Hi everyone, my name is Recytnik. I'm from Ivo Martian's company and today I will try to tell you
how and why from 10 developers, the developers should take care about the privacy. And you know a lot of people in
a lot of developers who are still in Twitter will ask a question like, oh no, politics again,
like I prefer to talk about memory, about the code, not the politics. Why? And this is a good question,
like how software industry related with the principles of politics. Open source, a lot of people who
still in Twitter think that open source is a way to get a free software. But in reality, open source
is a way to control your software that the laptop belongs to you and not just rent from the company
from the Apple for instance. And so this is pretty political idea that I should and must control
my software that it should belong to me. I think the very important part of software development
is mistrust the authorities and it's pretty political decision. But my favorite code from the developers
is the quote from the people who created RCA like all these encryption algorithms, actually
TPS in your URL bar. Like the decision we make about communication security today will determine
the kind of society we will live tomorrow. And this is a good example of how we as a developer should
think about what we're creating. It's not a software, it's not a task in your zero management. It's a
society where you will live where your child will live, etc. And I think software was always
about politics in principles, open source, high-end cryptography, it's always about the politics.
And it's only a modern generation thing that they should be out of the politics. This is a movie
hackers from the 1993 and this show completely different pictures of ourselves. If I will go
to frontend conference, it will look like this, not like this. And unfortunately this is a problem.
Okay, why I should care about privacy and understand that software development is about privacy
but why I should care? First, because you're creating a software, the world where you will live.
If you create a software which track a worker's hours, like what you're doing on the laptop
in the next month, you will use the software against you. Second, you know, working just for closing
a genotask, just for money is meaningless. It's created empty hole inside your soul and create
and having some fun together making the revolution is always fun. So having the principles
make your life much more meaningful and finding. But all the things about principles, what about
the privacy? It's about principles in general and there is multiple principles,
politics and solutions which you should care about. And like there is no objective way to prove that
one revolution principle is better than another one. But I will try. So why you should care about privacy
especially? Of course, like there is a lot of misconception about privacy. First,
in this assumption, it's like that Google, et cetera, they took our data only to show
the better advertisement for you. You should not be care about privacy because all the
survival is for your better advertisement. Unfortunately, it's not exactly how it works.
And the main problem here is a very shaded thing which nobody really takes to speak about is data brokers.
You know, like when you have a software and there is some trackers like Google Analytics,
some advertisement, this data is not going to only one company. It's going to the company
which aggregate a lot of data together and they sell this data,
aggregated data to very shaded clients. Here's a one interesting example.
This is a data broker called XMode and in 2020,
journalists found out that this data brokers buy a data from about 100 applications,
including Corona application, missing data application,
drug applications, and then all this data aggregated data was sold to US milk to contractors.
What could be more shady that selling a missing data to the Americans military?
Like it's fucking pretty crazy. Okay, this is like a bad company,
but my company doesn't sell the data. I'm working in a good company.
And here's the problem, like you don't need to sell the data,
so this data will be available for data brokers.
There is such a thing called data breaches,
so data leaks when data will be taken from your company without your permissions.
My hackers buy some leaks, et cetera, et cetera.
And we have more and more leaks every month.
And so if you store any data on the server,
this data will be leaked in some point of the company history.
The only way to prevent data from the leaking is not to know
to have a better security system, et cetera, just not to store the data.
And there is a very interesting example.
Like there is a Yandex food delivery, similar to Zubili, et cetera,
and they leaked all data from 2021 to 2022.
This data includes your first last name, from number, delivery address,
and delivery time.
For the whole year of all cities and of Russia, that was leaked.
And you know, imagine that once you have a meeting with your grandma,
give you some Hiroshki, and you told that, no, I don't want it,
I'm already a lot, but then.
Like the funny part that people create in website, which everyone can use
to search this data, and then your grandma going to this data, put your name,
and find that after this dialogue, you go in, you order a Chinese food.
It could be, you know, very bad situation in your family.
But you know, like, you can understand, like, right now, people use this data to
track president, because it's easy to track the, like, execute the present security,
according to this data, because they have a phone number, et cetera.
Okay, then mistake, the next mistake.
Okay, but the data, which my company collects, is not, you know,
sense it, if it's not private data, just email.
And here's a problem.
The problem is called big data.
