Welcome to the third session of the day. The next session is Leverage Ansible Security Automation in DevSecOps by Sumit Jayaswal. We are starting with the next session. Allow me with a minute. Apology, I'll just restart. Give me a minute for the Ansible Business Unit, and thanks for joining this session. In this talk, we are going to cover how Ansible Security Automation can help Dev and SecOps teams. Let's have a look at what we're going to discuss today. Firstly, I'm going to share what Ansible Security Automation is and how it can help security teams. Sumit Jayaswal is then going to provide some real-world use cases and examples of how Ansible Security Automation can integrate with IDPS systems, with firewalls, and with CFs. Let's get started. What is Ansible Security Automation? Well, before I get there, I'd like to share some analysis of what's happening in the market. God that predicts that this year, 2021, the spend on cybersecurity is going to surpass $150 billion. But counter-intuitively, if we look at what we are seeing in the headlines of all the increased cyber attacks and the increased cyber breaches, this doesn't make a lot of sense. Well, the Cyber Resiliency Organization provided a report which has some great insight that I'd like to share with you. Of all the alerts that security teams are getting, they're only able to respond to 5% of this. And the predominant reason for this is because between a mid-sized organization and a large-sized organization, they'll have between 20 and 40 security devices that they need to protect their organization with. However, they go from different vendors and they perform different tasks. They're all provided alerts in a very specific way. So it's very impossible to get all these alerts to address all of the alerts. Also, counter-intuitively, again, the amount of time it takes for security teams to respond to a cyber incident has increased. But if all that money has been put and invested in it, why is this occurring? There's several reasons for it. The first and predominant reason is the severity of the cyber attacks has increased, as well as the throughput and volume of the cyber attacks has significantly increased these days, especially taking for the fact that our working circumstances have changed. Also, if we look at how security teams look off the traditional data center and because of the lack of integration between the different security tools, there's a lot of manual tasks. But organizations are expanding. They're looking at including cloud computing models. They're trying to create microservices architectures and move to a cloud-native environmental practices. These manual tasks that security practitioners use because of the lack of integration is just not going to scale and be agile enough to keep up with that. There's also a large need for more skills within the security space. Companies are extremely willing to pay for it and extremely willing to hire. There's just a lack of those skills. On average, they say, if there's 100 developers within an organization, there's usually 10 people in the operations team. And for the 10 people in the operations team, there's going to be one person who's trying to look after this and secure all of this. They are overwhelmed and inundated. I've mentioned that the severity of the cyber tax has increased. And this is because the actors who are writing this malicious code and actually performing the attacks have embraced ideas and products and methodologies such as AI and machine learning and automation where security teams now traditionally are still relying on a lot of manual tasks. Let's imagine we're a security practitioner and we're just even trying to investigate if the threat is malicious. Well, that person, we would have to log into maybe five different user interfaces. We would have to go and manually input the same data again. It's error-prote. Human error is a real factor. Thankfully, the organization and the security ecosystem realize that automation is going to be vital for security teams to be able to keep up with the new demands. This is where Ansible security automation comes into the picture. We have had as Ansible a tremendous success within the infrastructure space, within the networking space and the app space to name a few. Ansible security automation expands that portfolio and that success to now include the security space. It's important though to mention firstly that we are not a security product ourselves. We are only there to be that conduit, to be that integration layer between these multiple vendors and multiple security tools. We augment them. We provide the security teams the capabilities, the tools, the integration to ensure that if there is indeed a cyber attack, right, they are able to create and mount an effective response a lot quicker. We also integrate with the different teams with security for sure, but we elevate that automation so when security teams do have the automation in place, they can now share this with the rest of the organization and form part of an effective remediation plan. Adopting automation in security is a journey and from what we've seen in the market, we see there's three main parts to it.  They want to do it with more speed and they want to do it with more consistency. Here, the human readable YAML language that Ansible provides is vital to this. It makes it easy for them to do so. Moving up as they move to the systematic layer, this is where the security teams now want to be able to share their automation beyond their domain to other domains within the IT organization or the security practice. This is where automation controller, formerly known as Ansible Tower, provides role-based access control, APIs, credential management, just to name a few to help them do this. At this stage, we also see security tools such as a security information and events management system or a CEM. And what those tools do is they provide alerts and aggregates all the logs to provide analysts the capability of identifying and classifying security threats. Ansible automation platform and Ansible security automation has integration to supported CEMs, which opens up a new avenue for analysts. Usually, if they had to increase the verbosity of a log, as an example, they would have to reach out to their team. However, in a safe, controlled and consistent manner, they are able to actually directly start changing the verbosity of a log on a specific device, reducing a lot of the operational overhead. Moving to institutionalized, these organizations have a mature security posture. They have an effective remediation plan in place. Their compliance, their auditing, their regulation requirements are all met. At this stage, you'll see tools such as a security orchestration and automated response platform or a SOAR. And a SOAR gives the organization the capability of mapping and creating business processes and mapping it to a security remediation plan or a compliance plan, et cetera. And what we can do as Ansible. And once again, just to say we are not there to compete, we are there to augment, we are that integration layer. We enable supported SOARs to increase the footprint that they can reach to ensure that the tasks are performed correctly to ensure that the remediation plan is executed correctly to ensure that there's ordering and compliance because Ansible has such a wide footprint across the IT domain. What we've done with Ansible security automation is we have created three high level use cases. The first one is investigation enrichment. Let's imagine once again that we are a security analyst and we noticed an alert, but we need more information about this. That would usually be a phone call. That would usually be a meeting or a ticket that they would have to submit to that relevant firewall team or IDPS team. Using Ansible security automation, that analyst can actually go and do an increase the velocity or include more logs from different devices into that CM, getting more insights into what is happening and being able to classify what the cyber threat is. When it comes to threat hunting, that's mostly at a preventive layer. In other words, Ansible security automation allows them to update signatures as an example on an IDPS device. It allows them to integrate a latest security bulletin and ensure that that is applied organization-wide. Whereas the security analyst again, let's imagine that that person has to change a specific signature on an IDPS device. Now they have the capability to do so from the CM portal. As we move to incident response, I have chatted about how it takes so many different teams to work cohesively to be able to provide an effective response to a cyber attack. Ansible automation platform and the tools it provides as well as Ansible security automation provides that collaborative environment where different teams can describe their requirements, can describe their needs, and work together to create these workflows to form part of a larger security remediation plan, eliminating the manual steps that are usually required and reducing the time it takes to actually go and fix that cyber attack. Because remember, the more time an organization is exposed, the more risk it introduces. Thank you. And with that, I'm going to hand over to Sumit Jaiswal. Okay. Hi all, thanks Greg for setting up this stage for Ansible security automation and also giving us the overview what Ansible security automation is and all about and why security automation has become a necessity and how Ansible security automation initiative can help enterprise customers as well as individual users equally to automate their security needs. So before moving on to the discussion, I'll just like to try, I'll just give a brief intro about myself. So my name is Sumit Jaiswal and currently I'm working as a senior software engineer for Ansible content team where I'm largely focusing on security content side of it. Okay. So first thing we'll discuss about is the firewall management. So we can move to the next slide. So here we'll discuss about the incident response scenario where in this scenario, basically we have identified an attack and we need to block access to a specific machine that find itself the target of the attack. By using content from ACL manager security automation roles, we are able to block access via a playbook and because we are using variable as input, these variables can pass dynamically as well. And alternatively, this information basically can also be supplied to Ansible tower job by an input template or through tower API call and for further integration. So continuing on the same use case of incident response, here we are using Cisco firepower threat defense with a Cisco FTD to deny access via creation of security intelligence URL policy. And this basically is to highlight that in a single playbook, we could remediate the situation across multiple devices in the infrastructure from multiple vendors. And this capability will continue to grow and expand and mature because as time goes on, we'll keep on adding new vendors and we'll keep on partnering with new vendors to come up with the integration with Ansible. Okay, so this slide talks about bringing in dev workflows with the CI. So if you think from a developer's perspective, we can consider bringing security practices and policy into the development workflows. And in this particular scenario, we have a CI environment that's provisioning a new minimal set of production infrastructure, but typically details of enterprise security policies and the devices, which if ignored, will have a negative effect on the validity of our integration test. So if you use Ansible to provision and set up the CI environment, we should allow Dev Team to simply use the existing and the same security policy Ansible playbooks in their CI such that they can actually test like production and can actually validate and verify if the test traffic close or works as expected. And this in turn ensures that application developers are mindful of their application requirement, which has been given from the security team and are mindful of those points while developing. So this slide may look like something, some fancy slide, and this all may sound like some fantasy, but it actually works because our security workshop are tested and verified using the same scenario where we are actively testing these type of scenarios. So here we are trying to put on our idea that your operation team, your security team and your development team all are coming together and trying to design on the CI pipelines, which is very much similar to the production pipeline and all your security