Hey friends, it's Leanne and recently I had the great pleasure of sitting down with one of my good industry friends Isabella Bachmanek who is the event planner for the Dietitians of Canada. You may recall seeing Isabella on another video I did with her last summer where she talked about implementing brain dates into her conferences and you can find a link to that video here. Well, today Isabella is talking about pivoting her in-person live scheduled conference that was supposed to take place in June into a virtual library of education. Yes, she turned her live event into nine weeks of programming for the Dietitians members. I want you to hear her story. She has some incredible best practices for you event planners out there. And as she looks ahead to 2021 she's got some nuggets of wisdom as well. So stick around and let's hear from Isabella with Dietitians. Hey Isabella, thank you so much for joining us today. Hi Leanne, it's great to see you and I'm happy to chat today about my virtual conference experience. And I'm so thankful that you're able to do that and I know a lot of Canadian associations had to cancel their in-person events and of course Dietitians of Canada was no different and you made the difficult decision to cancel your June event. So at what point did you guys decide to go virtual? I think pretty much from the beginning when we were talking about cancellation we were talking about canceling the in-person but what could we do with all of this fantastic content that had been curated by our program committee and what could we offer our members during this difficult time to help them stay connected to each other and moving forward with their careers and learning and just feel supported by us in general during this time? Yeah, no and we appreciate associations staying on top of these things and staying connected with their members because you're right they needed that support. So but your event looks a little bit different than other virtual events that I've seen out there. What can you tell us in particular about the Dietitians event? Well what we decided to do was break the two and a half days up into a weekly program over nine weeks and the reason that we did that is we knew that as healthcare workers Dietitians would not have a whole day to sit in front of a computer and at that time we weren't sure about you know all of the research has come out now about you know how long you can actually make virtual events we were just kind of going off of what we thought our particular group could handle. So we had two sessions and one research presentation every Wednesday afternoon starting at the end of May. We had to use go to webinar because some of the health authorities that employ Dietitians had blocked Zoom at that time because Zoom was relatively new and had some security issues that people were worried about. We made sure that we still offered our brain dates except you know we offered those virtually because we knew that it was important for our delegates to not just get the content and the learning but also to be able to connect with one another. So we did four brain dates over the course of the nine week program. We had a really good response from our supporters and exhibitors. We had about 25% who stayed on for the virtual program because they saw the value in that. And we decided to offer it free to members to show them the value of being part of our association during hard times. We did lose you know revenue. We didn't make any money on this conference certainly. We lost some money but we felt that we needed to give our community something special when they needed it during this difficult time.  So how did your members react to this virtual event and to the generous offer of it being complimentary to them as members? Well we were amazed you know. We were forecasting that maybe about 500 would be able to you know connect with us during the program but we actually got over 2,000 people that attended a session or brain dated or interacted in some way with the program. Many of them were repeat customers. They were coming back week after week participating in multiple brain date sessions. They were very appreciative. We had about 500 to 800 attendees live at each session and then another 500 or so that would watch the recordings afterwards. So that was really fantastic.  And over 50% of those attended more than one brain date. And this was great for them and for us because we were able to see the topics that people were most interested in talking about. Which is very helpful for us as we plan the future of our professional development and also DC's activities. Yeah, that's an incredibly high participation rate. And you are hearing that from other associations as well. They're seeing a lot more people participate because it's more convenient to do it virtually than obviously to make all the logistics of an in-person event happen. But 2,000 people, that's incredible. Congratulations. That's such an accomplishment and an achievement both for you and for dietitians. But talking more about you, and we've chatted about this in the past, you had a lot of great virtual event experience even before this all happened. How did you lean on your skill set as a virtual event strategist to make this happen? Well, I've always been very interested in event technology and the AV production and all those kinds of things. So I focused a lot on that in my career. And I've also worked in the technology sector before. So worked with a lot of tech people. And so I always have my eye on what technology is doing in general as well as in events. So when I started with Dietitians of Canada, one of the first things I implemented was broadcasting the plenary room and the AGM at conference. Because we already had all of the AV equipment in there. We already had a camera in there. You know, doing the the camera work in there. So I thought, why don't we just plug in our go to webinar system into that and broadcast out what's happening in the plenary room? So we've been doing that for two years. So our audience was already accustomed to that. And so was our staff. And then we had also just the fall prior to COVID-19 hitting. We had actually transitioned our coast to coast seminar series that we do every fall and winter to completely virtual as well. Because we found that the in-person numbers were dropping off and the connecting virtually numbers were picking up because it was a hybrid event previously. And so we said, why don't we just pivot this completely to virtual to help people attend this easier and not have to leave their office for a half day event sort of thing. And so we had that experience under our belts, you know, when this crisis hit. And that's why I think when we looked at cancelling the live event, it was really easy for us to picture how to move it to a virtual program immediately. Yeah, easy for easy for you to say. But I do think dieticians has a great asset in you as their planner. Because a lot of the planners now are playing a bit of a catch up game. And you were right there knowing exactly what needed to happen. But having said that, surely you had some new learnings or things that were new to you as a virtual event strategist through creating this weekly library of sessions. What did you learn new? Well, just like you said, I think experience makes the difference. Even for me, as someone who had been doing virtual events for dieticians of Canada for a couple of years, doing a full program like that with fully virtual event production and everything, that was certainly a learning for me too. So for anyone who's doing some of the great digital strategist or digital producer courses out there online and stuff, I think it's important to get the practical under your belt as well before you tackle anything too big. The other thing is pre-recording sessions is a really great tool for your speakers who may be presenting from areas where their internet is unreliable. So you can pre-record their actual session and then still have them joined for Q&A or any discussions that might be scheduled to happen throughout the session. At least they can be there for that. But you don't have to worry about their internet cutting out in the middle of their presentation or something like that. We, in order to get people to really engage with the live event and with the chats and the questions and everything that were happening at the live event, we made sure that people understood that we were offering a recording of the session after it was done, but only for a limited time, so only until the end of the summer. So we wanted to make sure that they were actively engaging in the content as much as possible during the program. Attendees really like to see the questions and have a discussion with each other while they're attending live. Unfortunately, GoToWebinar doesn't allow the attendees to see each other's questions or to really have a chat with each other. So we'll definitely move to a platform that would allow for that. And making sure you have a structured networking opportunity. It's just as important as the content. It's not enough just to have some random networking area or a meeting feature in your platform. I think you need to give people a time slot and options to connect on topics of their choice in groups or as one-on-one because the introverts are going to really want to do one-on-one stuff. So you need to give people an opportunity to talk in a group if they feel more comfortable with that. So I think that's a really important thing. So don't forget about structured networking. Don't just leave it to people to do themselves. And then I guess the last thing is the three hour maximum. That's the longest you can ask people to sit in front of a computer. Like I said before, we based our programming times on what we thought dietitians could handle as health care workers. But now all this research has come out in the last few months that actually backs that up and says, don't try to do eight hours a day for two days. You're going to get people's brains are going to explode or their butts are going to go numb or the other things just or they're just going to log off and disconnect because they just can't commit that amount of time. Some of us just need to get another cup of tea. That's really all it goes down to for some of us. Oh, my goodness. I took so many great notes, Isabella, because I really do want to capture some of these best practice tips that you have maybe for other planners who are starting to even now just look at their format. So I appreciate you sharing all this for those planners who are looking ahead. And thank you also for commenting on some things that you've learned or even some things that you would do differently next time. Is there anything else that you would change or do differently if you had to do a completely virtual event again? Well, definitely for the future, we'll be looking at using a virtual event platform like on air, for example, to manage all of the content and sessions and everything involved with the conference in one place. You know, a tool like that offers the option to have question upvoting, chats available for attendees, an exhibitor marketplace, e-poster sessions for researchers. And it's just like a one-stop shop. As opposed to this year, we just didn't have time to source anything like that. So we just used GoToWebinar. And so I was sending links out every week to everybody and then I'd have to send the link to the recording out separately and the survey out separately. So there was a lot of emails and a lot of links flying around. So definitely next year, we're gonna use an event platform where all of that can live in one place and people can just log in to one place for all of their conference needs. I love it, I love it. But you know what? You had such a successful event with the GoToWebinar platform. I mean, with 2,000 people continuing to log in week after week, you obviously did something really special and really unique to the dietitians. And I'm hopeful that other planners can pull some of these best practices. And you're looking ahead, but I'm curious to know, what do you think your 2020 event one, your 2021 event would look like if you had to predict it right now? Well, I'm the eternal optimist. So I'm really hoping that we can do a hybrid event where we have a live group and a virtual group. We certainly understand that by the end of May next year, people may not be able to travel as freely as they could a year ago, but we're hoping our event is in Quebec. We're hoping that people from Quebec and Eastern Ontario and maybe the Maritimes will come in and we'll have a few hundred people at the Sheraton Montreal and then have another few hundred people online. So we plan to expand our online option to include all concurrent sessions rather than just what's happening in the plenary room. So that's gonna be a more robust program for our virtual attendees. And of course, we'll have to make the call about whether we can have the live event based on what's happening about 90 days prior. We'll look at what's happening, what the provincial guidelines are and decide from there if we need to pull the plug on the live event and just go completely virtual. But I'm really hoping we can have a hybrid event. Yes, fingers crossed and you aren't alone. I think a lot of associations are thinking along the same lines that there's the great hope that we can do hybrid and in-person for 2021. But to your point, you're right, it's gonna come down to 90 days prior, which is so unfair for you planners. All that work that you put in and then have three months to make those decisions. Isabella, I cannot thank you enough for sharing about your event today, sharing these best practices that we can give to other planners. Where can people go to learn more either about you or about dietitians virtual events? So dietitians of Canada's website is dietitians.ca and under our events tab there, you can see all of the virtual events we're gonna be doing over the fall. And then you'll see the conference link there as well to see what's happening with conference 2021. And I'm on LinkedIn. So if anybody has any questions or wants to reach out and have a chat about hybrid events or virtual events, I'd love to do that. I certainly am going to be paying a lot of attention to hybrid event conversations over the next few months and see what I can learn and what I can pick up in terms of best practices for creating a good experience for a live and a virtual group at the same time. That's gonna be a new challenge in itself. It's the new learning curve, isn't it? Right, to pivot now to hybrid. Friends, I'm going to have these links also in the description for this video. So please go on over and say hi to Isabella on LinkedIn and visit the dietitians.ca website to learn more about their events. Isabella, thank you so much again. I always learn from you. You have so much great information here that I can't wait to get into the hands of other planners. Thank you so much for your time and I wish you nothing but the best as you plan for Q4 and into 2021. Thank you so much, Leanne. I really appreciate the opportunity to share. I've learned from so many people over my career so I'm delighted to be able to give back and also to recognize all the hard work that the program committee did at Dietitians of Canada and all the staff and all the volunteers. They really did a wonderful job at pulling all this together this year and creating this awesome virtual conference. So kudos to them. Agreed, so many volunteers behind the scenes that are supporting us, great planners. So thank you for recognizing them. You are always welcome to do a video with me anytime. You just name it. All right, sounds good. Thanks, Isabella. Okay, bye.


