# Inside Out and Upside Down: Making the Web Distributed Despite Itself by Dietrich Ayala (Devcon4)

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2019-10-09
- Duration: 28:46
- Topics: blockchain, smart contracts, distributed ledger, Science & Technology
- Watch: https://streameth.org/watch/yt-wby8Qt3WZkU
- YouTube: https://www.youtube.com/watch?v=wby8Qt3WZkU

## Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on IPFS and more.
https://archive.devcon.org/archive/watch/4/inside-out-and-upside-down-making-the-web-distributed-despite-itself

I'll talk about efforts at Mozilla to enable decentralized and distributed web applications, how the success of the web is one of the biggest challenges to changing it, and share lessons we've learned shipping open source software to hundreds of millions of people worldwide.

Speaker(s): Dietrich Ayala
Skill level: Intermediate
Track: Developer Infrastructure
Keywords: Mozilla

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon 4 was held in Prague, Czech Republic on Oct 30 - Nov 2, 2018.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

## Transcript

good morning I I grew up skateboarding so I keep looking at the stage thinking skate park but I think it would probably break if I tried to skate it so I'm gonna not do that my name is Dietrich I'm from Mozilla and I've been at Mozilla for almost 13 years and primarily I mean there's interesting technology I love the web love open source open systems but the question that I asked yesterday why is really really important one and one of the reasons why I've stayed at Mozilla for so long because it's an organization that has a commitment to keeping the internet open and free at place that's accessible to everyone promotes civil discourse and elevates critical thinking and amongst other things but that set of clearly articulated values those reasons why our ultimate Lee the the most important thing and for me so today I'm going to talk a little bit about how we apply those values how we make a decentralized or a distributive web that reflects those values how the threats that we have against the web today and also some of the challenges that exist in changing the web that we have today and also talk a little bit about one of the projects that we have that were building in this space so this is Mark sermon he's the executive director of the Mozilla Foundation and and I think it was like 2010 he did a talk and actually I tried to go back and watch this talk it is on YouTube but apparently in 2010 they didn't have HD cameras and that the quality was so blurry so just to paraphrase the bit that really stuck with me from that talk is is what does it take to be a 100 year organization how do you develop technologies and platforms systems that that last have that type of longevity there are not a lot of non-governmental organizations that are have been around that long and the web is what 20 25 years now and it's facing serious problems it's the it can be an inhospitable place at times right now with surveillance capitalism and and hate speech and the internet being used as a discipline by governments so how do we what do we need to do to make the web a more hospitable place by by any measure the web really is a success there are an estimated 4.5 billion web pages and an estimated 1.5 billion websites this is an unbelievably large amount of human activity that that we put online in contrasts the combined app stores of Apple and Google are estimated to be around just over 5 million apps so this is actually not to scale a fair rendering would actually make those Apple and Google icons invisible and you wouldn't be able to see them with that amount of human content of human creation a line that browser vendors are responsible for though it really isn't it's a responsibility and we take that very seriously we need to make sure that as much of those 5 billion almost 5 billion web pages can still work that that they can be read by everyone that there's still function along with that success comes some challenges as well people who make the web are really comfortable with how the web works we're really familiar with how browsers work they're well understood security models well understood set of capabilities and constraints how what do we need to change and and how we're gonna be able to change that there's some resistance to change especially in talking about how you implement distributed and decentralized technologies and the web some of our biggest fans are some of the most challenging when it comes to talking about things like theory 'm things like block chains things like distributed applications but as long as the web stays centralized we need to have these conversations we need to figure out how to how to really move forward some of the bigger complaints like how do you mad world without URL the URLs are our core part of what made the web powerful accessible University University available but ultimately a lot of people don't understand actually how they work us as technologists we know how they work and we understand the importance of them but like this this video is Google went out on the street at one point and asked people what a browser was and it's kind of a famous video because it was really it was an inflection point as far as understanding like do people understand how the technology they use actually works people don't understand what a browser is what a search engine is what an operating system is it just i'll get smashed together it's it's the stuff we use it's how I do my thing right I don't know I just post stuff somebody puts it somewhere people don't understand how this works another one that it's really hard to imagine living without is domain names how do you live without what where's where's your company exists how can I find you DNS is one of the most like I guess easy choke points in centralization you know Indonesia turned off reddit with DNS we turkey turned off Wikipedia DNS very easy centralization and and censorship checkpoint another one of the cultural challenges is talking about protocols protocol Broz if you're talking about a protocol it must mean that you are not addressing real human problems real human problems start with where human needs actually exist and that's at the front end with the fundamental misunderstanding of the fact that we are really sitting on the shoulders of giants when we're using the Internet at all set of protocols that enable all of this to begin with here's another one is blockchain pros if you bring up the word