[00:00.000 --> 00:08.540]  This thing where a bunch of brogrammers get together and solve problems because programmers know how to fix shit, right?
[00:08.900 --> 00:23.040]  And the prototypes that come out of hackathons often just sort of sit on the vine and die there.
[00:28.050 --> 00:29.170]  There, that better?
[00:29.610 --> 00:30.290]  Woohoo!
[00:33.950 --> 00:46.790]  So, a lot of women, a lot of people of color, a lot of people that are not cisgendered or heteronormative end up feeling very uncomfortable at hackathons.
[00:47.190 --> 00:54.290]  And a lot of projects get big prizes at the hackathon and then disappear.
[00:54.290 --> 00:55.810]  And nobody ever hears from them again.
[00:56.270 --> 01:00.630]  And if you're lucky, there's a GitHub out there somewhere with halfway working code.
[01:02.130 --> 01:04.950]  Our hackathons are a little bit different.
[01:05.270 --> 01:09.870]  So, first of all, our hackathons are safe space always for anybody and everyone.
[01:10.810 --> 01:14.710]  We put an emphasis on cooperation, not competition.
[01:15.150 --> 01:19.690]  In fact, we do not give money prizes at our hackathons.
[01:19.690 --> 01:21.930]  We do do prizes of various sorts.
[01:22.270 --> 01:23.550]  Sometimes they're goofy prizes.
[01:23.810 --> 01:25.390]  Sometimes they're actually pretty cool prizes.
[01:26.750 --> 01:32.570]  The hackathons that I actually get to be in charge of and run, I try to make sure that everybody walks away with something.
[01:33.450 --> 01:41.470]  Because I think it's cool to walk away with something, you know, after you've spent a weekend of your hard labor working on some project.
[01:41.470 --> 01:47.150]  We also have a strong emphasis on learning from each other so that we can build better tools.
[01:47.710 --> 01:50.050]  I'm going to be talking a little bit more about what that means.
[01:51.750 --> 01:59.390]  And we include subject matter experts and end users in our hackathons.
[01:59.390 --> 02:06.610]  So, it's not a bunch of engineers who think that they understand how to fix the world working in a vacuum.
[02:07.110 --> 02:23.110]  It's engineers working together with the people who actually have been dealing with the problems in the first place and the people who are going to be using the tools in the end so that the things that come out of the weekend are useful to real people.
[02:24.610 --> 02:41.150]  Just really briefly, a really good example of this is applications that are made for mobile devices for, you know, fire response or other emergency response.
[02:41.510 --> 02:49.990]  Often they'll come out of a hackathon and there'll be lots of little buttons and tiny fonts and tons of things crammed into that little application.
[02:51.050 --> 02:54.970]  And, you know, somebody will take it out in the field and try to actually use it.
[02:55.550 --> 03:00.590]  And they're like, I can't do this while climbing over rubble.
[03:00.850 --> 03:01.690]  What the hell?
[03:01.850 --> 03:04.770]  And then they just don't use it and they go back to whatever they were doing before.
[03:04.990 --> 03:06.710]  So, that doesn't really solve things.
[03:06.910 --> 03:12.170]  So, we try to make sure that the users... we work for the users.
[03:12.290 --> 03:13.210]  Let's just put it that way.
[03:13.810 --> 03:13.950]  Yeah.
[03:13.950 --> 03:21.350]  Uh, our mentorship program is tailored for each project with volunteer mentors like you people.
[03:21.770 --> 03:26.110]  Um, we do user-centric co-design.
[03:26.250 --> 03:37.390]  So, we, you know, reach out to the people that are going to be using the tools and get them, uh, usually onto a Google Hangout with the team.
[03:37.390 --> 03:48.370]  And discuss what the, the needs are and, and look at designs, uh, and look at the, the various levels of prototypes with the team.
[03:48.690 --> 03:51.090]  So that they can get feedback all along the process.
[03:51.490 --> 03:57.030]  We have mentors who can help them with architecture of the system and the code.
[03:57.230 --> 04:03.130]  We have, uh, mentors that can help with learning how to deal with, uh, open source community building.
[04:03.130 --> 04:10.550]  Which any of you who have worked on open source projects know that, you know, some open source communities are fantastic.
[04:11.110 --> 04:15.490]  And some of them are like the noise bridge discuss lists.
[04:16.310 --> 04:31.090]  Um, uh, we also have lawyers who give, uh, advice and support on, uh, a range of subjects from, uh, what kind of a legal entity you might want to be as an open source project.
[04:31.090 --> 04:32.930]  Do you want to become a for profit company?
[04:33.170 --> 04:35.550]  Do you want to try to become a not for profit company?
[04:35.850 --> 04:39.430]  Do you want to be something else completely different?
[04:39.910 --> 04:50.190]  Um, we've also got, uh, lawyers who can help with legal issues over, um, you know, the problems of patents and copyright in open source.
[04:50.550 --> 04:52.970]  Uh, and, and security people.
[04:53.210 --> 04:54.470]  We love security people.
[04:56.170 --> 04:59.670]  Um, so I don't need to explain to any of you.
[05:00.850 --> 05:03.690]  That cyber security is a problem for everyone.
[05:04.050 --> 05:20.570]  I mean, I, I think everybody in this room knows that InfoSec and the security of our devices, our, our servers, our laptops, uh, you know, our, our bodily implants, if we have them, whatever, are at risk.
[05:20.570 --> 05:28.270]  There are malicious attacks, uh, in my own work, uh, outside my, my side contracting.
[05:28.270 --> 05:39.090]  I have personally seen a huge uptick in the number of direct attacks on servers, uh, of customers that I take care of personally.
[05:40.130 --> 05:46.870]  Um, and the, the malicious attacks of the criminal variety are getting more and more sophisticated.
[05:47.270 --> 05:48.850]  Which, you know, I mean, it makes sense.
[05:49.190 --> 05:54.890]  Like, you think about how Amazon software and Google software is getting more sophisticated somewhere in the world.
[05:54.890 --> 06:01.710]  There are, like, rooms full, or offices full, of people writing better malicious code.
[06:01.910 --> 06:03.590]  Those evil bastards.