You can't, oh, boom, let's go. I think we're all in love with him. To a regular Asian guy. Why do you say, oh my God, at her Instagram page, huh? What do you see? I'm not, no, I don't know what about you, you know? Mom, just. What's going on, everybody? Andrew here, and I'm going to be reacting to Jubilee's 10 Women Choose His Perfect Match. Now we got an Asian guy here at the center of the video as the bachelor, where women are gonna be deciding which of the women he should go on a date with. And I think it's cool because traditionally dating shows, especially the ones on TV, have not been very friendly to Asian men, let's be honest, and they have not fared very well. Kind of have a no dating Asians sort of policy. You kind of look a bit like my brother. Oh. So I'm excited to see something different. Maybe times have changed, but let's see if anything interesting happens, or if anything racial happens. Listen, just to see an Asian guy walk out from behind a curtain, and have that many attractive women react that positive to him is way better than how it used to be. Thank you, Jubilee. You make very thought-provoking content. And also, I think this is just, this is a good representation for Asian guys. Melvin, nice to meet you guys. How are you? This is terrifying.  Thank you, thank you. We'll name him today. He hasn't been named yet. All right, real quick about Melvin, I think his style actually really fits him because he kind of is taking on a little bit of that off-season K-pop look, where he does have that curtain bang cut with the fringe part down the middle, and then he kind of has this oversized sweater on. Obviously, he knows how to flip his hair and stuff like that. So I don't know, I think it's like 5'10", 5'11". Good height? Better. Who's popping the drinks? Guys, I'm 19. So you can't have two. I can't have that one. But does anyone want cider? I'm like the bartender today. I would say Melvin's whole attitude right now. Like he's kind of playing the shy guy, but he's also very confident. I don't want to call him a soft boy because I think that comes with so many connotations, but definitely I would say part of his whole kind of like vibe is kind of demure. So, but I think that's very non-threatening and accessible for a lot of people. One, two, three. What's your favorite thing about yourself? I feel like I can tell like pretty good dad jokes Give us your words. Yeah, yeah, okay, okay. Okay, what do you call a cow with no legs? What? Ground beef. Ground beef.  Tri-tip. Cheers. What is up with dad jokes? Ladies in the comments, please let me know because I've been on the dating apps and a lot of women say they love dad jokes. So I don't know if that's, I mean, I guess it's probably unaffensive comedy. It's quick one-liners. I can tell you this, this blonde Asian girl right here, she gets a lot of matches on the dating apps and I can tell you that she's probably been told that dad joke before. That's why she knew the answer because yeah, I think she just gets a lot of matches. That's my hunch. Cheers, cheers, cheers, cheers. Do you guys like movies? Yes, yes, that's your favorite movie. Top three. As a kid, my favorite movie was Forrest Gump just cause it was really fun. Do you like Marvel? I do. Okay. Forrest Gump released in 1994. I remember when that movie came out. So for him, he's 19, what is he born in 2003? So for him to like Forrest Gump as his favorite movie, I feel like that's him picking a classic. Obviously it's cool to see like Gen Z people really appreciate the, I guess the millennial movies. So that's cool. Spider-Man. Okay, Spider-Man. Which Spider-Man though? Andrew Garfield, I'm sorry. Me too. No, that movie was like made for like the female gaze. So I'm so happy that you said that. Who's your celebrity crush? There's this golfer. Her name's Lily He. And she's nice to be a crush. I'm like, if you're watching this, don't hit me up. Don't hit me up. Lily He is so funny to pick. She is like, if you liked K-pop girls but you wanted to like the American version of that golf, that's Lily He. She's from Sichuan and she golfed at USC. How do I know this? Maybe because I was a fan at one point because I'm an Asian guy who was living on the West Coast. That's a very West Coast pick by the way. That's what I was gonna say. Like, don't hit me up. Are you currently like studying anything? Yeah, I'm studying majoring in PR at USC and then I'm minoring in computer programming. Oh, nice. Do you have any? Crazy balance right here. Melvin? I don't know if he did this purposely, but he knows PR. When you major in public relations, mostly that you're gonna be in a class with mostly women because I think it's like 60 or 70% women in that major. However, CS is gonna be mostly men, probably like 70 to 80% guys. So he's kind of getting bussed of both worlds.  Obbies? Yeah, so like I'm into photography and I've done like some pretty cool shoots with that. Have you been in any relationships? I have, I have. How long? How long? How long? About a year. Why did it end? Yeah, so something just happened. I think I saw something that I shouldn't have seen. So. Like through the phone type. Through the phone on Instagram. So I love through the phones. You like through the phones too. Oh, I saw it on my phone. Yeah.  It was like, yeah, I saw something I wasn't supposed to. Oh, and it was on my phone. Oh, what is going on? What's the story, Melvin? You got to tell us to be 19 and I've gone through a girlfriend who I guess I'm assuming cheated on him. That's unfortunate, man. Oh, like Libra? Oh, okay. You said you're Libra? Yeah, me too. Great. Yo, how many Libras are there here? Oh my God. Okay, so do you have like a hot take? Okay, I'm gonna need like a subject though. Wait, what kind of question is that? Is that what people are doing nowadays, Fred? People are saying, you got a hot take? And then you're like, hot take on what? Throw me a topic. I'm a freestyle of hot take. I don't have a take. It's music. When I first listened to him, I didn't get the hype about Frank Ocean.  No, like it's good. Like, it's good music, but everyone on Twitter is like, oh my God, like. For artsy, so-cal girls, you cannot dis-Frank Ocean. Like they cry to him like every day or something. So what's your top three? Top three? The Marias, I like the Marias. Black Pink. Baby Keem. I didn't go to Coachella. He said all the right artists, literally that's all the right artists. Rapper's Baby Keem, kind of hipster, young rapper, you know, worked with Kendrick Lamar. Black Pink, of course, for your Asian side, because you got a rep, although that is like Black Pink, you know, I don't know. I didn't really listen to like Spice Girls as much growing up, but anyways, he said the right things, okay? He's appealing to all markets. Melvin Lowkey knows what he's doing. And the girls are liking it. Melvin's a likable guy. No, I wish I did. I saw BTS that weekend, though. Oh! Wait, you went to Vegas? Yeah. I was so jealous. I was gonna go, but I went to Coachella weekend too instead. Where are you guys from? I'm from Victorville. I'm from Colorado.  She goes, I'm from Victorville. Be proud of where you're at. Be proud, Delilah. Hello. Out of state. Yeah. Did you move here? Yeah, for school. I go to UCSD. UCSD, so you had like, you had to like drive here? Yeah. I'm from the Bay, originally, and yeah. See, that's a red flag. No, I'm just kidding. Oh, why? No! No, I got to go to Orange County, like looking at the beach area. Another red flag. No, I'm just kidding. I'm from Fresno, but I go to UCLA, which is gonna be another red flag, because we're rivals. The door's over there. Melvin, Melvin, Melvin, flexing his USC superiority. Let me tell you this, I lived in LA for many years, and I can tell you this, the USC kids, they are maybe the most like, media-centric, and they like to kind of interface with Hollywood a lot. They can be also the most judgmental. Jerry, you don't seem interested. Y'all can be one of us. Well, that's my personality. Yeah. I'm not, it's the age. He's cute. There's some people that are like, pretty long distance from him, so that might be like a... Does anybody think there's like, something wrong with the age difference? I'm 23, so I'm a little bit... Oh, Jesus. Yeah. He's 19. I mean, so far, I'm like, you probably have a lot more in common, right? No. Oh, yeah, the whole K-pop thing. Yeah. I love it. Just a couple of things. I think we're like really feeling it. I think we're all in love with him. How often do you hear that? A group of girls say, yeah, I think we're all in love with him. To a regular Asian guy. That's cool. I don't even know, I mean, obviously this show, or this episode's kind of set up, I don't think it's scripted, but obviously they put the girls together, but I know, I think these girls really are attracted to him. Winning, winning. Why do so many guys wave like this now? I get it though. When you wave to girls sometimes, you wave differently to women than you do to guys. Be honest, like as a guy, you're just like, what's up, man? Hey, maybe you might do one of these with the more rigid like one, two, threes, but then with girls or like, I guess I would say elderly people too.  