Delta Chat, CFFI, pytest and all the Rust
This is a modal window.
The media could not be loaded, either because the server or network failed or because the format is not supported.
Formal Metadata
| Title |
| |
| Subtitle |
| |
| Title of Series | ||
| Number of Parts | 118 | |
| Author | ||
| License | CC Attribution - NonCommercial - ShareAlike 3.0 Unported: You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal and non-commercial purpose as long as the work is attributed to the author in the manner specified by the author or licensor and the work or content is shared also in adapted form only under the conditions of this | |
| Identifiers | 10.5446/44855 (DOI) | |
| Publisher | ||
| Release Date | ||
| Language |
Content Metadata
| Subject Area | ||
| Genre | ||
| Abstract |
| |
| Keywords |
EuroPython 201916 / 118
2
7
8
15
20
30
33
36
39
40
45
49
51
55
57
58
63
64
66
68
69
71
74
77
78
80
82
96
98
105
107
108
110
113
115
00:00
GoogolOnline chatConfiguration space12 (number)Web 2.0WhiteboardProjective planeContext awarenessSoftwareParameter (computer programming)Constraint (mathematics)TelecommunicationGoogolEmailProjektiver RaumBlock (periodic table)Field (computer science)Cartesian coordinate systemFormal languageCodeMusical ensembleNeuroinformatikSquare numberScripting languageReduction of orderAddress spaceLogic gateMultiplication signLink (knot theory)Centralizer and normalizerBlogChainTerm (mathematics)FlagComplex (psychology)ForestCASE <Informatik>Peer-to-peerFunctional programmingMoment (mathematics)ExplosionQR code
05:08
ClefBlock (periodic table)FacebookHoaxBlock (periodic table)Event horizonMultiplication signWorkstation <Musikinstrument>Real numberFrame problemServer (computing)SoftwareLevel (video gaming)FlagContext awarenessPoint (geometry)TelecommunicationKritischer Punkt <Mathematik>Thread (computing)Condition numberEmailWeightChainBlogCentralizer and normalizerComplex (psychology)GodCryptographyDialectEncryptionPreconditionerNumberRight angleComputer animation
08:28
FacebookBlock (periodic table)Complex (psychology)Keyboard shortcutFacebookGoodness of fit
09:35
Block (periodic table)FacebookComputer networkEmailOnline chatElectronic mailing listMobile WebClient (computing)Identity managementSpeicheradresseAddress spaceKritischer Punkt <Mathematik>Hydraulic motorCentralizer and normalizerTrailEmailTowerInternet service providerServer (computing)Regulator geneGame controllerSoftwareMetadataTerm (mathematics)Key (cryptography)Message passingDifferent (Kate Ryan album)Online chatMultiplication signVolume (thermodynamics)NumberRegular graphPublic-key cryptographyClient (computing)2 (number)StatisticsAddress spaceIdentity managementSystem identificationWeb serviceCommunications protocolWebsiteInterface (computing)Order (biology)Electronic program guideWavePhysical systemPersonal identification numberInteractive televisionLength of stayForcing (mathematics)Neighbourhood (graph theory)Student's t-testMiniDiscSpeicheradresseProcess (computing)Musical ensembleComa BerenicesFlagTelecommunicationEvent horizonParticle systemGoogolOnline helpBitOpen sourceService (economics)Procedural programmingLevel (video gaming)Group actionData managementMatching (graph theory)Logic gateControl systemTraffic reportingVideo GenieComputer animation
16:41
EmailAxiom of choiceInternet service providerServer (computing)Block (periodic table)Information securityOnline chatPerspective (visual)InternetworkingPetri netNetbookAndroid (robot)Server (computing)Orientation (vector space)Information securityMusical ensembleMereologyUsabilityProjective planeUniverse (mathematics)FamilyCategory of beingComputer networkEmailClient (computing)Solvable groupEndliche ModelltheorieCASE <Informatik>Core dumpData miningComputing platformSoftwareAbstractionMetropolitan area networkGame controllerImplementationSelf-organizationTerm (mathematics)Maxima and minimaTelecommunicationWebsiteBitScaling (geometry)Field (computer science)Group actionDefault (computer science)LogicLevel (video gaming)Point (geometry)Perspective (visual)AlgorithmCryptography2 (number)Internet service providerMathematicsSystem callCommunications protocolAxiom of choiceComputer animation
23:42
Information securityOnline chatPerspective (visual)CryptographyEncryptionEmailKey (cryptography)Server (computing)DiagramGroup actionValidity (statistics)Group actionMobile appInterface (computing)User interfaceChainGraph (mathematics)BitEmailCASE <Informatik>Formal verificationTelecommunicationEncryptionTerm (mathematics)TwitterCryptographyOnline chatKey (cryptography)Programming paradigmPrice indexPort scannerLevel (video gaming)Projective planeServer (computing)Interactive televisionContent (media)Complete metric spaceInformation securityWeb pageQR codeLatent heatSoftware developerMusical ensembleWhiteboardWorkstation <Musikinstrument>Data storage deviceSpring (hydrology)Uniform resource locatorDifferent (Kate Ryan album)View (database)Expert systemFacebookState of matterWeb 2.0CodeSoftware frameworkInformationOffice suiteComputer programSystem callBounded variationElectronic mailing listConnected spaceOperator (mathematics)WordMassClient (computing)Complex (psychology)Ocean currentCuboidWeb browserScripting languageRippingElectronic visual displayCategory of beingComputer animation
31:43
PlastikkarteRandom numberEmailLocal GroupLeakInformation securityIndependence (probability theory)DisintegrationSoftware testingGroup actionMagnetic-core memoryLibrary (computing)Keyboard shortcutMobile appRevision controlSelf-organizationUniform resource locatorEvent horizonVideo gameSelectivity (electronic)Tape driveSoftwareView (database)Group actionTerm (mathematics)Web 2.0Online helpProduct (business)Server (computing)NumberMereologyMassMaxima and minimaPoint (geometry)String (computer science)AlgebraInformation securityTrailRow (database)Traffic reportingAddress spaceReal numberRandomizationAreaOperator (mathematics)Revision controlImplementationDisk read-and-write headMobile WebBus (computing)VideoconferencingCovering spaceLibrary (computing)Message passingMobile appFreewareGame theoryCondition numberAndroid (robot)Musical ensembleOpen setStreaming mediaFocus (optics)Vapor pressurePresentation of a groupSound effectUser interfaceLevel (video gaming)CryptographyPosition operatorYouTubeSoftware testingDigital photographyMetadataArithmetic meanCore dumpProjective planeSubsetOnline chatBitKey (cryptography)QR codeEmailCubeOcean currentPerfect groupIdentity managementComputer animation