policies and all the system related stuff are being tested over in your CI before we move on to the production system because if you use, if you check and if you test the security policies in your CI system before going into the productions, before that goes into this production, we can actually verify that everything works and there is no gap from or from this, which can be breached from security side. So now comes the inclusion detection prevention system management. So here in this scenario, basically, IDS and IPS knows which traffic is expected to reach to your application and what all traffic is not expected to reach to the application. And here we have taken an example of new signature which has been added to SNOT checkpoint 148 to check if someone is doing a DDoS simulation or doing some SQL injection. So if you see this playbook is using Ansible role, which is IDS rule role. It is actually developed and maintained by the Ansible security automation engineers and this Ansible role is to manage when diagnostic IDS rules to add a new rule using this SNOT backend provider. So the backend provider tells the role which IDS utility on the backend to target and allow SecOps administrator using Ansible to have consistent user experience regardless of the IDS solutions. This is your, this can be your trend micro, which can be your checkpoint, which can be your coordinate as well. More details about this SNOT rule and how it is laid out. You can go and check in the current workshop. I'll link the required at the end of the slide deck so that you can go ahead and check out for yourself. Okay, so in this particular slide, we are trying to create an IPS sensor using 40 OS. Something you will immediately notice here is the amount of options that we have in comparison to the previous slide. This is because and this is also, this also highlights that we have the capability within Ansible, which in many cases to take full advantage of all the features available to a particular technology, but providing abstraction for common use cases that all the vendors oppose. So here, as you can see currently it is using 40 OS IPS custom on you, which is a module written by like currently maintained by a coordinate engineers. So this is using a module and in the previous slide we were using an IDS rule, which was abstracting the module functionality. If let's say you have to configure a module, like any particular IDS rule or any particular IPS with custom requirements, you can use the module itself and go ahead and configure those IPS rule. Okay, so this is the slide which talks about the DevSecorp real world scenario using ZoolCI. ZoolCI is actually being actively used in Ansible CI power system. So as a DevSecorp practitioner, we can actually apply this change set in a way that verifies the signature we are looking for and potentially preventing the new classification of attacks that an application deployment in development might introduce. Moving on to the security information and event management that is SIM. So if we move on, so we have currently support of IBM Qradar and Splunk and this is basically a use case where we talk about the trials of suspicious activities. So here we are trying to add log source and enable SIM rule to generate offenses. So here we are configuring the IBM Qradar SIM to identify the log data which is coming from checkpoint next generation firewall and to process it and it processes it with appropriate powers and filters. Then we enable a relevant Qradar rule. So you can see, right? Enable remote accessive firewall denies rule. So here we are trying to enable the Qradar rule based on the log source side. So that we can trigger offenses based on the data coming from the log source appropriately. So continuing the same slide, same use case, you can see get info from the Qradar offense, excessive offense. So this actually gives you the detail of the Qradar offense info with the name of excessive offense. And based on that particular trigger, you are actually assigning actions to offense. So you can see, right? We have used a Qradar offense action module with the parameters like ID, status, assigned to, and protected. So if it's coming from a log source, this can be enabled, relevant rules can be enabled, which actually ensures we are getting only relevant alerts, not false positive alerts or the suit alerts. Okay, so this talks about adding log source and enabling SIM rule to generate offenses. So once again, from the developer's perspective, if we try to attempt and bring this to a devop workflow, we'll be able to dynamically add the logs from our new web app into Splunk, okay? As a log source and create a correlation search to enable the creation of investigation into Splunk's enterprise security plugin, SIM plugin. So while this is something we can incorporate into a CI environment, which is likely, which is more likely a common scenario if you are an enterprise structure, this does not do a regular deployment to depth test or stage or production environment. We can ensure during the deployment to your dev environment or the test environment that everything comes into play in Splunk, as would be expected for your stage and production environment. So this is a SecOps slide, which actually talks about the real world scenario, which is an end-to-end workflow for an attack, where an attack is happening and investigation and remediation is happening at the same time. And this allows us to decide how much or little we want to automate the process workflow, which can help us to figure out what would have been done better from automation prospects to avoid any future security breach and in turn, improve the process workflow. So this is a screenshot from our job template. So you can see here we have a tower workflow expression of the process outline in the previous slide, basically. So this shows each step being automated with information between stages of the workflow and remediation tasks to take. If the automation is not successful, then this template will properly alert the SecOps team with the information about the issues so that it may be triaged further. So much like an answerable tower workflow, a CI pipeline is a series of tasks that can spawn one or many stages. Some of it can be in parallel and we can do a conditional approach as well. Okay, so this brings us to the magical future of DevSecOps where it's such that you have some sort of version control system like Git, which is actually the source of truth for all the deployment logic from operations to the application and the security policies with all the appropriate component expressed as an answerable playbook, answerable automation playbooks. And while this can be structured as one of the repositories, whatever makes sense of the organization, the net effect of the workflow is same.  And as we enable a self-service portal for job delegation from SMEs to different groups, all imposed by our back, which is rollback access control. Okay, so as I was talking that I'll be going over all the relevant URLs at the end of the slide deck. So these are all, so you can see, right? Ansible.com, at ansible.com, we have a use case for security automation which talks about what use cases it covers and what it offers. And we have a Mojo page as well, which is actually a redhead internal page. And there is a galaxy from where you can download the collection that I just showed in the examples. So there is Ansible security, which actually has your ACL manager role, your IES rule and there are other roles as well. And apart from that, I talked about IBM Q-radar and Splunk Enterprise Security. So you can find those collection here and you can download it from Galaxy Ansible. So the GitHub link for Ansible security is github.com ansible security. Here is all the content that we are currently working on are there and you can go ahead and try to contribute or you can go ahead and check out all the contents that we are currently offering. We also have a community page for Overviki security automation and we have IRC handle as well as hashtag Ansible security. And as Greg has mentioned earlier as well, that we are not going to provide a security solution. We are trying to come up with the existing thing, whatever there is in the security space and we are trying to integrate with all the security use cases and with the vendors to come up with the automation as a whole, okay? So let's say if you have any use case or anything that you want to talk about from security aspect or you want to come up with the automation of any particular use case, we'd love to chat with you. So please hang out on Ansible security with your questions or queries or anything. Okay, so this brings us to the end of our discussion. Thanks a lot for joining the session and now we are open for the Q&A session. So, well, that was awesome. Well, we have Sumit available. Please feel free to share your questions if you have any. Sumit, I would request you to please click on share audio video button so that you can come on stage and you can join the stage. Sumit, if anybody have any question, please feel free to post in the chat section. We have another one hour for the break, lunch break and after that, we would be having the next session. So if anybody have any question, please feel free to post in the chat. Well, I believe Sumit, okay, you can try refreshing your browser, Sumit, or you can just try to reconnect. Well, we have Craig. Welcome, Craig. Hey, everybody, how you doing? Well, I would love to learn more about DevSecOps, probably I would get in touch with you. That was nice one. Yeah, yeah, look, it's an interesting, that DevSecOps is an interesting and a fascinating topic. I mean, we're hearing about it more and more as I think the whole DevOps matured from past, just the theme to actually getting done to the nitty gritty technical details of getting DevOps working. Same for security now, right? It was more of a goal. But what I'm personally seeing within organizations right now is that it's becoming more of a reality. And with that reality, there's a lot of complexity that comes with it. So that's where automation is really, really important to how will that DevSecOps flow. Hemant, I can't hear you. I'm sorry. As we don't have questions from the audience, probably I would take this opportunity and I would like to understand somewhere you mentioned about the IBM Q Radar. So how do we make use of that product in this process or flow? Because I believe that's the propriety ruin, right? Is it soon it's on? I'm not too sure. Okay, but I'll have a passionate. He's the technical guru, but could you please repeat the question? Okay, so I was trying to understand somewhere he has mentioned about the IBM Q Radar product. So, okay, we have Sumit. Give me a minute, let me just allow him. The experts is online. Hey, Sumit, how are you? Hey, all. Okay, so I think the question is, apart from Ansible Security, the rest of the platform mentioned with security, if I claim a proprietary example, what in it? Is that the question? That's the first question that's come through on the chat. And then Hemant also asked the question about how Q Radar fits into a security incident or response flow. Well, I believe the question is the same question. So, for Q Radar, are you able to hear me? Yes. Am I audible? Okay. So, Q Radar is basically a lock provider's same tool, right? So, we have Ansible Modules with respect to Q Radar. So, you can just create a policy tool for in the Q Radar and then from that, you can, if you have any enterprise end point security like Checkpoint, Fortinet, or any of the friend micro or others. So, in that, you can set up your lock source and then you can start forwarding those logs based on the rules from Q Radar to your firewall manager, like Fortinet, Checkpoint, and others. So, based on your lock source, you can take actions from your firewall manager. So, that's how this entire workflow can be automated on, I think, briefly I talked about that as well. So, yeah, Snot is an open source tool, yeah. That's great as much. Awesome. Thank you for the information. And, apart from that, I see Lenny's questions that, yes. So, Fortinet is a propriety firewall manager, but we have come up with the integration with Fortinet. So, if you see there is a Fortinet collections available on GitHub and you can directly use those modules to automate the, like automate all the configurations based on your firewall using those modules. So, for using those modules, you don't need any license or something. You can just use those with answers. Awesome. So, do we have any other questions? No, that answers my, you know.


