Jerod Santo: Because it’s in there, it’s part of the settings; it’s super-weird… When I have to show my parents that “Yeah, you can just get your passwords out there”, like how? I’m like “Well, I just swipe down and search for passwords.” And it’s had different names throughout the years, throughout the versions, and so it’s really just an unknown feature for so many people… If they had an actual app, just like they have a wallet app - have an app called Passwords, with all this stuff centralized - I think that would go a long way for people realizing how good their password offerings are. Because they have – I mean, you can do one-time password, you can do all kinds of stuff inside there… But people just don’t know about it, so… They should do that.

Adam Stacoviak: The card is amazing. They actually have a physical version of it, too. They started out with software, which is pretty awesome, and the fact that you can just literally go into the wallet app and apply right there; you don’t have to wait for the card to get to you, like any other traditional credit card. So they started out the demonstration describing this software-based version of the card and how they’re changing things, but then they turned it on the fact that “Hey, there’s sometimes that Apple Pay is not an option”, and that’s fine; they understand that it’s not gonna be an option everywhere… So instead, they give you this physical card. It’s a titanium card. There’s no number, there’s no signature, there’s no CVV, there’s no expiration date… It’s literally just a card with an Apple logo on it, and I believe your name was on it…?

Jack Dorsey: So if you’re ever in a state where you can fund open source developers, not just around Bitcoin, but anything, you might get something back that’s extremely valuable to your company. It would have taken Cash App so much longer if LDK did not exist. And again, they weren’t building that for Square’s interest, they were building it for wallet developers that were not Cash App. Because Cash App had no interest at that time of using Lightning. I’m really proud of that. It just happened, and we didn’t force it to happen. It just happened.

Jack Dorsey: [39:47] So if you're ever in a state where you can fund open source developers, not just around Bitcoin, but anything, you might get something back that's extremely valuable to your company. It would have taken Cash App so much longer if LDK did not exist. And again, they weren't building that for Square's interest, they were building it for wallet developers that were not Cash App. Because Cash App had no interest at that time of using Lightning. I'm really proud of that. It just happened, and we didn't force it to happen. It just happened.

Angelica Hill: I only have two quick thoughts. One was making sure that all dietary requirements are met by the establishments we’re partnering with. Secondarily was a call for the environment, that we not have physical plastic cards, and we make them virtual and perhaps an Apple wallet or an Android wallet… I don’t have an Android device, but an Android device-based card thing…

Patrick Ecker: [48:07] Yeah, yeah, sure. And companies like TinyMCE - they are building a rich-text editor platform with ReScript, and for that it’s also fantastic. These really complex domains - this is where ReScript shines.

On the team, we’ve got, as I said, Hongbo Zhang, who is now also working for Facebook, Cristiano Calcagno, who is one of the cleverest scientists I know. He has been working on the Infer project, if you know that, for code analysis and static analysis of all kinds of languages. He has huge knowledge about analyzing code, which is great for us, because we have a lot of dead code elimination analysis going on right now for ReScript, because it’s fully typed. Super-nice to analyze.

We’ve got Cheng Lou, who has a huge vision on products, and designs, and lean, clean interfaces. I love that as well. Maxim Valcke, who is our master brain on the syntax level. He has been investing so much time into writing a syntax parser that is efficient and small. It’s super-fantastic work. And myself, of course, for working on the documentation; I’ve been doing this within the ReScript Association, as you already mentioned. The ReScript Association was founded with the goal to support the community and support a language with financial infrastructure, so people can send donations to it who are relying on the technology. So if you are a company who wants the language to succeed, the best way to invest money is to invest it in the association. They’re reallocating the money for developing the documentation, growing the editor tooling, working on core essential libraries, finding other projects, organizing conferences… We had like two conferences already - ReasonConf 2018 and 2019, and also a Reason conference in the U.S, which will most likely of course be rebranded to ReScriptConf.

So in the past 2,5 years we also collaborated with research institutes and companies, we collaborated with Ahrefs, which I already mentioned, with the Tezos cryptocurrency - they’re also really invested in this, because they want their crypto wallet apps to be stable, and they chose ReScript for their web frontends, and stuff like that. Or subsidiaries of Tezos, of course. Tezos is a huge project.