I can't, I don't know, there's some about his wrist.  Like from that movie, everything, everywhere, all at once, it's like, hey. You ready to be done with this? I am, you know what? I'm enjoying every movement of this. How are you? Oh, I'm good, how are you? Good, good, good. Are you nervous at all? Extremely. Me too, I'm a little bit nervous. Sorry, what are you majoring in? She's into him. She likes, that's, that's, she likes the girl with the glasses, loves Melvin. Kinesiology. Like PT? Yeah, yeah. I don't think she's interested in him. This girl, Tracy, I don't feel it. I'm in community college, but I'm a business major right now. Yeah, business. Are you planning on transferring someone? Yes, not exactly sure where yet, but... Consider USC. Melvin, Melvin, Melvin. I'm telling you, USC kids, they know the hierarchy. He was like, oh, you going to community college?  Because you better want to transfer if you got a chance with me, because I'm not gonna date no girl from community college. I'm not, I didn't say it. There's nothing wrong with community college. I'm just saying what I felt from Melvin. I go to UCLA, I remember we were rivals. I know a bit of a red flag, but distance wouldn't be a problem for us. I'm gonna tell you a secret. UCLA was my dream school too. Oh, really? I got waitlisted. I don't think I got off the waitlist, but then I got into the rival school and like... Oh, that's it. For those who don't know, USC is technically easier to get into. Their acceptance rate is a little bit higher, and they accept less kids. UCLA has a very low acceptance rate. It's super selective, just because so many people apply, because UCLA is a state school. I got rejected from USC, so... It's all arbitrary, like that whole process. I can make like very basic things. Like a salmon bowl, I got you. Other than that, I think the most complicated thing I've ever done was like... Serial. What are your hobbies? I'm a raw climber, so like being outside. Are you afraid of heights? I'm not afraid of heights, but I just feel like I wouldn't be athletic enough to like climb over. Melvin basically counted them out with Chloe. I think Chloe's not really interested in him either, but she probably likes guys who like, honestly, more drink beer and have beards, because she's from Colorado. That's just the stereotype. But Melvin here was like, yeah, basically I just can't grab on to things, so I'm too weak. Anyways, Melvin's being honest. USC kids, very confident.  I was about to say I really like your outfit. Those boots are awesome. Thank you. I was scared to wear them because I didn't know how tall you were. Kind of a power move. Where'd you get the skirt? The skirt is from Depop. Shop second hand. I'm super into fashion, I saw your little bear. You still have to name it. What do you have any ideas? Honestly, I feel like Melvin Jr. was a good one. Okay. Style is fun and you can tell a lot about a person looking at their outfit. What would you say about me? Okay, the black is giving a little bit reserved, mysterious, but then the teddy bear is like, okay, well he has a soft spot. There's two sides to everybody. You know what I've been trying to get recently? What? I want a racing jacket really bad, but I haven't been able to find one. We got a fifth. We'll find one. We'll find one. Sorry. That was a good convo. You're into fashion or anything like that? Not really, are you? No. I swear whatever looks nice. Not actually. I have been on a date where I asked a girl a question like that and she gave some similar answer and I can tell you, she's not into it. She's just not, no, I don't know. What about you? Yeah? I have one question. Tarantino or Nolan? Okay. Nolan. Really?  Really? I do find Tarantino movies really entertaining. I just enjoy Nolan movies a lot. Okay, okay. Favorite Nolan movie? I think girls who like Tarantino movies are more freaky. This might be a hot take, I should have said this earlier, but I really enjoyed Tenet. No, no, no, really? Oh my God, I love Tenet. Growing up, I liked a lot of anime. Are you still into anime? I honestly don't have time. I read a lot of manga and I'm watching Spy Family right now. We should watch one together. Let's do it. She shot her shot. I like it, Brenda. We should watch one together. All right. Very forward. I was like, what's your nationality? I'm Chinese. Okay, cool, cool. Chinese, but I'm born here in LA. My mom's from China and my dad kind of grew up in Hong Kong. I'm a Bosnian, but I grew up here. Yeah, it's just both of my parents are from there. I really like it. They're actually lived there for like a year. Oh wow, how'd you like that experience? It was so good. I feel like it's always nice to meet people that are the same. That was a really good question, my Melvin. How did you like that experience of living in your motherland country?  Do you know exactly what you're like looking for? Like long-term, short-term, just for fun? Honestly, I'm still trying to figure that out to be honest. I've only like been on this earth for 19 years. So there's a lot for me to figure out. Sure, sure. He basically said, I'm still out in the field, baby. I'm 19. I have no reason to believe that anything that comes from this is gonna be serious. I'm involved in anything on campus. Yeah, so I'm a campus ambassador and then I'm also on a dance team. You're gonna like bust out a move right now? Oh my gosh, no, that's so... It would be crazy if you did. I can be like... I think she should. But I'll teach you the way.   Fine, I'll take that, I'll take that. I'll also show you. That was pretty good, that was pretty good. That was good. Is it my turn, is it my turn? Hey, it was really good.  That was not good though. No way. Neither of them were that good. I wonder what Delilah on the side is thinking. Yeah, so we could dance together a lot. Since I did. Okay, rapid fire. So, the weather. Yeah, it's okay. Yeah. Your parents were Chinese, right? My parents too, are you a canto? Canto. Canto, let's go. Yeah. It was nice meeting you. Hey, she tried to save that. They said, yo, it's counting down. Guys, you got five seconds left. What specific type of Chinese are you? Canto. Boom, let's go. Let's go on that anime date. Good to see you. Oh, good to see you. I have an opinion. I think you. Oh, really? Yeah. It's between Reggie and I'm so sorry. Yeah, it's between like you two. Yeah. For me. I feel like you guys got along really well. That your little conversation was so cute. Good, good. I'm glad to hear that. I did someone for you. Okay. Are you ready? I'm ready. Do you trust these women? I do, I do. That's a funny ask question to ask him. Do you trust these women? He has no choice. Are you sure?  Are you surprised? Did you, were you expecting that or was it close call? I was, I was kind of hoping for it. You were, I was hoping for it. Thank you guys, you did really good. Okay, so after the first round, I had Estelle, Reggie and Brianna. Guys, look, it's kind of crazy, huh? We can go thrifting now. We can, and you gotta get me into USC. Thanks. She looking for the socioeconomic jump. No, I'm just saying, I think it's funny how she threw that in there.  You know, that's the private school. And then she's like, yeah, you gotta get me into USC. I get, I get what's going on. I see you Brianna. Nice move. You get to name it since you won. Brianna. I'll go with that. That's a good name. All right, do you think we're gonna do like a number change Instagram? Definitely. We're going thrifting. Can you? Why do you say, oh my God, at her Instagram page, huh? What do you see? I feel great. I hope she feels great. I feel awesome. All right, everybody, just to wrap it up.  I think so. I think that Brianna showed a lot of like pro-activness and a lot of assertiveness with him. I think Melvin is one of those guys who maybe at this point in his life is looking for a girl who can kind of like pull him along and tell him what to do maybe. But yeah, I mean, let's look at Melvin. Melvin is an above average Asian dude. He's tall. He goes to USC. He is kind of has like that soft demeanor that is very non-threatening to women. And I think he's gonna do fine. But this is just cool to see this many women kind of compete for an Asian guy, I guess. Whether or not they really, really wanted him or only kind of wanted him, they all thought he was attractive. So I think that's cool. And it's a good sign for Asian guys everywhere. So hopefully, you know, there can be more videos like this. But yeah, this video kind of took me back to SoCal, Southern California. Man, it just reminded me of like all those like USC, UCLA conversations I used to have when I first moved there. So that's really funny, but all right guys, let me know in the comments down below. If you liked that video, please hit that like button. If you found anything interesting and let me know if there's other videos you want me to react to. Until next time, I'm out. Peace.


