Jacob DePriest: Well, you know, it turns out that threat actors also have figured that out. And when they hear things like free compute, they go right after it for – pick your abuse vector. We see campaigns that will try and escalate the number of stars that a particular repo has to increase its popularity. We see people trying to mine crypto using free compute. I mean, we see a lot. Hosting files on github.com that we’ll just say don’t have anything to do with software development. And so it’s a challenge. And it’s something that we have a fantastic team working on, we have been employing machine learning and AI for a while in this space, we’ll continue to do that… But it’s a really complex, challenging problem. And the balance we have to strike here is because we serve so much of the world’s software development ecosystem, we can’t turn the dials too strict, because then we start locking out hundreds, thousands of users that have legitimate use cases [unintelligible 01:08:03.10] And certainly, those things happen. You can’t fine-tune every filter to be perfect. But we really try and strike that balance of how we do that.

[01:08:12.15] So this is where we’re also working with our product counterparts to understand what are things we can make changes to in the actual product, or maybe a signup flow or things like that, that will decrease the likelihood of abuse, or impose costs a bit higher to actors who want to do that… And so that’s certainly something – there’s new campaigns every day that come out in this space that our teams are firefighting, and they’re doing a great job at it, and it’s something that’s just top of mind, because it’s something we don’t see getting less of, we’re definitely seeing an increase.

Roland Shoemaker: Yeah. I think a good thing to follow on from the Go debug discussion would be - you know, we try and keep everything as compatible as possible; we have this great way to introduce behavior that may be breaking, but I think there’s also a discussion about what we want to do in the future, where there are APIs we cannot change. They are what they are, and in those cases our only real option is to introduce a completely new package. And this has been done very sparingly in the standard library thus far, but I think it is probably – the world has changed a lot since not just the crypto tree was written, but a lot of the packages in the standard library were written. And we’re kind of looking at this point to what does not a Go 2, but a v2 of certain packages in the standard library look like. And the first big one that this has happened for is the math/rand package. I don’t know if you want to talk about that as well, Filippo…

Nathan Sobo: But just from a personal perspective, it’s not like I surveyed the landscape and was like “Let me find a low-hanging fruit to pick.” It was much more the perspective of “I’ve been trying to do this for 10 freakin’ years, still haven’t managed to do it, and nobody else has either, and so I just have to keep going.”

Now, you’ll have to talk to our investors for their particular motivations, but I can tell you what I told them, and really believe, in terms of what the market opportunity is today, in terms of - again, I think if I were in this for the money, I probably would have started like a crypto token, or something. That would have been a faster route to riches. But I do think it makes sense to build a business model around this.

And for me, the opportunity is really about how we all communicate around code. I mean, I worked at GitHub for nine years. I love GitHub, but I also don’t feel like there’s been substantial innovation, since pull requests came out all those many years ago. And I think it made sense at the time to kind of hang this social layer on top of the version control artifacts. I just think we can take it much further. I mean, that’s what I pitched Chris on, to kind of get hired at GitHub, and we didn’t manage to pull it off… But now I think, based on everything we’ve learned, we’re actually positioned to do that.

[44:00] And so what I really want is a world in which having a conversation about any line of code, whether it was written a couple of years ago, or I just wrote it and I haven’t even hit Save, is something that just feels like at my fingertips; I can @ mention a teammate, pull them in, and start a conversation, so that conversation is really growing over the entire codebase. Because again, you want to introduce a new feature - that probably interacts with some other layer of the system that you may not understand. Already, you need to start having a conversation. But do you do that on a pull request? You haven’t even written one line of code yet. You’re just trying to understand what’s going on.

And so there’s just so many things like that, where it would be a great idea to have a tool that really facilitates interaction around code, and it just doesn’t exist. Like, I don’t know what we did; we’d like paste code into Slack, or like cap things inside of backticks. You’re talking about code that isn’t even there, and then it scrolls off the screen, and it’s gone forever when someone else comes to the code and has the same exact question that you had. Or are you hopping on a Zoom call and now one person’s like dictating through the screen, like “Oh, no, no, no. Okay, open this file; okay, now go to this function…” Whereas already in Zed we’ve tackled the real-time piece of it.

