I'm Aaron Campbell. I really enjoy driving. Like, I definitely love sitting behind the wheel of a car and spending a lot of time on the road. As a matter of fact, just recently I traded in my last car for a new one, had put over 110,000 kilometers on it in the last two years because I really like to drive. And I like to drive kind of fast. I definitely have some issues with tickets because of that. But I learned to drive as a very young kid out in the deserts just outside of San Diego, California. And out there I could drive as fast as I wanted. And I definitely kind of got the taste for that before I got my license and had to deal with the rules of the road and all that. So as I was trading in my car recently, it would have been fun to trade it in for something neat and fast and even kind of reminiscent of the fast cars when I was younger. This is a Pontiac Fiero. They're fun to drive. They are fast. They look neat, especially if you like that era of car. But there's a problem with this car. It is not safe at all. As a matter of fact, it's not even crash test issues. This car will light on fire while you're driving it. There is a problem with it. Not safe at all. Literally just using it for its intended purpose, it could light on fire and burn down. But you could go all the way to the opposite extreme as well, right? This is an M1 Abrams tank. This is safe. This also weighs like 65 tons even without the gun. It's like eight meters long. Not especially maneuverable or useful for what I would want to use it for. This is not going to get me to the grocery store unless I'm okay with just running over some other cars on the way there, which I'm pretty sure is against the rules. So I end up with something between these. This is my car that I just got. There's a balance, right? And this is the right balance for me. It's useful. It gets decent mileage. It fits my whole family. This is the right balance. It also has five-star crash test ratings. It's very safe. It's safe and it's usable. And this is what a lot of what the security team does. We try to make WordPress safe and secure without ruining its usability, without making it so that you can't use it for the purposes that you want to use it for. So while a lot of people picture the security team and kind of picture the geeky digital equivalent of these, the way I picture our security team and the way it kind of feels being on it is a little bit more like this, right? I kind of feel like we have to be the masters of balance. Can we get this thing to... How secure can we get this thing while still making WordPress not only useful, but easy to use, right? We could obviously make WordPress perfectly secure. We just delete it, right? If it doesn't exist, there's no problems. If you unplug it and don't put it on the internet at all, pretty darn secure, but also not very useful. So we have to find that in between. Likewise, believe it or not, as I go to smaller meetups and stuff, some of the stuff that people are always frustrated with is having to log in, needing a good password, these kinds of things. Well, sure, it'd be easier to use WordPress if you didn't need a username and password. It would also be ridiculously insecure. And there's this middle ground that our team is always trying to find that perfect middle ground. So now on to our team and what it actually looks like. First of all, we're distributed. We have over 50 people, so we're decent size. And we're distributed all around the world, US, UK, Australia, Italy. I honestly, we have a lot of people all over the world. And I think that this is important not only for basic things like response times, but also for diversity and views. Finding that perfect balance, that perfect middle point. You can't have everybody sort of viewing things exactly the same. We also represent many different companies, which is, again, I think important for that diversity. If everybody on our security team worked for one company, then we would only have sort of the outlook of the things that affect that company. Instead, we have representatives of hosts, including Bluehost, Dreamhost, and GoDaddy. We have people from security teams like Securi on there. Automatic has people on there. There are people that run their own companies that are unaffiliated with any other companies. And I think that that's healthy because what we're doing is trying to figure out that perfect middle ground, and we need those opinions. And moving beyond the team to try to give you a little bit more understanding of how we work and what we do. A quick peek at our tools. We now use Hacker One. This has been fantastic, but is also pretty recent. Who's used Hacker One for anything before? Yeah? It's a great tool. Before Hacker One, we had basically a mailing list. You would report an issue to security at WordPress.org, and that would send an email to our whole team, and hopefully somebody would reply. But, you know, we all deal with hundreds and hundreds of emails a day. It's easy for stuff to get lost. That way with Hacker One, things don't get lost, which is pretty fantastic. It gives us the ability to communicate back and forth securely and easily with reporters. It gives us the ability to see when something hasn't been responded to recently. It's even given us the tools to help reduce the noise. We do get a lot of bogus, of invalid reports. This lets us filter through those faster than we used to be able to, which saves us time, lets us spend our time actually fixing the real issues instead of constantly sorting through to find those real issues. We also use some other tools that you will probably be familiar with. We use Track. We have a private security track that only the security team has access to, but we use it just like the core track is used. We use it for discussion around an issue, for uploading patches for other people on the team to test, all the same things that you see on the core track. And we use Slack. We have actually quite a few Slack channels, believe it or not. They're not public, so they're not visible, but we have a security Slack channel that is kind of our core channel. We also have a security hosting channel that lets us have access to security people at various hosts, and that's another kind of permanent channel. And we have a way of spinning up new security channels for any given issue. We have actually a slash command built into our WordPress Slack instance that lets us spin up a new channel in order to invite people in that are only needed for one specific issue. We can discuss that issue. We can close the channel when we're done. And so we use Slack a lot for that kind of discussion. So the life of a bug or a security report or whatever you want to call it. Obviously, first they're reported for us now. This is coming in through Hacker One. Again, that's been much more effective for us as far as being able to filter through things and get to what we really need. After this, after it's reported, it gets triaged. Most reports die right here. Most reports, this is the end, because we still get more invalid reports than valid ones. So this is where we check to make sure it's really an issue. Sometimes this might involve some back and forth with the reporter. We say we need more information or we couldn't reproduce it. Do we need a specific browser? Do we need a specific setup? This kind of thing. And sometimes it's just that we know that this isn't valid and we can simply give them a canned response that says so for things like people reporting that you can do cross-site scripting as an admin. You can put JavaScript in your post. Yes, you're an admin. You're supposed to be able to do that. Again, we have this balance between making WordPress useful and making it secure. And we could not allow admins to put HTML in their posts, but that wouldn't be very useful. And so we basically have a canned response that explains why, as an admin, you're allowed to do that. So most tickets die right here, but not all. Some of them are triaged in as valid. And at that point, we make a track ticket on our private track. And we move to there. The track, just like core track tickets, that's where most of the discussion around how we're going to fix it works, how we're actually going to make the patch, which is kind of the next step. So some of that discussion happens in Slack, but we keep track as kind of the canonical place for all that information. So if discussion happens in track, we link to it just like we do in the core track. Once a patch is made to fix it, similar to most of the developers at any company, we move on to sharing that patch around and testing it. But one of the neat things that Hacker One made really easy to do is also looping the reporter back in on this, passing the patch to them safely and securely, which is nice and easy with Hacker One to let them test it as well. And this is great because if there was any miscommunication on what the actual issue was, or maybe they saw more vectors that they thought were obvious, and so they listed the one but saw several, we may not have seen those same ones, letting them test it and say, yes, this fix is every attack vector that I had seen as well has been really useful. At this point, a lot of times there's iteration on that to fix anything else. The reporter, the hacker, they can go about trying to find a way around our fix to make sure that our fix really is a complete fix because if there's anything that we don't want to do, it's push out a fix that turns out to only be a partial fix and everybody notices, hey, there was this security issue and it's only half fixed, so now we can use that gap. Did I see a question over here? Yeah. At what point, at what step, you say that it's a low, middle, or high-risk bug that it's going through to a patch? Because this is something I see when there's like Google security teams say to Windows, you have a problem months ago and then they're doing nothing and then they reported public. Now Windows says, why and how are we discussing what happened? But then it's out and it's, for them, it's not a good reputation, so how do you handle this here with the bugs? So the question is how do we handle issues around conveying the severity of bugs? Are you talking about mostly back to the reporter so that things don't go public, so that they don't disclose it outside to other people? They say it's high, you say no, it's low, but they say no, but then there's no discussion between the reporter and you so that they say, okay, I go to the public and say it's a really high risk. So the question is how do we work with reporters to keep communication channels open enough that they don't end up disclosing it outside to other people before it's been fixed? And this is definitely a big challenge that we face all the time. It's very common for us to disagree with a reporter on how severe an issue is and how severe we see it definitely depends on how quickly we get to fixing it. I try to view the issue from both sides. I try to understand what the reporters are going through, but sometimes it's hard to get them to understand what we're going through as well. You get 100 reporters that each have found one issue, and they all report it, and we now have 100 issues to deal with. We obviously have to prioritize these, but for each of those people, their issue is their top priority. For us, only one of those can be our top priority, right? And then there's going to be some sort of hierarchy going down. We try to communicate very consistently with reporters, and I've found that helps a lot. They're less likely to go and disclose it if you're good about going back to them and saying, we haven't forgotten about this. It's just further down the line, and we haven't fixed it yet, but we haven't forgotten you. Most of the time that works. Not always. We have had some things get disclosed, even relatively recently, outside of the channels that I would like, but since we do prioritize and do focus on the most severe issues first, the ones that could potentially get disclosed are at least the lowest severity issues, which is good. The way that we rate severity, we try to take a lot of things into consideration. We try to consider how many people or sites could potentially