[06:04.430 --> 06:08.670]  Um, and, and governments are doing stupid things, as we all know.
[06:08.670 --> 06:19.890]  And thank you to Snowden for, you know, saying out loud and giving us proof of the things that other people have been saying.
[06:19.890 --> 06:25.950]  And also showing us many, many more stupid things the government is doing that we didn't even imagine.
[06:26.530 --> 06:37.530]  So, privacy is a serious concern, whether the issue is, you know, privacy from your government, or privacy from, uh, mean people that want to steal your credit card and destroy your life.
[06:37.530 --> 06:38.990]  Blah, blah, blah.
[06:39.630 --> 06:41.730]  Um, yeah, what conference was this again?
[06:42.070 --> 06:43.970]  I'm, I'm preaching to the choir, right?
[06:45.970 --> 06:57.670]  But, if, if you guys listened to the talks with Daniel Ellsberg and Edward Snowden yesterday, you heard several things hammered in over and over again.
[06:57.870 --> 07:01.650]  We need to work on improving privacy in the tools that we create.
[07:01.890 --> 07:10.210]  We need to build, uh, anti-surveillance systems, better anti-surveillance systems, just PGP for our email, that's not good enough.
[07:10.290 --> 07:12.370]  It's nice, but it's not good enough.
[07:12.570 --> 07:13.930]  We need more and better.
[07:14.230 --> 07:16.970]  Um, we also need to make things easier for the users.
[07:17.710 --> 07:20.870]  Uh, this is something that Eleanor Saitta talks about a lot.
[07:21.150 --> 07:27.370]  Like, nobody's going to use the security tools if half the time that they try to use them, they don't work.
[07:27.830 --> 07:45.450]  Uh, and, and if half the time that an ordinary user tries to use it, it doesn't work, then we're actually doing them a huge disservice because, uh, those people who are less technically savvy are going to think that they're protected and, in fact, be even more vulnerable.
[07:45.450 --> 07:47.410]  And we really don't want that to happen.
[07:48.170 --> 07:54.830]  And we also need to build systems that, by default, enforce human rights.
[07:54.830 --> 08:03.990]  Um, you know, a totally analog example of this is the way American cities are built.
[08:04.130 --> 08:05.870]  American cities are built for cars.
[08:06.070 --> 08:11.350]  And by default, the, the public space is for cars.
[08:11.350 --> 08:16.770]  And if you want to walk there, um, you need to be in a special zone, right?
[08:16.770 --> 08:19.230]  And in big cities, we have sidewalks.
[08:19.530 --> 08:25.190]  And in, in a lot of small parts of the United States, there are no sidewalks at all.
[08:25.350 --> 08:38.190]  If you're in the Silicon Valley, in the residential districts, like, I don't know how people who live in the Silicon Valley ever get to walk anywhere because there are no sidewalks and there are, like, miles and miles of housing developments.
[08:38.650 --> 08:45.370]  I grew up in San Francisco, so I have a little bit of a, like, Silicon Valley is not the place it was when I was a kid.
[08:45.370 --> 08:46.810]  It's really sad.
[08:47.350 --> 09:03.610]  Anyway, so, um, so when you're thinking about how you design things, you really need to think about how does, how does your design actually, uh, support the way that people are going to use them in such a way that actually promotes, uh, healthy living,
[09:03.610 --> 09:06.750]  like, in the analog world, being able to walk places.
[09:07.130 --> 09:12.050]  Uh, and in the digital world, part of healthy living is being safe.
[09:12.050 --> 09:15.130]  So, you really need to think like a noob, okay?
[09:15.650 --> 09:22.470]  Think like that person who, just no matter what they do, they can't figure out how to use an Android phone.
[09:23.430 --> 09:25.190]  Everybody knows one of those people.
[09:25.510 --> 09:30.310]  Everybody knows somebody who picks up an iPhone and is like, I don't get it!
[09:30.390 --> 09:33.630]  And you're sitting there going, how could you possibly not get it?
[09:33.630 --> 09:37.830]  They spend all that time trying to make it completely user-friendly.
[09:37.990 --> 09:39.810]  But there are people who just don't.
[09:40.450 --> 09:43.950]  It just, it's so hard for them.
[09:44.130 --> 09:48.070]  Whether it's a mental block or whether it's something else, doesn't matter.
[09:48.250 --> 09:49.410]  It's difficult for them.
[09:49.570 --> 09:51.410]  And this stuff is scary to them.
[09:51.590 --> 10:05.870]  And then when we add on top of that, the issues of, you have to keep yourself private, and you have to keep yourself safe, and you have to protect yourself from potential stalkers, and you have to protect yourself from the government, the vast majority of people,
[10:06.090 --> 10:10.150]  the way that they deal with it is that they get a bucket of sand and they stick their head in it.
[10:10.990 --> 10:16.010]  Because that is just so much easier than trying to figure all this stuff out.
[10:17.190 --> 10:27.430]  You know, Rambam, yesterday in his talk, was talking about how it's nearly impossible to be private because all your information is everywhere.
[10:27.870 --> 10:31.650]  Like, if you're using Google, they know everything about you.
[10:31.830 --> 10:34.570]  And they can, you know, they've got 14 pictures of you.
[10:34.770 --> 10:35.650]  You know they do.
[10:35.790 --> 10:40.430]  Even if you haven't put 14 pictures up there, somebody else has put 14 pictures of you up there.
[10:40.590 --> 10:42.730]  They can do facial recognition.
[10:42.730 --> 10:52.310]  And, you know, they might think that your kid or your dad or your mom is you, depending on your gender, of course.
[10:53.230 --> 10:59.170]  But aside from that, the facial recognition is really quite good.
[10:59.490 --> 11:10.990]  So, you know, think about all the different ways that even we as very technical people have to look at these things and say, wow, it's actually difficult to remain anonymous.
[11:12.150 --> 11:14.330]  How much harder is it for a noob?
[11:14.530 --> 11:19.570]  So, of course, you know, just pretend like it isn't there.
[11:20.210 --> 11:21.350]  It'll go away.
