terrific and other sectors firms are more comfortable today measuring on their own And we're okay with that as long as they have a thesis of change They're measuring themselves to it and they're publishing the results and I would say that winnowed the list down Significantly, but we still came up with a list much larger than 50 Affirms that we really believe we're walking the walk and creating true opportunities For investors to you know, that wouldn't be a bad idea for philanthropy either I'll say the thesis of change you measure it and you publish the results That would actually be kind of revolutionary philanthropy as well, wouldn't it would be We won't go there though because we're only going to have 13 minutes So did you have something you want to add jim point? Well, I I was just going to say I think that's really uh a lot of the The the idea and the core of the work that the center Does that is I think number one finding your center at the University of Utah that engages students You know, they're they're they're provided You know travel stipends scholarships and and internships And and really work around the world in finding Uh You know these types of opportunities for impact then in some of the very early stage work in helping the entrepreneurs and The business models You know, ultimately the due diligence that may be needed by organizations like mine It could be market sizing. It could be Any any host of of things that ultimately is needed Uh as well as really quantifying and developing the systems for measurement of the impact measures that Are important to foundations And you know, it's this type of very early stage work That frankly is beyond many foundations and their their capabilities and It's a it's a real barrier. And so we're hoping that this not only provides them with very useful information very useful Um, you know services so that they can engage and become educated But also, you know, the education for students is uh, just terrific and for them that provides I think a potential career path That uh, you know next gen is going to be really what moves this forward Yeah, you know, I work with a lot of large foundations and they have lots of capacity that small and family Founders just don't have on the other hand. They don't necessarily have the expertise to do this either and how you make it easier to Do is is key. So let's hear some Questions or comments. We've got a mic and because of the way this is being Simulcast we do need to get your question into the mic right here. Yep See several hands and identify yourself if you would Mike needs to be on My name is rich I work at echoing green and we try to find ways to support very early stage social entrepreneurs And so I wonder what advice anyone on the panel would have for early stage social entrepreneurs whose agenda is not necessarily about field building per se But who are thinking about pregnant women with anemia in india or high school kids in the united states They don't necessarily care so much about where Financing is coming from whether it's philanthropic whether it's investment And they're trying to make decisions about which avenues to pursue and how much to to really be thoughtful About this brave new world of impact investing. So the question really is not just general advice to somebody But it's like in terms of which kind of how to think about which type of investment Yeah navigating this new world that says there's many different sources of financing when you're an early stage social How much time how much effort should they sort of be putting into Figuring this world out when they have lots of other stuff to do as well I just want to note that question would not have been asked 10 years ago or even five years ago because There it wouldn't have been possible to think about the range of possible investments It's a really I mean in some parts of the world it'd be very small places But just the fact that that question is a real question is an indicator of some progress Does anybody have an answer to I think it really depends on the stage You know if it's to a stage where you can engage a return oriented investor You know then you know that's probably a pretty good place to go But quite often it's not to that stage It could be you know the idea or very early prototype And that's where I think philanthropy really plays a key role And that's the really the pioneering gap that I'm talking about You know getting from that stage to where ultimately you can engage commercial investors You can get this down a typical track that successful companies go To where ultimately you know they become mission related investments their their You know targets for for large investors and You know the corpus of foundations like mine You know if you want to just answer I'll just So we a huge fan of echoing green we share a lot of fellows with the echoing green organization and it's a there We've had a number of these young fellows echoing green on our own who have kind of said well gosh now Maybe i'll convert from a non-profit to a for-profit So I don't have to worry about spending all my time raising money and I can go out and get some impact investors And what we've tried to kind of caution these folks is you need to have what I would call kind of an Organizational self-awareness and hopefully a board of advisors that can help you Figure out whether or not the initiative the organization the business model you have Actually justifies an impact investment It may well be a very attractive and viable philanthropic model And it may not be possible to turn it into something that will bring in impact investment dollars The one thing I will say no probably happens sometime again happens every time it's so capped