 I am Madish. I'm presenting Madix, the lack of imagination that we have to choose the name, but Madix is a toolkit that allows people to install free open source application on a known server without the need of having technical skills or make a big investment. The idea came from my experience with XNet, which I am co-founder, and XNet is an activist group which operates in things related with digital democracy, privacy protection, whistleblower protection, and so on. Working with other activist organizations, we were surprised to see how many people were using services provided by big corporations and they were creating actions and sharing sensitive information for example with Google groups or stuff like that. And these people normally, most of them were aware that this was not the best practice, but they had no alternative. They said, I have no, see what that means? I have no money to pay one. What can I do? And we had no answer for that actually. So this is what we did, built this answer. The approach to be this tool was very clear to us. We didn't want to create a service, to offer a service. We wanted to offer a solution that will empower users and transfer the responsibility of their data as well as the application to them. So we do not run a service with our sysadmin that manages their data, okay, encrypted whatever you want, but it would be on our responsibility. And so we didn't want to reproduce that. So we decided that this tool must run on own service of people that can have at their home or with whatever internet hosting provider. So this graph, why did I show you this? You say it's this crazy. Because this is a list, an incomplete list of company owned by Alphabet. And it's incomplete for two reasons, because in the same Wikipedia they say that it's incomplete and because it didn't fit in my screenshot. I made some gimp to make it fit, but I couldn't get it all. So the thing is, if somebody needs email, make the decision to switch their organization from Gmail, for example, to another email provider, which option they have. They could, for example, use Protomail we have just seen, but on my opinion the model is not that different. I mean, you still trust that people from Protomail respect privacy and care about that. We say, okay, I mean, I'm not discussing that, but it's just a technical design, right? Or Tutanota. So what happened if Tutanota tomorrow belongs to that list? We have the same problem. We have not solved the base problem. That's why we decided that the email server must run on People Machine, not on our common email server. And email is important. This is the graph, the first one is Gmail users and the blue bar refers to younger people. So it also shows that there is a tendency of young people to use these tools. And it's normal because it works. It has a sex interface and you have a lot of other services once you set up a Gmail account and you can have it set up in a minute, of course. So the alternative, if you don't want to transfer this responsibility from Gmail to another external or more friendly privacy-friendly company, the only alternative you have is to want the email server yourself. And this is a guide that you can follow. And when you get at the end, this is to install post-speech dover code with LDAP. And when you get at the end, this is the result. And from here, you can start creating your first email account. And this is not sexy at all. So many people will end up here. And so, of course, this is pain, right? So this is the idea that was without all the time when developing this tool. So if there is not only the email server, of course, there are other tools for... There are a lot, but next cloud, on-cloud, only office online, new office online, a lot, rocket chat, VPN. So people can, from a graphical interface that we have developed and which is installed on own server when you start using Mavic, from this graphical interface, you just select the application you want. You push the install button that is over there and the installation process starts. From the same graphical interface, you can also manage other things. You can get a look at how your system is. You can create users in them access. You can create VPN accounts. You can create virtual hosts for your domain and all the typical things you need in a server. So, but how does it work? So you can think about... You can create a recipe of recipes that people can download and apply on their own server. This, now I will show a slide that you would say, oh no, yes, these are the technology we use, but some of you in the whole may know that Ansible and Puppet are not really privacy friendly tools, but we changed the way we implemented them. So, for Open Nebula, we only use that in case we also provide hosting to set up a virtual machine. But if you want to use Amazon, we don't use Open Nebula. You provide the server yourself. So the first... Okay, it's a part. So Ansible, we just use it at the beginning to set up the first very basic installation. So, we do not offer using MadDix in server that has already previous configuration because it would be a mess for us to calculate all the possible panoramas we prefer to go on developing rather than sort different scenarios. So, Ansible basically what does is install the Puppet client. People could say, no, I want to do that my own. Okay, but I mean, we have all the... all automatized, why not? So, and we could one day make an image that people can install or... but we go slow because we are a small project. Anyway, so then Puppet, once you have the Puppet installed, you run a first Puppet agent. This is how it's called. And the Puppet agent talk to this repository and ask him, him, it, her, I don't know, to download the basic... and to configure the base of the system which includes the graphical interface, the LDAP directory, and MySQL and all the base packages. So, Puppet normally is not good for this proposal to build