[00:18.740 --> 00:19.580]  Hello, everybody.
[00:20.880 --> 00:23.600]  If you're coming in for this talk, do please come forward.
[00:23.760 --> 00:24.760]  We've got plenty of space.
[00:25.760 --> 00:31.360]  For those lingering in the back, if you could sort of move out into the hall if you're not coming in.
[00:31.820 --> 00:33.520]  Okay, we've cleared the last speakers.
[00:33.660 --> 00:35.520]  Okay, I don't need to be a jerk anymore.
[00:37.020 --> 00:38.200]  Welcome to the last day of HOPE.
[00:40.300 --> 00:43.200]  I think my great regret is I don't have another concert for you this evening.
[00:43.360 --> 00:44.220]  I really wish I did.
[00:45.080 --> 00:49.160]  But the one thing we'd like to ask of everybody, of course, is that we do not have a clean-up staff.
[00:49.300 --> 00:51.360]  Do please stick around after closing ceremonies.
[00:51.500 --> 00:52.540]  Help us pack up.
[00:52.600 --> 00:53.820]  It's one of the greatest things you can do.
[00:55.400 --> 00:59.400]  Help if you see people who sort of know a lot of stuff, ask them for various things that can happen.
[00:59.980 --> 01:03.580]  Do also help us clean up if you see a cup under your feet, whether it's yours or not.
[01:03.580 --> 01:05.200]  When you leave, please take it with you.
[01:07.520 --> 01:07.920]  Okay.
[01:10.300 --> 01:10.920]  Try that.
[01:11.220 --> 01:12.080]  I'll see if we need to go direct.
[01:14.080 --> 01:15.680]  Okay, I might do it.
[01:16.160 --> 01:17.360]  Just watch your step on me.
[01:17.580 --> 01:18.940]  For instance, I have...
[01:20.040 --> 01:21.240]  How are we all doing out there?
[01:22.400 --> 01:22.660]  Yay!
[01:24.140 --> 01:26.040]  Everybody's not too hungover from last night.
[01:27.200 --> 01:28.820]  So, I'm still amazed I'm alive.
[01:29.280 --> 01:29.500]  Yay!
[01:41.710 --> 01:42.550]  How many people out there?
[01:42.630 --> 01:43.370]  Is this their first hope?
[01:44.830 --> 01:45.150]  Yay!
[01:46.210 --> 01:50.510]  I think we heard we had something like 50% more people here than last time.
[01:51.630 --> 01:53.190]  Somebody's like, you need a bigger hotel.
[01:53.310 --> 01:53.550]  You what?
[01:54.910 --> 01:58.910]  I don't know offhand, but I think last time we had like 3,000, so it's maybe 4,500 or something this time.
[01:58.910 --> 02:00.530]  I'm like, yeah, we're just, we're getting big.
[02:00.830 --> 02:01.250]  We're getting big.
[02:01.690 --> 02:02.090]  We're getting big.
[02:02.150 --> 02:03.890]  Oh, wow.
[02:04.630 --> 02:06.410]  And you don't have a VGA or the...
[02:06.410 --> 02:07.030]  There's no VGA.
[02:11.170 --> 02:13.750]  Because you know what we're really good at at Hackers is technology.
[02:14.890 --> 02:14.970]  Yeah.
[02:15.190 --> 02:18.150]  Anybody know some crazy technology?
[02:18.430 --> 02:18.750]  Yeah.
[02:19.350 --> 02:20.250]  Do you have a spare box?
[02:20.350 --> 02:21.770]  I have the presentation on the USB key.
[02:22.590 --> 02:23.110]  What do you want?
[02:23.210 --> 02:25.670]  I have the presentation on the USB key if you have a spare box.
[02:26.570 --> 02:28.290]  I will grab you a new computer.
[02:28.930 --> 02:29.190]  Thank you.
[02:29.930 --> 02:31.470]  He's got the right, we've got the right connector.
[02:31.590 --> 02:32.310]  We've got the connectors we need.
[02:32.450 --> 02:33.490]  The thing is, there's...
[02:38.730 --> 02:41.370]  Give it a try.
[02:50.830 --> 02:51.910]  Shepreen, you don't have your box with you?
[02:52.570 --> 02:53.330]  Help the pause out.
[02:53.850 --> 02:55.550]  Do you have a computer with you you could use?
[02:56.010 --> 02:56.870]  Is it ready to go?
[02:57.710 --> 02:58.910]  Is this a possibility?
[02:59.110 --> 02:59.410]  Let's do it.
[02:59.450 --> 02:59.790]  All right.
[03:00.030 --> 03:00.630]  Go team.
[03:01.890 --> 03:04.750]  This is the thing is, I am currently going to be introducing my boss.
[03:06.170 --> 03:08.290]  It's just sort of a strange position to be in.
[03:08.790 --> 03:10.750]  Since mostly I've been like, James, don't come to my talk.
[03:11.690 --> 03:13.790]  I said something about Richard Stallman, oh no.
[03:15.750 --> 03:19.430]  Yeah, so James and I and Shepreen, who's helping us out here, all work at OpenITP.
[03:21.090 --> 03:23.310]  OpenITP's basic mission is to...
[03:23.310 --> 03:29.770]  to support developers of open-source and free and open-source, as Richard reminded me that we need to say.
[03:29.890 --> 03:40.410]  Free and open-source tools for encrypting your stuff and securing your communications and getting around censorship is also a major concern of ours.
[03:40.410 --> 03:44.530]  So we work with folks at Cupcake, for example.
[03:44.730 --> 03:45.590]  Yay, Cupcake!
[03:45.770 --> 03:47.510]  I was just trying to name check Griffin, that's all.
[03:48.030 --> 03:49.570]  And we work with Cryptocat.
[03:49.630 --> 03:52.330]  We've worked a bit with Tor and various and sundry other folks.
[03:53.730 --> 03:56.190]  We don't actually code the tools ourselves, but we do things...
[03:56.190 --> 03:57.190]  In the past, we've given grants.
[03:57.270 --> 04:05.370]  In the past, we've had a peer review board where we've actually had security folks looking at the applications to go, is this as secure as everybody says it is?
[04:05.570 --> 04:06.870]  We may have a machine, actually.
[04:07.310 --> 04:07.710]  Oh.
[04:08.570 --> 04:08.730]  Oh.
[04:09.450 --> 04:10.350]  I guess that one will...
[04:10.350 --> 04:11.010]  See if this one works.
[04:11.010 --> 04:12.950]  See if we can get the cables, the video cable work.
[04:13.590 --> 04:14.050]  Okay.
[04:16.130 --> 04:19.070]  What I'm doing at OpenITP is working on usability.
[04:19.530 --> 04:25.230]  So we are doing user tests downstairs, actually, if anybody is feeling less than technical and has a moment to help out.
[04:25.310 --> 04:33.330]  We'd love to help you figure out how to use LinFone and CSIP Simple, which are both secure voice calling applications for your phone.
[04:35.530 --> 04:35.990]  And...
[04:35.990 --> 04:36.410]  It's not working.
[04:36.730 --> 04:37.450]  That's what?
[04:37.690 --> 04:38.510]  It's not working.
[04:39.750 --> 04:40.150]  No.
[04:40.450 --> 04:40.930]  That's the...
[04:41.550 --> 04:42.610]  That is the cable there.
[04:44.090 --> 04:44.490]  So...
[04:44.490 --> 04:44.690]  Okay.
[04:46.410 --> 04:47.210]  We also...
[04:47.210 --> 04:49.710]  It's been OpenITP managing the...
[04:49.710 --> 04:53.930]  Or not managing, but sponsoring the noisy square space downstairs with the large inflatable chairs.
[04:54.110 --> 04:58.630]  If you have passed out on those chairs, we're glad you're enjoying our time at the...
[04:58.630 --> 05:00.810]  Everybody's like, yay, human comfort.
[05:01.170 --> 05:01.610]  That's great.
[05:02.230 --> 05:07.170]  My meat body is still attached to me, even though I would just like to be a ghost in the machine, and I can't.
[05:07.690 --> 05:08.470]  So, yes.
[05:08.570 --> 05:09.750]  Inflatable chairs for your butt.
[05:10.350 --> 05:11.370]  And other parts of you.
[05:12.210 --> 05:12.550]  Great.
[05:12.910 --> 05:13.390]  Looking good.
[05:14.550 --> 05:14.990]  And...
[05:14.990 --> 05:15.130]  So, right.
[05:17.250 --> 05:18.870]  We have a killer AV team.
[05:18.930 --> 05:19.890]  This AV team is great.
[05:20.290 --> 05:21.550]  It's here for the AV team.
[05:22.690 --> 05:26.110]  These guys have covered my butt so many times on the course of this conference.
[05:26.230 --> 05:26.350]  Right.
[05:26.510 --> 05:31.830]  So, without further ado, James Vasil, executive director of the Open Internet Tools Project.
[05:34.310 --> 05:35.110]  Hello, everybody.
[05:35.570 --> 05:37.870]  I'm so glad that we finally got that together.
[05:38.090 --> 05:38.850]  Sorry for the delay.
[05:40.390 --> 05:45.010]  So, I'm with the Open Internet Tools Project, and I'll tell you a little bit more about what we do in a moment.
[05:45.310 --> 05:48.150]  What we're here for today is to talk about community infrastructure.