40:05
Series (mathematics)Android (robot)Core dumpOnline chatMereologyLibrary (computing)WindowAndroid (robot)Software testingGoogolMultiplication signData storage deviceMedical imagingLevel (video gaming)Complete metric spaceXMLProgram flowchart
41:00
Software testingJava appletKeyboard shortcutRAIDMagnetic-core memoryEmailLocal GroupMobile appKeyboard shortcutCore dumpJava applet2 (number)Online chatNP-hardAndroid (robot)BuildingoutputDifferent (Kate Ryan album)Term (mathematics)Software repositoryWindowGoodness of fitSoftwareModal logicCoefficient of determinationContent (media)Basis <Mathematik>Computer animation
42:27
SharewareEmailLocal GroupGoogol12 (number)Configuration spaceOnline chatFormal verificationPay televisionTelecommunicationPublic domainExplosionInformation securityInternationalization and localizationMotif (narrative)Formal languageSoftware testingInclusion mapReading (process)RSA (algorithm)Group actionInformation privacyAutomationError messageSoftwareEvent horizonMagnetic-core memoryInformationInfinityLoginVolumenvisualisierungCrash (computing)Run time (program lifecycle phase)Function (mathematics)System callElectronic visual displayFingerprintMessage passingRoute of administrationConvex hullDean numberAreaMultiplication signDistribution (mathematics)QR codeXMLComputer animation
43:14
Axiom of choiceWebsiteChatterbotEmailFood energyAddress spaceServer (computing)Link (knot theory)Self-organizationComputer animation
44:13
ChatterbotEmailMusical ensembleSoftwareTerm (mathematics)Connected spaceMobile appInterface (computing)ChatterbotForm (programming)Local ringVapor barrierLink (knot theory)EmailTouch typingView (database)Multiplication signWebsiteVideo gameWeb pageXMLProgram flowchartComputer animation
46:18
ChatterbotComputing platformOpen sourceSoftware testingCore dumpKeyboard shortcutOnline chatMatrix (mathematics)Configuration spaceHacker (term)EmailSoftware testingGame theoryKeyboard shortcutContext awarenessInterface (computing)Uniform resource locatorWebsiteCuboidBoss CorporationComplete metric spaceComputing platformRoundness (object)Auto mechanicException handlingOpen sourceBridging (networking)PlanningDifferent (Kate Ryan album)Operator (mathematics)Dependent and independent variablesStorage area networkChatterbotMusical ensembleTelecommunicationSpecial functionsCapillary actionSource codeNeuroinformatikTape driveAuthorizationCasting (performing arts)MereologyGodPoint (geometry)Library (computing)Uniqueness quantificationGUI widgetBitInformation privacyCanonical ensembleChemical equationLevel (video gaming)Functional (mathematics)Goodness of fitCore dumpPhysicalismOnline chatInstallation artBasis <Mathematik>Bus (computing)Term (mathematics)Time zoneMobile appAdditionComputer animation
52:52
Hacker (term)Regular graphOnline chatTerm (mathematics)Mobile appCollaborationismMultiplication signPerturbation theoryINTEGRALTable (information)Projective plane2 (number)Musical ensembleNatural numberExecution unitSuite (music)Address spaceLattice (order)Computer programRemote procedure callRange (statistics)Universe (mathematics)VideoconferencingUltraviolet photoelectron spectroscopyMathematicsPresentation of a groupFood energyMatching (graph theory)Assembly languageMetropolitan area networkEvent horizonCharge carrierMixture modelExclusive orNewsletterSelf-organizationWebsiteRoundness (object)Mobile appBitCodeData structureProxy serverCASE <Informatik>Open setEmailRule of inferenceHacker (term)Flow separationTerm (mathematics)Student's t-testPartial derivativeOnline chat1 (number)UsabilityFree variables and bound variablesMereologyComputer animation
59:23
Assembly languageCollaborationismClient (computing)Core dumpKeyboard shortcutOnline chatClient (computing)Spring (hydrology)Game theorySoftware developerBitComputing platformProjective planeGraphical user interfaceLibrary (computing)Keyboard shortcutNumberChatterbotPlanningWeb browserMultiplication signDivergenceCore dumpStability theoryDirection (geometry)Logic gateSoftwareParticle systemMonster groupWordFormal languageComputer animation
01:01:59
Lecture/ConferenceMeeting/Interview
Transcript: English(auto-generated)
00:04
So, I think, hello. There's supposed to be a session share, but I think I'm just going to do this myself. So, please welcome Holger. So, this is a few stickers that just in case you have an,
00:27
let's say, Google Play or F-Droid on your phone and you want to try it out and you don't want to use your proper account because you don't trust the application, then you can use a temporary account.
00:41
So, you can just take one sticker and then pass it on. But you can, of course, also use your Gmail or other account if you want to. We're going to, there's a QR code on this thing. I'm going to tell, and it tells on the paper what you can do.
01:03
So, I think four years ago, I was at a Europipe in Italy talking about the return of peer-to-peer computing. And I think the year afterwards, Nicholas, or maybe two years, talked about the return of the return of peer-to-peer computing.
01:22
And peer-to-peer computing, or also, let's say, decentralized computing, or however you want it to call it, has been a strong topic, mostly because of everybody knows this, blockchains, Bitcoin, and so on, lots of crazy cryptocurrencies. But at the time, I was also talking about languages,
01:42
functional languages. I've been involved in PyPy, in PyTest and TOX. These are three projects I started and maintained for like 10 years or something like this. And decentralization has been on my mind for a very long time, and also
02:00
in the last couple of years. And even though it's currently very much occupied by blockchain and kind of cryptocurrencies, now Libra and so on, I think that there are, and I know that there's also lots of other projects in the space ongoing still.