be affected. We try to consider what that effect could be, like how bad can that, what's the worst that could happen. We try to take into account how easy it is to actually exploit as far as can you simply write a script that does this for you. Does it require some social engineering? That all makes a difference, as well as, to a much lesser extent, how complex the fix needs to be. That is something that has to be considered. Do you use for this ratings as CVSS model, or something other? So we haven't. Hacker One uses CVSS, and so all the bugs that are coming in are rated that way. The reporter rates it first, and we adjust said rating almost every time because it's not very accurate when they do it. But I would like to see us using something simpler. I think that while security professionals can understand CVSS really great, most people can't. And I would like to have a system that most people can understand. I don't know exactly what that is yet. It was actually something that we were talking about up in the security room just before I came down here to give this talk. So it's something that we're actively working on. I would like to have a very simple system that we can say this is really bad. This is kind of bad. This is not bad. Something that simplifies it down to where anybody can understand it. Yeah. So that's a question. He asked how many bugs we deal with, like I guess just what per day, per week, whatever. And that's actually a question that's impossible to answer because it varies so much. There will be weeks when we will literally get 100 reports in a week, and there will be a week where we get no reports. It varies a lot. Do we have a lot on the backlog? No. We do have some on the backlog. There are things that are being actively worked on, but we do not have a large backlog. No. So once the patch is tested by us and the reporter and whatnot, we move on to slating this for some release. Most of the time, this is going to be slated for the next minor release, 4.8.1, 4.8.2, whatever the next one is. There are rare cases where it needs to be slated for some specific release. Maybe something else needs to be released and pushed out before this one can. But the vast majority of the time, once it's ready to be released, it's scheduled for the next security release. But at this point, we're actually not done as awesome as it would be. We now have to backport this fix to all the versions of WordPress that we support. Does anybody know how many versions of WordPress we backport security fixes to? Too many. That is a very accurate statement. Right now, we go all the way back to 3.7, which means at this point, we have to fix trunk, which is what's ultimately going to be 4.9, and then we have to fix 4.8, 4.7, all the way back 12 versions to 3.7. This is becoming unsustainable for obvious reasons. So in the near future, there will be a lot of, I guess, post-education as much as we can to get people aware as we drop security support for these really old versions. We do want to make sure that we let people know. We want to bring as many people forward as possible to keep them all secure. Yeah. I thought the point of updating is to get these patches. So how do people on 3.7 get the updates if they're staying with 3.7? So she asked how do people on 3.7 get the updates without updating all the way to whatever the newest, latest, greatest is 4.8 in this case? Our update system has several different parts to it. Our automatic update system. If you click the update button, you can go a major version from 4.7 to 4.8. Without you taking any action, unless you have purposefully turned it off, your site will always get security updates automatically within the release that you're in. So if you have never clicked that update button and you were on 3.7, you're now on, I think, 3.7.23. We've had, I think, 23 releases for 3.7. It's not great because the code base has changed so much since then that when we're having to backport to 12 releases plus 4.9, this is usually somewhere between five and 13 different patches that don't just apply to every version, but the patch has to be changed. It applies differently. That code is in a different place or even a different file now. That code has been completely changed and we have to fix it and then start from scratch and fix it again for a different version. This is why it's unsustainable to go that far back. My goal in the future, and this isn't to say that this is going to be in two months future, but within the next year or two, I would like to see us support three versions with back porting. So if you were on 4.6 right now, I'd still be okay with keeping that secure and putting in the work to write those patches, but to go all the way back to 3.7 is extremely taxing on our team and it's also starting to become somewhat error prone. It's hard to write 13 different patches and make sure that you didn't break something when, let's be honest, no one on our security team is actively running sites on 3.7 or 3.8. So we're kind of relying on unit tests, which the unit tests for 3.7 weren't near as complete as they are for 4.8. So it's definitely a serious issue that we're actively addressing.  This happens really close to release and I'm going to touch a little bit on disclosure in just a second, but the reason that the patches go into our repository very close to release time is because, yes, we're going to do a post and disclose what we fixed, but you also kind of disclose to people as soon as you make the code public. There are definitely people, hackers that watch our code repository for changes and are looking for security related changes and we don't want to give them a head start. You never want to give the hackers a head start at all for any reason. I want them to always be behind the curve. So these patches all go in just before release, usually sometime in say the 12 hours before release, depending on how many patches we have that we need to get in and then we release it and it's fantastic. I love our automatic update system. All of a sudden I will see our graphs spike and I will see thousands, even tens of thousands of sites being updated per minute steadily for hours right after a release. Tens of thousands of sites a minute for hours are instantly being secured. Yeah. Is that triggered by a visit of the site or is it some mechanism that a server pings a website and says, hey, there is an update? So auto updates. The question was the check for auto updates. Does that happen when a visit to the site happens or does something else trigger that auto updates that the check for new versions happens based on WordPress Cron for the vast majority of sites unless something has been specifically changed at your host, that happens based on a visit to the site whether by you or anyone else because front end visits trigger that as well. Some hosts have a different Cron process that manages that and for them it's probably triggered on a schedule that happens every minute or something like that but yes in the vast majority of cases a visit to the site is required which is why we do see that happening for hours because while there are many WordPress sites that are getting constant traffic there are also many WordPress sites that get sporadic or very little traffic may only get a visit a day or something like that and so we do see that those updates run tens of thousands of sites a minute for hours and then that will dip down to a thousand or a couple thousand sites a minute for a day and then it tapers off again and so you know it is a thing that can be delayed for some sites but one visit triggers it yes that is true if a hacker visits a site to check it to see if it's not patched he would in fact trigger the patch and at this point usually we disclose 99% of the time probably even more than that all issues are disclosed it basically as soon as the release has gone out once the release goes out and auto updates start rolling at full speed we do a post on wordpress.org slash news that post includes what was patched we don't go into specific details like how you would have exploited said issue but we do say that there was a cross site scripting vulnerability in this part of wordpress that was fixed in this version and we list each each issue out I say the vast majority of the time but not always and I will get to the not always in just a second the point I'm missing today is security bulletins for the security fixes security what security bulletins okay security bulletins for yeah so we do we do an announcement post right after each security release and that has the info that we share like that's that is our disclosure um at this point once an issue you know once we've released the issue has been disclosed then we go back to hacker one we close the report we pay the bounty which is something that I guess I didn't touch on when I talked about hacker one which is that we pay bounties we we want to reward people for reporting through the proper channels for not disclosing outside you asked about what prevents people from disclosing if they do they're not eligible for a bounty so you know that automatically zeroes out the bounty bounties pay on a scale based on severity and based on the product that they affect we pay higher for wordpress and less for issues found on like less used wordpress sites like maybe the wordpress swag store or something like that that's still a property that falls under our purview that our security team is responsible for but isn't isn't affecting 28% of the web um yes so bounty is very uh the the base the lowest level thing that's valid for a bounty is $150 that would be for something like an authenticated xss or something like that where it's it's a very minor issue and it goes up from there we we recently paid uh what what was it um $1,300 bounty but that's not like the maximum but that's the biggest that we've paid recently um we honestly haven't officially set any kind of maximum because we've never had what we would consider like the most severe potential issue like a remote code execution that's unauthenticated or something really horrible like that we've not had um but we want to pay enough to reward people for letting us know and letting us fix it for working with us instead of just using it right um so we're not we're not making people filthy rich but we're also we are trying to be good about that and then if the report had not been disclosed for some specific issue which i can talk about uh 4.72 and how that went down um it is eventually disclosed i do want to say that if it's not disclosed back here where i added the little question mark we don't have security issues that that we know about and fix that we don't disclose they are always disclosed it's just a question of did we delay that for some specific reason and i think 4.72 the rest api issue is a fantastic example of that which was um the the severity of the issue was relatively high um specifically because it was so easy to script to someone could write a bot to crawl the web and affect a lot of sites um and so we didn't want again to give hackers a head start or in this case even an equal start with us we wanted that head start so we took about a weak head start um in order to do this as safely as we could we interacted with hosts quite a few hosts all the biggest hosts um and then some we worked with cdns like cloud flare we worked with wafs like um securities and in in capsula and all of those people mitigated the vulnerability so all the hosts that we could find and work with and these wafs and the cdns they all mitigated the vulnerability for anything that was going through their systems and then began monitoring their systems and sending us back information to let us know was anyone even attempting to exploit this on i guess at that point we must have had maybe 10 million sites or so that were probably being monitored um and we didn't see any attempts to exploit it um had there been an attempt we would have gone ahead with disclosure as soon as we saw it because the reason for disclosure is to let people know this is important you need to update right now but as long as i was still seeing thousands of sites a minute being um updated and patched and made safe and zero attempts to