Hello everybody, so this is a talk about crypto, so maybe first question, who has used
crypto here, like, okay, big room, so and we doesn't know crypto and wants to know more
about it, okay, good, great, perfect, so let's go, I'm Ludwig DuBurst, I'm the CEO of
the company XWiki that does crypto, so XWiki is a company that does both Wiki software
XWiki and builds also crypto, so we have been started building crypto for 10 years,
so what is exactly crypto ad, or crypto ad is a document editor, so think like Google Docs,
you have a lot of document editing where you will find, like equivalents to PowerPoint,
XWiki but also text pads, also rich text pad in HTML, you'll also find a whiteboard,
but then you will have some additional features which we'll talk about, but so one of the
aspects that it has all real-time editing, so that means you can edit with other people,
like in Google Docs, or like in Etapa, or in a few tools like that, we also have some additional
features like calendars, drive, teams, which makes crypto the full collaboration platform,
but the most innovative and interesting part of crypto ad is that it's end-to-end encrypted,
so what does it exactly mean, it means your data will be protected, I'll get back to that
to explain a bit how it works, so one of the key aspects of crypto ad is that it will
give you a familiar interface, so something that is easy to use, one of the assumptions we take
is that if we want people to get off the big text, we need to give them something simple,
and if we're giving them encryption and security, it needs to come without too much cost
in terms of understanding of the platform, it needs to be easy, encryption and security
tends to be complicated, it's difficult to understand what you need to do, and if we want
people to use encryption and protect their data, we need to give them something simple,
and crypto ad is of course a full open source platform in a GPLV3, so crypto ad has received
11 years of development, so we started 11 years ago, and you can also try it on crypto ad
so anybody can start using crypto ad right away, you go on crypto ad far, which is the
flagship instance of crypto ad, so we host it in the crypto team, and you can start using
crypto ad, and it's extremely easy to start using crypto ad, the only thing you can just
start without even creating accounts, you click on one of these documents here on the link
when you get to crypto ad far, and you get to collaborative documents, and then you have a
button, create a link to share it with people, so one very important thing, in order to keep
the security of crypto ad, if you create a sharing link using that way, using the link creation
instead of the sharing through the crypto ad platform, which requires people to register,
if you share it using a secure platform, otherwise you're breaking the security of crypto ad,
so share it using signal, matrix, element, so systems that are also encrypted, don't send it
by mail, if you send it by mail, you're taking a risk, if you absolutely need to send it by mail,
you can add a password to the link, and you can give the password by text message, by phone,
to the people that you're sending the link to, and in this case, you won't have broken the
security, so what we believe is that you can get collaboration and privacy at the same time,
that you can get books, and this is what we're trying to do with crypto ad, so security by design,
what does it exactly mean? So one of the problems with encryption is that everybody says
that they're doing encryption, so if you ask Google, Google is encrypted, it says HTTPS,
HTTPS is encrypted, but what is very important is that, well, you always have an encryption
between the user and the storage, but once it gets to the server, at that point, it becomes
unencrypted again, so the internet is massively encrypted when it comes to the communication,
between a client and a server, but at the server level it gets unencrypted, so what does it mean?