02:20
And I think that's still interesting to look at that. The one thing I learned since, in these four years, when I was engulfed and talking with many other people from not only Python but other projects in the decentralization or peer-to-peer computing space,
02:43
is that I now think it, I much less think about problems in terms of technical problems, but I rather think about them, let's say, more of like ecologic problems. So my, and that's one moment.
03:08
That's not only about climate warming. It's also that when you look at software today, there's just an awful lot of software everywhere. Maybe you have heard the term, software is eating the world, for good or bad.
03:24
And so what ecology actually means to me is discovering context explosions. So context explosion means that, maybe you know this, there's this thing that they discovered in biology called ecomemesis, ecomemesis, I think.
03:45
And it is kind of like a failure of reductionism. So you have this big thing, like a big forest. You want to make some statements, you want to make some research about it. And you discover it's too complex, like there's too much going on, you can't do it.
04:02
So you kind of constrain yourself, you reduce yourself to like, let's just look at this particular square kilometer, or this particular, and so on. And then you scale it down and you find, oh, it's still too complex. And you go down to like a square meter, and just look at what's happening there,
04:20
and you find it's still too complex. And you can go on and go on and go on, and it remains too complex to just completely look through it. And in that sense, that's what ecology actually, the kind of thinking that comes from there is realizing all of the complexities. And I think that one thing that everybody knows by now,
04:43
or most people, is the thing about climate warming. And the other thing is like in software worlds, and I'm going to talk about messengers. And when you think about messengers, for example, in Brazil, you could make an argument,
05:00
and some people are making an argument about this, that WhatsApp and the particular way how you communicate in WhatsApp was instrumental in getting Bolsonaro, the now Brazil right-wing president, elected.
05:22
Because in Brazil, most people only got to know WhatsApp one and a half or two years ago. It wasn't there before very much, and then basically 200 million to 300 million people started using WhatsApp within the timeframe of like 12 to 16 months.
05:42
So all of the things that most of us have actually experienced over a longer timeframe, like getting to know email, getting to know messaging, getting to know hoaxes, chain letters, and all of these fun stuff that you get from your family, you know?
06:01
They got this like in no time. So there was tons of fake news spreading, and people were just fresh into these kinds of communications. So they just took it for granted, all kinds of fake stories about political opponents. And it's very hard to research this
06:20
because everything is end-to-end encrypted. So there's no central place where you can see what everybody has been talking about. So you just have like more indirect evidence. Well, and so even messaging kind of like has a complex relationship to political realities.
06:42
It might even be involved in starting a world war. So it's really like a context explosion that a lot of the things that happen in software actually have a lot of repercussions that you can't even predict very much, if you look at that. And that's ecology. So aren't there already enough messengers?
07:01
How many of you have at least three messengers in active use? There's almost everybody, five, five messengers? Anyone? Still some, okay. So what's the point of going for another messenger? Yeah, there is no point, bye.
07:22
No, there is a point, otherwise I wouldn't be here. And I think it's because centralization actually is in many ways, not just in this way. It's becoming critical. It's reaching critical state. This is a picture of what happened and it was kind of, I didn't know about this before,
07:40
but there's a lot of things going on in Indonesia right now. It's rarely in the news, maybe in the UK news, but certainly not in Germany or other places. And end of May, there was a lot of protests and as happened in many regions of the world, they just blocked some services. WhatsApp is easy to block, Signal is kind of easy to block and so on.
08:02
So they blocked these and that's where we got to know, people started using data jet there. So we got basically quite a number of users in this kind of event went there because it worked. Like on some level, you can talk about crypto and lots of other things,
08:21
but for software to basically work is kind of like a precondition to use it. So centralization is becoming critical, I think not only because of like political interference and because of the realization of many governments who now know how to deal with IT stuff, how to block things, how to regulate it
08:42
and so on, but also because of the industry's tech complexity. Facebook down, WhatsApp down, Google down and so on. This all happened in the last two, three months. And it's like, you could say it's increasing and some people were discussing this
09:02
for a number of years. It's because also of the inherent technical complexity and running these infrastructures. And it does give you some, you know, it does give like reasons for thought that even these very experienced with very good people
09:22
with a lot of resources, companies, don't manage to keep the stuff online. So that might be, together with the political interferences that are happening, leads to this kind of notion, centralization is becoming and reaching critical state.
09:43
So, what's this about? Chat over email is an approach that basically says, well, why don't we actually do the same thing, the same UI, the same UX that you get with WhatsApp or Telegram, but just use the email system? There is, of course, a lot of backlash
10:03
when you talk about email because it has been declared dead already 15 times or so last week. And like over the last two decades, like starting around 2000, there was always this notion of, well, email is dead, especially with something like WhatsApp and so on.
10:22
But for some reason, it managed to stay, you know? And you want to have some statistics with some references, then you can go to emailisnotdead.com and if you look at the volumes, it's around three or four times the volumes that WhatsApp does, for example.
10:43
Or even more, like three or four times at least. In terms of, sorry? No, it's the legitimate email. I guess it's because all of the companies and governments being very busy emailing each other and inside and lots of CCs and so on. Yes, you can make all kinds of fun about why,
11:02
you know, this is not like nobody reads these emails and so on and so on. But you can also note that mobile phones and many other, many web services are actually rooted in email. Google is still very much rooted in email, in Gmail. It's not by coincidence that they have invested so much
11:20
in this email service. It is like a center of identification. Well, in any case, if you do chat over email, if you basically have a chat interface but use email service, it means that you can interact with the email system. You will know, and that's the reason why you're using three or four or five messengers,
11:41
they don't talk with each other. Each of them is an island and a silo. And you need to convince your counterparts to also use a particular thing. So here you could say, well, it's just another messenger but what you can do from day one in Delta Chat is you can chat with anyone
12:02
who just has a regular email account. So they will just get a normal mail. If they reply, then this will appear in your chat window, the reply. So centralized messaging has this thing that we have like a central entity
12:21
that manages all the communication. And everybody basically connects to this entity in order to find out about others and in order to relay messages. And also in the case of encryption, both in WhatsApp and Signal, also to get the keys because the WhatsApp servers and the Signal servers
12:40
are also key servers. They provide the keys so that you can actually encrypt to the other sites. And how does this happen? Well, that happens because these centralized providers, they map your phone number to a certain public key.