[05:50.190 --> 05:50.550]  And...
[05:50.550 --> 05:51.170]  Let's see.
[05:51.230 --> 05:51.610]  Is this working?
[05:51.730 --> 05:52.430]  Yes, it's working.
[05:52.690 --> 05:58.130]  So, if we're going to talk about community infrastructure, I just want to tell you a little bit about what I mean when I say community infrastructure.
[05:58.610 --> 06:04.710]  There's all kinds of infrastructure that we have available in a community to do all kinds of things to serve all kinds of purposes.
[06:04.710 --> 06:08.330]  And when we talk about infrastructure, we're talking about really any mechanism.
[06:09.070 --> 06:12.870]  Anything that can support a project in its ability to get code out the door.
[06:13.250 --> 06:18.370]  And any mechanism that can support a user in their ability to successfully use a project.
[06:19.050 --> 06:29.530]  You know, there's lots of projects, I think, that do really good work, but don't effectively get code to users, where users can actually turn that into workflow that gets them secure communication.
[06:29.990 --> 06:33.410]  So, what we do when we think about infrastructure is we try to bridge those gaps.
[06:33.410 --> 06:42.850]  We look for the pitfalls that programs and projects face commonly throughout our sector, and we try to figure out how we can help them across those common gaps.
[06:43.990 --> 06:48.150]  So, infrastructure and a lot of projects, a lot of projects build infrastructure for themselves, right?
[06:48.230 --> 06:52.910]  They develop workflows, they develop working groups, ways of getting their job done.
[06:52.930 --> 06:55.390]  All of that is infrastructure of one kind or another.
[06:55.750 --> 07:01.930]  The stuff that we talk about when we talk about community infrastructure is infrastructure that is bigger than just one project, right?
[07:01.930 --> 07:10.910]  When you're looking across the entire sector of circumvention tools, of free and open-source software, what are our opportunities to help more than one project at a time?
[07:11.070 --> 07:19.550]  And what are our opportunities to aggregate collaborative energy in order to solve problems so that we fix it for an entire field or for an entire section of a field?
[07:21.010 --> 07:29.450]  The most important thing that we talk about when we talk about community infrastructure is the question of what kind of infrastructure we're building and where this help is coming from.
[07:29.450 --> 07:34.710]  We're big believers at OpenITP in the notion that community infrastructure should really come from the community.
[07:35.230 --> 07:46.730]  And so in this talk, I'm going to talk about how we source help from the people that we're trying to help and from the development community that we're trying to fix problems with as opposed to just fixing them for.
[07:47.450 --> 07:51.410]  You know, the picture at the bottom there says where we're going, we don't need roads.
[07:51.530 --> 07:53.410]  And that's a picture from Back to the Future.
[07:54.710 --> 07:56.670]  And we think of roads as infrastructure.
[07:57.170 --> 07:57.190]  Right?
[07:57.650 --> 08:01.210]  The roads are things that get built for us by government in this country.
[08:02.170 --> 08:04.130]  And that's infrastructure we rely on.
[08:04.210 --> 08:06.730]  Without roads, we don't get to do the things we want to do.
[08:06.810 --> 08:09.530]  We don't get to build the things we want to build and we don't get to achieve our goals.
[08:09.670 --> 08:11.630]  But we don't think about roads on a daily basis.
[08:11.770 --> 08:13.050]  They kind of disappear into the background.
[08:13.250 --> 08:17.770]  Somebody else builds it, somebody else takes care of it, somebody else figures out how to fix it when it's broken.
[08:17.770 --> 08:19.810]  And that's one model of infrastructure.
[08:20.190 --> 08:24.690]  The other model of infrastructure is where you ignore those roads and you blaze your own trail.
[08:24.830 --> 08:25.970]  You build your own infrastructure.
[08:26.410 --> 08:35.070]  And a lot of times projects are in that model, that second model of fixing problems by redesigning their own workflow and redesigning their own stack.
[08:35.290 --> 08:45.990]  And so we're looking at projects that are doing a lot of this building their own roads, and we're seeing a lot of them try to solve the same problem for the nth time that every other project has tackled.
[08:45.990 --> 08:51.190]  And they're all kind of, you know, doing an okay job at it, but a lot of them are not doing a very good job at it, right?
[08:51.210 --> 09:00.230]  A lot of projects are trying to solve the localization problem that every other project has faced and not necessarily able to get over the hurdles because they're trying to do it as just one project.
[09:00.510 --> 09:08.530]  It turns out, you know, roads, we're not going to get roads, but we can't actually just ignore the need for infrastructure that is bigger than one project altogether.
[09:11.590 --> 09:22.250]  So, because we tend to have these two models, this centralized model of infrastructure like GitHub and the blaze-our-own-trail model, we see all these projects that are making the same mistakes time and time again.
[09:22.510 --> 09:26.690]  And what we're trying to do at OpenITP is try to figure out more of a middle ground.
[09:26.930 --> 09:28.610]  So, we're not going to build roads.
[09:28.730 --> 09:30.090]  We're not big enough to build roads.
[09:30.450 --> 09:32.410]  OpenITP is not a government organization.
[09:32.430 --> 09:34.030]  We don't have those kinds of resources.
[09:34.030 --> 09:39.370]  And we're actually not that good at just deciding where the community needs to go and forcing it to go there.
[09:39.550 --> 09:41.070]  We don't know where the roads need to go.
[09:41.330 --> 09:50.650]  So, our model of community infrastructure tends to look more like talking to projects and figuring out what they can do, working with other projects to fix problems.
[09:53.370 --> 09:56.790]  We need infrastructure for a few simple reasons, right?
[09:56.870 --> 10:00.490]  The most important reason why we need infrastructure is that it's really hard to do things one-off.
[10:00.850 --> 10:06.850]  If you do things one-off, you tend to make mistakes, you tend to do them over and over again without learning the lessons you need to learn.
[10:07.590 --> 10:11.330]  And projects, it turns out, need to do a really long list of things to succeed.
[10:11.330 --> 10:24.590]  In order for a project to achieve that rank where we think of them as a successful project, they have to do a very long list of things, a long list of milestones, in order for us to regard them as doing their jobs well.
[10:24.590 --> 10:30.350]  And the things on that list are diverse and require many different skills and vastly different experience.
[10:30.610 --> 10:33.390]  We ask projects to localize, especially in our space.
[10:33.610 --> 10:47.130]  In our space where we're trying to help people, a lot of people who don't speak English as a native language, localization becomes one of those big things where if you make a project, you make a security tool, you make a communication tool, and that thing is only in English,
[10:47.130 --> 10:50.870]  you're not helping people who need it the most on this planet, right?
[10:51.030 --> 10:53.150]  So you've already missed a beat.
[10:53.770 --> 11:01.070]  And projects, a lot of projects don't have language skills on team for every target language they might want to tackle.
[11:01.350 --> 11:03.550]  That's an impossible thing to ask projects for.
[11:04.030 --> 11:05.330]  Same thing with documentation.
[11:05.610 --> 11:08.110]  Writing documentation is not the same skill as writing code.
[11:08.570 --> 11:13.870]  The people who write really good code on your project are not necessarily the people who are going to write really good documentation.
[11:13.870 --> 11:21.410]  In fact, there are a lot of times when I would say whoever's writing the best code on your project should not be writing the documentation, because those people are too close to the code.
[11:22.090 --> 11:24.230]  But we demand that projects write documentation.
[11:24.330 --> 11:25.070]  They have to.
[11:25.230 --> 11:28.030]  If they don't do documentation well, how could they possibly succeed?
[11:30.830 --> 11:32.170]  We need code auditing.
[11:32.590 --> 11:37.590]  Code auditing is a thing that we have asked projects to do and asked projects to do, and it turns out they weren't doing it.
[11:37.850 --> 11:39.030]  They still aren't doing it.
[11:39.690 --> 11:42.110]  And so we started asking projects why they weren't doing it.
[11:42.110 --> 11:45.710]  And it turns out that most projects don't have the expertise on staff.
[11:46.010 --> 11:49.170]  They don't have the people in their community who know how to do that well.
[11:49.370 --> 11:50.830]  And they don't have the time to do it well.
[11:51.030 --> 11:53.850]  So we demand code running because we know that it's important.
[11:54.370 --> 11:58.350]  But at the same time, we're asking projects to do something they don't have capacity to do.
[11:59.050 --> 12:00.970]  We ask people to do code-based management.
[12:01.130 --> 12:03.050]  We ask them to have modern, usable interfaces.
[12:03.410 --> 12:04.770]  We ask them to do user support.
[12:04.950 --> 12:11.910]  If you ship stuff and your users try to use it and they fall down while using it, they have not succeeded and you have not succeeded.
[12:12.330 --> 12:17.070]  But how many open-source projects do you know of that actually have end user support mechanisms?
[12:19.410 --> 12:19.810]  Three?
[12:20.850 --> 12:21.570]  That's pretty good.
[12:21.730 --> 12:24.990]  How many of those projects have effective end user support mechanisms?
[12:26.410 --> 12:26.810]  One.
[12:26.990 --> 12:27.210]  Okay.
[12:28.130 --> 12:29.390]  That's higher than I expected.
[12:29.550 --> 12:32.370]  I mean, you know, end user support turns out to be really hard.