It means admin can actually look at the data, now there is a second level that actually
big text say they use encryption for that, yeah, we encrypt the disks, so we encrypt the disks,
but in reality, the admins still have the keys to that disk, so the admins can still see the data,
and so this ends up being a bit of encryption washing, like yeah, we do security, it's great,
it's super secure, but in the system, admins can always see the data, with n to n encryption,
so the word n to n is very important for those that don't know that word, it's very important,
n to n means it's encrypted from the user to the system, and it stays encrypted there,
and the admins don't have the key, so the key is owned by the users, only the users have the key,
the admins cannot look at the data, and that's what's happening with CRIPAD, if you use CRIPAD4,
you create the document on CRIPAD4, we, the hosters of CRIPAD on CRIPAD4, that's us,
or if you use another CRIPAD server, the people managing that server cannot see your data,
so what's important to understand is that encryption in itself is not enough, it really needs to,
it needs to come with how the key management is done, and that is n to an encryption,
with good key management, so when you get to an encrypted platform, it's important to think about
how the keys are managed, and so we should all favor into an encrypted solutions because they
really protect the data more, so systems like signal, element, CRIPAD, or Proton, Proton is not fully
open source, so Proton tends to show their source for the clients, they don't, they're not an open source
platform because all the service system is not open source, so usually serious and to an encrypted
platform always show the source of their client, because you cannot prove that it actually does
what it's supposed to do, if nobody can look at the code, so open source for n to an encrypted
platform is actually critical, it's really important because people need to be able to
audit the code to verify that it's actually doing what it promises to do, and one thing that
is important to understand with n to an encryption is that it might come and it comes usually
with some loss of features, it's more complex to build all collaboration features using n to
an encryption, so we need to be honest about it, but CRIPAD is a proof that you can actually
go quite far, so you can build quite a lot of collaboration features when n to an encryption
when you put your mind to it, so when the big text or when other companies say, no, we can't do it
no, they have the money to do it, if they wanted they could do it, they just don't want to do it
because they like to see the data, so CRIPAD is about CRIPAD first, so I won't go too much into that
because even myself, I don't fully understand it, so this is explaining how encryption works in CRIPAD,
so the key point in CRIPAD is start, so when you create the document, the document has a key,
every document in CRIPAD will have a different key, so there's going to be a key for every document
and that's where the drive is very important, all your keys will be stored in your drive,
so that it's simple to use, so the drive acts like a wallet, wallet where you put your keys,
you put your cards basically, that gives you access to every document, and your drive itself
is an encrypted document itself, and this drive is encrypted using your username and password,
so if you use CRIPAD, if tomorrow you start, you decide to start using CRIPAD,
your username and password will never be known to us, there are your keys to the system,
we cannot recover your data if you lose your username and password, so the combination of
your username and password becomes your key using a secure algorithm called SRIPAD, and these two items
are things that we don't know on our side, and we cannot help you recover if you lose them,
so it's going to be super important for you to back this information up in a secure location,
so in a password manager, on a paper, in a safe, on a paper, in an envelope, somewhere in your home
that nobody knows where it is, it's super important, otherwise you're disclosing your data,
we cannot do anything for you if you're losing your data, maybe in the future will allow you
to give your keys to a group of friends, which could recover them together for you in order to have
a backup system, but today we don't have that type of feature, so if you lose your username,
password you lose your data, this is by design, and if we were able to do it, then it would mean
that we're not doing what we're saying we're doing, so it's encryption for all, the
goal of CRIPAD is really that anybody can use it, it should be familiar, it should be easy to use,
so when you get to a drive, you click your open document, it's simple, simple to use,
so we also worked a lot on accessibility, because we believe that it should be usable by
anybody, so it's not easy to make platforms like CRIPAD fully accessible, because all the editing tools
are quite complex in terms of how to use them, because it's not only about viewing and reading
documents, it's about writing them, so it's at a level of complexity, but we've did quite a lot
of work, also with the help of internet funding that and giving us free audits in order to improve
the accessibility of the platform, and this is on come something we're continuing to try to do,
the quote is actually the result of an audit, so that we have a system that's quite accessible already,
so what happened in 2025, so first the main thing we know on how to measure if CRIPAD is