When we want to just have a conversation about code, we’re doing that in Zed. Start up voice, that’s not in Zed yet, so we still rely on an external tool to do the voice for us. But then I’ll just open up a submenu, invite one of my teammates in, and we’re following each other around inside the code, instead of trying to dictate through the screen, like “Go here. That – take that”, because the latency is so high, or whatever. I’m just moving around, and they’re following me, and then they’re moving around and following me…

I remember, when Mikhaila, an engineer on our team - she was like integrating the terminal into Zed; she was interacting with GPUI, and there might have been some APIs missing; she wasn’t quite sure. So we had a conversation, and I toured her around inside the GPUI, which I wrote the majority of, and then I followed her, and she toured me around inside of the terminal code, and then I got a sense of what she was trying to do. And then I jumped back into GPUI, and we wrote the code, added the methods together that needed to exist for her to accomplish what she was trying to accomplish. Then we hop back into her code, which she knew much better than me, and used those methods. And within an hour, with a quick conversation, we accomplished what over pull requests would have taken a week, I feel like.

And so that’s the level of fidelity that we’re looking to bring to interaction around code, starting with real time, but not confining ourselves to that. That’s, I think, the innovation opportunity; it just so happens that the primo kind of iPhone, Apple vertically-integrated product that delivers that experience in my mind is the tool in which the code is written itself. That you shouldn’t be Command+Tabbing out to a browser; that that experience should be tightly integrated directly into the authoring environment, just like it is with Figma, or Google Docs, or these other disciplines, that the place to collaborate and talk about code is where you write it. So we have to build a great code editor. But luckily, I want to do that… So that’s our competitive insertion, and that’s the business part that we want to build.

If you want to use it by yourself, I want you to do that and do it without paying us a dime for it into the future. And I want to build a business around teams using this tool to be more productive by having a better mind meld with each other and being more effective in our communication. That funds the people that just want to use it by themselves for free, and drives more innovation into the code editor space than has ever been possible, ever been funded.

Jerod Santo: Yeah, especially somebody like yourself, who is so much about zero to one; that’s what that free allows people to do, is get to one, and then pay from there. And so yeah, I was with you. I was definitely kind of like “Hm… That’s sad, but I get it. I understand.” I just saw an article yesterday, I think, that GitHub Actions is suffering the same fate… Because you get a certain amount of hours every month, or something, and the crypto miners are the spammers, or I don’t know what they’re doing, but they’re, of course, abusing that platform.

Nader Dabit: [01:03:49.23] Yeah, there’s a couple of privacy coins; I don’t know enough about them. I haven’t investigated them enough to know whether I would use them or not… But I also think that not everyone needs to use crypto or Web3. I think it’s more kind of like now we have other ways to do things, and other ways for us to build applications, other ways for people to participate financially.

If people are still wary of the drawbacks, I would actually encourage to wait until things improve, or maybe just don’t use it at all… Because yeah, if you have concerns that are legitimate, that you feel are concerning, like most probably do, I would say definitely investigate those and decide whether or not you feel like the trade-offs are worth it or they’re not worth it.

To me, it’s really fun and interesting to be able to transact so much and so quickly using these wallets. You can trade between coins, you can do DeFi, you can buy NFTs, you can send money to people… In my DAO, I mint these tokens for free to get people into my DAO and send it to them for free for people that can’t have gas… Yeah, there’s all kinds of fun stuff.

There’s also financial (of course) incentives, but again, not everyone probably wants or should participate in this stuff. So I would say keep an eye, if you’re still wary about this stuff - just keep an eye on the innovations and improvements that will happen over the next 6-12 months and check back again with us a year from now. Maybe we’ll have adjusted some of those, and maybe we haven’t, I don’t really know… But yeah, I definitely think that these concerns that people have are legitimate, and I would encourage people to check out my thread that I kind of wrote, maybe going into stuff a little bit more in detail… As well as a blog post that I wrote called “Getting into crypto as a developer.” I have linked in that blog post another thread from someone else that kind of talked about it… And I think he was a little bit more critical than I was, and I encourage you to read both of those.

Filippo Valsorda: Yeah, so the approach that I’ve been working on for the last few months - quite a few months, wow - is TLS 1.3. The short version of the crypto like page is that TLS 1.3 is the new version of TLS; it’s not about getting cryptographers job security, but instead about making the protocol actually more robust against future attacks, so it’s a complete rework and it takes one less round trip to connect to things, so it’s faster, and a bunch of other things that if you’re interested in – there’s a talk at CCC 33c3 that you should watch.

