good morning I I grew up skateboarding
so I keep looking at the stage thinking
skate park but I think it would probably
break if I tried to skate it so I'm
gonna not do that
my name is Dietrich I'm from Mozilla and
I've been at Mozilla for almost 13 years
and primarily I mean there's interesting
technology I love the web love open
source open systems but the question
that I asked yesterday why is really
really important one and one of the
reasons why I've stayed at Mozilla for
so long because it's an organization
that has a commitment to keeping the
internet open and free at place that's
accessible to everyone
promotes civil discourse and elevates
critical thinking and amongst other
things but that set of clearly
articulated values those reasons why our
ultimate Lee the the most important
thing and for me so today I'm going to
talk a little bit about how we apply
those values how we make a decentralized
or a distributive web that reflects
those values how the threats that we
have against the web today and also some
of the challenges that exist in changing
the web that we have today and also talk
a little bit about one of the projects
that we have that were building in this
space so this is Mark sermon he's the
executive director of the Mozilla
Foundation and and I think it was like
2010 he did a talk and actually I tried
to go back and watch this talk it is on
YouTube but apparently in 2010 they
didn't have HD cameras and that the
quality was so blurry so just to
paraphrase the bit that really stuck
with me from that talk is is what does
it take to be a 100 year organization
how do you develop technologies and
platforms systems that that last have
that type of longevity there are not a
lot of non-governmental organizations
that are have been around that long and
the web is what 20 25 years now and it's
facing serious problems it's the
it can be an inhospitable place at times
right now with surveillance capitalism
and and hate speech and the internet
being used as a discipline
by governments so how do we what do we
need to do to make the web a more
hospitable place by by any measure the
web really is a success there are an
estimated 4.5 billion web pages and an
estimated 1.5 billion websites this is
an unbelievably large amount of human
activity that that we put online in
contrasts the combined app stores of
Apple and Google are estimated to be
around just over 5 million apps so this
is actually not to scale a fair
rendering would actually make those
Apple and Google icons invisible and you
wouldn't be able to see them with that
amount of human content of human
creation a line that browser vendors are
responsible for though it really isn't
it's a responsibility and we take that
very seriously we need to make sure that
as much of those 5 billion almost 5
billion web pages can still work that
that they can be read by everyone that
there's still function along with that
success comes some challenges as well
people who make the web are really
comfortable with how the web works we're
really familiar with how browsers work
they're well understood security models
well understood set of capabilities and
constraints how what do we need to
change and and how we're gonna be able
to change that there's some resistance
to change especially in talking about
how you implement distributed and
decentralized technologies and the web
some of our biggest fans are some of the
most challenging when it comes to
talking about things like theory 'm
things like block chains things like
distributed applications but as long as
the web stays centralized we need to
have these conversations we need to
figure out how to how to really move
forward some of the bigger complaints
like how do you mad
world without URL the URLs are our core
part of what made the web powerful
accessible University University
available but ultimately a lot of people
don't understand actually how they work
us as technologists we know how they
work and we understand the importance of
them but like this this video is Google
went out on the street at one point and
asked people what a browser was and it's
kind of a famous video because it was
really it was an inflection point as far
as understanding like do people
understand how the technology they use
actually works people don't understand
what a browser is what a search engine
is what an operating system is it just
i'll get smashed together it's it's the
stuff we use it's how I do my thing
right I don't know I just post stuff
somebody puts it somewhere people don't
understand how this works
another one that it's really hard to
imagine living without is domain names
how do you live without what where's
where's your company exists how can I
find you
DNS is one of the most like I guess easy
choke points in centralization you know
Indonesia turned off reddit with DNS we
turkey turned off Wikipedia DNS very
easy centralization and and censorship
checkpoint another one of the cultural
challenges is talking about protocols
protocol Broz if you're talking about a
protocol it must mean that you are not
addressing real human problems real
human problems start with where human
needs actually exist and that's at the
front end with the fundamental
misunderstanding of the fact that we are
really sitting on the shoulders of
giants when we're using the Internet at
all set of protocols that enable all of
this to begin with here's another one is
blockchain pros if you bring up the word
blockchain in certain circles certainly
it must mean that you are over
engineering and there's absolutely no
need for this at all and I found myself
actually starting a sentence
well not all block chains it's it's not
a good place to be in and and arguably
the you know there's like there's
there's some good reason for that
there's some justification for that and
applying to the same tool to a number of
different problems they're gonna get
anywhere but for this we do need to
re-evaluate the network architecture of
how browsers work
so what does that look like what is a
what is Reedy centralizing the web
actually look like in the web
architecture that we know today a
browser loads the URL on your behalf
makes that request to the server and the
server returns a response and the
browser passively accepts that response
and that's pretty much how things go on