[12:32.570 --> 12:36.910]  You know, and we can laugh about projects doing a bad job of end user support.
[12:36.910 --> 12:41.030]  But the truth is, you know, laughing at projects is not going to make them do any better.
[12:41.350 --> 12:44.930]  We can do all the finger waving and all the head shaking and all the tits, tits, tits.
[12:44.990 --> 12:49.990]  But none of that actually gets projects over the hurdle of providing those services.
[12:49.990 --> 12:54.730]  This full range of services that you would actually need to provide in order to really help people.
[12:55.290 --> 13:03.830]  I mean, think about how wide a band of expertise and resources it takes to do this entire list of things.
[13:03.830 --> 13:04.310]  Right?
[13:04.390 --> 13:05.530]  And this is just the tip of the iceberg.
[13:05.710 --> 13:09.530]  I mean, I made this list in two minutes while I was writing up this slide.
[13:09.690 --> 13:16.070]  But actually, the number of things successful projects are doing on a daily basis is much longer than this.
[13:16.430 --> 13:20.370]  And you know, every single one of those projects that are doing it well didn't do it well on day one.
[13:20.750 --> 13:25.950]  Those projects went through a period of time where they were struggling with each one of these milestones.
[13:25.950 --> 13:31.790]  And trying to figure out how they were going to develop process and infrastructure that would allow them to hit these milestones.
[13:32.610 --> 13:38.490]  And it took them time to do it and they failed a bunch and eventually, you know, they get big enough that they can do some of this stuff.
[13:38.690 --> 13:42.110]  You know, look at the Tor project or, you know, Apache or Debian.
[13:42.510 --> 13:48.510]  Those projects are big and well resourced relative to all the other projects and they're still struggling to hit all these marks.
[13:48.510 --> 13:49.030]  Right?
[13:49.130 --> 13:52.270]  They're still, you know, they're doing a much better job than most everyone else.
[13:52.450 --> 13:58.890]  But they're not doing the job that we need them to do in order to actually reach every user that we want them to reach.
[13:59.610 --> 14:01.190]  So projects can't do all these things.
[14:01.530 --> 14:02.650]  They can't do them alone.
[14:03.030 --> 14:05.070]  Even the big ones struggle to do them well.
[14:05.290 --> 14:13.490]  And so we're never going to get successful open-source software if we continue to ask projects to solve this set of problems one project at a time.
[14:13.490 --> 14:23.390]  It's a recipe for failure and it's a big reason why open-source software has not dominated the end user market in the way that we all thought it would, you know, 10 or 12 years ago.
[14:27.130 --> 14:30.970]  So, you know, that's the community that you guys have, right?
[14:31.070 --> 14:31.970]  That's the community we have.
[14:32.110 --> 14:42.810]  All these projects out there that we can observe that are doing stuff, they're operating in a manner that is not designed for success because they're dealing with just the constraints of trying to get their stuff out the door.
[14:43.210 --> 14:49.570]  But I really also want to talk about me because I'm the one standing up here in the front of the room and I want you to pay more attention to me.
[14:51.010 --> 14:59.530]  So, I, you know, my background in the open-source world, you know, goes back to the late 90s when we were just sharing code because we thought it was fun.
[15:00.450 --> 15:02.510]  Writing projects together because it was interesting.
[15:02.870 --> 15:05.730]  And it turns out that I'm not actually that good at writing code, right?
[15:05.730 --> 15:08.290]  You know, I can write a shell script occasionally.
[15:08.590 --> 15:11.330]  I can look at code and tell you if it's got an obvious bug.
[15:11.710 --> 15:15.670]  But I'm not the person who's going to re-engineer your architecture.
[15:15.670 --> 15:16.750]  That's just not my bag.
[15:16.830 --> 15:17.550]  And that's okay.
[15:17.810 --> 15:22.490]  It turns out there are other ways that I have tried to be useful within the world of free software.
[15:22.490 --> 15:28.650]  And what I've done is, you know, really fill myself into a support role around free software.
[15:28.810 --> 15:32.070]  And that has largely meant trying to build infrastructure.
[15:32.450 --> 15:42.550]  And so when I started building infrastructure in this way, I joined up with other people who managed to find resources to create stuff like the Software Freedom Law Center and the Software Freedom Conservancy.
[15:42.870 --> 15:49.890]  You know, we tried to design structures that would just be service providers to the hacker community.
[15:49.890 --> 15:55.250]  We tried to just make it turnkey for people to come to us, ask us questions, come to us, ask us for services.
[15:55.250 --> 15:56.410]  We would provide services.
[15:56.430 --> 15:57.190]  We would provide help.
[15:57.290 --> 15:58.130]  We would provide answers.
[15:58.690 --> 16:00.570]  And we built infrastructure together, right?
[16:00.650 --> 16:07.410]  We worked on GPL v3 to make that license the next, you know, modern version of GPL so that the community could actually use it.
[16:07.650 --> 16:12.550]  We built the Conservancy as a physical sponsorship organization, right?
[16:12.550 --> 16:23.650]  That's a monolithic structure, a central piece of infrastructure where we take the financial services burden off of projects by doing it for those projects.
[16:23.770 --> 16:25.690]  And I shouldn't say we because I'm not associated with it anymore.
[16:25.810 --> 16:35.130]  But they get the expertise of having people who know how to manage accounts and how to do accounting and how to handle all the tax stuff so that projects don't have to do it.
[16:35.350 --> 16:36.270]  That's infrastructure.
[16:36.370 --> 16:42.110]  That's the kind of infrastructure that takes things off the plates of projects so that they don't have to worry about that stuff anymore.
[16:42.830 --> 16:44.250]  And that's great, right?
[16:44.310 --> 16:46.090]  That's one kind of infrastructure.
[16:46.390 --> 16:47.330]  But that's roads.
[16:47.670 --> 16:55.690]  You know, those kinds of projects are well-resourced, they're expensive to run, and they don't scale that well.
[16:56.170 --> 16:58.270]  The Conservancy is a great project.
[16:58.370 --> 16:59.310]  I love the Conservancy.
[16:59.470 --> 17:02.970]  But they have a limit to the number of projects that they can take in the door.
[17:03.130 --> 17:08.550]  They're resource-limited by the fact that, you know, it takes a lot of expertise to provide those services.
[17:08.550 --> 17:17.650]  And because the expertise that is needed to run the Conservancy is not widespread in our community, they can't just turn to the community for help to scale it.
[17:20.360 --> 17:36.680]  So after working in that sort of environment of building centralized, monolithic, you know, expertise-heavy, resource-heavy, money-heavy infrastructure that I think does a good job of helping people, I looked around the community, and I started thinking a lot about what was still missing.
[17:38.160 --> 17:44.920]  And a couple years ago, I ended up here at HOPE, you know, for the nth time, coming to HOPE and talking to people about how we can solve these problems.
[17:45.140 --> 17:50.960]  And I ended up giving a talk on just improving the landscape of anti-censorship and anti-surveillance tools.
[17:50.960 --> 17:59.120]  And during that talk, you know, I really was focused on how we fix the user interface problem and how we fix the localization problem.
[17:59.660 --> 18:08.440]  And I stood in this room and I said, we're going to fix this stuff, which was an incredibly naive thing to say and an incredibly arrogant thing to say.
[18:08.540 --> 18:15.260]  But I really thought that if we started to build some community structure around this, we could collaborate to fix some of these problems.
[18:15.260 --> 18:20.580]  And it turns out HOPE people are some of the most proactive and helpful people around.
[18:21.320 --> 18:26.640]  And afterwards, I got a long line of people who were happy to talk about how they could pitch in and help.
[18:27.620 --> 18:30.540]  But I didn't really know where we were going or what we were doing.
[18:30.680 --> 18:32.480]  And so I was not effective at using that help.
[18:32.620 --> 18:38.820]  We got some really good ideas and we started to turn it into what we eventually built.
[18:39.200 --> 18:41.440]  But, you know, HOPE was where it all started.
[18:41.440 --> 18:48.240]  And I really just wanted to say thank you to the HOPE community for making that piece of it the crucial step in getting these projects off the ground.
[18:49.880 --> 18:53.580]  So, after HOPE, you know, I was like, hey, this is a really good idea.
[18:53.700 --> 18:54.720]  We should do something about this.
[18:54.900 --> 18:57.480]  And I ended up speaking at Software Freedom Day.
[18:57.900 --> 19:07.180]  And instead of talking to, you know, the proactive HOPE type of hacker, I was talking to the Software Freedom community of software developers.
[19:07.180 --> 19:18.480]  And when I explained to software developers that we could stop writing code and just redesign all our interfaces, just redesign the way people use our products, they didn't lynch me, which I was really happy about.
[19:18.700 --> 19:22.900]  But none of those developers actually jumped up to get on board the train.
[19:23.040 --> 19:28.660]  And that was the crucial difference between talking to the HOPE community and talking to certain other communities.
[19:28.660 --> 19:34.280]  And so it just made me appreciate how we have very different facets in the world that we're operating in.
[19:34.420 --> 19:37.220]  And we're going to have to work with many different communities to get this stuff done.
[19:38.080 --> 19:40.480]  And finally, I couldn't shut up about this.
[19:40.480 --> 19:44.740]  And I went all the way across the country to invite other free software people.
