 Hello, so I'm obviously Nicholas and the reason this talk is called the return of the return of peer-to-peer computing is because this is a reaction to Holger's classic keynotes at last year's EuroPython entitled the return of peer-to-peer computing. Now the aim of this talk is, well like it says up there, to create a context in which you may think about peer-to-peer computing. So it's very much a presentation of ideas, although it does contain some technical stuff at a high hand-wavy level at the very end. We've organised the talk this way because we believe that there's plenty of time for technology at a technology conference and we'll deal with that at the very end. But it's very important for us to clearly state our position and our ideas about peer-to-peer software. So that's basically what this talk is about and the modus operandi that I'm going to use for this is very simple. I'm going to provide what I hope is a clear movement of thought between motivations via questions and actions to outcomes. So we have some sort of tangible engineering aims at the very end of this talk that we can all agree we might be able to go and tackle. So part one motivations. This time last year Edward Snowden's revelations were published in The Guardian. Actually this time last year I was working at The Guardian as a Python developer and it was rather a fascinating place to be, to be inside the organisation that was actually breaking these incredible news stories. But I don't really want to talk about Edward Snowden really because he's been dealt with elsewhere. What I want to talk about is the result and the result was a moral panic apart from in the United Kingdom. I'm not sure why anyway. Suddenly privacy became a bit of a hot topic. But up until Snowden privacy was a topic that was dealt with more within the domain of corporations at our Facebook and obviously Mr Zuckerberg is very famous for stating that privacy is of course dead. And for years I guess the people in this room anyway have realised that private corporations have been insinuating themselves into our lives by harvesting our data and so on and so forth. And this has been worrying me at least anyway since about 2009 and many others as well. So in response to concerns about privacy from people like me you get a corporate repackaging of the if you have nothing to hide you have nothing to fear type argument which is the quote from Eric Schmidt. If you have something that you don't want anyone to know maybe you shouldn't be doing it in the first place. Interestingly though those who say privacy is dead are those who gain most from the surveillance of their users because their business their business plan is basically we're going to harvest your data and we are going to sell it on through targeted advertising and other things. So of course privacy needs to be dead anyway rewind back to last year and Snowden suddenly makes privacy rather a hot topic for a wider audience than just developers in the room. And the governments around the world went in especially the British and the US governments went into full on panic mode and this was the foreign secretary which is I guess the equivalent of the secretary of state in the US. This is Mr William Hague who represents all bureaucrats in this example and this is a typical example of what they're likely to say in response to the Snowden revelations and I hope the audio works. If you are a law abiding citizen of this country going about your business and your personal life you have nothing to fear nothing to fear about the British state or intelligence agencies listening to all the contents of your phone calls or anything like that. Indeed you'll never be aware of all the things those agencies are doing. In fact you will not be aware of all the things that those agencies are doing. It's the way he ends it. Happily we are a bit more aware of what these agencies are doing in our name as citizens of these countries. Another formulation of Mr Hague's argument is only if you're doing something wrong should you worry and then you don't deserve to keep it private. And after all we don't want the bad guys to gain the upper hand and you guys you're probably obviously fine upstanding citizens and should be happy that innocence are protected from the evil doers that such a dragnet of surveillance will capture and identify. And this sort of argument, nothing to hide, nothing to fear argument is often trotted out with other classic defences like think of the children, terrorists, extremists and heaven forbid for us hackers. So this is blatantly wrong argument. For a start it's a false dichotomy. What do I mean by that? I mean that it turns a very nuanced and complicated subject into a simplistic black and white subject. Okay if you've got nothing to hide you've got nothing to fear, that's it black and white. Actually it's a lot more complicated than that as I'm sure we all know. It's also lazy thinking too and it's manipulative as well because you're framing the argument in a binary way when in fact it's a very nuanced argument. And putting that aside it's also an argument that hides several uncomfortable truths which I'd like to explore now. So the first uncomfortable truth is that it's not you who determines if you have anything to hide or not. For example these gentlemen who are some prominent American Muslims who are law-abiding citizens. They are political candidates, civil rights activists, academics, lawyers, people like that. Yet the NSA and the FBI have covertly been monitoring their emails and other communications. And this was done under a law intended to target terrorists and foreign spies. How do you think that makes American Muslims feel? As an