the web we have today that is the
centralized single two points
architecture of almost every single
browsing session even if you're loading
up ipfs in there it's going to be
centralized somehow you're not actually
bootstrapping a node from the client
every proxy to a decentralized or
distributed service is still just a
centralized proxy there are a number of
problems with this we talked a little
bit about already easy to censor all the
different problems where that actually
are just daily annoyances sites go down
sites get ddosed a business goes down
goes out of business and this side goes
down they or they get bought by a bigger
fish that's a service you love so much
suddenly disappeared poof never to be
seen again
after being bought by one of the big
tech companies ultimately though it
comes down to the fact that all the
power resides on one side of this
relationship and the browser itself
doesn't have any say really in what
comes back the server ends up being kind
of like like that friend you go to meet
and they always seem to be the one that
decides what you're going to eat and
where you're gonna meet and you start
talking to your other friends and you
realize that they're also being treated
this way by this friend and then you
hear that they've been actually taking
notes about what you've been talking
about while having dinner and then you
hear that they've been taking those
notes and selling them to people who
really aren't your friends and then you
end up one morning in a refugees refugee
camp on the border of Myanmar or a
victim of genocide because that friend
was Facebook these are real problems
that we need to solve and that are going
to be really difficult to solve
with this architecture incredibly
difficult to solve as long as we have
that centralization choke point we won't
be able to get past this point of Mack
massive structures massive amounts of
control over human activity so let's fix
it let's make a distributed web browser
there's a lot of projects in the space a
lot of people try to figure out what the
what the right pattern is how what the
use cases are how do we how do we solve
this problem how do we create a web that
is gives more control back to the user
for the web to truly for a user agent
actually to truly live up to its name we
we have to change these network
architectures and see these are some of
the projects that are explaining in this
experiment in this place but like I said
before we need to think on the
hundred-year scale we need to think
about well actually as a browser vendor
we're just thinking any changes we make
we have to own that code forever we
can't break the web we can't change
things too fast we can't just be like oh
yeah web v5 everybody upgrade right we
have to support that that five billion
web pages we have to make sure that that
that that human that output of human
activity and creativity stays usable and
and still works so we we can't just pick
a winner we can't just say all right
I'm PFS sounds good let's run with it I
think also picking a winner deciding
that this one solution is the best
really narrows the set of use cases that
we can address and answering that
question about like how do you build a
system an architecture for longevity for
first century long longevity means you
have to understand these what the
broader set of use cases are that all
these projects are trying to address I
think success looks like not a winner
but many islands in the sea
a healthy ecosystem is one that really
props up and supports and enables
experimentation change it enables a the
ability to adapt as human needs change
which is going to happen over a hundred
years right so we started looking at
what the
the building blocks are in a lot of
these distributed systems there's a
swarm there's a CRT T's there's web
servers okay should we there's a lot of
key management issues do we just put a
blockchain in the browser see what
happens
do we turn the browser into a server let
it go and see what people do with it
these are maybe high-level building
blocks okay so what what are these built
on well a set of very familiar well
understood but pretty boring
technologies these are things that we've
been using for 20 years or more right is
but you can build on top of these things
those other higher-level
application primitives every single
blockchain is built on top of these
application these lower level primitives
and network architecture primitives
things like access to file system these
are all things the web doesn't really
have today the web browser has been a
client for 20 years and nothing but for
the most part like the few different
experiments and things that didn't
really really last implemented things
like discovery and but there's no real
file system access that works across all
web browsers for example so if these are
the kind of lower level primitives how
do we get these into a place where
people can start experimenting and
building those higher-level primitives
in the web this is kind of the world
that I live in as somebody who works
building browsers there are these three
basic execution scopes we could okay
build distributed application
capabilities in to Firefox itself and
just make the the browser part of the
application we're where we implement
these types of features it'll be slow
going we will be able to meet all the
needs and these projects that I've been
talking about half today and the needs
that your projects have today so that's
not ideal and we are resource
constrained we are probably the smallest
ok no we definitely are the smallest of
the web browser vendors building major
in used browsers today do we want to put
UDP api's inside of a web page in
JavaScript that also sounds like maybe
the right level of abstraction and
browser extensions which you're probably
familiar with from installing that a
mask it might be the right middle ground
it might be the place where we can say
expose some of these capabilities but
without over committing too much
well letting people experiment letting
projects like yours experiment but
without deciding that okay the web is
gonna have this API and live with it
forever and and without really trying to
own or control what that distributed web
looks like by just building it directly