is I will get a pitch from somebody who has a great enterprise who says and we're looking for impact investments But you know we're doing such great work that even if you lose money It's still going to be okay because it's going to go to this great work And what I have to do is stop them and say you know I need to figure out in my own portfolio. Am I making an investment? Or am I making a philanthropic grant and we do both But the worst thing we could possibly do is mix up the two because if I make too many philanthropic grants Out of the other 95 of our investment portfolio It does not you know the the Long-term success of our foundation and our viability is really going to be threatened So I do think that more work needs to be done by social entrepreneurs To really understand where their business model fits in the ecosystem And a lot of the work that jim's talking about pris that might lead to mri's And some patient capital that leads to real commercial capital is often a direction that we need to go Let's get another question. I I saw a couple hands over here And you know what let's do this because of the time I want to hear several questions rather than and so we can get more voices So let's hear Jan's question right here and then we'll take the mic over here.  Yeah, thank you And this is a follow-on to the echoing green question I wonder if you would address a question that that flags which is what about the need for Intermediation in this space in other words if I'm that entrepreneur and I am focused and need to be focused on my venture But I also need to know what are the appropriate types of capital to tap for mission-aligned growth and scaling What about the need in this spectrum for those of us who will be the intermediaries that will make some of those connections Because you haven't talked a little bit about that part of the infrastructure. Okay. Good back here And then if you could take the mic back over here. Yep Hi, uh, david bank with the impact space which we launched today to try to address some of this question about Data and performance in the space and we're we're trying to be an open Commons data commons for impact investing and we have identified what we're calling the sort of tragedy of the impact commons Which is everybody wants everybody else's data to be transparent, but not necessarily their own And I'm so kind of interested what you think about the the need for investors to make public more public their own investment activity Successes and failures as a way to signal to other investors the creation of the data the gene referred to how do we make more of it Open and transparent Back here. Yes. Yeah, I'm jackie van der breg with us trust bank of america And I want to pick up on gene's comment about the number of people who don't know about this space because someone said to me today I'm so thrilled to be here at socap The choir has arrived And so this question of how do we get beyond the choir and specifically I'd love the panel to Take the question of segments because our research shows that 72 percent of next-gen investors high net worth investors Say they will take more risk for impact interestingly Women are over a third more willing to do that than men So how are we as martyrs investors in general? How are we thinking about bringing this beyond the choir and in that what kind of segments are we talking about? One more right behind you. Yep James buoy lotus impact impact investing fund based in southeast asia question is a variant of the intermediation idea What are the top three roadblocks to? Creating intermediation and one of the best three solutions moving forward I'm sorry say that one more time top three roadblocks to kind of Spur intermediation and then top three solutions moving forward. Okay, so Um We got a question some questions about intermediation some questions about data transparency And some questions about how we get beyond the choir Anybody want to take that that energy to take up one of them? I'll start with get beyond the choir a little bit more So I completely agree that the millennials represent a beautiful picture forward And in fact if most of us failed at our effort to take forward impact investing They will find a way to make the movement happen So I mean we can do a lot hopefully to accelerate it, but this new generation sees a blended world They didn't grow up the way I did they didn't see it in silas They didn't say okay after being government I have to be in business. I've been non-profit They just see problems and they want them to be fixed and they want to bring everything they have They're looking at that when they decide what company to go to work for what products to buy It is totally in their DNA and we should all feel really really jazzed by that. I will say generationally I think it's interesting the three foundations represented on this panel today and Kathy I'll exempt you for a moment as moderator are what we call living donors And if you look at the market today living donors have much more tolerance for risk Therefore are much more willing to open their minds to impact investing Then those foundations where you're basically shepherding someone else's money who's not here anymore And think about it if tomorrow a friend said to you will you watch after what I've left behind and do right? You're going to go immediately into conservative mode and into risk averse mode because now you're taking care of someone else's money So I think as we look at philanthropy we may find philanthropy bifurcates a little bit And I do think we've seen some early leadership Rockefeller being one great example Oh many are of course his living donor Where you know some of the big old foundations have jumped in in a