Delta Chat, CFFI, pytest and all the Rust
CC Attribution - NonCommercial - ShareAlike 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal and non-commercial purpose as long as the work is attributed to the author in the manner specified by the author or licensor and the work or content is shared also in adapted form only under the conditions of this
Krekel, Holger
Delta Chat, a new approach to decentralized messaging, uses Python in several ways. Delta Chat is a Whatsapp/Telegram-style messenger app which uses the existing e-mail server network instead of central servers. There is no address book upload, and no necessity to tie accounts to mobile numbers. We'll live-demo how ""Chat over E-mail"" works, with random audience members, in real-time. We'll then look into how Python is used for automated testing (with pytest) against the messenger core library which is exposed through CFFI. However, the core library will soon be ported to full Rust. Are there better ways to interface Rust with Python than going through C-interfaces? In the third part we'll introduce first example Chat Bots, written in Python. Do you want to send an machine-generated system allert to a sysadmin group? Or safely archive all media that is posted to a family group? Or have your IoT sensor react to commands or send info? Just do it without registering a bot to some central cite, or by exposing all content information to (e. g. Telegram) servers. A Chat Bot only needs access to a standard IMAP/SMTP account. We'll look at the simple Python API for writing and testing powerful and versatile Chat bots.
 So I think, hello, there's supposed to be a session share, but I think I'm just going to do this myself. So please welcome Holger. So this is a few stickers that just in case you have a, let's say, Google Play or FDROID on your phone and you want to try it out, then you don't want to use your proper account because you don't trust the application, then you can use a temporary account. So you can just take one sticker and then pass it on. But you can, of course, also use your Gmail or other account if you want to. We're going to, there's a QR code on this thing. I'm going to tell, and it tells on the paper what you can do. So I think four years ago I was at a EuroPython in Italy talking about the return of peer-to-peer computing. And I think the year afterwards, Nicholas, or maybe two years, talked about the return of the return of peer-to-peer computing. And peer-to-peer computing or also, let's say, decentralized computing or however you want it to call it, has been a strong topic mostly because of everybody knows this, blockchain, spitcoin and so on, lots of crazy cryptocurrencies. But at the time I was also talking about languages, functional languages. I've been involved in PyPy, in PyTest and TOX. These are three projects I started and maintained for like 10 years or something like this. And decentralization has been on my mind for a very long time and also in the last couple of years. And even though it's currently very much occupied by blockchain and kind of cryptocurrencies, now Libra and so on, I think that there, and I know that there's also lots of other projects in the space ongoing still. And I think that's still interesting to look at that. The one thing I learned since in these four years when I was engulfed and talking with many other people from not only Python but other projects in the decentralization or peer-to-peer computing space is that I now think it, I much less think about problems in terms of technical problems, but I rather think about them, let's say, more of like ecologic problems. So my, and that's one moment. That's not only about climate warming. It's also that when you look at software today, there's just an awful lot of software everywhere. Maybe you have heard the term software is eating the world for good or bad. And so what ecology actually means to me is discovering context explosions. So context explosion means that maybe you know this, there's this thing that they discovered in biology called ecomimimises. And it is kind of like a failure of reductionism. So you have this big thing, like a big forest. You want to make some statements, you want to make some research about it. And you discover it's too complex. Like there's too much going on, you can't do it. So you kind of constrain yourself, you reduce yourself to like let's just look at this particular square kilometer or this particular and so on. And then you scale it down and you find, oh, it's still too complex. And you go down to like a square meter and just look at what's happening there and you find it's still too complex. And you can go on and go on and go on. And it remains too complex to just completely like look through it. And in that sense, that's what ecology actually, the kind of thinking that comes from there is realizing all of the complexities. And I think that one thing that everybody knows by now, or most people, is the thing about climate warming. And the other thing is like in software worlds, and I'm going to talk about messengers. And when you think about messengers, for example in Brazil, you could make an argument, and some people are making an argument about this, that WhatsApp and the particular way how you communicate in WhatsApp was instrumental in getting Bolsonaro, the now Brazil right wing president elected. Because in Brazil, most people only got to know WhatsApp one and a half or two years ago. It wasn't there before very much. And then basically 200 million to 300 million people started using WhatsApp within the time frame of like 12 to 16 months. So all of the things that most of us have actually experienced over a longer time frame, like getting to know email, getting to know messaging, getting to know hoaxes, chain letters, and all of these fun stuff that you get from your family, you know. They got this like in no time. So there was tons of fake news spreading, and people were not really, you know, they were just fresh into these kinds of communications. So they just took it for granted, all kinds of fake stories about political opponents. And it's very hard to research this because everything is end to end encrypted. So there's no central place where you can see what everybody has been talking about. So you just have like more indirect evidence. Well, and so even messaging kind of like has a complex relationship to political realities. It might even be involved in starting a world war. So it's really like a context explosion that a lot of the things that happen in software actually have a lot of repercussions that you can't even predict very much if you look at that. And that's ecology. So aren't there already enough messengers? How many of you have at least three messengers in active use? Okay, it's almost everybody. Five? Five messengers? Anyone? Still some? Okay. So what's the point of going for another messenger? There is no point. Bye. No, there is a point. Otherwise I wouldn't be here. And I think it's because centralization actually is in many ways, not just in this way, it's becoming critical. It's reaching critical state. This is a picture of what happened and it was kind of, I didn't know about this before, but there's a lot of things going on in Indonesia right now. It's rarely in the news, maybe in the UK news, but certainly not in Germany or other places. And of May there was a lot of protests and as happened in many regions of the world, they just blocked some services. WhatsApp is easy to block, Signal is kind of easy to block and so on. So they blocked these and that's where we got to know people started using Dota.Chat. So we got basically quite a number of users in this kind of event, went there because it worked. Like on some level you can talk about crypto and lots of other things, but for software to basically work is kind of like a precondition to use it. So centralization is becoming critical, I think not only because of like political interference and because of the realization of many governments who now know how to deal with IT stuff, how to block things, how to regulate it and so on, but also because of the industry's tech complexity. Facebook down, WhatsApp down, Google down and so on. This all happened in the last two, three months. And it's like you could say it's increasing and some people were discussing this for a number of years, it's because also of the inherent technical complexity and running these infrastructures. And it does give you some, you know, it does give like reasons for thought that even these very experienced with very good people with a lot of resources, companies don't manage to keep the stuff online. So that might be together with the political interferences that are happening, leads to this kind of notion centralization is becoming and reaching critical state. So what's this about? Chat over email is an approach that basically says, well, why don't we actually do the same thing, the same UI, the same UX that you get with WhatsApp or Telegram, but just use the email system. There is, of course, a lot of backlash when you talk about email because it has been declared dead already 15 times or so last week. And like over the last two decades, like starting around 2000, there was always this notion of email is dead, especially with like something like WhatsApp and so on. But for some reason it managed to stay, you know, and you want to have some statistics with some references, then you can go to email is not dead.com. And if you look at the volumes, it's around three or four times the volumes that WhatsApp does, for example, or even more, like three or four times at least in terms of, sorry, no, it's the legitimate email. I guess it's because all of the companies and governments being very busy mailing each other and inside and lots of CCs and so on. Yes, you can make all kinds of fun about why, you know, this is not like a, like nobody reads these emails and so on and so on. But you can also note that mobile phones and many other, many web services are actually rooted in email. Google is still very much rooted in email and Gmail, you know, it's not by coincidence that they have invested so much in this email service. It is like a center of identification. Well, in any case, if you do chat over email, if you basically have a chat interface but use email service, it means that you can interact with the email system. You will know, and that's the reason why you're using three or four or five messengers, they don't talk with each other. They are, each of them is an island and an asylum. You need to convince your counterparts to also use a particular thing. So here you could say, well, it's just another messenger, but what you can do from day one in Delta Chat is you can chat with anyone who just has a regular email account. So they will just get a normal mail. If they reply, then this will appear in your chat window, the reply. So centralized messaging has this thing that we have like a central entity that manages all the communication. And everybody basically connects to this entity in order to find out about others and in order to relay messages. And also in the case of encryption, both in WhatsApp and Signal, also to get the keys. Because the WhatsApp servers and the Signal servers are also key servers. And they provide the keys so that you can actually encrypt to the other sides. And how does this happen? Well, that happens because these centralized providers, they map your phone number to a certain public key. That's the encryption key. That's the key that is used if somebody wants to encrypt a message to you, public key encryption. So but you need to find out about this because you just know maybe the phone number. So you