We can compare data from a different application to make a very interesting connections.
For instance, this application can run up, and, like, it does have any
like registration, it just use only location to show the direction to the,
but of course, like, if user have this application, we know that this
application is, this user is very likely a Muslim.
But then we, this is another application, social application.
We use location to make a picture, like Instagram, to make a, to put a
location inside the pictures.
And this social app has email.
And we can use locations to connect, that it's exactly the same person
using a corona application and social app application.
And then we can use all data bridge to connect email with the real,
phone name.
So this corona application and locations, it's a sensitive data,
because it could be connected with other data links.
And then, make it very, like, painful, very dangerous decisions.
Okay, and this is a very interesting example.
How many people here use Google Analytics on their website?
It's okay, it's okay, it's okay.
It's okay, it's okay, it's okay, it's okay, it's okay.
Like, according to statistics, the global interest is about half of the website.
And the Google Analytics, it's not only track, I use it inside your website.
It has a global user ID.
So Google Analytics track your path through the whole internet.
And it's not only through this 50% of the websites,
because Google Analytics know where you can go next from the tracking websites
to the tracking area, because it could track the clicks.
And it could track a referer.
So it can understand where, like, from where did you come here.
And as a result, I believe that Google
can understand about 75% of all your paths through the whole internet.
And, like, connected to your exactly username, phone number, personality.
So, you have exactly profile of what you do across the whole global internet.
And this is, like, how they combine data together.
Okay, next mistake.
No, I have nothing to hide.
If you have nothing to hide, you have nothing to fear.
The main problem is that there is people who have something to hide.
For instance, like, extra employee sells the data to Saudi,
about the decisions in Saudi Arabia,
because Twitter collects the data.
And as a result, one person going to jail and a lot of skill.
So, unfortunately, if Twitter would not collect this data,
they will be released right now.
It's not only, you know, about Saudi Arabia.
In Israel, it's a company who created a Facebook condition system,
which you use in the Russian, other countries to prevent mass protests.
And it's not only about a new citizen of Saudi Arabia,
Russia, like, a proton mail, get data to the Spanish government
and then it's combined data with Apple to find a person who helped
mass protests during the Catalonian independence movement.
And this person going to jail, because of this data.
And if Apple and proton mail did not collect this data in first place,
this person will be free.
And even if not about somebody who tried to fight against government,
the more your data available online,
means that LLMs could convince you to do something different by this data.
Because your private data makes LLMs much better to change your political views
and it's very dangerous.
But what I can do about all of this problems.
Yeah, this is a problem, but I'm just a developer.
Okay, different topic.
You know, modern internet is a shitty place.
Pop-ups is everywhere, it's hard to use.
Somebody made it very bad, yeah.
But, like, I mean, the JavaScript section is like, first of them.
Like, it's we made internet, awful place, full of the pop-ups.
It's exactly we are to make, you know, adding this pop-ups to our website.
So, first step, remove fucking GDPR pop-ups, please, finally.
But you know, but like, it's a European bureaucrats forced me to do it.
It's, you know, all this left government forced me to do it.
It's not what I want.
But the main problem that in GDPR, law, there is no pop-up world.
And reality, we add pop-ups, not because we forced by GDPR.
The reality that our software industry could not stop tracking users.
GDPR has a very simple idea, stop truck users.
But we cannot combine this force together.
And like, this law changed, like, our answer to this law is not stopping to track users.
It's to punish users with pop-ups until they agree to give the data.
You know, like, the whole pop-up is a black design pattern.
Like, we show it's exactly in the moment when users don't want it.
So, like, he will be the most suffer, and this software will force the users to allow us to track him.
Said.
So, what is the right way?
It's to use GDPR compatible analytics, instead Google Analytics.
Then you don't need to show pop-up.
And only when users will give you a data in some reasonable way, for instance, sign-up form, et cetera,
we will have you know some checkbox explaining how we will use this data.
Et cetera, it will be a good design.
Nice.
And analytics without GDPR pop-up right now is very capable.
It could track your campaigns, it could track sources, it could track events.
It could, you know, understand that if a person came from this website,
he buys something, kind of, this type of analysis could combine this data,
and like give a campaign, campaign, et cetera, this data to your marketing management.
The only two things which could not track is first it could not connect actions across your website with exact user ID.