liked and loved by people is people using it, so the first thing is that we have 2000 instances,
so 2000 of 2000 people have installed the CRIPAD server, for these servers we don't really know
how many people are using them, like they're just independent servers, and you have on CRIPAD,
if you go to CRIPAD org, there is a free instance list, so you can have free instance list that are
managed independently by people in different countries, the way it's hosted is mentioned,
we cannot vouch for them, for these instances it's important, because we don't know what was
handling the instances, and there's still a level of trust that you need to have with the
host, or is that while the host cannot see the data, the host could hack the code and modify the
code and then steal your data, so it's still important to have some level of trust with your host,
CRIPAD is not here to protect you from malicious users, it's protecting you to what we call
insecurity, what is called insecurity, honest but curious, that means you could be curious,
but you're honest, you're not going to try to see the data, you're not going to hack to see
the data, you're not going to decide, you're going to be honest, you're not going to be tempted to see
the data, and it's like basically the idea, and the idea that if the data is visible then people will
read it, so I'll speed up a bit, so two million five to three million pads every month are
read on our CRIPAD flagship instance, so the CRIPAD flagship instance is the most used instance
in the world we believe, there's like 60,000 people having accounts and using them every month,
a hundred thousand people using forms, I didn't mention forms at this point, we also have a
service system which allow people to protect the answers of survey and that's heavy to use, it's
very heavy to use in the internet, we have 7,000 to rich tax documents for 500,000 per month,
office documents that are open, this is a registration curve, you can see over the last 30 days,
it's growing quite a lot, and the reason it's growing quite a lot is that in 2005 we've been growing
a lot in the US, so you can try to guess why it's growing in the US, and in the last 60 days
it has almost double usage in the US, and the reason is that activists want to need to protect
their data to communicate with other activists, and that's in particular the form system is
heavy used by activists to put in contact with other activists, and in the last 60 days we got
huge usage in the US, which is very sad in some way, but it makes us also very proud that we're
helping these activists, 2000 instances and we have these stats about which pads are being used,
so heavy form usage, we have a lot of engineers, even the UN has used grip at this year for form,
and it actually what's very interesting with the form is that it brings us 100,000 users per month
which in many cases probably vast majority of these people don't know grip at, because it's
other people that are sending them the pad, and it makes people aware that there are alternatives
to get thumbs and to big techs, and that you can actually run forms with another system, then google
forms. We have worked on UIUX this year, we have redesigned a few components,
there is a regular complaint that we could be better in terms of design and looking
and feeling prepared, so we're working on it, we're making improvements, so we have made improvements
to the look and feel across the board, and in the last few years we tried to focus more on the
UX user experience, so how the boxes are designed, and what message we're giving to the people,
then on the look itself, now we're also going towards the look, and we're trying to work on this,
we still have plans to make more improvements, so that's the new icons that we put in place in
in the last few months, this is how we evolve the trees, so I mean it doesn't look that much,
but it gives a different feeling to people, and it improves the look and feel which is important
for people to love the tool, and another thing that we developed, and that is interesting for
developers, that for them, is that we created an API, so crypto can also be used using that
API by other tools that are that could encrypt documents and use crypto as a document editor,
so that would allow to use the capacity of crypto, which is to edit 10 types of documents
using encryption systems, and integrate it with other encrypted systems, with other
end-to-end encrypted systems, so if you're a developer and you find that interesting, go check it out,
it's been funded by French funding, so we also developed crypto at cloud, so for an organization
that wants to run its own instance separately from crypto, but doesn't want to run it itself,
they can do, they can go to a cloud, and we have paying services there, and it's also a source
of revenue for us, some other works is that we have upgraded only office, we made lots of fixes,
we also experimented with post-contom cryptography, which is something we'll need to do in the
future, it's not yet urgent, but and it's still, there are a few problems with it, it's not so
easy to integrate in a tool like crypto, it needs to stay performant, but this is something we've
been working on, and the German security agency, BSI, made a security audit of crypto, which has
been quite useful also, to understand if we have security issues, so they found a few things,
not anything critical, but that are still interesting to improve the security of crypto.