uh exploit it i wanted to let that keep going and let that let as many people become secure as possible so in that case we delayed one week and we had all decided ahead of time that if we saw anything happen we disclose immediately otherwise we'd give it one week for as many people to update as possible and then we would disclose um there was never a consideration of not disclosing one week was what we said is the maximum um and we did we went one week we we protected millions and millions tens of millions of sites um between auto updates and working with hosts and working with WAFs and then we disclosed and then we did see quite a few attempts yeah what was missing in the first in the releasing of 4.72 was the initial there is a security fix in a police happening and it's for right so four point from the enterprise that one of you you are not one of them because you get involved in front of this and you plan your updates you have patch your release processes on your own and you haven't the info that there's security relevant updates and and so the the issue that he has because i'm supposed to repeat everything for the camera is that uh what he feels like was missing from the force four point seven point two release post was something that let him know how severe the issue was because there were uh four seven two was only a security release right so there were other security issues that were fixed so it was announced as a security release the post that went out immediately following said that there were security issues but they didn't list this one most severe one so some people may have prioritized that down the list and it's part of the reason that we gave a full week before disclosing hoping that even people that didn't know that there was this really bad vulnerability they at least knew that there were vulnerabilities so they would prioritize it within that week that obviously wasn't everybody because there were some sites that got defaced by that issue the good thing is the the number of sites was extremely small and i think that that's because we did give people a long time to update before we gave that disclosure i think that had we disclosed it immediately that it would have been a race how quick can you put together a release and get it you know through all of your processes and up on your sites or are the hackers who by the way could easily automate this attack are they going to be faster and and our our update servers are extremely fast i love that we can sort of race them and and feel pretty confident in in at least protecting more sites than they're able to get but not everybody's processes can be that quick because like you said there's often approval processes and stuff in place and this is the thing that we were again just talking about at the security table upstairs in the courtroom is how do we improve this messaging should we have if we had a scoring system for example and we could apply that scoring system also to a release rather than just individual issues and we could say hey this is a really severe release again though technically disclosure happens as soon as we put the code in the repository so if we say say we had a color system right red is bad and green is not bad if all the bugs that we fixed were like green or yellow or whatever color coding system we have in between but the release was red hackers are going to be really digging through every line of code that we changed and trying to figure it out would they have been able to i don't know many of them are quite intelligent i do not doubt their abilities it's true i mean when you're when you're pitting yourself against them you realize they're good at what they do unfortunately yeah actually let me let me just go ahead and shoot to the next slide which is q and a because that's clearly where we're at yes this is a really easy question to answer because our last group is zero for security updates for the stuff that core does out of the box which is only security updates in your in your branch in you know whatever version major version you're on for that functionality i think that should always be left on for everyone in every system massive companies like you know disney and tiny companies like you know i don't know my parents blog like everything should get the security updates automatically i'm obviously bias but i don't see the downside for security releases we have a rule that we have no breaking changes there are times again when we're patching both trunk which is going to be the next version and back porting to all these other versions the fix that goes into trunk the fix that that's going to be in 4.9 it could potentially have changes to the way an api works or the way a function works or something like that and when we do those we scan the plugin directory we we talk to big plugin companies and stuff we try to make sure that we're not breaking anything but we don't have a zero breakage policy for for that we try to be a hundred percent backwards compatible but yes stuff happens having said that for all the versions that have already been released for a patch that goes in into 4.8.1 4.8.2 it can have no breaking changes so it has to fix just the security issue without adding any new functionality or changing the way something works um so those are extremely safe to do yeah i saw this hand up if so then you have to give it some kind of access to the wordpress inside and like how the system works so or maybe you have some internal code in the wordpress board does it and no we do not have code in wordpress that's reporting anything back to us security wise um but specifically i had said that around the 4.7 to the the rest api issue that was something that could be detected at the network level rather than at the php or wordpress level so we had hosts that were monitoring network traffic looking for packets that could be attempting to do this so those hosts yes we had to let them know what the issue was and how people would try to exploit it so that they could recognize those packets we that's what first spawned the security dash hosting room that i mentioned in slack earlier um we got them together we got their security people so trusted people that we could share this information with um and we had them monitoring that and reporting back to us but all at the network level not digging into people's wordpress installs uh just traffic that they're passing through and having to monitor um similarly WAFs and CDNs as they're passing traffic through they're able to look at the packets the great thing was not only could they have reported to us if they saw packets like that they can also kill them and get rid of them so every uh wordpress site on godaddy and blue host or any eig property and dream host um and all of these hosts anyone that was under the security firewall anyone that used cloud flare cdn none of those wordpress installs were at risk because all those packets were being killed um before they ever got there yeah yep so the question was about plugins so beyond just wordpress core which is what we've mostly talked about because it's what i mostly focus on um what about plugins especially the really widely used ones um and that varies a little plugin to plugin some of the big widely used ones like Yoast SEO uh they have their own hacker one they handle their own stuff uh for the vast majority of issues there has in the past been times when we have used the wordpress auto update system to push those plugins um forcibly just like we push security updates it's pretty rare we have criteria that needs to be met including um simplicity of the patch so that we can be positive that we're not messing up people's installs they have to follow the same procedures we and we follow of of no breaking changes they have to apply the patch to every version that people are using just like we do so that we're not upgrading your plugin we're just fixing the security issue it needs to affect enough people so we really only do it for the widely used ones um just because like uh i guess costs to affect ratio like it takes a lot of work a lot of people a lot of time to do these pushes um but we can and we want to extend that umbrella to do that more and more as a matter of fact i would like to see our core team of 50 people um probably grow in order to do this but also spread out and sort of take not take ownership of these bigger plugins but help them with their security to to be a resource that they can use possibly even to allow them to take uh security reports through our hacker one program if they don't have one set up because almost everyone that runs WordPress runs it with plugins so the security of WordPress in most people's minds is really the security of WordPress plus whatever plugins they're running so yes we want to focus more on the plugin ecosphere and see what we can do we've done some in the past but we can do a lot more last question work is a center place that distributes all those security updates to other sites and actually all other dates as well this is a single point of quail law because if the worker that is compromised the millions of sites are compromised as well because they can get this issue so how would we handle this situation and security of the torque and your servers so um um a yes uh wordpress.org is clearly kind of a central point it's not totally a single point of failure um because in order to be able to push stuff out to all these sites uh you actually need to get access to to commit code into the version repository as well as get access to um commit code into a separate repository that we use for triggering those updates to go out um so there are actually there are there are three different places that you would have to gain access to but they are all part of wordpress.org part of this kind of bigger central thing but they are kind of subdivided out um it is a thing that we're looking at um as far as trying to figure out the best way to do say package signing or those kinds of things but it's also I want to be very honest and clear that's a very long term plan it's there's no quick change to those kinds of things without the possibility of severe breakage right when we're and when we're talking about 28% of the web we have a responsibility to be uh sort of real sure in our course forward to make a plan and to make sure that it's all right before we execute on it um but yes we would like to see those three points sort of get distributed out even more so that there's um not a small group of things that could potentially cause large failures and I'm going to be up in the core room we have a table at the end that's for security I'm happy to answer any more questions up there and I'm Aaron Campbell and thank you to GoDaddy by the way who funds me to uh be able to spend all this time on wordpress and uh that's it that's all I got


Gotta keep your head up, man Hold your chin up, gotta keep your head up, man Gotta keep your head up, man Hold your chin up, gotta keep your head up It can be super, stressful At times, man, we all know that shit Life can be super, stressful At times, man, we at times You gotta let it go Don't wipe your face, bro, blow your nose I know this life can be pretty stressful But it get better along down the road I'ma tell you about the time I was broke And when I had to learn how to flow When my relationship was going down fast Like somebody poke holes in my boat Like reaching under the bed, I was feeling low For how long, I don't need no But I stayed hard working at my dream Even when the folks took a nigga as a joke I still had faith even when I seen the ones I love running out of hope Still gon' make sure they run clean Like I just got a cop painted with soap Pockets with cricket, but now they so straight They used to sleep on me, but now they awake All that hard work and staying up late Made it harder till the night that I'm great Gotta think out every night that I pray Ask them for these, show me the way How to get to them by the day Now let hard times just fall At times, man Life can be super, stressful At times, man, we Just for that minimum wage Gotta put up what they boss says Everyday to be not getting a raise How do my people getting put in a cage Or put in a grave?


