words if you want them. Okay, so obviously Evan Moglen probably doesn't need much of an introduction to this audience, but still I'd like to highlight a few things. He's a law professor here at Columbia University since 1987. He's also the founder and chairman of the Software Freedom Law Center. So obviously as a professor he's spent many, many years training generations of lawyers to kind of intervene in the world in the realm of privacy and copyright. Some people may not know. He's also got a very kind of strong historical edge to his work. He has a PhD from Yale University in history. However, as much as Evan has worked as a professor for many, many years, he's quite interested in changing and intervening directly in the world. He has provided pro bono work to the Free Software Foundation since 1993. He was on Phil Zimmerman's legal counsel team for PGP. He founded the Software Freedom Law Center, had a direct role obviously in shaping the GPL3. So all these things are obviously incredibly important, but for anyone who has seen him speak, he also tends to inspire all sorts of people who are not the students to follow kind of in the way of free software. And I think today we are confronting some interesting challenges when it comes to software freedom and this is what Evan will be talking about today. So please join me in welcoming Evan Mockel in today. It's an honor to be here. Since early in Bo, it has been the case that every single day there's been at least one computer in my life running Debian and I couldn't begin without thanking you. It's a great pleasure to meet that Debian has come to New York at least once, probably once. And having spent almost a quarter of a century teaching in this university, it's a particular pleasure from me to see you here. I want to talk this morning about technology and politics and I want to talk about technology and politics in the mode where technology can help fix politics, which is good because if we expect politics to fix technology, we, of course, wait forever and be deeply disappointed. So the line of direction if we need to support freedom is not a line from politics to technology, but a line from technology to politics. That's what time ago, that's what Phil Zimmerman saw a long time ago. That's what our client base at the South River Freedom Law Center says that to you. And the question is how do we take political analysis, turn it into technological problems and be what I want to do. I've been thinking a good deal to start a year away from teaching, which is the moment when, as an academic, you can begin to do some thinking. I've been thinking a lot this year in preparation for a year away from teaching about the lamentable state of privacy in the network and about the extent to which, though we have been working steadily with extraordinary results for a generation now, towards technology to support freedom, we are also watching as the network grows up in a way we've all, you know, as a great surveillance instrument that can be used for forms of control over people's lives that are far too powerful for us to permit, far too powerful for people themselves to be fully aware of.  It's another way to do this. Get rid of the wireless headset mic. Somebody hand me a stem mic. I'll do this, which is an easier mode of working all together. Pardon me while the delay. Yeah, no, it's fine. Console just needs to catch up. Okay, so the network is doing the very things that we're afraid it can be made to do. And indeed, a certain application layer, I hesitate to call them developments. Let's just say the events like Facebook have created far more serious concerns for the network's possibilities as an instrument of surveillance and control than the ones we thought we were worrying about when we started worrying about proprietary technology and freedom. The problem is that proprietary technology's threat to freedom consisted of the possibility that people would be trapped in a technological environment they didn't understand, couldn't reason about, and couldn't modify to the extent necessary to preserve their own personal liberties. The problem with the net that we have now, in addition to all of that, is that people are induced to give away everything that is crucial to the maintenance of their autonomy in return for vastly overpriced services, which cost nothing in monetary terms, but which are not just unfree but are productive of unfreedom. We have social networking that spies on you all the time. We have email delivery, which is extremely capacious and spies on you all the time. We have free telephony services supported by advertising based on the content of what you're talking about. It's a rather bad universe from the point of view of freedom. It's a bad universe because it incorporates all of the things which worried us about the possibilities of proprietary software plus one more, namely that people can be fooled into doing themselves very substantial long-term harm and not just harm to themselves but harm to the ecology of information protection in return for people giving them at monetary cost zero stuff that degenerates freedom but which also provides them features that they want. This is a challenge not merely of a technical kind. That is to say, technical from a lawyer's point of view. No binaries are being distributed so the GPL doesn't kick in so you don't get the source code. It's past that. I mean, that's true and that's our reason for the Franklin Street Statement and a reason for the AGPL and a reason for specific concern about the licensing of software that performs service provision in a network but it goes way beyond that. It's a matter of bad technology design. In early February at NYU, I gave a talk about the beginnings of my thinking on this subject called freedom in the cloud and this morning, though I don't want to leave anybody behind who didn't happen to hear that tedious recitation of trouble, I want to take the thinking a little bit past that because it's time for some engineering and we're the people who are going to do it. The basic difficulty in my view, the reason that we have wound up with a net which despite the extraordinary penetration of free software into it is still in the growth curve phase of hurting freedom. The reason that we're there is that we have allowed an architectural myth about the net to grow strong. The net was built as a collection of peers with equal power and it became over time a network based on master client, server client, master servant relationships of hierarchy. That hierarchical design had in part to do with the architectural premises of the Microsoft monopoly which tended always to think in server client terms not because those were essential to the technology or even really because they were essential to the Microsoft platform management business model, although that was relevant, but mostly just because it was the culture of an institution which had very rigid culture which is part of why it is now dying. But that server client view of the network also made some sense in a world where large iron and small iron behave differently and it sort of made sense to think of large iron as doing large iron work serving small iron where small iron wasn't really thought of as stuff that fits in a pocket but stuff that lives on a tabletop and all of our considerations about the network have become imbued with technological assumptions in articulate most of the time barely glimpsed except out of the corner of our eye we assume a hierarchical net even we assume a hierarchical net with heavy iron doing serving and lighter iron out there being clients and doing conceptually different things. We are now about to take another architectural step in the history of our technology. This is the step which is being referred to as the cloud a very cloudy phrase which basically means iron doesn't matter anymore it could be anywhere. The cloud is the location independence and virtualization of iron that's what it means in some fundamental sense if you're trying to cut through the jargon and what that means to most of the people thinking about the cloud as a business proposition is we're going to have a hierarchical network in which the real hierarchs are invisible virtual nonexistent movable flexible can disappear and appear anywhere at the convenience of whoever it