So, because it's tracking, you can track user pass through the website.
And second one, think it could not do remarketing.
It's when you collect the social media ID.
So, then when you go to Instagram, you will see a detachment about the sense which you try to buy.
Because it's a fucking creepier.
Okay.
There is a lot of Google, a lot of Google analytics.
I personally use plousible, but like all of them is pretty nice.
So, I can recommend them.
And it's not the only, it's like the sense which I heard about.
There is a lot of system right now.
There is a very good website called European Alternative Software.
I think, like, it's a company switches in Europe and then they are mostly like,
Gebercompatible.
Okay.
But what if your marketing manager force you to at Google analytics?
You know, a lot of people collect data, not because they need it,
but because they have a session, especially now, software industry.
And this is a very simple question which you could ask your marketing manager about
this data or not.
Like, what decision have you made with this personal data in the last year?
If they did not make any decision according to this data,
it's not, they don't need it.
It's just a obsession to collect more and more data.
And the main problem with all this, you know,
Google analytics and pop-ups that we cannot trust this data.
Like, if we have some users, and only part of them,
press no, and part of them press yes, it's about, like,
search for 60%.
It means that this, like, our users split it to two specific groups.
And some feature could be, and presented in a different proportion between these two groups.
So if you have data only for users who press a yes in Europe or pop-up,
you cannot trust this data because in the real case,
it could be completely opposite results.
So, like, marketing manager could trust data only,
which without private data, which could be collected from user who press no,
really, by pop-ups.
Because all this data is, like, representative.
We cannot trust data only for people who press yes.
And, you know, it's not only for you for European Union, right?
Now, across the whole world, this is very similar law,
and this is why you cannot just remove the data of the European user,
something, you know, be okay.
We need this pop-up anywhere, like across the globe.
And I really believe that our, like, software development society could change the industry.
Like, we killed, yeah, and that is polar.
You know, it can be passed.
Who, like, make a, make a website for this polar?
Like, it's what's painful for people who don't understand it.
And, like, I really believe that we are society, like,
make a better world by killing that polar.
And it was not, you know, like, okay, right?
Now, managers don't ask us to make our internet explorer.
So, like, we stop to make the website to support it.
In reality, like, developers create a conspiracy inside the company
to force companies to stop supporting their explorer.
And I believe we can do the same with the privacy.
Okay, second step.
We reduce privacy data professors.
You know, all these GPUs are pop-ups.
We care about your privacy and then, like, a huge number of people who,
they will send their data.
The problem is that, like, a lot of the companies will access
to the private data of your website.
It will be any, like, any CDNs for JavaScript or phones.
Any, like, website hosted.
CDNs, the global one.
And, like, other partners.
All of them has access to your data.
And if more companies will have access,
more companies will have access to their data.
So, the second step, reduce number of companies.
Uh, reduce number of services.
For instance, like, don't use public CDN for the JavaScript libraries.
Don't use public CDN for the phones.
Don't use Google phones anymore.
First, it's a bad for performance.
Second, it's a bad for privacy.
Just serve, or file from your servers.
Very easy to do.
You don't need any magic to do it.
Then, try to use self-posted tools.
Maybe not in the day one.
It's okay to start from the cloud solution.
But it's the option for self-host.
And then, you'll have more money, more engineers.
You can go to self-host solutions.
And second, try to combine different services inside one provider.
For instance, if you have a customer, I'm a zone.
Don't use cloud-stallair.
As you can separate the company.
Before, a CDN from the Amazon, from the Google.
From the company we have hosting.
So, try to combine everything in one place.
At least you have less number of the companies.
You can lick your data.
Start step.
It's advanced step.
Look at first.
Of course, it's a step only for new projects.
It's very hard to add it to the existing project.
So, before, we keep all data on the machine.
Second, next, we have iPhone.
And after iPhone, each user starts to have two devices.
And this is a solution for that problem.
We move the data to the cloud.
But this is completely different way to do it.
Like, elects continue to keep the data on the machine of the users.
But, and use very small server just to synchronize the data.
Between these two devices.
This idea caught local first.
With a whole, like, manifest of it, created by index switch.
It has a lot of, like, ideas, like, no spin or privacy, but default, et cetera.
But, like, I will show you an example.
There is a notion.
How many people here use your notion?
It's people who are popular too.
It's a format nodes.