And normally I would introduce them, but I don't think that Jack or Bill or Bernstein need to be in the introduction and we don't want to steal the time from their conversation. So at this point, we, well, this is a free, ranging, non-political exchange when we break that rule. So, anyway, this is called the Power Side Chat and you guys have it? Well, good morning everyone. Jack, I'm going to start by asking you like a question everyone wants to know, which is what does the retirement... Can you hear me? Can you hear me? Can you hear me? Yes, okay. What does the retirement of Bust me to those of us who invest in these indexed portfolios? Well, first place, he's been a great guy, a fabulous friend, a terrific mathematician, certainly one of Vanguard's priceless assets. But think about what he's doing. He's matching the market and that is not complex beyond belief. There are lots of nuances in it, but if you follow the performance of all of what's safe, there's some good argument here. This is the 500 Index Funds. They are all the same when you adjust for an expense ratio. Everybody has picked up how to do this. Heck, it may be that Gus told them all, but I wouldn't spend 30 seconds worrying about what happens next.  And one of the great things about it is that when you buy an index fund, you're really investing for life without worrying about who the manager is. Think about this for a minute. First, if you like this, maybe you'd overspend, say 50 years, whatever it may be. Some of us may not have quite that many yell left, but there we are, but over lifetime. How many managers are going to be there for a lifetime? And the answer is none. They're going to come and they're going to go. Funds come and go. Individual mutual funds come and go. The failure rate is about 50% every 10 years. Don't worry about that in an index fund. Regular funds, managers change every five years. So over, say, 25 years. You can start right up in that year. If you own four mutual funds, 20 managers in 25 years, roughly a manager a year. What is the possibility that 20 managers a manager a year can beat the index at zero before it goes to, you know, maybe it's under the 1%. So all the index fund has to do is match the index, become a commodity, and for all of Gus's fabulous contributions to Vanguard, he was the one to say that he likes to say and I like to say, I was the architect and I picked a great builder, and that's the truth of the matter. But his retirement will not trouble anybody in this room, and it certainly doesn't trouble me, except as a friend. Yeah, I mean, I should mention that just to amplify a point that Jack made, it was always something that I would wonder about, but we all know that, you know, over the long run, the odds of getting an index fund are 20%, which would be kind of horrible. But the odds that you're putting together a portfolio of active managers that would be an indexed approach is much smaller than that. And Alan Roth, finally, did that study, an excellent study, in demonstrating exactly what Jack said, which is that you're the 1% when you're putting together a portfolio of active managers. Do you have any comments, Jack, on the switching away from the MSC on indexes? Do you think that's any significance at all? No, that's just a kind of funny thing. It was a closely guarded secret that we were thinking about doing this in Vanguard. And, well, I have lots of contacts there, in touch with a lot of people, closely guarded secret is something they shouldn't tell me about, and they didn't, they shouldn't. And I looked at it and the secret comes out in the paper, and my first reaction was to yawn. It doesn't matter. The idea that, say, an MSCI 500 if they have one, or a Russell 500, or a Vanguard 500, or a Dow Jones total stock market, all of them, old Wilshire 5000, and there are probably half a dozen other indexes at that like 500 level or total stock market level, and they're all going to have the same return over the long run, no matter which firm is managing it, because large cap stocks are large cap stocks. The correlations between managers and index portfolios in that area is going to be 100. And later on, I'll show you a chart showing, and it's sort of relevant here, I want to get into it until I have the chart, but the idea, my idea has always been on for everything we do, including active management. I used to call it relative predictability, I would call it consensual predictability. And now when this modern age wants, we want to have my R-squares. There's no change, except you can understand what relative predictability means. I mean, I think it's an interesting issue. I think it does matter a little bit, maybe at a basis point, I'd rather be indexing an obscure index, large cap index in the S&P 500, just from the new constitution and the expenses. I'm much happy with the large cap index when I am looking to index the S&P 500 if I want to index that particular area. Check, let me ask you, I mean, basically I agree with you when that is, I was making this point to talk about total stock market index funds, total international funds, all with very heavy large cap bias. There could easily be differences between the S&P, what is it, the 400 or something down there, small cap index, 600 for the small cap index, and the Russell, they have different ways of reconstituting, some are better or worse, you try to get around like a lot in that fight using different indexers, but it has a broad generalization, and when you can save as much as we are saving, I don't know the exact number, but it's a good thing. These guys get away with it very rarely, I mean, if you saw the stock of MSCI, why an index provider is publicly held is another good question, but their stock dropped 33% or something the day we made this announcement. We saved money, they lost money, and so hats off to Vanguard for doing what we, you know, eating what we, what do we say, eating what we preach or something, eating what we cook, and so, but it doesn't, I think you do have to agree with Bill here, you feel more careful, it's not a lot more careful in the lower areas, but a firm like Vanguard or another big indexer like Fidelity or BlackRock is going to be, you know, very much able to do these things in the right way, and if they aren't, time will emerge and tell them that, and they'll have to change. So it's, I mean, I've never done this before, made two brands of generalization. Well, maybe almost never. Almost never. That segue is jacking to another question that I have, and this is sort of a personal interest of mine, and I apologize for dulling in front of this audience, but it's a very interesting issue. I mean, Vanguard is a nonprofit, and it's a nonprofit which is slowly gaining market share on those companies that supposedly should be benefited from the invisible hand, and it's not the only area in our society in which nonprofits outpace more profit-centered. I'd rather be on a school, for example, that's run by a nonprofit than one that's run by a city man. I'd rather, you know, how many great for-profit universities can you mention? You know, the University of Venus is the biggest one. I don't think it has the best reputation in this country, and so there are some areas that hate paying doesn't do as well as a nonprofit, and you've written, of course, the performance of mutual funds and their corporate structure and their corporate leadership. If you have any reflections on that, let's look at it this way. The one thing that distinguishes the mutual fund industry from other industries is the relationship between cost and return, dollar for dollar. In other words, you would not necessarily cost-determines return, but if you get return acts and deduct 20 basis points from it or 10, you're going to have a big advantage on someone who provides the exact same performance and charge the exact same kind of fund and charge the 100 or 200 basis points. There's no way around the man. So as long as gross return and the markets are in your fund minus cost equals net return, whoever has the lowest cost has the highest return. This is not complicated, and our industry is just finally trying to catch up with it, and they don't know how to. The problem is that it is very simple when they are in business to make money for themselves or to make money for the financial conglomerates that own the management companies. For those of you who have read my book with great care, if these aren't the numbers that are in the book, forgive me, but the 50 largest mutual fund management companies, 36, I believe, are owned by great big financial conglomerates from Canada, from Canada in the line, Deutsche Bank, and so on. And those companies have bought mutual fund firms to earn a return on their capital or corporate capital, say Deutsche Bank. And the interest of the shareholders in that fund is to earn a return on their capital. And that's a conflict of interest right there when you're in business to make money for yourself and the people that you're investing toward that you're in business to make money for them. But they have a great difficulty in competing. Another six or seven firms in this industry are publicly held. There's their own stock holds around. And so I think that leaves about six firms that are privately held, six big firms, which of course would be Fidelity Funds and Dodgercocks. There aren't a lot of them. And then Vanguard is sort of privately held by its own shareholders. You want to look at it that way. So that's the... tremendous advantage because this business not only is cost everything, but cost can be measured with precision. I mean, if somebody else's, I don't know, Lincoln Continental is more valuable than somebody else's Mercedes, Benz or Jaguar, all that benefit is in the mind, in style. Maybe a little bit of construction, whatever it is. Diamonds, maybe a girl's best friend. But it's very hard to measure precise value. But in this business, you can do it. You can do the math. You can see the math and see just where it comes out. You have to estimate things like turnover costs. We always ignore sales commissions, which is still a very big part, sales low and big part of the business. And Vanguard has, you know, because of our structure and the kind of funds we choose to run, we have very low portfolio of turnover that costs us since we're zero. We have no sales lows. There are, say, 18, 20 basis points overall. V, sometimes as low as five basis points, with others who are on average in this industry is to call out their basis points for fun. Just have this huge advantage. But they can't compete. The example I use is, I might just rattle on for one more minute here, is that, so we're up in Fidel. And there's Ned Johnson. And he says, then God's ideologue, do something about it. Get everybody in the room and say, what are we going to do? Ned Johnson is eating on lunch. I'm a little humor here, aren't I? And so they all come back in a week later. So we can get the expense ratio down by eliminating your profits. Yeah, sure, that's going to make the guy happy. Cutting out the marketing budget. No more green lines running our grocery television screen. They're coming much more efficient. Taking big bonuses away from managers that don't perform. And I think if we do all these things, no marketing, no profits, much more efficient on the investment side and on the administrative side, negotiate with the custodians, the whole works, we can get down to 50 basis points. And I won't try to emulate Mr. Johnson's accent here. He says, 50 basis points? Boy, we'll be 250% higher than that gone. Why would we do that? So what is his option? He cannot do that. He will not do that. People don't like to cut their own throats, right? So he's going to keep milking that cash cow, which will probably last 20 or 30 years. And that is the most, without any measure at all, the most intelligent business decision he could possibly make. He's doing the right thing for his personal standpoint, the standpoint of that program. So if he was doing it as a fiduciary and not a businessman, he would do just the opposite. It's a problem Vanguard has that we've gotten such scale now, $2 trillion, oh my God. Oh, entry. You know when you get to our scale, someone operating exactly the way we do, which is really impossible because no one's going to be pretty close to 95% index. I'll talk about that later. So you've got to pay the money manager something. But if you just