need to find out what is the other side's key and that's what you do by uploading your address book. You upload your address book to WhatsApp or Signal so that they can tell you who has which keys so that you can actually send a message to them. And nowadays mobile numbers are very much tied to passports. So if you are for some reason illegal or refugee or anything, then this is already problematic. You cannot easily participate because you don't easily get a mobile number. And that's maybe not, well, it's a problem depending on the region you are in. And of course, depending on where you come from. It certainly produces a lot of control at this central side and also in terms of metadata because everything is tied between phone numbers and identities. These things last messaging in the sense of data chat is you can understand data chat is basically an email client. That means it just talks with your email server and nothing else. And the email servers because we have this like 30 year evolved standards, they know how to talk with each other. There's message formats, there's protocols between them and the devices between the providers themselves and so on. So this is kind of sorted out. There's existing open software that is used. There's all kinds of software toolings around this. And basically data chat just ties into that. And before you wonder about that and you can verify it basically here later, this is fast enough. So it's not really a problem. Usually it takes like two seconds, four seconds, five seconds from one device to the next. And even WhatsApp can take longer sometimes. So it's not, that's not really a problem. Also read receipts and so on, but we can look at that later. So we have centralized messaging, decentralized messaging. One main difference here is that you don't need to, with data chat you don't need to upload anything anywhere. You don't need to upload your address book. You can immediately start messaging by knowing the other side's email address. So if you have email addresses, then you can just start chat with them. And obviously for email addresses, oh by the way, if you have any kind of question and want to raise something, just do it. I will repeat the question and then try to say something. Yes? It creates a key for you, but it's all invisible to get to this. And that's very important. Mobile phone numbers are tied to cell towers, are tied, are very closely tied to the government around you because the cell tower is physical. You only get access to a cell tower basically in some kind of government tracking and regulation way. Whereas an email address, you can get from any provider wherever. Like if you are in the Ukraine and you want to have an email address from a Swiss company like Proton Mail or so on, no problem. And then your identity is like run by this more or less Swiss American company. And you are not directly affected by what the government regulates in, let's say, Eastern Europe in this case. Okay. So that is clearly an advantage. And to break it down and to tie it back to the picture of Indonesia, which is also a picture of many other countries, what this chat over email approach provides is resilience. You cannot, I mean, you can choose your own email provider, can be any of thousands of providers in your region or somewhere else. And it's also kind of hard to block it. Like unlike WhatsApp, email is still in most countries used by the government itself. And it's used by business. So trying to block that on like a whole scale. Let's say we block part 25, which is like the S&TP protocol for the whole country, then nothing works anymore. So you cannot just do it like on this broad scale. At least you get a lot of damage by doing that. And also it means that we don't have to run a platform that needs to be online. We don't need to run servers that get attacked, ddost and so on and so on. And well, you can also run your own email server if you like, if you really want to have control over that. And that's what many organizations and universities and so on do. They run their own email infrastructure. And it's not actually that hard anymore to do that. I mean, there are certain things that you need to look at, but I think this resilience party is the main point of going for the chat over email thing. But it's a big point because it means that it's hard to block and you have a lot of choice and a big ecosystem to tap into. Okay, so what about security? When you talk to news sites and you give them a call and you say, hello, I'd like to tell you about a new messenger project. There's two things. A is oh no, as an answer. And B is I will refer you to our security guys because messaging is typically tied now to security because the only interesting property is security. And also when you go to, when you talk with people who are like in the IT field for a longer time, that's also like one of the primary questions like how secure is it? So I'd like to talk a little bit about this. To me, it's a matter of perspectives. One of the core perspectives that we evolved in the data chat project, which is like two, two and a half years old, there is some prior research that exists. But the main thing is that we see security as, we measure it, basically we look at it in terms of what are the eventual outcomes for people. And they get in prison for that because they, you know, their data, their communication has been observed and they have been related to other people who are in trouble and so on and so on. So what is in the end the outcome for actual people involved? That is actually a bit of a change. It was a suggestion by Elia Noura-Saita from 2016 who said that engineers are too much focusing on the mathematical kind of conceptual abstract security. What actually counts is what comes out at the end. Not if your algorithm is super clever, but it's very bad implemented and the usability is so bad that everybody messes it up, then it doesn't matter that your original crypto algorithm is great. So yeah, well, no, no, I don't want to go into specifics. It's like, I think it's really a mindset problem that reminding ourselves that it's actually about what happens to people in the end and not about some abstract concept. And the second thing is, for example, research shows that people in the Ukraine, for example, they trust Telegram. Now why? Telegram is unencrypted by default. Like you can have a secret one-on-one chat, not a group chat, a one-on-one encrypted chat, but that's it. Everything else is clear on the platform and so on. So why is that okay for many people, for hundreds of millions of people? Because of UX. The user experience of Telegram is so good and people like it so much that they use it and they regard it as secure in the Ukraine because of the Pavlov brothers, because they are clearly an enemy of Putin. Right? Because they are kind of like prosecuted by Putin ostensibly, so everything is fine. Like if they are basically, you know, it's like a strange logic. It's not like coming from the engineering side. It's what is called by Max Weber, like the heroic kind of legitimacy. That means that you have some heroes you identify with and whatever they suggest or do is okay. There's a few examples currently on the world stage for this, but it happens. And so one of the reasons is UX. It's a very nice user experience that you have in Telegram. And the other is that's perceived security through the people running it being on your side in some way. So DataChat has an orientation when it comes to usability questions and UX questions, Telegram. That's kind of like the gold standard in usability. Of course also WhatsApp, but Telegram was basically the main one. So what we did in terms of finding out about the security of people in various countries is a lot of research. I work with Xenia Amushina. She's from Paris, originally from Russia for a number of like two or three years now. And she has done a lot of research in various countries and also during the DataChat project in the last two years where we actually talk, do interviews with people in the ground who go to various dangerous places and are in need of having communication tools and asking them like what is important to you? Because that's quite a different perspective than if you go to an IT conference and ask an engineer what is important to you because then it's like the brilliance of a crypto algorithm or the brilliance of some implementation, but not actually something that is tied to the messy situation on the ground. So that's why, but I would like to start with, like security is really something, it's not as much cryptographic as you think. So let's talk about cryptography. DataChat also kind of evolved in conjunction with another project I co-started two and a half years ago, which is called AutoCript. It has this beautiful bicycle lock. It's like also tying back to ecology as a logo. So it's a very UX driven specification for achieving end to end encryption in email. It's opportunistic so it actually drops back to clear text because the primary goal is that people can read their messages. Everybody who has tried, who has tried PGP actually here. Oh wow. Okay. So you will have this situation I guess where you got an email that you couldn't read and you sent an email that the other side couldn't read, oh and so on and so on. Not to talk about the key server problems and so on, but well one of the principle things in AutoCript is that we said we don't want to have any interaction with the user about keys. Like the keys, the term key, cryptographic key does not appear in the user interface. We don't want to have it there. As soon as you start talking about keys you are in trouble, right? Because I mean we might be able to talk about it, but in general you can't do it. And I think even if we talk about it we easily get confused and we have the wrong keys and what not. So it's something basically when you go for more of a mass appeal then I think you can't avoid this kind of paradigm of saying never talk about it. You might talk about encryption maybe, but not about keys. And it also means that the data chat unlike all other messengers is compatible with other email apps. Just K9 if you use Enigmail, if you use Balsa on Linux and there's a few others upcoming this year probably, then it will encrypt end to end between your app and the other app. Even those are not the same apps. So that's what's made possible by the AutoCript standard and I think one validation of that was last year when somebody said oh I didn't know that you can use PGP without first listening to an hour of explanations. Crypto parties. However I said that AutoCript happily drops back to clear text if it has the impression that the other side can't read it. Maybe just one thing why I'm saying opportunistic, if we mail with each other and you have two devices, one device is let's say K9 mail and another device is your web mail interface to Gmail. Then you will sometimes use this and sometimes the other. So seen from my perspective I'm sometimes getting an encrypted mail from you and sometimes a clear text mail because in your Gmail interface at least for now you don't have this end to end encryption. So then AutoCript says well if in doubt don't encrypt because the primary thing that people want to do is they want to communicate. So don't get in their way of saying no, no you should change everything before you can communicate. Do you let the users know that this is being sent in clear text because you're falling back? Well it depends on the user interface of the particular app. It's, yeah, I mean let's, it's a complex, we have discussed this many hours, it's a complex topic. In the case of DeltaChat you will notice that