aside I read at the Guardian website this morning that the Metropolitan Police in London have been monitoring the communications of the family of the man they mistakenly shot on the tube train soon after the July 5th bombings. This was a grieving family yet they were monitored. They had nothing to fear yet they still had their communications monitored. You have nothing to fear because you've got nothing to hide. It assumes that surveillance results in correct data and sound judgment. Now if you live in the UK you'll be very familiar with this particular tweet but some poor unfortunate gentleman who lives in Yorkshire was trying to catch an airplane one winter and he tweeted, Crap Robin Hood airport is closed. You've got a week to get your shit together otherwise I'm blowing the airport sky high. This was obviously a joke you would think. And then the police turned up and he got carted away under terrorism. I can't remember precisely what it was but he got carted away anyway. He was imprisoned and the result was that they ended up going to the UK's highest court at much expense and getting thrown out. So you know surveillance you might have a bit of a problem if the police get the wrong end of the stick for example or they're just collecting the wrong sort of data. If you're doing nothing wrong you have nothing to hide. Well rules and governments change. For example in the UK obviously I'm British so many of these examples are British. In the UK there's a law called our IPA Reaper and it's a UK law to monitor the communications of people for national security reasons. You could understand why people might want such a law and the way the law works is that it allows certain stated public bodies to be able to use such a law for such a reason. And since the law was introduced at the beginning of the 2000s that list of public organisations who are allowed to use that law has increased four times and now includes local councils. So local councils have been found to be monitoring their citizens' communications to track incidents of dogfouling. If your dog craps in the street in the wrong place you might be tracked. If you have nothing to hide you have nothing to fear. Well you know breaking the law isn't necessarily bad. If we look at this rogues gallery of people some of them might not be familiar especially the second one in. So that's Socrates right at the very end who was executed for corrupting the youth of Athens with philosophy no less. The second one in is Emmeline Pankhurst who was a suffragette who changed herself to Buckingham Palace in the cause of women's rights and getting votes for women. Obviously I'm guessing you all know Anders Gandhi who was imprisoned for basically trying to make India independent from the British Empire and obviously Nelson Mandela a recent example imprisoned for his protest against apartheid. Now these are widely regarded as people who acted as beacons of hope and I guess you know hindsight is a good thing but what I'd like to ask is how would their causes have survived in a digital penopticon if the authorities that imprisoned and in some cases executed these people were able to view their communications. And finally if you've got nothing to hide you've got nothing to fear we should be able to watch you. Well actually you know what privacy is a fundamental human right. There are many examples that enshrine this right but the one I've chosen is sort of the big daddy as it were and this is from the United Nations Universal Declaration of Human Rights and I'm believing and I guess that you do too that things like intimate decorations of love and doctors discussing the patients and engineers working on a new top secret project or journalists planning an expose of the government these are just a few scenarios where privacy is both a reasonable and legitimate requirement yet of course people want to surveil you. So am I saying that privacy trumps all? Absolutely not. Openness of public institutions, governments and corporations I believe is a fundamental requirement for our society to be able to function otherwise how else are we going to be able to hold such entities to account if we don't know what they're up to. I also believe that surveillance is legitimate given probable cause for concern and I'm not the only person who believes that. Can anyone identify where this comes from? It's the fourth amendment to the Constitution of the United States of America. The right of the people to be secure in their persons houses, papers and effects against unreasonable searches and seizes shall not be violated and no one shall issue but upon probable cause supported by oath or affirmation and particularly describing the place to be searched and the persons or things to be seized. I guess I'm not the only one in the room who sees the great irony of the fourth amendment. So you're sitting there thinking, hang on, you're a python here, this is a technical conference and who is this British guy ranting on for the last ten minutes about politics? After all, what has politics got to do with programming? We're engineers. So a straw man engineer might ask questions like, well, we're engineers, we like to solve engineering problems and I don't really worry about the politics of stuff and things like that. I'm far more interested in the hard problems of technology and servers and code and things like that. For example, we ask questions like, what is the best way to organise computational resources and we answer them by thinking about architecture and design. We also think about how should such arrangements be created. What tools are we going to use? We use Python, we use databases, we use methodologies like test driven development