is who manages the hierarchs. Which is a convenience no question about it incapable of saving enormous money in the it expenses of large businesses and will happen therefore because capitalism needs it and there's nothing intrinsically wrong with it in fact it may save energy move jobs to better place God knows it all sorts of things but what it will do unless we begin to intervene in how it does it what it will do is make freedom even harder to preserve because people's data will go someplace they don't control it all and there will be an open scrum to control it this week as you are noticing the UAE is playing tough with rim over why you don't let small countries like us bug everybody who uses a blackberry just as much as you let big countries where your servers are bug people who use blackberries which is really oddly enough a complaint about freedom in the cloud by a government whose secret police don't have enough of it right and is much as I don't generally sympathize with the spooks and the cops and the listeners on this particular case my heart goes out to them because they're having the cloud problem the thing is that at the end of the day we don't really care whether the secret police have a cloud problem we care whether human beings have a cloud problem and it's going to grow worse as everybody's hierarchically organized net moves towards servers that go wherever they are going to be least effectively controlled by you and least effectively controlled by law in the interest of those people who have de facto control because they have your data and they run your processes this is a very bad outcome fortunately we're the free software movement that means not only do we make great software but we think about problems exactly like this and we try to solve them preferably before they happen and if necessary after they happen and we've been doing it for a long time 20 years ago when as bella points at almost 19 this summer 20 years ago when the question was can you use mass market freely developed freely transmissible strong encryption the most powerful organizations in the world like the United States government wanted the answer to be no we recognized back then that two things were true without freely available industrial strength encryption people control two things can't happen one freedom and two electronic commerce and we said that to everybody and we were told no you're in favor of nuclear terrorism and pedophilia in fact back when I was working for Phil Zimmerman I had a bet with one of the lawyers on the beat at every public event where I showed up to talk about it we bet a dime whether the first thing that was going to be said about me that particular day was nuclear terrorism or pedophilia and we're talking about the early 90s before the vast hysteria really began so we've been trying to think ahead about what would be necessary in order to prevent harm to freedom for a generation now and although the scoreboard is quite uneven we've done reasonably well most importantly we have built profound capacity and when I say we I mean you we've got real tools for improving freedom in the net at the moment we have profound challenges and I've just quickly tried to describe them here those who are interested in a more detailed analysis can go back to the transcript or the video of the freedom in the cloud talk where I tried to spell it out in more detail but today I don't want to get to starting line today I want to get past the starting line here's the situation about the cloud servers can be anywhere and they can be anything they can be made out of iron they can be made out of bits all they do is run programs that provide outputs to people who provide inputs over a network generally speaking the physical or even virtual organization of the server cloud in the net in the next several years will support the business models of people selling services they will to some extent support the business models of people selling hardware they will to some extent support the business models of people selling software but primarily they will support service-based business model provision of everything from data centers we wrap for you to your email in one great big inbox as long as we're allowed to read over your shoulder but because servers can be anywhere people interested in freedom might ask themselves where should a server be who goal is to make freedom for the human being who owns it where should a server be if its goal is to make freedom for the person who owns it the answer is in his apartment in her bedroom in the places where law and society could come together to agree that there is something called privacy and that you ought to have it if your data is sitting in your desk drawer and in your house and somebody in the world wants it and your house is located in the United States then they can get a search warrant and if they can't get a search warrant then they can't have it unless you want to give it to the enormous changes in our fourth amendment which used to protect us in our papers and effects in lots of places no longer protects us in an airport on the street at work on the phone in many of the ways we thought it did but so far and I believe for the for the foreseeable future the constitutional sacredness of the home is not going away and while not every society behaves with the same degree of recognition that a man's home is his castle as the common law did he puts in everybody understands that that which you keep close is more yours to regulate and control than that which you voluntarily give away to a stranger to keep for you on another comment so the server that protects your freedom should be in your house well you've got lots of servers in the house you've already solved this problem to the extent that you want it to be solved it's solved already but we make technology to free people who aren't us so the server should be in somebody's house but people are afraid of servers in the house servers in the house is some kind of high complexity thing that nobody older than 12 you have to be you have to be an expert a genius or a child and not everybody is so the server that works in your house to protect your freedom should be very inexpensive very small and very simple in fact it should basically be something you plug into all and forget the server that protects your freedom should be in the world of 2015 what a quaint antique piece of technology called the telephone answering machine was to the 1980s a commodity box you buy at every corner store at nearly no price you bring it home you plug it in you do two minutes of setting up and record your favorite funny outbound message and you leave it there and you leave it there until which is as long as most answering machines were until the whole technology of society has made it no longer necessary for you to keep it at which point you throw it away that's the best possible model for the server that lives in your house and protects your freedom gotta be cheap gotta be simple gotta be basically featureless in fact of course the server that protects your freedom and lives in your house is no larger than the power supply for your answering machine and when we are done with the project I'm going to propose we should be on it will cost 25 bucks so everybody can have everybody can have one and it's a consumer appliance it's meant to be that simple that you don't have to be a 12 you could actually be a grown-up and still know how to use it what should a server that lives in your house and protects your freedom do well I was talking in February about how it should affect your social network which is actually among the most complex and least straightforward of the various things it ought to do and I was starting there because I wanted to talk about the effective social networking in the cloud on people's freedom so what I said out there was we we look at social networking and we see that we have a problem which we identify immediately as the problem presented by centralized services everybody's social life half a billion people should not be locked up in one big database that belongs to somebody else terrible idea everybody knows that mr. Zuckerberg knows it too it's the magic of capitalism that says getting very rich by doing something that's very bad for everybody is a great idea and you should do