[11:21.750 --> 11:26.110]  And if something bad happens, well, it was just fate, right?
[11:27.210 --> 11:29.070]  No, it doesn't have to be just fate.
[11:30.290 --> 11:35.770]  So, what's really important is that we're talking here about vulnerable populations.
[11:35.770 --> 11:43.530]  The projects that Geeks Without Bounds works on are disaster response and crisis response.
[11:43.810 --> 11:47.030]  So, when I say that, a lot of people are like, wait, isn't that the same thing?
[11:47.990 --> 11:49.270]  No, it's not.
[11:49.490 --> 11:53.430]  There's actually an international definition of what a disaster is.
[11:53.630 --> 12:00.310]  And basically, it's the two weeks after a major event that you couldn't clean up in a few hours.
[12:00.310 --> 12:02.970]  So, Sandia is a disaster.
[12:03.510 --> 12:08.730]  Interestingly enough, some years ago, there was a train crash outside of London.
[12:09.350 --> 12:10.750]  Something like 200 people died.
[12:10.950 --> 12:15.090]  That wasn't a disaster because it was cleaned up in like two hours.
[12:15.350 --> 12:17.490]  And the tracks were fixed the next day.
[12:17.710 --> 12:18.750]  It wasn't a disaster.
[12:18.930 --> 12:19.810]  It was just a crisis.
[12:21.050 --> 12:28.510]  But, on the other hand, a similar train crash in India became a disaster.
[12:28.590 --> 12:32.370]  Because they didn't have the ways to clean it up quickly.
[12:32.370 --> 12:41.650]  They didn't have ways to get the people out of the broken train, off the tracks, into hospitals.
[12:42.010 --> 12:43.070]  More people died.
[12:43.330 --> 12:47.090]  More people had long-term life-altering injuries because of it.
[12:47.090 --> 12:50.430]  And it also took a lot more time to clean up.
[12:51.770 --> 12:54.810]  So, every disaster is a crisis.
[12:55.690 --> 12:58.110]  Not all crises are disasters.
[12:58.370 --> 13:02.910]  There's the other kind of crisis, which is the long-term crisis, right?
[13:03.310 --> 13:05.730]  I mean, long-term unemployment is a crisis.
[13:06.650 --> 13:09.490]  The problems of developing countries.
[13:09.910 --> 13:11.970]  There are many crises there.
[13:11.970 --> 13:14.970]  Water crises, sanitation crises.
[13:15.390 --> 13:18.070]  The ability to get food is a crisis.
[13:18.870 --> 13:22.790]  What's going on in Syria is a crisis.
[13:24.310 --> 13:27.330]  What's going on in Israel and Palestine right now?
[13:28.310 --> 13:31.490]  It's... I guess you could say it's a disaster and a crisis.
[13:32.730 --> 13:38.590]  These... these are crises that have long-term effects on the population.
[13:38.590 --> 13:48.210]  And those populations, because of the crises that they're in, they are more vulnerable on a whole huge spectrum.
[13:48.210 --> 13:51.490]  They don't have access to money to fix a problem.
[13:51.730 --> 14:05.590]  They don't have access to, well, home to go back to in many cases to, you know, get rest and take care of the basic sorts of medical things that you don't generally need a doctor for in your normal life.
[14:05.590 --> 14:07.790]  Because you just go home and you put a band-aid on it, right?
[14:08.590 --> 14:15.470]  But when you're at a refugee camp and you can't get those basic things, you're a lot more vulnerable.
[14:15.790 --> 14:20.510]  Things that just would roll off your back in normal life won't.
[14:22.390 --> 14:22.870]  So...
[14:22.870 --> 14:23.550]  Excuse me.
[14:25.130 --> 14:36.910]  When it comes to the digital footprint of these people, the sorts of things that somebody can do to hurt those people is going to hurt them even more.
[14:36.910 --> 15:03.010]  And in situations like war, especially civil war, or situations like ongoing political crises that aren't exactly wars, but are ongoing protests or ongoing political developments of those sorts, in addition to being vulnerable because of the situation that people are in,
[15:03.250 --> 15:17.510]  they are also being actively attacked by the government or by the opposition or, you know, by a Mexican drug cartel.
[15:18.490 --> 15:26.170]  So it's important to think about those things as we're developing software and as we're managing the systems.
[15:26.170 --> 15:31.050]  So there's two basic kinds of humanitarian projects that I think a lot about.
[15:32.150 --> 15:43.210]  One of them is the kind of humanitarian projects that is attached to a large, well-established organization, whether that be an NGO or a governmental organization.
[15:43.970 --> 15:50.050]  You know, Doctors Without Borders, Red Cross, FEMA, any of those sorts of organizations.
[15:50.050 --> 15:57.410]  They have many digital initiatives, pieces of software that they may use.
[15:57.810 --> 16:05.650]  The Red Cross, by the way, still mostly uses paper and triplicate to manage their crisis response.
[16:05.990 --> 16:10.930]  They have a project that was in our accelerator program.
[16:12.190 --> 16:14.150]  Its name's changed several times.
[16:14.310 --> 16:16.710]  I don't know what its current name within Red Cross is.
[16:16.870 --> 16:41.510]  But it's a crisis response application that helps responders to deal with all of the things that they would have dealt with on that paper in triplicate, on a tablet or a mobile phone, and, you know, that can also be connected to local disaster mesh networks.
[16:42.270 --> 16:51.130]  So those projects have a lot more resources because they're attached to a big organization, but they also have some very special challenges.
[16:51.750 --> 17:10.830]  And the other kind of humanitarian project that I think a lot about, which is actually what we spend the most of our time dealing with, are the small projects that are run by passionate people with no direct support from large established or even small established orgs.
[17:12.150 --> 17:14.090]  So they have a lot of the same problems.
[17:14.090 --> 17:19.050]  They generally lack deep security skills or knowledge.
[17:21.210 --> 17:30.030]  A lot of times people know that there is a problem but have no idea how to fix the problem or how to deal with the problem or what that problem even really means.
[17:30.610 --> 17:36.310]  A really good example of that is when people think about the security of Wi-Fi.