But the point is we wanted to implement TLS 1.3 and participate in the standardization process with a real implementation deployed… So we wanted to take up TLS stack and add 1.3 ourselves. I essentially threatened to quit if they made me do it on OpenSSL – no, I’m joking; nobody asked me. They just asked me what to use as a base, so I just jumped straight to crypto/tls, the standard library of Go, which is a wonderful stack written originally by Adam Langley, which all of the people in the industry say that it’s where they go to to understand TLS. They read the spec, they fail to understand it, they go to crypto/tls, they read the Go code, and now they understand things. So that was the starting point… And we extended it to have TLS 1.3 support; we worked most on the server side, and it’s now deployed globally on millions of CloudFlare sites. If you just sign up for a free account, it’s on by default.

[15:56] The nice thing we don’t talk that much about, but you can definitely gather is that if our TLS 1.3 stack is in Go and you can use Go to connect to CloudFlare site it means that sometimes when you connect to CloudFlare, actually in the HTTP pipeline there is a Go HTTP reverse proxy.

Cory Doctorow: Sure. As I mentioned, I’ve got an eight-year-old and she was born in London in our flat in a pool in the living room. She likes to hear the story of her birth, right? So we would tell her the story of her birth… My wife told her she came and yanked on my arm and shouted, “Story arm”, that I would tell her a story. So she runs up whenever she is bored and she yanks at my arm and yells “Story arm!” And being a writer, I like to iterate when I tell stories, so I’d tell them a little differently every time. I’d start a little further back or go a little bit further forward.

What I realized was that the interesting part of her birth story was the stuff that led up to her birth, and not like the stork stuff, but the stuff about how my wife and I met and became best friends and lovers and a couple, and got married and decided to have a baby. You know, all of that stuff is unique; the stork stuff is the same for everybody. What your parents did to make you is almost certainly something I can guess at with a pretty high degree of accuracy, right? But how your parents came to make the decision to do that and make you - everyone has a different version of that.

[20:08] The open source version of how we got here, we talk about the licenses and we talk about the packages and milestones, but there’s like this really strong social component to how we got here, because around the same time that the open source movement was starting, it was also around the same time that the open web movement was starting, that we were sun setting these proprietary network architectures - whether those were the ones the phone companies ran… You know, AT&T circuit-switched services-centric network or the big commercial services like Compuserve in AOL… They both kick-off around the same time, and yet the open web has collapsed, the open web is almost dead.

We are in a desperate and dire moment for the open web, and the free and open source software movement has soared; everything, including the things that are closing down the open web is built on free and open source software. So that is an amazing thing, and the speech kind of interrogates what the difference is, and how one soared and the other sank, and what we can learn from the free and open source movement to keep the web open as we try to open it up again.

I think the thing that the free and open source software movement had going for it is this thing called the Ulysses Pact. The story of Ulysses goes that Ulysses was gonna sail into siren-infested waters and anyone who heard the song of the sirens would be tempted irresistibly to jump into the sea and the sirens would drown them. So normally, when sailors sailed into the siren sea, they would fill their ears with wax. But Ulysses was a hacker and he wanted to hear what the sirens’ song sounded like, so he had his men lash him to the mast so that he could hear it, but he couldn’t get loose. So what he used was his strong self, the moment at which he was strong, to predict that in a future moment he would be weak and to take countermeasures to prevent himself from giving into that weakness. We use Ulysses pacts all the time - if you go on a diet, you should throw away your Oreos away on night one; not because you’re like incapable of resisting temptation, but because everyone sometimes has moments of weakness, and the strongest thing you can do is to recognize that you will have a moment of weakness in the future and take a countermeasure against it.

In the free and open source world, our Ulysses pact is the irrevocable license, because the failure mode of free and open source software, having founded a free and open source software company, I can tell you is that there are moments in which it feels like your survival turns on being able to close the code that you had opened when you were idealistic. There are moments of desperation when that happens.

Of course, it’s ridiculous, because if you’re making anything substantial under free and open source software, you’re building it on other things that other people have opened and can’t close, and if they were to close off their code your project will collapse. So every one of us wants to be the only one who can revoke a free and open source software license, while all the plumbing that we built on top of stays open. Because the licenses are irrevocable, because you can’t close it once you opened it, you generally don’t even get the pressure from your investors or from potential acquisition suitors or from other parties who can otherwise lean on you and put a gun to your head - they don’t even bother, because there’s no point in shouting at you to close the code, if they know that it’s not course of action that’s even open to you.