it and become famous and a hero and that's okay I mean fine right every every system in the world has problems and capitalism has this problem and the thing to do about it isn't overthrow capitalism burned down the world is to fix this problem now to be sure mr. Zuckerberg is part of the problem and not part of the solution so I went and tried to talk on a Friday night to a bunch of young people at the other University on Manhattan Island that collects a lot of people with no dates on Friday night and and we and we try to imagine what it would mean to take social networking out of the server client master slave architecture of the network and a few guys in the audience said yeah this is a project we want to do so let's think up how we want to do this we want to have an API structure which solves the fundamental underlying problem of changing Facebook if your Facebook if you're the guys around Zuckerberg or the guys salivating to take it public or whatever you think that what protects your business is half a billion people are in a roach motel they can't leave because their friends are there and it's this and it's this inflexibility which is from their point of view strategically the underpinning of their inevitability this is technically wrong what the diaspora guys said was how about we develop a system which provides encrypted peer-to-peer routes for social networking like information sharing of text and photos and conducting of real-world human intercommunications and suppose we set it up through an aggregation interface which is insensitive to whether it is getting this particular photo from Flickr or over an encrypted route from a friend as your friends switch to federated social networking more and more of your interactions occurred directly peer-to-peer over encrypted routes and fewer and fewer of your interactions occur through the intermediary centralized services but you never have to know because every day you look through your aggregator and every day you see all the stuff and some of it is coming one way and some of it is coming the other way and as your friends begin to work through diaspora nodes you all take a soft withdrawal from the centralized services this is a very interesting business as is demonstrated by the two hundred thousand dollars raised on kickstart in less than four weeks by a whole lot of people around the world who said yeah that's a really great idea you're some smart young people with no track record and no code but we're willing to bet a little bit on you and a lot of little bits added up and they're off writing some code and we'll see what happens but what I want to do right now is to focus a little bit more on other parts of the stack that may be a little more simple to think about and and actually have also some very powerful effects on freedom so you've got a server in your apartment it knows about your mobile devices and it talks to them in an authenticated way so you can run your life from your mobile devices sensibly and without intermediaries who puts you in any way at risk that box is also your wireless router because it's got wireless and it's got a wired connection in whatever is the wire connection your apartment or it's part of some mesh if that's how you like to be and it does backups for you in an encrypted form to your friends so that everybody is helping to make everybody's data more robust and unless all your friends including in the different places around the world where you have them all disappear all at once you can regenerate anything with a couple of key presses it versions your stuff which for many people in the world would be a shocking development it encrypts your email a thing we've made possible for people 20 years ago people aren't doing as a consequence of which a lot of stuff is stolen out of email far more than they even know never mind the government if you have friends who live in China or Syria or other places in the world your box works to help them climb over the wall around where they live because it proxies for your box is a cognitive radio on the net that is to say it senses its environment do you have an ISP who won't let you get to port 5678 on IP address so-and-so gee that's a shame your box tunnels to a friend and bounces you the traffic in other words your box makes network neutrality for you it can't do everything it's not a replacement for sound regulation but politics won't make freedom by technology most of the time and technology can make freedom for politics sometimes if you have de facto network neutrality because everybody's using these servers no ISP can kick them off the net it's out of the question and they are cross routing traffic to avoid difficulties you will have fewer your server in your apartment should have asterisk now we begin to change the global economics of telephony and we begin to acquire some working power in dealing with parties who are very difficult for us and who are very important to our future let us call them AT&T Verizon Deutsche Telecom BT because we begin to have alternatives in fact if we spread these cheap easy simple fun useful boxes around the world we will become the world's largest telephone company in a very short period of time and we will begin to have things to say about industry and how it works all of this and a lot more can be done in a very feature full footprint the size of a power supply it's the arm based plug server right we have many designs around the world right now this year next year or the year after that they will be commodities their prices will drop precipitously we are now talking about very good servers that consume less than 10 cubic centimeters and that are very cheap they have significant processing power they have significant available storage you can usb connect anything in the world to them and make as much storage as you like they are very intelligent routers they can do lots of interesting things the architecture is one Debian already supports that's to say we've got our whole toolkit already packed we've got lots of software that we would need for such a project since I spoke in February I've been receiving email from all over the world from people who have dozens of pieces guy writes to me and says I live in a small Central American company behind 12 layers of IPv6 NAT but I've got exactly the thing you want for your router privacy piece and you know we're pulling together a stack it's a stack whose job it is to provide freedom appliance material to be used in a particular form factor which is our form factor the small server located under your physical control which federates services with the people in your life with whom you wish to exchange privately and in a secure fashion that's our iPhone that's the form factor we want to be most businesses around the world don't want that form factor it doesn't help their business model we will have allies I am working to find us allies they are people in portions of the world hardware business for whom disruption of dominant competitors would be a good thing and if I say to them there's commodity hardware out there you don't have to make join to free software we already have which will produce vast amounts of political liberty to its users and will really screw up your dominant competitors business model are you at all interested in helping the diplomacy is doable let me put it that way the diplomacy is doable the crucial fact is that it's up to us to make the software just as it was up to us to make PGP okay no one's gonna do it nobody's gonna do it for us no matter how obvious it is no matter how good it would be for everybody no matter how much better the world would be if we don't do it it won't get done so we should do it there are a few parts to this that we don't already have we need a very extraordinary fun experience web configuration business for how to get your little personal server up and running in a way that's good for you the first time and we need to do even better than we have already done at making it easy for people to trust us with respect to feature updates and security services and all the other things that will be involved here it needs to be a bring it home plug it in teach it what your cell phone is set up the basic stuff tell it where your friends are and forget about it it will just work for you this is within our reach