and agile methodology. We organise ourselves. Who is responsible for making such things work? In a team, we have people who have particular responsibilities. There's the QA guy, there's the DBA, there's the developer, there's the business analyst, there's all these different roles and each is responsible for doing something. Each of them also has authority to do certain things. Perhaps only the QA person is allowed to deploy the thing to the website to the surfer because they're the one who signs off that the QA is done. We also have people who create standards that we use so that we in some ways delegate responsibility for making things work by following standards that are made in public. If you contrast these with problems in political philosophy, after all, what has engineering got to do with politics? Political philosophers, I'm not saying politicians here, I'm talking about political philosophers, people who think about politics, not the politicians who are the ones involved in the political system itself. These guys ask questions like, what is the best way to organise humanity? That's a pretty big question to ask. What's the best way? What forms of governments should we try and promote? They think about the problems of democracy. They think about things like corporate structures within the public sphere, things like that. How should such arrangements be created? They try and define concepts such as duty and rights and they think very carefully about how the law should come to pass and how it should be enforced. Talking of enforcement, who is responsible for making such things work? Who has the power in a society? Who has authority? How does governance work? This is political philosophy 101. So I would say, I'm asserting, that programming is politics quite simply because we are asking and answering questions about organisation, process, power and control. We're writing, implementing in some respect, we control the laws of the digital world if you look at it that way. So part two, questions. Assuming that these things are important, that politics are programming important, why do we explore this program? What questions as developers should we be asking ourselves? So we turn to Holger, who I notice is sat at the back of the room. Last year Holger focused on these political aspects of programming by asking several pertinent questions. What digital world do I want to live in? What sort of software do I want to create as a developer? And if you're a parent, what legacy do I leave for my children? How would you answer these questions? Remember my aim at the beginning, which is to give you a context in which you can think, and part of having that context is being able to answer such questions. So one of the conclusions that Holger and I and many others believe is important is the answer to this question. Peer-to-peer and ubiquitous cryptography are a way to address the concerns over power and control in a digital world. So I'm going to, because I don't have that much time, I'm going to brush over cryptography assuming that you can go and read a book about it somewhere. This is talk about peer-to-peer. So let's examine what peer-to-peer means and how this affects the political aspects of the talk that I was just talking about. So what do I mean by peer-to-peer? Well, this is my back-of-a-fag packet definition. Peers of equal status devices running appropriate software co-operate in a loose, decentralized network for mutual benefit. And also peer-to-peer is the antithesis of hierarchy where some have elevated status and power over others. And one way to visualize this is the taxonomy diagrams, very simple taxonomy diagrams over there. On the left is peer-to-peer, and on the right is the client-server topology that we use on the web. Notice that the red spot is the point of power and control in the web. And wherever there's power and control, well, that's where politics is. So let's just think very carefully about how this affects, for example, the worldwide web, which is probably the most ubiquitous technology platform of the day. So the client-server architecture of the web is fundamentally unbalanced because the server always has power over the client. You authorize yourself, authenticate yourself against Facebook's servers, for example, and then Facebook decides whether you are allowed to see this content or that content or the other content. And of course, the server can decide that it's just not right for you to see certain content at all because it's illegal. Also, a server is a single point of failure that is also an obvious target for attacks. We all know about the Twitter fail well, but where did the NSA go when they wanted to try and hoover up lots of people's emails? They tapped into Google because lots and lots of people used Gmail. So am I saying that hierarchy is bad? No, I'm not. Sometimes hierarchy is very good, especially when it's efficient and it saves lives. If I was having brain surgery, I would like to know that the person in charge of that team had trained for several years and was acknowledged as an expert in their field. I wouldn't want to have surgery from a democratic group of, I don't know, hippie doctors who would vote at every point in the operation as to what to do next. I'm more likely to be dead as a result of that. So it's important in certain situations that there is definite power and control. But the important thing to notice is that in an ideal world such a hierarchy is best when the obvious skill, knowledge and capabilities of the person or the entity are acknowledged to bring about greater benefit for all. In an ideal world, those with elevated status and authority would have earned it via