meaningful way But generally speaking I think the further you get away from the entrepreneur That made the money and took the risk and understood what it took I think the the harder it gets to embody or embrace risk But I think to grow the choir there's a big old market opportunity high net worth individuals Living donors crowdfunding will play a huge role here. I think millennials will jump into the crowdfunding in a big way I hope it works And you know, I just think we see some things on the horizon that are going to happen independent of what goes out from this room Great. Um, in a way, this is going to be actually just a closing comment. Um, I'm so Ron because of where we that's a that's a good challenge to us gene Sure. Well, maybe I'll address there was a couple of questions about intermediaries and I think that again, it's all about building this ecosystem But today if I'm a social entrepreneur and I'm looking for investment capital I've got to find ways to do it beyond just trying to find one investor at a time individually And find them connect with them make that pitch and then figure out if they're even interested in the sector that I'm in So the two things that I see there one is kind of the investment banking placement agent function Which I see a lot of firms doing effectively where they can help connect either a fund or an individual enterprise With investors that they know or interested in what that fund or enterprise is doing And the second is the organizations like tonic the angel investor group that are bringing together an aggregating Due diligence so that an either a fund or an individual enterprise with a promising opportunity Can get together with 15 20 25 investors have them do their due diligence together and not replicate that process over and over I would just add tonics a good example village capital is another they worked with in country intermediaries Essentially incubators and quite often what entrepreneurs need is They need to understand what their their true business is And what the principles are to make it successful and determine whether or not it it can be a for-profit model And optimize that before they can start going to You know investors and that's where some of that very early stage works Work is and and a lot of the the efforts of the center that That I've established there is also involved in in that space again very early stage Well, you can you can get a feel for how I think this is going to continue to pick up and one of the things that I'm very excited about is Actually looking ahead. They're one of my new colleagues at Deloitte Bill Eggers is just publishing a book called the solution revolution, which is out on the table outside And I think they do a wonderful job of picturing this space that's actually been opened up that Socap is in some ways the meeting of the tribe of between the government and business and the nonprofit sector I think we're living into that space in the next 10 to 20 years It'd be a very very exciting time and impact investing is one of the engines of it, but not the only one and uh The fact that we haven't answered all the questions is Part for the course of where we are and and lots of the rest of the conference. Thank you all for coming and thank our panelists


about my experience as a Node.js developer. So I'll just tell you the title of the talk. It's the musings of a frustrated developer, and this comes from the pure vexing nature of Node.js or JavaScript, I would say, as the more perceptive of you may have assumed. With that said, I'm Shreyansh, lovely to meet you. And I write code obviously, that's why I'm here. And those are some of my handles. Please don't judge me for the last two, I was young. And I am really horrible at just making presentations. So why am I giving this talk? Why am I having a chat with you about some of the things I've learned? Because it's actually important to see some of the more easy to make mistakes while we are learning to be a developer. And I think so, ma'am here asked the entire crowd who's presenting, what is the good method of getting into the development scene? So you can imagine this to be something along those lines where I'm giving you advice or where I'm telling you what I have experienced so you don't have to do that yourself. With that said, the other reason, and as many of the engineers will agree with me, is that because no one can write bug free code, I disagree with that statement and for a very simple reason because there is a way.  So with all of that aside, let's actually go into the presentation. Tour is to human and tour and produce JS. Now, I'll just tell you a couple of the things which we'll be sort of covering in this presentation. In college, we learn how memory works, right? Sadly, sometimes you forget how that happens in JavaScript because well, it is JavaScript and nothing is what it seems like. And how we are using JSON for literally everything. Then I, actually I work with cryptography and sometimes I don't really know why I've messed something up in my code. Where I log a lot because as you can imagine that I talk a lot. So of course, that translates to logging while I'm writing code. And how configuration is just my new sort of pet peeve, I would say, and express for the win, of course. So just a quick note here. I love friends. How many of you watch friends? Excellent crowd. So this is the first present, the first sort of episode I would say, the one where I forgot how memory works. And just to lay down on the application we were working with something to give you a little bit of a context. So this application gets PDF file and sort of analyzes them of how good they are. Now, when I say good, I mean how useful they are for the