pay the month performance, pay the firm month performance, that would be a good thing for the clients but a bad thing for the manager. But you could probably get to, let me see if you can get to 40 basis points. So what? As a wise man, the neighbor of Ham Lincoln once said, the world will know for a long remember. Yeah, I mean, you know, it's interesting to be brought up met Johnson to a wonderful audience, I'd probably say. It is that met Johnson will do it. What is in Fagality's long-term best interest and he may be able to play it out for decades to determine his heirs and heirs. But that's still a better case scenario than what you've also written out, which is what happens in publicly traded companies where they don't manage the next quarter's profits, which is a recipe for disaster. He was also warmly able to something. I think it's worth, you're probably not wanting to know more about this. People become second-grade teachers and Marines and join diplomatic or not for the money they do it for, more reasons they think the world is serving a useful purpose. And I think that the people at the vanguard go to work in the morning and realize that they are serving a socially useful purpose. You saw a maturation, of course. You saw it as a useful social enterprise and I think you certainly inculcated that corporate culture. Just that everybody who works at the vanguard can be working for somewhere else for a lot more money than you. You say it isn't so. That's good. You didn't have two, you didn't have one more popular one, two more now, which is I think someone pointed out. And I think that's the issue, is why are you doing this? And I think the people who work at the big Wall Street firms are in it for bucks and the people who work at the vanguard are in it because they want to be able to work themselves in the mirror. And I think there are some activities that are socially useful, like providing the expense of investment products, save investment products as well, but making widgets is not. You're not going to get non-profit car companies you need to do this again to make those. You know what? Alternatives. David Swenson's had a rough five years of it. Not bad. Yeah, not great. Yeah, not bad, just not great. Do you think that he, do you think, why do you think that is happening? Do you think that the ground has just gotten too covered? Do you think that he has a different approach on all this than the Wall Street building right now? But do you think it's possible to sustain that sort of performance? I never believed he could sustain that kind of performance. And I said that to David who was a great, great human being. I mean, just a straight arrow. I mean, there's just nobody any better as a human being and then combined money management. He's just a wonderful guy. He went to Yale. He went to Yale. I guess he didn't go there. And so I have great respect for him. But I said, how can you go on like this in the future?  And I think there are probably fewer than expected, Bill, fewer than expected. But there is, the advantages these university endowments funds have is no conflicts of interest. Infinite time horizons. No worry about a massive renunciation. And no daily reporting, weekly reporting, monthly reporting, quarterly reporting. They haven't even got out the report, just getting them out now in October for their fiscal years, which always ends on June 30th academic year. And they're just getting paid out now. And it doesn't look so good for last year. I think it's probably going to be about a 0% return for college endowment funds. And I combined, it's so hard to deal with my poor aging brain has a great deal of trouble going from college fiscal years so when I tell you what the return on a fund stock portfolio say, well, I can fund or balance index fund was in the year end of June 30th, I frankly had no idea what that 0% compare with. Well, it turns out to be about 6%. It's the average for 60-40 indexes out of last year. Roughly that. So the colleges aren't going to come up to that. The disadvantages given to the advantage of it, and they have terrific research guys, and they're all over the world. They're innovative. They understand some of these complex instruments that the rest of us believe have a fighting chance of understanding so that they're good. But what gets in their way now that they've been doing that for quite a few years is basically the Swenson model. They do it at Princeton. Princeton is right up there with Yale. I kind of wonder why this is so. But very similar to the return here every year in the last 10 or 15 years. I think Yale is about, I don't know, 20 basis points ahead. Let me say 12% of the year compared to 12.2, something like that now. And so they're terrific long-term records. But what happens in the market is other people copy you. And, you know, the market gets more efficient. There's a lot more price discovery and high-treatancy trading and there's a lot to do with that making the markets more efficient. And when there's nobody playing your game as it was when AW Jones started the first hedge fund in I think 1950 or 60 he could do a good idea what everybody does. All hedge fund managers cannot, will not and are not above average. They're all average. And then you take that 20%, 2%, 20% of the games and 50% of the boxes in a year nobody can overcome that in the long run.  People just getting wise to the fact that these private equity things and hedge funds are great compensation devices for managers. And private equity, I won't mention that I have a certain firm who's in the United States. But they rip people off, they borrow all this money to over leverage the thing and they pay it to themselves and it's pretty seemy stuff and I tell everybody to avoid it unless you're sure you can pick the right hedge fund manager, whatever it is. So when everybody is looking for shares of diamonds in their own backyard there's only one diamond there and so the price of it goes up and up as people discover that. So it's competition. These guys, the general run of people that are running these hedge funds and these quads is brilliant. I mean they are fantastic. Some of the smartest people I've ever met in my life and if I was to draw a scale here of the baseboard level over there and there's right at that top ceiling level there's a big gap there but when everybody is doing it they can't all win. This is not complicated. This is not like what we're going either. There's not so much alpha out there but my operating principle is something that's called Reagan-Foller's Rule which is named after John Reagan-Foller who works at the Morningstar. He slipped a lip. He wishes I guess. And Reagan-Foller's Rule for 20 years has been if the Bozos know about it it doesn't work anymore. And I see the Bozos now investing in the Yale model. We see people coming to us at our firm saying gosh we just got shown this by this big investment company that big investment company and it's the Yale model. Conventional. And one half alternatives. What's alternatives? Well it's hedge funds and private real estate and Timber. I loved Timber. I worked for 30 years in a place that produced nothing like Timber. And what's happening in that area in rural Oregon is these old families who've been in the business who certainly have how to send their sons to Wharton are now selling out to people who in Greenwich, Connecticut who have smooth hands. Where do you think the information asymmetry is there? I mean if you don't know your way around a 50 inch chainsaw and a children's cable you probably shouldn't be working in the forest or investing in the forest products. You know. The Yale model is the conventional wisdom now. There's a wonderful section in David Swanson's book where he says if you're investing in the conventional wisdom you will have your head into he's the conventional wisdom now.  Well let me add a little icing on that cake by saying before I love this phrase whole new ideas go through these three phases.  Another great innovator was John Templeton John Templeton of course investing in foreign stocks, particularly Japanese stocks back in the late 40s when you couldn't even take good stocks and on the contrary a brilliant and incisive and you know when he saw people piling into Japanese stocks starting in the US in the late 70s he sold out to the US market. And so the most important work in the title of David Swanson's book pioneering portfolio management it's not portfolio management it's important work. You're not a pioneer and you're not first you're probably in the wrong game and that's something a lot of people don't realize. The other thing that we all know I mean if these guys can't get it right if all college endowments I see McFurry sitting down at the back you would have a marvelous article for forums about this very subject but they're not getting it right. What odds does the average client you know JP Morgan Stanley who's being put into all these private investments not very good I would suggest. The crisis we're now four years I remember you talking about the layman index this conference in September of 2000 May I think it was in San Diego when you used the word layman index you just about shrieked the word layman. We now have four years of respect for one of these jobs. We've seen how things have gone down. Do you think that we got out about as well as we could have ended and the second way the final question is if you had been hanged false and you had this position in September 16, 2008 knowing what we did now but you've done things differently. Let me say answering the first part of the question that you know when you're confronted with a possible financial comparative catastrophe that system is so over linked so over leveraged so misaligned in terms of its incentive that we just got totally out of whack and it should have been easy to see. I unfortunately did not see as much of it as I should. If I had spent a week on the west coast with a country wide mortgage salesman I would have come back and said out because you could see the way those things were building up. I don't call a mortgage company as Washington Mutual and so on never have but I had no idea how much out of hand their lending had gotten but it's so I guess really obvious that when you've got a bunch of salesmen trying to give you a $250,000 mortgage for a $150,000 house and you've got a $100,000 left over to yourself that's what happens or what did happen in some cases and in some cases people are making $30,000 a year some story about a great picker that was making $16,000 a year and he put it $200,000 house that's got to end badly right and so and then you break the link between borrower and seller and that's what happened in the mortgage business the banks would take those mortgages make their fees to mortgage banks sell them to banks who didn't care they probably didn't even look at them because they were going to sell them to some kind of a new underwriting of mortgage backed securities securitization so the risk holders were completely two levels removed from the risk takers and the homeowners back there who have been borrowing the money and that just went and maybe I was just not alert enough and I really feel pretty stupid about it personally because I didn't think it would amount to that much but if I'd known how much it was going on you would have been alarmed immediately just seeing what happens on the ground and a lot of us are a little more elevated we should be from the real world existence and you don't get in the ground I don't nearly enough and that's not my business anyway but it was such a big thing Bill Gross might have had some people doing the exact same thing see what's actually happening I mean it's really important don't take anybody else's word for anything so the crisis was going to come and it was going to be terrible and I think what would I have done if I were Hank Paul's I think I just would have tried to do a more comprehensive job and I thought he was said to somebody I thought it was a little punch drunk and then a few days later a punch there and then another punch and I'm not sure the greatest credentials for a treasury secretary would be an investment banker a very good guy a very smart guy and a very strong guy and without the strength not much is going to happen so I commend them for all that but I still think we could have done a better job we finally get the so-called TARC which was to buy bad