in Firefox so this gives us some
extensibility it gives you some
capabilities in a way that we can is a
little bit more malleable that we can
experiment with so I'd like to introduce
Lib D web this is a project we've been
working on for the last couple of months
that adds some of these basic primitives
to web extension ap is it so far adds
the protocol registration so you can
register custom protocols TCP and UDP
API is mdns endianness and file system
api is talking with the projects in the
space key management seems to be really
important as well there are a number of
changes happening how Firefox works and
stores keys at the OS level that maybe
we'll be able to take advantage of but
as soon as we implemented this the ipfs
project took it use their IP FS
companion add-on and migrated it into
this experiment api's and actually got a
full IP FS node running inside Firefox
and one of the first things they did was
start serving Turkish Wikipedia directly
between two browsers which is amazing
and it means that that we're onto
something
that maybe these capabilities at the
lowest level will at least give us and
are all these projects and your projects
room room to play room to figure out
what that next generation distributed
web browser looks like so where we're at
now we've prototypes a number of these
api's we've proposed them to the web
extension
the guy's team sounds alright but of
course this is just one web browser
right the web works for everyone because
it works across multiple browsers we
need to build some momentum around what
we want to do here and and we've seen
that just doing even a little bit
publicly is actually pretty powerful
earlier this year we whitelisted a few
different protocols IPF acid that and a
few other ones and people were really
excited about it we've got a really big
response you couldn't actually do
anything we just whitelisted the
protocols there's no way to actually
handle it on the other end really so it
was more symbolic but now several months
later chrome also whitelisted those
protocols so you start pushing at the
edges you start a little bit by a little
bit looking at what features people need
looking at where the right place is to
push our and hopefully making progress
and if any of you worked in web
standards or any standardization process
you'll already know that this kind of
how things work anyway there's not like
a group of people get together write
down a spec and then all the browser
vendors go off and implement it most
often these things get proved out over
time by domain experts giving their
input and maybe some browsers
experimenting in some ways so this is
really actually kind of looking typical
for how browsers develop the next steps
we're getting privacy and security
review right now are in this process for
the protocol registration API which is
one of the trickier ones things like TCP
sockets pretty well understood not
anywhere in web browsers generally right
but we understand what they do want the
effect they're gonna have especially in
an extension but when you register a
custom protocol all of the rest of the
browser infrastructure gets pulled in
and all of the browser's security model
we make decisions around what
permissions a webpage has to your data
to different features based on the
origin the URL that we loaded and the
domain name that it came from and the
security context that it has based on
the SSL certificate static that came
with right that actually are
in those certificates is that domain
name so what does it look like what is
that security model what is that origin
when you load and ipfs hash it's really
different
so we're tackling this API first because
we think it's gonna be one of the more
challenging API to really figure out
what that what all the downstream
effects on the browser are going to be
I've been the last couple of weeks we've
been threat modeling if you're not
familiar with threat modeling and I know
there are a couple of security workshops
here at the conference threat modeling
is when instead of you saying okay we
know that's a fantasy to say that any
software will ever be secure there's no
such thing as plenty of security the
important part is actually understanding
what the threats are what are the
attacks on your on your software being
able to identify and articulate those
attacks and then design mitigations and
protections for those attacks so we're
going through and doing this process the
threat modeling for each one of these
api's and it's very exciting I've been
applying it to my personal life like I
have an early flight tomorrow threat I
might miss it mitigation not drink so
much beer tonight go to sleep early I'm
gonna die of heart disease threat don't
eat all the cake again so it's really
useful process I highly recommend you
apply it to your software projects and
your personal life one of the other
things we're doing is talking to a lot
of these projects
what are these projects who are building
distribute and decentralized web
browsers or processors like things what
do they need one of the ways to do this
is a w3c community group the community
groups at the w3c is an interesting
construct construct because you don't
need to be a member of the w3c to join
anyone can join and anyone can
participate in the discussion so it
creates a place where vendors software
developers interested parties domain
experts can share their projects share
their experiments but without any
explicit commitments to implement
anything and this is I think it's the
right level abstraction for the
communication aspects of what we're
doing this is the are we distributed yet
project which was I think initially
started by IBM
folks and as you can see issue number 27
is where we're having this conversation
so if you're interested in participating
in in proving out and forging what a
distributed web browser might look like
this is the place please come and join
in hang out
so this weekend's coming weekend I'll be
in Berlin for indiewebcamp the indie web
indie web community is is fascinating
awesome group of people they're actually
one of the people that say if you're
talking about protocols it must mean you
are ignoring real human problems so we
always have interesting conversations
where you get together but their set of
principles for building software I think