Coffee TV, it's your boy Astro. Whoo. How about Tim Blues y'all?  We done started the season great and then all of a sudden we did a hundred and eighty degrees and we turned the wrong way and then everything all kinds of crazy shit happens and then we do another hundred and eighty degrees and we're right back Where we want to be and when we needed to like the macho man used to say the cream Done rise to the top, baby. Whoo Let me tell y'all something We all have to show our disapproval our emotion our upset some folks did it by walking out at 27 minutes today That's fine Other people stood up and yell. That's fine, too. Okay? One thing we can all agree on is is that did we walk the best for Everton football club?  Yes, it does but We've got them points tonight, baby. We got the beat back on And that's just how it's gonna be until we take the best away fans Down the motorway into London town Crystal Palace You next on the hit list, baby because we done got it bumping again We got the beat back on and Astros get to have a little bit of fun with these match reactions until next time Let's end it with a little bit of passion.


My work here on YouTube is supported by viewers. Please follow the links in the description below where you can make one-time donations or you can go to the 30-second sci-fi website and pledge a small monthly amount to become a sponsor. This is an alternate history story taking place in the 1850s in which a British expedition to Antarctica discovers an unusual mineral that is stable and basically inert as long as it remains frozen 100 degrees below zero in An age that didn't understand atomic power or even the nature of the atom It was impossible for them to understand that this was anti-matter But they did discover that when the substance is allowed to warm up it releases a terrifying amount of energy England's monopoly on anti-ice Changes history and allows them to expand and maintain their worldwide empire. This book has one of the most brilliant setups that I've ever read But I had to reread the book recently because I couldn't remember anything that happened after that And the reason I didn't remember anything is because basically Nothing happens Please remember to press that like button. It helps my videos get seen and then subscribe so you can come back next time I do science fiction book TV and movie reviews all the time and please consider becoming a patron There's a link in the description below


Kyle M. Parker, actually Joe, please save us from Joe Biden. It's not Joe Biden you need saving from. Joe Biden is in the clown. Joe Biden is the bear, is the person that lifted the veil, right? Anybody that still thinks Joe Biden's calling anything is, I don't know what they are, they've been only consuming information on Facebook and Twitter, right? But Joe Biden is just, it's just the puppet, right? The people behind Joe Biden, those are the people in the world economic forum, the globalist, the neocons specifically, the Obama's, the Clintons, right? The caries and all that jazz. It's, and for a certain part of the deep state, which are really the destructive force or the neocons, right? The Zionist neocons that exist there, right? Those are the people that we need to out, right? And we need to realize that they are destroying the global economy and they're doing it because they're about to put boots on our faces.


Okay, good morning everyone. I hope everyone's having a good open source summit. This is my first time, I believe, talking in the Ospo contract. I'm really excited because I've been in Ospo's for a while now. Due to a technical mishap, my next slide is my previous slide. So if you want to follow along, the slides and notes are already published at bit.ly transparency-ossu-mnit. This lets you reference anything later as well as read things at your own pace. So we'll go back to the title So I've fooled you all into thinking that this is an Ospo specific talk. It's not. It is very relevant, in my opinion, so hopefully it'll be useful for you in your work. I have been on this kind of transparency kick for some time now because it struck me as super counterintuitive that open source, in part, is about transparency of code, but the transparency of process, the transparency of everything else, not so much. The way that I have observed the open source evolution over time is there's something increasingly secretive about open source development. There's a lot that's ostensibly in the open, but maybe falling a little bit short, we often talk about these shadow networks within open source projects where decisions get made, but no one knows where they are or who is in the room when those decisions were made. And I think it somehow stems from what seems to be kind of a fear of the establishment, which kind of makes sense given open source's history. So I've kind of here to this talk is not about lessons learned. It is not a proposed solution. This is a journey and a thought experiment. So hi, I haven't met many of you, I've met some of you. My name is Julia Farioli, and my official title is open source technical leader at Cisco, which I think is a really cool title, to be honest. I'm pleased with that. I also co-lead opensourcestories.org that's aimed at capturing narratives in open source, and we've been running that for a bit over a year now. And I hold an ever-increasing interest in the evolution of open source and how the decisions and the behaviors that we have changed the practice of open source software. But 40 minutes, just like 40 years, flies by very rapidly. So let's dive in. This completely meaningless chart over here that I made up shows us what we want to see and up and to the right trend. And we've seen the open source marketing campaign over the years that many of us have pushed for has worked. We've convinced our companies that open source is good, that secure, and that it's this thriving ecosystem that has been doing amazing work since its inception. None of that is false. So go us. We've seen the headlines. Open source says one, but we've also created a little bit of a problem for ourselves. And that's the idea that open source is a resource waiting to be. And as the demands on open source grow, so do the demands on the maintainers of open source, the creators, the facilitators, and they have increased faster than the support that we're able to give them. We've spent so much time and effort talking about the value of open source, but we haven't talked about the cost and the obligation. So our obligatory framing, I have to do this because it's in my contract, I'm pretty sure, is open source freezing pizza? I'm not going to turn down a free pizza. Pizza's delicious. There's very little cost in me consuming a slice of pizza, unless I consume like two or three pizzas. Or is it freezing beer? Not going to turn that down either, but might leave me not feeling so great in the morning. So in that case, in that sense, it might be more appropriate. But the one that's gained the most traction over the years is open sources, free as a puppy. Adorable, rewarding. Sometimes a handful.  Sometimes they need to go to the vet because they've eaten the squeaker out of that toy. This is my dog. So I can I can say terrible things about her. And this one in particular is very needy. And you know, I could say that, but I love her. And there's an obligation. There's a contractual obligation between myself and my dog. So open source is free as a puppy seems to make the most sense for folks. That's harder to sell internally. So it's the eternal question. Open source is at least a bi-directional relationship. And because it's a relationship, we do have to ask what do we owe each other in it? Any fans of The Good Place Here? It's a good show. I'm not getting a commission. And we're seeing, especially from the Ospo side, a lot more effort in fulfilling our obligations as consumers of open source. We see where we do a lot of investment in helping our respective companies be good players in the open source space. But is there more? And that's a leading question. One of my colleagues, Josh Simmons, asked way back in 2019, pre-COVID, what are the big companies doing to facilitate open source contribution? What are we doing to give back? And this was not a new question. It's not a solved question, either.  There's tension between the creators and the consumers of open source. And I'm making very deliberate decisions about what words to use. I will interchangeably say creators, maintainers, contributors. And I tend to deliberately use consumer of open source rather than user because that has a slightly negative connotation when you think about it. So a consumer can be a company, can be another open source project, anybody who adopts open source. But we do see this tension. And with the increasing adoption of open source and the increasing scrutiny and the increasing visibility of security incidents, we get things like this. This was perfectly worded, in my opinion, in a letter that Daniel, an open source maintainer, received in the wake of Log4J. I'll actually read this because it's perfect. If you are a multi-million dollar company and are concerned about Log4J, why not just email open source authors, you never paid anything, and demand a response for free within 24 hours with lots of info. And this is something I think we've all seen in various forms, in various levels of severity, with the fundamental misunderstanding of an open source project's obligation to you, to us, as well as ours to them. And that sucks because we do this because we love it for a lot of us anyway, although if I were to win the lottery, I might retire. I'm not going to lie. But we don't ever want to put the projects in a position where they regret being open, where they regret being open source, where they take their