[17:37.570 --> 17:46.550]  People will say, well, if I'm on a locked network, if I'm on a secure network, so does that mean that my traffic is secure?
[17:46.850 --> 17:48.130]  Well, no.
[17:49.850 --> 17:53.210]  Let me show you what happens when I run Wireshark.
[17:53.550 --> 17:55.750]  Let's see what we see on this network.
[17:56.890 --> 18:07.830]  And then people are like, okay, so I shouldn't do anything on a public Wi-Fi because everything going across a public Wi-Fi is automatically at risk.
[18:08.170 --> 18:09.950]  Well, no.
[18:10.310 --> 18:13.210]  There's ways that we can protect you on the public network.
[18:13.410 --> 18:18.530]  And some of them are very simple, depending on the level of protection that you need for your situation.
[18:19.430 --> 18:26.030]  If you don't mind metadata going across, then you can just be using HTTPS for everything, right?
[18:26.030 --> 18:35.870]  If metadata is a problem, then you might need to use a VPN or other tools to hide your tracks.
[18:37.150 --> 18:43.590]  So both of these groups are serving vulnerable populations in different sorts of situations.
[18:43.950 --> 18:45.670]  And they hold sensitive data.
[18:46.030 --> 18:51.210]  They hold...so here in the U.S., they might hold Social Security numbers.
[18:51.430 --> 18:52.470]  That's pretty sensitive.
[18:53.750 --> 19:07.550]  I know this personally because when I was 19-years-old and a single mom with two very small children and American Express would never have given me a card if they had actually known who the hell I was.
[19:08.030 --> 19:13.830]  Somebody had stolen my social security number and got an American Express card in my name.
[19:15.730 --> 19:28.030]  And I was like, dude, when they started calling me to try to collect, I was like, if I had known that I could have gotten an American Express card by just lying and attaching it to my social security number.
[19:29.430 --> 19:30.490]  Yeah, anyway.
[19:31.310 --> 19:36.750]  So there's a lot of other sensitive data that these organizations might have.
[19:36.950 --> 19:44.090]  Medical data, HIV status, family relations, you name it.
[19:44.090 --> 19:48.870]  Just if you start thinking with your hacker brain, I'm sure that you can imagine.
[19:50.390 --> 19:57.790]  Another thing about them is that these organizations and tools may be a source of trusted information.
[19:59.130 --> 20:00.050]  Holy cow.
[20:00.350 --> 20:17.110]  If your source of trusted information gets hacked by the opposition, whatever that opposition is, and they put fake data, and now you've got, let's say, a bunch of refugees going to the wrong place, say in the middle of the desert with nothing.
[20:17.590 --> 20:20.550]  Wow, what a great way to kill a bunch of civilians.
[20:21.530 --> 20:24.210]  So that needs to be protected.
[20:24.590 --> 20:30.250]  And both of these, even the really large organizations, still struggle for funds.
[20:30.250 --> 20:48.370]  A really big not-for-profit may have enough money that somebody in the organization is able to go out and get whores and blow, as some organization that shall remain unnamed did most recently.
[20:48.830 --> 20:57.430]  And yet still, groups within that organization will be struggling for the funds to be able to do the really important work that they're doing.
[20:59.630 --> 21:02.210]  They also have very different problems.
[21:02.790 --> 21:06.350]  The bigger you are, the more likely you're going to have organizational paralysis.
[21:07.210 --> 21:10.670]  So having somebody come in and say, you really need to fix this problem.
[21:10.890 --> 21:17.330]  And they say, well, we have to take that through our committees and come up with a new policy for it.
[21:17.630 --> 21:24.390]  And yes, it's going to take us six months to maybe two years to figure out how to deal with these security issues.
[21:24.390 --> 21:28.110]  And you're like, no, there are people at risk now.
[21:30.070 --> 21:32.730]  Versus the small organization that has no structure at all.
[21:33.590 --> 21:35.510]  And somebody comes along and says, fix this.
[21:35.610 --> 21:37.710]  And they do that thing, which is actually the wrong thing.
[21:37.810 --> 21:39.650]  And then somebody else comes along and does this.
[21:39.870 --> 21:42.650]  And they go, wait a second, that's the opposite of what we did over there.
[21:43.410 --> 21:47.350]  And they have no way to filter and figure stuff out.
[21:48.790 --> 21:54.950]  Another dichotomy is that existing infrastructure may have flaws already.
[21:55.570 --> 21:58.610]  That you need to deal with those flaws.
[21:58.990 --> 22:05.270]  The cloud service that a large organization is using has not been pen tested.
[22:05.550 --> 22:13.910]  Because even if they actually did have the money for the pen test, their organizational management is like, oh, what's a pen test?
[22:15.310 --> 22:16.610]  Wait, I've got a pen.
[22:16.750 --> 22:17.550]  Can you test it?
[22:19.570 --> 22:24.530]  And not to make you feel bad, anybody out there who doesn't know what pen testing is, it's penetration testing.
[22:24.530 --> 22:31.850]  It's when you hire people to break your stuff so that you know what's wrong with it and can go back and fix it.
[22:31.950 --> 22:35.070]  Because it's always good to have a friend break your things.
[22:35.070 --> 22:35.930]  Really.
[22:36.210 --> 22:36.930]  I promise.
[22:37.230 --> 22:41.070]  You want your friends to break your stuff, not your enemies.
[22:41.770 --> 22:47.530]  The opposite problem in small organization is having no infrastructure whatsoever.
[22:48.490 --> 22:51.650]  And they're just trying to figure out how to do this thing.
[22:51.910 --> 22:56.230]  Like, yeah, we wrote some software and it really should go on a server somewhere.
[22:56.270 --> 23:03.170]  And we're not sure if we should put it on a virtual private server or if we should use Square to make a website.
[23:06.810 --> 23:13.770]  And the organizations have different problems or, you know, issues with how money and volunteers are handled.
[23:14.410 --> 23:17.790]  So if you're going to come along and say, I want to help.
[23:18.950 --> 23:23.910]  The smaller organizations may say, yes, we'll take anybody.
[23:24.190 --> 23:26.070]  Or they may say, we don't know you.
[23:26.190 --> 23:27.050]  We don't trust you.