end users. It's written in express by the way. At lovely 2.57 AM, I get a nice notification from AWS saying that something is an alarm. And well, well, it restarted, great. No biggie, we had around more than 15 notes to sort of cluster for all the traffic which we had. But what we noticed after I think it's around half an hour was that every 20 minutes I was getting a notification and I don't know why I was getting it, but it was a failing note which would then restart and the same thing will continue to happen at infinite. So the first thought, that as a responsible sort of engineer, the first thought should be that after solid contemplation, you decide that okay, I'm gonna just go into the prod, the prod environment and I'm going to debug it. I was watching Rick and Morty, so pardon me for the interruption there. But finally, I got around to doing it and there's this very simple command. If anyone can tell me what this does. Yes, so this is an SSH tunnel which means that I'm connecting to, let's not, right. So I can basically access the port on the right which is on the system which I'm trying to access the port on the left, very simply, very simply put. And as the first thing I'll do is just get into the logging of whatever is happening in my application. And there's this lovely garbage collector in Node.js. And this is the thing I see that it's working properly but in two ticks, which is I would say a couple of milliseconds and nanoseconds depending on how many for loops you have in your application or the complexity. It was just skyrocketing for absolutely no reason. So the first question, how and who can debug this? The problem is that our code base has quite a bit of code around two lines of code at this stage. I have no idea. Okay, so 90% of that is Node modules, I'm sorry. So a couple of methods do exist to sort of debug this. The first one is core dump. Just take a dump of whatever virtual machine or application is running on an analyzer from there. Security researchers love it, I'm pretty sure. The second one is something called MDB. Now, this is not a very viable option for a very simple reason because this is a tool which is created by Joined which is sort of like, you can imagine it to be like a parent company for Node.js. And it only runs in one of the proprietary operating systems, so satellite there. And there is no debug. I'm not even going to go into why that is horrible. There is Perfmon, which is not that great, but it works on Linux events. You can get some sort of information from it, but for production, it's really, really slow.  Because back in their day, apparently they used to read RAM with chips, which sadly I can't do because I have a very high level system in my house. I'm just kidding, I don't. So what did I finally choose? I'm sorry for waffling there, but I went with flame graphs. And these look really pretty like a lovely Diwali light there. And just to give you a quick idea of what it is, can anyone tell me what the y-axis represents? If anyone has worked on this? Exactly, so that's a stack frame, excellent. Can anyone tell me what the x-axis means? Absolutely nothing, because it's node. So with that said, another thing, the width of the box you see is the amount of time for which it was on the CPU. And just one thing, so that black box there, that means that that's the process which is running when I took this flame graph. Yeah, so there's a simple controller call here, which is calling two functions, very simple sort of standard design practice. And that looks like this. I'm just getting a post request. There are some middlewares, which I am authentication, authorization, all of that jazz. And then I'm sending it for analysis, which is this lovely function. There are some problems with it. Can someone tell me what they are? Anyone from the crowd? Okay, okay, I'm sorry. So the first object that parts, that's basically a memory leak, because I have a long-term object in a short-term context. And the second one is the classic post and pre-increment operators, which we learn in grade nine, while doing computer science. So JavaScript has this tendency of giving you something called an undefined at where something is out of range, instead of giving an index out of range exception, like the people who use Java, or any other programming language for that matter. So very simply, it is just a plus plus I from zero to 11, I'm going pre-increment, undefined, and there's a memory leak. Now, we didn't really have good debugging practices and monitoring practices, right? And I was having a chat with some of my friends here, and there was a very valid point, which was brought up, that you can do all the logging in the world, but who monitors it, who sees it? Because you need some humanize, right? That's like saying that I have an entire system of CCTV cameras, but anyone can infiltrate if no one is looking. If someone has played Counter-Strike, they'll relate. So how do we monitor it? And the first question is, how do we create those pretty looking Diwali lights I call flame grubs? We can create a heap dump, which is all of the objects in the memory. And then I can just throw it in dev tools and see it from there. Very simple process. You cannot create it in production, though, because it requires twice the amount of memory your system is currently running on. So we had to think with this in mind and how did we do that? So Node has a lovely event attachment function called process.on, where you can attach to native Linux or Nix-based signals. The first one is SigUser2, that is also SigUser1, which are by definition not used by any processes.  