But all this nodes is openly inside their cloud.
And they can read it.
It's pretty changes still.
This is a different company.
It's not the only solution.
This multiple solutions.
Just an example called obsidian.
For an obsidian, all your nodes stored on your machine.
Inside, mark down files.
In one folder.
And you can use any tool to synchronize this folder.
But, they, of course, provide their own solution.
And, like, you need to pay for it.
And this, and I think, very good example when they have monetization.
Because this cloud is, like, you need to pay for it.
But you can choose what provider you will use to synchronize this data.
And all data is on your machines.
They don't have any access to the data.
But, again, obsidian is, like, ideal case.
Your applications should not be, like, so extreme.
Like, local trust is spectrum.
And, like, different application is different part, different dot on this spectrum.
To make your application local trust.
First, you need a storage.
You need to store all data here.
So, here, you need some database.
With the rich query language.
We have a good performance.
So, if we are talking about JavaScript,
it means that we need to run a skill light of postgres in JavaScript.
It is possible.
The risk of solution call a skill light doesn't.
Or, pinch a light.
It's both, like, a skill light in the web assembly.
And, postgres in the web assembly.
It's pretty amazing.
You can use it in the web version, like, on the website.
But, also, in your not-js application, for instance,
like, to make access to stores the data.
To use postgres language.
But, stores the data in the file without any server.
Like, send a second.
You need some persistent storage on your browser.
And, this is a way, it's called,
OpenFS.
It's a way to ask browser to create temporary data.
To create a folder for you, for your websites.
And, then, your website will have access to this folder,
and it can create any database files inside.
But, there is another way, called, in this database.
And, the funny way, that Firefox used a skill light for in this database.
And, if you will put a skill light inside in this database,
it means that, like, it will be a skill light inside a skill light.
So, like, it could be funny.
A funny part.
It's still faster, like, putting a skill light inside the skill light.
It's faster than just in the index of the database.
Don't use in this database.
Shit database.
Nobody likes it.
And, a big benefit of skill light is to be used at a strict native as well.
So, like, a skill light is much better solution.
Second, you need not only to have database,
but you need operational lock.
So, every time, when you have, like, user interface,
and usually change something to this user interface,
this user interface, like, reacted, etc,
will not change the data directly in the database.
Instead, it will create an action,
and put this action to the action lock.
And, different code will read action lock,
see a new action, and update database.
And, on this end, we will, like,
using the interface will read the new data from database.
Why we need this action lock?
Because, if we were going to make a local trust,
we need a way to synchronize data with a cloud,
and we need to synchronize data between different browser tabs.
So, in reality, it's distributed system.
And, the best way to do distributed system is to have
operation lock, because in this way,
it does not matter who change the data.
Because, like, if it's a server,
the server will edit data to your operation lock.
It's a different browser tab,
it will edit data to your operation lock.
And, as a result, your software,
it actually will be mass, mass, mass,
more simple, because,
all different ways of to change the data will be equal.
Then, you need to use CRDT to resolve
automatically resolve context,
because there is no one source of truth.
Don't afraid of CRDT, like, a lot of people
think that it's something mathematical,
it's hard to read,
because, like, it's was created in the university.
In reality, it's very simple system,
and there is a lot of libraries just use it,
it's, like, just use the individual libraries,
easy to do.
And, step four,
good idea is to create two different password.
Two.
One password for user will,
to, like, one password to authenticate
the user at the cloud,
and second password will increase
all this operation operation lock,
when it will be send it to the server.
As a result,
your server will not be able to read
the data of user.
Benefits, the fun part.
We create all this local infrastructure
of this complexity,
lock, et cetera,
because we have a principles,
because we have a political,
realness.
But in reality,
we will have a lot of practical benefits,
business benefits.
First,
with local first,
which we created for political reasons,
we don't need a complex server.
Our server will be very simple,
so we don't need a big,
back-end team.
Second,
we can create prototype without server at all,
and it's very good for the business,
because you can create a BP
to show to the investors,
like, two times faster.
Third,
because, like, we don't
store the data on the server,
and the server is very simple.
When we will, like,
I will use the base,
you grow dramatically,
we don't need more investments,
because our server is very simple.
We don't need to scale it with our,
our user base.
If, like, we have people,
local trust,
we use machine of the clients,
more clients, more power.