blockchain in certain circles certainly it must mean that you are over engineering and there's absolutely no need for this at all and I found myself actually starting a sentence well not all block chains it's it's not a good place to be in and and arguably the you know there's like there's there's some good reason for that there's some justification for that and applying to the same tool to a number of different problems they're gonna get anywhere but for this we do need to re-evaluate the network architecture of how browsers work so what does that look like what is a what is Reedy centralizing the web actually look like in the web architecture that we know today a browser loads the URL on your behalf makes that request to the server and the server returns a response and the browser passively accepts that response and that's pretty much how things go on the web we have today that is the centralized single two points architecture of almost every single browsing session even if you're loading up ipfs in there it's going to be centralized somehow you're not actually bootstrapping a node from the client every proxy to a decentralized or distributed service is still just a centralized proxy there are a number of problems with this we talked a little bit about already easy to censor all the different problems where that actually are just daily annoyances sites go down sites get ddosed a business goes down goes out of business and this side goes down they or they get bought by a bigger fish that's a service you love so much suddenly disappeared poof never to be seen again after being bought by one of the big tech companies ultimately though it comes down to the fact that all the power resides on one side of this relationship and the browser itself doesn't have any say really in what comes back the server ends up being kind of like like that friend you go to meet and they always seem to be the one that decides what you're going to eat and where you're gonna meet and you start talking to your other friends and you realize that they're also being treated this way by this friend and then you hear that they've been actually taking notes about what you've been talking about while having dinner and then you hear that they've been taking those notes and selling them to people who really aren't your friends and then you end up one morning in a refugees refugee camp on the border of Myanmar or a victim of genocide because that friend was Facebook these are real problems that we need to solve and that are going to be really difficult to solve with this architecture incredibly difficult to solve as long as we have that centralization choke point we won't be able to get past this point of Mack massive structures massive amounts of control over human activity so let's fix it let's make a distributed web browser there's a lot of projects in the space a lot of people try to figure out what the what the right pattern is how what the use cases are how do we how do we solve this problem how do we create a web that is gives more control back to the user for the web to truly for a user agent actually to truly live up to its name we we have to change these network architectures and see these are some of the projects that are explaining in this experiment in this place but like I said before we need to think on the hundred-year scale we need to think about well actually as a browser vendor we're just thinking any changes we make we have to own that code forever we can't break the web we can't change things too fast we can't just be like oh yeah web v5 everybody upgrade right we have to support that that five billion web pages we have to make sure that that that that human that output of human activity and creativity stays usable and and still works so we we can't just pick a winner we can't just say all right I'm PFS sounds good let's run with it I think also picking a winner deciding that this one solution is the best really narrows the set of use cases that we can address and answering that question about like how do you build a system an architecture for longevity for first century long longevity means you have to understand these what the broader set of use cases are that all these projects are trying to address I think success looks like not a winner but many islands in the sea a healthy ecosystem is one that really props up and supports and enables experimentation change it enables a the ability to adapt as human needs change which is going to happen over a hundred years right so we started looking at what the the building blocks are in a lot of these distributed systems there's a swarm there's a CRT T's there's web servers okay should we there's a lot of key management issues do we just put a blockchain in the browser see what happens do we turn the browser into a server let it go and see what people do with it these are maybe high-level building blocks okay so what what are these built on well a set of very familiar well understood but pretty boring technologies these are things that we've been using for 20 years or more right is but you can build on top of these things those other higher-level application primitives every single blockchain is built on top of these application these lower level primitives and network architecture primitives things like access to file system these are all things the web doesn't really have today the web browser has been a client for 20 years and nothing but for the most part like the few different experiments and things that didn't really really last implemented things like discovery and but there's no real file system access that works across all web browsers for example so if these are the kind of lower level primitives how do we get these into a place where people can start experimenting and building those higher-level primitives in the web this is kind of the world that I live in as somebody who works building browsers there are these three basic execution scopes we could okay build distributed application capabilities in to Firefox itself and just make the the browser part of the application we're where we implement these types of features it'll be slow going we will be able to meet all the needs and these projects that I've been talking about half today and the needs that your projects have today so that's not ideal and we are resource constrained we are probably the smallest ok no we definitely are the smallest of the web browser vendors building major in used browsers today do we want to put UDP api's inside of a web page in JavaScript that also