assets it was so funny we called I think TARC was just something blah blah about getting the bad assets out of the banks buying the back front of them and that hasn't happened a whole lot of other very different things that TARC money was used for so I probably had to be used it I think I would have done more on more of a Keynesian than ever and not perfectly because none of those things work perfectly I thought I was the king two or three steps at least there were three steps from the drone done more stimulation more stimulation in the infrastructure side where we put people back to work and we may yet have to do that or try and do it because the greatest price an economy pays for all this ultimately is the lack of full utilization of its productive power so I think Ben Bernanke was very good I'm not sure what Hank Wolf amounted to without Ben Bernanke aside actually he was a Princeton professor he's extremely smart we all are I'm kidding and I think he's doing what he can but he's trying to do the impossible and that is he's trying to solve the biggest problem with monetary policy with the money supply buying securities with QE2 which I was taught as an ocean liner the I agree with the newest one it's called twist operation twist getting out of the short term security is a pattern and monetary policy I mean sorry fiscal policy monetary policy can only do so much big things behind the blow up in Europe the idea of monetary policy is basically European wide the idea of fiscal policy is each government's responsibility and you separate those two and we sure have to separate it here just because of the nature of our system the government's in charge of both finally but the legislative side is just so stymied unable to do almost any, I'll give you an example just show you how it's done so I hope that's not too political but we aren't we're trying to have monetary policy carry the burden and you can't, monetary policy can't not, unequivocally cannot do it all so we've got to do some fiscal stuff got a loan on us what's going to come out of this so-called fiscal cliff you know it's not going to go on the way it is for sure because it just can't be sustained but it is horrifying to me this is not a politically slanted conversation but this deadlock between the parties means no material legislation can get done in Washington D.C and the only thing and the only piece of legislation the two sides are able to agree on is probably the worst piece of securities legislation ever designed by the mind of man and that is the so-called jobs act, put jobs in it if you want to get it fast and it's supposed to increase jobs by giving small businesses access to public capital so all the constraints on very small companies going public and prospectus is all that kind of thing all those are taken down limited and it's much easier to raise capital out there but there are a lot of swindlers out there and they are going to come and swindle on an awful lot of people so we get the jobs act both parties think it's wonderful to deal with one day as far as I know it hasn't created one job but it's just a symbol of something that really lies at the root of many of the problems we are dealing with in this country and that is a political system that is in chaos unable to move and oftentimes it's a good idea for the congress to do nothing you could say one of the great blessings is congress can't act and there is something to that but none of these circumstances so we'll have to see what comes out of the election and see if sides can somehow reason together and produce what's best for the country instead of what's best for their own individual interests I know that's idealistic and I hope it's not too political for Mel for me to approach that my favorite economist of all time is Harman Vince the instability in our financial system touches on exactly what John was talking about which is that if you primary instrument is monetary policy then what you do is you get into the cycle where you stimulate Wall Street but you don't stimulate Main Street which is what Van Buren and he used to do there's been a lot of stimulation at Wall Street stocks have been on its air obviously assets have been on its air but it hasn't done the great field, done something but not a great deal for the economy, you want to do that you have to do it on the political side and so you wind up with a more of a map but you wind up with this very unstable system a physical system where you just get financial and boss in that that does all the things that frighten me, that frightens me because you notice there's this chronic instability in the financial system we went we started out with four bags that were too big for Dale and now we've got three that are big I think it's a very frightening situation it's why the boys believe in the portfolio side that you want to separate out your risk and risk as assets instead of being for things that would be like the most large things like that unless you're giving me a very reasonable risk it's an interesting example of congressional failure I think in that we've got the Dodd-Frank Act and they've got all these I think 194 regulations that were done down there all of them do what they could have done with one stroke of the pen by saying bring back Glass-Steagall Act we're going to let that out in the Battle of the Solar Capitalism of 2005 and all we ever say it seems so simple to me you could be in the deposit taking business or you could be in the investment banking business but you can't be in both we'll call it the mobile another question is anything about what we were talking about before I think it's important which is what do you see as the long term function of this organization of the nine parts what do you like to be seen as doing 10 to 20 years from now? well first of all I think it's unbelievable how it is convergent and I think it's quite remarkable what wonderful people you guys all are trying to help others and being the backbone of America you forget that too many places and people are doing all the nation's hard work and we're trying to be intelligent investors in the market it is just the office of intelligence so I feel very good about the message it cannot be the wrong message find another mutual fund manager in America that says if you do what I tell you you can't go wrong there's no one to say that I think Peter Lynch he was great in 1992 he left Magellan fund and it's dropped on the mentions later on from 105 billion dollars to around 9 billion that's a lot of disappointment for investors very mediocre actually worse than mediocre so for the extent people are looking people are looking all over the country for unbiased financial advice investment advice particularly and in the actual owners there's nothing any better than the owner of a product or service say I've done this and it works and so I see this thing spreading like an infectious disease if you will and pretty soon everybody is going to be affected with it so I see you getting bigger and bigger and I don't know the logistics of putting together your site I see some of this stuff and Mike Nolan my assistant sees some of it and gives it to me I imagine we have some full-time person at Vanguard who sees it and I believe that the management tries to respond when they see something significant you know on stages that kind of thing and I still get letters from shareholders asking me to correct these things I can't do that but I answer them and I don't know if I'm being already well or at least it's supposed to and so I think it's an idea an independent body of self-educated investors will learn the right thing in an industry that's going the wrong way so next year we should hire Madison Square Garden that that means to just have a great best question to our two people in the audience Susan, I don't know, Alex is around what's happening to website traffic it's I haven't really done the numbers but there's levels in activity and then I can't answer that overall but I think it's increased so it's also in the wiki side but not only from traffic but I'm getting a lot of comments here from people who aren't form members and they're saying thank you so it's not just the web traffic it's the people who are reading the form if you look at the stats of the views of the topic and how many people post you might have 10 posts but 100 views that means I'm helping 100 people not the 10 who post in there so a lot of the is for those people not just answering the question directly did you all hear that answer okay basically what Susan said that's Lady Keek what Susan said was that she's not sure about website traffic a lot of people are working basically and not posting and then the wiki is also getting a lot of traffic but Jack's comment I think is well taken which is the useful thing we do is the website there's a lot of good people on that website it's very high level and I think we are helping a lot of people and maybe just maybe in this era that is really where the actions went I don't know I think it's something that's worth looking at finally one more question let me just add one cool thing to that if I may and I was asked to write the introduction to the guide to investing and I came up with a quote from him Alexis de Tocqueville democracy in America and he talked about the tendency of Americans in the year 1818 or something a long time ago tendency of Americans to gather together to work on issues and to fix them and this is obviously to Tocqueville we're around today he would say man did I hit that one right out of the park of course Robert Button has written a counterpoint to that he says that we're not doing it as much but this may be the answer to that he's willing to admit that it's an interesting question and of course it's also social capital of the United States finally one last question and then I'll get out of your way Jack I've never been able to convince you to think about other people I really would try to do it but no other people can do this at all because it doesn't produce a good deficit it's not productive so we can't convince you about that it's a standalone asset we can't probably convince you in terms of portfolio automatic insurance and we're looking at a environment in which we don't know what is going to happen because of money supply and the velocity of money if someone came to you and said I just want to own a few boat of coins as insurance I hope they do what about the reason? I'd say be my guest we live in a totally uncertain world and if you believe in likelihood that gold would be a good performing asset in a bad performing world I wouldn't hesitate if your portfolio is a diversifier now 100% probably is not a bad working number to give you my opinion and recognizing that it's strictly a supply and demand equation when you buy you get no return on your money you buy it with the hope you can sell it if you ever do for a larger amount of money and you pay for it and so it's just another commodity with this peculiar almost universal use since the beginning of time so I wouldn't try and talk anybody out of it I don't have to do it with my personal accounts at all I would think about it in a long term account just because we don't know what's coming along and there is the possibility always the possibility of kind of a black swan event and that would be a helpful diversifier and unfortunately one of the things Bill you know this is that whenever somebody comes up with a diversifier someone with a hot performing asset will go in this case and says a great diversifier it should get an all time high no one called gold a great diversifier 15 years ago warped gold with a great diversifier I don't know maybe in 1960 and then they forgot about it they didn't perform well so either it is a great diversifier or it isn't but there is a huge tendency of our financial markets to rely on our financial promoters to rely on so you want to secretly watch that price of gold and it goes up so they try and intellectually justify it by saying it's a diversifier so I would say do gold do it in very small accounts and do it at all and with great caution this is the riskiest time the difficult time to invest I know and not so much the risk but the terrible returns I'll talk about this a little bit later the terrible returns on bonds the customary and inevitably the diversifier for an equity portfolio yeah it is the famous eel swam or ass resort with a great line and an awesome place paradise kiss goodbye I think that's the basic story of all diversifying and as well as that I will thank you Jack and get out of your way