And as a result,
we don't eat money from the investors,
and it's again very good for business.
And no private data,
no problem with GDPR,
no problem with the pop,
nothing, like,
no problem with that,
because we don't have open data
in our system, nothing too weak.
And, but my favourite example,
with local trust,
a lot of developers,
like, tell us that
it becomes faster for them to make websites.
Because right now,
when we have a juxtap,
because when we have fetch request,
etc.,
rest API,
we have a imperative way
to write code in our components.
We, in UI,
write imperative way,
how to go to servers and data,
etc.,
it's local trust,
it mostly likes some sort of service,
and we use the clarity way.
And this service,
take care about networking,
raw, optimistic UI,
a lot of stuff,
and the code becomes smaller.
It's mean people write code bad,
faster,
and, like,
it's again,
good for the business.
And six,
like,
another benefit.
Your applications start to look faster,
because all data is here,
and user will like it.
It will be your benefit
in competition on the market.
And with a lot of good examples,
for instance,
linear,
linear is a task manager,
there is a lot of task manager right now,
and they compete with other,
by using local trust,
because their UI is faster.
A lot of people going to pay money for them,
because of the local trust,
because they take care about the privacy,
not because people who won't privacy,
but because they take care about privacy,
they have a better user interface,
and it's good for the business.
Like,
and they exactly explain that local trust
helps them to make it.
Only,
there's a pitch with 2 million team users.
It's a very good production level.
Or there is good news with 24 million monthly users.
It means that local trust is pretty production-wedding.
And then,
there is a lot of frameworks to do a local trust.
These are big number of them.
It's only a small part,
but still.
So, there's a big guide,
where you get all the links to the frameworks,
and it works.
Good articles,
guys, et cetera.
So, go to it.
And,
last step to take about the privacy.
You know,
when we talk about the privacy,
we speak only about the United States,
and for instance,
UK.
We don't speak about other countries.
And, of course,
this is a step.
This is where advanced step.
It's only for the big companies,
but I hope there is some developers from the big companies here.
There is a lot of problems with the privacy,
different risks.
For instance,
there is a risk,
not only for you know,
governments,
secret service and threat providers,
that are brokers.
But there is also from family members.
Who know,
when you will sleep,
you will scan your fingerprint
and read your messages.
There is a local community with
very strict editor standard,
which will try to recognize you,
that you follow this ethical standards.
And,
US media focus only on the problem,
which is important for the United States.
Not about other problems.
For instance,
I am making a research video,
like a private first ever research video.
And, for US,
citizens,
they afraid clouds.
So, I will prefer to do local first,
and the application,
as a student,
will ask directly the news from the website.
But in Russia,
I cannot do it.
Because people in Russia,
they don't,
they trust cloud,
but they don't trust local internet provider,
because it will spy for them.
As a result,
in Russia,
to make a private first application,
I need to do completely opposite.
I need to use cloud,
to hide what they are requesting,
because otherwise,
internet provider,
will mix the data to the government.
Interesting case,
which is like,
a lot of privacy,
engineers don't think about it.
It's a local police check in Russia,
or Belarusian.
If you are on the street,
the local police can tell you
and ask you your phone,
and ask you to unlock your phone,
and to see your,
for instance,
telegram,
subscription channels.
And you can unlock it,
they will find,
nobody,
and you go to jail,
or you can try to know or reject it,
because you have to write,
and they will just break your legs.
You know,
like,
not a good question to do.
And,
Belarusian cyber-partisans,
they've,
like,
they've,
who you can see through those things,
but like,
telegram refuses.
So the Russian cyber-partisans create
a fork of telegram,
where you can define two different pin cod form order,
one pin loc,
it's normally pin loc,
and the loc every set.
But second ones is a different one.
Which will remove.
Alloughing subscribers will be
a dangeles for you,
and a good feature,
to do next Monday.
First, find your principles.
Second, remove the paper up or up by using
Google Less Analytics.
Second, start.
Reduce services.
It's a success to the private data.
Then, think about the local trust
when you create a new project.
And think about other privacy risks
if you make some big application for many users.
That's all.
This is my method on Twitter.
It must be on the company slides
if you need some of the things from the talks.
That's all.
Thank you.
Well, the next speaker, you can remove your mic.
While the next speaker comes up, if you...