this is the silver lining of the cloud this is how we can take the very thing which is happening to the network the dematerialization of the network this is how we can use the dematerialization of the network to redress the unfortunate hierarchicalization which happened over the last 20 years to return the net to a condition much more like peerage and to use that peerage in the interests of the peers who are the people the people for whom we make the software we are going to live in the year of the Linux desktop sooner or later all right I believe that too I believe that too and I think that's good I think that's good I think we used to think that was victory it's not victory in fact whatever we do about that and we will do really good things and GNU will be there and X will be there and the Linux kernel will be there and some other kernels will be there and all kinds of stuff will run and it will all be fantastic but the really big social payoff for us right now the really big social payoff for us right now is the small server that restores free that begins to turn the net into a place of federated services because the infrastructure for federated services is already there and people are buying it and installing it because it's good for them cheap and gives them what they want in my world where the lawyers are there are lots of people who say yeah give me that I want to put it my apartment I want people to have to get a search warrant there are other people out there who think well we really need a cloud of proxy servers to help our friends in countries that don't allow people to read freely people need network neutrality people need privacy people need cheaper telephone calls all kinds of things that people need that we can give them on a hardware platform that already exists and which we already support and which will otherwise not be used for politically advantageous purposes over the next few months we want at SFLC to help pull together the necessary institutional and legal arrangements and we want to find the technologists who want to help us do this work the freedom box as I'm calling it right now in default of something better and more catchy the freedom box is a product for us not a product to sell and make money on a product to spread through the world in order to get the promise of free software to people in a particularly advantageous way right now at the moment where we don't have to do it by inventing hardware or software we can just put together the off-the-shelf pieces that will do the job I don't mean by saying just that it's either no technical challenge or no technical challenge worthy of the extraordinary people in this room it is a technical challenge and it is worthy of the extraordinary people in this room it is the shortest route in my personal opinion to major pro-freedom payoffs from free software in the near future we can have a transformative effect on the network and on the evolution of connected society if we do this right this is the time we live now in a world of hardware heterogeneity that's part of why the Microsoft monopoly is failing because it doesn't run on everything we run on everything we are for now in the position that in a differently constructed universe the alternate universe in which Richard Stallman grows up to be president of the United States but doesn't do free software programming we are now living in a world in which the promise of technological freedom as a support for political freedom can be realized in a new and ingenious way because the box builders have done what they always do they have built great boxes for us to do something with these boxes are great because they are cheap simple and can be made ubiquitous they can put power back into a better balanced net if they put power back into a better balanced net and we're the power of that net then we will begin to have a net which actively sustains supports and implements freedom inside people's apartments every day this is the game we should be shooting for along with all the other games we're shooting for maybe there are ten projects we need now we haven't already got and some glue but this is eminently reachable this is eminently reachable and it isn't merely that social networking will stop spying on you and it isn't merely that you'll get all the email convenience you want with nobody looking over your shoulder it isn't merely that the net will become more neutral than people in China will read or that there will be enough tour nodes for performance finally not to be horrendous it's all of that and a lot of other stuff we haven't even thought of yet but that we'll figure out as we begin to do the work so that's what I came to talk about I will spend the next several months trying to find other things that we can do to help make this suddenly happen and believe me to the rest of the world it will happen very suddenly we will disrupt a lot of games we would like to have disrupted and we will win a lot of credit for ourselves and for freedom so that's what I wanted to say today I'm happy to take your questions how we'd like to do this now is have everyone form a line and here or something like that and ask questions is this one coming up we'll start with my side first or hello thank you for your talk I have a question one of the things that has pushed me kind of towards the cloud or men at least towards the data center or the somewhat userous agreements that ISPs enforce upon you not to serve any services from your house and I was wondering what your suggestions are and how we can battle that well remember that you've asked a question which is global and any answer which I give you is local in some parts of the world I can say the market is a useful instrument for altering the behavior of market participants because people can vote with their feet in some parts of the world I can say we have regulatory options but mostly what I can say to you is using personal encryption was against the law in many places in 1991 may I just randomly think of France for example and the movement of encryption software was forbidden in many places including this one on the export side and we actually found it necessary at one point to print the source code of PGP 2.0 in a heartbound book published by the MIT Press in order which published I think it was a whole 50 copies I have one if anybody ever wants to see which we took to the United States government through the Commerce Department window and we said well here's a book do you want to tell us that we're not allowed to export this book from the United States because of some law rather we'd really like to have a First Amendment conversation in the courts about that if that's what you think and they gave us a commodities jurisdiction certificate for the book so what I guess I want to say is I actually think of this device as an electric cattle prod capable of being used with respect to certain ISPs okay let's rumble do you really want to say you want to enforce your imagine that the telephone company had before the breakup of AT&T said we're gonna cut off the telephone service of everybody with an answering machine what would happen so I think the way to deal with the problem in other words is to face it really really squarely I don't think the cable companies in New York City want to say you can't have the magic freedom box go buy your bandwidth from Verizon and I don't think they really want to say you can't have a magic freedom box unless you mesh network it with the guy in the apartment next to you who doesn't use our services I think best buy which now owns speakeasy in the United States but which is doing its very best never to be seen with speakeasy because it knows it wouldn't be good for speakeasy's business I don't think best buy wants to turn speakeasy into an oppressive ISP I think they want to leave it there for the people who want to buy those services so I don't want to say this is not a problem I just want to say I think the freedom box helps to fix it instead of keep it from happening hi thank you for your talk I've been as you mentioned trying to we all have servers at home and I think we have all been trying to do some of this work ourselves for a long time and struggling to bring the internet back to its natural form what I'm my question is a lot of the work we're doing is isolated