[19:44.740 --> 19:58.200]  I thought maybe those weird people on the other coast would be more interested as a free software community in helping us figure out how to focus on usability and localization in this space.
[19:59.420 --> 20:15.800]  And the nice thing about going to a completely different community where I literally didn't know anybody there, you know, I have never been to Portland before, was everyone, you know, nobody had any sort of preconceived notions about the work that I do or about the stuff that I was talking about.
[20:15.800 --> 20:21.040]  And this was just when people were starting to really pay attention to circumvention tools.
[20:21.300 --> 20:30.000]  So in Portland, the interesting thing about talking to people there was really that everybody was willing to help.
[20:30.280 --> 20:36.000]  Everybody had ideas of what we could do, but nobody could point to any structures we could build on.
[20:36.180 --> 20:42.300]  Nobody was able to point to the people that were already doing this on a wider than one project basis.
[20:42.480 --> 20:45.620]  And so that kind of became the nucleus of what we were going to do.
[20:45.620 --> 20:49.280]  We were going to figure out how to build structure across projects.
[20:49.780 --> 20:51.700]  And like I said, we had no idea how to do this.
[20:51.880 --> 20:54.600]  We still, you know, are not going to say that we know what we're doing.
[20:54.900 --> 20:57.220]  What we're going to say is that we did some experiments.
[20:57.880 --> 21:04.780]  We, in the last couple of years, have run two experiments building two kinds of infrastructure for the community.
[21:05.140 --> 21:08.400]  And one of those projects went really, really well.
[21:08.680 --> 21:13.540]  The other project went middling well and then I think failed to quite achieve liftoff.
[21:13.540 --> 21:16.400]  But we learned a lot from running those projects.
[21:17.000 --> 21:24.640]  And so this is my coming back to HOPE and saying this is what I learned from the journey that I've been on that started at HOPE a couple of years ago.
[21:25.540 --> 21:28.320]  And I don't know who that dog is, but he looks pretty smart.
[21:31.520 --> 21:34.500]  The first experiment is the peer review board.
[21:35.220 --> 21:48.860]  And, you know, we set out to do an experiment that was, can we build a piece of infrastructure that has some of the qualities of centralized infrastructure?
[21:48.860 --> 21:59.980]  Meaning well-resourced, full of experts, able to provide service to a community on a service basis where people come in the door and we treat them kind of like clients.
[22:01.900 --> 22:07.160]  And turn it around so that they get what is essentially an experience of acting with a community.
[22:07.580 --> 22:08.940]  So let's talk about how that went.
[22:08.940 --> 22:15.540]  So everybody here is aware that security audits are a big deal, right?
[22:15.640 --> 22:20.160]  It's a topic of conversation that people have been increasingly interested in in the last couple of years.
[22:20.440 --> 22:24.480]  Free software has this great property that anyone can look at it.
[22:24.620 --> 22:32.740]  And we tell this story that free software is more secure because anyone can look at the code and they'll find the bugs.
[22:32.740 --> 22:39.460]  All the bugs are just there to be found for the looking, you know, like little nuggets of gold to be collected up and polished.
[22:40.480 --> 22:42.680]  And unfortunately, it turns out nobody's looking.
[22:43.140 --> 22:48.520]  If you were to count up all the eyeballs that looks at the code, you would get somewhere between zero and one.
[22:48.820 --> 22:51.760]  Not even two eyeballs, one eyeball, right?
[22:51.880 --> 22:54.960]  And that was bad when it came to something like Heartbleed.
[22:55.340 --> 22:59.160]  And it's bad when it comes to something like, you know, LibPurple.
[22:59.160 --> 23:02.500]  We don't know what's lurking in our own code.
[23:03.000 --> 23:05.160]  And we tell a story about it.
[23:05.280 --> 23:06.340]  And the story is false.
[23:06.740 --> 23:11.160]  The story of we know what we're running because it's open-source software is...
[23:11.780 --> 23:18.560]  It's a comforting tale that we tell to ourselves so that we can feel okay about running stuff that we can't actually trust.
[23:18.920 --> 23:25.500]  And that's, you know, I tell that story to myself every day when I lay my head on my pillow at night so that I can sleep.
[23:25.500 --> 23:31.760]  But when I wake up in the morning, I really do try to remind myself that it is really a fairy tale.
[23:32.080 --> 23:33.680]  So we have software.
[23:33.740 --> 23:34.900]  We can look at it.
[23:35.040 --> 23:36.780]  We're not effectively looking at it.
[23:37.180 --> 23:44.580]  Even to the extent that people are reading that code, they're not able to do an effective audit, right?
[23:44.680 --> 23:46.700]  Audits are really, really hard.
[23:47.020 --> 23:54.700]  Looking at code from the perspective of somebody who is looking for security bugs is completely different than looking at code for other purposes.
[23:55.640 --> 24:02.320]  When you are looking at code and looking for security vulnerabilities, that's not the normal reading code and hunting for bugs.
[24:02.840 --> 24:04.600]  You put on a different mindset.
[24:04.860 --> 24:06.100]  You're wearing a different hat.
[24:06.360 --> 24:10.260]  It takes expertise and it takes security.
[24:11.040 --> 24:15.800]  You know, we worked a lot with Eleanor Saita, who has a lot of experience in this area.
[24:15.800 --> 24:26.020]  And she estimated that for somebody to be a competent, not a good or a great security researcher in this area, an auditor in this area, just competent.
[24:26.320 --> 24:34.820]  She estimated that it would take about three years of full-time work with colleagues that are expert enough that you are learning from them on a daily basis.
[24:35.520 --> 24:37.220]  Now that's a lot of expertise.
[24:37.660 --> 24:42.920]  The number of people in our community who have that expertise is very, very small.
[24:43.200 --> 24:45.820]  So it takes a long time to learn how to do this stuff well.
[24:46.200 --> 24:55.440]  And even if you know how to do it, the amount of time it takes to read the code and learn how to do it well, and actually do it well, is also very long.
[24:56.660 --> 24:59.660]  And finally, you know, security audits are an obstacle to shipping.
[24:59.920 --> 25:05.020]  Every project hits that point where they can either ship the stuff that has not been audited or not ship.
[25:05.820 --> 25:10.820]  And the number of projects that will choose not to ship is very, very low.
[25:11.380 --> 25:14.240]  There are a couple, but there aren't enough.
[25:14.820 --> 25:17.520]  So auditing is this huge obstacle to shipping.
[25:17.540 --> 25:21.500]  It's a huge obstacle because you don't have the resources to get it done.
[25:21.960 --> 25:24.820]  And it turns out this is just a human resources issue.
[25:25.360 --> 25:26.500]  You don't have the people.
[25:26.840 --> 25:28.240]  You don't have enough of the people.
[25:28.480 --> 25:29.520]  The people don't have time.
[25:31.700 --> 25:44.780]  So because we're living in a world where projects don't have the audits that they need and don't have the ability to get the audits that they need, we can't turn to those projects and say, Hey, why don't you go do an audit?
[25:45.180 --> 25:47.400]  Or, Hey, you didn't do an audit.
[25:47.540 --> 25:48.060]  Shame on you.
[25:48.060 --> 25:51.180]  None of that conversation makes any difference.
[25:51.540 --> 26:06.320]  All of the work that we've done to, say, to socialize people around audits, to make audits a thing that people feel like they should be doing, to make them feel like they should not ship without an audit, has not actually resulted in more audited code.
[26:06.520 --> 26:10.800]  What it's resulted in is more people feeling kind of guilty about what they're shipping.
[26:11.500 --> 26:12.700]  And that's not useful.
[26:12.880 --> 26:15.040]  That hasn't helped anyone do anything.
[26:15.040 --> 26:19.600]  That has not helped anyone take any of this work forward at all.
[26:21.620 --> 26:32.380]  So, our response to the situation, Ella's and mine and OpenITPs and everyone working there, was to realize that we weren't going to just crowdsource auditing.
[26:33.020 --> 26:34.960]  There are a few good auditors in our community.
[26:35.160 --> 26:39.300]  But man, they're also, you know, overworked and they get asked to do stuff on a daily basis.
[26:39.300 --> 26:43.460]  So we decided to try to pull in auditors from the commercial sector.
[26:44.260 --> 26:57.060]  And what that meant was we were going to have to pay not quite commercial rates for auditing services, but we're going to have to pay more than, you know, getting people in our community to do stuff at the friend rate.
[26:57.060 --> 27:01.620]  We were going to pay, you know, very expensive people at a slight discount.
[27:03.100 --> 27:06.840]  And we also realized that we were going to need a process to manage those audits.
[27:07.420 --> 27:12.300]  Because we wanted whatever we were doing to be a community, a piece of community infrastructure.
[27:12.560 --> 27:17.740]  And what that meant was that there had to be due process around finding bugs, disclosing bugs.
[27:17.880 --> 27:30.520]  There had to be a standard way of treating projects when they come in the door and a standard way of dealing with vulnerabilities when we found them And also, that we were gonna have to close the loop on making sure those vulnerabilities actually got fixed.
[27:30.520 --> 27:37.160]  So there are some projects out there, most notably the Open Technology Fund, that have just been paying for audits, right?
[27:37.260 --> 27:42.120]  Hiring commercial services directly for projects and paying for audits and you get an audit report, and that's great.