reliable and consistent public displays of such skill, knowledge and capabilities. So everyone knows this is a good surgeon because not a lot of people die when they're on the slab with him. For example, him or her, it's a him in this photo. In an ideal world, the responsibility and trust associated with such status and authority would be a serious yet welcome obligation. But we don't live in an ideal world. We live in a digital world where architecture in some sense defines power and control as I just tried to illustrate with the client-servant model of the web. If Facebook changed their terms and conditions, we have no way to challenge them. Not only because they're the ones in control of the servers, but also because they, in some sense, they've trapped us in their walled garden of data. All our photos, all our lives, all our social life is within this walled garden controlled by Facebook, for example. So I'm about halfway through the talk and I want to summarise. So programming, I believe, is politics because we're thinking about process and power and control of digital assets. We agree, I hope, that strong cryptography protects against surveillance. And we agree, I hope, that surveillance is in some forms not a good thing to have. Peer-to-peer decentralized distributed federated systems mitigate points of control and authority derived from architecture is bad. However, authority derived from evidence is good. So what can we do to address these issues? So part three, actions. So this time last year, I didn't know Holger and I was moving house and as Holger was giving his keynote, I kept getting tweeted by friends in the audience saying you should contact Holger, he's doing this peer-to-peer stuff. Nicholas, you're interested in peer-to-peer stuff, you should get together, which is what I did and Holger got together with lots of other people at Yora Python and the outcome of that is that we decided that we would get together a group of us and organise some sprints where we would be able to explore the ideas surrounding peer-to-peer and cryptography and so on and so forth. And we'd try and do something as well. Obviously Jonas needs an avatar because he doesn't really look like an egg. So at this sprint, what were our aims? At this sprint, we grew a community interested in redescentralisation of the internet. We also have people from redescentralised.org in the audience, we have a fantastic project era, put your hand up, talk to her. Promoting non-safael communications is another thing we're interested in, exploring existing solutions because we're not the first people to be worried about this sort of thing and doing something practical as well. We're programmers, we can do stuff with digital assets. So at this sprint, at the first sprint, we asked ourselves two important questions. What are the fundamental elements of a secure peer-to-peer system that can we build that is useful to this end? So at the sprints, we looked at existing technologies, Bitcoin, peer-to-peer messaging, et cetera, et cetera, et cetera. And at the sprint, we also plugged Holger into the matrix as well. And the point I'm trying to make here is that seriously, you don't need to do silly things to enjoy yourself at these sorts of sprints because these are fun and interesting and challenging engineering problems that need to be plugged into anything to enjoy them. We also decided we were trying to organise ourselves at conferences and gatherings like this one. I'll come on to that in a minute. But most importantly, I guess, is that we wanted to prototype at conferences and gatherings like this one. So we had something tangible, some code that we could point people at. So at least people could say, that's wrong, you're doing it wrong or that's good, I might join you. This stuff isn't going to happen by itself. So talking about outcomes, what were the outcomes? So, like I said, prototypes and hacks. And there are two that I would like to talk about. We explored the problem of a peer-to-peer cryptographic message passing system, completely decentralised. And we also looked at a universal distributed hash table as a platform, which is based on some work that I've been doing on a project called The Drugulous. I'll give you a very high level view of both of these projects now. So, the peer-to-peer decentralised crypto messaging, Holger calls this the test card, because if we can make this work, we've solved many of the fundamental problems of a cryptographically secure peer-to-peer system. We also had expertise within the group. We had Jorgis, who is one of the developers of the Cryfo project, which is in-browser cryptographically safe chat system. He was there. It was very good to have him and his expertise there. And we also looked at existing solutions. We found many, but the most interesting was one called RetroShare, that met many of our requirements for such a system, but not all of our needs. So, we tried to work out what are the gaps that we can fill in. So, to give you a sense of some of the thoughts that we've been having at these sprints, I just want to pause a moment and describe one of the problems that we have. The problem is, in a secure decentralised message delivery system, how do you communicate with offline peers? Now, with email, it's very simple. I just send my email to your email server, and the next time you come online, you go and collect it. It's almost like a sort of a post box for you. But that's a centralised point of control. It's somewhere, as we know with Gmail and so on and so forth, that people can intercept your communications. So, we wanted to make this completely decentralised if we could with no single point of failure, so that the