toys and go home. And we've seen that a number of times. We've seen maintainers, creators, take their stuff off the internet and disappear because it's not rewarding. And for all we talk about empathy these days, when it comes down to understanding each other's perspectives, we don't do a very good job. Oftentimes we see the finished project without all the work that went into it. Or we perceive an outsized benefit from the hard work we've done without any sort of appreciation for it. So without describing any sort of blame or judgment, these are some things that I've heard from maintainers and companies alike. Hey, it's a free support channel. Cool. I don't have to pay for support. I can just ask the maintainers and ask the community. Or, hey, you know, we have day jobs too. Like, I do this on the nights and weekends instead of making dinner. I'm at my computer We're trying to get this issue fixed, but the maintainers are not being super responsive. No one's answered my issue. No one's answered my pull request, merge request. Or why am I here? Where's the joy? Where is the reason that I got into open source in the first place? And I think these are extremely relatable questions and statements from both sides of the issue. But we can easily reframe these statements from the other perspective. We need to understand how to use open source better. We need to communicate better. We need to be engaged, invested in this ecosystem that we're benefiting from. At the end of the day, it's a shared responsibility. The solution doesn't come from the project side. It doesn't come from the company side. It's a shared responsibility. We've seen existing efforts to close some of these gaps. And we see their benefits and where they fall short. There's very little in general that crosses the maintainer consumer divide. Though initiatives such as Indeed's FOSS fund have made good strides towards it. But in many cases, what the problem becomes is that we're not meeting maintainers where they are. And we don't consider the long-term consequences of providing short-term help. So how do we change our perspective? How can we go from playing tug of war with each other to walking in the same direction? And that's kind of what I've been grappling with for a while. And so this is some simple thoughts. So let's start by examining some of the core issues at play. These are by no means the only issues. But again, 40 minutes is not very long. We could probably spend a whole day. On one hand, we have unrealistic and potentially unwritten expectations from both the maintainers and consumers alike. We know that all participants in these relationships have unmet needs, from income to reliability to sheer infrastructure needs. For today, at least, we have insufficient communication. All of these issues raise the cost of consuming, running and participating in these open source ecosystems. And when I say cost, it's not just financial. It's not just risk. It's also burnout. It's toil. It's time. It's loss of joy. It's loss of enthusiasm. But the problem becomes is that this is not something you can automate away. It requires manual intervention to reconcile some of these core issues. And that's part of the problem. But not resolving them, not trying, results in sustainability and reliability issues. And the unfortunate part is that when that sustainability and reliability issue affects a company, oftentimes the maintainer is to blame or gets blamed. That was a severe misstatement on my part. Often the maintainer gets blamed. So where does transparency figure in? We can start to untangle these issues, but we can only start. There is no end point. There is no winning. There is no job done. Open source is an ever-evolving ecosystem. And as such, our approaches always have to change. They always have to be reexamined. Along the way. What are some ways to aid and transparency? One of the biggest disconnects that I often see is what is the project's goal in being open source? Now, what type of project it is? What function does it serve? But what is its goal in the act of open source? In being part of the open source ecosystem? And these are just like some goals that I can identify. There are undoubtedly many more. Generally speaking, this isn't explicit anywhere. Sometimes it might be buried in a readme, but it will often revolve around functionality instead of intent. And while adapting an open source project to suit your needs is fine and encouraged. Hey, it's open source, right? That's what we do. Having someone adopt your project that's a toy or a proof of concept and then expecting a fully formed governance model can lead to frustration all around. But that also depends upon people hearing it. When we are evaluating taking on open source dependencies, are we listening to the goals of the project? Taking a strict dependency upon one that doesn't line up with your goals can introduce risks into your supply chain. And switching away at a later point is expensive. Who has had to yank out an open source dependency and wholesale replace it once it's been embedded into? Yeah. Is it fun? Do you enjoy it? No? Okay. I was worried we had at least one person who would say yes, throw the whole talk off. But by listening to the goals of the project, you can create risk evaluation frameworks to guide the decisions. And in open source programs offices, this is something we're asked, like is this a project that I should be considering? And the answer to that is it depends. And you go through this complex flowchart of various things that should help your teams decide whether to use an open source project or not. A project that was meant to be a proof of concept probably shouldn't be used in production going on all in there. Probably as it's going to be static, never receive updates. But a project that's a utility that was, you know, the flags library and go, right? Probably is going to be something that you can rely upon because it's there to facilitate the usage of technology. And it will likely be more responsive to your needs as a company. And I'm saying us and we and all of these things with the understanding that we live in the open source ecosystem and we also live on the company side as well. So apologies for any confusion that my language is causing. In our open source ecosystem, there's a lot of effort these days to fund projects that you rely upon. It's an important part of sustainability, especially for a system that has relied on volunteer labor with little to no compensation for the vast majority of open sources inception. But funding isn't everything. Maintainers can't use money to buy time. You can disagree with me on that. They can't use it to buy skills and expertise. Expecting them to means that you also expect them to have the time and expertise to hire chicken and egg problem. The introduction of funding can sometimes actually be a severe source of stress for maintainers given the inherent transactional nature of money. Even if you say that it's do whatever you want with it, there's still an obligation there. Instead, if projects can tell you what they need and how they need it, they reduce the cost to themselves of accepting help and thereby reduce the cost of maintainership overall.  What does it mean? Like you have to figure out how to actually accept the money. You have to figure out what it means tax-wise. What are your obligations? Is there a contract that you need to sign? There's a lot of different places accepting money can imply an intent of support as well. When we talk about needs from the company side, oftentimes what companies actually want to know is, is this project sustainable? Is this safe to use? What is safe? Every day for the past, like now I think it's three weeks, I've said what do words even mean here? What does safe mean? What is health? What is sustainability? So how do you know if it's safe to take a project on as a dependency? You can't just look at activity or dependency graph as those are metrics in search of a lot like questions or theories or baselines. But if you think about it similarly to evaluating if you want to buy a particular brand of appliance, what do you look for? Is the brand reputable? Are there a lot of people out there who know how to fix it when it gets broken? What's the cost of replacing parts? It gets a little bit easier to judge the safeness of that appliance. But the most important one would be to me is, is that brand going to be discontinued soon? And looking at it from a project perspective, looking at the needs of the project can help guide companies into whether something is, quote unquote, safe. If it has mostly met needs, then it's probably a safer project to take a dependency on. Unmet needs, maybe you want to wait, maybe you want to step in and meet those needs. But it all hinges upon listening to the stated needs and respecting them. You don't want to create an ask for obligations. Like the introduction, we're just talking about this the other day, the introduction of a new feature seems like a gift except who's going to maintain it forever and ever and ever. Probably not the person who submitted the merge request, right? So what about communication? Who has heard of the golden rule? The golden rule is due unto others as you would have done unto you. I really hate the golden rule. I think it's terrible. It's egocentric and lazy. It's the, I don't want to take the time to learn and listen about others' needs. What's good enough for me is good enough for them. But the improved version of that is the platinum rule, which is due unto others as they would have done unto them or stated in a less circuitous fashion. Treat people how they want to be treated. This is the meet people where they are philosophy. So what's the platinum rule of open source? As a maintainer, as a project, it's telling