[23:27.390 --> 23:28.150]  Go away.
[23:28.150 --> 23:34.550]  And big organizations may have sort of a barrier to entry as a volunteer.
[23:35.050 --> 23:40.410]  Red Cross, for instance, requires that you go through certain trainings before you can do volunteering on anything.
[23:40.790 --> 23:45.010]  Like, if you want to do data entry in an office, you have to go through their training first.
[23:46.670 --> 23:48.810]  So these are issues.
[23:50.310 --> 23:54.250]  Just a word about open source projects in general.
[23:55.450 --> 24:01.570]  Projects in the open source world are, by and large, not built for security.
[24:02.890 --> 24:06.670]  And unless the project itself is about security.
[24:06.670 --> 24:10.270]  Now, a lot of projects are improving on that problem.
[24:11.310 --> 24:13.430]  Especially in the last year.
[24:14.170 --> 24:16.850]  Because people have become much more aware of the issue.
[24:18.950 --> 24:23.630]  But the new projects, every time I see a new project kind of bubbling up.
[24:23.950 --> 24:26.590]  And I start looking at what they're doing.
[24:26.830 --> 24:28.490]  I'm like, have you thought about security?
[24:28.610 --> 24:30.970]  And they're like, we'll add that later.
[24:31.170 --> 24:32.370]  First we need to make it work.
[24:34.530 --> 24:35.110]  No.
[24:37.250 --> 24:42.870]  As part of your brainstorming process, at the beginning of whatever you're doing.
[24:42.990 --> 24:49.770]  Whether it's at a hackathon, or whether you and your friends are hanging out at a bar drinking beer, talking about a project you want to do.
[24:50.450 --> 24:59.250]  At the same time as you're thinking about functionality, you need to be planning how you're going to deal with security issues.
[25:02.230 --> 25:09.290]  By the way, I just want to take this opportunity to preach this gospel that is dear to me.
[25:11.070 --> 25:15.990]  If you are a coder, you may be like I once was.
[25:16.190 --> 25:19.510]  And have a sense that, yes, I have to write secure code.
[25:19.510 --> 25:23.330]  And I've read lots of things about what makes secure code.
[25:23.330 --> 25:31.150]  And I will tell you that you don't know anything about secure code until you've broken things.
[25:32.190 --> 25:34.270]  And I learned that lesson.
[25:35.390 --> 25:37.930]  I guess it wasn't the hard way, it was the fun way.
[25:38.250 --> 25:43.110]  Luckily, nothing horrible happened to any of my projects that happened before I started breaking things.
[25:43.310 --> 25:45.590]  Or returned to breaking things for fun.
[25:45.970 --> 25:47.950]  When I was a kid, I broke things for fun.
[25:47.950 --> 25:51.290]  But then I turned 18 and went, huh, jail time.
[25:55.990 --> 26:00.050]  But, you know, then I learned the legal ways to break things for fun.
[26:00.050 --> 26:00.710]  And it's all better.
[26:02.030 --> 26:05.790]  So, some suggestions for you right off the top.
[26:06.010 --> 26:15.970]  Google has Google Gruyere, which will allow you to learn a lot of things about insecure web services.
[26:15.970 --> 26:22.390]  You can break all sorts of things with their holy cheese web application.
[26:23.590 --> 26:29.210]  Sans does a holiday hack at Christmas time every year, which is a lot of fun.
[26:30.450 --> 26:35.230]  And they, like, put together a storyline that you follow.
[26:35.250 --> 26:38.550]  And you, you know, it's kind of a capture the flag kind of thing.
[26:38.670 --> 26:41.310]  And there's often some sort of crypto that you have to break.
[26:41.310 --> 26:43.650]  And it's good fun.
[26:44.650 --> 26:48.650]  On top of that, I would also... I didn't write this down, and I really should have.
[26:48.790 --> 26:55.950]  I'd like to encourage all of you, including those of you who already break things for fun, don't just break things by yourself.
[26:56.590 --> 27:01.650]  You will learn much better if you break things with friends.
[27:02.210 --> 27:08.630]  Whether you're sitting in the same room, whether you're doing the pro... co... English.
[27:08.630 --> 27:12.090]  Three hours sleep last night, way too much booze from security.
[27:12.330 --> 27:12.470]  Sorry.
[27:15.030 --> 27:21.470]  So, whether it's, like, pair programming, it's in reverse, pair breakage.
[27:22.390 --> 27:28.390]  Or you sit down, and one person at the keyboard, and two of you talking, and you swap time at the keyboard.
[27:28.390 --> 27:33.650]  Or whether you're talking over Jitsi video link.
[27:34.030 --> 27:37.590]  One of my favorite things to do breakage with.
[27:39.570 --> 27:43.270]  You... you get so much more when you're working together with somebody.
[27:43.430 --> 27:45.430]  Because you're going to know things that they don't.
[27:45.510 --> 27:47.110]  They're going to know things that you don't.
[27:47.110 --> 27:51.370]  So, you're... each of you is bringing the other person's level up.
[27:51.530 --> 27:58.350]  And the things that both of you don't know, you will find the answers faster by working on the problem together.
[27:58.650 --> 28:05.550]  And combining your Google Foo, or DuckDuckGoFoo, or whatever it is that you use.
[28:07.850 --> 28:08.410]  Okay.
[28:08.710 --> 28:11.350]  So, let's talk a little bit about the hows.
[28:11.350 --> 28:16.550]  About what strategies we at Geeks Without Bounds have been dealing with.
[28:17.470 --> 28:20.990]  One of our strategies is security-focused hackathons.
[28:24.170 --> 28:31.710]  We... have run some hackathons in Scotland, in cooperation with our sister organization, Scotland Hacks.
[28:33.010 --> 28:37.090]  This monkey, by the way, he belongs to Scotland Hacks.
[28:37.090 --> 28:41.450]  He's Paul Mason, the director of Scotland Hacks monkey.
[28:42.210 --> 28:46.190]  And he is here enjoying the conference.
[28:46.190 --> 28:49.330]  Anyway, so... so he's here to represent Scotland Hacks.