it happens but it's not getting in your face completely. So this is opportunistic and of course there's a lot of contention about this. The first page of the spec is devoted to this topic and also the reasoning, so if you want to understand the exact reasoning for this then read the first page of the AutoCript level one spec. It's just the 12 page spec. It's not very large. It doesn't have key servers so keys are transmitted in email messages in the header but I'm not going to talk about AutoCript now in detail. What I do want to talk a bit about is that we have something called verified end-to-end encrypted chats and that is, these are chat groups. You can see they have this little blue check mark you might know from Twitter or something like this. We use this as a visual indication that this is a verified chat and the verified chat has two properties. It's always end-to-end encrypted. It doesn't fall back to opportunistic and it's safe against active attacks. That happens because you only can join an encrypted, verified encrypted group through a QR code scan. So I show you something and then you can join the group through this scan and you can add new members through another scan. So if you want to be 10 people in one group, you need to have nine joins. Like I join the first person and I join another person and these persons join more but all in all for 10 people to exist in a verified group, you need nine verifications and that's 81 verifications less than what you would need in Signal or WhatsApp because they actually also are FRIMA. They also offer verification but you need to do it with every group member. So for 10 people, it means that everybody needs to do nine verifications basically, more or less, maybe it's a bit less. But it's like a lot more than this kind of the data-chat way is basically just having a fully connected graph. Like I start the group and then everybody who's going to be in the group will be connected to me through a chain of verifications, a blockchain of verifications. It is actually quite similar. So this has evolved in an EU research project and there's a paper about this, how this is done but here I just wanted to say that it exists. So if you're very afraid about the opportunistic side of things, then you can always go for verified end-to-end encrypted with your partner or other groupings. Another security issue is what we identified together with activists in Eastern Europe is location streaming because if you have people going around in, let's say, Bela Russia, and White Russia and they vanish and that is kind of a regular occurrence that happens during demonstrations or other events, then one of the questions the organizers of events have is where are these people? They can't find them anymore. So one of the things is that location streaming allows you to say, I want to stream, like only on my side, I want to stream my location to this chat and this might be just somebody who is somewhere else who is in a safe situation, we call this base camp and they see actually where everybody moves, also the movements like in the past. So you can see on the desktop version there's like a slider, you can see what happened in the last couple of hours. So location streaming, once you enable it, basically tracks your location and sends it end to end encrypted to your chat partners so that if you do vanish at some point, at least there's a last position where you have been and all of the photos and audio messages and videos that you do will also have location text. So that kind of like gives some tracking and also after some kind of action allows to map everything. This is a security feature in a particular way. It's not about ECC keys or perfect forward secrecy or anything like this, but this affects people for real. Like you can save people through that. What we did do in end of April also in Kiev in Ukraine was we kind of introduced this location streaming by playing it and you see this here, this is the quarter of Kiev called Pudil where we played the game and the game was played with these cards. It's probably not well readable. It reads something like politician, whistleblower, journalist and so on and you draw a card. There's two teams, cubes and spheres and they basically have two coordinators, two base camps and they fight with each other or try to do things with each other, but they also have to uncover lots of hidden places in the city. So you can also use location streaming for other things. In this case we were using it for some kind of safe real life testing. Another security feature that is upcoming, it's not implemented yet, is what we call burner accounts. You might know burner messages from signal. Burner accounts are really what they sound like. If you scan a QR code you get a temporary account that is completely removed after one week. If you are a group of ten people or if we want to be like in a temporary group like this, I would show the QR code. You would all get a temporary account. After one week the server deletes all of these accounts. We have a verified group with each other and we have kind of randomized and that's the important thing, we have randomized accounts. So maybe we choose nicknames on how we can recognize each other. This is a bit of a large group I guess. But it means that when my phone gets taken, then my contacts, my metadata that gets revealed by my phone being seized will not reveal very much. Just a number of random accounts. Compare this with phone numbers, mobile numbers. Getting one phone from somebody who is involved in an action and you get all of the contacts and mobile numbers which at least in the EU means real life identities for free. So that's something in burner accounts you don't get this. You just get a number of accounts that have no long time identity track record. That is something that has been designed or is designed with activists on the ground. So it's not something that we just think might be useful or so. We actually have discussions with the people affected and design the things from there, the security and so on. What we also have in terms of a bit more security engineering thing is RPGP which is full Rust implementation of PGP done by Friedel Ziegermeier and it supports the auto-crypt subset of open PGP because auto-crypt is not, it uses open PGP but in a very minimal way. It says very specifically what you use out of PGP. For example, no key servers. It's not needed. We don't need it at all. And RPGP implements this subset in full Rust and next week I think we will get the security report so that means that it also has an independent review there. What we want to do quite soon is we want to have, like when I told about this game in QIFF, that was kind of real life but not really because it wasn't actually, like QIFF is not very dangerous in some sense, at least most parts of it. Whereas the people we are talking with there are operating in areas that are dangerous and we want to actually prepare and then go for real life testings of things during actual actions there. And our general focus other than for example what signal other messengers provide is that we don't regard everybody in a chat group as equal but we actually see that there's some asymmetry. There's usually organizers who are like in a safe place and they're helping others to actually do something. So if you have for example something like ephemeral messages, you really just want to have them one-sided. You want to have them from the people on the ground but the people at the base camp who actually look at everything, they want to see all the messages and actually also have a history of these messages and so on. Okay, so that concludes, I don't talk about this, this concludes the security part. I hope I could give you some insights on the way on how we think about security. It doesn't mean that we don't care about crypto, in fact we have RPGP and some other things but it means that we focus on the actual outcomes for people. So now software, that's probably also why you are here. There is a core library, it's called Lettichet Core, sometimes DCC. It's MPL licensed so it can also be used in commercial products and is actually used in commercial products. For example by Open Exchange or mainly by Open Exchange currently. And it is the library that is used by all the Lettichet user interfaces. It's a very UI oriented library. It doesn't give you access to MIME and IMAP and SMTP and AutoPrep and the persistence layer and so on. This is all kind of hidden. What you get is add this contact, create a chat for this contact, like on this level is the API and give me all the members of this chat, send a message to this chat, send an audio message to this chat and stuff like this but you don't get to specify like a MIME message which is like the email format. This is all handled by the core library. So in that sense it's kind of easy to write a UI because you don't have to handle all of these details yourself. And we are currently transitioning this core library to also be a full Rust version. Currently it's C, like the Android version that you might be using is C but the upcoming and partly used already version is done in Rust. So we have Delta Android that's quite stable. Since last week we did like the declared this to be stable. This is still using the C library because we wanted it to be stable. The Rust part is still a bit, it is kind of stable but it has some glitches here and there so we don't feel comfortable. Delta chat Android is used by, hard to say, let's say 30,000 people or something like this. It's hard to count because it has been only on FDroid for two years and since February or March this year it's also on Google Play and there it has something like 20,000 installs or so but also a lot of uninstalls so you can't really count this as like active users. But this is quite stable, very feature complete, many people use it. Desktop is on Linux and Mac quite stable I would say. So still using the C library there on Windows we actually already use the Rust core library because it's much easier to build. Building the C thing on Windows has been too hard basically and then in Rust it was relatively straightforward. Rust is very good in terms of cross compiling to lots of different targets. And iOS is evolving strongly currently there's just another quite good test flight release from yesterday and we think it's going to go to App Store let's say in the next two, three months. And the core bindings, the most complete bindings I think are in Python. You can find the docs on PyData Chat. The node bindings are also used for the desktop because the desktop and we get to this later is using Electron. And of course the Swift and Java bindings they are contained in the iOS and Android reports they are not packaged separately although this could happen. So who has managed to, I don't know if you were just listening or also tried to configure your phone? Somebody? Okay. Did you try to join already or? Did anything work? Do I have network? Wait a second. I might have to log out here. Okay that's a bit hard for me to do. I need to restart my desktop. Yes. It takes a while to refresh. Oh a lot of people joined. Ah hi. Okay. I can't type very much. But this is the papers that got distributed. We are 10 members now by scanning this QR code. But the time is running out a bit so I'm going to continue here. Oh Delta bots. That was also something that I'm actually starting like in the last couple of weeks especially and I really want to have the bot developing chat bots that you can use with Delta Chat. It's like a thing of the next half year that we want to give a lot of energy to. The nice thing about the Delta Chat bots is that unlike