Meaning when you can just post one comment per hour, don't be worried, it's a measurement on Drupal.org to avoid spam, so yeah, the system automatically detects if your account is older, then you will have no problem. I don't know, so you can't, if you try to post many comments within one minute, like you're looking like a bot, then Drupal.org will, I'm not sure how it works. There's some spammer role that you then get or that you lose at some point, it's I'm not sure how it works exactly, it's a bit of a secret. So the spammers don't know how it works on Drupal.org, but yeah. Of course, Drupal.org is a popular website, so people want to publish their content there because it's good for their SEO ranking or whatever. Which also means anything that you do for your Drupal company on Drupal.org gives your company and yourself more visibility, so really, the first thing when you start out with Drupal is just created account and yeah, the first step. So this session will also be a little bit developer centric, so yeah. I will show you that the tools that you need as a developer to get something up and running on Drupal.org, maybe in two minutes. We have to wait a bit until the people arrive and until the recording is ready. Are we ready for recording? So we wait two more minutes to let some more people in and then I'm going to start. If you have any questions at any point, just feel free to ask me. Just raise your hand and I'm going to repeat the question to the microphone so that it's in the recording. We also have some microphones here checking if they work. Do you have a question, sir? What's the best so far with Mumbai? I think the food. So food is good. I'm a vegetarian, so I live in Austria and the options there are limited. So it's nice to go to an Asian place because they have lots of veggie food. I like that. Okay, I think I'm going to start now so that we don't lose a lot of time. Hello, everybody. Welcome to my session. This will be about publishing a module on Drupal.org. So I'm assuming you're a developer and you have some kind of code and you want to start to contribute and want to share something with the community. My name is Klaus Burra or Klausie on Drupal.org. I'm a software engineer at Epico. It's a small company in Austria in Europe. We're working on job boards, which means we're using Drupal and sell them as job boards where companies can post their company profiles and post jobs and applicants can apply for jobs. That's basically our business. On Drupal.org, I'm a project application review administrator, which means there's a group of people that look at new contributors, what kind of code they provide, and we review that code. I'm also a member of the Drupal security team. So when security releases come out, we coordinate with all the maintainers on Drupal.org to get that out. I'm currently working on the rules project. This is a contributed module for Drupal 8. And I'm also a maintainer of the rest module in Drupal 8. Core. And then I also work on coding standards for Drupal. So there's the Coder project, which can automatically review your code for coding standards errors. I will also talk about that a little bit later. So much about me. So one important aspect I want to talk a little bit about is contribution. So we should all thank each other more that we contribute much, that we offer our code to be shared amongst each other, because no one person alone could program all the code that has been developed for Drupal on their own. So we all live of each other's contributions. So this is the most important aspect of the Drupal community, is that we all provide contributions. And this makes this huge pile of magic where you can build actual websites and get stuff done. So I also want to thank you to you all for your future contributions. This is important for the Drupal community, as I said. And this is always the thing that we should focus on when we work together, that we appreciate each other's contribution, and that we make them useful, and that we make them most out of it. So before you start to publish a module, there are some questions that you should ask yourself. One aspect is duplication. Most of the time when you want to publish code, there is something similar probably already out there. So the first thing in order is to do a web search, do a Google search, or do a search on drupal.org. Does a module like that already exist? Can I work with the maintainers that are already there? Can I contribute my code there? Because if we create many similar modules on drupal.org, then it means that it's much, much harder for the users, and we all are users. I'm also searching for modules on drupal.org to find the right thing. If there are 10 modules doing the same thing, and they only have one maintainer, and they're not working together, then that's really bad, because I have no idea which module I should choose. So this plays into the drupal community ethos of joint forces, which means we always emphasize collaboration over competition. In this community, you are not alone. There are always like-minded people, people trying to accomplish the same task, so you should really work together instead of competing, and then make one module which is better than two separate modules that do kind of the same things, but are not really finished, so it's always better to combine that force. Then there's also the aspect of utility. When you program a custom module for your site, it might be very specific to that use case of a site. Then that means it might not be that useful if you publish it as a project on drupal.org, because it should be in some way generic that you could use it on any drupal site for a certain use case. For example, if you have the organic groups module, it's quite generic. It doesn't tell you that this is made for a news site or this is made for a job board site. It's just grouping content together and providing a use case. That's also an important aspect of the drupal community that every module is programmed in a very flexible way and can be used for many things. And also there's the aspect of dedication. It should be, publishing a module is not a one-off shot that you just do once and then forget about it. You should also think about how I'm going to maintain this, how, what happens if there's a security issue, then you have to work together with a security team to create a new release. So you should also think about how you can support this in a long-term, be a responsible maintainer. So the first thing that we have in drupal.org are so-called sandboxes. These are project pages that have a sandbox URL. So it clearly says in the URL that this is a sandbox from the user Clousey and it has just the number. And it also has this experimental warning meaning that there is code in there that hasn't been reviewed, that hasn't been tested. It's probably not meant for production use. It's just something a person put out there. And the most important aspect is everybody that has a drupal.org account and has agreed to the terms and condition and I think there's also a Git repository policy can create such a sandbox. So you create your account in drupal.org and this is where you start. With the sandbox, everybody can push their code. The only thing you need to know is Git. I will talk a little bit about that later. So a sandbox has this project page and it also has a Git repository and the Git repository contains the actual code. And the project page is meant to describe the sandbox, what kind of code is in there. As we can see, there are no releases. Releases are only for full projects and that's basically all there is to a sandbox. On the other hand, there's another kind of project on drupal.org. These are called full project. So what you can see here, they have a full namespace URL, which means you always have the slash project prefix and then a short name for the project. In rules is just rules. Something there's an underscore in there. You probably have seen this pattern a lot. And the biggest differences to sandboxes, of course, they don't have an experimental warning and they have tag releases. So you have some branches in Git and then you create tags and can make releases out of them. And all projects on drupal.org that have stable releases like that, they are also supported by the Drupal security team. So when a security issue comes up, the security team works together with the maintainers to get a new release out and create a so-called security advisory telling people that they should update and what the problem was and how it was fixed. So that's the biggest thing. Not everybody can create full project. This is only user accounts that have been reviewed can do this and I will talk about this review process. But there's also the possibility of abandon project. So there are quite a lot, quite a few, a lot, I don't know how to say that correctly there. Some un-maintained project on drupal.org. So as I already said in the beginning, when I talked about duplication, instead of publishing something new or instead of publishing a fork, you should work together with the un-maintain project to just contact the maintainer and if they don't respond, then you just open an issue in the drupal.org webmaster queue and you say, hey, I would like to take over this project. Here is some code that I've written, this should be replaced and then the webmasters will transfer the ownership of this full project to you. So you can now work in this project and people should do that more often. They should work together. Sometimes the maintainer just say, yeah, sure, you can work with a project. It's not a problem and we should do this more often. So instead of creating another project, really do that. For example, you shouldn't create this plus project or a better project. So don't create a project like better comments or coder plus or I don't know, comments double plus improved now really. You shouldn't really do that. Work together with the projects that already exist and improve them. Also, there are existing users of this full project. So when there is new code out there, they are going to test it and they will give you feedback. You have a much higher visibility to do that. As I already said, if you cannot contact the maintainer, if they don't respond, you can go to the webmasters and they will transfer the ownership to you. So there's a link in there where you can get the instructions exactly how to do that. And these slides are also up at the Drupalcon website now so you can open the presentation from the website and click through the slides and then you can click on the links if you want to look this up. As I already mentioned, every sandbox, every full project has a Git repository attached to it. So for every Drupal developer, it's very important to learn the basics in Git because every maintainer, everybody that pushes code to Drupal.org has to know Git to some degree. You can either use Git from the command line, you can use it in your IDE. For example, in PHPStorm or in NetBeans, you just use it somehow. And why do we use Git? It tracks the changes that you make to your project. So you make an amount of so-called commits which means there are change sets to your code and then you tag a release at a certain point. And later you find a bug, you fix that and you might fix another bug and then you create a new tag and this is then going to be the next release. Every project on Drupal.org has a version control tab and there you can find the Git clone command. It's actually very similar to other systems like GitHub that you know, every project page that you see has an associated Git repository and you find a clone command there and how you give you the instruction