and desperate and not coordinated and I think it has a grave effect over the way those developments are happening are you proposing some coordinating structure or some way of pushing this forward in a common fashion or are you simply relying on the common energy that we can pull out I'm proposing that this is a Debian in little it's another sub-distribution it's a stack made out of our parts thought about and governed in our way democratically capable of producing self-organization for the making of software capable of supporting architecture and supporting use and engaging users and bringing people into active as a into active relationship to the software who've only begun as users of the software I'm suggesting we go and do the full Monty with it excellent that is what I was expecting and Apple creates desire from free because it employs highly skilled graphic industrial and interaction designers and free software projects not typically engage those communities as hobbyists so I wonder what to what extent those skills are needed to achieve the mass popularity that you envision and if those skills are needed how you suggest the free software community can engage with those kinds of people well you know not without reason some people have commented on how much better their stuff looks some people remember that part of that reason is because they have patents on how to make stuff look good and they won't share them with us and we spent years worrying about how to do things that we could have done if Steve had been as generous with us as we were with him but notice but notice that what I've said is that the platform whose time has come is a platform that doesn't have a screen doesn't have a mode of interaction directly with its owner and is beige small and in fact could be made pardon me be dealt by HP except that it will be delivered to you with 20 layers of cardboard and right I mean this is not this does not call upon us to worry about whether we are good enough at making cute shiny things this calls upon us to make what we are really good at which is powerful stuff that just works never breaks does what it's supposed to do and makes things easy for you it will wind up with a UI but that UI will be made of CSS right it's just gonna talk to you over whatever it is that you use to talk to things in the net it's just gonna be yours and I'm sure it will skin in the end in all the ways that everything does but people won't buy cuz it's pretty people will buy cuz their wireless router broke and this is cheaper than a wireless router and does 200 other things and everybody's got one and oddly enough it's cool even though it doesn't look it you're correct of course that Apple will never make this product because no matter how much shininess you put on it it's still just a beige box and that's the good part we're not we're in a different product cycle than he is now isn't that sweet so technology is gradually converting on science fiction I don't know if you've read your talk brought to mind bernie vinge's renders end for me and one of the nightmares there is that we did this but the US government beat us and the before we before we got as far as making it work we were federally mandated to include something very much akin to the clipper chip in all of these boxes so you know everything only operates within a sandbox how do we is the only way that we can defeat this to be quick to get there first no but it doesn't hurt making facts on the grounds a good idea PGP came from Phil Zimmerman's determination that if s1 passed and encryption became illegal to use in the United States as it was already in France there would be free software doing strong encryption out there in the world and they'd have to get it back in I have to tell you that I'm not as worried as you are about a clipper chip because the clipper chip proved to government what will happen if it does the clipper chip what what what we are actually going to be doing if we do this is doing the United States government an immense favor because we're going to provide a superb addition to network security without costing the United States government the one thing it doesn't ever want to do which is to come out and tell people there will never be a secure network while there is windows this is a this is an open understanding everybody knows it you can't really study the problem without noticing that windows made the secure net a mere theory but the United States government in gonna do that so we can't tell the truth so what it will do is waste tens of billions of dollars on cyber war in order to keep people employed without really addressing the problem and I say knew that when they tried to get security enhanced Linux to exist and we're willing to face down very serious Microsoft pushback over the idea of contributing to free software to improve general network security now we if we put freedom boxes in people's houses will give them appropriate perimeter security for the first time we will give them ideas for free and I don't mean ideas to spies on you for free I mean ideas to tries to keep the spies out of your apartment for free and we will put a ring around windows boxes that will make the botnet inside your house less of a problem to you and the world outside in fact over a while those botnets will get better because more bots will be behind filtration the government is not going to fight us about it's there are too many easy ways to stop the fight if we had the software now and the boxes now I would be standing here telling you don't worry I can protect you so you say that this box is not going to need a shiny UI or whatever it's just a beige box that sits in the corner one of the reasons that people use these services that we're objecting to here is because they like the UI so people or use Gmail because it has a very nice way of accessing their email and doing all the features that they want with their email whereas when you look at the web mail things which are currently available in open source you know they don't people don't use these in some cases because they don't have a server to run them on but a lot of cases because you know they don't have these features and they aren't as polished and the same with things like Facebook you know there there isn't the equivalent in open source largely for probably the reason that the these companies can hire the people to produce really nice and slick and usable systems so if you're if this freedom box is going to sit there and handle all of your encryption aren't people just going to then send the emails back over to Gmail once they've come into the freedom box and send all of their images over to Facebook and this sort of thing because it's got a much nicer interface and thus undo all of the good work well since I don't use Facebook I'm at a disadvantage I rarely hear people tell me how pretty it is my impression is that's not the reason similarly although it may be true that Gmail is basically in use for prettiness I think it's in use because it's convenient as hell for people and when I ask the free software hackers who go to law school and sit in my classroom and take the class on privacy the Constitution and computers why they run Gmail Lewis Villa says I don't know just so easy Lewisville is one of the most shocking moments in my classroom in the past 10 years aside from the people who now believe in the efficacy of torture is Lewis sitting in there and telling me you know it's too much trouble running a web a mail server I'd rather use Gmail now he's a lawyer for Mozilla I don't know whether he's changed his attitude about that or not you ask him ask him the next time you see him tell him I sent you you may be right and if it turns out that pretty is what we need then pretty is what we'll make web design is not act we don't have to feel really all that guilty we know how to make designs okay I we have nice websites if you're right and that turns out to be what we have to do then that's what we have to do we have to do it I don't actually think that's the first and most important part of gaining acceptance for this I think cheap stuff that really works good and is better than your route than your existing wireless router is smaller uses less and costs less and fits under your desk more conveniently is really the selling point for some people