in WhatsApp and Telegram you can just you only need an email address. You only need SMTP and IMAP credentials and then you run it wherever. You don't need to register it anywhere at the Telegram server or the WhatsApp business API. It is quite difficult to use. You can run it wherever. Also inside your organization you can make it such that nobody can reach it other than the people in your organization and so on and so on. So that's like a very nice and easy deployment story. There is one huge I think at least by now 15 to 20,000 users in Cuba who have a very special situation in that everything in Cuba that stays on the island in terms of network traffic is relatively affordable. Everything that leaves the island is like very expensive and you may have mentioned why. There are a lot of cases of sanctions from the US and so on. It's directly next to the US. So they don't have very good connectivity outside this island. So there's an economic barrier. You can get the connectivity but it's expensive. And so what people are using is the local Cuban email server, nauta.cu. That's relatively cheap. You can get it on your mobile and that's why Delta Chat is getting quite some take up such that they jumped in early, used the Python bindings, one of the people there and wrote simple bot. What you see here is on the left-hand side a chat and you will find that it's kind of like you send a command and you get back some form of an attachment, get delta3.html. When you click on that, I can't show this here, when you click on that then there is an app that you have to install separately called ZHV, zipped HTML view. And when you click on that then it opens. What you see is the simple bot interface. So this is a chat bot interface in HTML. You see it here and you can click on it and when you actually do something like get me help or find some friends, whatever, then it sends you back to the chat because it's a mail to link. This is actually, you can use it to browse web pages. So you say give me this website, it goes to the bot, the bot sanitizes this, strips this down so it's not so much size, gives you the HTML with all of the links substituted by mail to links. So when you click on them you land back in Delta Chat and you just say send. So you have a complete history of the site that you visited. It's very low traffic and it's like an interesting hack you could say on how to write bots. Of course we can, I mean we could make this almost automatic in the future. That you basically allow this bot to use Delta Chat basically in the background. So you can do this kind of bot communication differently but that's maybe something to discuss tomorrow. So the Python bindings on Linux are very easy to install. They are by now binary for Linux so you can just say pip install Delta Chat. You don't need to compile anything and so on and you can just directly start. On other platforms you still require first having your Rust core compile and then with pip install basically from the source code you need to install the bindings. The interfacing between the Rust library and the Python bindings is done through CFFI. That means it should also, I think it does also, I'm not sure if you tested this actually, but should also work in PyPy. This kind of interfacing, it's a relatively simple usage. So that's certainly, if you are around also tomorrow then you can just test it if it really works. And of course the tests are written in PyTest and they are used as functional tests also against the core. So there's a lot of like, in the bindings there's a lot of functional testing of this high level API and more that we need to do in this area but it's a good basis. There's also like a simpler than the simple bot example that is in the Delta Bot repository that is also the basis for the simple bot but obviously the simple bot has done some more things. So that makes basic usage of the high level API and you can directly deploy it. Like if you have SMTP and IMAP credentials or you can easily create this, it's a matter of really two minutes and you are connected and can do something. We did get, I think couple of weeks ago, we got some funding specifically for completing the move to Rust in terms of the chatbots and also implementing all kinds of chatbot examples in addition to what we have like RSS, ActivityPub, Matrix, IRC bridges and so on. There's some good planning and ideas around this but the idea is to do this in Python and we're also going to sprint about this tomorrow and if anybody here or if you know if anybody was interested, possibly interested in this and there's also some money to be gotten for getting involved here and helping to drive this effort. There's going to be a lot of things happening there. One of the things that some of us definitely want to go is use and produce gaming bots. So there's some talk about, for example, implementing the game of Werewolf. Maybe you know Werewolf. So everybody joins and the bot says hello and then the game starts and the bot basically randomizes the roles, opens the chats with the various people. You can imagine roughly how this could go and it's designed and discussed with a 14-year-old girl who's very eager to get this done because they are playing Werewolf currently with an app like in their school with an app called Telonym. Not sure if you heard of this and it's crazy. It's like a crazy app. You get messages but you don't know from whom. Right? How can this go wrong? So they're using it to play Werewolf with it but it's also privacy-wise and so on. It's a disaster. But okay. The last note to close up on how do we actually do this? WhatsApp exists since 10 years, has lots of investment and resources and so on. Time is also long going already so how can we enter this scene? Like how do we get funded? How do we actually do this? You got some glimpses of like when I mentioned Kiev and this and that. I'm going to try to... This is the coffee bus in Kiev. It's a very strange thing to have. There's like four coffee buses in Kiev. It's like a double thing. It doesn't come from the UK. I don't know where it comes from. They serve coffee. This particular one I think has a lot of Hollywood pictures inside and it's very strange. Coffee is kind of okay. And so you hang out there and also next to the park and you are in Kiev 200 kilometers from Chernobyl, 300 kilometers from a war zone and so on. So it's a kind of a different feeling than what you would have, let's say, sitting in a Starbucks in San Francisco. It's like a very... so location matters like how and where you actually do things and what is your context in which you're operating makes a lot of difference, I think. And we are basically saying, okay, we want to have really different contexts and locations especially of people who are on risk. We have a lot of physical gatherings. When I co-started Pai Pai, I think 17 years ago or so, also with Amin over there, what we established also was having sprints. Like every, I don't know, six, eight weeks or so at some point we did sprints and that's also what we do here but in a slightly different way and that we have also partial gatherings and we never really do... we don't sit everybody together except for the party. Like there's a lot of partial gatherings even within this bigger framing and that's also what's happening that people meet, be it often in several parts of Germany, like just three or four people out of the maybe 15 who are actively involved because that's already helping. It's not like everybody needs to meet all the time with everybody. But the physical gatherings in complementing the remote work that we usually do are really important. Backgrounds, you see here on the left Xenia, I mentioned already, I'm working with her for a very long time already. She comes from Russia originally and she has done a lot of the research and a lot of the usability things that we are doing also relate to her work. And you can see the glimpse of the guy with the coffee mug here at the park in Kiev. On the right hand side, that is Bjarn, who actually started the whole Dethatrad project two and a half years ago. And on the right hand side, you see a placeholder for all of the other people you can't see here. What we usually do is we don't do project meetings. So we don't say this is a Dethatrad sprint, come, or something like this. Every event has a different name. And we also invite various people around the project. So not directly contributing, but who are kind of like, for example, heart of code. It's a feminist tech space in Berlin, you know, and we have some relations and they were interested, so they joined for various reasons. I'm not going to go into that now. And so we have befriended projects, also other decentralization projects who are just around. So we do some things, we talk with each other, you know, we have some food, whatever, but otherwise they can work on whatever they want. They don't need to integrate into our Dethatrad structure or something like this. So that's a little bit of an open gathering culture, I think, that everybody came to appreciate very much. Otherwise just to conclude on this, we got some money from the EU, we got some money from the Open Tech Fund that some of you might know, and we are also going to get some new Open Tech Fund money. It's just been one week ago that they accepted that. I mentioned the NLNet one, and we have a lot of people actually who are really, really, really good at what they do and they just help us and they get to steer the project also. It's not that they just help a little bit or so, but they actually get a say in how things are done. And I think that's quite important. If you have a mixture of people who get paid and people who just participate, there's always the risk that the people who get the money actually also get to make all of the important decisions. And that's something, let's say, that I learned earlier on that it's very good if it's possible in the project culture to give the contributors who don't get money and who are contributing lots of things also a say in how things are done. Longer-term money is, that's a bit of a more involved discussion. We are also like, if data chat grows like bigger than it is now, then we might also just try to go for more donations. There's also upcoming organizations who want to use data chat, a university in Germany, for example, who wants to deploy it everywhere, not only in their stuff, but also with Microsoft Exchange. It works. It's standard-based. It uses IMAP and SMTP. It's fine. It works. You don't need to change your email infrastructure for data chat. You can just use it as is, usually. And we are also thinking about special pay apps to go for. So no VC money. I think venture capital money and this kind of endeavor is a dangerous thing. And we don't want to go for that. Okay, maybe as a, and I think I stopped it at that, I think in 2005 I gave at the CCC in Berlin a talk with Beatrice During, who was also involved in the PIPI project, about agile programming, which was a big thing, scrum and so on. In 2005, and we talked, you go back to the talk, we talked about lessons learned and how it doesn't really fit the bill. And then, I don't know, two months ago or so, I was 2019, some student came to me, oh, I can't hear this new agile thing. It's very strange. I mean, I don't know. Anyway, I think it's time to move on. One thing that I kind of keep advertising or talking about is that I think it's good to not have too many round tables, to not have, not base everything on assembly where everybody discusses and decides everything. It seems like a very natural thing. I don't have the time now to go very much into this, but I think it's also, and I've done my