[23:44] So even though the same desperation that led us to close the web is present for everyone who’s ever made an open source project that succeeded, that desperation can’t express itself in the same failure mode that the web has had. So my talk is about how we can build a Ulysses pact for a newly opened web around two principles that will keep the web open even in the desperation of its founders, even when the pirates who founded it become admirals.

The first principle is that any time a technology or computer gets an order from its owner that conflicts an order that’s been given to it by a remote party, the owner should 100% of the time without exception win. The owner always gets to overwrite remote policy.

The second one is that any true fact about the security of a system that you rely on should always be legal to disclose, under every circumstance. My pitch is that these two principles should the principles that we become zealots for; that if they’re not calling you an unrealistic idealist about your adherence to these principles, then you’re probably not trying hard enough. So my pitch is that the people who care about building an open web to be the nervous system of the 21st century, to have an Internet of Things that’s not an Internet of things on fire that spy on you and ruin your life, is that we need to like take these principles and cherish them as much as we cherish the core principles of free and open source software, and weave them into our licenses, into our professional codes of conduct, into our membership agreements, into every single piece of what we do, so that there’s never any question that this will come about.

There have been lots of times when the governments have tried to pass laws that say “In order to make software, it has to be closed” and the fact that there’s all of this critical, open software has meant that those laws died every time. Because you’re going back to them and saying, “Well okay, but what you’re talking about is throwing away all the infrastructure on which the digital world is built. What are you planning to replace it with when you pass your dumb law?” You know, reality asserts itself, and so if we can create a reality on the ground to assert itself when governments contemplate stupid laws that say that remote parties can override local parties, whether those are crypto backdoors, or DRM, or lawful interception overrides, or any of the other things that have been the parade of horribles of the 21st-century, then we can make a difference.

Rod Vagg: That’s just right, and that brings up an important point, which I haven’t touched on at all which is the importance of leadership. It’s nice to have this idea that you’re gonna have people show up, you’re gonna have this emergent property of leadership, it’s just gonna emerge out of the mass of people doing things. That’s a nice idea and sometimes it works, but very often you still need leadership, and that leadership may be in the form of people putting in more effort than others.

[01:02:01.17] That’s what happens early on in a project - you’ve either got one person or a few people who are passionate enough about making this thing work, that they are willing to put in that much time to get it there; rarely do you have a lot of people doing that. Usually, there is only a small group or only one person, so that’s what leadership looks like initially.

As the project evolves you need somebody or some people to serve in that role of facilitating the community, and that comes down to the fact that not everyone is a leader and we ought to be fine with that, that not everyone wants to be a leader and not everyone has those natural skills to be a leader, and when you accept that then you see that there is a place for individuals to step up and just start being the grease in the wheels. And that can play out in really interesting ways; it can play out just by the fact that somebody is stepping up. Very often, other people will be looking for that person, and they’ll be waiting for it, and they step up and they might start to assert things, and other people involved in the project might say “Phew, finally somebody is here to take that burden.” And we can disagree with them, “Great, at least we’ve got someone to disagree with now. We don’t just have this mess of people that are too timid to really assert thing”, so having somebody stand up and start asserting can be a really valuable thing and people look forward to it.

The other way that it can manifest is simply in the respect that people get over time, and that’s how leadership can evolve in these projects. It evolves in open source in general; you build up this capital of respect by your contributions and by what you know and what people know that you know, and you see that in complex projects like Node. Node has a lot of different areas that are all very distinct and there are different levels of expertise in different areas that are required to understand them and nobody – there’s zero people in the Node Core project, amongst that group of people, that understand it all and that are experts in it all. Everybody is an expert in one area or a few areas, and nobody is an expert in it all.

And the way this kind of leadership evolves in that setting is that people build up the respect and the technical capital from other people that they know this area and that they are somebody to be listened to. One of the most obvious ways this plays out at Node is when you think about Crypto; it’s a really hard area for people to get across, very few people really understand it enough. We have a few people that are really well respected in that area, and we will generally defer to them, and often for even the most trivial things; we’ll say we need sign off from these people, or they need to be involved in this discussion in order for it to move forward, and then when those people in that small group - or it might be just one person even - they start proposing changes in their little area of expertise, they almost get a free pass because everyone looks at them as the leader in that area.