how to get the code. Branch names in Drupal we usually call after the major version of Drupal that the code is written against. So this would be an example for Drupal 8 code. You call it 8.x minus the branch of the project 1.x and the tag would then look like this. My module is somehow ready so I tag it with 8.x 1.0 but it's the first beta, it's not a full release yet. And the documentation how to use Git is actually quite good on Drupal.org. I also recommend you to look up that. It's an essential tool that you should use for the project that you publish on Drupal.org but it's also nice to use Git for your client projects. It's really an essential tool for any Drupal developer. Another thing that you consider before you publish your module is to follow the coding standards. This is important because other people are going to look at your code, contributors, clients, people that want to do a security review of the code. They want to look at it because Drupal is of course open source so people are going to read your code and they need to understand it. This is why I have come together to set a certain set of standards and formalities. So for example around whitespace and indentation how code should look like because if we all use the same patterns for our code then it's much easier to look at another module and then immediately realizing what is going on there and what the module does. There are also naming conventions, how you should name your functions, for example in Drupal every function that you write for Drupal 7 module for example needs to start with your module name. That's why for example in the rules module every function will start with rules lowercase. So these are some conventions that we follow. We also have lots of coding standards for inland documentation. So when you write code you should leave comments. You should leave a short comment what the function does. You should give clear names to your variables and all of this is documented on drupal.org in the coding standards document. So in order to follow that there are automated tools that you can use. There is the Coder project which uses PHP code sniffer. This is a command line tool that you can execute. So what I'm doing here is just invoking the PHP CS command with the Drupal standard on some example module and then it will list out all the coding standards problems that it finds. For example there's a function documentation missing or the opening brace is not on the correct line. It will also give you a hint which of those errors it can fix automatically. So Coder and PHP code sniffer come with a second command which automatically can fix your coding standards. This is really nice if you have some old legacy code and it's really not written. It's hard to read because it uses tabs instead of spaces and you can just run this PHP code beautifier over it and it will at least fix that so the code is much more readable. This all is in the Coder project on drupal.org so I recommend you to check that out. The same thing we have for JavaScript. This is done with ESLint. This is a node package. So for most front-end developers it might, it's probably not a problem to install another node package because they're probably using some SAS pre-processing for the CSS anyway and there are instructions how to install ESLint and it works pretty much the same in Coder. It will just review your JavaScript file and then give you hints what you can improve in your code. Drupal 8 already ships with such an ESLint RC config file which specifies in JavaScript files you should use two space indentation, other stuff that should be done and on ESLint.org you find instructions how to install it and how to run it. So these are essential tools that you can run to automatically check your code. They will give you some important hints. And all of this has also been put together on a website called pa-review.sh. So I wrote the original pa-review.sh bash script which uses Coder and uses ESLint and some other review tools that you can execute locally and then Patrick from Germany put it up on a website called pa-review.sh and what you do there you just give it the GitRepose URL of your project and then hit the submit button and then it will download the module and check it and give you a nice report what coding standards problem there are in your project. So in the project application review process where we look at your code we use this a lot to automatically review code. Another important thing to consider when you publish code in Drupal.org is licensing. So we want to prevent the Drupal association to get into legal trouble and since Drupal is open source and it's licensed under the GPL version two all code that is pushed to the GitRepose.org on Drupal.org is automatically GPL version two which means you need to be careful if you have third-party libraries that you are using them in your module because you are not allowed to push them in the GitRepose.org is that you should tell users where to download them. One example you are using for example the Amazon web services SDK for PHP in your module then don't include it in the GitRepose.org and just tell users here's the module and then you download the Amazon PHP library and put it in this place and then it will work. So you can also use for Drupal 7 the libraries API module to include third-party code in Drupal 8 it's more and more the use of Composer if you're referring to PHP libraries but I think the libraries API still exists for JavaScript libraries that you include in your Drupal code. Yes, so it's also important if you develop a theme for example if there are font files or icons, images make sure that you have the right to publish them on Drupal.org because as I said everything that goes in there needs to be GPL version two cannot be anything else and this is important if it violates the licensing then you need to remove it. This is also something that we review when we review applicants that apply for full projects. So I think this is the most important aspect when we think about new project that people put up security. So of course if you publish a module it shouldn't make the website it is running on less secure than it was before. So always when you develop code always work with it in a security mindset make sure that the data is protected make sure that the configuration that can be done with the module is protected in a way that it cannot be abused or anything else. And security is also the reason why we don't just allow everybody to publish full projects on Drupal.org because we have the security team and the security team wants to support all stable releases of any contributed module but they can only do that if we know to a certain degree that the people know what they are doing. So we need to check the code somehow. We need to approve users that we trust them and yeah that's a very important part when we do project application reviews. As I already said your code that you publish shouldn't be a threat. That's why you should security review your own code yourself but it's also a good idea to ask somebody else to do it for you. And in this process you should get a little bit creative so think about it. How could an attacker abuse your module? What could they do with it? Could they run their own JavaScript? Is there a cross-site scripting vulnerability somewhere? What weaknesses does your code contain? Is every path that you have implemented protected with a certain permission? Is the code that you have written ready for a production side or is it still very much experimental? And Ask yourself also are you familiar with the security concepts in Drupal? So there are certain vulnerabilities that you can easily run into and we have some good documentation on Drupal.org to write secure code. This is mostly written for Drupal 7 but many of the concepts also apply to Drupal 8. Just to give you an overview what kind of security vulnerabilities do we find in Drupal Contrib and more than a half is cross-site scripting vulnerabilities. And I will talk a little bit about that. It's basically attackers injecting their own JavaScript into your website and thereby they can exploit admin access, for example. But there are also other kinds of vulnerabilities like access pipers. You forgot to check for a permission somewhere or you forgot to protect a path or you forgot to implement the node access tag when you show a list of nodes. This can easily happen so there are also quite a few access pipers vulnerabilities. And there are also others like cross-site request for tree and SQL injection. They make a smaller percentage of the vulnerabilities but of course they are also very bad. I think that the most that has the highest impact is SQL injection. If you have that in a model it's really bad because then an attacker can easily modify data that is in your database which is really bad. And there are also other kinds of security vulnerabilities in this last piece. So let's look a bit at cross-site scripting. What is this? Many develop a module and your module might produce HTML output and it might access user provided variables. So in this example, we have a reflected cross-site scripting example. Let's assume you have a simple PHP script, not even Drupal. It's just a simple PHP script and you're outputting something from the URL and number. Do you think this is secure? What could go wrong here? And if you think about it, anything an attacker can basically pass anything in that number and when you print it like that an attacker passes script tags like here, they can execute JavaScript on the HTML page. So whenever the page is being printed to an administrator, for example, then the JavaScript is executed. So what would I do as an attacker? I would send you, you are the admin of the Drupal site, I will send you a link with a special number parameter in it and when you click that link, PHP process that, prints that out and then in your browser the script is executed and that script might, so in this example it just pops up and alert which is pretty, that's not really harmful but it could also load some JavaScript code from my homepage for example and then execute it as you as the administrator and for example create a new user account or give some other user an additional role. So cross-site scripting can be really dangerous and you should be aware of that. And in Drupal 7, in 7 the general rule is use it always sanitize user provided text. The user provided text can come in many forms as a parameter in the URL or it can be a note title. It basically can be anything that is in your database. It can be user provided so it's not trusted. So when you print something to HTML we need to make sure that it's not JavaScript that is sanitized properly. In Drupal 8 we use that tweak rendering engine and it has auto escaping built-in which is really, really helpful. So I hope that we can bring down the cross-site scripting vulnerabilities for Drupal 8 quite a lot. Yep. But there is also cross-site request forgery. I just show you some vulnerabilities and how they can be exploited. So to give you a feeling what can possibly go wrong with your code. So cross-site request forgery means an attacker can change data without verifying the intent. Let's look at this HTML example. So we have an image tag here and usually you would find that the source attribute you would find some kind of image. So as an attacker what I have done here I have put in a URL to your Drupal site in there. Let's say example.com is your Drupal site. And let's say there are a quick delete module has been enabled there and it exposes that path. So what happens if you as an admin go there and you have access to the quick delete path and you