[27:42.840 --> 27:54.460]  We wanted to do one step further, which was to layer on a mechanism that actually helps projects negotiate the process and finish the hard work of fixing those bugs.
[27:54.460 --> 28:01.460]  And also managing disclosure, helping them manage the process of getting notification to vulnerable parties if needed.
[28:01.740 --> 28:08.060]  All of the kinds of things that come along with a professional audit, but aren't necessarily included in the fee that you give your auditor.
[28:12.240 --> 28:13.720]  So, we built it.
[28:13.980 --> 28:17.740]  We made the structure that does the audits.
[28:18.060 --> 28:24.340]  We assembled a diverse team, you know, diverse in skill set, in gender, in ethnicity.
[28:24.340 --> 28:33.020]  We did what we could to make sure we had representatives from different parts of the community working together to figure out what an audit plan looks like.
[28:33.220 --> 28:35.600]  We raised some money to pay industry auditors.
[28:36.500 --> 28:41.040]  We built a process, a very elaborate process, to manage those audits.
[28:41.140 --> 28:42.880]  And we even did an audit.
[28:43.220 --> 28:44.000]  Only one.
[28:44.180 --> 28:49.940]  But we did it as our first audit to make sure that we knew how to do it and that we could show people what we were doing.
[28:50.600 --> 28:55.140]  And that was a... that took us about a year, believe it or not.
[28:55.400 --> 28:58.880]  Well, primarily because we're all doing other things in the midst of doing this.
[28:59.080 --> 29:05.660]  But also because it turns out that every time we examined the problem, there was a new wrinkle we hadn't actually anticipated.
[29:06.080 --> 29:07.540]  Building process is hard.
[29:08.080 --> 29:15.940]  And asking projects to do it one by one and having them run up against all these problems and not being able to solve them wouldn't work.
[29:15.940 --> 29:18.520]  So we took the time to try to solve these problems one by one.
[29:18.700 --> 29:20.200]  But it did take a lot of time.
[29:21.780 --> 29:22.840]  So we did an audit.
[29:23.400 --> 29:26.980]  We squeaked to that finish line and then we ran out of road.
[29:27.700 --> 29:31.540]  It turns out we spent too much time and too much money.
[29:32.020 --> 29:39.800]  And just as we were at the point where we had a turnkey way to crank audits through, we ran out of funding to do more audits.
[29:39.800 --> 29:43.680]  And so we're at a point where we can do audits.
[29:44.240 --> 29:48.040]  And we can turn that around for people in a reasonable length of time.
[29:48.260 --> 29:49.800]  But we can't actually pay for them.
[29:50.020 --> 29:52.940]  And so projects that want audits have to bring funding to us.
[29:53.060 --> 29:54.240]  Which is a major obstacle.
[29:54.500 --> 29:59.380]  Because projects don't actually have the tens of thousands of dollars it takes to do an audit most of the time.
[30:01.480 --> 30:02.520]  So what did we learn?
[30:02.760 --> 30:04.100]  We took a project.
[30:04.320 --> 30:05.020]  We built a structure.
[30:05.200 --> 30:05.940]  The structure is good.
[30:06.080 --> 30:06.820]  The structure works.
[30:06.820 --> 30:08.100]  It has good results.
[30:08.880 --> 30:11.580]  But the project didn't quite achieve liftoff.
[30:11.660 --> 30:12.700]  We ran out of road.
[30:13.740 --> 30:20.540]  So we learned that, you know, we probably would have been better getting out the door with something that didn't work.
[30:21.760 --> 30:26.240]  Quick and dirty that ships beats perfection that sits on a shelf, right?
[30:26.340 --> 30:29.320]  We let perfection be the enemy of the good.
[30:30.440 --> 30:31.980]  And that's not a new lesson.
[30:32.080 --> 30:33.060]  We all know that lesson.
[30:33.380 --> 30:38.300]  But we thought when it came to process that we really needed to nail the process down.
[30:38.620 --> 30:40.040]  And we did, I think.
[30:40.220 --> 30:41.880]  But we should have shipped sooner.
[30:42.060 --> 30:43.080]  We needed to ship sooner.
[30:43.860 --> 30:51.240]  If we had done audits, even if they weren't great audits, I think we would have been able to attract the funding that got us to the next stage.
[30:52.160 --> 30:55.540]  And, you know, you see the picture I have there of Steve Ballmer.
[30:55.680 --> 30:58.120]  Because he had a thing where he jumped around on stage.
[30:58.120 --> 31:01.220]  And he shouted, developers, developers, developers!
[31:01.680 --> 31:02.980]  And everyone made fun of him.
[31:03.060 --> 31:04.900]  So I'm not going to mimic what he did.
[31:05.000 --> 31:10.200]  But I will say that the passion he feels for developers is exactly how I feel about community.
[31:10.860 --> 31:23.300]  Because the big mistake that we made in the peer review board was that we built a thing with a diverse panel of experts, even though they were experts from our community, but we didn't actually build a community.
[31:23.940 --> 31:37.860]  We built a top-heavy structure that was going to teach people how to do audits, that was going to take our learned experience and hand it down to a bunch of people who don't know how to do this stuff.
[31:38.940 --> 31:40.860]  And there was some necessity to do that, right?
[31:40.980 --> 31:42.220]  This does take real expertise.
[31:42.680 --> 31:48.780]  But the cost, the cost of doing things in this top-down way, is that we are less stable.
[31:49.400 --> 31:53.700]  We didn't have a bunch of people ready to pick up the slack when the audit funding ran out.
[31:53.900 --> 31:59.200]  We didn't have a bunch of people helping to push this over the top when we started losing momentum.
[31:59.200 --> 32:04.620]  And we didn't have anybody helping us make a case to more funders in order to keep the thing going.
[32:04.940 --> 32:15.640]  So what happened was, we built a thing that we intended to be this really community-oriented process, and community was on the roadmap.
[32:16.000 --> 32:17.320]  We just didn't quite get there.
[32:18.120 --> 32:25.560]  So that's the sadness for me, is that we didn't quite get to the community part, and really what we should have done is build the community part in from the beginning.
[32:25.720 --> 32:29.520]  We needed to involve more people and open our process earlier than we did.
[32:30.260 --> 32:39.300]  So that is the big lesson from the peer review board, is that you can build community structure, but you have to start with the community.
[32:39.500 --> 32:40.480]  You can't end up there.
[32:40.920 --> 32:42.880]  So community, community, community.
[32:43.040 --> 32:46.760]  I won't jump up and down, but I will say it many times in this talk.
[32:49.200 --> 32:50.640]  So that was the peer review board.
[32:52.200 --> 32:55.360]  We did another thing, a more successful thing.
[32:56.160 --> 32:58.280]  And that was the localization management project.
[32:58.400 --> 33:06.900]  I talked earlier about how localization is this huge problem for especially us that are trying to help people who don't speak English as a native language.
[33:07.500 --> 33:18.600]  And the communication, the miscommunication that goes on between the people making tools and the people using tools is kind of this giant marsh of epic failure.
[33:18.860 --> 33:31.280]  It's this big problem where we make stuff, we have some intentions around it, we describe those intentions in words that nobody reads for a variety of reasons, including that they are not native English speakers.
[33:32.720 --> 33:40.360]  And because our target users often don't speak English as a native language, they can't understand our words, they can't understand the tools.
[33:40.360 --> 33:46.260]  And if you cannot understand a communications tool, a security tool, you're not going to be able to use it.
[33:46.580 --> 33:50.980]  And misusing security tools, especially security tools, can be dangerous.
[33:51.500 --> 33:52.800]  So this is the problem.
[33:53.380 --> 33:56.540]  We actually, you know, we host a lot of events at OpenITP.
[33:57.200 --> 34:00.220]  And we do them in various countries and we go to a lot of conferences.
[34:00.440 --> 34:03.220]  And one of the things I always do is I talk to people about what tools they're using.
[34:03.440 --> 34:06.840]  And I always ask them why they're using it and what their biggest obstacles are.
[34:06.840 --> 34:18.860]  And whenever we talk to users from the Middle East, the language barrier was one of the first two things mentioned about every single tool.
[34:19.520 --> 34:22.360]  Was, you know, my English isn't that great.
[34:22.700 --> 34:26.060]  Or, you know, and you would often... people would say this to you in perfect English.
[34:26.260 --> 34:27.440]  My English is not that great.
[34:28.500 --> 34:31.500]  And sometimes it's just confidence, right?
[34:31.500 --> 34:40.900]  And sometimes it's just that when you get down to technical language, the experience that people have does not give them the ability to follow what you're doing.
[34:41.760 --> 34:46.180]  So needing to translate tools is a very obvious thing.
[34:46.280 --> 34:48.500]  And every project knows that they have to do it.
[34:48.920 --> 34:52.660]  So we, you know, we started trying to figure out what a solution looked like.
[34:53.180 --> 35:00.340]  Now, again, being at the Open Internet Tools project, every day somebody says to me, Wow, what you guys do sounds really interesting.
[35:00.500 --> 35:01.960]  There seems to be people we should be helping.
[35:02.120 --> 35:02.960]  How can I get involved?
[35:03.500 --> 35:06.400]  And a lot of those people say, Well, I don't have any skills.
[35:06.420 --> 35:07.100]  I'm not technical.