So this is how we try to set a foundation for the language on the community side, on the open source side, but also we have a strong commitment on the business side with the core team, who is working at Facebook, and all other companies that depend on it.

Chris Beams: Yeah, sure. So let’s just assume the simple scenario of you’ve gotten your first Bitcoin wallet - it’s a desktop application - and I’ve sent you some Bitcoin just to get you started, so now you have 0.1 Bitcoin or something like that sitting in that wallet, and five minutes later your machine melts down. It’s just an unrecoverable disk failure, and your time machine hasn’t had time to back it up, or whatever; you don’t have any backup of it. That wallet on that computer was the only home of the private keys that can spend the Bitcoin that I transferred to you.

When I transferred the Bitcoin to you, I signed a transaction using my Bitcoin private keys that spent the Bitcoin, to your address, in that wallet. I sent it to your public address, and only that wallet has the private key that can then subsequently sign again and send it to somebody else. So if that private key is gone, your money is gone, gone, gone, gone, gone.

Now, there’s a little bit better news these days. For the last number of years there have been really clever solutions that have come along. When you set up a modern wallet today, if it’s a good one, the first thing it’s gonna walk you through is this process of setting up the so-called seed words, which are typically a 12-word sequence, or sometimes even a 24-word sequence. Those words, in addition to a password or whatever it is that unlocks the wallet, but these words are much more powerful than a password, because those words alone can actually completely recreate a wallet, including essentially all of the private keys that are necessary to spend that Bitcoin, and that’s a really clever piece of engineering and math that makes that possible.

[20:15] So the process today is people set up a wallet, they get their seed words, and they must write down those seed words, like pen and paper, never ever storing those words on a digital device of any kind. Store that piece of paper utterly secure, whether it’s your bank’s safe deposit box, or whatever it is that you deem to be the most secure location that you can possibly –

Mikeal Rogers: [32:14] Right. So if you wanna create one, you do what’s called minting. To mint an NFT means you take the data, you put it into IPFS… You can use this project that I talked about, NFT.storage, and that’ll handle getting all of the data in IPFS, creating the metadata file, getting you what you need to work with an NFT. But then you’ve gotta pick a blockchain you’re gonna use, and what you’re gonna do is you’re gonna develop a contract around how that NFT is used, and then you’re gonna reference that IPFS address for that metadata in that NFT. And then you’re going to use the user’s wallet. So the user that is minting the NFT, not the developer - this is the user’s wallet - will then sign that transaction and put that on the network.

We can link to an example of how this all works, actually. That’s probably a little bit better. There’s a blog post about this little project called Minty, that we wrote at Protocol Labs, that does some minting. If you’re pulling apart these different components, there’s parts of this that are on the developer, and parts that are on the user; so the user has to have a wallet around, and there’s different ways that different applications have approached having that wallet. There’s a project called Metamask, which is a very popular wallet for Ethereum… You can use Ethereum wallets on a lot of other chains as well. It’s a public-private key. But Metamask is really nice in that that stays in secure storage on people’s devices. It’s never shared with the application. So there’s no man in the middle stuff, there’s no custody issues. It’s always the user’s address. That’s a really great one.

But a lot of these projects that are getting people to set up Metamask, getting people to set up these wallets is actually a big barrier to entry, so a lot of the NFT minting sites that you might go to will just create a wallet for you, and they’ll hold on to the public-private key pair. And that can be problematic, because if they get hacked, your private key’s gone… And also, they can kind of run off with it. You really want to have custody of your wallet in this ecosystem… But again, it’s really young, it’s really immature. The user experiences around wallet custody are not entirely worked out very well. There’s a bunch of sites where you have an account with them and they have that wallet, and then they’re handling a lot of the signature stuff for you when you mint these NFTs.