13:03
That's the encryption key. That's the key that is used if somebody wants to encrypt a message to you. Public key encryption. But you need to find out about this because you just know maybe the phone number. So you need to find out what is the other site's key and that's what you do by uploading your address book.
13:21
You upload your address book to WhatsApp or Signal so that they can tell you who has which keys so that you can actually send a message to them. And nowadays, mobile numbers are very much tied to passports. So if you are for some reason illegal
13:41
or a refugee or anything, then this is already problematic. You cannot easily participate because you don't easily get a mobile number. And that's maybe not, well, it's a problem depending on the region you are in. And of course, depending on where you come from. It certainly produces a lot of control
14:02
at this central site and also in terms of metadata because everything is tied between phone numbers and identities. Decentralized messaging in the sense of data chat is you can understand, data chat is basically an email client.
14:21
And that means it just talks with your email server and nothing else. And the email servers, because we have this 30-year evolved standards, they know how to talk with each other. There's message formats. There's protocols between them and the devices
14:41
between the providers themselves and so on. So this is kind of sorted out. There's existing open software that is used. There's all kinds of software toolings around this. And basically, data chat just ties into that. And before you wonder about that, and you can verify it basically here later,
15:02
this is fast enough. So it's not really a problem. Usually it takes like two seconds, four seconds, five seconds from one device to the next. And even WhatsApp can take longer sometimes. So it's not, that's not really a problem. Also read receipts and so on. But we can look at that later.
15:21
So we have centralized messaging, decentralized messaging. The one main difference here is that you don't need to, with data chat, you don't need to upload anything anywhere. You don't need to upload your address book. You can immediately start messaging by knowing the other side's email address. So if you have email addresses,
15:41
then you can just start chat with them. And obviously for email addresses, oh, by the way, if you have any kind of question and want to raise something, just do it. I will repeat the question and then try to say something. Yes, yes, yeah.
16:04
It creates a key for you, but it's all invisible to get to this. And that's very important. Mobile phone numbers are tied to cell towers, are tied, are very closely tied to the government around you because the cell tower is physical.
16:20
You only get access to a cell tower basically in some kind of government tracking and regulation way. Whereas an email address, you can get from any provider wherever. Like if you are in the Ukraine and you want to have an email address from a Swiss company like ProtonMail or so, no problem. And then your identity is like run
16:41
by this more or less Swiss American company. And you are not directly affected by what the government regulates in let's say Eastern Europe in this case. Okay, so that is clearly an advantage. And to break it down and to tie it back
17:01
to the picture of Indonesia, which is also a picture of many other countries, what this chat over email approach provides is resilience. You cannot, I mean, you can choose your own email provider, can be any of thousands of providers
17:21
in your region or somewhere else. And it's also kind of hard to block it. Unlike WhatsApp, email is still in most countries used by the government itself. And it's used by business. So trying to block that on like a whole scale, let's say we block port 25,
17:41
which is like the SMTP protocol for the whole country, then nothing works anymore. So you cannot just do it like on this broad scale. At least you get a lot of damage by doing that. And also it means that we don't have to run a platform
18:01
that needs to be online. We don't need to run servers that get attacked, DDoSed and so on and so on. And well, you can also run your own email server if you like, if you really want to have control over that and that's what many organizations and universities and so on do.
18:21
They run their own email infrastructure and it's not actually that hard anymore to do that. I mean, there are certain things that you need to look at but I think this resilience property is the main point
18:42
of going for the chat over email thing. But it's a big point because it means that it's hard to block and you have a lot of choice and a big ecosystem to tap into. Okay, so what about security?
19:01
When you talk to news sites and you give them a call and you say, hello, I'd like to tell you about a new messenger project, there's two things, A is oh no, as an answer and B is I will refer you to our security guys
19:25
because messaging is typically tied now to security because the only interesting property is security. And also when you go to,
19:40
when you talk with people who are like in the IT field for a longer time, that's also like one of the primary questions like how secure is it? So I'd like to talk a little bit about this. To me, it's a matter of perspectives. One of the core perspectives that we evolved in the data chat project which is like
20:01
two, two and a half years old, there is some prior research that exists but the main thing is that we see security as we measure it, basically we look at it in terms of what are the eventual outcomes for people?
20:23
Can they get in prison for that? Because their data, their communication has been observed and they have been related to other people who are in trouble and so on and so on. So what is in the end the outcome for actual people involved?
20:42
That is actually a bit of a change. It was a suggestion by Eleonora Saita from 2016 who said that engineers are too much focusing on the mathematical kind of conceptual abstract security. You know, what actually counts is what comes out at the end.
21:01
Not if your algorithm is super clever but it's very bad implemented and the usability is so bad that everybody messes it up, then you know, it doesn't matter that your original crypto algorithm is great. Also, hmm? Yeah, well, no, no, I don't want to go into specifics.
21:22
There's like, I think it's really a mindset problem that reminding ourselves that it's actually about what happens to people in the end and not about some abstract concept. And the second thing is, for example, research shows that people in the Ukraine, for example,
21:42
they trust Telegram. Now why? Telegram is unencrypted by default. Like you can have a secret one-on-one chat, not a group chat, a one-on-one encrypted chat but that's it. Everything else is clear on the platform and so on. So why is that okay for many people,
22:01
for hundreds of millions of people? Because of UX. The user experience of Telegram is so good and people like it so much that they use it and they regard it as secure in the Ukraine because of the Pavlov brothers because they are clearly an enemy of Putin, right?
22:26
Because they are kind of like prosecuted by Putin ostensibly. So everything is fine. If they are basically, you know, it's like a strange logic. It's not like coming from the engineering side. It's what is called by Max Weber
22:41
like the heroic kind of legitimacy that means that you have some heroes you identify with and whatever they suggest or do is okay. There's a few examples currently on the world stage. For this, but it happens. And so one of the reasons is UX.