So that plays out really interestingly when you’ve got a complex enough project, but it also plays out in smaller projects when you’ve got simply somebody who has got obvious depth of technical knowledge and understanding about a project; they are generally recognized and they get to play that leadership role, as well.

David A. Wheeler: Well, the criteria we created - as I said, we talked to a lot of folks - it’s basically what do most projects do for each one. But here’s the challenge: if you identify a bunch of criteria that each of which most projects do, and then you say “Hey, you’ve gotta do them all”, often times what people find is they do almost all of them, except for these two. We’ve actually been tracking those… I actually recently posted an analysis of the projects which are close but not quite making it, to figure out what were the ones that were most missed. So let me list those that are kind of the most missed ones. We take feedback and we basically planned to update the criteria every year, and we actually have an intent to add higher levels in the future, but right now we have that basic, passing level.

The most missed in terms of the criteria where tests are added; basically, as you add functionality, you add tests. The second most missed was HTTPS. There were some others about crypto certs, vulnerability reporting - basically, tell us how to report vulnerabilities. For the tests that are added - could we reduce the criteria? We could, but should we, really? If you add new functionality, shouldn’t you be adding new tests? We’re not mandating a hundred percent coverage rating, we’re just, “Keep improving.”

For HTTPS, if folks want HTTPS, go to Let’s Encrypt, they’ll give you a certificate for free. For vulnerability reporting, that’s one sentence on the Readme, on your project page.

Another one that’s coming is knowing just the basics about secure design and common errors. That’s really just knowing how the basic principles, such as from Saltzer and Schroeder, and knowing things like the OWASP top ten, what they are, how to counter them. They aren’t hard to do, and while we could back off on those things, no one is actually suggesting that we should. It’s just that there’s a number of projects that don’t need those sorts of things, so what we’re trying to do is instead of changing the criteria, we’re trying to help the projects actually meet them, which is gonna be good for everybody.

Fred K. Schott: Yeah, I think that’s really worth calling out, and I’m glad you did… That idea that just because now something is ESM doesn’t mean it now runs anywhere. The package can still be using things that are only Node or only browser.

One of the things we saw in the Skypack CDN was that – we released every package, essentially, as an ESM interface, which means that Deno can technically load it… But just because it can load it doesn’t mean that it can run it by default. It could be using something on the file system, a package could be using the crypto library… There are all these things that you realize are really baked into how Node works, and just because now it’s in a language format that a browser or Deno can understand doesn’t mean that Deno can run the code itself based on how it’s written and whatever lies on what it depends on.

Tim Coulter: You kill your kitty. But in killing this kitty, you get a new token, you get a new (for lack of a better word) piece of digital art. And what you can do from there is trade them just like you would CryptoKitties, but you can also feed other people’s kitties to your zombie to create even more zombies… And this zombie apocalypse comes up.

Now, what we can do with that (with the Pouncing Dead) instead of making money, we can take that fee structure and give it to the Horde itself, so that whenever you sacrifice a kitty over to the Horde, that money gets paid out to you. We could actually create this really interactive – and in doing so… I mean, you guys reacted yourself, like “This is so cool!” We can create this really interactive system where people are interacting with CryptoKitties, they’re interacting with Crypto Zombies… It becomes a narrative that’s fun to talk about and fun to interact with.

Like I mentioned, this is just one thing that you can do. People are using the Ethereum blockchain to manage provenance of fish or products that get created and make sure that the authentic things finally make it to consumers… People are using it to check out oil production and make sure that we’re producing things right, blood diamonds don’t need to happen anymore, we can create applications like decentralized eBay… For instance, eBay is great in that it brings people together, but along with PayPal they take a 17,5% cut, which is outrageous; that doesn’t need to happen anymore. The value transfer can happen over Ethereum. So what we’re going to do is reduce what we call the amount of rent-seekers that are in our industry today, that are just kind of building an asset and then sitting on that asset, and instead put that value over to everybody else.

And part of this question was really hard for me to answer because there’s so many cool things that people can build, but a lot of this stuff we haven’t even thought of yet. The promise of Ethereum is there, we just need things like CryptoKitties and the Pouncing Dead to show us how cool this stuff is.