 It is a my honor again to introduce a great always the same guy It's always the same guy the same same topics give it up for links and privacy scalable in the GNU net And something like that. It's yeah skill ability so Scalable and privacy respectful distributed systems Which I think is actually our only chance that we have to escape the cloud computing principle So why do I believe that? Let's have a look so Federated systems of decentralized systems usually try to connect each other all of them all the time like full so-called full mesh round robin So I had a chat with a matrix developer a few weeks ago, and he said matrix currently connects each server directly and sends all makes all the exchanges directly and The internet has become very broad and bandwidth. It has become very fast Computers have been have become very powerful So for even the matrix systems as big as it is now It's still not running into performance problems. So that's good news But it's just kind of postponing the problem Because the architecture as such Typically doesn't scale well, and if you try to have Billions of people on it like with Twitter or Facebook then it's unlikely to work out this way So as soon as you have large numbers then you would start having less and less servers So people would always try to find the the server that works reliably that is Working all the time while other servers are crashing and so more and more people would start Centralizing the servers and find themselves on a Google server or on a Facebook server and then you kind of at Essentially lost the game again like it happened for a mail. We all ended up on Gmail not all of us I don't have a Gmail account, but a lot of us a lot of us ended up on Facebook, so Well in the case of Jabber there was a period when everyone was ending up on on Google now everyone's ending on CCC Unless they can no longer get an account there But the pattern is always the same each time we start a federated system. It actually ends up being being controlled by a big player later, so the old legend of Federation which is like decades old it actually never really worked out and Still for the users. It's a problem. Which server should I actually choose who can I trust and Even if I have my my server in a safe place and at home at home How would others etc etc or if I Rent a server on a virtual machine. It's really cheap, but it can be Observed and monitored so it is not a safe choice against surveillance Especially nowadays when the empty stack can be attacked from any hacked Cisco router, so There's very hard to set up a server that cannot be accessed by the NSA these days and Why is it working so well for the other ones? Well, they have this cloud and we just talked to the cloud and the cloud is is always Very performant. So how does cloud computing actually do it? Well, in fact cloud computing does a kind of distribution trees as well You can call it database replication. Well, that that was like 10 years ago when people would actually use databases and replicate databases and have caching all of that nowadays Cloud computing actually uses push technology and pushes all the database changes to all the nodes that need to know so It's actually using a multicast strategy, but it's a simplified strategy because It it all the nodes are owned by the same company There's no complexity about who's who's who's allowed to get which kind of data There's no encryption. You can simplify a lot and Whereas in a distributed system, we actually need to do the kind of same kind of architecture and just Add the little bit of extra to be on the safe side for privacy so The essence to solve the scalability challenge is to build multicast trees It's actually a very old knowledge because we used to have it with IRC. We used to have it with NNTP and we have it in tour tools like bit torrent kind of similar and Instead all the newer federated systems. They are not doing this anymore like Jabber ignored the problem Matrix isn't dealing with it because it's not a problem yet Psych used to do multicast But psych is this protocol up here, but We later realized that the federated architecture would still keep us from providing the kind of privacy and security that we want We were still using the the certificate certification system the existing one the TLS and and there were so many loopholes that could That that would break privacy, especially the metadata protection is is hard to achieve in a federated system Where you just talk to your own server and then you don't know what? Happens behind that. Is it really going to arrive at the other on a different server in a protected way? Who knows and there are so many ways to attack the communication between servers so So we prefer to do a distributed system Where the servers in between do not even know what they are doing and we found that actually Anonymous mildcast can be implemented there has been research. I'll mention the paper names and That the social graph can be used the social graph among people who is gonna knows who Can be used to protect against the kind of civil attacks. We already have civil attack protection in grunet for Because of the network size estimation strategy and we can additionally use secure shares social graph for additional protection and We can also use Have a different multiple strategies for onion routing usually using the social graph But getting back to the actual papers So in 98 there was already a paper that suggested how to do multicast trees and maintain an anonymity In 2003 we had an actual implementation which unfortunately is only available on request and I didn't make the request so I don't know and This one is particularly promising. I think Grunit is actually looking into the this one for implementation So we're actually looking at this work Grunit is not reinventing wheels The essence of secure sharing Grunit is look at the best ideas that the world has invented and then get it in in there So that might be something that will get implemented in the coming years So what are the typical problems if you do? Distribution strategy. Well, you can you could be doing one which with high latency and actually IPFS kind of does it Freena does it And even Grunit itself with its file sharing or file system module Does exactly that but high latency is something that doesn't always make fun So a lot of applications like to have Like a spare but in particular Twitter is not fun if the Twitter message arrives an hour late You want if