people how you want to be interacted with. It's saying file issues here, not here. It's providing issue templates. It's telling people how they should reach you and how they shouldn't. It's giving them guardrails for what's going to get them a response and what's going to get them the exponential back off treatment. It's helping Daniel from one of the first slides not have to post something in shame on Twitter. And so spending a little bit of effort here saves you the practical and tedious job of redirecting people, the emotional labor. The flip side, of course, is listening to it and respecting it. And this is all part of, hey, transparency only works. If you're looking through the same window, so filing an issue or opening a merge request isn't always the right approach. But that has been ingrained in people within this ecosystem for so long that as projects set up boundaries and guardrails, we need to surface them as auspos to our contributors within our companies. So education is the key to helping people respect the transparency that's being offered to them. I had a really spicy take in there, but I removed it. So if you want to know, you can come up and ask me later. So isn't the information already there? Isn't it already in the readme? Creators put a lot of effort into creating documentation and readmeads and guides. But where does it actually live? If it's all there, how is it discoverable? Is it on the website? Is it in the repo itself? In the docs? Is there a standard place for it? Talking about standard stuff, a lot. You can take a non-trivial amount of time to locate. And then once you do find it, is it in a wording, a language that you understand what do words mean? Is it accurate? Or is it incredibly out of date? There's a lot of inference that you have to do when reading and evaluating open source in order to respect the goals of a project, to respect the communication, and the mores of a project. And that's for everyone that works in the ecosystem. The people who consume, the people who create, the people who contribute. It's hard to be a contributor in open source these days. And this is the point where I ordinarily present a solution, but I don't have one. So what I do have is some areas where I think we can make some progress. We need to provide information, and we need to understand how to do that so that it can be surfaced and relied upon. And that means acknowledging that people are going to have their own ways of doing things and their own solutions built on top of that information. So it will need to be a standard format. But those words, come back to those words, words are problems. We need to agree on definitions of things. It seems so straightforward. But I bet if I asked every one of you what open source means, you'd tell me something different. It doesn't have to be perfect. Like I said, these will have to evolve indefinitely. But they do have to be defined and documented. And where do we find it? How do systems find this documentation? We've agreed upon locations for so many things, like license files and readmeals and security.mds. Could we do the same with this sort of information? We need to figure out how to make this a know-op to maintainers. I don't want to increase the burden on maintainers. And if it's not apparent, this is a machine-readable thing that we specify. It's a spec. And we all know those are really easy to create and agree upon and ship. By the time we get out of the talk, okay, cool. But why? Running a project is a lot of work. It oftentimes starts as a labor of love. But slowly as the cost of maintenance rises, the joy just seeps out of it. And I often say that open source is one of the few areas where success is more problematic than failure. Can we fix that by giving projects enforceable boundaries? Can we give them space and tools to bring back that joy? And as companies, that transparency to us is a gift that we can, in turn, give back to the ecosystem by respecting it, by supporting it. So this is Aspocon. So what do we have to do with it? We live straddling the divide. We've seen stuff. We've seen patterns. We've seen anti-patterns. We've seen good behavior and bad behavior. All behavior in between. We understand the long-term consequences of good and bad decisions. We understand the ripple effects that they can have in the overall ecosystem. We take the long view. And I don't know if you know this, but we're kind of loud. We like to talk, but most of all we care. I care probably too much sometimes. I don't know where we go, though I have theories. But I do know that it requires everyone. It can't be a one-sided push. It has to be bi-directional. And we can't rush it through with badges or gamification mechanisms. So if this is something that you want to talk about, I am, as they say, extremely online and eager to talk. So thanks. And I think I have no time for questions, so I'm sorry about that.


All righty big day for Kelly girl big day for Kelly she can leave I'm gonna swim Introduction to water She's about to go Well, she really don't want that breaker She didn't listen to me only her master set Girl All right swimming time good day to do because it's like 88 degrees So all right, let's do it She's like he's a monster Wow, they're in daughter I'll show you guys the difference those of you wondering the difference between the large gunner kennel and the intermediate That's the next one down on the left. I've always wanted to see them side-by-side. That's a Really big difference Rockies a little over 90 pounds This is good for anything. I'd say the one on the left isn't good for anything around 80 But there's the front view side view and Then they're lined up in the front So That's the difference in the length too Hi guys, welcome back to the channel. This is part three introduction to water So got Nathaniel here his dog Kelly, which is Rockies pup my black lab Who is four years old and you can see him in the hunt videos So today we're gonna do if her first introduction to water. Why don't you pick her up being show everybody? We're kind of in the shouts right here. We're a little early more people here today than we wanted But there's Kelly And it's gonna be your first time in the water. So I'm gonna leave this running I'm gonna try to get some pictures from a different angle and Basically on this you do not want to force them into the water So I'm kind of talking to Daniel and you at the same time. He's watched the videos Chris Aikens who I train rocky with and Nathaniel is watching as well. So basically don't rush him in and Just coax him in and talk to him. He's gonna have the fit 30 foot check cord the floating check cord on I'll have all those in the description below For the links, but basically he's gonna get in the water let a bunch of slack out She's gonna be on the bank. She'll I think she'll just jump right in also I think she's just gonna like run in but even if she doesn't she's gonna kind of put her nose down to it Has she been around any water? Besides a bath or a drink and water. Yeah, okay, so no like swimming, okay? So we'll see and then he and basically it's rule shallow right here And you want a non fast-moving spot because we are on a river, but it's pretty calm right here And then as she gets in, you know up to her her ankles her knees her chest We're gonna get it where she's out there ways where she's actually swimming I'm gonna try to get that with a different camera at a different angle, but hopefully I catch it all in here So anyways, I guess let's get started Hi guys, I went really well actually really good. She's awesome She got in what four or five times on six times just run around so she did that really well Got some cool photos that I'll pop up for you right now You ever need it for tougher hit me up and by the way guys Don't forget to give this video a thumbs up if you're getting some out of it and enjoy it Nathaniel's doing a good job as well. He's brand new. I've only this would be the second time that I'm like helping I'm not training them. I want Nathaniel to learn you ain't gonna learn if I'm always breathing down his neck. So how are you feeling? Good. Yeah, a lot better than I thought it was gonna go. Yeah, I went she just hopped right out and it was over her head Yeah, so I might so what we're gonna do now is he hasn't done the bumper. Do you have the bumper on you? Yeah, okay, so we got the let me see that real quick So this is the two inch. This is a SD get all I have all the stuff in the link below so it's a way smaller.  She don't get it. It's not a big deal So it's just kind of like you work into it crawl walk run I Think we might up right there. I was trying to get pictures being a little stingy getting some awesome pictures But basically we probably overdid it with her being in the water Again, it's really warm outside, but it is March and the water's still pretty cold. So it's a river pond would probably be better if we had something like that But that's just what we have. I turned out really good. I don't know I haven't edited this yet, but I'm recording this but I hope that That was all on it because that was pretty awesome honestly. She did really good rocky at 13 weeks She's 13 weeks today on the button and he didn't even do that if I remember right He didn't grab the bumper while he was actually swimming. I mean some do when they're younger sometime It's not the end of the world, but it's pretty cool that she did it So it's cool guys because it's the same place that I trained Rocky as a pup here by Good boy Good boy. He'll here. No here He'll sit sit hold hold Leave check Sit I give you guys a little bit better angle this time. Good boy. Sit Sit sit a little off-season train daughter like father Cool guys. Hope you guys enjoyed this video. He's like should I go over here? Sure. Why not?