[35:07.180 --> 35:08.080]  I don't write any code.
[35:08.540 --> 35:16.940]  You know, and they miss the big contribution they could be making, which is that they have cultural knowledge and they have linguistic knowledge.
[35:17.080 --> 35:17.880]  They have skills.
[35:18.160 --> 35:19.200]  Skills that we lack.
[35:19.520 --> 35:25.080]  You know, we could not possibly cover every culture and language that we need to in order to work on these tools.
[35:25.660 --> 35:34.340]  And for a long time, people that describe themselves as unskilled, but actually had vital skills to offer, had no entry point into our community.
[35:34.540 --> 35:35.660]  They had no way to help.
[35:35.960 --> 35:39.800]  People would say this to me and I would say, Oh, that's, you know, that's too bad.
[35:40.000 --> 35:40.400]  Right?
[35:40.500 --> 35:45.520]  I wish I knew how to take what you have and turn that into productivity that helps people.
[35:45.660 --> 35:47.680]  But we didn't have a way to do it.
[35:47.800 --> 35:56.160]  So there was this huge community of people who speak all these languages and have all these skills and we were not going to take advantage of it.
[35:56.340 --> 36:01.060]  The good news for us, though, was it meant we didn't have to create a community out of nothing.
[36:01.320 --> 36:03.780]  There were all these people just waiting to be organized.
[36:06.060 --> 36:08.220]  These people, you know, who are they?
[36:08.480 --> 36:13.300]  They are expats and native speakers from their home country.
[36:13.620 --> 36:13.700]  Right?
[36:13.860 --> 36:23.220]  The thing about trying to make tools for people who live in difficult circumstances is a lot of people who live in those circumstances leave and seek better circumstances.
[36:23.580 --> 36:29.240]  And there's a huge expat community from most of the countries and most of the societies that we're trying to reach.
[36:30.080 --> 36:41.660]  Reaching out to those communities was one of the first steps in finding people who could teach us enough about how to talk to the people that they need to talk to so that we could actually provide some help.
[36:42.120 --> 36:47.660]  And for a lot of people, helping your friends back home is a big reason why you're getting involved.
[36:47.660 --> 36:53.280]  I mean, we all sort of get involved in free software for our own personal reasons, but that's a pretty personal reason.
[36:53.440 --> 36:57.520]  Helping people who are living in circumstances that you used to live in.
[36:58.640 --> 37:03.880]  So the pitch around come help us localize was the easiest pitch in the world.
[37:04.280 --> 37:04.720]  Right?
[37:04.960 --> 37:10.040]  In the free software world, we're always like strategizing about how to recruit people and how to get more volunteers.
[37:10.540 --> 37:12.060]  We didn't have to do that here.
[37:12.200 --> 37:21.640]  It turns out that just by talking to people and saying that we thought maybe they could possibly help out in this way that people jumped at the chance to join up.
[37:21.820 --> 37:24.680]  All we needed to do was give them a place to gather.
[37:25.540 --> 37:27.700]  And so, you know, we sought volunteers.
[37:27.700 --> 37:29.020]  We said, hey, come.
[37:29.240 --> 37:29.960]  We went out.
[37:30.000 --> 37:30.860]  We talked to conferences.
[37:30.860 --> 37:32.060]  We talked to our friends.
[37:32.540 --> 37:35.140]  We did a lot of one-on-one recruiting.
[37:35.600 --> 37:39.200]  You know, Dragana Korin, who was the person who primarily worked on this at OpenITP.
[37:40.500 --> 37:47.080]  Basically, everybody she talked to who had any kind of accent at all, she would ask them, where is that accent from?
[37:47.460 --> 37:48.800]  You know, where are you from?
[37:48.860 --> 37:52.920]  And would you like to help us talk to the people who come from where you're from?
[37:54.700 --> 37:58.320]  In less than a year, or about a year, I should say, we had over a thousand people.
[37:58.820 --> 38:03.320]  A thousand volunteers in a year for a project in the free software world is pretty good.
[38:03.320 --> 38:04.200]  Right?
[38:04.480 --> 38:08.540]  I've never gotten a thousand software developers to volunteer for something.
[38:08.800 --> 38:11.600]  I've never gotten a thousand UX designers to volunteer for anything.
[38:11.860 --> 38:14.860]  But a thousand localizers, that turned out to be pretty easy.
[38:15.640 --> 38:17.380]  So, we were on to something, right?
[38:17.640 --> 38:19.720]  You know, community that already exists.
[38:19.960 --> 38:23.380]  Community that looks like the kinds of people that we're trying to help.
[38:23.560 --> 38:27.780]  Community that includes people from every walk of life and every background that we might need to talk to.
[38:28.700 --> 38:33.300]  Starting to gather in one place to talk about how they're going to improve towards.
[38:37.810 --> 38:42.600]  We needed a way to connect these people to the work, right?
[38:42.730 --> 38:45.030]  These are people who describe themselves as unskilled.
[38:45.910 --> 38:49.330]  These are people who don't spend a lot of time in text editors.
[38:49.730 --> 38:52.500]  These are people who don't spend a lot of time at the command line.
[38:53.000 --> 38:56.640]  And we needed a way for those people to work with source code.
[38:57.350 --> 38:59.390]  And we turned to TransFX.
[38:59.560 --> 39:05.820]  The Open Technology Fund, bless their hearts, licensed TransFX for us so that we have a tool, a translation platform.
[39:06.390 --> 39:12.370]  This is a website that allows you to translate lots of stuff in a crowd-organized way very quickly.
[39:12.810 --> 39:15.540]  TransFX has been good for us on that basis.
[39:16.390 --> 39:19.700]  Now, TransFX wasn't really meant for communities, which was kind of an obstacle.
[39:19.700 --> 39:21.230]  And we can't change it.
[39:21.520 --> 39:27.620]  You know, we can't go in and change the code of TransFX and improve it because we don't host it, we don't serve it, and it's not free software.
[39:28.250 --> 39:29.790]  But, you know, it's pretty good.
[39:30.140 --> 39:32.080]  And we're kind of locked into TransFX.
[39:32.500 --> 39:36.620]  You know, we've moved a whole bunch of people to TransFX and are doing work with them there.
[39:36.620 --> 39:45.020]  And if we need to leave TransFX, there will be some major cost in changing providers, you know, booting up our own system or whatever it is we want to do.
[39:45.200 --> 39:46.850]  So we're a little bit locked into TransFX.
[39:48.020 --> 39:49.060]  And that's a problem.
[39:50.000 --> 39:52.370]  Because TransFX is kind of expensive.
[39:53.000 --> 40:00.540]  You know, the license fee for TransFX would surprise you if you were to think about what you're getting and what you're paying for it.
[40:00.540 --> 40:04.730]  You know, it's a website that does some data management and some workflow management.
[40:05.290 --> 40:08.790]  And they do it well, which is why they managed to get those fees.
[40:09.180 --> 40:15.200]  But paying that TransFX license is a major part of the expense of running a project like this.
[40:15.700 --> 40:20.020]  And TransFX itself is not a community-based or community-oriented solution.
[40:20.230 --> 40:21.730]  It's just, you know, they're a business.
[40:22.040 --> 40:30.520]  So in the midst of doing all this community organizing stuff, we ended up with a expedient dependency on something that doesn't work.
[40:30.540 --> 40:32.250]  very community-oriented at all.
[40:33.080 --> 40:38.330]  And, you know, that's going to be a thing that we'll have to cope with over time.
[40:38.640 --> 40:42.040]  But it's not going to be a thing that stops us, I hope.
[40:42.910 --> 40:44.100]  But we do have to deal with it.
[40:44.140 --> 40:46.200]  And I'll talk a little bit more about that in a moment.
[40:46.450 --> 40:48.430]  So we boot up this project.
[40:48.460 --> 40:49.200]  It's got a workflow.
[40:49.310 --> 40:50.450]  It's a community-based workflow.
[40:50.460 --> 40:53.040]  We've got a platform that does translation.
[40:53.390 --> 40:56.660]  But we don't have a platform for communication, right?
[40:57.870 --> 41:01.660]  We're getting requests from projects to ship a release.
[41:01.980 --> 41:05.020]  And they dump a pile of strings on the localization team.
[41:05.140 --> 41:11.730]  The localization team emails a bunch of people or contacts them on TransFX and says, hey, could you translate this with us?
[41:12.080 --> 41:16.060]  Occasionally, they hire translators to fill in some gaps, professional translators.
[41:16.060 --> 41:25.290]  And the crowd converges on a pile of strings and turns them into localized versions in whatever target languages we need.
[41:26.250 --> 41:29.120]  And that model of working...
[41:29.120 --> 41:34.830]  So, and this is where we learned a little bit about community, was that it's urgent, right?
[41:34.910 --> 41:36.160]  We're going to ship in three weeks.
[41:36.290 --> 41:38.020]  We need people to crank on this.
[41:39.100 --> 41:49.390]  Constantly urging people to work really quickly to hit a release date by giving them a last-minute assignment turns out not to be great for keeping volunteers, right?
[41:49.520 --> 41:50.660]  People get fatigued.
[41:50.870 --> 41:52.890]  They'll come back, but they won't work as hard.
[41:53.120 --> 41:56.730]  You know, they'll start to feel a little bit unhappy about their work with us.