Now, if anyone has worked in DevOps or has managed a server writing kill in prod, sounds like no, I'm not going to do that because I like what I'm doing at this company. Let's just go to the man page for this and it says the kill utility sends a signal to the process. The first thing is just terminate or signal a process. So we are signaling a process, not killing it. Please add the dash s. And another thing which you should keep in mind is just restart the process before it locks you out because at one of my companies where we had a memory leak, we were logged out of our production clusters because we weren't able to SSH. The SSH demon wasn't able to, didn't have enough memory to basically decrypt our credentials properly. And for those of you who don't really like using separate packages as I think so happens at large companies, that these two lovely sort of properties on process.memory usage which is a function native in node. I don't remember the compatibility but I think so it is 5.4 above. The RSS or the resident set size is the total memory used by all packages and who can tell me what the heap is? Anyone? Anyone like to take a short like a quick sort of one line description what the heap is? That's the stack, that's different. So the heap is the total memory for all the objects. One thing which I would like to you to know is that heap versus stack, the argument which we have in any other programming language is not the same in JavaScript. For one reason because it is JavaScript. So before we move on, a couple of things here which we should keep in mind while developing applications. Proper memory debugging practices and proper monitoring practices. So you know where your code is not functioning like it is supposed to. The second one is I would say a lovely juxtaposition for who I am as a person, a very talkative gentleman. And I love to log whenever I'm starting an application I just love to write a lot of logs for everything I do. And this gives a lot of response latency as you'll see in just a bit. So I have a very simple route here which just does a status for 200 and sends some JSON response. For any normal engineer, this would be like around three lines of logs. But for someone like me, it is this. Most of it is just for fun. I'm not sure why I do it. The second thing which I want to talk about is who has used Winston here? You've used Winston. Okay, so how do you like it? Good, bad, horrible, very bad. All right. So what Winston does is for those of you who have not used it before, you send it logs and it's going to automatically upload it to your servers, whatever logging server or platform you've configured, which is great. But not for the application. Why? Because you're opening a new socket and as Node.js is a, as they say, a single threaded event based or driven IO system. So it means that if you open a new socket, you're basically compromising your business logic or the amount of memory or space your application has to run on. So the average latency was around 400 milliseconds for something as simple as that, which is literally just stringifying a JSON object. Out of which 328 milliseconds went for just sending it to the production server. So yeah, this is bad, this is bad. Now, in order to refine this process, we need to think about what is the point of logging? The point of logging for a developer at least or an engineer is you get the data, you have the payload, you have the stack. So you can replay everything like it was happening when the application crashed or out on you. Now, why Winston was an overkill for us is because your business logic is not responsible for sending logs to your production server. Simply the amount of complexity involved is just not worth it. And just to summarize all of what I said in the last four minutes is that Winston was really slow. As I said, it is processing these logs through a transport. It is sending it through the transport where it is stored in a database or whatever have you. And application should be responsible for sending them, not processing them. So the better method is write it to STD out. A lovely console at log. Then pipe it to another process, which is again very simple. And you can achieve Nirvana. I'm just kidding, don't try that. With that in mind, the second thing which you should keep in mind is control verbosity. So when I say verbosity, don't keep on waffling like I do for some reason. Just see the amount of logging you need in a separate environment. For example, in testing, you might want everything which is happening in the application. In staging, you would only want the arrows probably because you don't really care about the warnings.  And in production, again, probably the arrows or the fatal exits, something along those lines. So control it. Now, how do you control verbosity in production in real time? So if I see that my 500 arrows are spiking through the roof, how do I change the verbosity so that I can get everything I need to replay the thing which is happening? And this is the question you have that. How will you interface this? How will you make it, how will you bake this into the application such that you can change it right on the go? For that, we use management routes, which are basically, for example, imagine there are two routes, post management log and management health. What I do, I send a simple post request and I just send the parameter there with which I want to change it. Like for example, I want to go from info to trace or from trace to info so on and so forth. And in the health, I can get how my external services are working. For example, how is my postgres database doing? Or how is that lovely Redis cluster going?  