you have a billion subscribers at a of a Twitter stream You still want to get in real time. You might ask but why are we doing Twitter on an anonymity technology? Because the fact that you're interested in Christopher Bieber's Tweets should be private That's that's what we believe in. Yes, Christopher Whoever any personality will Tweet to a lot of people and it might be visible how many Roughly how many people are interested in somebody's tweets But still each one of them has a privacy to keep it secret that they're actually Subscribing to Sasha Gray as well So So High latency is not a solution to our problems Another problem with most of these tools is then they're not protecting anonymity So that's that's a secure scuttlebot is really interesting if you have heard of it It's a distributed Twitter replacement and it's pretty advanced in many ways But it will not protect The your metadata who you're interested in who you're communicating with and even if you're having an encrypted conversation Everybody can see that you're having an encrypted in a conversation and that would be similar with other tools if we were doing a distributed Twitter using other tools like 0mq and Another possibility is to use existing Anonymization technology, so somebody did a Twitter like clone over I2P That was like five years ago or six years ago, and it died the project has disappeared and it's not happening Also the idea of doing BitTorrent over I2P which would be a proof of of concept Well, some people are kind of using it. It's not forbidden, but it didn't really Break through like it's not like we are all suddenly using I2P and doing BitTorrent because it works so well So something didn't really work out. I guess it's the scalability because if the Anonymization layer is on top of the scalability than the scalability actually doesn't work so what we have is the the choice of of trade-off so are we going to accept high latency or are we Going to accept that it's going to take a lot of bandwidth or are we going to accept that? We're not getting anonymity and we actually don't wouldn't like to have to have to choose so the multicast layer that we would like to have in GNUNET would Combine different methods would learn from the best ideas To make it a Plugable system that you can choose the kind of properties that you need for your application Similar to what we said before in the previous presentation about the anonymization strategies So you can combine different anonymization strategies with different scalability properties and We can have use cases from very private chat rooms to super popular Twitter kind of feeds So if you're still interested, then I'll add a few slides regarding Secure share Which is using or is would be using them at the multicast layer in the long run for high high scalability high popularity feeds We're using the good old psych protocol in a refurbished and renewed way For some reasons that the old that actually in the meantime we haven't found any Syntax or protocol which is actually more efficient in the Characteristics that we're looking for if you're if you want a binary protocol Then there are binary protocols without just slightly more efficient than psych just slightly But if you actually want an extensible Protocol which has rich semantics in a almost XML kind of style and you want it to be still text-based and have the advantages of a text protocol Then psych is pretty smart because it's at least four times faster than XML or jason It's actually in most cases a lot more faster and still text based It's actually friendly for text templates Which means you don't always have to create the text that you're going to send you can just use a pre-formatted string and just fill in the data if you know that the data is not going to break the protocol and So other protocols can be at least the binary ones like seaborr can be Close, but they are not that they don't have these friendly properties Here's a comparison of of speed and the small numbers are in milliseconds are how speed it how fast the implementation is and You can see that the lip psych is is the C implementation of the psych syntax and You can see that lip psych is Extremely fast on different kind of use cases Whereas jason is a lot slower and XML is usually even more slower But actually it depends a lot on what kind of use case and what kind of data structure you're you're delivering still Yeah, so We still don't understand why the world isn't using psych for all kinds of things because psych is actually a very efficient syntax This is this is what a psych message looks like when it's not compacted Which means? The underscore Keyword can be compacted to a single single letter So it is almost as compact as a binary protocol But it has many of the advantages of text protocols because you can extend the semantics of each of each Element by adding an extra underscore something and you can do it as you need it in your implementation So Yeah, this is a typical way on the top it would include the the public key of a GNUNET node it can send to a certain target on on that Not in a GNUNET node on a on a GNUNET ego so an Identity a person so you send a message to a person you can specify what kind of context this message is in You send a text body or can be a binary body you can deliver a binary Image for example as a parameter and you can also include a State modification which in this case says I have become a fan of the shitty Beals In case you have ever heard of the shitty Beals a famous band from Wayne's world So it's a secret sure essentially uses a lot of published subscribe Subscriptions for all kinds of people we discussed that in a previous talk about the modeling of The social modeling of a secret sure So the the useful thing about that is we get We we have a personalized collection of of subscription and that Gives us a personalized view of our social network and off of the profile of the people that we're looking at so My mother sees a different profile of me than a person that I met on the street or an old friend and It's probably safer that way. It's actually socially more Relevant because that's how social interaction works people have different views of each other so it's more advanced than the the plain Facebook approach and That alone gives you a whole choice of applications that could be done not just secure Social networking, but all kinds of podcasts and dynamic websites that up that are pushed to you instead of you fetching them mailing