[41:57.060 --> 42:03.330]  We have recently done more paid translation on the localization project than we were doing earlier.
[42:03.390 --> 42:12.500]  And I don't quite know whether that's because we're hitting the limits of our volunteer base or whether, you know, that's just the nature of the work in this cycle.
[42:12.730 --> 42:21.370]  But I suspect that one of the issues we're hitting is that we're running our volunteers a little bit ragged, even with as many volunteers as we have.
[42:21.500 --> 42:24.480]  So constant urgency is a fatigue factor.
[42:24.640 --> 42:30.770]  And we need to do something that looks a little bit more like continuous workflow as opposed to milestone-driven fire drills.
[42:33.020 --> 42:35.850]  So the project as a whole, I would say, is a success.
[42:35.850 --> 42:37.290]  It's over a thousand localizers.
[42:37.480 --> 42:38.640]  We've covered our key languages.
[42:38.950 --> 42:40.350]  You know, Farsi, Mandarin.
[42:40.750 --> 42:44.660]  I don't know how many languages are even on there, but I would venture to say it's over a dozen.
[42:45.660 --> 42:50.140]  There are major projects using the localization services that we produced.
[42:50.450 --> 42:51.410]  You know, Tor uses it.
[42:51.520 --> 42:52.770]  The Guardian project uses it.
[42:53.100 --> 42:57.960]  We're rather proud that some projects have just turned over their localization effort to us.
[42:58.790 --> 43:01.060]  So, you know, we've hit dozens of release dates.
[43:01.140 --> 43:01.830]  We're pretty good.
[43:02.160 --> 43:04.870]  And we're happy about where that project is.
[43:04.870 --> 43:05.980]  I would call that a success.
[43:07.620 --> 43:10.270]  The project needs to do a few things to move forward, right?
[43:10.370 --> 43:22.330]  It needs to actually reboot the community so that we have real community members that are more focused on talking to each other rather than talking to the localization managers.
[43:23.520 --> 43:26.730]  Once the community starts talking to each other, it can try to be self-sustaining.
[43:26.850 --> 43:31.620]  It can try to be a community that makes its own decisions, A community that chooses its own work.
[43:31.770 --> 43:33.450]  A community that chooses its own path.
[43:34.200 --> 43:41.680]  And what I would really like to see is that when you gather a community like that, they start doing things that we don't ask them to do, right?
[43:41.700 --> 43:50.880]  A community like that, that starts doing spontaneous work that is not in our control or at our direction, that's when you know you've got a real community.
[43:51.040 --> 43:52.770]  And we have not hit that milestone yet.
[43:53.270 --> 43:54.660]  But that's what I'm hoping for.
[43:54.800 --> 44:01.400]  And a community like that is the kind of community that sort of starts undertaking their own projects, Like native language documentation and stuff like that.
[44:01.640 --> 44:03.820]  So localization was a big success for us.
[44:03.960 --> 44:05.480]  We're really happy with where it is.
[44:06.040 --> 44:07.620]  We don't actually run the project anymore.
[44:07.770 --> 44:10.540]  The project is moved on to another agency.
[44:10.880 --> 44:12.140]  It was time for it to move on.
[44:12.270 --> 44:14.250]  But we still support it very enthusiastically.
[44:14.440 --> 44:15.880]  And we're really excited to see where it goes.
[44:17.480 --> 44:19.320]  So again, what did we learn?
[44:19.600 --> 44:21.230]  It turns out we learned a lot of the same stuff.
[44:22.500 --> 44:27.540]  We never built a communications platform or a process or any heavyweight structure.
[44:28.170 --> 44:30.290]  Localization was a quick and dirty project.
[44:30.520 --> 44:31.840]  People dumped strings on us.
[44:32.020 --> 44:34.680]  We emailed people and said, hey, can you translate this?
[44:34.900 --> 44:35.640]  And you know what?
[44:35.840 --> 44:36.730]  We shipped.
[44:37.340 --> 44:38.270]  We shipped.
[44:38.270 --> 44:39.840]  And it was messy and it was hard.
[44:39.860 --> 44:48.920]  And we have a staffer who ran herself ragged and occasionally worked way too many hours for how much she was being paid and for what she deserved.
[44:49.360 --> 44:51.270]  But man, that shipped.
[44:51.600 --> 44:56.770]  And because it shipped, it proved its value over and over again.
[44:56.770 --> 45:00.040]  Every time it shipped, it proved why that was a valuable effort.
[45:00.290 --> 45:07.440]  And all of the volunteers and all of the people supporting us financially and logistically see that you ship.
[45:08.060 --> 45:13.900]  And so quick and dirty completely, completely beat perfection all the way down the line.
[45:14.080 --> 45:18.020]  You know, and I'm sure some of the stuff we shipped was not as good as it could have been.
[45:18.160 --> 45:19.680]  But I'm okay with that.
[45:19.800 --> 45:21.200]  I think we did a really good job on that.
[45:22.340 --> 45:26.820]  The community we've built around localization starts to look like a real community.
[45:27.100 --> 45:28.080]  It's coming together.
[45:28.290 --> 45:29.600]  People are starting to talk to each other.
[45:29.700 --> 45:32.340]  People are enthusiastically, personally invested in the work.
[45:33.200 --> 45:34.480]  And that's the difference.
[45:35.060 --> 45:35.860]  That's what worked.
[45:35.860 --> 45:40.230]  And even, you know, even with localization moving to another organization.
[45:40.420 --> 45:44.180]  Even with localization rejiggering the way it's going to do everything.
[45:44.420 --> 45:50.900]  The fact that there's a community there invested in it is what's going to help it smooth over any cracks and gaps in service.
[45:51.100 --> 45:55.900]  And it's going to allow it to adapt and move to a model of more continuous integration.
[45:56.460 --> 46:00.420]  So the top-down model that we did with PRB was not stable.
[46:00.580 --> 46:05.880]  The more bottom-up model that we did with localization turned out to be stable.
[46:06.880 --> 46:09.730]  We could not kill that project if we wanted to.
[46:10.180 --> 46:11.120]  It is moving.
[46:11.290 --> 46:11.920]  It is working.
[46:13.020 --> 46:24.770]  So, you know, the big thing that we learned in the process of localization, the other big thing, is that when you recruit a thousand volunteers and throw them at projects, they're not all going to land.
[46:25.980 --> 46:28.360]  People bounce off projects, right?
[46:28.460 --> 46:30.820]  They show up eager to work, ready to contribute.
[46:31.790 --> 46:34.320]  And there's no functional way for them to contribute.
[46:34.680 --> 46:37.420]  And if they don't land, they don't come back a second time.
[46:37.640 --> 46:38.320]  They move on.
[46:38.420 --> 46:39.270]  They go do something else.
[46:39.380 --> 46:41.770]  They find another way to contribute to serve their passion.
[46:42.080 --> 46:57.020]  And so one of the key functions of managing a community like this, building a community like this, growing a community like this, was really making sure that when translators and localizers showed up to work, we had something for them to do.
[46:57.020 --> 47:07.580]  We had a clear way for them to do it, so that they could go home knowing that they contributed that day, instead of sending an email and hoping they get a vague response from a developer who doesn't really work on localization, right?
[47:07.640 --> 47:17.300]  They talked to people who were treating them as first-order participants in a translation community, as opposed to third-tier volunteers in a software project.
[47:17.800 --> 47:22.120]  And that turned out to be one of the crucial differences in what we're doing.
[47:22.400 --> 47:23.520]  So those were two experiments.
[47:23.940 --> 47:26.480]  PRB, top-down, kind of worked, kind of didn't.
[47:26.920 --> 47:29.400]  Localization, bottom-up, worked really well.
[47:29.540 --> 47:30.730]  Community-oriented, worked really well.
[47:30.820 --> 47:31.820]  We were really happy with it.
[47:32.580 --> 47:34.060]  So where do we go from here?
[47:34.460 --> 47:35.730]  We need to scale this stuff.
[47:35.960 --> 47:41.420]  It turns out that we're bottlenecking on, you know, the central managers in these spaces.
[47:42.240 --> 47:47.380]  And learning how to grow something above the scale of a few projects is hard.
[47:48.020 --> 47:52.340]  Growing things to serve an entire industry is going to be a whole new challenge.
[47:53.300 --> 47:54.730]  So that's the first thing, scale.
[47:54.940 --> 47:56.500]  The second thing is how do we replicate it, right?
[47:56.520 --> 47:59.340]  We now know how to do localization really well for a sector.
[47:59.920 --> 48:01.520]  Are there other sectors we should look at?
[48:01.620 --> 48:03.700]  Should we be trying to do it for the wider community as a whole?
[48:03.940 --> 48:07.770]  Are there other problem areas we should be trying to solve in this manner?
[48:08.400 --> 48:10.820]  And I want ideas from other people about how to do that.
[48:10.820 --> 48:12.520]  I want ideas from you guys on how to do that.
[48:12.730 --> 48:18.200]  If you have ideas or expertise or a community that you could turn in this direction, talk to me about it.
[48:18.660 --> 48:21.140]  We've started something called Secure User Practices.
[48:21.480 --> 48:22.940]  It's affectionately called SUP.
[48:24.060 --> 48:25.900]  And this is our spokesman.