go to the attacker's page and the image is rendered. What the browser will do it will try to fetch this URL and if there is no CSIF protection then Drupal will just execute the code and quickly delete the node in this example. So what we have to do here is either use confirmation forms. The form API in Drupal 7 and 8 and all versions has CSIF protection built in. So it means when a user goes to that path they have to click an additional button so nothing gets deleted by default. Or we use per user tokens in the URL. So sometimes it's nice to have quick links to delete something but then we need to do it like this here at the bottom we have an additional security token this is different per user so an attacker cannot guess this token and the link will be secured and can only be executed from HTML that has been printed for your user and not on some completely different site or whatever. So these are all things that you have to think about when you take security into consideration when publishing a code. And do you see the pattern here? What happens? We need to be very, very careful about user-provided data that comes into Drupal. It can be in a URL, it can be in a request, it can be in a body of the request, it can be in the content of the database. Because as the golden rule in Drupal you always store what the user typed exactly. So if they put in a script text for example in the node body okay that's fine you store the script text in the database in the field but when you render it to HTML you make sure that it is then sanitized appropriately. That's why we never trust data that is in the database because it could be potentially be from someone that we don't trust. And what attackers try to exploit is missing a weak access control so make sure that your permission setup is configured correctly. And what we saw here when I explained to you cross-site scripting and cross-site request forgery is that this browser features to perform actions behind the user's back. So when we saw the image earlier that the browser doesn't ask you should I fetch this image now? No, it just executes it, it just fetches that path and if it's an image then it can display it but otherwise it just will execute a request and whatever happens on a server happens. Same with cross-site scripting the browser will not ask you should I really execute this JavaScript that is here? It looks a bit suspicious. No, the browser whatever JavaScript text it finds in the HTML it would just execute it. And if an attacker manages to inject JavaScript into your HTML, the browser will just execute it. They won't ask for your permission. So that's important that we always keep this everything that is provided by the user even by admins, by editors, by anybody is not trusted and we need to make sure that it's sanitized when we deal with it. Okay, now let's talk a little bit about workflow how does this now work on Drupal.org the review process?  And there is this review checklist. A lot of these points I have already mentioned. So the review checklist is something that you go through as an applicant but then also reviewers that look at the code will go through the same thing. So they make sure there's no duplication that the module doesn't exist. They check for security and licensing those are the most important parts but they also take a look, is there documentation? Is it obvious to users how this module can be used? Does it follow the coding standards? Is the code usable? How is the API usage? Are they abusing something? Is there maybe an SQL injection or some other weakness that could be exploited? And there's also a link in there which explains the lists which gives you a point for point checklist that you can just go through and make sure that the code follows that. Then there is the project application queue. So on Drupal.org we use the so-called issue queues. Every project has an issue queue like Drupal core has one, the big modules have one, every module has one. And there's a special project called project applications. So this is not really a project it's just a meta queue which is used to track applicants. So what you do, you go there and you open an issue and you give it the name of the module. For example, I want to publish the rules module and you apply it for permissions to create full projects with that because when you start your code is in a sandbox and now you want to push it up to a full project to have a nice name or to have releases. So you create your application issue there. It's just a usual issue queue and then other people will review your code. And in the end, when everything works out you will get approved. So how is the workflow? You open the applications needs to view which means somebody else should look at it and they will then check out the code. They will go through the review checklist that we have seen before and if they find a major problem for example, they find a security issue, they tell you, hey, here's a cross-site scripting vulnerability, you should fix that before you publish that. Then the issue is set to needs work which means now it's your turn to fix this problem and when you've done that you set it back to needs review. So this is the standard issue queue workflow that you might already know from Drupal Core when we develop patches, it's pretty similar and the same thing we're using here to approve applicants to review them and then to approve them. And in the end a reviewer says, okay, I don't see any problems anymore with this. Then they set it to review and test it to the community. So which means in their opinion everything is ready and this can now be approved by a good department. And then a Git administrator, this is a group of people on Drupal.org, they approve the application and set it to fixed. So what then happens is the user gets the so-called Git vetted user on Drupal.org so they have some elevated permissions and they can now create full projects. They can still create sandboxes so nothing changes there but once their sandboxes are ready they can promote them to full projects. And they cannot only do that for one project but they can do it for any project in the future. So this is a one-time approval process. You only do this once. You apply with one sandbox and when that's approved then we trust you which means we trust that all future projects that you create will be secure and good as well and then you can publish them on your own. No review process after that. Of course this is not without problems. So there are certain things that are not nice about this review process. If you compare it with GitHub for example, anybody can publish anything on GitHub that's also why you should be really careful if you download something from GitHub because you don't know what are the skills of that person. Did they actually, is this a known person that knows what they are doing or is this just some experimental code? Yeah, it's hard to tell. On Drupal.org if it's a full project and a chance that it has been created by a user that knows what they are doing is really high and if it's a sandbox then there's a clear distinction this is experimental. So whatever code you download from Drupal.org you're thinking about do I need to review this? By how many people is this used? With the most popular modules like the views module or I don't know the rules module they have been downloaded and used so many times so the chances are good that this is trusted code but if you download something which has only one user might think about maybe I should look at the code myself to make sure it actually does what it says. Yeah, but back to the problems that we have. One thing is that we're always running out of reviewers so at some point you might get really angry in the HQ you created your application and it takes really a long time nobody's looking at your code. Some applicants wait even for months and they don't get feedback fast enough. The problem is that we don't have enough reviewers so this takes some time. These are all volunteers that work in the Drupal community nobody gets paid for that and that's why it may take some time. So what people also might perceive as unfair is this one-time approval process so once you have the role you don't need to get reviewed again so people might think this is really unfair once the people are approved they can basically do anything on Drupal.org but I have to wait here and I cannot publish further modules so people get really annoyed. Some people are also angry that they only get superficial feedback people are pointing out the coding standards errors they make but they don't review the actual functionality of the module. So when you provide feedback for a module make sure that you point out yes this module worked for me I think this use case should work like this or this is good so you should really tell the people about the functionality of the module not only point out coding standard errors. This is something we have to constantly work on as reviewers so that we give the applicants a good experience when they publish their module. After all it's a contribution and as I already said this is something very valuable so we should be careful how we treat the applicants. Some consideration why are we doing this at all so we could also say why just can't everybody publish project? But there is the problem of spam I already mentioned this in the beginning so there could be some namespace quoting by random users they sign up for an account then reserve many namespaces and then the webmasters have to go in and revert that give the namespace back so this could really increase the workload so that's why we have the process to make this a barrier to spam but also we have the security team as I already mentioned and they want to support all of all contributed modules that are out there just have a stable release so the security team makes one important distinction this is between stable releases and non-stable releases unstable releases is a beta and alpha version of a module so the security team does not release advisories for that but if it's a 1.0 or 1.1 or 2.0 then this is considered to be supported by a security lease and they will work together with the maintainers to fix security issues in case they come up also Drupal has a certain reputation so most of the code that we have in Drupal.org is actually quite good and most of the contributed modules are also quite good they are used on many, many sites this is something to be very proud of of the Drupal community so of course we want to preserve this quality level of contributed modules that's also why we consider having this process and also encourage collaboration over competition this is forced into the duplication month that don't publish your module without checking ever what the community provides so make sure that you don't duplicate stuff these are all reasons why we have the current projects but yeah so what can you do to speed up your application? our problem is that we are lacking reviewers so my idea a couple of years ago is that applicants become reviewers themselves so what you do is you review other applications so there are other applicants out there they publish interesting modules you just look at them and you review them according to our checklist and then you say yes this module works or no this module has this and this problem and after you have done this for three projects you give your own issue attack PA review review bonus so which means then you show up on a high priority list where I for example as a Git administrator will look first when I'm reviewing applications I always go to this tag because I don't have time to review everything so I need to prioritize and of course