as all my data in my apartment where you have to get a warrant is about for some people diaspora or something like it that gives you privacy respected social networking will be the selling point for other people and you know since we don't have to sell the boxes and make a profit on it I don't actually care all I really want is for us to make the software which is immortal and will never die and let other people make the boxes and sell them for money which they will do and we will help them because we will give people a wonderful way to use their products which they will advertise so let's see how it goes I understand what you're saying and it might be right but I don't want us to get into the view that we are tyrannized by the pretty we need to be aware of design we need to think about design we need to care about design but what we really need to care about is technology and freedom I was told that there is going to be a gift giving session or for a few minutes was it came up to me and told me the gift is nobody has to listen to me answer any more questions oh it's after the questions well let's at least take one or two more since there are people in the back I want to ask them hi so I had a question about the architect the proposed architecture of a distributed social network that would that would scrape from existing services like Twitter and Facebook so that the people who switched to it wouldn't feel that they were losing something so a number of my non-geek friends say that they like Facebook and similar services because and this is a direct quote they get to spy on their friends without any difficulty okay so so so and I recognize that the have you interviewed the friends well these these are mutual friends so your proposed model let's people continue to spy on their friends without difficulty but it seems to me that unless it allows Facebook to spy in that they are now removed from the mutual spying activity if their friends have not yet switched so I'm wondering how the proposed model would address that well so so again I want to point out that I was describing a software project some young people are working I'm not running that project and I'm not reading any code because there's any code to read yet so I don't want to talk to you about somebody's vaporware as though I were either a in control of the feature set or knew what its date of arrival is let me talk in broad conceptual terms if you use aggregators already to put a layer between yourself and service providers and many people do in many different places for many different reasons think RSS then you recognize that you can decouple the underlying service from its presentation to people if you use an aggregation technology which is attractive to people if they like it if the way it gets them the stuff they want to see about the people they know inside their browser is good for them then what you have done is put middleware between the centralized service provider and yourself that gives you opportunities to have multiple back ends in effect what we want to do is put a front scrim in front of the entire social network in universe which is good for you because it aggregates the stuff and gives it to you in the summary form that you want and allows you to dig where you want to dig and gives you a control panel for your social life and which because it's a middleware front end with respect to the centralized service providers allows you to disintermediate them quietly because as more and more of your friends are using encrypted routes that are private among peers you've gotten them out of exchanging all their data through somebody else's switch has that changed the extent to which you're spying on them or they're spying on you not at all the same date is flowing it's just flowing over different network differently organized and the different network geometry drops out the spy you didn't want namely Zuckerberg whether you want to share everything with your friends you want to share nothing with your friends remains a decision you can make you can make it more effective than you can make it when you're under man in the middle attack all the time which is from the security point of view what existing social networking is right it's the institutionalized man in the middle attack it's always Zuckerberg just said hey how about I'm the man in the middle of everything what do you think about that yeah mark we love it sure and every time there's not enough traffic passing over the thing he goes out there and says share more right that's all so what we say is yeah just don't put it where he can see it everything else stays the same you don't even know you went transparently from a man in the middle attack to inappropriately structured encrypted network how'd that feel felt like no change good that's what we want thanks for the talk with the timeline being five plus years out for this I'm wondering if it's perhaps kind of already missed the boat you take a look at the ubiquitousness of cell phones and how children growing up now are you know getting them at age 8 10 whatever and kind of how that you know the mobile cellular network is is progressing as much as I you know like the freedom box and kind of what it stands for I'm wondering if it's already missed the boat I'm not sure why I would have said that from my point of view the fact of the closed proprietary networks which is a major part of our problem is a problem we can begin to solve better if we control some more endpoints particularly endpoints that are themselves capable of telephony switching if you give me another hundred million asterisk servers around the world I can make Verizon a much easier place for us to deal with right we're gonna have our problems with the closed network operators are every bit as serious as you say they are we need leverage and we need it fast we got leverage over Microsoft and we have solved a lot of problems in the world and now Microsoft has way more problems than we do that success okay we need to do the same thing about services and we need to do the same thing about closed networks and in order to do that we need a lever and what I'm telling you is that the best lever in the world I think right now is a little beige box that already exists and where we already run and we need to do some tuning we need to sharpen the edges on that little beige box but if we do it right that's the bomb which gives us deterrent capacity and which makes us important in the system of power that you're talking about and which gives us a place where we can go to say to people you need to deal with us and you need to deal with us on the basis that we want to be dealt with which is we care about freedom now let's talk there isn't anybody else representing that point of view in the world there's guys who believe in so-called network neutrality despite how hard it is to operate a network without paying attention to which packet needs to go where when right there's there's guys who believe that we're going to get the FCC one day to announce the internet is free again as though on the morning after that AT&T and Verizon won't go to work doing what they're doing now and Apple won't be thinking about how to do what it done so on we need an actual lever this I think is the best lever you know we make software each of us one at a time sitting at a keyboard and we make strategy like this so what I'm telling you is this is my suggestion about our strategy I want to do something big and I want to do it at minimum possible cost I want to use hardware it doesn't have to be invented and software we already have I think this is how that's all I wanted to say thank you very well thank you very much Evan Moglen it sounds like everyone's got a little bit of work ahead of themselves Evan has mentioned to me that he will be in and out for the rest of the week so if you have more questions advice concerns he's here to talk to you so definitely