kind of nice and it's too warm. You guys, just a little bit less warm and it'd be great. This is the problem I have with San Francisco, just a little bit less cold and it'd be great. So I'm just gonna keep going back and forth I guess. Anyway, I'm here to talk about security. So first, let me introduce myself. I'm Andre Arco. That's my picture on the internet. I'm also indirect on basically all the internet things. I work at Cloud City Development. We do mostly Rails contract work and have like a bunch of devs who do cool stuff. I specifically do pairing and team training on teams doing Rails development. If that's the kind of thing that your company's interested in, talk to me later, it's cool. The other thing I work on is called Ruby Together. It's actually one of the things that Winston and Alan did as organizers of this conference is everybody's goodie bags have Ruby Together stickers in them. Ruby Together is a non-profit company that I started specifically to make sure that all of these tools that every Rubyist uses every day keep working. So, Bundler and RubyGems and RubyGems.org and all of those things that basically all of us sit down and use any time that we're doing work have spent years and years just getting maintained by people in their spare time. I don't know how much all of you know about the history of those tools, but it's basically been people who are like, man, it would be cool if, and then spending like their weekends and their nights improving things. And that means that when people don't have weekends and nights, it goes totally unmaintained. And sometimes that means that there are security issues and sometimes that means that RubyGems.org goes down and sometimes that means that Bundler doesn't work with the newest version of RubyGems because no one had time to make sure that those things kept happening. So Ruby Together is a trade association for Ruby developers and Ruby companies that funds developers to make sure that all those things keep working. So right now, Ruby Together is paying for maintenance work on Bundler to make sure that Bundler keeps working with new versions of RubyGems and new versions of Ruby as they come out. And it's paying for maintenance on rubygems.org to make sure that the servers get security patches applied and it's not an easy target for hackers. We would love to do more, including additional development work, adding new features, making things faster and more awesome. We'd even love to eventually pay people to improve Rails and even Ruby, but we need all of your help. So check out Ruby Together. So far, companies have joined Ruby Together, include Stripe, Engine Yard, Cloud City, where I work, and Bleacher Report. We'd love to have you and your company help us with that as well. So back to security. Security, unfortunately, is really hard. It would be nice if when things were hard we could just go off and do something easy. I find shopping much easier than security. I recognize that this may be different for individual people, but I'm drawing from my own life experience. So I get sad when I have to deal with security instead of going shopping. So the motivation for me to give this talk is actually now maybe a couple years old. And it was when there was a huge string of security releases. Depending on how long each of you's been programming Ruby, like maybe you remember this, maybe you kind of glossed over it, maybe this was your nightmare for multiple months in a row. So this thing happened where Ruby went through a bunch of security releases in like a few weeks. It's really not normal to have a Ruby release more than like maybe two or three times a year, and there were three releases in like a month. That's really a lot of releases. It was actually so many releases that the release manager apologized for releasing too much. But it would have been worse to not release because the releases contained fixes for critical security problems. So everything's terrible. At the same time, in the same time period, there was a amazing record number of Rails security releases. Look at that, that's amazing. How did that even happen? That's a really huge number of releases. So while that was happening, and I was talking to other Ruby developers, I would say, oh, there was the security release because of this security problem. It's really important you should update so that all of your stuff isn't easily hackable by anyone who wants to hack it. And a really common question that I suddenly got when I started talking about security issues was like, wait, okay, a security issue means that there's some CVE number that goes with it, but what does that mean? So CVE does mean a security issue, but it actually also has additional meaning. CVE stands for Common Vulnerabilities and Exposures, and it's a number issued by a company that tracks security issues for actually all software. There's, it's not just Ruby, it's not just Python, it's not just Oracle, it's not just, it's security issues with all of the software in the world. And there's a company called MITRE Corporation that issues the numbers that are used to track these security issues. And lots of organizations, including huge corporations and even governments, including the US government, have agreed to use these numbers that are issued by MITRE as the way to tell that you're talking about the same security vulnerability because when you say, as you just saw, did you see that big security vulnerability in Rails yesterday, you could be talking about three things. So having the CVE number is a good way to tell them apart. The MITRE Corporation assigns blocks of numbers to big software companies like Oracle or Apple or Microsoft, Red Hat, other companies. Those companies, then, when they encounter specific security issues, use one of the numbers that they already have in a block to say, okay, this security issue has this specific number and now we're just gonna use that number to talk about this problem from now on. The Ruby community has been getting help with security issues from Red Hat. The Red Hat security operations group has mostly been the source of CVEs for Ruby and for software written in Ruby like Rails and Bundler and other gems. There is a global, or yeah, global, both MITRE and the US government's National Institute of Standards and Technology have websites that provide a complete list of all the CVEs that have ever been issued, so you can go look them up. You can see what the problem was, you can see what software the problem was with and you can see if there are workarounds or if there's a version of the software that fixes the problem or if there's nothing that can be done and you're just screwed. All of those things are there on those websites. So once I've explained that part and I'm telling people that these security issues could cause really severe problems with their application because there are horrible people out there who would be really happy to take advantage of these security problems, the most common response that I get is, but Matt's is nice and we're nice and why is security a big deal? Come on, everybody's just great, right? So unfortunately, in that time period where Ruby and Rails both had tons and tons of security issues discovered at the same time, there were so many security issues in such a small period of time that security researchers who many of whom are not Rubyists and many of whom are not nice, said, wow, if there are that many bugs, there must be a lot more other bugs that are pretty easy to find too. And so that's ultimately the reason why it's really important to start talking about this stuff and thinking about it now because we've unfortunately for the last year and a half or two years as the Ruby community been kind of a bigger, juicier looking target than other software and other communities just because there's this well-known set of, wow, that was a whole lot of problems so fast, like maybe there's some more problems, I should go check them out. And so it's actually really important that we start paying attention to this because it's not like those security researchers are gonna go away satisfied that there are no bugs in our software. There will be bugs in our software and now they're paying attention and looking for them. So as you have probably noticed, there are some other people in the Ruby community who maybe aren't as nice. But before all of these security issues happened, Rails was actually the only project that had any serious experience dealing with security issues at all. Rails was part of this big group but before that Rails actually had established procedures for dealing with security issues and they had a security team and they had a security reporting address and they had a bunch of stuff that meant that they were actually able to deal with this flood of security issues when it came up. And so that means that the rest of the Ruby community can definitely learn from the things that the Rails team has already figured out as a result of having to be on top of that stuff just by being a bigger, more attractive target to security researchers. So the other reason why for a very long time Rails was the only gem that had any experience dealing with security issues is because for a really long time, Rails was the only gem that really was worth attacking. When Rails was like the only thing that everyone used, there wasn't really anything else that really mattered to attack. But starting with Rails 3, one of the big changes that happened in Rails 3 is that things broke down into smaller and smaller pieces and you can only use some of those pieces or you can swap some of those pieces out for other pieces and ultimately the combination of Rails 3 becoming modular and Bundler providing the ability to add a new gem to your project by like copying and pasting one line of code and then typing bundle. It means that now we have hundreds of chances for security issues in every project, hooray. So I actually went back and tracked an eight-week period kind of just after the Ruby and Rails issues that I showed you and I counted up which gems had security releases with fixes for like critical security issues in them. So this is just eight weeks. Ruby gems, yes, Ruby gems had a security issue. It was in the documentation generator. There was a CSS attack. Bundler had a security issue. JSON had a security issue. RexML had a security issue. Rack had a security issue. Arrow had a security issue. ActiveRecord had a security issue. ActionPack had a security issue. ActiveSport had a security issue. Ardock had a security issue. Yup, that was eight weeks. Unless you spend a lot of time running bundle outdated, chances are good that you do not actually make sure that Ardock is up to date in case there's a security issue. So I am here to talk to you about what should we do about that problem. Just keeping up with the super critical security releases is sometimes really hard, right? Like Ruby has a critical security release and you're like, oh, but something slightly different and my application doesn't quite work seamlessly and that means we have to upgrade production and that means that the other developers also have to upgrade their development environments and maybe we should just do this a little later and then you have a critical security vulnerability that everyone knows about in production on your servers which is not good. So how can we handle the problems that we face when other people's code have security issues? Well, it's really frustrating, right? Updating is a pain, security updates are important but it's not always really clear what the downside of ignoring them is. Again, when I talk to Ruby developers about security updates, they're like, oh yeah, that's important, security's important, I know security's important. We'll do that when we have some free time after this important thing and then that important thing and then the other important thing. Well, one day we'll do it. So it's also really hard to sell updating sometimes to bosses.  