message could get through in a secure way. So, what we've been looking at is building a system that allows trusted online friends to sort of pass the message like a baton in a relay race until the message is delivered. What we're trying to work out is, can this be done in a completely decentralised way? And it's early days, and we'll have to see how it goes. The other important thing that we realised is that signalling and discovery are the key. How do you know when this person is online or offline? And this leads me to the second project that I talked about. You could use a distributed hash table to do that. So, let's have a look. What is a distributed hash table? Everybody knows what a dictionary is in Python. Yes? Okay, it's a distributed one of them. It is literally a distributed and decentralised key value store. There's no single point of failure or control. It scales to a huge number of nodes as well. Lookup is relatively efficient, although obviously it's done over the network. And it also, depending on which algorithm you use, the one I'm using is one called Cademlia. It has good handling of fluid network membership because, of course, there are nodes joining and leaving the network all the time. And it's also tested in the real world with distributed hash tables because BitTorrent and FreeNet and other similar projects use distributed hash table for lookup. But they use a distributed hash table for just their application. And what we were thinking about doing is a universal distributed hash table. So any application could store key value pairs in this DHT. So the universal DHT, it's my current obsession, programming project obsession. I work on it on the train when I go into London and those late nights when my kids have finally gone to bed and so on and so forth. So development is a little bit slow. But it solves the problem of discoverability and signaling because people can leave their status within the key value pair, within the dictionary and friends can look up. We also had a quick look at... Sorry, we didn't look. We had a think about how we could make this work. I'm not going to talk about this very much because I'm not even sure we understand it. But we were discussing a platform called P4P2P which is distributed hash tables within distributed hash tables. So these are namespace in some ways. So that particular applications can use particular parts of the network that best meet their needs. So you're probably sitting there thinking, wow, he's had about half an hour now. This sounds far too utopian, hippy. And it'd be quite valid for you to ask why. You're obviously crazy, you guys. And that's usually quickly followed up by what about the economics of this sort of stuff. How is development funded for peer-to-peer systems? How do you put food on the table? So, well, let's think. Serendipity, there's a good example of that that happened last year at EuroPython. I kept getting tweets about Holger from friends who just happened to be in the room. I met people that I'd never met before at least Prince, but they're here and they're my friends now. Serendipity. God, we met and we're collaborating together. Why is that? Well, perhaps it's because we share the same values. We actually care very passionately about our privacy and working in a world where a peer-to-peer system is some way of enabling us to build a digital world that we want to live in. It's also fun. That's a good reason why you might want to work on this sort of thing. These are fun engineering problems, as I hope I sort of demonstrated. And it's also that itch for me. Everybody has a different sort of an itch, but that's my particular itch. First of all, important to remember that there was no economic argument made when the web was born. As Tim Berners-Lease said, the web is more of a social creation than a technical one. He designed it for a social effect to help people to work together, and therein is the value of the web. He didn't sit down going, what world-dominating hypertext system could I invent? It sort of grew from the bottom up, which chimed in with the keynote from yesterday morning. It's also important to remember that itch is 1996. William Gibson, the science fiction author, I'm sure you're all familiar with him, said in an article that the world-wide web is the test pattern for whatever will become the dominant global medium. The reason I'm saying this is because it's very easy for us at this time, after 20 years of the existence of the world-wide web, to have world-wide web goggles on. So everyone seems to see things. We must have a website for that. We must use a RESTful API. We must use HTTP because that's what everybody uses. Perhaps it's time that we might be able to think outside the box and think, well, what should come after the web? What post-web solutions and digital architectures should we be using? Which leads me on to Alan Kay. Alan Kay is very famous for saying the best way to predict the future is to invent it. We're in a very privileged position as developers because we could actually build that future with Python. But I actually like this quote more. I believe that the only kind of science computer can be is like the science of bridge building. Somebody has to build the bridges and other people have to tear them down and make better theories. And you have to keep on building bridges. What's the next bridge after the world-wide web? The penultimate slide. Sorry, I'm nearly finished, don't worry. This is some cuniform that's in the British Museum. It's 5,100 years old. It's one of my favourite places to be the British Museum because you can't help but get an enhanced sense of perspective. In internet years, two years is a huge