And the first thing which comes to mind is how can I automate this? Because a good engineer automates anything which takes more than 10 seconds with a shell script. So for that, I will be introducing console. How many of you have heard of at least something called a service mesh or a service framework? Okay, all right, so excellent. So for those of you who do not know what a service mesh is, imagine it to be like a net which interlinks all of every service which is similar or isomorphic in if I had to be really professional at a conference. So what council will do is that it is going to give you something called reactive configurations.  You want like a DNS name-based approach because that is a lot simpler as opposed to going every node by name. The second thing it gives you is as I said reactive configuration. So reactive means that I'll react to something. If someone slaps me, I'm going to react. If someone cracks a joke, I'll probably won't. So that means that whenever the configuration file changes, I will update my application. I am going to reload the configuration file and start from there, which is very simple. Again, we'll be using the process.onNirvana moment for a single signal hang up, sorry, and imagine you have a configuration store like Redux or something. Just reload the configuration there. And there's a very simple code piece I wrote. Of course, don't use this in prod because this is going to give you a memory leak but you get the idea here. Now the benefits of course are multifaceted. You can control whatever you need, whenever you need, you're not wasting a lot of bandwidth on logging and whoever is monitoring for you is probably having a piece of mind because you don't have to look through thousands of lines of logs for a simple request. Now the episode three is probably the last one here which deals with data security and cryptography. Now, I was employed for a project which was written in PHP. Can I get a cheers for PHP here please? As I thought. So it had insecure authentication code. Now what do I mean by that? I mean this.  There's a MD5 happening in a production environment. This is cake PHP for the PHP fans here. Lovely framework. And the bigger problem which I as someone who likes to sort of tell people about things is that most could, you're learning Node, you're learning JavaScript, you Google something, you go online and you see that okay this is the way how you can store passwords, how you can update passwords, how you can create a very simple forgot password flow. They don't cover it properly because that's a huge worry. Think about it. If I can get access to a token with changes in the password, it is as good as having your password. Think about it because then I can change it to whatever I want and instead of probably brute forcing on my GPU. So the usual flow is you get a request, you send a request, send an email, click on the link and magic. The first problem here as I think so, many of us have talked about is predictable tokens. Don't have something which is sequential, one, two, three, four, five, the next token one, two, three, four, five, six is not good, please. They can figure out how they work and they can keep on replaying it for random users. The second one is non-wallet tile tokens which do not expire after use. I have seen this in production applications where I can literally use the same token again and again and again. So I can forge a request basically. So there's a better way. Generate a random string. And how many of you know what HMAC is? So you can imagine it to be like a hash with a password which I can change with the password. Just use a random string and for the key use the current password which you have stored in the database. What's going to happen is that you won't have to delete it because upon a successful reset, the password in the database changes which makes the token by default not valid. Now why did I bring this up? I'm sure most of you can't see what is happening but the first request URL is HTTP and what I'm going to show you next is going to blow your mind that we are transmitting live credentials over a simple HTTP connection. Great, why? Why? And then it is also sending me a cookie which I can store in my system. Let's take a look at that cookie. You can't again see it probably. The user data option looks very interesting here. So I tried to decode it, failed. And this is what it stores. The username and the password, clear as day. So a man in the middle attack is very easy. And my first response to seeing this was this. Right? So just to recap, whatever tutorials you follow online are probably not designed for production so you would want to read about the package of the library you're using while building a system. And with that said, thank you so much for listing me blabber for half an hour on a topic. Any questions from anyone? Yes, I have tried Bcrypt. What did I suggest for encrypting passwords? No, so that was H, that was for resetting passwords. Bcrypt is again, so that's actually a very nice point How many of you know what Bcrypt is? How does it work? Can anyone tell me very quickly? More or less? Yeah, so what it does is that in security there is something called a timing attack. Which means that I can see the amount of time or the amount of processor resource, some process is taken and then I can decrypt it. What Bcrypt does is that it gives you sort of like a way to define the amount of time it takes for the hash to sort of be generated for you. You can control that with something called a cost factor or a costing function. Read about it, it's actually very interesting for those of you who want to use something like Bcrypt. You should also look into argon too, which won the password hashing competition I think so last year. Anything else? Anybody else who has a questions? Anyone in the audience? Yep, thanks Shreyaan. So with that