I want to help people that help others so this is my high priority list where I review applications and it's also a good experience you can learn really a lot by reviewing but what you can also do is community networking so as already said as community we should work together so when you want to publish code it's important to make connections to other Drupalistas in your area or worldwide there are many channels that you can use you can ask colleagues at your company to review your code then you can improve the quality so you can even work together with them on Drupal.org you publish the module your colleague reviews it and sets it to RTPC this is totally fine it's just a second pair of eyes that makes sure that the code is good or you can it doesn't have to be colleagues it can be friends it can be other community members you can go to local meetups make connections there you can go to user groups but there's also on the internet IRC we use the internet relay chat protocol so there are certain channels where the Drupal community meets online you can also go there and try to find people that want to work with you there's also Drupal answers on Stack Exchange where people ask questions and your module might be the perfect answer to a question so it also makes sense to post it there and the important thing is just to get visibility to your sandbox and then more people will review it and you will get approved faster it's also always good to communicate about your project so maybe write a blog post about it and post it on social media just get the word out so that people know that you are working on this and want to promote this and it also helps to contribute and make yourself known so in the Drupal community you will just be known and people will trust you we're starting to trust you we want to work with you so this is a very good process everybody should really do community networking because we shouldn't work on our own we should work together we're all using each other's code so it's important to work together what are the benefits of reviewing? you might want to help another applicant so what is in there for you? so what you can really learn you learn Drupal by reviewing code you see what other people are doing with Drupal it's the same as if you look into the source code of Drupal Core you see it's done like this this is very interesting now I know how it works the same with other projects if you review them you can maybe point out even mistakes you can say usually in Drupal we do it this way but it has a problem you learn about alternative ways people are very creative so when they publish new modules they have a really interesting idea how they are doing things and you can learn really a lot for that and to learn how to analyze for a code you learn how to review code which also comes in handy if you are having a Drupal job and you would like to review code from your colleague then it helps if you are already familiar with that you also learn how to write secure code because if you look at the application list you will see people pointing out security issues and then as another review you will see I haven't thought about that that's a good point you learn about best and worst practices you learn what people do right and what they do wrong and how it could be avoided so whenever you write the next module it helps you to do it right you also stay on top of what is new and hot which means there are a lot of interesting new projects posted for certain use cases that are coming up for web trends for example any new third party services that might pull up so a lot of interesting things in the queue you basically see what people are working on and it also helps your own Drupal career if you think about it most of us are professional Drupal developer but maybe you haven't started with Drupal yet so this is a good opportunity to review other people code engage with the community and maybe then land the Drupal job I always recommend that to people so I'm new to Drupal I want to work with it and I don't have a Drupal job yet this is the perfect opportunity to work with other people and help mentoring and being mentored and then it's easy to actually get a job in Drupal so how can we improve this on Drupal or overall there are some plans that people are working on and of course we want to make the experience better for the applicants so currently they have to wait a lot it takes time until they are reviewed and what can we do about this the plans are that we integrate the automated reviews into Drupal.org itself so we saw the PA review website earlier this is an external site it's not that nice it would be actually cool to have a code review tab on every project on sandboxes and full projects so that you can go there and see a report Coder has been executed on this and these are the problems I can just fix it here and the plan is also to give every non-git vetted user the rights to promote one sandbox so you push a code to a sandbox and then you can immediately turn it into a full project but you can only do that for one sandbox until you're not approved yet so the goal is to bring people up to speed sooner so that they can get code out sooner with full projects and releases although they cannot create stable releases so that they can push out the first beta or the first alpha version of a module and people can already download that and they have the visibility and people know about it and they have a better experience so there's no, as I already said there's no security team support for unstable releases so for the security team there wouldn't be changing much you would have your beta release out there and then you would go through the approval process after that so instead of giving a sandbox for review or providing a full project for review and then people would just review that otherwise the process is the same so you get reviewed once and once you got that you can publish as many modules as you want it basically means we trust you now so there's also an issue to track this on Drupal.org where people are currently working on it as I said this is just a plan it hasn't been implemented yet so there is a community initiative on Drupal.org to make this happen and basically we just need to implement permissions so the users can publish this one sandbox and then get started sooner there are a couple of sub-issues in there so they specifically list what tasks need to be done and Jeremy Thorsten is leading that effort I think he also created that issue so if you want to help with that if you want to implement something for Drupal.org that's also the place to get started yes and getting involved overall is a good idea anyway so there's a group of reviewers on groups.drupal.org that do code review and a project application issue queue and those are not only Git administrators but those are regular reviewers that post their stuff there one interesting thing that you can also do if you become a little bit experienced in Drupal you can become a Git admin yourself so the process is not really difficult as soon as you are a regular reviewer we would just get in contact with you and if we see that you do good work if you bonus points if you find security issues in projects on Drupal.org this person really knows how to review code they should be a Git admin themselves and then they can approve users so this is just a list of people that do that and they always want to put in new people so just talk to me if you want to get involved with that as we already talked about Drupal.org plans there are many tasks now that people can help work on and there's also another way to get involved that are the code sprints on Sunday so people will gather work here at this event at DrupalCon on Drupal Core they work on contributed projects they work on documentation, all kinds of things so you don't just you don't have to get involved with code reviewing but there are many, many, many topics in Drupal you can get involved I'm active in code review so I'm also happy to help you out getting involved there so I think that's it for now I made it a bit quicker any questions? yes we have about 8 minutes time for questions anyone? so here's a microphone if the question is short I just repeat it I was guessing that it's on I was guessing that can Drupal review process can be used with the help of platform message with the help of what? platform platform I don't know black form platform.sh oh the hosting company yeah it has a very good review process I see, no I don't know about that it would be interesting so what do they review? just like peer reviews anybody can review any code like that can we implement that? I think it's already implemented at pareview.sh and there are now plans to integrate the automated review that coder does so that's one sub-task of the plans that I've been talking to do that I assume that platform.sh does the same thing is that peer review compatible with some other repositories as well or it only works with Git? no it only works with Git at this point in time everybody should be working with Git everything else is a waste of time that's true but I mean everyone don't use the Git yes if you're still using subversion for example or mercurial or anything else you should really learn Git because it's a tool that is going to be used everywhere on drupal.org and also on other projects I highly recommend that sorry anyone else? so the matrix like number of installs and downloads most of my projects are like long term projects and I usually disable update manager so that the code stays stable it might break with the new version so is there a plan to have a flag or something which I can just go in and say that this project works for me because if it is not working I can easily go in and create an issue but if it is working to have a matrix like this is working no it's a good idea I think people have talked about this very often on drupal.org that there should be some R rating system or some feedback for users or just a flag so that people can indicate this is working for me or not but currently it's not implemented yet I don't know what the current plans for that are I think it's on hold so what you can just look at is the amount of installs basically if many people have this module installed the chances that it's actually working is high but of course it always depends on your use case from the site I could have an instance yes it's still a good indication because you would have to spin up many instances to just to create false data yes then it will count five times like project URL or project name yeah could be possible so that becomes more of better matrix because if I'm trying to enter the site name there are five developers they are trying to enter the site name twice it says that okay that project has already been added in the list yeah would be an idea any more questions here is one this is regarding github you have gith can we have the sandbox on github in github there is no distinction because on github everything is prefixed with the username or the organization you are working for so on drupal.org it's slash project slash name on github it's slash your username or slash organization and then slash the project name so on github there is no distinction that's why I said be careful with the code from github because you don't know how many people are using that how secure is this there is no indication on drupal.org you at least know this is in a sandbox so people mean that this is experimental code if it's in a full project the chances that it's actually stable is higher okay then there's another question see so we want to have two separate things is it possible there's a way to move code from