Paul Bakaus: Yeah, exactly right. There was this meme around stories, and everything… Even the meme is already a couple of years old, so we’re definitely late to the show… But that’s not the point. The point is really to figure out what works for consumers today, and then bring that to the web, and make it more webby; that’s the really important thing. If you’re creating a story in a closed, walled garden app, good luck adding a link to that story. But with web stories, you have that possibility. You can add links, your content doesn’t expire…

But the crucial thing is that we’re always trying to find that compromise that keeps the user experience the way that consumers demand it, and yet, basically make it webby enough for the open web to sustain itself, and for those creators to sustain themselves. I feel like we’re generally misunderstood on this question. We’ve been misunderstood about this intention with AMP, but it’s kind of a hill that I’m willing to die on, because I really believe in the web and I want it to succeed.

Till Schneidereit: In the talk yesterday I made this sort of off-hand joke about stealing your Bitcoin wallet, which of course is based on real world events… And it’s no joke. It’s something that has actually happened. An application that you trust, where you rightfully trust the author of that application, still going behind your back and stealing your money, literally. Well, almost; it’s blockchain. And this probably won’t go away without us doing anything about it.

The way I see it, we can do something about it in two different ways. Either by locking everything down through authority, going through app stores and letting the Apples of this world dictate what you can and cannot consume in terms of applications and media, or by going away from something that is otherwise incredibly helpful, and increases the stability of applications and productivity of developers, and that is code reuse through platforms like npm. Or for Rust we have crates.io, which is very similar.

It’s not scalable to try to review the entire code there for the hundreds of thousands of packages published there all the time and we see that it’s not scalable, because nobody is doing and nobody could possibly do it. So we can give up on this code reuse, or we can say “Well, let’s work on things such that you don’t have to trust all of this code”, and to do that we need proper sandboxing, we need to be able to say “As long as the application can only run in this directory, I don’t actually care about whether it tries to steal my Bitcoin wallet”, because it can’t, and you don’t need to trust it in this regard. For that, we need to bring a sandboxing model that is essentially similar to what the web provides to development outside the web, in a way that still allows these applications to provide the value you want from there, and we’re working on that.

Dominic Tarr: [20:03] Yeah, it was the name of the wallet thing. It was like, it goes into an environment variable that is “see it when it’s run inside an app.” So they found that there was some suspicious encrypted material in the minified file, but they had to go through every single module that depended on event-stream, until they found the one that actually decrypted the thing. They had to just try thousands of things, until they discovered that it was this Bitcoin wallet.

Of course, by the time they had noticed that there was some encrypted thing inside the minified content, and not inside the regular content, then obviously something was up, and they didn’t know exactly what was the thing… Although now next time this happens, some Bitcoin wallet is probably a pretty obvious case.

Adam Stacoviak: Using the new Brave it’s pretty interesting, where you can in the right-hand corner see the known BAT triangle icon, and you click that and it pops down and shows you your wallet, and it actually shows you that you’re on a Brave-verified publisher. Of course I’m on Changelog.com talking about this, so if you’re listening somewhere and you wanna open up a tab - sure, why not? Go ahead and go to Changelog.com and follow my direction here… But it’s pretty interesting, you have a button here that says “Send a tip”, and I find this kind of interesting, because we’ve always kind of been pulled into this “Pay with your attention” model, and it’s never been attached to something so foundational to a user’s day-to-day usage and/or software habits like a browser. I don’t know – Jerod, am I crazy? This is the first time, right? …a cryptocurrency available to give it out; it’s based on attention. Right now my attention is slightly higher, towards Changelog.com over Brave.com. I’ve been to two sites in this new Brave browser app installed, so 61% of my attention is going to our site, Changelog.com, and the other 39% is going to Brave.com… So does that mean I’m automatically giving those two sites just my attention and I can divvy it later, or is there some sort of auto – like you said, it’s auto-contribute, right?

Feross Aboukhadijeh: Yeah, so Brave is another Electron app. Brave isn’t widely known yet; you guys are the first to hear it. I’m trying right now to add WebTorrent to Brave. Brave is a new browser founded by Brendan Eich and some other guys, and they’re trying to make a private browser that respects your privacy, doesn’t track you, blocks trackers… We’re doing some interesting things with paying publishers as well; the browser has a BitCoin wallet in it, and it will anonymously send money to the sites you visit if you’re down to do that.