Hi everybody, it's Sam at Mixed Up Craft. Thank you for watching my tutorial today. This is the start of my Mother's Day series 2018. I done one last year and I'll share all the links for those tutorials above. A little bit of a twist this morning after we stop laughing I've got my mum in the house. Say hi mum! Hi everybody! So we've had a few bloopers. I should have recorded them actually well they are recorded so I might edit them in later. Mum still can't stop laughing but I thought as a nice way to introduce Mother's Day week I would do some crafting with my mum. So we are going to make today this really lovely so if it's the biggest envelope you can do on the envelope scoreboard and I'll show you here. It is the six by eight and a half. It's the very last one on your scoreboard. It will give you the perfect envelope size for this. So this is a rocker card. Really easy to make. If I just bring it up there you can see all the detail. I've got little embellishments on there, die-cut circles and then basically it sits up like so and it rocks. So what do you think of that mum? I think it's lovely. I really do like it. So inside here as well. I'm going to talk. Yeah you are. Inside here I've got a little hinge as well just to stop it because it's quite weighted to stop it kind of falling out and kind of just going flat on the mantle or bedside or anywhere where people will keep it and it's you've got to balance it out as well so I'll talk you through that in a minute because obviously you've got a lot of weight on this side so you have to kind of balance it out on each side. So there you have it. So I'm using papers today. I keep raving about these. I absolutely love them. So the paper pack is the Nature's Grace Dovecraft which mum is like drawing over and I think she's going to pinch it from me. Lovely. But you're not allowed to because it's mine. Because it's Mother's Day I might let you have some. That's nice. And the card I'm using is this Ducast Paper Mania. So capsule assorted colossal colours. Solid card stock. It's card stock. It's lovely. Really really nice and you just get a whole rainbow of all different tones and stuff there in the back. So that is what we're using. Again as always I will share all these links in my blog and there will be a link for that below. Okay so mum is going to be doing all of the preparing of the flowers. No we're not having a lunch. This is actually what you're going to need today is a dinner plate and I'll talk through the sizes. A side plate. Oh sorry a side plate. Sorry I do apologize. I did ask her for a dinner plate and brought it up and it was like 12 inches and thought that's a bit of a big card. So we've sized it down but again so this is what we're doing. So I'm just going to pop that to one side. So the best way to, so you need, now if you've got a compass as again I'm crafting with my mum in my mum's craft room. Some of you that have watched old tutorials of me I've got these big circle plastic kind of rings with a cutter by X cuts and I'll share the links to them but I want to check the dimensions of it as well but you should be able to use those otherwise use a compass and what else. If you've even got any big circle dies that would work as well. So I am using a side plate that is coming in at eight and a quarter in diameter. So you want something as close to that really. If you've got your compass you want to set your compass at four and one eighth of an inch. So you want to set it at half of the diameter and then you'll put that into the middle, swirl it around your paper and it will give you an eight and a quarter circle. But I'm always conscious and aware that you know we've always got people starting off the crafting. Some people don't have all the bits and pieces so I'm going to show you how to do it with a good old dinner plate. Side plate. Alright. Okay so don't need the scoreboard.   So basically what I've got is all these punches. Again this is all my mum's stuff. So we've got three punches here of assorted sizes and then I've got these dies here, that one and also that one there. So you can see here this one quite a pointy one is with this die here. So we just come up a bit in there. It's that one then this one at the back is I think it was just two of them actually I didn't use that one in the end so we'll get rid of that one we don't need that one. So it was two of those ones two of those and then just little hole punch two of those. That one was just one there. I don't actually think I didn't use that one in the end either so you can pop that to one side. So if you can for me mum if you can die cut two of those. So I just got scrap paper here from the card that I made before. Everything's here for your mum, I've got your dying machine. So yeah so if you can do two of those on the yellow for me, two of those on the yellow and then I'll show you the other ones to do in a minute. So mum's gonna crack on and prep the flowers so again if you're doing similar that's what you want to do as well and then I'm gonna cut out this big circle here. So let's remove the dinner plate or the side plate. I keep saying dinner plate that's it now it's stuck. Okay so pop that to one side so that's all the measurements. So you just want to really as neat as possible because obviously this is going to affect the rocking mechanism which is why I mentioned if you you know if you do have a compass if you're very good with a cutting knife or if you do have those circles that I have which I will share the links to then you might find that easier if you are worried that you're not going to get a perfect cut. You have to be quite steady with this piece. Okay so I've got my circle or cut out. So the next thing you want to do is just fold that in half so make sure it's all lined up really well. Oh you need to use I noticed that actually if you just use that extra bit of this here I gave you. So just you have to do another one. Just sit on top and just put that shim in it. Okay so just burnish off there and now you have the main part so the rocker so that's really really straightforward. Now if you want you can die cut some circles you can put them right in the middle have a nice big sentiment I have some flowers down here and that could be your rocker as simple as that and put the little bit in here which I'm going to do but I just want to show you other ways to kind of add a bit more fun to it a little bit more dimension so open it back out again and what you want to do is using a metal ruler and I've got my cutting knife here so first of all with a pencil you want to cut what did I say it was going to be so okay so you want to come in at two and a half on this score line so come in two and a half and just put a little marker just there at two and a half then you want to do a line I'm going to use my grid my mat here just so I can make sure that I'm getting so I'm going to start with this line here just because you're using a circle you want to make sure that you get it then again from this score line you want to come up one inch okay so from that marker that we the two and a half marker there you then want to mark up one inch and down one inch okay like so and then again with your ruler you just want to do a nice straight line just bring that up there can you see what I've done that was the two and a half inch in point there and do that full pencil mark all the way through and then come up one inch there and come down one inch there okay like so now what we're going to do so we're going to put with your metal ruler we're going to cut from that top one inch line down to the bottom one inch line so I just again do this and bring it up so you can see like so so all I've done is I've just cut on the top of that one inch one down to the bottom okay then you want to grab your stylus and then you're going to score the other two pencil marks because we're going to actually burnish these and you're quite a strong score line through there now before we burnish it we can now rub out all of those pencil marks so most of it will be covered with DSP and stuff but just in case some of it does come through be careful over the piece that you've cut how you getting on with the flowers mum okay you do need a shim though for one of the um one of those dyes okay so that is now what we've got so I've got two scored lines because I've rubbed out the pencil here in here and then that piece that's cut so now what you want to do is fold down that back one this one now will fold down and then that other one will fold up like so light all down flat and then you can just burnish everything so okay now obviously we've got this piece poking out so all you want to do is very neatly with your scissors is just follow around that curve and just remove that okay and now we've got this little step piece that kind of goes down like so and now we can grab this little piece here so I've cut a piece let me grab my scoreboard again this piece here is a piece of three by three quarters of an inch and what you want to do is just score at a quarter of an inch one and a half and two and three quarters along that three inch side again get rid of this and then all you want to do is just fold the two ones down and then the middle one up so you're creating that shape okay so the outer ones have gone out folded and then that one's just folded down okay and then okay so so what have you died cut now then so we've got almost four two to two yeah yeah just die cut as many as you want mom and we can just add them in wherever okay then I'm just gonna on the outsides just put some double sided sticky which I don't use I do not use these rolls but my mom does so I'm gonna give hers a go so so just the outsides there both of those and then the very bottom just roughly in the middle don't worry too much just gonna stick one down and then the other side like so that's what you'll have okay and then actually then I need to fold up I think I've told you to fold it the other way but basically that needs to fold up inside like so and all it means is now that that will only ever expand to that width like so just stop no matter what how much weight now you put on that it will always stand up okay so that's that piece done so now we need to do the DSP for the front so you need to cut a piece of Bob whatever paper is that you're using and my piece here measures at use my scoreboard actually measurement so this measures eight by three and three quarters okay and then underneath along the eight inch side with a pencil you just want to mark at four inches so just in the middle there and then grab your side plate and you're gonna mark you're gonna score you're gonna do a pencil mark sorry you're just gonna trace the outside of the plate from the very top what's it top right hand side here like so all the way down so it meets up with that pencil mark at the bottom okay and then again on this side I'm gonna do exactly the same so again I'm just making sure the plate comes up to the edge there and saying that alright so that is just bring that up that is what you want okay and then again you just want to cut that out so again with my scissors and what I'm gonna get also mum to do if you don't mind mum and so I've got the piece here this is what's gonna be the main sentiment so I've already die-cut to with the purple background and then the same print the outer one comes in roughly three and a quarter inch squared and then the inside one is two and five eighths squared and then the next one down again is this one here and this is two inches squared and that's gonna go on top with our sentiment so I've already got the sentiment here and it just says first and mother always a friend I'm giving her a hug right now okay so and I'm using again mom's got all the stamping up colors I've got quite a few but mom's got even more so I did use rich raspberry but I thought it was a bit too pinky but the perfect plum went really nice so if you can stamp this is when mum's starting to sweat now I am sweating I don't I don't free stamp she loves her stamp positioner I love my stuff okay so if you can ink that one up for me and it's neat and as centered as possible I want you to stamp in the middle okay so while mom's doing that which you can see her doing I'm gonna cut this piece out all right mom we've got faith just