So I've done individual videos on PF Blocker. I've done a video on Seracada. I've talked about how to set these up inside of PF Sense. And I've talked about segmenting your network. For example, in our case, we have our servers on their own separate network. That way they're locked down and it's easier to look through logs for a single network stream versus all the other noise that gets on the other networks. So when you're trying to focus on security and try to go through what's going on, you can lock down that network more tighter and it's a little bit less noise to punch through when you're doing things like analyzing Seracada. Now we self host a few things and so those are on that separate network and are exposed to the outside world so people can get to them. But obviously we don't want everybody getting to them. So what I wanna talk about today is even though you have all these things and some people may get this false sense of security which I never want people to have that you just load PF Blocker and Seracada and as long as the threat rules are up to date and the GUIP up to date for a block list and the IP reputation lists are up to date, you're good, right? Those are all reactive things. Now they're good, they're good to have. Security is all done in layers so it's not like they're not a good idea to have. They are just far from an end all solution and we're gonna point out something that was missed here by both Seracada and PF Blocker and it's because of the way and I don't know that it's an attack, I just know of the problem it caused and I wanna walk you through like the practical problems we run into even though we have these things here and how this kind of passed right through them. So like I said, I have PF Blocker, we block countries, we don't really do a lot of business and we block all the proxy satellites. Basically, all the places you just get a lot of attacks from Russia, China, so on and so forth where you see a high volume of attacks. We just block them all with PF Blocker so those IPs just automatically are blocked, that's fine. Let's move over to Seracada. We have a Snort feed going into it. Snort is a competing product for Seracada. They both, I'm not gonna get into the merits of each of them but both of them run off of Snort's feeds which upstream come from the Telos Security Group. They're the ones that maintain those feeds. And once again, these feeds are really good but they're once again reactive. So we try to determine whether or not these IPs are bad or whether or not the actions as they see them in these signatures will does this pattern of data coming through match a known signature or look like a signature because there's common ways people attack. Even though the stream is encrypted they're looking for kind of like a heuristic approach. They see things much better when you look at a non-encrypted stream of course because they can see more about what the data is but as the internet has become way more encrypted over the last few years especially with things like let's encrypt there's less visibility and especially when you start talking about the QIC protocol that actually blinds these things even more because it's all a bunch of UDP streams and it's a little bit harder to do any type of heuristics on UDP streams versus the TCP streams that we're looking at right here. So back to the reality of it and here's an IP that managed to get itself blocked. So 45, 55, 188, 183. We're gonna go over here to shodan.io which is the wonderful internet lookup and we look it up and say, okay it's a internet scanner hosted over at Djint Digital Ocean. What does it see? Backbone.js, Google font, API, gravitar, blah, blah a few different things that it's seeing running on there and it says this IP has been observed scanning the internet source with gray noise. So we look over at gray noise they're one of these companies that's collecting reputations and learning things about the internet by setting up probably a series of honey pots and kind of seeing what comes out there and going hey look at these guys are bad. So they're on the bad list they're not on the PF blocker list for whatever reason but they're also a digital ocean server so you don't want to just blanket block everything on digital ocean. If you did you would block our forums for example because that's where I'm hosting those but my forums aren't scanning but you kind of get the idea. This is actually within I believe close in proximity to where I'm hosting our current forums and those are hosted external not inside of our office here in Detroit but you can see that this is all the flow through okay it all stopped and only thing we really stopped someone was from scanning and scannings aren't necessarily the same as an attack they're reconnaissance missions and the reason a lot of people are on scanners they're gonna want to go hey what is the OS they're running what firewall is that can we make those determinations because if they can make that determination of what you're using the next step is to go is there an exploit against that particular model or brand firewall is you know is it a really old one patch and they can then try those attack factors so a lot of these noise makers on the internet that are out there scanning they're more of reconnaissance and making lists for later attack that's all fine and like I said that's the process for that now let's talk about the practical security of a couple things you ran into and how they affected us and how nothing about Saragata helps and nothing about PF Blocker helps and we had to start manually blocking some of these so let me show you and there's a really cool tool because everyone asked what tool I'm using for things the Go Access is a really neat command line log analyzer and I've got my logs in such a way that when I see any problems and I use Zabix to monitor my servers if I see a problem the server's under high load for mystery reasons we can use things like Go Access to go look at that and I see web server because we're running we self host screen connect or connect wise control depending on how you know the product that's our remote access tool that we do host in house so let's go over and take a look at the logs for that so here's Go Access and it's analyzing the log file seeing the hits from internal IP addresses and external IP addresses as they go here so here's actually our Zabix server which accounts for this this person here I don't know who this is at 747577.224 is just beaten up on my server for some reason these are internal IP addresses and things like that. The cool thing about Go Access is I'll actually open up screen connect and refresh it a couple of times on my side here use this is my IP address I have highlighted and you can see it actually updates it so every time I move around the screen connect and refresh this again you see another hit so internally these 192 addresses are the internal staff hitting it the 122 is Zabix monitoring it and this person I don't know what they're doing but they're not doing anything that matches any known nefarious signatures hence the reason nothing blocks them so let's go ahead and take a look and see if they're in gray list or one of these other places so let's go ahead and switch back over to this gray noise is a gray list put that IP address in search not found go over here show Dan and not found so that's where things get a little bit trickier this person's just banging away on my website they're not doing anything and I'm not going to go through the details of the raw log file but they're just hitting the website randomly and refreshing the page they're not even sending any commands so my guess it's maybe just a curl command running it's not sending a header or anything identifying it's just kind of unusual when we see these when we see these ones all we don't understand why cause literally they're just refreshing the webpage all the time is essentially what's going on there now this person wasn't causing me too much drama I just happened to open up the log file and see them there but there has been times in a past where we've actually noticed a server under high loads they have x alerted us going this is higher than usual and I said okay what's going on here and we pull up the logs and we found some other IP addresses in there let's talk about how that works and this is the practical security of how things go this is the offending one I should say the most offending one this one was going up to thousands of hits a second same thing no header information just refreshing the page I don't really know what their purpose was but Shodan has very little about them so we look at here they're marked as just not bad but something that Shodan has found they