You're gonna be done with everything at exactly the same time after you upgrade and you're like, yeah, yeah, maybe. So the way that I have found is most useful to think about updating is that it's a lot like insurance. Businesses are actually really fond of insurance. If something really disastrous happens, the business is not instantaneously destroyed by whatever the problem was. They talk to the insurance company and the insurance company says, wow, that was really unlikely. Good thing you've been paying for insurance. We got you covered. Updating is basically like that. It's a small amount of developer time that you pay on an ongoing basis when there are new updates. But without that small payment over time, when something goes wrong, what goes wrong goes really wrong because your system is full of security issues that anyone who pays attention just like already knows about how to use an exploit and hack your stuff and hack your user stuff and hack their stuff and it just gets worse from there. As you can maybe imagine, this is not really great for anyone, honestly, but you as a developer in particular. And just one security breach can be a really big deal. Ask me, I worked on rubygems.org when there was a security breach and we had to throw away the servers and build new servers from scratch. And download every single gem and check to make sure that no one had replaced any of them and build new servers. And a week later, rubygems.org was back up and everyone was really relieved, but it was not good. If you do, so assuming that you're not doing this insurance level maintenance of upgrading when there are critical security upgrades available, when you have a problem, it takes down your site for an amount of time that is more than five minutes and less than months, I guess, but it's not really clear how long it's gonna take, right? Like there was a company that offered backups as like their entire service was give us some money and we'll hold your backups. And one of their like, not even really important servers hadn't had security updates applied and it got hacked and they had been using the same AWS key for every single thing that they did on AWS, on every machine and their not important server had a copy of that key. And the people who hacked that not important server that they hadn't bothered to upgrade because it wasn't important, use the AWS key to delete every single piece of data that the entire company had ever put onto AWS and make sure that it couldn't be recovered because it was the admin key for the account. So that entire business literally replaced their website with we have gone out of business, sorry, and they were out of business the next day. Like that is actually a real thing that happened. So security issues are somewhere between bad and your business is now over, go find a new job. Even if it's not that bad, security issues, especially in places where there are laws around disclosing being hacked, like in the US it's not super even, it's like a state by state thing, but like in California, which matters for a lot of tech companies because if they have some corporate existence in California, this law applies to them, you actually have to inform every single person whose information might have been stolen when you get hacked. That means lawyers, that means having to figure out how to contact hundreds or thousands or hundreds of thousands of people and it's just like a gigantic problem is a nice way to put it. So updating is hard work. I totally get that. I experienced the hard work myself, it sucks, but updating is worth it because updating like insurance gets you something that takes a gigantic disaster into something that is not actually a complete disaster and then you can do things like sleep at night because you don't have to find a new job, which is great. So that covers security issues with other people's code. Now let's talk about what happens when you find security issues that aren't actually causing critical security updates yet. So we're developers, we use other people's code. Chances are really high that while you use other people's code at some point, you will find a problem with other people's code. Anybody who's never found a problem with other people's code, raise their hand. Okay, that's what I thought. So if the problem that you find with someone else's code is maybe a security problem, what should you do about it? Well, fortunately, we don't have to try to figure that out. Software developers and security researchers and companies that sell software for the last several decades have been engaged in a kind of low level argument slash war about how security issues should be reported and they've kind of hashed out something that is considered the best practice for a software developer who finds a security issue. So that's what I'm gonna talk about. It's called responsible disclosure. It's, as I said, it's kind of worked out from years of trying different options. It is not super great except everything else is worse. And it's the best thing that we've come up with yet because although everyone involved in the situation usually ends up unhappy, everyone involved in the situation hopefully does not end up screwed over. So responsible and disclosure. I'll talk about disclosure first. Companies hate disclosure, right? If you announce that your software has a problem and isn't perfect, that's like companies are like, no, no, that's not okay. We can't tell people that we make not perfect software. And companies are really motivated to make sure that problems with their products aren't publicized, right? If they can spend money or spend money on lawyers to sue you to make sure that no one will find out about the problem, it's actually often worth it to them. And then there's the responsible part. Security researchers really hate this part. Responsible disclosure means that you don't say, hey, I found the security issue, aren't I so cool? And you put it on the internet. It means that you go talk to the company and you say, hey, I found the security issue. There's a generally accepted amount of time depending on how bad the issue is and what company it is, usually between 30 and 90 days. And you say, hey, I'm gonna give you this window. At the end of this window, if you haven't made an agreement with me about when you're gonna have this fixed, then I'll make it public.  And that's basically what security researchers do security research for as far as I've ever been able to tell. So everyone ends up unhappy, but hopefully nobody ends up screwed over by it.  Some companies are trying to change the equation of security researchers being really unhappy by saying, hey, we'll pay you money to reward you for finding this and then you can talk about it, but we'll only give you the money if you don't talk about it until after we fixed it. Which is cool, like maybe everyone ends up happy, that'd be great. So here are some examples of what companies do. Google, for example, has a very clear application security researcher slash reward policy. They rank how big a security issue is and then they issue an award somewhere between $120,000. Last time I checked the max was $20,000 per issue. But I mean, don't let that stop you. There was one guy who reported three bugs in Chrome at one time and cut a pad of $35,000. Google actually, so far this year, that might be last year, but yeah, lots of money going to security researchers. This is actually a thing that is totally working out for Google. Other companies explicitly provide responsible disclosure guidelines, but what is this? This is, oh yeah, this is the payout schedule. It's, I feel like someone thought that they were just so clever that they set the low end of the scale to one, three, three, seven dollars. Anyway, there are other companies that have really explicit agreements about responsible disclosure, but then state that researchers will not be given any money. I'm not sure why companies would decide to do that, but they definitely exist. Other big company examples who are willing to payout include Facebook. Facebook has kind of a similar bounty setup to Google. They say if it's an actual security bug, they will give you money. It will be at least $500. The highest payout that I know of that Facebook has issued was I think like 40 or $50,000 for a single bug. It was a really bad bug. There's other systems that are kind of like semi-alternative, GitHub has set up like a bounty slash game center leaderboard for security issues. You can earn points for finding bugs in GitHub. They give you both points and rank you on a leaderboard and give you t-shirts and give you money. Works for GitHub. Oh yeah, they don't explicitly say whether they'll give you money or not, but they definitely have paid a lot of money to people who have found bugs in GitHub. Where else was I going? Oh yeah, Engine Yard is one of those companies like I was talking about a minute ago where they have a policy, they explicitly say $0, ever. So if you find security issues to re-sum up, talk to the company whose code, if it's a company, definitely talk to the company whose code you found a security issue with. Try to make sure that they know what's going on. So, right. If you find a bug, back to your work as a developer, once you have the bug, stop, think for a second. There are two questions that you can ask yourself that are really straightforward that let you know how to handle the bug that you found. The fact that it's a bug means that something isn't working the way it's supposed to, but the thing that makes it a security issue or not is can you get to something that doesn't belong to you? Can you see someone else's information? Can you change someone else's information? Can you cause problems for people who aren't you? And second, can you disable something for people who aren't you? This is like an entire class of attacks that mostly get called denial of service even though they're not like a distributed denial of service attack like what happens to GitHub every couple of months. They're an attack like when