hold it make sure it's all really inked up nicely and then just hold it down I always hold it in place for like remember the sentiment okay ten seconds always a friend there's always more paper we can dive that one don't worry that's it now you've committed I have committed no see what's wrong that's okay if it's a bit no no you've gone a bit heavy on the maybe you put a bit too much weight on the left and the this well if you want to grab the other side I don't think and I think I'd already put stuff I know you can okay just be a bit lighter don't be so heavy okay can I use my steps if you want so I'll try this again it's just it's just a little stamp just yeah don't be don't push down so heavy oh but enough but obviously that's okay I'm happy with that because it'll be for me so I'm going to know it's not for you do you want to move that to one side so we can get it on okay so can you stick that for me on there and if you can a little secret like I have there as well so just put a little secret in the bottom there and I'm gonna make the bow because my mum always moans at me whenever I do tutorials afterwards we talk about them and stuff then she always says I'm gonna teach you how to do both properly and I think I've got it I'm gonna show you how I do it now okay so my measurement then so you need to on the paper now I can't show you it on the reverse because if I do it on the reverse side what I'm gonna do next it then will be on this left hand side and it needs to be on the right so I have to do it over the top of this pattern paper so it won't be easy for you to see but you get what I'm doing so now we need to make this is gonna fit nicely over the top so you can see already I've got a lovely border but I need to make this piece here so I need to cut this piece away so what you want to do is you need to come down was it so I came down one and one eighth of an inch and came in two and five eighths of an inch so I can come along the bottom here actually so come along the top here two and five eighths of an inch like so so that's just from that side in is two and five eighths of an inch and then just gonna line that up on the front and just do that pencil mark on here as well so I can see I can rub this out I've just done on the front because then I need to come down from that pencil mark by one and one eighth of an inch so do a little cross there okay again it's hardly to see but then from that marker need to come down one and one eighth of an inch which is about there and then you need to come across in a nice straight line so this piece on the outside okay so now we're gonna cut that out very nice and neat just along and then come down so okay I'm not used to having someone looking over my shoulder literally mum is looking over my shoulder okay so now fingers crossed there we go so you pop that in place and you get a nice even order okay so quickly stick that down yeah I do like them but like I've said before I find I go through them really quickly I think I'm maybe too heavy handed on them and I think they can end up costing you lots of money I think as I'm in China I get that roll that I use that scotch roll I get it so cheap so you just want to lie this down now making sure that you get a nice even border you still kind of move it around a little bit because you're looking at you got obviously make sure this is fine this is fine the bottom so you have to play around a bit this bit here is going to be covered by a lot of flowers so I would say your main kind of focus is making sure that this bottom and along the top here because that's what's really gonna be seen okay so you can see that's all down now and then this lovely piece that's been stamped by mum is gonna go here so we just need to put some tape just along the bottom and then you just want to sit it so again so it's in the middle of this top line here and bring it down so it's kind of lining up with the bottom bit of the DSP here so that's about right okay there we go so that's that piece so now if I rock this it's just always going off to the left so this is why now you need to balance it out with the flowers that you're gonna put down here so man what have you done so these ones here okay I think we're gonna need because that so I'm just looking mirroring this so we're gonna have the orange one up there I'm gonna do this purple one this was one of the rosettes which actually comes matching with the nature's grace pack but I'm just gonna do all flowers on this one yeah can you do me that pointy one where's the pointy one gone remember is that green yeah can you do that can you do that in yellow for me yeah two of those in yellow yeah okay so that's that piece there and then I should have a tiny bit of acetate here we go trying to find it thank you so I got a tiny piece of acetate here and this measures at two and three eighths of an inch by half an inch there's just a very very small piece there and that's what I've got this one at the back kind of on now if you haven't got any acetate just use some of the purple card here it still look fine I just liked it you know kind of looking like it was floating and then I've got just a piece of foam that mum's got here and she's got loads of these and they're great they're really heavy where did you get these from can you remember I got them online somewhere but again I never take any notice I just put in I will try and find these or if anybody else has got these because they are really heavy and they're really good they were in set as well yeah no I've seen them yeah there's I think there's about maybe three or four yeah so I will have a look for you and I will try and share links to them but basically on this foam backing once you die cut your flowers if you just kind of rub it around with the ball there on the end it just brings them to life a little bit and I've done lots of tutorials with flowers and just stressing them and stuff like that so I will share some of those links at the end of this video as well but again they just see how quickly that all works and kind of just like I said brings them all to life so whilst mum's doing those other ones I'll bring in she's so she's done these little ones here as well for me so again even if they're tiny I mean the tiny ones take seconds so that one and then maybe yeah we do that's these are dinky dinky ones so that's those ones there thank you mum and then she's just done these other ones here okay so now you just need to put them all together so the flowers are really easy just move all this out of the way okay so first of all I'm going to do the one that's floating which is going to do this one here so just using some of the actually just use this tape here because it's quite a big area so just gonna put a little bit of tape in the middle you don't need a lot these are such so lightweight and just stick it in the middle so it's kind of overlapping like so and then I've raided mum's embellishment drawer so I'm going to take one of the big kind of creamy pearly ones there like so put another bit of tape on the back here thanks man and then just stick that to the top turn the acetate over here actually just stick it on the back there to the top of that acetate like so okay and then on the bottom on the back of that acetate as well just put a bit more tape and then I'm sitting it in this stepped bit so this kind of valley and just popping it in on an angle like so okay now if you want to do lots more on acetate you can but what you don't want to do is you don't want to go any further past this this 8 inch piece here your whole width because you won't fit in your envelope so you can see with mine here I've got that one right up to the edge but if you're going to do any more make sure they kind of come around this way they can kind of feel behind this area here but don't go off over that way because you just wouldn't be able to fit them in your envelope so that's that one there then and just stick this one down so they have all been cut out thank you mom so now we can just start putting them where we want so I'm gonna have that one so again don't need much on these are so light but like I said make sure even these bits here don't go past this this most outer point so it just will not fit in your envelope and that's gonna cover this kind of join here so see what I mean so if you are slightly out with your border at all don't worry because it's easily doctored and that's why I like things like this we like hiding things with embellishments yeah that's a good one for mum so if I ever see like a rogue embellishment on any of my mum's projects I usually say to her was there a little mistake then she goes yeah cover it with an embellishment always works what's your favorite thing you like to make mum oh boxes bags give boxes and bags and who's your favorite paper grafter who's your favorite don't be careful there's a right answer I think it's mixed up card oh good answer some of you may have read things that I've wrote on my blog posts and stuff and mum is my inspiration mum got me started on all of this although I've always been crafting or definitely mom encouraged me to share it with you lot so yeah I think we might need another little orange one maybe do that one yeah in orange or me all yellow it's yellow is not orange I choose it in fact yes we're gonna have one more extra on here because we're gonna do a yellow I think it needs a yellow one down there not this purple one I might put the purple I'll put the purple there we can always have an extra one it's not gonna hurt I think it's in oh no it's here I'm gonna add one more I need two please yeah one more just for the top thank you just again you can just stress these with inks as well you can add obviously leaves depending on what kind of paper you've got so you know this is just as always just a nice I'm just I do like so okay so that's all that there and then I've got to do the bow and a few more embellishments so while I'm doing the bow mum can you put a few more little sequins just like I've done in this one yeah if you can just decorate the middle of that so while mum's doing that I'm gonna cut off mom's got a big ribbon wall like I have so I'm just gonna trim off some ribbon and then mum you should be proud of me now I think I've mastered bow making I hope you can have a look she might always tells me off it when she watches my tutorials if I show her I'm gonna do this right live perfect I have brought a little ribbon machine a tiny little one just this little plastic device just to help me out if I do sometimes I'm alright but I think I've got this down better than I used to anyway that's it yeah yeah you just have to say you need to come that side a little bit you're happy is that yeah your standard there just about yeah yeah yeah yeah fine okay so I'm just gonna trim off the edges like so and then with a little foam I find the ribbon sticks really well with the foam squares so I just cut it down I'm just gonna stick a bit on the back there take off the backing and then when mum's done with the sequins I can stick that on top there so this one then I've just gotten a little angle just to the left because then it kind of again balances out all what you've got going on on this right-hand side and then I think the sequins yeah I think that's fine if the sequins just bring it just bring a little bit more shine we can add a bit more after I guess but they have it so now that will rock it's nice and even it's like so keep playing around with it rock it every now and then make sure you're not then going too heavy on the right-hand side to the left but you can see now when it stops rocking it stays centered which is what we want so there you have it two rocker Mother's Day cards as I mentioned the envelope you just need to use the biggest the last sorry scoring what's the word measurement on the scoreboard and I do have a envelope making tutorial which I will share as well so if any of you do want to look at that you can do but I hope you liked the first of this Mother's Day series 2018 thanks for joining me mum that's alright I enjoyed every minute of it you can now treat me to lunch yes we're gonna go out for lunch now tune in every day this week there will be a different Mother's Day themed project but as always they can be used for any occasion so hope you liked today's tutorial please give us a thumbs up if you did love for my mum and subscribe to the channel and I'll see you again soon take care bye