[28:50.490 --> 28:57.810]  So, what we've done over there is we've put together hackathons where we take existing projects.
[28:58.170 --> 29:02.090]  We... we have already decided in advance which projects we're going to work on for the weekend.
[29:02.090 --> 29:06.050]  And we set up a room like this with different sections.
[29:07.410 --> 29:18.990]  And the... you know, few days to a week in advance, we set up systems according to the instructions, as they are on GitHub or the project website.
[29:19.750 --> 29:21.990]  So that there is a pen test lab.
[29:22.590 --> 29:27.850]  And we set up a section for people to sit and just do code audits.
[29:27.850 --> 29:32.310]  And we set up a section for coders to fix things.
[29:33.090 --> 29:43.550]  And we also invite end users and subject matter experts on the projects themselves to come in and be a part of that.
[29:44.530 --> 29:48.950]  So that they can learn about what we're doing and how to use things.
[29:49.170 --> 29:50.890]  And so that they can also give us feedback.
[29:50.890 --> 29:59.210]  As we're making fixes to things, we still want to hear the feedback that says, yes, we know how to make this work.
[29:59.670 --> 30:01.970]  No, you just made it so much more confusing.
[30:03.130 --> 30:07.810]  That's not secure because I'm just going to try to circumvent what you just did to make me safer.
[30:10.870 --> 30:12.910]  And we get all of this together.
[30:12.910 --> 30:15.510]  The end result is we have a lot of bug fixes.
[30:15.510 --> 30:17.750]  We have reports.
[30:18.410 --> 30:26.970]  And we have bug issue tracking in whatever issue tracking that project is using.
[30:27.850 --> 30:30.530]  One of the great things about these hackathons...
[30:30.530 --> 30:34.990]  One of my favorite things to do with hackathons, actually, just personally, is to do them with students.
[30:35.170 --> 30:40.690]  And I've done them with everything from seventh graders all the way through university graduate-level students.
[30:41.510 --> 30:48.190]  And the first RockSec was very much one of these educational events, even though it wasn't at a university.
[30:48.190 --> 31:00.830]  We had students and professors from all three major universities in Glasgow from their cybersecurity and digital forensics and CS departments.
[31:01.570 --> 31:12.130]  And one of the students coming away from there said that they learned more in a single weekend than they had in the entire year previous.
[31:12.950 --> 31:19.390]  And the professors came away saying, oh, wow, this was so useful to us.
[31:21.290 --> 31:44.410]  So if you're thinking about improving your skills and not just thinking about helping humanitarian projects, this is also a good way to improve your skills, while coming away with something that you can, A, put on your resume, and B, that there's an actual thing at the end of it that's going to help the world.
[31:46.310 --> 31:48.610]  We'd like to do a whole lot more of those.
[31:49.610 --> 31:53.290]  So, again, just a quick word about why non-techies are so important.
[31:56.550 --> 32:01.030]  So, I am a developer with no graphical sense.
[32:01.210 --> 32:02.550]  There's a reason that I use Prezi.
[32:02.750 --> 32:06.910]  I used to not do slides at all because I hate making slides.
[32:07.090 --> 32:09.410]  I am basically incompetent at it.
[32:09.610 --> 32:11.150]  I like the command line.
[32:14.050 --> 32:20.690]  And I know that I suck at that, but there are a lot of people who don't realize that they suck at user interfaces.
[32:20.690 --> 32:33.310]  And we really need the people who use things who don't think in command line ease to hold and play with and poke at the stuff that we build.
[32:36.180 --> 32:39.360]  Okay, so another strategy that we have is mentoring.
[32:39.840 --> 32:42.360]  We mentor open source developers.
[32:43.040 --> 32:51.920]  I have... right now I have an intern who's working with us on the HackAid Crisis Badges Project.
[32:52.660 --> 32:57.800]  And he's working basically full-time right now writing code for us.
[32:57.900 --> 33:04.320]  And I spend a bit of time every single day with him seeing how his project's going, answering questions.
[33:04.440 --> 33:08.000]  And he sends me messages whenever he gets stuck.
[33:08.680 --> 33:11.940]  And then, you know, I help him out where I can.
[33:11.940 --> 33:23.260]  We've got a couple more people that are going to be kind of coming into that same stream of working in order to learn and do a thing on a project.
[33:24.680 --> 33:37.660]  And that sort of internship situation, you come away with, you've accomplished something and built a project that is going to be sitting on GitHub or, you know, whatever code platform.
[33:37.660 --> 33:39.700]  I say GitHub because that's what I use the most.
[33:40.700 --> 33:44.600]  In your head, you can replace the brand's name for any brand you like.
[33:47.500 --> 33:53.960]  And it also helps in getting your first job, especially for young people who don't have experience.
[33:55.120 --> 34:11.200]  But I also... not just me, but our team in general will also work with open source developers who are more experienced, who might want some mentorship on a particular issue that they're dealing with on sort of one-off and informal ways.
[34:11.980 --> 34:13.820]  We work with project teams.
[34:13.820 --> 34:17.960]  We take three to four project teams every six months.
[34:18.640 --> 34:23.300]  And actually, the application is open right now.
[34:23.580 --> 34:32.980]  We were going to be closing it, but it is now open until the 30th of this month, I believe.
[34:33.360 --> 34:57.740]  So you should... if you have a humanitarian project that you think could really use six months of mentorship, meeting with our volunteers and us once every two weeks with as-needed support in between as well, you should go to gwob.org slash apply and check it out.
[34:59.880 --> 35:12.380]  We work with not-for-profits and consult with them and sort of explain technology to them and how to use it in crisis situations, and even government agencies.
[35:13.180 --> 35:20.700]  Willow Brew was one of the people who went to the White House after Sandy to talk about how to do disasters better.
[35:22.080 --> 35:25.040]  It sounds awful when I say this, but we love disasters.
[35:25.100 --> 35:28.820]  We don't like that they happen, but we like making them better.
[35:29.720 --> 35:31.280]  So what else can we do?
[35:31.840 --> 35:48.900]  Something I'd really like to see and that I've been talking to people lately, trying to organize, is pairing professionals with students and connecting them directly with a not-for-profit.