23:01
It's a very nice user experience that you have in Telegram. And the other is that's perceived security through the people running it being on your site in some way. So DataChat has as an orientation
23:20
when it comes to usability questions and UX questions, Telegram. That's kind of like the gold standard in usability. Of course also WhatsApp, but Telegram was basically the main one. So what we did in terms of finding out about the security of people in various countries
23:44
is a lot of research. I work with Xenia Amushina. She's from Paris, originally from Russia for a number of like two or three years now, three years now. And she has done a lot of research in various countries. And also during the DataChat project
24:01
in the last two years, we actually talk, do interviews with people in the ground who go to various dangerous places and are in need of having communication tools and asking them like, what is important to you? Because that's quite a different perspective than if you go to an IT conference
24:22
and ask an engineer, what is important to you? Because then it's like the brilliance of a crypto algorithm, or the brilliance of some implementation, but not actually something that is tied to the messy situation on the ground. So that's what I would like to start with. Like security is really something,
24:43
it's not as much cryptographic as you think. So let's talk about cryptography. DataChat also kind of evolved in conjunction with another project I co-started two and a half years ago, which is called Autocrypt.
25:00
It has this beautiful bicycle lock. It's like also tying back to ecology as a logo. So it's a very UX-driven specification for achieving end-to-end encryption in email. It's opportunistic, so it actually drops back to clear text
25:22
because the primary goal is that people can read their messages. Everybody who's tried, who's tried PGP actually here? Oh wow, okay. So you will have this situation, I guess, where you got an email that you couldn't read and you sent an email that the other side couldn't read,
25:42
oh, and so on and so on. Not to talk about the key server problems and so on, but well, one of the principle things in Autocrypt is that we said we don't want to have any interaction with the user about keys. Like the keys, the term key, cryptographic key,
26:02
does not appear in the user interface. We don't want to have it there. As soon as you start talking about keys, you are in trouble, right? Because I mean, we might be able to talk about it, but in general, you can't do it. And I think even if we talk about it, we easily get confused. And we have the wrong keys and whatnot.
26:22
So it's something basically, when you go for like more of a mass appeal, then I think you can't avoid this kind of paradigm of saying, never talk about, you might talk about encryption maybe, but not about keys. And it also means that DataChat, unlike all other messengers,
26:41
is compatible with other email apps. Use K9 if you use Enigmail, if you use Balsa on Linux, and there's a few others upcoming this year probably, then it will encrypt end-to-end between your app and the other app.
27:00
Even those are not the same apps. So that's what's made possible by the Autocrypt standard. And I think one validation of that was last year when somebody said, oh, I didn't know that you can use PGP without first listening to an hour of explanations.
27:22
Crypto parties. However, I said that Autocrypt happily drops back to clear text if it has the impression that the other side can't read it. Maybe just one thing why I'm saying opportunistic, if we mail with each other,
27:41
and you have two devices, one device is let's say K9 mail, and another device is your webmail interface to Gmail. Then you will sometimes use this and sometimes the other. So seen from my perspective, I'm sometimes getting an encrypted mail from you and sometimes a clear text mail. Because in your Gmail interface, at least for now,
28:02
you don't have this end-to-end encryption. So then Autocrypt says, well, if in doubt, don't encrypt. Because the primary thing that people want to do is they want to communicate. So don't get in their way of saying, no, no, you should change everything before you can communicate.
28:23
Do you let the users know that this is being sent in clear text because you're falling back? Well, it depends on the user interface of the particular app. It's, yeah. I mean, let's, it's a complex, we have discussed this many hours, it's a complex topic.
28:42
In the case of DeltaChat, you will notice that it happens, but it's not getting in your face completely. So this is opportunistic, and of course, there's a lot of contention about this. The first page of the spec is devoted to this topic, and also the reasoning. So if you want to understand the exact reasoning for this, then read the first page
29:01
of the Autocrypt level one spec. It's just the 12-page spec. It's not very large. It doesn't have key servers, so keys are transmitted in email messages in the header. But I'm not going to talk about Autocrypt now in detail. What I do want to talk a bit about is that we have something called verified end-to-end encrypted chats.
29:21
And that is, these are chat groups. You can see they have this little blue check mark you might know from Twitter or something like this. We use this as a visual indication that this is a verified chat. And the verified chat has two properties. It's always end-to-end encrypted. It doesn't fall back to opportunistic,
29:41
and it's safe against active attacks. And that happens because you only can join an encrypted, verified encrypted group through a QR code scan. So I show you something, and then you can join the group through this scan,
30:01
and you can add new members through another scan. So if you want to be 10 people in one group, you need to have nine joins. Like I enjoin the first person, and I enjoin another person, and these persons join more. But all in all, for 10 people to exist in a verified group, you need nine verifications.
30:23
And that's 81 verifications less than what you would need in Signal or WhatsApp. Because they, actually also, or three more, they also offer a verification, but you need to do it with every group member.
30:40
So for 10 people, it means that everybody needs to do nine verifications, basically, more or less. Maybe it's a bit less, but it's like a lot more than this kind of, the delta chat way is basically just having a fully connected graph. Like I start the group, and then everybody who's going to be in the group
31:01
will be connected to me through a chain of verifications, a blockchain of verifications. It is actually quite similar. So this is, this has evolved in an EU research project, and there's a paper about this, how this is done.
31:22
But here, I just wanted to say that it exists. So if you're very afraid about the opportunistic side of things, then you can always go for verified end-to-end encrypted with your partner or other groupings. Another security issue is what we identified
31:41
together with activists in Eastern Europe is location streaming, because if you have people going around in, let's say, Bela, Russia, in White Russia, and they vanish, and that is kind of a regular occurrence
32:01
that happens during demonstrations or other events, then one of the questions the organizers of events have is where are these people? They can't find them anymore. So one of the things is that location streaming allows you to say, I want to stream, like only on my side, I want to stream
32:21
my location to this chat. And this might be just somebody who's somewhere else who's like in a safe situation, we call this base camp, and they see actually where everybody moves. Also the movements like in the past. So you can see on the desktop version, there's like a slider, you can see what happened
32:41
in the last couple of hours. So location streaming, once you enable it, basically tracks your location and sends it end-to-end encrypted to your chat partners, so that if you do vanish at some point, at least there's a last position where you have been, and all of the photos and audio messages and videos
33:00
that you do will also have location tags. So that kind of like gives some tracking and also after some kind of action, allows to map everything. This is a security feature in a particular way. It's not about ECC keys or Perfect Forward Secrecy or anything like this, but this affects people for real.