github to this yes it's totally easy so what you just do with your local git repository you just add another remote you clone from github then the remote origin is github then you can add another remote you call it drupal.org and give it the correct URL you find it on the version control tab of your project and then you say git push to the other remote and then it just pushes all your commits and then it's just a complete mirror it's the same it's the mirror of the code in github so what we do in the rules project we have a mirror on github so we're using pull requests to work on rules but the code is also synced to drupal.org so that's a recommended way it's some one way to do it so the most important stuff is that the code is on drupal.org because that's where you create the releases if you have it on github or not it's your choice so because you know you'll find a lot of users and developers on github so if you have an active project you could actually have it on the side the git of drupal or would you recommend the other way around where you have an active project inside because the collaboration would happen more freely on github I'm just guessing you know probably it depends on the drupal community is mostly on drupal.org because the issue queue is much better than on github so in github you cannot say something too needs work only the maintainer of the project can do this so there's no workflow if you imagine drupal code is 30,000 open issues if it would have done on github people would go crazy drupal.org you have better filters that's why people use drupal.org because the issue queue github is so limited so I think we have to stop let me check yeah one more question excuse me I have a question I didn't get the point that you have described benefit of reviewing actually there's a point that learn how to analyze foreign code I didn't get this point actually it means if you look at other people's code often it means you develop a skill to analyze foreign code, foreign means not your own so if you look at another project it's not your own code and you do that very often you see people do it like this that person did it like that you can compare it in your mind how people do things so it's the kind of practice you get and it also helps if with your own programming skills if you have seen many approaches how people do things it helps to improve yourself that's what I meant with that thank you I'll be out for more questions thank you


Okay I think we'll declare it 9 o'clock and begin with the first lecture of the day which is titled in your program the Austrian Theory of the Business Cycle. Actually I think of this material as a little more general than that. I call it capital-based macroeconomics and the most well-developed aspect of that theory is the business cycle. But if you look at my book Time and Money you'll see that I deal with other issues that aren't business cycles. I deal with fiscal issues. I deal with tax reform, consumption tax versus income tax. I deal with the idea of infrastructure and how that looks in this framework. But this morning it's going to be the Theory of the Business Cycle. I don't want to save my punchline to the end. I want you to see how this works out. The distinction we'll be making throughout the hour is a distinction between sustainable growth and unsustainable growth. It's the macroeconomics of boom and bust. That's the unsustainable part. And I can even give you a clue on how to know whether the growth that you might be expecting is sustainable or unsustainable. If growth is used as an entrancity verb, which in the context of macroeconomics that always should be, then it's sustainable. In other words, leave the economy alone and it grows. That's an entrancity verb. It doesn't take a direct object to, you know what an entrancity verb is. Leave the economy alone and it grows. Well, it'll grow on the basis of how much you're willing to save, but it will grow. The transitive verb, elect a Keynesian to office and he will grow the economy. Okay, watch out. And dating back from several presidential elections ago, the phrase grow the economy has become a staple of both Republicans and Democrats. And so it has the effect of fingernails scratching on the blackboard to me. Okay, so I wanted to have that effect on you too. So I want to start out by just setting up the elements of capital based macro over the theory of the business cycle. And what I want you to see is that I'm using to the extent possible, some off the shelf, graphics that can go together and tell the story of boom and buzz. Production possibilities frontier will be somewhere in the first 10 pages of every elementary textbook that you pick up today, although it doesn't come into play in the exposition of business cycle in those texts. The loanable funds market is a staple derives. It comes out of Alfred Marshall. It was developed by Dennis Robertson, a British economist. And it's a workhorse in macroeconomics of the Austrian school, but tends not to get used certainly in the Keynesian theory, as we'll see. The structure of production is the only one that's sort of uniquely Austrian. That's that's what's so Austrian about the Austrian theory. It's at stages of production, the Hayekian triangle and all that. You've seen it before, even in my lecture, and you've seen it in other people. So you should be prepared to see that. And labor markets, well, of course, that's heavy in Keynes. It's all about labor, unemployment and malfunction of the labor market because wages are sticky downwards and all that. But in the Austrian view, we have to have stage specific labor markets to tell a better story. So that's what it's all about. And the applications as the cover slide indicated about sustainable growth supported by saving and unsustainable growth is triggered by credit creation. Now, one of the things you'll note about this lecture, and especially if you keep looking at your watch from time to time, is that most of this lecture, probably two thirds of it, will be dealing with the sustainable growth. And I do that because of a particular methodological maximum articulated by Hayek. I think that comes up next. We'll see. Well, there's Mises and Hayek. Mises originated the Austrian theory in the business cycle. I can say now over 100 years ago, 2000 from 2013 back to 1912, in theory of money and credit. And in that book, it's only a few pages near the end where he sets out the Austrian theory. And it was developed by and large by Hayek in the late 20s and throughout the 1930s. And now turned out to this methodological point, which seems to command a scent just on reading it. Before we can even ask how things might go wrong, we must first explain how they could ever go right. One's a prerequisite of the other, surely, surely. And I remember in an article that I wrote about Hayek in Keynes, I mentioned about Keynes that he passed over the first question. Well, partly because he saw no way the market could go right. And I brought this up to some mainstream economist and the response was, well, he's in good company because no one explains how it could go right. Well, the Austrians do. The Austrians do. And they consider it a prerequisite. So I start out with this production possibilities frontier. I hope the light on the screen doesn't wash it out completely. So we've got investment on the horizontal axis and consumption on the vertical axis. And it shows that there's a trade-off. There are alternative ways of using resources. You can invest with them or you can consume. Goods have already been produced. This right here is just a start difference between Hayek and Keynes. If you remember your Keynesian theory, consumption C and investment I are just two components of total spending. C plus I throw in a G and you've got the whole thing. Let me ask just for a show of hands. How many have gone through a basic macro book and got a full dose of C plus I plus G? Okay. That's good in one sense and bad in another. You know what I'm talking about when we say C plus I plus G? Well, here what we're saying C instead of I or I instead of C. That's what the PPF tells us. And it says I say here that under favorable conditions I just leave the market alone. The economy will find itself somewhere on that production possibilities frontier. Now the frontier itself, I've been given some flak about this, but I can take it. The frontier itself stands for sustainable combinations of consumption and investment, which doesn't preclude some movement beyond the PPF, but by virtue of being beyond the PPF, it's by construction unsustainable. It ain't going to hang out there very long.  So it's a boom if it's pushed out there, but it goes bust and comes back. Okay. That's the idea. And by the way, that's the standard interpretation of the PPF if it is employed in a macro sense. All right. It's a sustainable level of output of consumption and consumer goods. Okay. And here I've just indicated that, look, this little piece of graphic is used for a lot of things. International trade theory and different applications that trade off of one thing or another, even if it's beer and pretzels, which is a bad example because those two things are compliments. But it's rarely used in a macroeconomic construction. In fact, that's an understatement. I don't know anybody else that uses it in a macroeconomic construction. And here I'm saying that featuring this trade off gives us that contrast with Keynes because Keynes treats those two magnitudes as additive. Okay. So investment in this construction and in most macro constructions includes replacement capital or capital maintenance. And so that horizontal distances is the addition to the capital stock, most of which is just making good on worn out capital and used up resources and so on. Okay. Typically investment or replacement capital or capital maintenance is a pretty good portion of total investment, but not all of it. So there's some net investment. So you get so much replacement capital and the rest is net investment. All right. And that means that the trade off next year will be more liberal in the old sense. In other words, the PPF will shift outwards because you've actually added some net amount to the capital stock. So there's net investment. So positive investment means the economy grows. That's in transit. Okay. The outward shifting represents sustainable growth. All right. And so now we watch the economy grow. You can hear the economy shifting, shifting outwards as we go. Okay. After about four shifts and you're up there quite a ways you can consume more and invest more just because you've saved back in the earlier period. So I've got four points here. And the actual rate of growth, I say it depends on a number of factors. I mean, replacement capital increases too. Plus, this is probably what this says. You don't need to read it. Plus, as the economy grows, people are more wealthy and more income and they tend to save more. The more you make them more in proportion, you tend to save not for everybody, but for generally for the population. So that can change too. And I haven't taken into account that. Importantly, I probably should have importantly, in italics here, if we have a change in saving preferences, if you all decide to save more, then that gives you a movement along that frontier. In other words, if you prefer not to consume so much now, but to save, why would you do that? Well, because you want to consume more in the future. Okay. So your time preference are lower. You decide that you want to save more. That's represented by a movement along the frontier. So suppose people become more thrifty. And it says here, watch the movement along the frontier. Well, we can move along the frontier. And when we do, we get less in the way of consumption more in the way of saving and investment. That's what savings do. They work themselves into the investment community. And then investments are undertaken. Okay. Now that has a certain effect here. And that is the economy grows faster. You have a little saving going on, the economy grows faster. As you can see. And in fact, we can do a little comparison here. This is all just for illustrative purposes. I haven't looked through any data to show these things. Increased thriftiness makes the difference. Okay. So let's compare those two instances. And what we see is that after Oh, let's do it. Yeah, let's do it this way. Look at the one on the left. And you see that yeah, yeah, you got growth. It was a little bit sluggish. But there it is. And on the other on the right hand side, you see that first you had First, you had an increase in saving and then a more vigorous economic expansion precisely because more resources were put in the hands of entrepreneurs. That's the way it works. And that after four periods, we can just cut across here and see that people now are consuming more than they would have been able to consume. Have they not saved in the first place? Okay. Well, of course, I mean, that's the way it is.  