do have a port 443 open let's look at gray noise and see if they have anything on them nothing at all so they've not made any reputation lists that make us like try to block them so once again they pass right through unnoticed through Sericata there's nothing about them on different companies and there's a ton of different companies that do analysis on these but Shodan being one of the real big ones that keeping a log of stuff there's nothing about their reputation to make you think you'd block them but they decided to refresh my web server so hard that it caused a blip in it to make me notice them now there's rate limiting and things like that and one of the most important things about security is that we have all of our servers constantly up to date to protect us for many potential vulnerabilities and apache we don't hesitate at all we make sure our servers are auto updating which comes at the risk of course if you're patching every security update as they come out of having a potential go wrong I know someone's going to comment on that but I would rather be secure than insecure so we make sure all of our patches are loaded all the time and are checked every single day but this is one of those weird things where people will see an attack and they're like but why doesn't these other tools do it and this is where it's really hard to do analysis so you can really try to make some decisions based on rate limiting like how much can this one particular IP pull data from that one port but then it would create a problem for those IPs that are actually pulling data from the port you don't want to block them and because they're only refreshing the page not using the service they're not pulling as much data as someone using the service but they're weirdly refreshing a page so you have to focus security down on the apache and set up the moderate limits to say this one person can't refresh the page that many times but you kind of see the overall practical side of how the security works and it's not really anything that you can easily point your finger at and you can see how quickly something like this kind of spirals out of control if you will where there's a lot of functions a lot of things that you can look into but this is the practical side of security and what we see from not just ours I'm showing you ours because I can show you this we see this for clients where they have a publicly exposed server maybe that's even if it is hosted in the cloud and we kind of sort out why does this one IP attack it and then we put in a block for those IPs and the last thing I'll show you is how you block those people so these are the only IPs over time that have ever caused this weird issue that wasn't blocked by Sierra Cata so there's really not a lot in here and this IP address was the real bad offender this one was these ones were equally we're all doing at the same time but what you do is I create an alias and it's just called mainly blocked IP address and I said blocked IP address due to attacking and so we go ahead and throw them in here and from here we created a rule so first you start with the alias then we're gonna go ahead and create a rule and that rule starts with the action block you wanna make sure that you are blocking these people where do I block them interface when we don't have IPv6 turned on so we have it turned to just the IPv4 you can change that to both if you have both protocol any I don't care what protocol they come in on I can block them for example only on TCP and only in filter it down but I don't just block that IP address I don't there's nothing about them that I think I need to get to them where they need to get to me so blocking them is not a problem single hoster alias change it to there change it to mainly blocked IP address and if you haven't wrote a rule before with an alias you don't have to remember how it's done when you start typing it fills it out for you. Destination I'm not gonna pull down the whole list here but what this is as a destination is all the IP addresses we have a block of IP addresses assigned to our PSNs I don't care what IP address they originally may have been attacking I want them to block anything inbound to my firewall because there's nothing of value coming in from that person nothing I could see anyways and description manual block list simple as that and I go ahead and log this I have plenty of storage on my PSNs box to be able to log a lot so I do have this set to log packets that are handled by this rule because I can still see if they're going ahead and attacking it still because it can log the blocks from that rule so like I said this is the kind of process for the whole thing like how you go from seeing the rules what it looks like for the rules in place and still what the rules miss so you still always have to be vigilant and sometimes go down to your server level to look at some of those things as PSNs or any firewall can only do so much blocking now there are other methods about that you can go about this and for example and when you get to some of the more enterprise level companies you can put a web application firewall as a go-between so everything has to pass through the WAF before it gets to the other side of the server that way there's more analysis going on before it actually addresses your server for us that's just not necessary it just in a matter of fact this is actually hitting a proxy before it passes on to our actual server so we keep an Apache proxy in front of our screen connect slash connect wise control server but this is some of the analysis I wanted to walk you through because I had to block this person the other day there's not many people I've ever had to block it's rare this happens I don't know if it's also a result because of YouTube and people going hey I you talk about security so let's poke at your systems that's gonna happen you should always be prepared for that and if someone wants to try denial of service there's not a lot I can do about some things and this has happened other security researchers at different levels if someone really wants to dial service you they can just fling lots of IPs that are not in any bad reputation list and start just pausing up bandwidth because they're not doing anything if they're interested in refreshing your page but this is kind of that whole thing I wanted to talk about where one all these things that they're nice they're all layers but still these are some of the practical things you have to do after everything passes through those layers which because there's only a few IPs in there you can tell it's not being done too often hopefully this was helpful and you kind of get an idea of either the process my thought flow of how I get on there how I found it and how we eventually led to just blocking those addresses and for those of you wondering yes, you can block alias and things like that that's actually what PF Blocker does watch my video on that and I'll leave a link below to the Siracada video and the PF Blocker video that I did to kind of give you the setup to build your security model around PF Sense and setting this up All right, thanks Thanks for watching if you enjoyed this video go ahead and hit the thumbs up if you want to see more content from my channel go ahead and hit subscribe and the bell icon and hopefully YouTube will send you a notice if you're interested in contracting launch systems for any type of IT services work or consulting work go ahead and head over to laurancesystems.com and fill out our contact and get in touch with us if you would like to help the channel out in other ways you can use our affiliate links below in the description or we have a link directly to our launch systems page where we have a list of different affiliate offers and it's very appreciated if you use any of those for signing up any of the services and many of them offer you discounts if you want to head over to our forums there'll be a link in the description for our forums wherever they may be because we've been looking at different forum platforms but they'll always be relevantly linked right there all right once again thanks leave some feedback and comments below on this video if you loved it if you hated it I try to reply to everyone the people who hate and the people who love them so thank you very much and see you next time