Howdy friends welcome to the tea of the day today I've got a black chai tea with a touch of milk and Basil in there because my basil I had that I open the other day is going bad. So hmm Smooth not too bad. I'm not a huge fan of chai teas Normally, but this one's okay. It's not too bad. It's not like to me It's like there's not like any discerning flavor with the regular chai tea that that makes it just go Ooh, that's fantastic But chai tea is supposed to be good for a lot of things It's supposed to help reduce hunger or digestion. It's supposed to be good for nausea heart health and some aches and pains amongst other things. So Chai tea can't go wrong with it. Also the word chai in a lot of places actually is just the word for tea So it's tea tea and enjoy your tea tea


So without further ado, please give a big hand to our next speaker who will be talking about Encrypted Email. Hi. I guess you can hear me, right? Welcome. Buenas. I guess you are not in the wrong talk. We are here to talk about Encrypted privacy-oriented services, especially email. I'm going to confer something. I just finished the slides 10 minutes ago. So this is my practice. A little bit of history. We are in a very interesting place. We are going to talk about old protocols. I'd like to introduce some history about the places we're in. This was a shipping company, a shipping factory that started in 900 and ended in 1984. When I discovered that on Wikipedia, I said, wow, this is a really good omen to talk about privacy. In the riots with the police, one person, one worker was killed here. By the way, the slides are in here, and many of those things are links because I don't want to get too technical. I am here more interested about talking about tools. This is the Karol crane out there. We have the whole year. We have IRC. We have mailing lists to discuss about technical details. Actually, I'm merging two talks. Holger Greco, I guess some of you will know it. I just met him two months ago. He was going to give another talk about a two-word secure email. For personal reasons, he couldn't make it. I decided to put together some of the conversations we were having and try to merge the talks. I'm intending to do two different parts. One more about high-level philosophical questions, if you want, and strategy. We are a community that builds tools. The other part is about actual tools. I work in something called Leap Encryption Access Project. We gathered four years ago to decide to make encryption accessible. My role in the team is this. I'm probably not the best person to be here giving this talk, but I was just passing around Europe and nobody else could come. So forgive me for my ignorance. This is my first talk in kind of a serious manner. I started doing Python 10 years ago, but this is the first time I'm actually trying to present something to the world. So, Leap, what do we want to do? We want to make privacy usable at all levels. And the motto is we kind of feel that we have to defend the right to whisper, because privacy is about the right to whisper. Some of the really smart guys that started this project are coming from these kind of collectives. Someone here has a rise up account. Good. Rise up is a tech support collective that gives support for activists. It's like the Gmail for social movements. And this is a problem, because when we start centralizing things, we have a single point of failure. But we are a non-profit. We are something more than a non-profit. We are kind of a distributed network of people that think alike, that wanted to do something in some specific way and just we look for the way of getting money to do it. Towards by using grants, by using research projects, but we are more people than the people being paid by the particular project. And this is very interesting, because it frees you from the startup mindset. So I probably, since I knew I was going to be very nervous, I probably took the tips for speakers too literally, but I kind of found it fun. So I'm going to present a kind of adventure in which we meet the non-heroes, I'd say the anti-heroes, that go on a quest, find some weapons, you can guess which kind of weapons we use. We met some allies in the road. We, probably this is the only thing important from this talk, the monsters we are finding, because we are kind of learning in their way. The adventurers yet to come and my goal here is to convince you that this is important and interesting and we'd like to have your feedback. Disclaimer. LEAP is a highly opinionated project. With a highly opinionated team that builds highly opinionated tools and this talk is given by a highly opinionated person. So don't take me too seriously.  So now you know the team. I'd like to mention that we are not just coders. We tend to forget about the other people in the teams that make that possible. So kudos to the other people that are not cis admin or coders. We have one woman that the only thing she does is trying to get money through funding research for allowing us to keep coding. And that's much appreciated. So the question. I already said that. I guess if you are here is because you are interested in privacy. And so probably it's obvious in this context that privacy is not for privacy-manded persons. We cannot think that privacy is something fundamental. Privacy and communications are a fundamental human right. And it's about the right to whisper. Privacy, as the cypherpunks said, is the right to choose who I communicate with. And we think that we need to be able to choose who we communicate with when talking with our friends. By the way, this is a very interesting link. In case you don't know it, just click on it and read something tonight. This is the typical thing. We need to do privacy-oriented tools for journalists because they have to keep secrets, what sources and so on. Our saints, the whistleblowers, kind of appreciated in the community. And we, everybody, understand that they need privacy and secrecy. You probably work in a startup environment. If you are in China doing some wonderful research for selling a big thing, probably you want secrecy, communicating with your CEO to avoid all the Chinese industrially spinach. Or maybe you are thinking about changing jobs and you want to communicate with another CEO and being able to blast your salary away. How many people here know this guy? This guy was the one that hacking team. Okay? Here you have the whole tutorial about how he did this thing. Let's say I'm interested in interviewing Phineas Fisher. He's probably the most wanted hacker right now that is not in jail. So probably the only way to communicate with him is going to be GPG. How many persons here actively use open PGP encrypted email? Good. Now I understand a bit more where we are. Probably I need secrecy to communicate with my lawyer, with my package maintainers. Thank you guys. But yeah, seriously. When I'm traveling in India, I really, really, really would like to or need to my mom being able to understand what PGP signing a mail means because if not, whenever I'm going to be kidnapped because I'm a little white guy with a credit card in my pocket, it's going to scam her for money. So in general, the whole society, the point is that the whole society would need to, if not understand, at least being able to use the magical trickeries that cryptography gives us.  But you get the point by now. We need, our friendship is the whole society. If, without privacy, the whole society cannot work. You probably, yeah, I think you probably remember the crypto wars some years ago. Now we have a very much interesting movie. For those who don't go to the countryside, this is a silo. A silo is something where you put the grain and from there you get the cookies in the supermarket. So we are now in the silo wars. And this is a very interesting moment to be. This is from a Tim Berners-Lee article some years ago. You can see that the cool things were wearing so cool at the end. Some of them were, some of them died. Haha. Smart guys. In Dante Alighieri Divine Comedy, there is a very big explanation about the layers of hell. It's an interesting thing with a historical value. We now have a special place in hell, in the technological hell we all live in, for the people that use GPG. And I'm not trying to be smart or metaphorical here.  In my surveillance device, I need to have at least four, five different apps to communicate with different kind of friends. I don't know if this is the right order, but you get the idea. Some people think that signal is totally secure. Thanks Moxie, we can discuss about federation. Some people think that WhatsApp is secure, because it has end-to-end encryption. Some people, I don't know why, think Telegram is a cool thing to have. It's kind of open source-ish thing. But you know what?  This is my run minute. It's unacceptable that if I want to get Raspberry Pi from some nice guys in there, I have to get a Twitter account. No, no, Twitter is not a tool for communication.   You get the point. This guy, Michael Hayden, former CIA director. The most important fact in the last years probably has been for my bias view, this one, metadata kills people. And it is not a bunch of nerdies that says that this is the important thing. You were called paranoid five years ago. Now it's not that we think they do it.  So we have a nice pun on the concept of the killer app. They are actually, metadata is actually killing people. But in some sense, we all want to have killer applications, killer libraries, killer operative systems, whatever. We are all here selling things or recruiting people. And the key, this is from my Snyder book. The key to being in this place is that the things we do in the clouds, the internet or whatever are convenient and free. Free as in beer, mostly. We believe kind of in free as in freedom, but whatever. All the whole open sources thing. And this is a race, my friends. If we want users to use things, we have to do convenient things and kind of free things. So it's like fighting the enemy with their own weapons. And this is the holy grail for encryption and privacy and all that.  