fair share of assemblies. Let's say probably more than most of you. I've done a couple of hundred assemblies and plenaries in all kinds of collective projects. And I think it's overestimated and also dangerous, and because it's exclusive, like you can make whatever kind of rules in terms of talking with each other, that everybody gets a fair share and talking and so on, and you want to be very inclusive and so. But in the end, you're going to be on a table, and some people will talk, others will not talk, and others will not even be there and participate in the talk for various reasons. That's always the case. In any given project that has a regular practice of doing assemblies, usually 20 to 30 percent actually show up to do this kind of discussion. So it's problematic. Also in terms of deadlines and schedules, we try to not do it. We have some rough ones where we want to be, but we don't keep a timetable, like exact times when anything should be ready. That worked despite all the languages, despite all the platforms we are involved in and not like that much money, worked quite well for us. And we try to take up, if somebody comes to this brand or to the gathering and wants to do something particular and tries it out and it seems to work, it might actually shift the project towards that direction. It just happened in April because before April, we didn't have a full Rust call library. That only happened in April because Friedel discovered this wonderful tool called C2Rust. So if you have plain C, you can just translate it to Rust. And he said, let's try it. And it was not on our plan. We wanted to get stable releases out in May because that's one of the promises we made to the funder. But if somebody has the expertise and really wants to do something and it makes a sense on a certain level, then we try to go for it. Even though that was counter to some other things we wanted to do. So that's what I call situational developments. Yes. So I think I'd like to leave it at that and maybe just mention tomorrow. So tomorrow, the sprint topics, there's a number of things you can also bring something and diverge. On the one hand, dealing and playing a bit with the data chat bindings, write some chat bots, maybe the beginning of a gaming bot or so. And there's also an idea together with Florian here from Qt browser fame to actually see about kickstarting QT-based desktop client. Because everybody knows Electron is horrible, right? You know Electron, the JavaScript-based Chrome, big, whatever. Well, it has also advantages to have this kind of framework. But I think a QT-based one based on the nice Python bindings we have that now eventually work would be an interesting project. OK, thanks everybody.
 So I think, hello, there's supposed to be a session share, but I think I'm just going  to do this myself.  So please welcome Holger.  So this is a few stickers that just in case you have a, let's say, Google Play or FDROID  on your phone and you want to try it out, then you don't want to use your proper account  because you don't trust the application, then you can use a temporary account.  So you can just take one sticker and then pass it on.  But you can, of course, also use your Gmail or other account if you want to.  We're going to, there's a QR code on this thing.  I'm going to tell, and it tells on the paper what you can do.  So I think four years ago I was at a EuroPython in Italy talking about the return of peer-to-peer  computing.  And I think the year afterwards, Nicholas, or maybe two years, talked about the return  of the return of peer-to-peer computing.  And peer-to-peer computing or also, let's say, decentralized computing or however you  want it to call it, has been a strong topic mostly because of everybody knows this, blockchain,  spitcoin and so on, lots of crazy cryptocurrencies.  But at the time I was also talking about languages, functional languages.  I've been involved in PyPy, in PyTest and TOX.  These are three projects I started and maintained for like 10 years or something like this.  And decentralization has been on my mind for a very long time and also in the last couple  of years.  And even though it's currently very much occupied by blockchain and kind of cryptocurrencies,  now Libra and so on, I think that there, and I know that there's also lots of other projects  in the space ongoing still.  And I think that's still interesting to look at that.  The one thing I learned since in these four years when I was engulfed and talking with  many other people from not only Python but other projects in the decentralization or  peer-to-peer computing space is that I now think it, I much less think about problems  in terms of technical problems, but I rather think about them, let's say, more of like  ecologic problems.  So my, and that's one moment.  That's not only about climate warming.  It's also that when you look at software today, there's just an awful lot of software everywhere.  Maybe you have heard the term software is eating the world for good or bad.  And so what ecology actually means to me is discovering context explosions.  So context explosion means that maybe you know this, there's this thing that they discovered  in biology called ecomimimises.  And it is kind of like a failure of reductionism.  So you have this big thing, like a big forest.  You want to make some statements, you want to make some research about it.  And you discover it's too complex.  Like there's too much going on, you can't do it.  So you kind of constrain yourself, you reduce yourself to like let's just look at this particular  square kilometer or this particular and so on.  And then you scale it down and you find, oh, it's still too complex.  And you go down to like a square meter and just look at what's happening there and you  find it's still too complex.  And you can go on and go on and go on.  And it remains too complex to just completely like look through it.  And in that sense, that's what ecology actually, the kind of thinking that comes from there  is realizing all of the complexities.  And I think that one thing that everybody knows by now, or most people, is the thing  about climate warming.  And the other thing is like in software worlds, and I'm going to talk about messengers.  And when you think about messengers, for example in Brazil, you could make an argument, and  some people are making an argument about this, that WhatsApp and the particular way how you  communicate in WhatsApp was instrumental in getting Bolsonaro, the now Brazil right wing  president elected.  Because in Brazil, most people only got to know WhatsApp one and a half or two years  ago.  It wasn't there before very much.  And then basically 200 million to 300 million people started using WhatsApp within the time  frame of like 12 to 16 months.  So all of the things that most of us have actually experienced over a longer time frame,  like getting to know email, getting to know messaging, getting to know hoaxes, chain letters,  and all of these fun stuff that you get from your family, you know.  They got this like in no time.  So there was tons of fake news spreading, and people were not really, you know, they were  just fresh into these kinds of communications.  So they just took it for granted, all kinds of fake stories about political opponents.  And it's very hard to research this because everything is end to end encrypted.  So there's no central place where you can see what everybody has been talking about.  So you just have like more indirect evidence.  Well, and so even messaging kind of like has a complex relationship to political realities.  It might even be involved in starting a world war.  So it's really like a context explosion that a lot of the things that happen in software  actually have a lot of repercussions that you can't even predict very much if you look  at that.  And that's ecology.  So aren't there already enough messengers?  How many of you have at least three messengers in active use?  Okay, it's almost everybody.  Five?  Five messengers?  Anyone?  Still some?  Okay.  So what's the point of going for another messenger?  There is no point.  Bye.  No, there is a point.  Otherwise I wouldn't be here.  And I think it's because centralization actually is in many ways, not just in this way, it's  becoming critical.  It's reaching critical state.  This is a picture of what happened and it was kind of, I didn't know about this before,  but there's a lot of things going on in Indonesia right now.  It's rarely in the news, maybe in the UK news, but certainly not in Germany or other places.  And of May there was a lot of protests and as happened in many regions of the world,  they just blocked some services.  WhatsApp is easy to block, Signal is kind of easy to block and so on.  So they blocked these and that's where we got to know people started using Dota.Chat.  So we got basically quite a number of users in this kind of event, went there because  it worked.  Like on some level you can talk about crypto and lots of other things, but for software  to basically work is kind of like a precondition to use it.  So centralization is becoming critical, I think not only because of like political interference  and because of the realization of many governments who now know how to deal with IT stuff, how  to block things, how to regulate it and so on, but also because of the industry's tech  complexity.  Facebook down, WhatsApp down, Google down and so on.  This all happened in the last two, three months.  And it's like you could say it's increasing and some people were discussing this for a  number of years, it's because also of the inherent technical complexity and running  these infrastructures.  And it does give you some, you know, it does give like reasons for thought that even these  very experienced with very good people with a lot of resources, companies don't manage  to keep the stuff online.  So that might be together with the political interferences that are happening, leads to  this kind of notion centralization is becoming and reaching critical state.  So what's this about?  Chat over email is an approach that basically says, well, why don't we actually do the same  thing, the same UI, the same UX that you get with WhatsApp or Telegram, but just use the  email system.  There is, of course, a lot of backlash when you talk about email because it has been declared  dead already 15 times or so last week.  And like over the last two decades, like starting around 2000, there was always this notion  of email is dead, especially with like something like WhatsApp and so on.  But for some reason it managed to stay, you know, and you want to have some statistics  with some references, then you can go to email is not dead.com.  And if you look at the volumes, it's around three or four times the volumes that WhatsApp  does, for example, or even more, like three or four times at least in terms of, sorry,  no, it's the legitimate email.  I guess it's because all of the companies and governments being very busy mailing each  other and inside and lots of CCs and so on.  Yes, you can make all kinds of fun about why, you know, this is not like a, like nobody  reads these emails and so on and so on.  But you can also note that mobile phones and many other, many web services are actually  rooted in email.  Google is still very much rooted in email and Gmail, you know, it's not by coincidence  that they have invested so much in this email service.  It is like a center of identification.  Well, in any case, if you do chat over email, if you basically have a chat interface but  use email service, it means that you can interact with the email system.  