33:22
Like, you know, you can save people for that. What we did do in end of April also in Kiev in Ukraine was we kind of introduced this location streaming by playing it, and you see this here, this is the quarter of Kiev called Pudil, where we played the game.
33:42
And the game was played with these cards. It's probably not well readable. It reads something like politician, whistleblower, journalist, and so on, and you draw a card. There's two teams, cubes and spheres, and they basically have two coordinators. Two base camps, and they fight with each other
34:02
or try to do things with each other, but they also have to uncover lots of hidden places in the city. So you can also use location streaming for other things. In this case, we were using it for some kind of safe, real life testing. Another security feature that is upcoming,
34:20
it's not implemented yet, is what we call burner accounts. You might know burner messages from Signal. Burner accounts are really what they sound like. If you scan a QR code, you get a temporary account that is completely removed after one week. If you are a group of 10 people, or if you want to be in a temporary group like this,
34:41
I would show the QR code. You would all get a temporary account. After one week, the server deletes all of these accounts. We have a verified group with each other, and we have kind of randomized, and that's the important thing, we have randomized accounts. So maybe we choose nicknames on how we can recognize each other. I mean, this is a bit of a large group, I guess.
35:01
But it means that when my phone gets taken, then my contacts, my metadata that gets revealed by my phone being seized will not reveal very much. Just a number of random accounts compare this with phone numbers, mobile numbers. Getting one phone from somebody
35:22
who's involved in an action, and you get all of the contacts in mobile numbers, which at least in the EU means identities, real-life identities, for free. So that's something, in burner accounts, you don't get this. You just get a number of accounts that have no long-time identity track record.
35:43
That is something that has been designed, or is designed with activists on the ground. So it's not something that we just, you know, think might be useful or so. We actually have discussions with the people affected and design the things from there, the security and so on.
36:00
What we also have in terms of a bit more kind of security engineering thing is our PGP, which is full Rust implementation of PGP, done by Friedel Zieglmaier. And it supports the Autocrypt subset of OpenPGP, because Autocrypt is not, it uses OpenPGP, but in a very minimal way.
36:21
It says very specifically what you use out of PGP. For example, no key servers, it's not needed. We don't need it at all. And our PGP implements this subset in full Rust, and next week I think we will get the security report, so that means that it also has a independent review there.
36:45
What we want to do quite soon is we want to have, like when I told about this game in Kiev, that was kind of real life, but not really, because it wasn't actually, like Kiev is not very dangerous in some sense, at least most parts of it.
37:01
Whereas the people we are talking with there are operating in areas that are dangerous, and we want to actually prepare and then go for real life testings of things during actual actions there. And our general focus, other than, for example, what Signal or other messengers provide is that we don't regard everybody
37:22
in a chat group as equal, but we actually see that there's some asymmetry. There's usually organizers who are like in a safe place, and they are helping others to actually do something. So if you have, for example, something like ephemeral messages, you really just want to have them one-sided.
37:42
You want to have them from the people on the ground, but the people at the base camp who actually look at everything, they want to see all the messages and actually also have a history of these messages and so on. Okay, so that concludes, I don't talk about this. This concludes the security part.
38:04
I hope I could give you some insights on the way on how we think about security. It doesn't mean that we don't care about crypto. In fact, we have RPGP and some other things, but it means that we focus on the actual outcomes for people.
38:22
So now, software. That's probably also why you are here. There is a core library. It's called LetterChat Core, sometimes DCC. It's MPL licensed, so can also be used in commercial projects and is actually used in commercial products, for example, by Open Exchange or mainly by Open Exchange currently.
38:42
And it is the library that is used by all the LetterChat user interfaces. It's a very UX kind of UI oriented library. It doesn't give you access to MIME and IMAP and SMTP and AutoCrypt and the persistence layer and so on.
39:01
This is all kind of hidden. What you get is at this contact, create a chat for this contact. Like on this level is the API. And give me all the members of this chat. Send a message to this chat. Send an audio message to this chat and stuff like this,
39:21
but you don't get to specify like a MIME message, which is like the email format. This is all handled by the core library. So in that sense, it's kind of easy to write a UI because you don't have to handle all of these details yourself. And we are currently transitioning this core library to also be a full Rust version.
39:44
Currently it's C, like the Android version that you might be using is C, but the upcoming and partly used already version is done in Rust. So we have Delta Android, that's quite stable. Since last week, we did like the,
40:01
declared this to be stable. This is still using the C library because we want it to be stable. The Rust part is still a bit, it is kind of stable, but it has some glitches here and there. So we don't feel comfortable. Delta chat Android is used by, hard to say, let's say 30,000 people or something like this.
40:22
It's hard to count because it has been only on F Droid for two years. And since February or March this year, it's also on Google Play. And there it has something like 20, 30,000 installs or so, but also a lot of uninstalls. So you can't really count this as like active users.
40:43
But this is quite stable, very feature complete, many people use it. Desktop is on Linux and Mac quite stable, I would say. Also still using the C library there on Windows. We actually already use the Rust core library
41:04
because it's much easier to build. The building the C thing on Windows has been too hard basically. And then in Rust it was relatively straightforward. Rust is very good in terms of cross-compiling to lots of different targets.
41:20
Then iOS is evolving strongly currently. There's just another quite good test flight release from yesterday. And we think it's going to go to App Store, let's say in the next two, three months. And the core bindings. The most complete bindings I think are in Python.
41:41
You can find the docs on PyData chat. There's also, the node bindings are also, they're used for the desktop because the desktop, and we get to this later, is using Electron. And of course the Swift and Java bindings, they are contained in the iOS and Android repos. They are not packaged separately,
42:01
although this could happen. So, who has managed to, I don't know if you were just listening, or also tried to configure your phone? Somebody? Okay, did you try to join already, or? Did anything work? Do I have network?
42:24
Ah, wait a second. I might have to log out here. Okay, that's a bit hard for me to do. I need to restart my desktop. Yes, takes a while to refresh.
42:48
Oh, a lot of people joined. Ah, hi. Okay, I can't type very much. But this is the papers that got distributed.