So they’re trying lots of interesting ideas and experiments in Brave. One of the things that they’re open to is torrent support. The idea is if you install Brave, you should be able to go and click on a magnet link or a torrent file and have it just playback right away, or show up right away in the browser without a separate program. Since WebTorrent worked so well in WebTorrent Desktop, the JS library just works great with Electron. We just thought, “Well, why not put it in Brave?” and let Brave users just torrent things really easily. That will be another perk for using Brave over other browsers.

Jerod Santo: Yeah, there’s lots of challenges there. I like the idea of really the user’s phone, their network plan, all these things as user concerns that people – I think they are waking up to them more and more, because they are more tangible costs than privacy costs. Trading my privacy is very hard to intellectualize exactly what am I doing here, but especially if I’m on a capped connection, or I’m paying per megabyte, or my battery is dying in the middle of the day, and I’m seeing actually using this application is causing me really hard costs, right there in my wallet - I think people are starting to make decisions around that.

[28:09] We see it happening with the phone operating systems starting to percolate up to the user “What is draining my battery right now?” “Well, it’s this application.” “Oh, you know what - I’m sick of that application. I’m not gonna use it anymore.”

So I think the caring for your user, part of that is for their resources on their devices. And the more you can do on the server, especially when you’re talking about heavy computation, there more you’re actually caring about them in that way… So good point.

Jerod Santo: Pretty cool what she’s doing with her money, in my opinion. Of course, I’m biased towards open source, but I’m happy that she’s doing it. It’s awesome that so many projects can benefit from her opening up her wallet, as you said. Very cool.

A couple of questions about the money; so that’s where it’s coming from, different than most of these things, but straight from Mitchell’s “wallet”. The question is where does it go? We talked about what kind of projects that you’re interested in, and the application process… First of all, I did wanna say - I didn’t get a chance to say it earlier - I think the revolving door (is that what you called it?), every month… You can basically apply at any time. I think that’s really cool, versus like a once-a-year application process and selection… Because in light of sustainability, a lot of these projects, when they need money and they need help, they might not be here if they’ve gotta wait 9 months before they can get an application put together… So I think it’s pretty cool that you can just – you know, if you need the money, go ahead and apply; once a month you get a shot at it. That’s a neat formula.

But let’s talk about where the money goes, because a few of these organizations - I’m thinking about Open Collective, where they formulized a 501(c)3, and they’ll actually be able to receive the money on your behalf… There’s a lot of legalese and problems with receiving money, and so when you ahead and select a project and say “Okay, we’re gonna give the Tor Project $150,000 for the year 2018”, how do they receive that? Is it sent to an individual? Do they have to claim taxes? Is there an entity? Is it different for each project? Help us understand who receives the money and how.

Jerod Santo: For the sake of conversation, let me play the bear for a minute with you, Alan, because as you said, internally it was not unanimous, so no doubt you had interesting conversations with your colleagues and leadership at Wire around this. One of the major points brought up by people who were skeptical of open sourcing - I think it’s a legitimate skepticism with regard to rip-offs. Rip-offs happen, and the more successful you are, the more they can happen.

In fact, just recently I was reading about a cryptocoin wallet called Coinomi, which I think is an Android-only thing now, and I was just reading about their history a little bit (these things interest me) and they were open source, I think it was GPL-ed even, and their Android application was all open source, on GitHub, and they were doing it all in the open… Which makes a lot of sense for a crypto wallet as well, because talk about you wanted to know what the coin is doing… Similar to an encryption type of a secure chat, you wanna know what’s going on under the hood, so it made sense for them to be open source. Well, what happened was other people who were being very capitalistic, decided they were going to just take that code, rename it, rebrand it, and put it on the Android Store.

This is not an isolated incident, we see this happening over and over. The Coinomi folks stopped open sourcing, they decided it wasn’t worth it for them anymore; I believe that repo is still on GitHub, but it hasn’t been updated in a few years, and they’ve marked it as inactive, so they’ve continued to develop the codebase closed, because they had these problems.

Was this a potential reason not to open source discussed at Wire? Because surely, if everything you do is in the open, somebody could just take all of your code and all that you’re doing and rebrand it and compete with you.