sounds like maybe the right level of abstraction and browser extensions which you're probably familiar with from installing that a mask it might be the right middle ground it might be the place where we can say expose some of these capabilities but without over committing too much well letting people experiment letting projects like yours experiment but without deciding that okay the web is gonna have this API and live with it forever and and without really trying to own or control what that distributed web looks like by just building it directly in Firefox so this gives us some extensibility it gives you some capabilities in a way that we can is a little bit more malleable that we can experiment with so I'd like to introduce Lib D web this is a project we've been working on for the last couple of months that adds some of these basic primitives to web extension ap is it so far adds the protocol registration so you can register custom protocols TCP and UDP API is mdns endianness and file system api is talking with the projects in the space key management seems to be really important as well there are a number of changes happening how Firefox works and stores keys at the OS level that maybe we'll be able to take advantage of but as soon as we implemented this the ipfs project took it use their IP FS companion add-on and migrated it into this experiment api's and actually got a full IP FS node running inside Firefox and one of the first things they did was start serving Turkish Wikipedia directly between two browsers which is amazing and it means that that we're onto something that maybe these capabilities at the lowest level will at least give us and are all these projects and your projects room room to play room to figure out what that next generation distributed web browser looks like so where we're at now we've prototypes a number of these api's we've proposed them to the web extension the guy's team sounds alright but of course this is just one web browser right the web works for everyone because it works across multiple browsers we need to build some momentum around what we want to do here and and we've seen that just doing even a little bit publicly is actually pretty powerful earlier this year we whitelisted a few different protocols IPF acid that and a few other ones and people were really excited about it we've got a really big response you couldn't actually do anything we just whitelisted the protocols there's no way to actually handle it on the other end really so it was more symbolic but now several months later chrome also whitelisted those protocols so you start pushing at the edges you start a little bit by a little bit looking at what features people need looking at where the right place is to push our and hopefully making progress and if any of you worked in web standards or any standardization process you'll already know that this kind of how things work anyway there's not like a group of people get together write down a spec and then all the browser vendors go off and implement it most often these things get proved out over time by domain experts giving their input and maybe some browsers experimenting in some ways so this is really actually kind of looking typical for how browsers develop the next steps we're getting privacy and security review right now are in this process for the protocol registration API which is one of the trickier ones things like TCP sockets pretty well understood not anywhere in web browsers generally right but we understand what they do want the effect they're gonna have especially in an extension but when you register a custom protocol all of the rest of the browser infrastructure gets pulled in and all of the browser's security model we make decisions around what permissions a webpage has to your data to different features based on the origin the URL that we loaded and the domain name that it came from and the security context that it has based on the SSL certificate static that came with right that actually are in those certificates is that domain name so what does it look like what is that security model what is that origin when you load and ipfs hash it's really different so we're tackling this API first because we think it's gonna be one of the more challenging API to really figure out what that what all the downstream effects on the browser are going to be I've been the last couple of weeks we've been threat modeling if you're not familiar with threat modeling and I know there are a couple of security workshops here at the conference threat modeling is when instead of you saying okay we know that's a fantasy to say that any software will ever be secure there's no such thing as plenty of security the important part is actually understanding what the threats are what are the attacks on your on your software being able to identify and articulate those attacks and then design mitigations and protections for those attacks so we're going through and doing this process the threat modeling for each one of these api's and it's very exciting I've been applying it to my personal life like I have an early flight tomorrow threat I might miss it mitigation not drink so much beer tonight go to sleep early I'm gonna die of heart disease threat don't eat all the cake again so it's really useful process I highly recommend you apply it to your software projects and your personal life one of the other things we're doing is talking to a lot of these projects what are these projects who are building distribute and decentralized web browsers or processors like things what do they need one of the ways to do this is a w3c community group the community groups at the w3c is an interesting construct construct because you don't need to be a member of the w3c to join anyone can join and anyone can participate in the discussion so it creates a place where vendors software developers interested parties domain experts can share their projects share their experiments but without any explicit commitments to implement anything and this is I think it's the right level abstraction for the communication aspects of what we're doing this is the are we distributed yet project which was I think initially started by IBM folks and as you can see issue number 27 is where we're having this conversation so if you're interested in participating in in proving out and forging what a distributed web browser might look like this is the place please come and join in hang out so this weekend's coming weekend I'll be in Berlin for indiewebcamp the indie web indie web community