In fact, in when I teach macro for sophomores, I like to use instead of S for saving, I like to use SUFS save up for something because people don't save for funds, not fun. Okay. Now don't get me wrong. I'm not getting preachy here. I'm I'm not your father.  You ought to save more. I'm just saying that if you save more, then the economy will grow faster. If you don't save more, then it won't grow faster. And for Lord's sake, don't save less and then vote for politicians who promise to grow the economy. That's a disaster. Okay. Now I look at the loanable funds market here. And what we see is just an application of supply and demand. And this comes out of Marshall 1890. You have a supply of it, which is just to say, the more interest you're paid for saving, the more likely you're willing to save. And this gets demonstrated in recent years in the opposite direction.  So it works both ways. And then the demand for loanable funds, of course, is the demand on the part of people undertaking investments. I actually net out consumer borrowing on the supply side. In other words, how much do people in general or in the aggregate devote their income to saving, realizing that some people may be dissaving. In other words, they may be borrowing and buying wide screen TVs and new golf bags and that sort of thing. But the saving here is the net saving done by income earners. And the demand then is the entrepreneurs borrowing the money to undertake investments. That's the way it is. And of course, the interest rate simply equilibrates that market like other prices equilibrate their own markets. Now I note here that this was the agreed upon interpretation of the loanable funds market from way back and certainly to Keynes and even back to Bombavere. So here you have an Austrian and the Keynesians or Keynes himself agreeing on this point that the loanable funds market is conceived broadly as the market that puts unconsumed resources. In other words, you go to work, you make things, you get paid toward, it's called income.   If that's true on an economy wide basis, then that's the part of output that can be used for investment purposes. And the way it gets put in the hands of the entrepreneurs that are going to invest it is through this loanable funds market. So they take command of the unconsumed resources and use it to beef up the stages of production, beef up the economy and give you growth. So that's sort of the macro meaning of that whole diagram. Now what that amounts to is that that horizontal axis which represents supply of savings, demand for savings, it also represents the investable resources. That stands with those savings. The entrepreneurs can buy the output that was produced in the period but not consumed. Because that's the same output that would be represented by your saving. You didn't consume. That's the way that works. And here I just give Dennis Robertson a plug. He was the one that developed it and used it to hit Keynes over the head with, by the way, because Keynes didn't use it. He specifically rejected it and we'll see more about that in this afternoon's lecture. In fact, you see a little bit about it here. When Keynes was writing the general theory, he let a few people, not many, see it in manuscript form. Roy Herrod was one of them, read the manuscript. And what Herrod told Keynes is something like this. It's not a direct quote. My God, Keynes, it looks like you're throwing out the loanable funds theory.  So Keynes made it clear. He put the graph in the general theory and then indicated this is why he's throwing out. And in fact, that's the only graph in the general theory. If you've taken introductory level Keynesianism, you guess that the general theory is full of graphs. It's not. It doesn't have any graphs. It doesn't have any except that one. And he only put it in there because Herrod told him to put it in. He put it in through it out. What do you think is the loanable funds market? That's what that says. That's the only diagram to appear. Okay. Now let's go back to this business of people deciding to save more, whether or not they got the advice from their father. They decide to save more. And what that does, of course, is shift that supply of saving right. There it goes. All right. And you shift it right word. And of course, you get a lower interest rate and you get business people willing to borrow more money to undertake investment. If you're saving more, that means you're consuming less of the output that you produced in the period and left more for the investors to take command of by the borrowing of the funds that you save. It also works out. That's the market at work. So you get a decrease in the interest rate and an increase in both saving and investment. Okay. This is prerequisite, as others have told you, to sustainable growth. All right. Now we want to just put those two diagrams together because they tell the same story. But in a little different way, they line up, in other words, the investable resources in the bottom diagram. There's the same thing as investment in the top diagram. All right. And so we're in a position here where that just shows what the two tell you. This is available to you on the website. In fact, I think the Mises Institute has all these PowerPoints available. If you want to actually read through all this stuff, you can. But I've only got an hour, so I'm not going to read through it about it. But what we want to do is indicate that these two diagrams are telling different aspects of the same story. So as before, we assume that people decide to save more and we're going to watch the market respond. Now you have to watch both diagrams at once. That might have to turn your head sideways or something. But watch both diagrams at once and you can see how it works. Okay. Saving increases, interest rate falls, firms borrow more, people are consuming less. That's what saving means. All right. It works out. This is all part of Hayek's idea. You got to see how markets work first before you see what can go wrong. Okay. And that just summarized what has happened. Now it's worth pointing out here the contrast with Keynes will have something more rigorous in the next lecture that I give. Keynes denied that this could happen because we have opposite movements in consumption and investment. We have consumption going down while investments going up. And Keynes says essentially that doesn't happen. That can't happen. Is that consumption and investment moving the same direction? Okay. This sounds so Keynesian. Well, it really is. So according to Keynes, any reduction in consumer spending would result in excess inventories, which in turn would cause production cutbacks, worker layoffs, spiraling downward of income and expenditures, economy would go into recession. And the business community would commit itself to the less, not more investment that's Keynes paradox of thrift. And on recognizing that, then you recognize you need to elect somebody who will grow the economy. Okay. It will turn it around and get it going back the other way. That's so it's really a claim that markets can't work. They don't work. And so we need some help here by government. That's Keynes paradox of thrift. I mean, that expression you've heard, you probably had to answer a question on the test about the paradox of thrift. That's what it is. Okay. Now, here's where we segue to this production, structure of production. And that is that what Keynes is saying, he's right. He's right if he's talking about inventories at retail, he's talking about inventories in late stages of production. In other words, if you quit going into Walmart and buying goods, then Walmart will have fewer good shipped to the store. Okay. Might want to write that down so you don't forget it. And this is called the technical term is the derived demand effect. Okay. I call it the well done effect. And Keynes thought the well done effect was the only effect. All right. But the other effect is the reduction of interest rates. Okay. And the reduction of interest rates means that people that are starting to produce something that requires an investment in early stage can get the financing more cheaply and can expect to be able to sell the goods when they come to fruition, if he's a good entrepreneur, because people are saving now and people don't save for fun is not fun. They save up for something. And the entrepreneurs who can make them something they're willing to buy will make profits. That's how the market works. Okay. So it does require some entrepreneurs here. But of course, no one ever doubted that to advocate market solutions to economic problems. So in the early stages of production, then you get the opposite effect. In other words, you get a decrease in consumption of current consumer goods to give you an increase in production in early stages of production that are aimed at providing consumption in the more remote future where people have saved up funds that they can spend. All right. Now it's not all mechanical at all. It takes some foresight. It takes some entrepreneurship. It takes some luck probably, but that's the way that markets can work. And that's the interest rate effect dominates in the long term. Okay. So in the early stages of production, the interest rate effect dominates in the late stage, the well done effect will demonstrate. So to keep track of that, that's why you need that structure of production. And I can go through this maybe a little more quickly. Not much. We went through it pretty quickly last time. So that's why capital based macroeconomics, the Austrian view focuses on this structure of production. So they can look at those allocation effect within the structure. And here you saw yesterday that you have early stages that's research and development. It could be exploration for oil. It could be steel mills. You can think of a lot of things that are early stage. And late stage, of course, is just retailer. It's Walmart or it's the public or whatever. Dividing the stages into five is just for pedagogical reasons. So you could have some going up more than others, some going down more than others, some something in the middle, not going anywhere. Okay, there's nothing unique about the five. You can make it 55 if you want. But it's harder to see that way. I've had people ask me now just, just how many stages of production are there? I actually have heard mainstream economists ask, is anyone figured