is pretty fantastic there's some parts
of it that I think are really useful
when looking at the things we're
building and looking at them honestly
one of the most is to use one of the
most important I think is is use what
you make if you're not using your
software why would anyone else want to
use it and that is often especially for
the kind of things that we're building
really good lens to evaluate how
effective the software is that you're
building build for the long web like we
were talking about how do you build at
100-year scale how do you design systems
that are robust the the web was designed
with with legacy built in and I feel
like that's a been a pretty effective
way of a future proofing it because
there's everybody wants access to those
five billion near 4.5 billion web pages
what are the characteristics of systems
that that can last that long
the idea of plurality as well that are
there multiple implementations of your
software even if you don't agree or
their competitors the fact that multiple
people can implement an interoperable
version of the software is a testament
to its strengths and also is a great way
to identify maybe the things that you've
been in a bubble designing and might not
be right
so the a good way of identifying flaws
other problems that you might not see in
a single implementation
some of these lessons I think are really
important in getting the distributed web
to the place where we have billions of
applications the oh missing slag area
yeah so this is exciting there are real
users using DAPs today for real things
this I think is probably the most
important signal of whether or not what
you're building is actually working if
real people are actually using it to
solve you human problems
maybe those human problems are managing
and feeding digital animals that's fine
but if they're doing it all the time
that that's part of the course of our
human life and activity means you're
meeting a need and getting that world to
the same billions to at least 25 years I
think that focus on on human activity
human needs and problems is is really
important and I think that focus is
what's gonna get us back to an internet
that is hospitable again an internet
that does meet human needs is a place
where we can have civil discourse where
we can have trust again Thanks happy to
answer any questions if we have time
looks like we have some time all right
thank you very much oh sorry we got one
what would you say are important metrics
to measure DAP activity by because I
know like you know there's quite a bit
adapts that claim they have users but
it's just like BOTS basically crypto
shrimp was a really good example that
were they had a lot of users but it was
just a small amount of people basically
writing BOTS yeah so I I can't answer
that question but that seems like this
community of people should be able to
answer that question right I think
that's going to be critical to having
trust in things like DAP marketplaces
trust in systems especially if you're
investing real money things that have
value to you whether that's currency or
not into those systems having a having
at least an agreed-upon standards for
how to how to do metrics for distributed
applications it's really good things
like IP FS are and even that protocol
are pretty wide open like you you could
see who's asking for what for for good
or ill it's really strong and in some
ways and also can be a real problem in
some other areas but building it into
your protocols some way of being
accountable in a meaningful way there's
probably going to be important but how
that works like you said it's really
challenging it's really different than
then doing metrics on the on the
centralized web it may be maybe you
could argue that a actually having not
trustable numbers reduces the threat
surface because right now metrics on the
centralized web are kind of how we ended
up in this surveillance capitalism place
to begin with yeah
any more questions thank you hi my
question is how much of what you're
doing now of what you described with
ipfs and things related to the
distributed web you are doing in
collaboration with other browser
companies right now this is just us
working with a few the different
projects that I listed mostly in are
entirely in open repos pound D web on
IRC mozilla.org is where a bunch of
people from different objects are
hanging out I don't know if other
browser vendors are working directly on
these types of api's or not I know that
the chrome did whitelist those a couple
of protocols I don't know I'm not I'm
not clear on what that actually means in
the context of what they did if it does
unlock any other capabilities in their
extension environment or not I think it
my understanding was that it just did
what ours did initially to admit that
you could load a web page that was
hosted with from within the extension
itself and not actually outside or not
I'm not totally sure yeah
thank you very much for from rozilla to
take a lead in having the browsers
support some of these decentralized web
we're depending on it what do you need
from us to try to get more support
internally from Mozilla we need you guys
to succeed at this I I think that's that
that success story that I showed where
ipfs somebody from my PFS
just in a couple days took these
experimental api's and showed really
immediately indirectly how they were
able to apply that capability to a real
human problem of censorship of Wikipedia
and Turkey I think those stories are
really important so seeing more of those
successes I think the second thing is
actually helping us figure out what
these applications need you know
initially we were like okay we need some
network architecture changes we need
some more network capabilities but
really quickly it turns out that things
like key management are still are a huge
problem and I think that problem in
particular will show up strongly in the
mass adoption and adoption at scale of
the type of applications that are here
at Def Con so input and help in figuring
out those problems and best practices
and how may be key management has a
place in where in the architecture of
the web would also be helpful yeah sure
build stuff share your stories any other
questions
right all right thank you very much
[Applause]
you