lists group where editing all kinds of things and It and the fact that you have a social graph you can always each tool that you use you're using it with people not with IP numbers not with Profiles on a whole on on some server in a cloud you're doing it with people details and Five years ago, I made these nice funny slides Suggesting which kind of tools we would be replacing So if in the basic elementary secure share level if we managed to get good at working and we have basic Messaging happening between people then we're already attacking the business models of I see you okay these days you would say what's happened signal and Gmail and hotmail and and file sharing tools like that and As soon as we have advanced social graph modeling then we are attacking all the social graph institutions Well, we have some old-fashioned ones here in this listing and actually since media transfer is is already not a problem Then we would also be attacking the YouTube business model or soundcloud It gets interesting when we start doing applications on top of distributed social networking Right, you can see in in only five years these slides have become really old because now you would see Uber and Airbnb and They didn't exist back then But still yeah, these are the kind of things that one could do as a plug-in and then the question is do we Like proprietary plugins. No, we want free software plugins So all these applications would actually be free software applications for free people that get to find a couch Sleeping on a couch at a friend's place or friend find find a friend of a friend that is going to drive you through town for a few euros or Things like that. So we can implement things like Airbnb and Uber without having actual centralized capitalism in it and it goes on if you allow for sharing the location for example Then you can do applications where people find out that they are in the same city and maybe they find out they are in the same Street and so they can meet Things that we could be doing and everyone is free to decide for themselves How much privacy they need to hide from their own friends, which is completely different from the privacy discourse that we have regarding centralized corporate capitalism and and governments So that would that would be quite exciting to attack all those business models I even added Oracle because I think a lot of sequel databases make no sense once we have a platform like this So thank you for listening. Do you have any questions? Let's go ahead. How will you how will you finance? How will you finance developing all that you're gonna attack business models which Generate billions of dollars in revenue. So you could get some of those dollars well We think there are other business models which are Legitimate and ethical and the ones that are centralized are actually not ethical and so we are happy to Invite idealists who see the same way to produce solutions that run this way and also we are suggesting to politicians to political parties to the European Commission we are suggesting that that business model should actually not even be legal and That's why a whole dimension of other business models would actually Get established the moment that the other one is actually not an option Yeah, so what's like? No, it's just that Okay So what's like the easiest app or like to bootstrap the network to bootstrap the peer numbers like is there like a killer app that we could Focus on like a chat or like a easy app to bootstrap the network I actually don't know because as soon as we fix the last bugs from GNUNET that are blocking exactly that step then anybody who can write up a Python script or a shell script using the GNUNET command line tools can already be doing Tools that are extremely useful for other people and it's really not a big step to do a user interface or to so a lot of Amazing applications are just a small step away We just need the to to figure out what's going wrong in GNUNET or it has been going wrong until now Maybe it's I fixed maybe we'll find out next week. So actually next week will we hope that will Take that step and and have basic applications on GNUNET running and then anybody who's sitting here could be doing a killer application that might Be doing big stuff we have plans to provide For a Facebook replacement that is easier to use than Facebook that is nicer than Facebook and it's ethically viable Okay, then my question sir. Yeah, go ahead. Give me your question Let's get technical for for for a little while. I would like to have a look at the psych syntax again Why why this syntax? Why not others XML Jason RDF well the answer require RDF is XML, right? So the answer regarding XML and Jason you can see it here in the numbers It it's just I mean we're thinking about running these things on raspberry pies and and all kinds of equipment on old smartphones so I Wouldn't want to lose power and energy for something Unnecessary and since we're reinventing the whole thing anyway Why be compatible to a past that didn't satisfy certain requirements? So it there have been historic mistakes in the way XML has been designed in 98 there have been historic mistakes in in how XMPP was done and and the idea of just escaping to Jason was kind of like practical, but a JavaScript notation syntax is not exactly Optimized for performance in fact all the escaping and all the Yeah, you have so many special characters that you have to make sure that not do not appear in the data before you can send the data Right, or you have to escape it with backslashes and all that or you have to encode it with a basic c4 encoding So all of that appears in those numbers So as soon as something complicated happens you have an overhead that that you have to pay for I understand that all the Iot the Developers right now do not care because they just want to be fast to the market and so they are even agreeing on standards So like that But we are doing something completely fresh. We don't have to oblige to anybody else So we can pick something that is actually more efficient Last question you said the revolution is gonna there's one, but let me go first, please You said the revolution is gonna start next week when the last Bug is fixed from the GNU net that's my hope now, okay Where will you televised the revolution where how do we do we stay up to date? It's it's happening at the onion space in Berlin from second to ninth of January especially on the weekend will have will focus on the things on the weekend