43:02
We are 10 members now, by scanning this QR code. But the time is running out a bit, so I'm going to continue here. So, DeltaBots, that was also something that I'm, yeah, that I'm actually starting, like, as we, like, in the last couple of weeks,
43:20
especially, and I really want to have the bot, developing chatbots that you can use for DeltaChat. It's like a thing of the next half year that we want to, like, give a lot of energy to. The nice thing about the DeltaChat bots is that unlike in WhatsApp and in Telegram,
43:41
you can just, you only need an email address. You only need SMTP and IMAP credentials, and then you run it wherever. You don't need to register it anywhere, at the Telegram server, or the WhatsApp business API. That is quite difficult to use. You can run it wherever. Also, inside your organization, you can make it such that nobody can reach it,
44:01
other than the people in your organization, and so on, and so on. So that's, like, a very nice and easy deployment story. There is one huge, I think, at least, by now, 15 to 20,000 users in Cuba, who have a very special situation,
44:21
in that everything in Cuba that stays on the island, in terms of network traffic, is relatively affordable. Everything that leaves the island is, like, very expensive, and you may imagine why. I mean, it's, like, decades of sanctions from the US, and so on, it's directly next to the US. So, they don't have very good connectivity
44:43
outside this island, so there's an economic barrier. You can get the connectivity, but it's expensive. And so, what people are using is the local Cuban email server, nauta.cu. That's relatively cheap. You can get it on your mobile,
45:00
and that's why DeltaChat is getting quite some take-up, such that they jumped in early, used the Python bindings, one of the people there, and wrote simplebot. What you see here is, on the left-hand side, a chat, and you will find that it's kind of like you send a command, and you get back
45:21
some form of an attachment, getdelta3.html. When you click on that, I can't show this here, when you click on that, then there is an app that you have to install separately called zhv, zipped HTML view, and when you click on that,
45:40
then it opens, and what you see is the simplebot interface. So, this is the chatbot interface in HTML. You see it here, and you can click on it, and when you actually do something, like get me help, or, you know, find some friends, whatever, then it sends you back to the chat, because it's a mailto link.
46:02
So, this is actually, you can use it to browse webpages. So, you say, give me this website, it goes to the bot, the bot sanitizes this, strips this down, so it's like not so much size, gives you the HTML with all of the links
46:20
substituted by mailto links, so when you click on them, you land back in DeltaChat, and you just say send. So, you have a complete history of like the site that you visited. It's very low traffic, and it's like an interesting hack, you could say, on how to write bots.
46:40
Of course, we can, I mean, we could make this almost automatic in the future, that you basically allow this bot to use DeltaChat basically in the background, so you can do this kind of bot communication differently, but that's maybe something to discuss tomorrow. So, the Python bindings on Linux are very easy to install,
47:02
they are by now binary for Linux, so you can just say pip install DeltaChat, you don't need to compile anything and so on, and you can just directly start. On other platforms, you still require first having your Rust core compile, and then with pip install, basically from the source code,
47:20
you need to install the bindings. The interfacing between the Rust library and the Python bindings is done through CFFI. That means it should also, I think it does also, I'm not sure if you tested this actually, but should also work in PyPy. This kind of interfacing, it's a relatively simple usage,
47:45
so that's certainly, if you are around also tomorrow, then you can just test it, if it really works. And of course, the tests are written in pytest, and they're used as functional tests also against the core, so there's a lot of, in the bindings, there's a lot of functional testing
48:02
of this high-level API, and more that we need to do in this area, but it's a good basis. There's also a simpler-than-the-simple bot example that is in the DeltaBot repository, that is also the basis for the simple bot,
48:22
but obviously the simple bot has done some more things. So that makes basic usage of the high-level API, and you can directly deploy it. Like if you have SMTP and IMAP credentials, or you can easily create this, it's a matter of really two minutes, and you are connected and can do something.
48:43
We did get, I think a couple of weeks ago, we got some funding specifically for completing the move to Rust in terms of the chatbots, and also implementing all kinds of chatbot examples, in addition to what we have, like RSS, activity pub, matrix, IRC bridges, and so on.
49:03
There's some good planning and ideas around this, but the idea is to do this in Python, and we're also going to sprint about this tomorrow, and if anybody here, or if you know of anybody who's interested, possibly interested in this,
49:20
then there's also some money to be gotten for getting involved here, and helping to drive this effort. There's going to be a lot of things happening there. One of the things that some of us definitely want to go is use and produce gaming bots. So there's some talk about, for example,
49:41
implementing the game of werewolf. Maybe you know werewolf, so everybody joins, and the bot says hello, and then the game starts, and the bot basically randomizes the roles, opens the chats with the various people. You can imagine roughly how this could go,
50:01
and it's designed and discussed with a 14-year-old girl who's very eager to get this done, because they are playing werewolf currently with an app, like in their school, with an app called Telenim.
50:21
Not sure if you've heard of this, and it's crazy. It's like an, it's a crazy app. It's, when you, you get messages, but you don't know from whom, right? How can this go wrong? I don't know. So they're using it to play werewolf with it,
50:43
but it's like also privacy-wise and so on. It's a disaster, but okay. A last note to close up on when, like how do we actually do this? WhatsApp exists since 10 years, has lots of investment and resources and so on.
51:02
Telegram is also long-going already, so how can we enter this scene? Like how do we get funded? How do we actually do this? You got some glimpses of like when I mentioned Kiev and this and that, so I'm going to try to, this is the coffee bus in Kiev.
51:21
It's a very strange thing to have. There's like four coffee buses in Kiev. It's like a double thing. It doesn't come from the UK. I don't know where it comes from, and they serve coffee, and this particular one, I think has a lot of Hollywood pictures inside, and it's very strange. Coffee is kind of okay, and so you hang out there
51:42
and also next to the park, and you are in Kiev, 200 kilometers from Chernobyl, 300 kilometers from a war zone and so on, so it's kind of a different feeling than what you would have, let's say, sitting in a Starbucks in San Francisco. It's like a very, so location matters,
52:01
like how and where you actually do things, and what is your context in which you're operating makes a lot of difference, I think, and we are basically saying, okay, we want to have really different contexts and locations, especially of people who are in risk. We have a lot of physical gatherings.