symbols used to not be garbage collected and you could just send requests to a rail server in a loop until the rail server died and locked up and you couldn't do anything. So, if the answer to either one of those two questions was yes, then you should go talk to whoever owns that software before you go out onto the internet and say, hey guys, I found this problem. Everybody, you should attack it. That's what happens, right? Even if you don't actually say that. There are people who pay attention to stuff on the internet looking for new problems that they can use to attack things. So, contact an author. Even if it's a false alarm, the author will be able to say, hey, that's not actually a security issue but thanks for letting me know and then you can go talk about it if you want. But if it is a genuine security issue, it's a really good thing that you checked in with them before you went and announced it publicly. It means that they have a chance to fix it and it means that everyone else can potentially have a chance to upgrade to the version that's fixed before there's a script that you can download that lets you auto-hack anything with that flaw. So, if you go to report, if there is a company behind it, definitely go talk to the company. Most companies, as we just saw, have specific security reporting guidelines. If it's not a company, check the read me, check to see if there's a security policy. If there's not, just check to see if there's at least an email in the gem spec of the gem that you can send an email to. Sadly, sometimes there's not even an email in the gem spec, but find the repo on GitHub and see if there's an email on the author's account on GitHub, just try to get in contact with them somehow. Definitely try to contact the author if you can. If you can't contact the author or if you try to contact the author and you don't get any response at all even after waiting for a couple of days, then you have to kind of make a decision. What are you gonna do about it? So, I'll talk about that in a second, but ultimately when you're talking to developers about security issues, please try to remember that those are also developers and you could be on the other end of this at some point with your own code. Have empathy with the other person. It is not their primary job in life to fix the security problem that you found. Try to figure out a solution that means that they can fix their problem and that you can get credit for it that doesn't involve anyone having to be vulnerable to attacks. Most authors, most of the time will say, hey, I really appreciate that you let me know about this, I have figured out how to fix it and I'm going to announce the fix and let's announce the bug and the fix at the same time and then everyone can upgrade and it should be fine. That is actually really fortunately the most common thing that happens. But in the worst case, you won't be able to get ahold of the author. The author will have disappeared. You can just stop using that gem. I've done that a couple of times. If there's some other option that you can use that does have a maintainer or that you can take over maintaining instead, I've done that. But you could also just fork it and fix it yourself and be like, hey, I fixed the security problem in the version that you have and then start using that. At least then you don't have the problem. So, that in, I guess not that short of a summary is responsible disclosure. And last, I want to talk about what happens when you have a security problem in one of your gems. So, maybe show of hands. How many of you have ever written a gem that is published on RubyGems? That's a pretty good number of hands. How many of you have written Ruby code that's on GitHub that other people can use? Even more hands. Okay, cool. So, this actually applies to all of you. Even if it's not a gem, your code is a security vulnerability for someone else waiting to happen. Hooray. You know, unless your code is perfect. In which case, I'm sure everything's fine. So, there's three people who find problems with your code that you'll have to deal with. Three kinds of people. The easy one is someone like you. They say, hey, I found this problem. Maybe we can get it fixed and then announce that it was a problem and you can release it. That's totally the easy case, right? You fix it, you release it, you announced there was a problem, but now it's fixed. Everyone's happy. There's a medium hard one where the problem is already out there and people are already maybe already figuring out how to use it to do bad things. In that case, if you can announce it without making it even more dangerous for the people who already have the problem, do it right away, but fix it. Like, that's basically the answer always, but in this case, it's even more important because people might already be having problems as a result and then just announce it and basically everything's fine. The hard one is when it's a security researcher who's like, I'm amazing, you better fix this, I wanna talk about how cool I am. So, if and if you run into a person like this, I'm really sorry. There are definitely people in this room who've had to deal with this kind of security researcher possibly many times, Aaron. And so it's really important to respond soon enough that they know that you heard them, which usually means within 48 hours, 48 business hours. It's really important to tell them what you plan to do and it's really important to let them know that you're still working on it if you're still working on it. Security researchers will usually wait until they haven't heard from you for two or three days and then say, oh, you haven't told me anything, I guess you're not fixing it, I better go tell everyone in public now. That totally sucks, be careful. Ultimately, if you own code, make it as easy as possible for people to let you know if there are problems with it so that you can fix it. Put your email or an email that people who use the gem can use to contact you in the gem spec, put it on GitHub. If you're on a team, have a security address for that team, write a security disclosure policy even if it's just like one paragraph of like, please let us know, we will thank you, we will fix it. Yeah, that's basically the plan. So I created a mailing list specifically for gems that have security issues. There's a Rails only mailing list for security issues, but there isn't a mailing list for Ruby and Rails and Bundler and gem whatever, or there wasn't until I created this one. It's a Google group, you can subscribe to it, that's the address, and the Rails team and lots of other gems send all their security issues there so you don't have to like track down individual security announcements for gems, you can just subscribe to that one. Ultimately, I hope that if we're all paying attention, security will become just kind of like a background thing that we all know how to deal with and that's when we can go shopping. Thanks. We have any questions for Andre? Thanks for the great talk. So our team uses things like Breakman or like Rails practice. What do you think about them? And also are there any automated ways of like running these gems and then automatically updating them? Do you think that's a good practice? Some automation tools for security patches, thanks. Sure. So definitely, I think Breakman is a super valuable tool because it watches for things that you can do in Rails that create security holes. It's kind of unfortunate that it's so easy to potentially create security holes that you can find them by running a regular expression against the code base. But Breakman's good at finding them and for sure using code climate integrates Breakman if you use that or you can run Breakman itself against your code base. That definitely protects you against the set of like really obvious things that Breakman knows about. Definitely keep in mind that it is very, like it's not actually even hard to write a security issue that Breakman doesn't know exists. It's not a fix for everything. It just protects you against some of the like well-known things that people have done a lot in the past. As for updating things, it is possible to get a list of outdated her, I guess, a list of updates to all of the gems that you have in an application just by running the bundle outdated command. That will at least tell you if you're behind. It's harder to know if there are critical security updates in those changes. There actually isn't any super good collection of like here's what changed and that you can easily read. Ultimately, it just kind of comes down to an ongoing, again, actual amount of work and doing things like subscribing to the security list so that you know if there is like a big critical security issue, you can at least know about that. And then just kind of like over time look at one outdated gem, spend a few minutes on it. Sometime later, come back and look at one more of outdated gem and be like, well, do I need this update? Is it gonna break things? Does it work? Do the test pass if I upgrade it? Cool, let's do it. That's pretty much the best that we know how to do right now. Any other questions? Over here. Yeah, so actually I really love Ruby gems. I think it really helps projects. I write gems and maintain some of them myself. But when we are on a project, we can easily see that big long running projects have like easily 50 to 100 gems. As the maintainer of Bundler and do you think it's a problem? What's your take on it? I guess there are a lot of applications that use 50 or 100 or 200 or I've seen applications that use 400 gems and as the author of Bundler, I'm sorry. It's trading one problem for another, right? You were able to spend a lot less time doing things by using those gems, but using those gems means that you have to spend more time doing some things like upgrading those gems when there are security problems. Unfortunately, we have yet to discover whatever it is that makes the computer actually do it for us. I'm waiting for Matt's to ship that in Ruby 3.0. But in the meantime, decide if it's worth the trade off. If what the gym does for you is actually like gives you a single function that you could write in five lines, it's probably not actually not worth keeping the gem because then you don't have to pay attention to security updates. If the gem implements an entire login system and has active maintainers, like that's probably worth it.  It's a trade off. I know you mentioned that there isn't really a good place online to find out about it. There's something called the Ruby advisory database, which is off the hub that is trying to track all those. Is there any other plans to kind of maybe like a see a life of bundle is like bundle security outdated or something? I don't have any explicit plans to add bundle outdated security, but that actually is a pretty good idea. If somebody wants to submit a pull request, let me know. I would be interested in bundle outdated security. Yeah, for sure. Great, thank you so much, Andre. Let's thank our speakers again.