You will know, and that's the reason why you're using three or four or five messengers,  they don't talk with each other.  They are, each of them is an island and an asylum.  You need to convince your counterparts to also use a particular thing.  So here you could say, well, it's just another messenger, but what you can do from day one  in Delta Chat is you can chat with anyone who just has a regular email account.  So they will just get a normal mail.  If they reply, then this will appear in your chat window, the reply.  So centralized messaging has this thing that we have like a central entity that manages  all the communication.  And everybody basically connects to this entity in order to find out about others and in order  to relay messages.  And also in the case of encryption, both in WhatsApp and Signal, also to get the keys.  Because the WhatsApp servers and the Signal servers are also key servers.  And they provide the keys so that you can actually encrypt to the other sides.  And how does this happen?  Well, that happens because these centralized providers, they map your phone number to a  certain public key.  That's the encryption key.  That's the key that is used if somebody wants to encrypt a message to you, public key encryption.  So but you need to find out about this because you just know maybe the phone number.  So you need to find out what is the other side's key and that's what you do by uploading  your address book.  You upload your address book to WhatsApp or Signal so that they can tell you who has  which keys so that you can actually send a message to them.  And nowadays mobile numbers are very much tied to passports.  So if you are for some reason illegal or refugee or anything, then this is already problematic.  You cannot easily participate because you don't easily get a mobile number.  And that's maybe not, well, it's a problem depending on the region you are in.  And of course, depending on where you come from.  It certainly produces a lot of control at this central side and also in terms of metadata  because everything is tied between phone numbers and identities.  These things last messaging in the sense of data chat is you can understand data chat  is basically an email client.  That means it just talks with your email server and nothing else.  And the email servers because we have this like 30 year evolved standards, they know  how to talk with each other.  There's message formats, there's protocols between them and the devices between the providers  themselves and so on.  So this is kind of sorted out.  There's existing open software that is used.  There's all kinds of software toolings around this.  And basically data chat just ties into that.  And before you wonder about that and you can verify it basically here later, this is fast  enough.  So it's not really a problem.  Usually it takes like two seconds, four seconds, five seconds from one device to the next.  And even WhatsApp can take longer sometimes.  So it's not, that's not really a problem.  Also read receipts and so on, but we can look at that later.  So we have centralized messaging, decentralized messaging.  One main difference here is that you don't need to, with data chat you don't need to upload  anything anywhere.  You don't need to upload your address book.  You can immediately start messaging by knowing the other side's email address.  So if you have email addresses, then you can just start chat with them.  And obviously for email addresses, oh by the way, if you have any kind of question and  want to raise something, just do it.  I will repeat the question and then try to say something.  Yes?  It creates a key for you, but it's all invisible to get to this.  And that's very important.  Mobile phone numbers are tied to cell towers, are tied, are very closely tied to the government  around you because the cell tower is physical.  You only get access to a cell tower basically in some kind of government tracking and regulation  way.  Whereas an email address, you can get from any provider wherever.  Like if you are in the Ukraine and you want to have an email address from a Swiss company  like Proton Mail or so on, no problem.  And then your identity is like run by this more or less Swiss American company.  And you are not directly affected by what the government regulates in, let's say, Eastern  Europe in this case.  Okay.  So that is clearly an advantage.  And to break it down and to tie it back to the picture of Indonesia, which is also a  picture of many other countries, what this chat over email approach provides is resilience.  You cannot, I mean, you can choose your own email provider, can be any of thousands of  providers in your region or somewhere else.  And it's also kind of hard to block it.  Like unlike WhatsApp, email is still in most countries used by the government itself.  And it's used by business.  So trying to block that on like a whole scale.  Let's say we block part 25, which is like the S&TP protocol for the whole country, then  nothing works anymore.  So you cannot just do it like on this broad scale.  At least you get a lot of damage by doing that.  And also it means that we don't have to run a platform that needs to be online.  We don't need to run servers that get attacked, ddost and so on and so on.  And well, you can also run your own email server if you like, if you really want to  have control over that.  And that's what many organizations and universities and so on do.  They run their own email infrastructure.  And it's not actually that hard anymore to do that.  I mean, there are certain things that you need to look at, but I think this resilience  party is the main point of going for the chat over email thing.  But it's a big point because it means that it's hard to block and you have a lot of choice  and a big ecosystem to tap into.  Okay, so what about security?  When you talk to news sites and you give them a call and you say, hello, I'd like to tell  you about a new messenger project.  There's two things.  A is oh no, as an answer.  And B is I will refer you to our security guys because messaging is typically tied now to  security because the only interesting property is security.  And also when you go to, when you talk with people who are like in the IT field for a  longer time, that's also like one of the primary questions like how secure is it?  So I'd like to talk a little bit about this.  To me, it's a matter of perspectives.  One of the core perspectives that we evolved in the data chat project, which is like two,  two and a half years old, there is some prior research that exists.  But the main thing is that we see security as, we measure it, basically we look at it  in terms of what are the eventual outcomes for people.  And they get in prison for that because they, you know, their data, their communication  has been observed and they have been related to other people who are in trouble and so  on and so on.  So what is in the end the outcome for actual people involved?  That is actually a bit of a change.  It was a suggestion by Elia Noura-Saita from 2016 who said that engineers are too much focusing  on the mathematical kind of conceptual abstract security.  What actually counts is what comes out at the end.  Not if your algorithm is super clever, but it's very bad implemented and the usability  is so bad that everybody messes it up, then it doesn't matter that your original crypto  algorithm is great.  So yeah, well, no, no, I don't want to go into specifics.  It's like, I think it's really a mindset problem that reminding ourselves that it's actually  about what happens to people in the end and not about some abstract concept.  And the second thing is, for example, research shows that people in the Ukraine, for example,  they trust Telegram.  Now why?  Telegram is unencrypted by default.  Like you can have a secret one-on-one chat, not a group chat, a one-on-one encrypted chat,  but that's it.  Everything else is clear on the platform and so on.  So why is that okay for many people, for hundreds of millions of people?  Because of UX.  The user experience of Telegram is so good and people like it so much that they use it  and they regard it as secure in the Ukraine because of the Pavlov brothers, because they  are clearly an enemy of Putin.  Right?  Because they are kind of like prosecuted by Putin ostensibly, so everything is fine.  Like if they are basically, you know, it's like a strange logic.  It's not like coming from the engineering side.  It's what is called by Max Weber, like the heroic kind of legitimacy.  That means that you have some heroes you identify with and whatever they suggest or do is okay.  There's a few examples currently on the world stage for this, but it happens.  And so one of the reasons is UX.  It's a very nice user experience that you have in Telegram.  And the other is that's perceived security through the people running it being on your  side in some way.  So DataChat has an orientation when it comes to usability questions and UX questions, Telegram.  That's kind of like the gold standard in usability.  Of course also WhatsApp, but Telegram was basically the main one.  So what we did in terms of finding out about the security of people in various countries  is a lot of research.  I work with Xenia Amushina.  She's from Paris, originally from Russia for a number of like two or three years now.  And she has done a lot of research in various countries and also during the DataChat project  in the last two years where we actually talk, do interviews with people in the ground who  go to various dangerous places and are in need of having communication tools and asking  them like what is important to you?  Because that's quite a different perspective than if you go to an IT conference and ask  an engineer what is important to you because then it's like the brilliance of a crypto  algorithm or the brilliance of some implementation, but not actually something that is tied to  the messy situation on the ground.  So that's why, but I would like to start with, like security is really something, it's not  as much cryptographic as you think.  So let's talk about cryptography.  DataChat also kind of evolved in conjunction with another project I co-started two and  a half years ago, which is called AutoCript.  It has this beautiful bicycle lock.  It's like also tying back to ecology as a logo.  So it's a very UX driven specification for achieving end to end encryption in email.  It's opportunistic so it actually drops back to clear text because the primary goal is  that people can read their messages.  Everybody who has tried, who has tried PGP actually here.  Oh wow.  Okay.  So you will have this situation I guess where you got an email that you couldn't read and  you sent an email that the other side couldn't read, oh and so on and so on.  Not to talk about the key server problems and so on, but well one of the principle  things in AutoCript is that we said we don't want to have any interaction with the user  about keys.  Like the keys, the term key, cryptographic key does not appear in the user interface.  We don't want to have it there.  As soon as you start talking about keys you are in trouble, right?  Because I mean we might be able to talk about it, but in general you can't do it.  And I think even if we talk about it we easily get confused and we have the wrong keys and  what not.  So it's something basically when you go for more of a mass appeal then I think you can't  avoid this kind of paradigm of saying never talk about it.  You might talk about encryption maybe, but not about keys.  And it also means that the data chat unlike all other messengers is compatible with other  email apps.  