Zach Lloyd: …for example, when I first left Google, I tried to build an app, I used App Engine, and I was like “Oh, this is amazing. Look at all this stuff I get for free.” And then I hit an issue in App Engine and I was like “What do I do now?” And then I looked at like the Google support forum and there were 50 other people who had that same issue with App Engine… And was like “Oh, it’s somewhere in the application framework/database, it’s all connected together, and I can’t do anything.” So I do think there’s a problem with the totally walled garden approach.

Ivan Kwiatkowski: Yeah, this is a very good question. I do have very ambiguous feelings about them. I do believe that on the security perspective, it’s kind of a good thing, in the sense that yeah, it’s another one of those safeguards that prevent people from doing stupid stuff with their devices… And having to go to some friends’ places, or more specifically, friends of my mom’s places to debug computers, and uninstall malware, and fix the printers, then I’m very happy when there are protections that prevent them from doing that kind of stuff. But then again, they are not a perfect solution either. I think the Apple Store in terms of security is pretty good. The Google store, the Play Store has a bad track record when it comes to hosting malware. I’m not saying that they’re doing a bad job; I think it’s a very, very difficult job. But the fact of the matter is there are a number of apps on the Google Play Store that turned out to maybe not be total malware; some of them are, but a lot of them are just there to collect personal data, or that kind of stuff.

[58:23] So I think a better way of securing those devices is not to control the app stores. Creating protections on the device level is probably where I would work. So when you look at both iOS and Android, they are doing, I think, a very good job of – or have been doing a very good job, at least in the past years, of making sure that apps would not be able to access anything just because the user clicked Ok way back when they installed the app. So I think making sure that all those personal information cannot be pulled so easily is going to be a much better way than trying to police all the stores, and look at all those thousands of apps that are updated there every day… Which I do not think that you can realistically ensure that they are always going to be safe.

But overall, the other issue with walled gardens, which is, okay, maybe they do provide something with security, but also I feel like they take away some agency from me as a user, right? I really like to own the devices that I use, and having some restrictions that tell me “Oh, you cannot install this app because Google says you can’t”, or “You cannot uninstall this app, also because Google says you can’t” is something that tends to make me extremely, extremely angry.

Amal Hussein: Yeah. I have to echo – a couple shout-outs to some web APIs that I think have helped smooth the link communication in mobile apps… The Web Share API - I don’t know if y’all are familiar or remember it. It’s not that old. Essentially, it’s a way for you to share information, with anything, from your phone. So you can actually implement it, which is really nice. It works beautifully on Android and iOS. But I think for me the walled gardens, like the areas where you’re interacting with the web through a device that’s perhaps owned by a proprietary company, and the company has interests in you using their app store… I feel like the web has had a really tough battle, both with devices getting smaller and faster, and better to use, and the long arc of the web - how long it takes for things to get updated etc. Not all websites really caught up with it, so you don’t have this graceful, beautiful, out-of-the-box experience.

So there’s just so many uphill battles that I’ve seen for the web. We’re still very much in the thick of it, specifically also for new internet users, like folks coming online for the first time. There’s millions of people in Brazil and in India coming online for the first time every year, and they’re kind of learning about the internet through apps. And when I say apps, I mean native apps that come pre-installed on their low-end devices. And I can say the same thing about my younger siblings, that are much younger than me.

[12:17] So the web has a lot of catch-up to do, I would say, in certain areas… But obviously, if you take the accessibility of the web and you kind of supercharge it with the powers of native apps, that’s what you’re supposed to get with progressive web apps, and potentially projects like FUGU from Chrome.

Feross Aboukhadijeh: Well, it’s easier to do the walled garden approach if you’re using a lot of packages to build up your application… And I know this is not that common of an approach for building an actual web app; it’s more common in the open source world, in open source libraries, where those are composed usually of a lot of packages… Because there you can just say “We’re just gonna refactor this one package for now, and then we’ll do the next one after that, and the next one after that.” So it’s kind of like pre-decomposed for you, in a way. It’s easier to do.