Hey guys, it's MJ the students actually and I've just read something that might be the very first indicator of another financial crisis For those of you who don't remember back in 2007. We had a pretty big major Your world recession. What was happening was that banks were making loans to What they called ninjas people who had no income no assets no job if you use that as a literation You get the ninja So what they did is they made a whole bunch of these ninja jobs and then someone at like these banks like Goldman Sachs Liam and brothers all of these they were like, we've got a great idea What we'll do is we'll take these loans and we'll do a little bit of chippity choppity And we'll repackage them and sell them off at triple a you know securities to pension funds and all these other institutional investors And it was pretty successful. You know people bought it. They got more money They lent it to more ninjas. They took more money. They did more chippity choppity They kept selling it and this went back and forth back and forth until you know the bubble burst because none of the ninjas Actually repaid the loans which means institutions may system get any money back and the whole house of cards came crumbling down We have a credit crunch and the world went into a recession and it wasn't a very pleasant experience for humanity But what the American government did is they stepped in and they were like listen here We're gonna buy all these toxic loans You know these loans that aren't paying back any money. We're gonna come by them We're gonna do like a little injection of cash and we're gonna try and save the economy and in a sense I mean the economy continued to working we didn't go to complete anarchy. So They kind of did a good job. They saved us from from, you know, something terrible that could have happened But now fast forward 10 years into 2017 and I read an article that Goldman Sachs It has got this business plan someone there's like guys I've got a brilliant idea. What we're gonna do is we're gonna go back and we're gonna buy those toxic loans we're gonna go buy buy the loans that cause the chaos and We're gonna do a little bit of chippity choppity and we're gonna repackage them and we're gonna sell them back to institutional investors And I'm reading this and I'm like wait You want to go and buy the toxic assets and this is what they're saying. They're gonna take them They're gonna restructure them. They're gonna close up on some of the mortgages. They weren't paid or they're gonna restructure They can extend it or they're gonna do all their little financial wizardry and then they're gonna resell these loans back into the market So these toxic assets which caused the 27 2007 crisis are now getting purchased and restructured and being sent back into the market and I don't know about you, but that sounds a little bit crazy and it's one of those things where greed goes too far where But we allow greed to come up with these really crazy and creative Instruments that could potentially, you know in the financial world I know I'm being a little bit dramatic and for any of you who are interested in what I mean by the chippity choppity of financial instruments I did make a YouTube video called how to turn your friends loans into triple a securities it wasn't a very popular video and Which is probably a good thing seeing that I think doing that is illegal Unless the government gives you permission to do so But I will put a link in the description below although you probably y'all shouldn't watch it because it is illegal But that's for all of you who want to know what that chip each operating is is all about But the main part of the story is that these toxic assets that caused the world crisis the world financial crisis are being reintroduced into our markets and Yeah, I think that's pretty crazy and something that we need to keep an eye on Because we don't want this to go out of control. But anyway, that's just a little quick update of some crazy stories I've been seeing on the internet. I'll let you know if I find anything else But anyway, also feel free to leave a comment in the comment section below and I'll see you guys soon. Cheers


another Narx Fiver live video. I just managed to get on the beach here and it's just not raining. If it's raining all of this time I managed to do a quick tip talk as well. You know I'm a bit on the beach, no rain right now let's see what I'm going to last and I'm going to be talking about in this one how the Narcissist will never let you go. Because yes this is a thing with a lot of Narcissists, especially where you are their grade A source, you're their primary source of supply. They can be very possessive and controlling, where they just can't meet you alone. And this can be a very horrible experience to go through. Just when you're in a very toxic and abusive relationship, I guess we'll point where you just want to let it go. You want to leave it behind in the past, if you grow to it. You still want to be involved in them anymore with everything they've done to you.  Maybe you've met someone new, you're happy, you're in a new relationship. The Narcissist just can't leave you alone though. They just can't let you go. You don't understand why.  And the priority here is that no they don't. What you need to understand is that their entire identity revolves around controlling you and keeping you in a safe situation. Entity revolves around you. So take you out of the picture. What are they supposed to do with their lives? Everything revolves around you.  Everything revolves around you. They're probably logging on to your social media, seeing what you're posting, seeing where you are, who you're with, what you're doing. And if it's anything that doesn't tie in and support this identity, this false identity that they have created revolves around controlling you. If it's not anything that doesn't revolve around them, they will try to sabotage it. But it's getting in the corner because it's getting really cold. But yeah, if it's anything that does not support their false identity, their false sense of self-esteem, their inflated fragile ego, if it doesn't support that, then they're going to want to destroy it. So you may have moved on. You may be in a new relationship. You may have tried to just forget about them.  They're spreading gossip rumors about you. They're starting a smear campaign. Maybe they're even trying to communicate with your new partner. They're trying to brainwash them and tell them all of these bad things about you. They're making up all of these lies to try and ruin your new relationship.  And that is why they can't let you go. Because if they let you go, what are they meant to do? How are they supposed to live? They're using you to regulate their emotions. You are their source of supply.  It's kind of hard to let that person go. I mean, I know exactly what that's like. I've had relationships, especially girls that were much younger than myself. There were a few girls that I was with where they were virgins. And two in particular, where I was actually their first kiss as well. So you can imagine, I kind of felt like almost like this is like my possession, like this person belongs to me, even though, of course, I'm not actually a narcissist myself. I do consider myself to be an empath. But just as an example, even in that type of relationship, I can honestly say it was very hard for me to let them go. It really was. It took quite a lot of time. And again, we just have to accept it. The healthy person, you're not going to try to control them. You're not going to stalk and arrest them. You're not going to start a smear campaign. You're not going to try to get them fired from their job, affect them financially, try to sabotage their new relationship. Normal people, they won't do anything like that. But with a narcissist, it is far more extreme. They just cannot stand it. The thought of you moving on, where they're no longer able to control you. It just destroys them. Their false self, their false reality, the false narrative, because they've made this entire narrative around you.  Well, if you move on and you develop a healthy relationship with someone else, that just completely destroys their narrative. It just crushes their smear campaign. As long as they can keep you alone and they can isolate you, they can say whatever they want. And people will believe it because you're alone. You're on your own. So they can tell people whatever they like. And it makes you look very distrustful, very suspicious when you're always alone. So it works for them that way. The problem is when you have support, when you have someone who's on your side, they're in your corner, it just makes it even more difficult for them to control you, unless they can turn your new partner into one of their flying monkeys. Because that's what they will probably try to do. If they can't prevent you from moving on and beginning a new relationship, then they will just try to turn them into one of their flying monkeys and use them against you. That's just how second-twisted they really are. They do not want to see you moving on and building your own identity outside of them, outside of their narrative of you. They want everything that you do, everything that you experience in your life to revolve around them in some way. And why do they want that? Well, they want that because their life revolves around you.  They wake up in the morning, they're probably on your social media, looking at your posts, trying to see who you're talking to.  They're probably last thing at night as well before they go to sleep. Some of them may be up all night, looking through your social media.  And they become very paranoid when they're stalking you. They're always, they've always got to be two steps ahead of you. They're always worried, anticipating what you might do next, where you might go, who you might meet. They're very controlling. It's because it resurfaces those insecurities.  So anytime you do something that's outside of the character that they have induced in you, anything that might threaten their false self and their false reality, they suddenly start to feel very insecure and they will become very controlling to try to restrict or continue. Because it could be a serious threat to how they perceive themselves and how they feel about themselves to their false image. So that's why they just cannot let you go. And many narcissists will hold on to you for life because you're always that source of supply. You're always like this measuring stick, this reference point for them to where they feel like they've conquered you. They've broken you down. They've made you into nothing but a shell of the man or the woman that you once were. And that's like their achievement, their accomplishment. They like to look at you, return to you now and again, to just admire their work of how they conquered you. They broke you down. And many victims, they stay like that. They stay in that state for the rest of their life. They never move on, they never change. They stay broken down. They never get better. And that's kind of the whole point. That's why the narcissist does not want to let you go. They want to keep you in that state, in that condition where you can continue to supply them and make them feel powerful and significant to you in your life.  They had a loss in effect because that's what they're looking for. It's significant, relevant. The problem is when you try to move on, like they may have left you in the rubble in a ditch, but when you start trying to climb out of there, and you're crawling back onto your feet, you're no longer dependent on them. You no longer need them. They're no longer significant or relevant to you. And then it's like, what are they supposed to do?  It's what makes them feel like nothing is wrong with them. If they can project this on to you. I mean, in their minds, it's normally a state of chaos and disorder. But if they can project that on to you, it makes them feel a lot better about themselves. So that is why they will often like to do that. I know it can be very hard for you. Those of you who are going through this, I know it's not nice. After everything you've probably been through with, they abused you, they controlled you all of this time. 110 live viewers, please give this video a thumbs up down below if you find it helpful. Thank you.  Because that's all that it's really designed to do. The truth is, they can't let you go because they can't accept the truth that you are greater than them, that you don't need them, that you're going to be so much better off without them, that you can develop a healthy relationship with someone else outside of their control. They do not want to accept reality because if they were to accept the truth and reality and let things play out naturally, that would not be favorable for them. That means, I mean, let's just entertain this for a moment. Just think about this. If they were to let you go, just let go of all of the control. That means you could just move on, build a life for yourself. And there's really no limits to what you could accomplish. You could find your dream job, you could have a successful business, you could get married, have a husband, a wife, children, a family, you could do all of these things if they were to let you go and you're outside of their control. But what about them? That's not going to change anything for them. They're still going to be crazy. They're still going to be disordered. They're still going to be miserable and unhappy. And they're never going to experience peace, happiness, joy, nothing. They're never going to have anything good in their lives. They're never going to have a healthy relationship. Now you see, now you understand why they cannot let you go because you're going to be over there as the best version of yourself, living your best life with your family, your business, your home. And they're going to be all on their own, miserable, just looking at you with your family, smiling, happy, having a great time. You think they just want to watch that for the rest of their lives? You think they really want to see that happening? They're miserable enough as it is. Even while they still have you in their possession.  