[35:51.760 --> 35:57.220]  So there's a whole spectrum of things that need to be done.
[35:57.420 --> 36:03.400]  If a not-for-profit has been attacked, they may need help with the forensics.
[36:03.560 --> 36:11.960]  They may need help with figuring out how to get their stuff back and fix the problem.
[36:12.200 --> 36:17.220]  But hopefully, if they haven't been attacked yet, they need pen testers.
[36:17.380 --> 36:26.420]  They need people that actually have real cybersecurity skills to sit down with them and tell them what they should be doing differently and better.
[36:26.720 --> 36:42.240]  And by pairing a professional together with a student, the professional doesn't have to do all of the work, so you're not spending as many hours in your volunteer time, but you still get to have the good feeling and do a good thing.
[36:42.860 --> 36:52.560]  The student gets to pick up some of the slack, and the student gets to learn from the professional, and the not-for-profit gets help with their problems.
[36:53.400 --> 36:59.460]  So if you're interested in getting involved with something like that, please contact me.
[37:01.040 --> 37:03.200]  So how can you get involved?
[37:05.040 --> 37:13.860]  So one of the ways you can do it is get the company that you work for, or your company if you own one, to sponsor one of our hackathons.
[37:14.160 --> 37:18.960]  Most of our hackathons are sponsored by multiple organizations.
[37:19.600 --> 37:22.680]  We run Random Hacks of Kindness.
[37:24.540 --> 37:32.460]  Most times that Random Hacks of Kindness happens, Random Hacks of Kindness is the big ones, the global ones, are in December and June.
[37:33.040 --> 37:43.940]  And we didn't do one this June, but generally speaking, we do both dates and often in multiple locations on both dates.
[37:45.180 --> 38:02.520]  And we also do Everyone Hacks, which is really aimed at bringing more diversity into hackathons and really encouraging programmers that maybe feel less confident about showing up at most hackathons because they've heard about how competitive they are,
[38:02.600 --> 38:05.120]  and we're like, no, come, it'll be fun.
[38:06.660 --> 38:14.940]  And actually, if you go to our website and search for Everyone Hacks, you'll find some blog posts of people...
[38:14.940 --> 38:21.260]  written by people who came to Everyone Hacks as their first event and what that was like for them.
[38:22.780 --> 38:26.360]  Get your company to sponsor our work in general.
[38:26.700 --> 38:29.700]  We are actively seeking sponsors right now.
[38:31.140 --> 38:34.720]  Major donors, whether private donors or organizational donors.
[38:35.480 --> 38:43.640]  And if you think that you or your company could help us to do the work that we're doing, we have been living on a shoestring.
[38:43.820 --> 38:46.320]  There are three of us who work full-time in this.
[38:46.760 --> 38:49.100]  None of us is making a living wage.
[38:50.180 --> 39:01.820]  One of us have no idea who that might be, can only do this because I don't have rent, because basically I travel full-time and I'm creatively homeless.
[39:04.560 --> 39:08.600]  So we need to fix that and be able to do our work better.
[39:09.000 --> 39:10.840]  And I'm being waved at.
[39:11.000 --> 39:12.400]  We have 15 minutes left, right?
[39:12.780 --> 39:13.640]  I'm not waved.
[39:13.820 --> 39:15.020]  Oh, okay, sorry.
[39:18.500 --> 39:19.040]  Sorry?
[39:19.240 --> 39:20.000]  We have 15.
[39:20.100 --> 39:20.500]  Okay.
[39:21.570 --> 39:23.940]  Yeah, so also, come to hackathons.
[39:25.300 --> 39:29.200]  Not that our hackathons are the only fantastic ones, but they are.
[39:29.280 --> 39:30.140]  They are fantastic.
[39:30.560 --> 39:38.440]  They are among the awesome ones, and you should come and hack with us, whatever your skill level is.
[39:38.840 --> 39:57.340]  And if you have skills that you think would be useful to other projects, and you don't want to do a whole lot of volunteering, but you're willing to give one hour at some point to a project, we would really love to speak to you.
[39:58.760 --> 40:00.800]  So get a hold of us for that.
[40:01.100 --> 40:03.900]  Volunteer at nonprofits without us.
[40:04.380 --> 40:13.600]  Just remember that when you go to volunteer with them, you may be scaring them when you say, Hi, I'm a security expert and I want to fix your security.
[40:15.720 --> 40:28.460]  If you need some help or advice about how to approach organizations, in a way that will help them to accept your help, feel free to contact us.
[40:28.640 --> 40:31.420]  We would love to give you some pointers on that.
[40:32.620 --> 40:49.080]  And, you know, hey, if you've got an idea to build your own program that's going to help make cybersecurity more in the reach of humanitarian projects and not-for-profits, please build a program.
[40:49.340 --> 40:50.640]  Start your own organization.
[40:50.820 --> 40:51.860]  Tell us about it.
[40:51.980 --> 40:55.020]  We will shout it from the mountaintops if you want us to.
[40:55.220 --> 41:01.380]  We love partnering with, sharing with, and just hanging out with other people who are doing cool stuff.
[41:01.800 --> 41:07.500]  There is actually something called the Digital Humanitarian Network that we are a part of, and you should check it out.
[41:07.580 --> 41:19.520]  And if you have an idea for an organization that fits into that, that's also a, you know, it sort of lowers the barrier to entry in the sense that you're not trying to invent the wheel.
[41:19.800 --> 41:24.160]  You have friends who are doing cool things also.
[41:25.140 --> 41:36.820]  And if you can donate anything, really anything, you can find our PayPal buttons at gwob.org sponsorship.
[41:38.260 --> 41:47.100]  And I would really like to do Bitcoin donations, but I haven't figured out what the rules are about that for a U.S.
[41:47.200 --> 41:47.720]  not-for-profit.
[41:48.020 --> 41:49.940]  As soon as I know, I will take care of that.
[41:49.940 --> 41:52.680]  So that is us.
[41:53.140 --> 41:54.640]  Thank you very much.
[41:55.280 --> 41:57.100]  Worried Monkey thanks you as well.