I have less experience doing it on a very large web app, where it’s all in one repo, and you have maybe a framework that’s tying everything together, so it’s hard sometimes to be able to just like move to something else… Say you’re switching frameworks - it’s hard to… Like, I have no experience in doing that while the app is still functional, where you have half React and half Vue, or something like that. But yeah, I’m curious what other people have run into with that, and how they’ve dealt with it.

Adam Morse: Yeah. Compositor started when Jackson and I, and this guy John Otander worked on CSS stats together. Jackson and I had launched a web app and we knew nothing about tech ops or DevOps, we knew nothing about servers, Jackson barely knew anything about JavaScript at the time, and this guy comes along and just starts refactoring all of our horrible code right away and making our website way more stable.

After I think the 10th amazing pull request in a two-day or three-day spin, I was like “Hey, do you wanna just own this project with us?” Then we all kind of got in a chat room, and… Yeah, every now and then we would do these sprints on CSS stats, and chat, and then sometimes we’d go dark for a few months. But then I started working on Tachyons a lot more and I was stumbling on trying to get certain things done with JavaScript in terms of like dynamic build things… So I asked John for help, and he started helping me out.

Jackson at the time was building lots of open source tools, everything from lots of different color tools, to his rebase library of stateless React components. So the three of us were all kind of still in the same chat room, and John and I worked together, and Jackson and I worked together professionally, but not a lot on dedicated open source projects…

That’s just kind of been our relationship for the last 4-5 years, kind of all infecting each other’s brain with ideas. John would listen to Jackson and I talk about CSS stats, and then he’ll go off and build something crazy. He built a service to download the top million websites’ CSS with snapshots in like one-month intervals, going back to 2005… So he has just graphed out the history of design systems in CSS on the internet, and it’s just awe-inspiring to go through these graphs and just see these trends at this 10,000-foot scale. That’s something we’ll make public later; we still have a bunch of things to clean up there.

It’s just a lot of fun working with them, but at the same time we all know that open source is difficult. There are things that we wish we could pay contractors to help us with, there are features that we totally want in that we don’t have time to build, but we think are valuable, especially in something like CSS stats.

[54:03] And for our own work, it’s like “How do you just make all of this sustainable so that people don’t burn out? I don’t know how many modules we have between the three of us.
So I think it was about this time last year when I set out to just say like “Okay, let’s just make this a company and start to string a lot of our open source things together and build some apps and some design tools that nobody else is building, like the way that we wanna work.”

I think Jackson and I have been together for five companies now. Most companies, big or small, have the same problems. Most places don’t ship the result of validated design. One design stumbles across the finish line. It’s not like you’re keeping six or seven things in parallel and doing a bunch of different user testing. So that’s kind of where our head’s at, it’s like “How do we create an environment where we can get the tools built that we wanna use to design stuff.” So this Compositors, that’s kind of what the company is about.

Our first product is Lab, and that’s basically a tool where you can build React components from scratch, you can build the design system, and set scales for typography, for spacing, for color pallet… And then, as you’re building out components, you can compose them together. And in your React app, we have a command line interface, and we’ll also be releasing a separate app for this, but you can tweak values in your design system or edit things about your component and see them editing in real-time. You can drag sliders on border radius so you can change colors, and it’s – yeah, it’d be like if you could edit sketch symbols and see that update at the same time and not have to switch between artboards. That’s always been my dream - to be able to edit things about a system and then see them propagate everywhere and know what’s gonna render, and not have it be unpredictable.

I’m really excited about Lab, because I am not good at JavaScript or React, so it’s helped me speed up my ability to build components and reason through that abstraction.

Alex Moore: So in terms of what we as developers can do… I mean, I think the time for just putting up with gatekeepers’ anti-competitive behavior needs to come to an end. The sort of “Please sir, can I have some more features?” I mean, we just need to put a stop to it, and then loudly campaign for basically equality; equality in browser competition, and equality in web apps.

[01:52:09.19] And we shouldn’t stop until we get that in every jurisdiction across the planet. And the thing is, the web’s a global ecosystem. If we don’t have it uniform across all the different jurisdictions, then its ability to compete with these locked, walled garden ecosystems is severely limited.