out how many goods there are? So this is pedagogy people. We've got five stages of production. Okay. And the point here is there's always two interpretations. And I had to do this from my sophomores because when I started talking about resources going from the late stages to the early stages, they said, that's time travel. You can't do that. So two interpretations. One, it's a process where resources go through the stages of production from early to late. On the other hand, it's something that's going on in all stages at the same time. In other words, if at Mises University we took field trips, we could go out to different producers that were each in a different stage of production. We don't have to wait till tomorrow to find the next stage. They're all going on at once. It's just that they're aiming for output at a different point in time. So it's possible for somebody in the late stage of production to transfer to the early stage of production. A greeter at Walmart can become a security person at a steelman. So he's gone from late to early without any time travel. So watch the goods in process move through the stages of production. We saw that yesterday. So let's just show we're going from left to right and not down from up to down or in any other direction. So these are the Hayekian triangles and we can just make do with the triangle for a lot of purposes and don't need to divide it into stages, which was just for pedagogical purpose in any case. So in a growing economy, and think about that PPF increasing year to year, if the economy is growing, well, so will the triangle. I'm not presuming some change in saving here. People are saving maybe the same percentage this year they saved last and so on. But if they are saving, have net savings, then the triangle will grow. In fact, we can even link it up with the PPF and show that they grow in concert. So PPF grows and the triangle grows. All right. So everything still lines up. The output of consumption goods is larger now because of the general called it secular growth, just ongoing growth, which doesn't depend on some change in the saving rate. It just depends on their beings and saving. Okay, we got that part. Now, once again, when people become more thrifty, they choose to save more, that sends to seemingly conflicting signals. Okay, the decrease in consumption dampens the demand for investment goods in close proximity with the consumable output. That's the derived demand effect, the well done effect. And reduced interest rates, which means lower borrowing cost, emulates demand for investment goods that are temporarily remote for a consumer. That's the interest rate effect or some times called the time discount effect. And so the triangle is going to change shapes. Point out here that these two movements seem conflicting, only if you're trying to treat investment as a simple aggregate, as in C plus I plus G. So Keynes could look at this. In fact, I sort of push him in this direction. Well, what about this I? Which ways are going to go up or down? And Keynes view is to look out the window. In other words, we're talking about a depression on here. Look out the window, see which effect dominated. Did it go down or down? Well, it went down, you know, we're in a depression.  And of course, if you disaggregate within the investment sector, you get both effects. They just work at different points in the triangle. That's what this says. Well, there's something you want to see because it really was in this context. When Keynes reviewed, I'm sorry, when Hayek reviewed Keynes earlier book, he has treated us on money. He made the statement that Keynes aggregates conceal the most fundamental mechanisms of change. And this is essentially what he meant, except in that context, Keynes was aggregating profits. The treatise on money enters total profits as one of the key variables.   So if you're going to just look at total profits, you've aggregated yourself out of any chance of understanding what's going on. So Keynes aggregates conceal the most fundamental mechanisms of change. Again, I emphasize this time discount effect and drive demand effect, but I won't go any further with it. What's the structure of production respond to an increase and say, well, you know what it's going to do. Resources has to flow out of the late stages and into the early stages. They look something like that. And that means that they're going to be producing less in the immediate future. Well, people are consuming less, they're saving more, but it'll have more available in the more distant future. Well, people are saving up for buying things in the more distant future. That's how the market is at work for you and for me, for both savers and investors. Now, let's do this with both the PPF and the structure of production in view. And again, we get the increase in saving. And you can see what happens rotated along the production possibilities front here at the same time that the structure of production takes on a more future orientation. And so what we can see here is that you have both more investment total, you get more investment and is distributed disproportionately in favor of early stages. In fact, late stages go down because people aren't buying somebody. And so if you look at the stages of production, what you see, you get an uptick in the early stages and a downtick in the late stages. Well, that's exactly the kind of change you need to adjust production decisions with intertemporal preferences. That's what we're going for. Structure is given more of a future orientation. We get it. Okay. Now watch the economy grow more rapidly. And of course, here, I'm just showing you this is consistent with what we've done so far. And you notice here the time element. There's a time element. But the time element is shown by the sequential shifts in the period O, period one, period two, period three, and so on. And I think it's worthwhile to show the time element specifically on a graph. So I'm going to get a graph in here with time on the horizontal axis and consumption on the vertical axis. All right. And if you look at these upper two diagrams, you can see consumption first falling and rising in a more rapid rate. Look on the right, for instance. Okay. It falls and it rises. Look on the triangle. It falls and it rises. Okay. If we plot that on our diagram, the economy was already growing. But with increased savings, it could grow faster. So it looks like this is growing. And then people start saving after which the economy grows faster. Now, I made this dramatic where it actually goes way down. Chances are it would just slow in growth and then rise. But I want the people in the back of the room to be able to see that it changed like it was supposed to. And eventually, it will surpass where you would have been. Well, that's what this story is all about. In other words, this is a market mechanism that allows you to trade off consumption in the near future for more consumption in the more distant future. You can even see where that is on the diagram. So you're giving up all that consumption voluntarily. And you're going to get in exchange more consumption in the more distant future when you can spend those savings. And now quickly, I want to move through this application to stage specific labor markets. And all I have to do here is look at supply and demand diagrams for labor, but at different stages. And I'm just going to use two because it gets pretty cluttered if I try to use all five. And those diagrams are just taking the place of the photographs you saw earlier about the researcher and the retail manager. But what we notice is that the demand for labor moves differentially in those markets. Keynes always talk about the demand for labor, the market for labor. No, no, you can't do that. You have to look at labor in the different stages or look at other resources in the different stages. Labor tends to be more mobile than a lot of sorts of capital. But some isn't. I mean, you can have specific labor, you can have non-specific capital. But typically, economists like to think of labor as the most mobile factor. And so what you can see here is that if you watch the demand curves in those two diagrams, a change in the saving rate, more saving, is going to reduce the demand for labor in the late stages and increase the demand for labor in the early stages. All right. Let's see if we can do that. That's what that says. So watch the economy respond to an increase in saving and watch the labor market. It moves with that triangle. In fact, the dynamics of the labor market is what helps bring about the movement of labor from late stages to early stages here. Hayek even mentions the term he uses a wage rate gradient. A gradient here is just an increase over stages, in other words, from early to late. And it shows up graphically here as a slope of that line. In other words, well, conceptually, as a slope of that line, I'm going between two different graphs here. And if you look in the second edition of Prices and Production, he has a diagram, something like that, in a footnote where he shows the wage rate gradient. Well, that's what it looks like in my own reckoning. So I'm true to Hayek in this case. All right. Now we can put it all together. And look, we've got the loanable funds market, production possibility frontier. We've got structure, production, stage specific labor markets, and they all fit together to tell a coherent story about boom and bust. And now you have to watch the economy respond to an increase in saving. Well, you know how it's going to work. You've seen it separately. But what I want you to see now is that it's really poetry in motion. It's an orchestration. Everything is mutually consistent and consistent with people's preferences, which is what we want. I'll show this twice because you've got to look at everything at once anyhow. All right. More saving, rotated along the PPF, shifted the structure production towards early stages, which was brought about in part by the differential changes in the demand for labor. Show it again. Okay. Now, you see, it's a 20 or maybe even 18 to 10. And I've just gotten through dealing with how the market works. But once I've set myself up in the sense that now I can show very easily what happens when things go wrong. What happens when a politician tries to grow the economy. And I'm going to start out. I want to give myself a little extra credibility here by showing Steve Hankey because I can't look that stern. That's a stern looking guy. And what you know is whatever he says is probably true. So look what he says. And he says this in May of eight, think how that corresponds to the crash. He's a little ahead of the curve, a little ahead of the game, isn't he? So look what he says. With interest rates artificially low and boy were they not as much as they are now, but boy were they, consumers reduce saving. They reduce saving. Okay. Because they're artificially low. They're not low because people have decided to save more. They're low because the government says you can't have any more that much money for saving. Not going to reward you for saving. I don't want to save less. Reduce saving in favor of consumption and entrepreneurs increase the rate of investment spending because they're getting cheap financing. And then you have an imbalance between saving and investment. You have an economy on an unsustainable growth path. This in a nutshell is a lesson the Austrian critique of central banking developed in the 20s and 30s. That's Steve Hankey. I'm going to skip. I'll let you read this on your own. It really just, it's Hayek confirming in 1978 that yes, he still believes this theory. He still accepts this theory because