And your tool might be many things. Your tool might be infrastructure, forces admin. How many people here maintains mail servers? So you know the pain, my friends. Things need to be usable also for developers. I'm really amazed by learning so many things about how to make properly usable interfaces for libraries. And at the same time, in the bottom layer of hell, we have the end users because we are highly opinionated and we tell them what they should think like. So this is what LEAP project and its many branches and heads try to do to attack the hard problems and the interesting problems at many levels making things so simple that you cannot screw it. I'm not going to talk about the sysadmin part because that is mostly written in Ruby. No, just because. This is called the LEAP platform and it's for sysadmins to install systems with properly configured defaults and so on. For mail, we also do DPM but I'm going to focus on mail here. We're kind of presenting some libraries. I'll get there in the second part of the talk and we have some desktop applications for users. Intermission. Usually people will get out of the talk at this point saying, ah, but the user doesn't care. The user doesn't care because we don't make them think that it is possible. We are kind of shaping their view of the world and what is possible for them and not. We also think that the user is not going to pay but probably the problem is not in the user. Probably the problem is ourselves. I think it was Tankle that wrote a very nice postmortem on the whiteout thing with secure email and they basically were putting numbers on how hard it is to monetize the market for privacy but it exists. People is willing to pay. After Snowden, governments, universities, like whole sets of huge amounts of people were willing to put money on secure email. We can discuss what security means because they probably want to keep their private keys for their citizens or whatever but the need was there and the tools were ready. And there is another thing. Come on guys, like commodityization goes on many layers.  If you get 50 cents a month or one euro for two months for 100,000 people you get some nice cash for some developers to code in a valley beach. So probably the model we want to go is to cooperate in a way that we are not taking only our fishes but building the tools for everyone to fish and be happy. So in the end we want crypto but we want roses too. This is my fundamental truth.  This kind of puts things in perspective. We think that Twitter or Facebook are the big silos but they are just a tiny spot there on the whole volume of email communication and that is only a small subset of spoken language.  I'm going to skip this. If you are the kind of person that don't take this as a fundamental truth, you have statistics and surveys and you can see the data. So the weapons. We kind of brought some weapons from our previews. People have been like 20 years in this business and for the client parts and the synchronization parts we kind of choose Python because it was kind of obvious. We were very happy four years ago. We were told that all the hard work is done. The crypto is done, you need some glucose, the shoulder giants. It is really true. We have the crypto there and crypto is very effective. It works and we know that it works because in the leaks about NSA we know that there are two things that they really get mad at. Strong crypto and tour. So it works. It works for a bunch of nerds but we cannot explain the whole things that are needed to properly use or to properly be in a kissing party to the persons.   It doesn't work. When you have a nerd doing usability studies and doing things for the public, it doesn't work.  So what if I told you that we don't really need the users to understand the RSA concept that is awesome but we don't need it. We probably can have just some layers that do the magic underneath. A very good study 16 years ago showed that the mental models that we have to study usability in crypto are not valid. So we probably kind of have the criminals we deserve. So our plan four years ago in the happy moment of the relationship with the whole project was this. Very simple, three points, glue code, everything nice. Oh boy, how long we were. So the thing here is getting GPG key management easy and in a background manner and put it on the cloud because users have multiple devices and they want their GPG keys to be there. Put it on the cloud but at the same time they want to put them on the cloud in a manner that the FBI cannot get them when they get a server. And this was like the later part. Okay, we just use the normal main clients. Simple, right?  This is a very good book.   And we thought our project was simpler. So we do the key management. I'm not going to talk too much about it here. The logic there is probably 20 lines. Just fetching keys from key servers. They are kind of broke so we need to figure out a new model for sharing keys, trolling the web of tasks and all that. Key manager, discover the key and that's the right thing. Trying to establish trust relationships between old keys and new keys and trying to get scores for how good a key is depending on its source. And we want to kind of share the common parts of it out of leap. So the nice part is what do you use for local storage to have your secrets always stored locally in the client and in the server? So it was there. It was done. The only thing you have to do is to hack some setup.py script to do bindings for SQL cipher. SQL cipher does transparent as 256 encryption on top of SQLite. Fine. This package is there. It works.  It is usable for many other projects. So the big, the important part of the talk. It's called something called Soledad. Which is basically the idea of when we manage the keys we put them on a magical library that does the synchronization of data that has been locally encrypted in a way that the server can never tamper with it or infer anything useful about it. The design documents are there and the code is there. Security goals. Encryption in the client side. Encrypt the local storage and has to be resistant to online and offline attacks and to data tampering on the server because we have to assume the server is malicious. Same goals. Consistency, same flag. We don't want to see all the data. Has to be multi-platform.  We are on the desktop part. And these things are in the far future for now. Well, not so much for this. And for usability we need something that is available so the user can always get this data. User needs to recover the secrets if they forget the password. And we want to have something general because we also want to express this to things like having a pocket application or to do application or whatever. So probably something of this sound similar to what the Ubuntu one guys were doing. So we said, hey, so super nice. They had a library that was basically an abstraction layer to put JSON documents on a storage and sync it. And so we started using it and doing hacks on top of it. Now we kind of have fork. Although if the project gets to the life again, we probably can use the old thing again. So we put Couch on the server and we put SQL Cipher on the client. We have another syncdb for metadata and a pool to do things with KeyManager and UPG. The password never arrives the server because we do something very smart. It's a cello knowledge thing called SRP. We derive keys to get stronger keys from smallest inputs. And we basically do encrypted blobs and put them on the store. And it syncs. So these are the secrets. The blobs have, it's just a JSON document with a Cipher text of the original thing. You put it there, you create things, you sync things. Only that. The thing for mail is that we have like the whole mechanism for mail to arrive from the traditional SNTP world, put it on your inbox, decrypt it, do the pieces, and put them on the storage. So you can process your mail on one device and have your already synced inbox in many other devices as long as your GPG is. And you have a very simple rest API to sync. Alize. We kind of trust on Thunderbird. We wrote a Thunderbird plug-in. We have a desktop client that exposes SNTP proxies locally. Thanks to all these, this server was kind of easy and nice to do. Thanks to all these people. And we kind of started collaborating with ThoughtWorks because they said, oh, this is very nice. Encrypted replication of data. So we can put them on a server. This is our client. And this will be the mail user agent. This is the server part with the CouchDB blogs. And what the Pixelated project is doing is putting all this in a server and serving a Python user agent that does the web mail. So we kind of put our clients in their server, but we also close the loop and we take the web mail and put it in our local client. So you can do the two things. The corporate mode in which the private keys are in the server, you can use it, shipping it inside a desktop-only application. And look like this, and people are really excited about this kind of Gmail-ish things that do all the right magic in the background. Monsters. My biggest regret is not having dealt with complexity before. And that probably comes from our relatively inexperience with big projects and Python and packaging and so on. We start having too many packages.  Newcomers find it very difficult to understand where each thing is. When you start overloading inheritance, things get crazy very quickly. We also have some kind of complaints about the whole twisted, deferred thing for newcomers, which is kind of a religious war. But right now it is very nicely isolated so people can just use the REST API and forget about the things that are happening in the background. Another thing that has delayed us a lot is trying to get in the client server thing, your local demo, mixing together the QT paradigm with its event loop, the twisted IMAP server, and some other things. Simplify. We are at that point now trying to simplify it. The thing works. The thing has tests. People is contributed. We have a big company like ThoughtWorks contributing code, but we need to lower the barrier to do a significant contribution to the project in general. And some adventures are ahead. Part of the team now is working in a couple of European Union research grants that have to do with key server validation, key exchange, and trying to bridge, trying to tend some bridges across different privacy projects. We want to share some of the knowledge and even code. And Panoramics is another cool project about doing mixed master networks for privacy. We are one of the first clients to implement a new draft, a new standard proposal, which is called Memory Hole, that tries to attack the design error in mail, in Centipede, that all the headers are going in clear text. Last week we were on the OpenPGP Summit, and it seems that Thunderbird has already implemented this. So the whole idea is that you put