So some information of finance, so crypto has open finances, if you go to a blog you can find
our finances, we haven't yet published the blog for 2025, which basically is going to be this
information, but we have the information for 2024, so we have nine people that are working on
crypto ad, overhauled it costs between 600 and 700 k a year, because I believe so the reason we're
doing open finances is that how you fund open source is an overlooked issue, it is something that
is actually quite difficult, and I'm running a company paying people doing open source, and I'm very
focused on how can I pay these people, and so for crypto ad, this is also our objective, is how
can we build open source, be sustainable, and pay people every month, and not think about, okay,
how are we going to find the next paycheck for the people, so we have nine people working,
crypto ad costing between 600 and 700 k, being inside xwk size, which is a 70 people company,
that is already sustainable on the xwk software that we sell to businesses, gives us financial
stability, that's actually quite important for the team, but it's still challenging to fund the
project, crypto ad is not a very key in project, it's currently mainly funded with research
failed 2024, so last year we were at 80% is research funding, so only 20% is money that we get from
actual users of the software, 80% we need to go to people to get it, like asking the European
community, can you give us money, asking an internet, can you give us money, asking friends,
can you give us money because this is good software, and so one of the things we realize is that
we also had, we need to sell, so we could sell to users, we could sell to companies,
now we saw that for crypto ad the best pass was going to be to see like consumers themselves
can fund the software, signal has managed to get funding from their users, we believe that
crypto ad can do the same, and we chose to prioritize that revenue, so one of the things that if you
want to donate for crypto ad to crypto ad, you can do it, we have an open collective to participate
to the funding, I'm not going to spend too much time on that because there is a lot of numbers,
but these are all numbers, so in 2025, including our budget for the next year, so how we hope to
be funded, so what you can see here that 25 is funded is basically we finished at minus 12k,
that's not too bad, still 12k missing, but that's fine, getting most of the money from research,
30% of the recurring revenue, 30% is recurring revenue from customers now, and that has been
big progress because we move from 17% to 30% and that has been a big progress, the reason is that
we did 50% growth on the subscription on crypto ad far and on donation, both together, so 80%
we have 150k coming from subscription and donation, 80% of it is subscriptions, 20% donations,
but they have both grown by 50% in 2025, we hope to do 50% next year, which is quite challenging,
it's not that easy, like Trump is helping us a lot to grow because we have revenue from the US
and that's great, but we know, let's hope that Trump will stop helping us grow,
but that users will do help us grow, but if we count on these 50%,
while you can see it's 26, it's still funded because we still have a very big French research project,
but if you look at 27, 28, oh we're not there yet, like even with 50% growth, if we don't find
some extra funding, we won't be able to sustain the same team that we have today, so we still
we will still need to find funding, I'm not worried, we can't find it, so one thing with this
information is to make understand also that users have a very important role to play in helping
the platforms we funded, if we want to open source platform, we need to fund them as users,
so we need to contribute to it, we can't get everything for free, so now to finish what's coming,
so one of the things that we hope to grow 50% on crypto default, the biggest difficulty
when it comes to growing crypto default is that to grow paying users, we actually also need to grow
free users, we give one gigabyte for free on crypto default, that's quite a lot, we have 400,000
free users, we have 1500 subscribers, so if we want 3000 subscribers, well if we get the same
conversion rate, we need 800,000 free users, well today the platform is already at maximum
capacity, not because of hosting, not because of the capacity of the machines, because of the capacity
of the software, so that's why we're working on a scalable server, we've been happy that NLNet
accepted to fund it through NGI Commons, so we got a funding for that, and we hope to launch this
before the end of the first semester because we absolutely needed, otherwise the platform will go down,
crypto notes, integrating blockchain in crypto, is something that we will integrate,
we'll also try to continue to work on UI UX and on mobile, there's one of the biggest
requests from our users, be better on mobile, it's not simple to be highly performant on mobile,
mobile behaves differently and less stops when it comes to memory management, it tends to cut
the connection, reload the pages and that's more expensive for us, and that's more problematic,
to good news is that we also ask for funding with the project next graph, I think next graph
has a DevRome, tomorrow with on local first software, two DevRome, and we're going to work with them
and start doing some level of federation between crypto servers, so it's going to be a start
towards federation, collaborating with the next graph team, that technology is super interesting,
it's still new, but it's going to be interesting to integrate it and we got funding
from the European community together, it got announced yesterday, so that's actually completely
fresh news, change has changed our budget, like our budgets would be way more red if we didn't have