52:23
When I co-started PyPy, I think 17 years ago or so, also with Amin over there, what we established also was having sprints,
52:40
like every, I don't know, six, eight weeks or so at some point, we did sprints, and that's also what we do here, but in a slightly different way, in that we have also partial gatherings, and we never really do, we don't sit everybody together except for the party. Like, there's a lot of partial gatherings even within this bigger framing,
53:01
and that's also what's happening, that people meet, be it often in several parts of Germany like just three or four people out of the maybe 15 who are actively involved, because that's already helping. It's not like everybody needs to meet all the time with everybody, but the physical gatherings in like complementing the remote work that we usually do
53:29
are really important. Backgrounds, you see here on the left, Xenia, I mentioned already I'm working with her for a very long time already. She comes from Russia originally,
53:42
and she has done a lot of the research and a lot of the usability things that we are doing also relate to her work, and you can see the glimpse of the guy with the coffee mug here at the park in Kiev on the right-hand side, that is Bjarne,
54:02
who actually started the whole data chat project two and a half years ago, and on the right-hand side, you see a placeholder for all of the other people you can't see here. What we usually do is we don't do project meetings, so we don't say, this is a data chat sprint, come, or something like this. Every event has like a different name,
54:21
and we also invite various people around the project, so who are not directly contributing, but who are kind of like, for example, Heart of Code. It's a feminist hacker space in Berlin, and we have some relations, and they were interested, so they joined for various reasons. I'm not going to go into that now,
54:43
and so we have befriended projects, also other decentralization projects who are just around, so we do some things. We talk with each other. We have some food, whatever, but otherwise, they can work on whatever they want. They don't need to integrate into our data chat structure or something like this, so that's a little bit of an open gathering culture,
55:03
I think, that everybody came to appreciate very much. Money-wise, just to conclude on this, we got some money from the EU. We got some money from the Open Tech Fund that some of you might know, and we are also going to get some new Open Tech Fund money.
55:22
It's just been one week ago that they accepted that. I mentioned the NLNet one, and we have a lot of people actually who are really, really, really good at what they do, and they just help us, and they get to steer the project also. It's not that they just help a little bit or so, but they actually get a say in how things are done,
55:42
and I think that's quite important. If you have a mixture of people who get paid and people who just participate, there's always the risk that the people who get the money actually also get to make all of the important decisions, and that's something, let's say, that I learned earlier on,
56:02
that it's very good if it's possible in the project culture to give the contributors who don't get money and who are contributing lots of things also a say in how things are done. Longer-term monies, that's a bit of a more involved discussions.
56:21
We also were like, if DataChat grows bigger than it is now, then we might also just try to go for more donations. There's also upcoming organizations who want to use DataChat, a university in Germany, for example, who wants to deploy it everywhere, not only in their stuff, but also with Microsoft Exchange.
56:42
Like, it works. It's standard-based. It uses IMAP and SMTP. It's fine, it works. You don't need to change your email infrastructure for DataChat and just use it as is, usually. And we're also thinking about special per-pay apps
57:00
to go for. So, no VC money. I think venture capital money and this kind of endeavor is a dangerous thing, and we don't want to go for that. Okay, maybe as a, and I think I stop it at that, I think in 2005,
57:21
I gave at the CCC in Berlin a talk with Beatrice Doering, who was also involved in the PyPy project, about agile programming, which was a big thing, Scrum and so on, in 2005. And we talked, you go back to the talk, we talked about lessons learned and how it doesn't really fit the bill.
57:43
And then, I don't know, two months ago or so, I was 2019, some student came to me, oh, did you hear this new agile thing? And I was like, it's very strange. I mean, I don't know. Anyway, I think it's time to move on.
58:02
One thing that I kind of keep advertising or talking about is that I think it's good to not have too many round tables, to not base everything on assembly, where everybody discusses and decides everything. It seems like a very natural thing. I don't have the time now to go very much into this,
58:20
but I think it's also, and I've done my fair share of assemblies, let's say probably more than most of you. I've done a couple of hundred assemblies and plenaries in all kinds of collective projects. And I think it's overestimated and also dangerous. And because it's exclusive,
58:40
like you can make whatever kind of rules in terms of talking with each other, that everybody gets a fair share and talking and so on. And you want to be very inclusive and so, but in the end, you're going to be on a table and some people will talk, others will not talk and others will not even be there and participate in the talk for various reasons.
59:02
That's always the case. In any given project that has a regular practice of doing assemblies, usually 20 to 30% actually show up to do this kind of discussion. So it's problematic. Also in terms of deadlines and schedules, we try to not do it.
59:20
Like we have some rough ones where we want to be, but we don't keep a timetable, like exact times when anything should be ready. That worked despite all the languages, despite all the platforms we are involved in and not like that much money, it worked quite well for us.
59:41
And we try to take up, if somebody comes to the sprint or to the gathering and wants to do something particular and tries it out and it seems to work, it might actually shift the project towards that direction. It just happened in April because before April, we didn't have a full
01:00:00
Rust core library that only happened in April, because Friedl discovered this wonderful tool called C to Rust. So if you have plain C, you can just translate it to Rust. And he said, let's try it. And it was not in our plan. We wanted to get stable releases out in May, because that's one of the promises
01:00:23
we made to the funder. But if somebody has the expertise and really wants to do something, and it makes a sense on a certain level, then we try to go for it, even though that was counter to some other things we wanted to do. So that's what I call situational developments.
01:00:43
Yes. So I think I'd like to leave it at that and maybe just mention tomorrow. So tomorrow, the spring topics, there's a number of things. You can also bring something and diverge. On the one hand, dealing and playing a bit with the data chat bindings, write some chatbots,
01:01:07
maybe the beginning of a gaming bot or so. And there's also an idea, together with Florian here, from Qt browser fame, to actually see about kick-starting a Qt-based desktop client.
01:01:21
Because everybody knows Electron is horrible, right? You know Electron, the JavaScript-based Chrome big whatever? Well, it has also advantages to have this kind of framework, but I think a Qt-based
01:01:46
one based on the nice Python bindings we have that now eventually work would be an interesting project. Okay. Thanks, everybody.