autonomous and privacy oriented tool because Puppet normally needs to know all the secrets about the machine that is talking with it. I mean, to install, for example, a MySQL server, Puppet needs to know which to provide, which password will be used as a root password for the MySQL server. And normally Puppet stores this information on the master server. And this was something that we didn't want. So what we do? We solve this problem in a very silly, simple way, but it works. It works like a sham. So we cheat the Puppet master so that it is using fake templates with fake values that are common for all installation. And upon the installation is over, it's terminated, the machine locally generates its own secrets and overrides these secrets with the one that was used by Puppet. And that way we not only, I mean, there are two benefits of this way of working. One is that under security point of view, we don't store in the same place a lot of secrets of people which we don't want. It would be quite a mess for us. And second, users can apply own configurations and Puppet wouldn't then overwrite this personal configuration. In a normal environment, Puppet would do that, right? So then it's great, but then a lot of people who are an organization who are actually in high risk area started using Maddix because it was useful for them. They could have infinite VPN accounts without asking anyone. It was very agile for them. And so suddenly we get concerned about the security because we took care about that, but you know. So we asked somebody externally to make a security audit, which we did with open, radically open security. And the thing is that from this security audit, the result was that there were a lot of recommendations that we are now in the face of implementing in order to ensure the security of all the systems. And this represents for us a big challenge because we had to translate all these concepts to the graphical interface. We don't want people to avoid using these security enforcement because they are too complicated. So we are making an effort. We are not experts in UX, so we are making an effort. We will need help on that. And also because, for example, the security audit says that we just should allow TLS version 1.2. And we know that there are people using Maddix that have old browsers that do not support that. They may have problems. So we would transform Maddix in something impossible to use, not working, you know? So we decided to leave this decision to users. So now we are implementing all views, all interfaces related with these issues, these security issues. And so Maddix, you can use once install the application you want and not use it anymore. You cannot talk with the server. You can actually uninstall the puppet or whatever. But what we do, we also provide updates because once it runs, you need to maintain it. And so we publish periodically new releases in which, typically, we have bug fixes, security enforcement, new applications, updates for existing previous applications. So the important thing on that is that this graphical interface is not running any command. It's just an interface from where all the user inserts data which are written from this interface, which is a jumbo, based in jumbo, and right in the end up. So then there is the Chrome who is reading this LDAP and it finds that something must be done because there is a status who changes so the puppet is triggered. Otherwise, no. For example, these are some custom models we have developed. We also use some models from the puppet forge and these are models that run locally on the machine. So not every time the client needs to talk with the master. There are, for example, when creating a new domain and you need to create a virtual host, this is something that the machine can carry out locally on their own using these puppet models. So what happens is that when a new domain is added, the domain's module turns into a locket status. So the Chrome reads that and performs all the necessary tasks in order to create the virtual host, the little crypt certificate, the web root folder and all that. So we are always working on this tool. Ooh, we have a lot of time working on this tool and we are now planning to add new tools such as Moodle. Then also we want to add something for online forms which are not pretty sure which is the best solution if you can help us on that. But basically the decision to add a new feature is from the feedback we receive from people that are using that. But yes, we want to add a Kanban that there is nothing right now for that. And there is, you have to think that Maddox can run on a very small machine. We use very little Docker just for the application that had only Docker support with a Dockerized image support. And all the other stuff are integrated. We just use Debian because it's easier for us to just give support to one operating system. And of course people have root access to their machine. It's their own machine. They have root access. Everything is written in the log. We didn't publish the server side because it's just a puppet with the models we use. And most of them we publish the one we have developed but the other one are from the puppet approach directly. So also all the sources are downloaded directly from, if you download, I don't know, the MySQL server it's downloaded directly with Debian from the source. So yes, we would like to make a better documentation of all the infrastructure we will do but we are always behind the timetable. But this is our intention. And I think it's all. I hope you have understood what we do. And thank you very much. Thank you very much. There's a lot of time for questions. Does anyone have a question? I would like to ask if you are aware of, you know, horse and Claudron. Claudron, yes. Yes, the difference is that... You know, horse, Claudron. Yes, the other one is, I tell you. The one that the guy went to work