a lot of critics of Hayek say, oh well, he dismissed the theory after he got through with it in the 30s. Not so. He still believes it. Okay. So now what we have instead of an increase in saving, we have an increase in the money supply. But money gets pumped into the economy through credit markets. All right. The new money comes through credit market and masquerades is saving. Supply of loanable funds shifts rightward but without there being any increase in savings. So that supply curve is, yeah, it gives you more loanable funds but it doesn't give you more saving. It doesn't give you any abstention from consumption to free up resources to be used elsewhere in the economy. And I want to get your attention here to show you this is a basically different kind of process than what we've already talked about. Okay. So watch the opposing movements. Okay. There's the difference right there. There's the difference. This guy is here to grow the economy. All right. So he jerks that down. Okay. Now see, I don't have a new savings curve. I've got the old saving curve plus a ton of money, the Greenspan pumped out through credit markets. So it's S plus delta M. But the saving rate reflects the saving schedule that existed before and still exists. And with a lower rate of interest, you save less, not more. Okay. So how could that be? Well, the way it can be is that, see what we got here. There's pumping new money through credit markets drives a wedge. I like the language drives a wedge between saving and investment. The language is all sort of a disequilibrium kind of language. Investors move down along their demand curves and savers move down along their saving curves. Okay. And the difference is made up precisely by the money that Greenspan created and pumped into the economy. So one thing I'd like to point out here is that suppose that interest rate were lowered just by decree that Congress met or heck, Obama issues the executive order. And so this is starting noon Thursday, the interest rate will be down at that lower level. Well, what would happen? This is not monetary policy. This is just Obama's executive order. Well, what would happen would be a huge shortage of loanable funds and the market would crash immediately. Okay. So if you just put a price ceiling on interest rate or an interest rate ceiling into play, you get a crash immediately. Now, what Greenspan did will get you the crash. It'll get you the crash, but not immediately. It'll get you first a boom and then a bust. And by the time you get the bus, Greenspan can be out of office and can deny that the bus was associated with the initial increase in the money supply. That's the way it works. Okay. Okay. Now, all we have to do is sort of trace this around to see what's going up. And what we see is there's just a basic conflict about how much people are going to save and how much people are going to invest. And if you trace it upstairs there, you see that for the investors, they're thinking about spending more investment, getting the economy growing faster, so they're moving along the PPF in that direction. The savers, they're not saving, they're out buying the widescreen TV and the new bag of golf clubs. Okay. So they're going that direction and they can't both be having at the same time, because you got two different points along the curve. And in fact, the way we could look at it is notice that consumers are pushing upwards, consumption is measured vertically, investors are pushing rightward. That's the way investment, and if you resolve those two vectors, you get the pushes beyond the PPF.  In other words, you ain't going to get there. You're not going to get there too far beyond the PPF. But the market forces are nonetheless pushing in that direction and can push to some extent in that direction because they can go outside the PPF given PPF is defined as sustainable levels. They can go to unsustainable levels. That's the whole problem with the unsustainable boom. It's unsustainable. Okay. We'll look at the triangle. Again, you get conflicting signals. You get a lower interest rate that stimulates investment in interest-sensitive activities such as housing and other early stages of production. Housing qualifies as early stage on the grounds of its interest rate sensitivity. In other words, with 30-year mortgages, its interest rate sensitive, you get a lot of housing. On the other hand, consumers are trying and succeeding to some extent to growing down inventories, buying a lot of consumer goods. And so there you have another conflict, good friend of mine and fellow economist at Metropolitan State, John Cochran. He named this one. He called it the Dueling Triangles. So the dynamics of the boom and bust entail both overinvestment. I think Mises let that one slide. He didn't like to talk about overinvestment because he wanted to focus on the malinvestment, which is in the triangle. But you can see on the diagram that you get some overinvestment and you also get some malinvestment. These distortions are compounded by overconsumption as shown in both the PPF and the Hayekin triangle. And you can see that here and over there. And Mises did use the term repeatedly that the boom is characterized by malinvestment and overconsumption. You see that frequently. And that has been recognized fairly recently. People have gone back and people first disputed that Mises allowed for any overconsumption. But when they went back to human action, they could find it in a lot of different places as I had found it in a lot of places. So now it's become sort of standard, oh yes, the Austrian view is malinvestment and overconsumption. So look at what's going on. Look at all the language of disequilibrium. We've got the tug of war that fits consumers against investors, pushes the economy beyond the PPF, the low rate favors investment, and the increasing blinding resource constraints keeps the economy from reaching the PPF point. Temporary conflict, inflicted structure of production, that's the dueling triangles, eventually turns boom into bust and the economy goes into recession and possibly into deep depression. You could see, let me go back, you could see the economy moving towards the virtual equilibrium point, but it's not going to get there. Resources won't allow that. And scarcity is developing within the structure, eventually turn a lot of firms sour and you end up with the curve turning back towards the PPF. And guess what? There's no market mechanism that would cause the economy to make a sharp right turn when it gets to the PPF and go back to where it started. The economy can cave into deep depression. In fact, Hayek, writing well before Keynes's general theory, identified that as a secondary deflation or secondary depression, that the primary problem was all the misadjustments caused by the monetary expansion, but when the thing, when the economy is trying to sort itself out, it can get into a spiraling downwards as a secondary effect. That means secondary in terms of not being logically prior to the initial cause. It was subsidiary and it's in the cause. It may well be that the damage done to the economy by the secondary depression outweighed in magnitude the initial damage done by the misallocation. That doesn't change the nature of the Austrian theory at all. In fact, the analogy I like to use is there are some people who study earthquakes and look at the earthquake in San Francisco in 19, you tell me, 07, is that right? Around there somewhere. Some people say that it was the earthquake that caused all the damage in San Francisco, but others who've looked at the data more carefully, written articles for publication, say that that's just not true. It was the fires that broke out after the earthquake broke gas lines. That's what caused the damage in San Francisco. You buy that? You buy that?  The fires. Give me a break. It was the earthquake compounded by the fires, sorry. Here it's the misallocation of resources compounded by the spiraling downwards. Now one more point here that'll come into play in our next lecture. It's hard to see this screen anyhow because of the light, but squint your eyes and look at the screen and the thing that stands out for you is that big orange arrow pointing downward. By the way, if you haven't guessed it, orange and blue are used in these diagrams because it's all burnt colors. That's orange and blue. When Keynes looked at that orange arrow, that's all he saw. That's all he saw. That was his basis for saying that the interest rate was the well-duh effect and not any other effect because things were going downward. All the Keynesian stuff that you had to learn in school were just in terms of how long that arrow was. Now fast things fell given changes in this and that and whatever. In fact, in Keynesian theory, the summary principle, you can use this on an exam if you're taking it, uses to help get your answers correct. If anything happens in the economy, if anything happens, the economy crashes because prices, wages, and interest rate, they're all sticky downwards and the economy might be at 12 employment only by accident. But if anything changes, if any market condition changes, then that'll be at odds with what the economy is trying to do and it'll cause it to crash as represented by that arrow. Okay, now there's the language of disequilibrium and we put it all together. I hate to talk about the three P's, it makes it sound like a management course or something, you know, where you have to learn the three P's or whatever. Padding the supply of loanable funds with new money drives a wedge between saving and investment. Papering over the difference between saving and investment gives play to the tug of war between consumers and investors. Putting, pitting early stages against late stages distorts the hierarchy and triangle in both directions, the central discoordination eventually turning boom into busts, okay. And so watch the economy respond to the credit expansion. He's the one that called me a couple, you know, poor old Bernanke had taken order, wasn't too happy.  Joe the plumber, how old are you? Oh yeah, okay. Joe the plumber, he was the one that raised so much cane in a couple of elections ago, just somebody in the private sector that can't you people get as strange, you know, and keep the government off of our back. There's a couple of quotes here then I'll quit. Voices in the wilderness, there was recognition of the Austrian business cycle theory as it applied to dot-com boom in bust. It comes in 2002 and this is an unsigned editorial and the economists, a lot of them are, the recent business cycles in both America and Japan display many Austrian features. Landhoof it is a Swedish economist and he's writing in 2008, look what he says, operating an interest targeting regime. Here's a go, you know, Greenspan trying to hold interest rates at a certain level. The Fed was lured into keeping rates for far too low for far too long. The result was inflation of asset prices at its early stage combined with the general deterioration of credit quality. That's Fannie Mae, Freddie Mac. This of course does not make a Keynesian story, it's rather a variation that Freddie Mae, Fannie Mac on the Austrian over investment thing. And one more, I don't know this fellow, Forsythe, maybe some of you do, but the Austrians were the ones who could see the seeds of collapse in the successive credit booms and abetted by Fed policies, especially under former chairman Allen Greenspan. He disavows or skipped past that, that monetary policy played a role in the creating of successive bubbles in bust during his tenure, 87 to 2006. But Forsythe is onto it, he knows that it didn't cause the boom and the bud. Okay, thank you very much.