that project, and now to finish, well, the message I want to give is, the data is precious,
we need to protect our data, so crypto ad does offer an alternative to to Gaffem software,
to Microsoft Office 365 or Google Workspace, it's encrypted but it's still easy to use,
give it a try if you haven't, I mean if you think that open source platforms cannot be easy to
use, you're wrong, they can be, and we have lots of use of a crypto ad, they're not techies,
they're writers, lawyers, and they're using it, and because it's a platform that is easy to use
which in addition protects your data, and another message is, we have crypto platforms,
crypto platforms is an incredible tool to protect data when you do surveys,
actually nobody should be doing surveys with Google forms, this is forcing people to go to a
non-sexual platform, to accompany that tends to look at every data, and so, and the
your users didn't make the decision to go to Google, they should make the decision if they want
to go to Google or to something else, with crypto ad, you're sending them to a place where the
data is not exposed, so you're much safer there, and actually this is actually how a lot of
activists and a lot of people are helping us, that sometimes on Twitter LinkedIn and so on,
when people send out to Google form to answer survey, you get people say, why are you using Google
form, when you have crypto ad that is free, that's how we got the UN using a form, they had a
Microsoft form, somebody said, I don't understand, you're making a survey about sovereignty,
and you're sending people to Microsoft, how is that possible, like it's not possible, like you
can do that, and crypto ad is free, and so, well, if you actually, if we all participate like that
and send an expose people that are actually sending people to platforms that aren't secure,
we'll get more people that will use open source and use secure software, and another message is
that we still need your help to get to finance the stability, we will need to grow the revenue,
we hope to grow it through growing free users that pay, but if we actually get more people that pay,
for the same number of free users, then obviously we will be in a better shape, and we will be able
to hire, so we still need to help for that, so I want to thank you for listening to me,
I didn't leave any time for questions, I will maybe like one question, and yes,
I have two questions, I can choose, I found it very great, I just wanted to say that the
version is like, we need it, yes sorry, because as you pointed out, the distributed
source code must correspond to the deployed one, and this we can check and let's be deployed,
and then obviously special, and then I'm going to be like everybody's paying it, so everybody's
so I am blind, so I am thinking about this from this point of view, and you will be much of
accessibility, so I am too questions, and what is your level of conformance to wake-up,
do you know about blind people being comfortable using a quick bank,
this is basically inside of the browser, right, yes, second question, how is it, is it to you
prepare outside of the browser, and most specifically does your API provide fine-grain access to the
young editing feature, or is it like just you can like, don't know the document, but if you're not
editing to the end, okay, so I need to repeat the question, and I really don't have a lot of time,
so the first question, so now I forgot the first question, WCG, yeah, so I don't want to say too much
wrong stuff, so I think we have documents on the internet, so the best would be to find
the actual reports, I think it's level one, we're going to level one, and we got a decent percentage,
the problem of the quick bank platform is that it has 10 editors, so I mean it really depends
on every editor, so when you get to office documents, it's not, it's a different story,
then you get to with a week, so it's difficult, it's difficult to answer, so I don't want to say
that we're great to access about, I don't think that's the case, I think we're really doing
our best with the funding we have, we're trying to get funding to do it, but it's difficult,
it's difficult to work on that, I'd like to point to the documents on the internet,
then there was a question about blind people, we don't have too much knowledge on our side,
we don't have too many contacts, so I cannot really answer that question, and yeah,
in terms of API, we don't have an API for developers, what we have is an API for developers
of apps, we have an API for developers of apps, so if you have an app that manages documents,
you can embed crypto pad, so it's an API to embed crypto pad, so you have a crypto
server, and you can send a document to crypto pad, make it editable and embed it as an
I-frame in your own software, so you get access to the editing features of crypto pad,
actually the other type of API that you might think about is one where programmatically
you can access the content of documents, read and write, that is actually something that we
don't have that easily, this is one of the difficulties with intuition, we need a lot of code
on the client side in order to make APIs, and for some documents it's super complicated,
so we have done some experiments with common line tools to connect to crypto pad, so for example,
we have some common line tools where you can create a rich text editor, but we don't have one
that can create enough is document, and the problem is that it's very difficult to actually
interact with the actual content when you don't have the editor, so for purely common line
API it's much more complex work, we're trying to work on it, but it's a lot of work, thank you
thank you and let's say that you uploaded all the team of crypto pad that is working on it, thank you