and And whatever happens there will will publish it on sick your share the arc will probably also have something on GNU net or We have mailing lists we have other kinds of channels to to follow for now and Soon hopefully you can subscribe To the news that is happening on section share using secure share or at least a GNU net tool that kind of uses the pop sub principle cool Is there a point on the roadmap where I can reach a GNU net application from my actively running Java script in my browser tab somehow or is they a model for that to Christian mentioned it before that That restful API's are being done for several of the modules So several of the modules where you might find it reasonable I'm still critical about these approaches but where you might find it reasonable to have a JavaScript application run in the browser and do Do interaction with them out servers then you can use restful API's and do exactly that So for other people that love to work in that direction they can quickly hack something up and using that method So it also probably something that a lot of smartphone applications would be doing because that's the way they work thin clients It's not like restful HTTP is actually very efficient But it's on a level that I I understand that we're talking about a level of efficiency that for most people is no longer important but yeah Back again to psych I haven't never heard about the protocol so since when when started the development psych There was a binary psych prototype in 94 and then in 95 the first version of the syntax was defined and there was an implementation which was Yeah, and is there also an RFC? No, there are the specifications on the psych website and And it never became an RFC and the ITF decided to make XMPPS standard and Kind of didn't make sense to awesome. I didn't follow up and nobody else did so maybe it's just a marketing problem Yeah, could be in fact the We did the statistics much later There to find out that it's actually there a good syntax. We only found out later So we didn't know at the time Okay, thank you Just a sec is there any translation from the psych syntax into the Into something more readable like Jason or XML or something so that we can understand which data structure you're trying to Yeah to It's pretty simple to do conversion tools. I'm not sure if we actually have any but You can use a lip psych and just drop the same thing into a Jason library or We actually that that's how the benchmarks have been done. They were converted So it's not difficult and but ironically if you get used to psych It's much more readable than Jason or XML actually Because Jason is a lot more verbose and XML even more so yeah, so you have you need to parse more with your eyes Would it be possible to to share all the data there is? Files texts movies Well for binary data is not always useful. I Mean psych can have a trivial binary transfer by saying the next Eight megabytes, etc. are binary data, and then you send binary data Is it that easy? It's just like HTTP. I mean we When psych was designed it looked at the advantages of of SMTP of RFC a 22 and the advantages of HTTP it learned from all the good ideas in there and then it tried to go beyond and The things that we added to psych we didn't think that we was so spectacularly new I mean we just logically tried to make a syntax that can do a few things more And for some reason in the following 20 years nobody did the same Okay, then one last question for my side, you know, I always have a last question Excellent, so you have a radical approach on the syntax. I understood that that's pretty cool and the numbers show it Your radical on the unicast versus multicast issue Is there even a third thing that you can say? It's gonna be amazing because we are Reinvent not reinventing but learning from all the mistakes in the last 20 years Okay, scalability Yeah, I guess the way we combine anonymity technologies and encryption Will make it should make it quite amazing once we actually have the implementation So the early versions of six is how will be and I'm not not Specifiable if it's safer than tour like you can't it's like comparing apples and pears like GNUnet already if a large number of GNUnet nodes is running and it's using non-deterministic routing and stuff It's not trivial to say that it's less secure than tours onion rooting or more secure We don't know that would take research to find out and if we later even add onion rooting Then it's pretty obvious that it's going to be more secure and Yeah, even more things. Let me think I Tell me something that Okay I don't it doesn't right now. It doesn't come to my head, but actually it's it's a lot of stuff actually Why are you sitting during the Congress? Where's the assembly? It's right around the corner We have a secure shared table close to Chaos West, but also the GNUnet Thank you. Thank you. Thank you. Thank you The GNUnet people They have a table in the Vau Holland next to the Vau Holland Stiftung. It's very quiet there. It's kind of I'm I think tomorrow will probably be hanging out up there and Networking with those people and we're coming back on the 29 like That's Friday We're coming back here because we're going to have several talks and a lot of more in-deep and more exchange and more With other developers and more kind of not so much frontal talks is it will be more like panels and discussions? I See you very will be back here. I'm looking forward to it my friend great Okay, since I know for the questions Is this the last talk for today? I think so Okay, so I can start rapping now No, I can just beat box No, I'm kidding. Okay. So this is it That's it. This is a day one. We would have another slot for you if you want Slot for you if you wanted to have a talk you can hand the presentation papers To me or to casten back there. We do have some free space tomorrow, too So, please go ahead. Don't hesitate if you have a cool idea some kink you want to present just be very emotional about it and intelligent and beautiful just like links always is be on time be on time to present and The chaos West stage team will be more than happy to make this possible to you. I think The team at the back. This is a sec and Carson and void and Michi and all the other people and The next thing up is at midnight the clang teppich will have DJs here playing amazing sound Which will make some more atmospheric stuff and then we can hang out and have a good time as we always do on the Congress Stay tuned Bye