is is fascinating awesome group of people they're actually one of the people that say if you're talking about protocols it must mean you are ignoring real human problems so we always have interesting conversations where you get together but their set of principles for building software I think is pretty fantastic there's some parts of it that I think are really useful when looking at the things we're building and looking at them honestly one of the most is to use one of the most important I think is is use what you make if you're not using your software why would anyone else want to use it and that is often especially for the kind of things that we're building really good lens to evaluate how effective the software is that you're building build for the long web like we were talking about how do you build at 100-year scale how do you design systems that are robust the the web was designed with with legacy built in and I feel like that's a been a pretty effective way of a future proofing it because there's everybody wants access to those five billion near 4.5 billion web pages what are the characteristics of systems that that can last that long the idea of plurality as well that are there multiple implementations of your software even if you don't agree or their competitors the fact that multiple people can implement an interoperable version of the software is a testament to its strengths and also is a great way to identify maybe the things that you've been in a bubble designing and might not be right so the a good way of identifying flaws other problems that you might not see in a single implementation some of these lessons I think are really important in getting the distributed web to the place where we have billions of applications the oh missing slag area yeah so this is exciting there are real users using DAPs today for real things this I think is probably the most important signal of whether or not what you're building is actually working if real people are actually using it to solve you human problems maybe those human problems are managing and feeding digital animals that's fine but if they're doing it all the time that that's part of the course of our human life and activity means you're meeting a need and getting that world to the same billions to at least 25 years I think that focus on on human activity human needs and problems is is really important and I think that focus is what's gonna get us back to an internet that is hospitable again an internet that does meet human needs is a place where we can have civil discourse where we can have trust again Thanks happy to answer any questions if we have time looks like we have some time all right thank you very much oh sorry we got one what would you say are important metrics to measure DAP activity by because I know like you know there's quite a bit adapts that claim they have users but it's just like BOTS basically crypto shrimp was a really good example that were they had a lot of users but it was just a small amount of people basically writing BOTS yeah so I I can't answer that question but that seems like this community of people should be able to answer that question right I think that's going to be critical to having trust in things like DAP marketplaces trust in systems especially if you're investing real money things that have value to you whether that's currency or not into those systems having a having at least an agreed-upon standards for how to how to do metrics for distributed applications it's really good things like IP FS are and even that protocol are pretty wide open like you you could see who's asking for what for for good or ill it's really strong and in some ways and also can be a real problem in some other areas but building it into your protocols some way of being accountable in a meaningful way there's probably going to be important but how that works like you said it's really challenging it's really different than then doing metrics on the on the centralized web it may be maybe you could argue that a actually having not trustable numbers reduces the threat surface because right now metrics on the centralized web are kind of how we ended up in this surveillance capitalism place to begin with yeah any more questions thank you hi my question is how much of what you're doing now of what you described with ipfs and things related to the distributed web you are doing in collaboration with other browser companies right now this is just us working with a few the different projects that I listed mostly in are entirely in open repos pound D web on IRC mozilla.org is where a bunch of people from different objects are hanging out I don't know if other browser vendors are working directly on these types of api's or not I know that the chrome did whitelist those a couple of protocols I don't know I'm not I'm not clear on what that actually means in the context of what they did if it does unlock any other capabilities in their extension environment or not I think it my understanding was that it just did what ours did initially to admit that you could load a web page that was hosted with from within the extension itself and not actually outside or not I'm not totally sure yeah thank you very much for from rozilla to take a lead in having the browsers support some of these decentralized web we're depending on it what do you need from us to try to get more support internally from Mozilla we need you guys to succeed at this I I think that's that that success story that I showed where ipfs somebody from my PFS just in a couple days took these experimental api's and showed really immediately indirectly how they were able to apply that capability to a real human problem of censorship of Wikipedia and Turkey I think those stories are really important so seeing more of those successes I think the second thing is actually helping us figure out what these applications need you know initially we were like okay we need some network architecture changes we need some more network capabilities but really quickly it turns out that things like key management are still are a huge problem and I think that problem in particular will show up strongly in the mass adoption and adoption at scale of the type of applications that are here at Def Con so input and help in figuring out those problems and best practices and how may be key management has a place in where in the architecture of the web would also be helpful yeah sure build stuff share your stories any other questions right all right thank you very much [Applause]