[41:57.380 --> 42:07.420]  If you'd like to see this talk, the slides for this talk, it's at bit.ly/sterling-hopex.
[42:08.380 --> 42:11.060]  I am Lisha at gwob.org.
[42:11.220 --> 42:14.420]  And you can find me on Twitter at Lisha Vita.
[42:14.820 --> 42:16.540]  And don't get confused.
[42:16.540 --> 42:19.800]  Yes, it's Lisha with an A and Lisha Vita.
[42:19.800 --> 42:26.720]  That's because Lisha Vita is really a, like, Hispanicized nickname for Elie Sheva, which is my real name.
[42:27.660 --> 42:28.220]  Yes.
[42:28.560 --> 42:30.780]  So, Worried Monkey and I, thank you.
[42:31.820 --> 42:32.760]  Any questions?
[42:37.480 --> 42:38.040]  Yeah.
[42:38.580 --> 42:40.360]  Please use the microphone over here.
[42:49.180 --> 42:49.840]  All right.
[42:50.020 --> 42:55.980]  So, earlier you mentioned that security needs to be, like, front and center from the beginning of the project.
[42:55.980 --> 43:01.760]  But that's really contrary to my experience as a core developer and project manager for Byzantium.
[43:01.950 --> 43:08.260]  If we had spent all of our time focusing on the fun, interesting security challenges, we never would have finished the project.
[43:08.280 --> 43:12.480]  And it never would have gotten to the state where it's now being used around the world in crisis zones.
[43:13.000 --> 43:15.020]  So, I mean, perfection is the enemy of done.
[43:15.020 --> 43:21.280]  How do you balance security with the need to actually move forward, get things done, and get it out there work and help people?
[43:21.700 --> 43:29.460]  So, my advice on that is that you treat security like you treat your other features, right?
[43:29.460 --> 43:38.430]  When you sit down at the beginning, you do a lot of brainstorming, you figure out what you need to do to make this the perfect project, right?
[43:38.660 --> 43:48.420]  When this thing is totally awesome and does everything and makes people's coffee, it's going to have all these features, right?
[43:48.420 --> 43:55.720]  And then as you're building things out, you don't come out with your... your minimum viable product is not that end point, right?
[43:56.040 --> 44:02.420]  But as you're building your minimum viable product, you're already thinking about all those other things that you've done, right?
[44:02.640 --> 44:31.980]  So, if in that feature starting point, when you're thinking about our dream project is going to look like that, and you have security features in that list of our dream project, then as you're building your minimum viable product, you're already putting some of those things in and writing code in such a way that it's going to be easier to add more and more and more of those security features in
[44:31.980 --> 44:34.900]  the future because you already have it in mind down the line.
[44:35.500 --> 44:36.220]  Thank you.
[44:38.560 --> 44:39.240]  Hi there.
[44:39.240 --> 44:47.240]  I was wondering if you could talk about what, what if any, actual attacks you've seen on humanitarian projects in the wild as opposed to hypothetical attacks.
[44:51.820 --> 44:54.060]  So, this is a little bit problematic.
[44:55.420 --> 45:03.700]  I am wary of discussing the couple of big, big nasties that I've...
[45:03.700 --> 45:21.760]  So, one of the things that has happened is scammers scraping names and phone numbers of people, and then sending text messages that are phishing text messages.
[45:22.020 --> 45:32.180]  So, that's actually, that's one that has happened several times, that I don't feel like I'm saying anything that makes things worse, right?
[45:33.600 --> 45:38.460]  Yeah, I'd say that that's a really, a big one and actually a very common one.
[45:39.720 --> 45:45.400]  Yeah, there, there are other dangers in...
[45:45.400 --> 46:04.920]  There have been some projects where the, the real issue and, and actual attacks are about getting information about the people who are dissidents in a specific zone and then that puts those people at risk.
[46:05.400 --> 46:06.780]  And we know that that has happened.
[46:08.320 --> 46:09.980]  But, yeah, no specifics.
[46:10.260 --> 46:11.580]  That's exactly what I was looking for.
[46:13.000 --> 46:13.520]  Yeah?
[46:14.480 --> 46:28.920]  I was, sorry I came in a bit late, but if I may make a suggestion, what about putting up a webpage with links for, or students to these projects that they can contribute to, that are looking for contributors outside of the hackathon?
[46:32.900 --> 46:35.840]  Yes, so, here's the thing.
[46:36.100 --> 46:39.960]  There, there are so many projects out there.
[46:40.220 --> 46:41.680]  So, so, so many projects out there.
[46:41.980 --> 46:49.060]  What we do have is, at gwob.org, we have a get involved page.
[46:49.060 --> 46:55.660]  And we put up blog posts about particular projects that are looking for volunteers actively.
[46:56.560 --> 47:03.540]  And so, you can go there and, and skim through that and you'll get a lot of information about projects that we're actively working with.
[47:06.020 --> 47:11.040]  And, yeah, we, we've been looking at how to build a better clearinghouse.
[47:11.040 --> 47:18.220]  And actually, uh, something is on the horizon for a volunteer clearinghouse, kind of like what you're talking about.
[47:18.400 --> 47:20.200]  But it's actually going to be mobile based.
[47:20.480 --> 47:37.600]  And we'll have badges so that as you do things on a volunteer basis for humanitarian projects, you will be able to get something that says, yes, you've proven that you are a trustworthy and b displayed the skill so that the next project will trust you.
[47:37.940 --> 47:42.560]  Uh, and you won't have that problem with the organizations going, who are you?
[47:42.620 --> 47:43.160]  Who are you?
[47:43.380 --> 47:43.720]  No.
[47:44.220 --> 47:45.500]  We're not going to talk to you.
[47:46.560 --> 47:50.800]  So, yeah, it doesn't answer it perfectly, but hopefully it helps.
[47:51.140 --> 47:51.380]  All right.
[47:51.500 --> 47:51.680]  Thanks.
[47:53.400 --> 47:54.280]  Anybody else?
[47:55.440 --> 47:56.240]  Well, great.
[47:56.240 --> 48:02.880]  Thank you so much for waking up and fighting off your, uh, your sleep and hangover.