with. No. Cloudflare, no? Sandstone, sandstone. Sandstone, yes. What are the differences? Yes, before starting we looked because if this solution already exists why repeat ourselves? So the difference with Claudron is that on Claudron if you install on your own another application and then you update the Claudron it will overwrite all your custom things. They say that on their website. So it was not useful for us because it was just for us, it... Maddox is the tool that avoids repeating borrowing tasks such as installing, you know, but people need to have the freedom to then make the customization of their own system. So this was not useful for us. Sandstone, for something is more complicated for users. If you want to set up a website and make it accessible with the domain, some configuration and you still need to have some skills. You know, to install them, run it and so on. And among these three, you know, Host is the one we love more. We think it's great. Yes, we were talking with people from the project and the thing is that in this case also people need to somehow have a CISAD name capable to make some little maintenance on the one hand. On the other hand, we saw that their interface, yes, is running scripts directly and we thought that under a security point of view it was not a good decision. We wanted something that avoided this difference in this separation. And on the other hand, this system allow us to also provide service, service as a CISAD mean, I refer, to bigger organizations and provide them a very customized configuration for the server because, for example, we could create a template just for them if we want, you know. What we do, actually we do, we give maintenance and support to bigger organizations and they ask us, for example, a future that it only works for them, you know. So we just can work that way also with bigger organizations but we have systematized all the CISAD meaning work which is boring and repeating and so on. Any more questions? We still have time. What it would be possible to install my own machine that I am running in my basement? Your own PC. Yeah. Yes, you could but think it's a server environment and with local installation the problem is the IP. If you are changing IP, think that you have, for example, let's increase certificate generated that then if you change the IP everything will break, you know. So okay, you could but taking into account this thing about IPs, for example, to install the rocket chat, you need a known domain or subdomain that process automatically creates the built-in holes so if your ISP changes your IP, your Maddox is fucked up, you won't work anymore. But yes, it can work. You can, for example, this type, then you make some configuration in the site to use it just in a LAN and so it can work. Any, how do you do major upgrade? Major upgrade, oof. We did from Jesse to Stretch and in this we need to, a little bit, communicate with users, it's not just a button but then what we did was a button in which users send us, like a report because so we see if they had made some installed other applications, you know, to see if their system has some application that is not included in the upgrade, for example, then we have automatized part of this process but with every machine that we did the upgrade from Jesse to Stretch, we said to people come to DRC, write this command, do that. I mean, you know, we had to communicate because it's a major upgrade. We tell them do a backup before everything so this is a little bit more complicated. We could not get just one click but because we prefer also that we prefer to have a conversation with them, be sure that they have a backup and things like that because we don't provide backup to people. Then we are going to implement encrypted backup so we will also maybe find a way to solve that but see the moment we do not provide backup. Sorry, here in the GitLab there are some pre-stretch manifest that you can get a look of what they do that is the preparation to go from Jesse to Stretch, you can read them. Did you automate also the installation configuration of things like a fail-to-ban or clam-of stuff like that? We have spam assassins, for example, something that user can install until now for everybody is level three but we will add the option to increase or reduce this level and for fail-to-ban also the configuration see now is that the port and it's for SSH, Sargal, Apache, Dove, Cort and so on but I mean now it's already it's included by the port or all servers, it's not a package that people can decide to have or not this is mandatory in this case but yes we would like to add the opportunity to change the, for example we would need to put the opportunity to un-ban IP from this control panel because a lot of people, for example when configuring the thunderbirds they make an error there and so they get banned from that so we would like to add customization for that. Hello, how do you decide which apps are included in the library of apps? How does it work? We started because we needed this tool so we started putting the tool the apps we needed and the community we were working with and then some others that we didn't think of were requested by people that were already using Maddix and so when we saw that it was not just only one person but more than one so we decided ok, they were right this app is useful so if somebody requested that it would be great to have this application and it's not really a crazy thing that we added You said that you are going to add new apps in the future Yes in the future it's six months because we want to add Moodle and we want to add we were thinking about the line survey to create the online form but it's not really so much easier to use the interface on my opinion is not so clean so we are digging and investigating why why not which alternative could there be for that if you know of some we would love to check more Thank you very much We are running out of time