amount of time. This is 5,100 years old. It's one of the earliest examples of writing that we have and it records the allocation of beer. You'll be pleased to know. By administrators in the city of Uruk and the symbol representing beer is actually an upright jar. I'm not sure if I can find one yet. With a pointed base. The amounts of beer that these workmen or work ladies have been having is denoted by the circles and the crescents. That's their counting system. If you look in the bottom left, there's actually a person drinking from the bowl and that's kind of like the receipt to say that the goods have been received. It's a bit of a small one. I would like to end by asking you is the World Wide Web our cuniform clay tablet and what should we be building afterwards? If you would like to discuss this more with not just me but my friends that went on the sprints as well because what I presented here is very much a group effort. Meet us in the foyer at 5.30 this afternoon and we'll have a chat and we'll probably go afterwards for beer and food. The end. Is there time for questions? I can't hear. The GPG key signing is almost in parallel to that time in the basement so it's a bit unfortunate somehow. I didn't realise that. We looked into key signing when we were our first sprint. I remember there were about nine highly technical people in the room and we managed to do it wrong which says a lot for key signing. There are lots of ways that you can improve security but we got it totally wrong. No more questions? OK. Oh! How did I guess? David who's going to ask the question is my colleague. So what is the best way to organise humans? To organise? Humans. That was your big question. OK. I should say that David has a philosophy degree. As do I. My answer would be if you come along at 5.30 this afternoon we can work out the details then and actually we could put a note in our sprint plan and we can create a ticket to discover what the best way to organise humanity is. You said there is a small community of people working on that stuff but the only thing I find on your website is your Twitter account. So what medium do you use to communicate except meeting in meet space for some sprint? There should be some more effective way without driving through Germany or whatever. You're probably quite right. I'd say in our defence this is early days we're a group of people who are just exploring the ideas and it's not as if we've announced a political party or a new free software project or something like that yet. We're getting together to think about these ideas. We communicate on IRC in a channel that has nothing to do with peer to peer because it's run by one of the guys it's his company IRC channel on FreeNode so I'm not sure he might not like me sharing that channel. But it's informed. So the first thing you can do is come along at 5.30 and we can talk and share email addresses and things like that. The second thing you can do is you can prod me on Twitter and I will get back to you. The third thing you could do is probably annoy Holger and send him emails because he's quite a high profile person that will be able to disseminate information because people follow him an awful lot. But you are quite right. This is something we've been enjoying ourselves with distributed hash tables rather than IRC channels and Twitter accounts I'm afraid. Irina, do you want to have the microphone over there in the middle? It needs to be recorded for posterity so you better say hello to posterity. Hi everybody. It sounds like you guys have a bit of a clique out there hanging out. For those who want to join a broader movement there is a re-decentralised mailing list re-decentralised at Libralist.com with public archives where there's a huge community of people who are interested in re-decentralisation technology in adoption, in how do we change stuff. So that is a really good discussion list and there's a whole website as well which you can join and follow and get. I would encourage people to do that. Definitely. Join Irina's list. I'm a member of it. If you search Google for re-decentralised.org don't go to Google, type it into your URL. At the top of it, re-decentralised.org and through the magic of the internet this web page will appear and they have interviews with various people who are doing things that they don't know that they don't know. There are various people who are doing very similar projects in the peer-to-peer sphere. I think because we need to sort of turn the room around for the next talk. Now's a good time. Time to finish. One more question then. Okay. Hello. The five questions that you had there on the blackboard. I think the most interesting is the fifth one and some political philosophy in Poland recently said that it's not about who we give the power to it's about how we can remove them when they fail to deliver what they were supposed to do. It seems that this distributed peer-to-peer communication is about taking away the power from everyone so that nobody holds the power. So the power is not centralized. But there are many instances of stuff where for example when you make a standard you need to have a centralized power to make the standard happen, right? You need some kind of standardizing committee. For example like English. Do you have any ideas of how to organize the removal of people you don't trust anymore? Yeah. Just for your interest anyway. That's half the blackboard. The bottom half is even better. But it was only the top half that was pertinent for this part of the talk. This was created by a UK politician called Tony Ben who recently died. Tony Ben's five rules. You'll see the whole picture. He's very very good. That's it I guess.