Just K9 if you use Enigmail, if you use Balsa on Linux and there's a few others upcoming  this year probably, then it will encrypt end to end between your app and the other app.  Even those are not the same apps.  So that's what's made possible by the AutoCript standard and I think one validation of that  was last year when somebody said oh I didn't know that you can use PGP without first listening  to an hour of explanations.  Crypto parties.  However I said that AutoCript happily drops back to clear text if it has the impression  that the other side can't read it.  Maybe just one thing why I'm saying opportunistic, if we mail with each other and you have two  devices, one device is let's say K9 mail and another device is your web mail interface  to Gmail.  Then you will sometimes use this and sometimes the other.  So seen from my perspective I'm sometimes getting an encrypted mail from you and sometimes  a clear text mail because in your Gmail interface at least for now you don't have this end to  end encryption.  So then AutoCript says well if in doubt don't encrypt because the primary thing that people  want to do is they want to communicate.  So don't get in their way of saying no, no you should change everything before you can  communicate.  Do you let the users know that this is being sent in clear text because you're falling  back?  Well it depends on the user interface of the particular app.  It's, yeah, I mean let's, it's a complex, we have discussed this many hours, it's a  complex topic.  In the case of DeltaChat you will notice that it happens but it's not getting in your face  completely.  So this is opportunistic and of course there's a lot of contention about this.  The first page of the spec is devoted to this topic and also the reasoning, so if you want  to understand the exact reasoning for this then read the first page of the AutoCript  level one spec.  It's just the 12 page spec.  It's not very large.  It doesn't have key servers so keys are transmitted in email messages in the header but I'm not  going to talk about AutoCript now in detail.  What I do want to talk a bit about is that we have something called verified end-to-end  encrypted chats and that is, these are chat groups.  You can see they have this little blue check mark you might know from Twitter or something  like this.  We use this as a visual indication that this is a verified chat and the verified chat has  two properties.  It's always end-to-end encrypted.  It doesn't fall back to opportunistic and it's safe against active attacks.  That happens because you only can join an encrypted, verified encrypted group through  a QR code scan.  So I show you something and then you can join the group through this scan and you can add  new members through another scan.  So if you want to be 10 people in one group, you need to have nine joins.  Like I join the first person and I join another person and these persons join more but all  in all for 10 people to exist in a verified group, you need nine verifications and that's  81 verifications less than what you would need in Signal or WhatsApp because they actually  also are FRIMA.  They also offer verification but you need to do it with every group member.  So for 10 people, it means that everybody needs to do nine verifications basically,  more or less, maybe it's a bit less.  But it's like a lot more than this kind of the data-chat way is basically just having  a fully connected graph.  Like I start the group and then everybody who's going to be in the group will be connected  to me through a chain of verifications, a blockchain of verifications.  It is actually quite similar.  So this has evolved in an EU research project and there's a paper about this, how this is  done but here I just wanted to say that it exists.  So if you're very afraid about the opportunistic side of things, then you can always go for  verified end-to-end encrypted with your partner or other groupings.  Another security issue is what we identified together with activists in Eastern Europe  is location streaming because if you have people going around in, let's say, Bela Russia,  and White Russia and they vanish and that is kind of a regular occurrence that happens  during demonstrations or other events, then one of the questions the organizers of events  have is where are these people?  They can't find them anymore.  So one of the things is that location streaming allows you to say, I want to stream, like  only on my side, I want to stream my location to this chat and this might be just somebody  who is somewhere else who is in a safe situation, we call this base camp and they see actually  where everybody moves, also the movements like in the past.  So you can see on the desktop version there's like a slider, you can see what happened in  the last couple of hours.  So location streaming, once you enable it, basically tracks your location and sends it  end to end encrypted to your chat partners so that if you do vanish at some point, at  least there's a last position where you have been and all of the photos and audio messages  and videos that you do will also have location text.  So that kind of like gives some tracking and also after some kind of action allows to map  everything.  This is a security feature in a particular way.  It's not about ECC keys or perfect forward secrecy or anything like this, but this affects  people for real.  Like you can save people through that.  What we did do in end of April also in Kiev in Ukraine was we kind of introduced this  location streaming by playing it and you see this here, this is the quarter of Kiev called  Pudil where we played the game and the game was played with these cards.  It's probably not well readable.  It reads something like politician, whistleblower, journalist and so on and you draw a card.  There's two teams, cubes and spheres and they basically have two coordinators, two base  camps and they fight with each other or try to do things with each other, but they also  have to uncover lots of hidden places in the city.  So you can also use location streaming for other things.  In this case we were using it for some kind of safe real life testing.  Another security feature that is upcoming, it's not implemented yet, is what we call  burner accounts.  You might know burner messages from signal.  Burner accounts are really what they sound like.  If you scan a QR code you get a temporary account that is completely removed after one  week.  If you are a group of ten people or if we want to be like in a temporary group like this,  I would show the QR code.  You would all get a temporary account.  After one week the server deletes all of these accounts.  We have a verified group with each other and we have kind of randomized and that's the  important thing, we have randomized accounts.  So maybe we choose nicknames on how we can recognize each other.  This is a bit of a large group I guess.  But it means that when my phone gets taken, then my contacts, my metadata that gets revealed  by my phone being seized will not reveal very much.  Just a number of random accounts.  Compare this with phone numbers, mobile numbers.  Getting one phone from somebody who is involved in an action and you get all of the contacts  and mobile numbers which at least in the EU means real life identities for free.  So that's something in burner accounts you don't get this.  You just get a number of accounts that have no long time identity track record.  That is something that has been designed or is designed with activists on the ground.  So it's not something that we just think might be useful or so.  We actually have discussions with the people affected and design the things from there,  the security and so on.  What we also have in terms of a bit more security engineering thing is RPGP which is full Rust  implementation of PGP done by Friedel Ziegermeier and it supports the auto-crypt subset of open  PGP because auto-crypt is not, it uses open PGP but in a very minimal way.  It says very specifically what you use out of PGP.  For example, no key servers.  It's not needed.  We don't need it at all.  And RPGP implements this subset in full Rust and next week I think we will get the security  report so that means that it also has an independent review there.  What we want to do quite soon is we want to have, like when I told about this game in  QIFF, that was kind of real life but not really because it wasn't actually, like QIFF is not  very dangerous in some sense, at least most parts of it.  Whereas the people we are talking with there are operating in areas that are dangerous  and we want to actually prepare and then go for real life testings of things during actual  actions there.  And our general focus other than for example what signal other messengers provide is that  we don't regard everybody in a chat group as equal but we actually see that there's  some asymmetry.  There's usually organizers who are like in a safe place and they're helping others to  actually do something.  So if you have for example something like ephemeral messages, you really just want to  have them one-sided.  You want to have them from the people on the ground but the people at the base camp who  actually look at everything, they want to see all the messages and actually also have  a history of these messages and so on.  Okay, so that concludes, I don't talk about this, this concludes the security part.  I hope I could give you some insights on the way on how we think about security.  It doesn't mean that we don't care about crypto, in fact we have RPGP and some other things  but it means that we focus on the actual outcomes for people.  So now software, that's probably also why you are here.  There is a core library, it's called Lettichet Core, sometimes DCC.  It's MPL licensed so it can also be used in commercial products and is actually used in  commercial products.  For example by Open Exchange or mainly by Open Exchange currently.  And it is the library that is used by all the Lettichet user interfaces.  It's a very UI oriented library.  It doesn't give you access to MIME and IMAP and SMTP and AutoPrep and the persistence  layer and so on.  This is all kind of hidden.  What you get is add this contact, create a chat for this contact, like on this level  is the API and give me all the members of this chat, send a message to this chat, send  an audio message to this chat and stuff like this but you don't get to specify like a MIME  message which is like the email format.  This is all handled by the core library.  So in that sense it's kind of easy to write a UI because you don't have to handle all  of these details yourself.  And we are currently transitioning this core library to also be a full Rust version.  Currently it's C, like the Android version that you might be using is C but the upcoming  and partly used already version is done in Rust.  So we have Delta Android that's quite stable.  Since last week we did like the declared this to be stable.  This is still using the C library because we wanted it to be stable.  The Rust part is still a bit, it is kind of stable but it has some glitches here and there  so we don't feel comfortable.  Delta chat Android is used by, hard to say, let's say 30,000 people or something like  this.  It's hard to count because it has been only on FDroid for two years and since February  or March this year it's also on Google Play and there it has something like 20,000 installs  or so but also a lot of uninstalls so you can't really count this as like active users.  But this is quite stable, very feature complete, many people use it.  Desktop is on Linux and Mac quite stable I would say.  So still using the C library there on Windows we actually already use the Rust core library  because it's much easier to build.  