Let me just look at it like this when they pretend to move on and they've got their new supply and flaunted it on social media. These four smiles, these fake laughs, they can dish it out but they can't take it. I can promise you that everything they put out, everything that they do in an attempt to hurt you, to punish you, to try to make you jealous, that is what hurts them. That is what someone has done to hurt them in the past. We just have to hurt them unintentionally, but either way, whatever they're putting out to you, that's what bothers them the most. They can dish it out but they can't take it. They do not want a taste of their own medicine.   To see you doing what they do to you, when you're going on social media, you're taking selfies, but for you it's real.     Two people together who both love and care for each other. No doubt that would be a very successful relationship, marriage, family. No doubt about that at all and they're already aware of it that yes, you do have the power, the ability to care about someone for real, something that they cannot do and by this point they've probably realized already the fact that they have this inability to actually care about people for real. Of course, at some level they do realize that that is kind of the barrier, the reason why they can't establish or maintain a healthy relationship or even hold down a job. Of course, yes, somewhere in their minds they are aware of that and they already know it's so easy for you. If they were to let you go, you could just move on. So easy for you to find someone like yourself because like attracts like. You could find someone like that so effortlessly and many of you, your hard workers, I mean, that's where they picked you. You did all of the work for them. You could quite easily move on with someone who cares about you and loves you and you love them. You get a good job, maybe you start your own business, you buy a home together, you have a family, a marriage, something that narcissists cannot experience. Yes, they do try. They have this false image. They make it look like they have the perfect family, perfect children, perfect marriage. Yeah, they put it all on social media. It looks great. But in reality, we all know it's nothing like that. We all know it's fake. We're just pretending. They just put on a show to look normal. Here's the thing. If someone is really happy with themselves and happy with their lives, they're happy with their partner, with their family, with their marriage, with their whatever it is that they have. They're really happy with that. Of course, they're going to be happy for you and they are going to want you to move on and to be happy. Of course, yes, they are going to want that, but they do not want that for you. They do not want to let you go. They do not want you to move on. And it always comes back to the fact that it's because that they are not happy. They're not happy with themselves and their lives, no matter what it is, that they're showcasing to you that they're flaunting on their social media. It doesn't matter. Quite clearly, they're not happy with it. Quite clearly, it isn't real. If they had something real, they would want you to have something real. If they were happy, they would want you to be happy. As with and so without, how a person treats you, it is a direct reflection of how they feel about themselves.  They cannot let go of the false self, which is tied to you and revolves around you. It revolves around how you're doing, where you are, who you're with. Just revolves around your situation and your life. If your situation or your life changes, it impacts them. It affects their false identity, which they have built to revolve around you because it's tied to you. It's all tied to their self-esteem and their inflated ego. That is why they cannot let you go. I mean, they would at least have to have a suitable replacement for you. And that would be very difficult for them to find someone else like you. Because you're just a very caring person. You're very empathic. If you find this video helpful, don't forget to hit that thumbs up button down below. It helps the YouTube algorithm to get this very important message out there. But I'd like to hear from you down below as well in the live chat. Let me know about your situation. What's going on with you? And then ask, they're not letting you go. They're not letting you move on. They're not letting you begin a new relationship with someone else. Let me know in the live chat down below. I will read it out and respond to you. Charity Udoka says I'm now a happy person. And Paris Marie as well says I'm raising my virations. Happy to hear that. These positive comments. You know, that's what I want for one of you. But as I've said it before, even for my exes, that would be great to hear that they have actually moved on. They are in a healthy relationship with someone. Of course, the reality is that's unlikely to happen with narcissistic people. Just look at how they treated us. But it makes me happy when I see that other people are happy for real. I mean, it's mutually beneficial. When people are happy, they want you to be happy as well. Amy Lynn. I'm glad you like my work. Henry Torres is sending love from NYC. I've never actually been to the U.S. at all. But I guess at this point I'm in Japan right now. So I'm probably not too far away from the U.S. I may be closer to there than the U.K., I think. J.S. says I'm in no contact, but he is still at me. Yeah, this is what they do. Very possessive and controlling. Always stalking and harassing. Because it's their false identity. It's tied to us. That's why they're so controlling. Because anything we do that is outside of the false character that they have assigned to us, that threatens their false self. That's why they get so insecure and they get so mad when you try to go off and do things on your own. That's why they don't like it. Because their false identity is tied to you. There's no separate existence of their own outside of you. Even when it looks like they're moving on with someone else, usually that's just to hurt you to make you jealous. Or it could be to make someone else jealous. Whatever it is, their identity is always tied to other people. It's never a self-identity from within. It's always dependent on how other people act or behave or what they do, where they go, who they're with. Very rare that I've asked that question. Paris Marie asks, are you having fun? I guess right now I am just sitting in the car, looking out at this beach. I find that at this point in my life, 34 now, I tend to have the most fun when I am alone. Difficult to find peace around other people. What I really hope is that I could meet someone who's maybe shy, introverted, quiet and peaceful, a good listener. Doesn't have to be someone who is especially attractive or impressive in any way, just a regular person. Yes, that person could be very special to me. But until that time, just being alone, yes, that is fun for me. And generally, I am actually happy most of the time. Didn't always used to be that way for me though. A few years ago, I was suffering from depression. Before I found my purpose and created this channel, DruidVW says we are not their drug of choice, not anymore, not ever again. That's really it. I was watching a video by Sam Vakinen just the other day and he compared narcissistic supply to Coke. It's no different to these cocaine addicts. It has very similar effects on the brain, the addiction. And that's what we were to them, this drug. They have this dependency on us. They're heavily dependent on us thinking, feeling, acting and behaving in a certain way, in a way that is predictable or controllable. They're dependent on our emotional responses or reactions. And as I said, it's to maintain this false sense of identity for themselves. That's all that it really is. They need us far more than we ever needed them. But they had to manipulate us, trick us, deceive us, future fake, lie, to keep us stuck, to keep us holding on. So that we could continue to provide this emotional regulation to them when we're feeding their ego, making them feel important.  So that they are able to keep us around to do that. But the reality is, if you really take a step back and look at them, they're not really significant or relevant to you in any way. They just tricked you into misinterpreting or misperceiving them or something else.  None of that really has anything to do with them anyway. They were never really about that. For real, that was you. That's who you are. And they just steal it. They reflect it back to you. So that it keeps you locked in, it keeps you stuck, which is what they want because their false identity is tied to you. Maricela Burns says, will stay with me even if he has to pay $3,000 a month as my roommate. Even though we are not together, he gets controlling of me. Weird, but living with him is horrible and not worth it. Why? Yeah, that's just it. They're very possessive and controlling of you.  You're not happy. And that just shows they don't really care about who you actually are. It's all about just keeping you down, keeping you stuck so that you can provide a false sense of self for them, for them having the ability to control you. They don't actually care about your feelings, desires, wants and needs.  It's all just manipulation and deception to prop up their false self and the illusion. That's what your purpose is in their false reality. That's what they use you for as their object, as their possession. That's why we remain tied to them in this trauma bond and we're miserable. We're not even happy. We just want to get away from them. But they won't leave us alone because often and only to you the entire time they viewed you as an extension of themselves.  So you need to be a certain way. You need to be in a certain condition, in a certain situation so that they can feel like they are who they desire themselves to be. If you're going off on your own and you're doing what you want, that affects how they see themselves, how they feel about themselves, how they perceive themselves and they don't want that to happen. They have to control you so that they can control this image and perception of themselves. Of how they see it in their minds. So that's really it. I really can't go much deeper than that on this topic. I mean, that's what it really is. They won't let you go because it's a stain in this false sense of identity for them. It's feeding their ego, propping up their false self and the illusion. This false image that they've created for themselves where they are all powerful, significant, relevant, attractive and desirable or whatever else they deem to be a source of power for themselves and it regulates what would otherwise be their very low self-worth and self-esteem because they're very insecure and that's really as deep as it goes. That's really all that it is if they had their own separate identity of their own which is not connected or tied to you and they could regulate themselves. They had fair amounts of self-worth and self-esteem. They weren't so insecure. Then they could just let you go quite easily. It wouldn't be so difficult for them because they wouldn't be so heavily dependent on you as their life force, as their life support. It wouldn't be that important to them but this is why it is important to them and they can't let you go because of their low self-worth and self-esteem because they have no real separate identity of their own. Their false sense of self is tied to you. That is why they cannot let you go. And if you ever did get away, if it was outside of their control, they may just attempt suicide or take it out on someone else or if it is within their realm of control then they will come after you. They will track you down. They will try to sabotage your new relationship. They will try to get you fired from your job, target you financially.   So that is it. That is as deep as it goes. At least at this point in my experience and research, maybe in a few months, one year, I will be able to go even deeper into this but for now, this is as deep as it goes for me. This is an arch-survivor role. As deep as it gets, it can't get any deeper than that. If you found this video helpful, it is very important for you to hit that thumbs up button down below. Helps the YouTube algorithm to get this very important message out there to other survivors. So if you want to help other survivors, other victims of narcissistic abuse to receive this very important information, all you've got to do is hit that thumbs up button down below. It will take you two seconds and let me know your thoughts about this video in the comment section below. As always, I am reading your comments every day and don't forget to hit that subscribe button and click all notifications so that you will be notified of my videos when I upload them. And if you would like to book a one-on-one coaching session with me, just head to my website, it is NarcSurvivor.co.uk. You can also follow me on Instagram. My Instagram is NarcSurvivor YouTube. You can send me a message on there. I will reply. I post new pictures and videos of my travels every day on my Instagram. So follow me on there. It is NarcSurvivor YouTube. All right, that's all for this video. I'd just like to thank you all for joining me. I do appreciate your support. And as always, I look forward to talking with you in another video very soon.