all the headers, you put them inside the encrypted and signed mail, and you replace the headers with dummy steps. So you have a very nice and simple way of protecting the mail while in transit. There are also some nice proposals to do forward secrecy in OpenPGP, doing something quite similar to what the signal protocol is using, this ratcheting mechanism, to avoid that if an attacker can get some of your keys, it cannot recover the whole... Because it is a story, it is there. So trying to break the reconstruction of the whole communications. This is probably going to be something really, really exciting in the next year. And in Soledad, we are in a point where we are not finding any important bugs now, but we need to do some things for scaling. One of the main things we are going to do in the next month is trying to break the atomicity of the syncs, because right now everything is the same pool, and that's kind of shitty. We want to be able to sync all the keys first in a new device and then probably all the headers and then probably the attachments on demand. And we have to deal with event plan consistency in a nice manner. There's a lot of things that need to be done. That's it. This thing is my fingerprint. This thing is my fingerprint. And for the young people, this is not a Twitter handle. This is something called IRC. We are there and I'd be very, very happy to talk to you guys and learn all the possible things you can communicate with me. So thanks for an absolutely fascinating talk. We have managed to leave a full 10 minutes for questions. In fact, almost 11, which I think is a great idea. I have a million questions, but you don't want to hear my voice, so I hope you have the same questions in your heads that I have in mind. Who would like to have the first one? Thank you very much for the talk. Do you have any idea how to deal with a big amount of encrypted email? How to search in it? What to do with a start-away encrypted email when the keys elapse? What to do in the long run? What we are doing now is that we, it's different in this case. In the original BitMask client, what we do is that we don't store the encrypted blogs anymore. We use the very nice and old code in the standard library for, it has like 10 years ago, 10 years code that pieces, cast the pieces of the MIME3 and we store all the metadata in different documents in the document store and we delete the original encrypted blog. So we can do efficient search mainly by headers. We can build indexes for searching for the main things in headers. Pixelated project is using a different approach. They are using bush, I think it's pronounced like this, and they do full-text search on the whole body of the mail. And they store, what they do is that they build the index for doing full-text search locally and they encrypt the index and they store the key for this blog inside Soledad. So you have locally quite nice and efficient index to do any kind of, we probably could do the same with NodeMatch, just trying to block and grip the things with NodeMatch and just store the keys for the encryption inside the metadata database. I came across an encrypted email client called MailPile, which sounds kind of simpler but less ambitious. Can you compare the two? Because I felt you were trying to get done in time, which was great. But when you started saying, here, let's have a client in the server and a server in the client, I was lost. I need probably better diagrams for that. We are really similar to MailPile. Actually, the Pixelated project started to consider using MailPile for the frontend. I personally found MailPile kind of monolithic and we tried to decouple the things to play nice with the whole provider infrastructure. So MailPile is probably doing this whole thing in the client. They do their web server thingy, they do all the handling for GPG and they do the storage and it's basically the same thing. It's a webmail with encrypted local storage. They don't attack this as far as I remember. They don't attack the replicability problem. So we kind of started from the upper layer and this is a very hardcore strain. I got MailPile running with my agent. So at the end I don't care. We kind of focus on this layer and the user agent should be pluggable. MailPile is really, really nice and for the amount of funding they got, they are really far in terms of features. So I really would like to plug it into the whole Soledad encrypted storage. The main difference is replication. That's great. Any more questions? Yes? Hi, so one of the things I've been struggling with is can we really escape it? I mean, even if we use something encrypted, people will communicate with us Gmail. Even if we use encryption, if it's on the phone, I mean, that's either Android. I mean, it's either Google or Apple. So can we really escape it? Or is the only way to communicate securely is just low tech, just meeting people? I don't think I have an answer for that. It is totally true. Our code now... I kind of screwed it. We had code in GitHub and we are moving to another GitLab instance in which a requirement is that you have an email that is not from one of the big mail providers, because as you say, it doesn't make any sense if you are hosting a mailing list server with some pretensions of privacy and one only person in the mailing list has a Gmail account. End of the game. Have you read Moxie Marlin Spike's recent rant about the end of Federation? It's a very interesting discussion going on in the community because he thinks that having central control allows you to reach a lot of people. Like deploying something. My personal impression is that that is not the main goal. Like Federation doesn't really need to mean that you are sharing... Isn't it the open source problem or the creative problem in an abstract way? We are open, but the big corporations are less open. So they are open to our things, our code, our conversations or whatever. They can do data crunching, they can do data mining on it, they can make money out of it, and they return zero.  For me, mail is important because it is like the last place or common language. Until now, mail is the only universal identity anchor. If we lose that, we are screwed. More and more, with Facebook, it's going to move towards GSM identity pieces. So I don't know, hard question. I want to believe. You said GSM identity pieces. What was that? What I'm meaning is that right now, for all the social networking silos, mail is the identity provider. It's your reset for everything. But more and more, if you look at the peripheries of the capitalist system, they are starting. New people, younger people, doesn't have an email. They only open an email for opening their Facebook account and they forget the password for the email. And more and more, I'm seeing this trend about the GSM and GSM, the chip, being your identity anchor. They can build about it. So are you saying that email is the only right way and there's no future for protocols like Signal or something like that? No, I'm not saying that.  Mail actually is for spam and we are going to have a big problem about spam if we encrypt all the metadata and for work and for university and whatever. But this is the pragmatic approach. I'm really excited about things like POM that have POM. It's a project I think by Adam Landly, which maybe I'm mistaken, but it's like an experiment towards a new messaging protocol with security considerations from the beginning. Signal is something that 10 nerds are using. My point with this being strategically important is that mail is going to be there for a while and we cannot wait. There are situations in the world, I don't know, you are running an abortion network in Malaysia. You cannot wait 10 years until the hikers can with the right tool.  It has to be open and federated. And the thing you were talking about was POM? P-O-M-D. Thanks. All questions. What's the time? We've got time for about one more. Yes. Hello, hi. Oh, hello, hi. I think one of the things you mentioned in your talk was really important and it's around the question of why normal people either don't do it or can't do it and it's around usability. And I think in the open source world we have lots and lots of people who are technically very good. We are enthusiastic about pushing the boundaries in terms of protocols and the cryptographic correctness and all the rest of it. And whether it's cryptography and email or a Libre Office, I think there's always a stumbling block which is the usability for normal people. And it's a shame. I mean, I'm older than most people here. I've seen over the years great ideas which are intrinsically excellent fail because Granny Smith didn't understand the word or the icon looked wrong. Something that was relatively easy to fix. So my question is to what extent are you doing the user research, the user testing with normal people to say actually we don't need to put the effort into key replication or whatever it is because the thing that's stopping people is something else completely as observed by a more disciplined understanding of how users interact with what you're building. Let me search for one little thing. I didn't have time to get into it. This is absolutely important and usually it is not hard-coded into the processes of the groups because we have the, I'd say, the engineering bias.  I'm generalising, just trying to be funny but that's a very wrong approach and we don't realise about it. I've been talking kind of about mail but the first part of the project we were trying to solve another different problem which was secure VPM. The idea was having a Trojan horse because users are not going to install a desktop client for email but they probably won't a desktop client if it is the only way to get VPM. So now we have our regrets, I have to say but we spend some time trying to solve the other problem about VPM, cross-platform and so on and if you don't know this blog, just subscribe it. Subscribe to it. This is Gas Andrews and she gave some workshops about disability studies in a very scientific way and came up with a long list of very interesting things that need to be changed because our mental model, basically for how the user understands and reacts to the application was not optimised and we fucking need more of these things earlier, during, afterwards and I cannot mention that one of the challenges right now is to close the feedback loop with these kind of things in a faster way. Okay that's it, thank you very much. Huge hand for this wonderful security.