[48:28.320 --> 48:44.620]  So Secure User Practices is our attempt to explore the area of user interface design and user experience design and try to learn whether there are places we can go that will build a community around that stuff, around servicing projects with designers.
[48:44.940 --> 48:52.160]  Now, secure user design, user interface design, looks a little bit more like expert auditing than localization does.
[48:52.160 --> 48:55.250]  So we're not quite sure how we're going to do it yet, but we're still in the design phase.
[48:55.250 --> 49:01.380]  And we need more people with expertise in that area and too much time on their hands, ha-ha, to come and join us.
[49:01.380 --> 49:03.940]  So if you are interested in that, please do.
[49:04.180 --> 49:06.250]  So that's my pitch, right?
[49:06.440 --> 49:07.520]  We did a couple experiments.
[49:07.520 --> 49:08.960]  We learned some lessons.
[49:09.580 --> 49:14.020]  We learned that we need to start with the community and build from there.
[49:14.180 --> 49:23.700]  And that the communities, even the community-based stuff that ends up having dependencies on monolithic closed-source commercial stacks, that those dependencies are weaknesses.
[49:24.230 --> 49:27.800]  And that those dependencies are going to hold those projects back to some degree.
[49:27.800 --> 49:36.180]  And I'm not saying we shouldn't take the expedient path of using that infrastructure, but we should keep an eye on it because it might come back to bite us.
[49:36.640 --> 49:39.500]  So finally, I'm not too proud to beg.
[49:40.120 --> 49:41.290]  We need a few things.
[49:41.480 --> 49:42.230]  We need more ideas.
[49:42.300 --> 49:43.440]  We need more volunteers.
[49:43.880 --> 49:45.660]  We need funding to get the stuff off the ground.
[49:45.750 --> 49:52.420]  And especially if you are a translator, you know, if you have language expertise, you have UX expertise, do come around.
[49:52.440 --> 49:53.420]  Do let me know.
[49:53.580 --> 49:54.460]  Talk to me about it.
[49:54.460 --> 50:06.620]  I would love to help you find a project or a niche in our field in either circumvention or the wider free software community, where you will be loved and appreciated and make a real contribution to improving the world around us.
[50:07.750 --> 50:08.840]  That's how you can reach me.
[50:09.040 --> 50:10.180]  Thank you very much.
[50:10.840 --> 50:14.000]  And I'll take questions in the one or two minutes we have left.
[50:24.920 --> 50:26.180]  I can't actually see.
[50:26.500 --> 50:28.440]  I think there might not be any questions.
[50:28.620 --> 50:28.860]  No.
[50:29.040 --> 50:29.720]  We do have questions.
[50:30.920 --> 50:31.340]  Wow.
[50:31.540 --> 50:32.240]  That was accurate.
[50:32.420 --> 50:32.800]  Okay.
[50:36.620 --> 50:37.660]  I'll repeat the question.
[50:42.420 --> 50:47.760]  So, I'm puzzled about, or I haven't heard yet about, what's the organizational structure of ITP?
[50:48.560 --> 50:54.300]  Are you an open-source project yourself, made up a theory of volunteers?
[50:55.000 --> 51:03.220]  It was disconcerting to hear you using a sort of NGO model of organization, where you step in and provide services to us leading folks.
[51:03.220 --> 51:04.140]  Yeah, absolutely.
[51:04.520 --> 51:08.300]  So, the question was, how is OpenITP organized?
[51:08.760 --> 51:17.800]  Are we some kind of, you know, NGO invading a space trying to prescribe solutions to a native population that we don't understand?
[51:18.020 --> 51:21.700]  Or, are we structured more like an open-source effort?
[51:22.660 --> 51:25.900]  And I would say that we're probably somewhere in the middle, right?
[51:26.060 --> 51:28.000]  We're a team of people.
[51:28.100 --> 51:30.680]  All of us are open-source folks from way back.
[51:30.680 --> 51:35.200]  So, we consider ourselves to be in the population that we are trying to help.
[51:36.200 --> 51:49.920]  And all of, every single project we have ever done at the Open Internet Tools Project has been in collaboration with a bunch of people in our community, and with a bunch of people at other organizations, from the design phase all the way down the line.
[51:50.140 --> 51:53.240]  So, we're actually too small to do anything by ourselves.
[51:54.700 --> 52:00.640]  So, everything we've done has really, the first step has been trying to get other people excited about doing it with us.
[52:01.540 --> 52:03.580]  So, that's kind of how we do it.
[52:04.100 --> 52:15.400]  We basically state a desire to do something in an area, bring some people together on a mailing list to discuss how to do it, agree with them on how to do it, and then start doing it.
[52:15.400 --> 52:16.440]  So, that's our...
[52:16.440 --> 52:23.320]  It sounds to me like a change agent model would be more effective than an NGO service
[52:28.510 --> 52:29.950]  change in the community.
[52:30.350 --> 52:46.650]  One thing that, as a concrete suggestion, is that the both documentation and user experience, and also, I guess, translational services, are needed by all of the projects.
[52:46.870 --> 53:07.670]  And so, an open-source organization that focused on doing that for other projects, a sort of meta level, would still be able to work just as an open-source, democratic, flat, non-hierarchical model, and yet could provide a continuous feed for that.
[53:08.070 --> 53:08.430]  Cool.
[53:08.490 --> 53:09.650]  I wonder if that's something you'd consider.
[53:09.790 --> 53:10.490]  Yeah, definitely.
[53:10.690 --> 53:11.690]  Thank you for your comments.
[53:11.790 --> 53:13.310]  I think we have time for one other question.
[53:13.850 --> 53:14.110]  Hi.
[53:15.110 --> 53:15.470]  Okay.
[53:15.570 --> 53:16.350]  I'll repeat the question.
[53:16.690 --> 53:16.850]  Yeah.
[53:17.010 --> 53:18.710]  So, I'm really glad to see you're doing this.
[53:18.750 --> 53:19.610]  I think it's so important.
[53:19.870 --> 53:22.650]  I have a question about the motivation of volunteers.
[53:23.590 --> 53:31.510]  As I'm sure you know, it's really hard to motivate people to volunteer sometimes, especially when you need experts who spend all day at work doing something.
[53:32.250 --> 53:38.670]  And the motivations that come to mind are money, glory, and just...
[53:42.810 --> 53:44.850]  I can think of a few other motivations, but...
[53:47.390 --> 53:50.690]  You know, you can't split glory over a thousand people.
[53:51.330 --> 53:57.430]  If you're dependent on a thousand other people, you know, it's hard to get that motivation of being able to use something for yourself.
[53:58.110 --> 53:59.950]  What other forms of motivation?
[54:00.070 --> 54:00.310]  Sure.
[54:00.310 --> 54:04.810]  So, you know, the question was how do we motivate people in these spaces, especially the UX folks.
[54:06.330 --> 54:10.270]  If you're a UX designer, man, you've got a skill that everyone wants.
[54:10.410 --> 54:17.970]  Like, everybody I know who can do design, the graphic design or UX design, is constantly fending off folks who are like, hey, man, can you do my business cards?
[54:18.490 --> 54:23.790]  You know, there aren't that many people who have come up to me and been like, hey, man, can you run me a mail server?
[54:24.250 --> 54:26.410]  You know, it doesn't happen that often.
[54:27.250 --> 54:33.950]  People who are in the design field are constantly training themselves habitually to say, no, I'm sorry.
[54:34.070 --> 54:35.990]  I can't split my attention that way.
[54:36.010 --> 54:36.790]  I can't give you that.
[54:38.110 --> 54:44.090]  And, you know, yeah, we're not giving tons of money and glory to people in that field when they come to help.
[54:44.190 --> 54:46.270]  What we're giving them is an opportunity to make a real difference.
[54:46.490 --> 54:49.890]  We're giving them a way to contribute to improving the world around them.
[54:50.090 --> 54:56.970]  A way to wake up in the morning and do some work that, in their opinion, not anybody else's, but in their opinion, will matter.
[54:57.370 --> 54:59.190]  And that turns out to be a pretty powerful motivator.
[54:59.690 --> 55:01.910]  I know it motivates a lot of the other people in this room.
[55:02.050 --> 55:08.110]  The number of people in our community who are doing work that gets them zero money and zero glory is very high.
[55:08.230 --> 55:09.290]  And it's not that different.
[55:09.490 --> 55:11.070]  So that's how we're reaching out to people.
[55:11.270 --> 55:12.650]  Plus, we try to make it fun.
[55:14.250 --> 55:21.310]  So, you know, I'm out of time, but I really did enjoy reporting back on the thing that started at HOPE a couple years ago.
[55:21.310 --> 55:23.450]  It was really important to me to close the loop on that.
[55:24.010 --> 55:25.990]  This community is really important to me.
[55:26.110 --> 55:27.650]  I love the work you guys are doing.
[55:27.950 --> 55:32.370]  And I'm really honored that I get to participate in it through my own work.
[55:32.510 --> 55:33.390]  So thank you very much.
[55:33.510 --> 55:37.310]  And I look forward to continuing the conversation with you guys in the hallway and online.
[55:42.040 --> 55:42.720]  Thank you.
[55:42.900 --> 55:43.460]  Thank you.
[55:43.460 --> 55:43.500]  Thank you.
[55:43.620 --> 55:44.020]  And...