Building the C thing on Windows has been too hard basically and then in Rust it was relatively  straightforward.  Rust is very good in terms of cross compiling to lots of different targets.  And iOS is evolving strongly currently there's just another quite good test flight release  from yesterday and we think it's going to go to App Store let's say in the next two,  three months.  And the core bindings, the most complete bindings I think are in Python.  You can find the docs on PyData Chat.  The node bindings are also used for the desktop because the desktop and we get to this later  is using Electron.  And of course the Swift and Java bindings they are contained in the iOS and Android  reports they are not packaged separately although this could happen.  So who has managed to, I don't know if you were just listening or also tried to configure  your phone?  Somebody?  Okay.  Did you try to join already or?  Did anything work?  Do I have network?  Wait a second.  I might have to log out here.  Okay that's a bit hard for me to do.  I need to restart my desktop.  Yes.  It takes a while to refresh.  Oh a lot of people joined.  Ah hi.  Okay.  I can't type very much.  But this is the papers that got distributed.  We are 10 members now by scanning this QR code.  But the time is running out a bit so I'm going to continue here.  Oh Delta bots.  That was also something that I'm actually starting like in the last couple of weeks especially  and I really want to have the bot developing chat bots that you can use with Delta Chat.  It's like a thing of the next half year that we want to give a lot of energy to.  The nice thing about the Delta Chat bots is that unlike in WhatsApp and Telegram you can  just you only need an email address.  You only need SMTP and IMAP credentials and then you run it wherever.  You don't need to register it anywhere at the Telegram server or the WhatsApp business  API.  It is quite difficult to use.  You can run it wherever.  Also inside your organization you can make it such that nobody can reach it other than  the people in your organization and so on and so on.  So that's like a very nice and easy deployment story.  There is one huge I think at least by now 15 to 20,000 users in Cuba who have a very special  situation in that everything in Cuba that stays on the island in terms of network traffic  is relatively affordable.  Everything that leaves the island is like very expensive and you may have mentioned  why.  There are a lot of cases of sanctions from the US and so on.  It's directly next to the US.  So they don't have very good connectivity outside this island.  So there's an economic barrier.  You can get the connectivity but it's expensive.  And so what people are using is the local Cuban email server, nauta.cu.  That's relatively cheap.  You can get it on your mobile and that's why Delta Chat is getting quite some take up  such that they jumped in early, used the Python bindings, one of the people there and wrote  simple bot.  What you see here is on the left-hand side a chat and you will find that it's kind of  like you send a command and you get back some form of an attachment, get delta3.html.  When you click on that, I can't show this here, when you click on that then there is  an app that you have to install separately called ZHV, zipped HTML view.  And when you click on that then it opens.  What you see is the simple bot interface.  So this is a chat bot interface in HTML.  You see it here and you can click on it and when you actually do something like get me  help or find some friends, whatever, then it sends you back to the chat because it's  a mail to link.  This is actually, you can use it to browse web pages.  So you say give me this website, it goes to the bot, the bot sanitizes this, strips this  down so it's not so much size, gives you the HTML with all of the links substituted by  mail to links.  So when you click on them you land back in Delta Chat and you just say send.  So you have a complete history of the site that you visited.  It's very low traffic and it's like an interesting hack you could say on how to write bots.  Of course we can, I mean we could make this almost automatic in the future.  That you basically allow this bot to use Delta Chat basically in the background.  So you can do this kind of bot communication differently but that's maybe something to discuss  tomorrow.  So the Python bindings on Linux are very easy to install.  They are by now binary for Linux so you can just say pip install Delta Chat.  You don't need to compile anything and so on and you can just directly start.  On other platforms you still require first having your Rust core compile and then with  pip install basically from the source code you need to install the bindings.  The interfacing between the Rust library and the Python bindings is done through CFFI.  That means it should also, I think it does also, I'm not sure if you tested this actually,  but should also work in PyPy.  This kind of interfacing, it's a relatively simple usage.  So that's certainly, if you are around also tomorrow then you can just test it if it really  works.  And of course the tests are written in PyTest and they are used as functional tests also  against the core.  So there's a lot of like, in the bindings there's a lot of functional testing of this  high level API and more that we need to do in this area but it's a good basis.  There's also like a simpler than the simple bot example that is in the Delta Bot repository  that is also the basis for the simple bot but obviously the simple bot has done some  more things.  So that makes basic usage of the high level API and you can directly deploy it.  Like if you have SMTP and IMAP credentials or you can easily create this, it's a matter  of really two minutes and you are connected and can do something.  We did get, I think couple of weeks ago, we got some funding specifically for completing  the move to Rust in terms of the chatbots and also implementing all kinds of chatbot  examples in addition to what we have like RSS, ActivityPub, Matrix, IRC bridges and so  on.  There's some good planning and ideas around this but the idea is to do this in Python and  we're also going to sprint about this tomorrow and if anybody here or if you know if anybody  was interested, possibly interested in this and there's also some money to be gotten for  getting involved here and helping to drive this effort.  There's going to be a lot of things happening there.  One of the things that some of us definitely want to go is use and produce gaming bots.  So there's some talk about, for example, implementing the game of Werewolf.  Maybe you know Werewolf.  So everybody joins and the bot says hello and then the game starts and the bot basically  randomizes the roles, opens the chats with the various people.  You can imagine roughly how this could go and it's designed and discussed with a 14-year-old  girl who's very eager to get this done because they are playing Werewolf currently with an  app like in their school with an app called Telonym.  Not sure if you heard of this and it's crazy.  It's like a crazy app.  You get messages but you don't know from whom.  Right?  How can this go wrong?  So they're using it to play Werewolf with it but it's also privacy-wise and so on.  It's a disaster.  But okay.  The last note to close up on how do we actually do this?  WhatsApp exists since 10 years, has lots of investment and resources and so on.  Time is also long going already so how can we enter this scene?  Like how do we get funded?  How do we actually do this?  You got some glimpses of like when I mentioned Kiev and this and that.  I'm going to try to...  This is the coffee bus in Kiev.  It's a very strange thing to have.  There's like four coffee buses in Kiev.  It's like a double thing.  It doesn't come from the UK.  I don't know where it comes from.  They serve coffee.  This particular one I think has a lot of Hollywood pictures inside and it's very strange.  Coffee is kind of okay.  And so you hang out there and also next to the park and you are in Kiev 200 kilometers  from Chernobyl, 300 kilometers from a war zone and so on.  So it's a kind of a different feeling than what you would have, let's say, sitting in  a Starbucks in San Francisco.  It's like a very... so location matters like how and where you actually do things and what  is your context in which you're operating makes a lot of difference, I think.  And we are basically saying, okay, we want to have really different contexts and locations  especially of people who are on risk.  We have a lot of physical gatherings.  When I co-started Pai Pai, I think 17 years ago or so, also with Amin over there, what  we established also was having sprints.  Like every, I don't know, six, eight weeks or so at some point we did sprints and that's  also what we do here but in a slightly different way and that we have also partial gatherings  and we never really do... we don't sit everybody together except for the party.  Like there's a lot of partial gatherings even within this bigger framing and that's also  what's happening that people meet, be it often in several parts of Germany, like just three  or four people out of the maybe 15 who are actively involved because that's already helping.  It's not like everybody needs to meet all the time with everybody.  But the physical gatherings in complementing the remote work that we usually do are really  important.  Backgrounds, you see here on the left Xenia, I mentioned already, I'm working with her  for a very long time already.  She comes from Russia originally and she has done a lot of the research and a lot of the  usability things that we are doing also relate to her work.  And you can see the glimpse of the guy with the coffee mug here at the park in Kiev.  On the right hand side, that is Bjarn, who actually started the whole Dethatrad project  two and a half years ago.  And on the right hand side, you see a placeholder for all of the other people you can't see  here.  What we usually do is we don't do project meetings.  So we don't say this is a Dethatrad sprint, come, or something like this.  Every event has a different name.  And we also invite various people around the project.  So not directly contributing, but who are kind of like, for example, heart of code.  It's a feminist tech space in Berlin, you know, and we have some relations and they  were interested, so they joined for various reasons.  I'm not going to go into that now.  And so we have befriended projects, also other decentralization projects who are just around.  So we do some things, we talk with each other, you know, we have some food, whatever, but  otherwise they can work on whatever they want.  They don't need to integrate into our Dethatrad structure or something like this.  So that's a little bit of an open gathering culture, I think, that everybody came to appreciate  very much.  Otherwise just to conclude on this, we got some money from the EU, we got some money  from the Open Tech Fund that some of you might know, and we are also going to get some new  Open Tech Fund money.  It's just been one week ago that they accepted that.  I mentioned the NLNet one, and we have a lot of people actually who are really, really,  really good at what they do and they just help us and they get to steer the project  also.  It's not that they just help a little bit or so, but they actually get a say in how  things are done.  And I think that's quite important.  If you have a mixture of people who get paid and people who just participate, there's  always the risk that the people who get the money actually also get to make all of the  important decisions.  And that's something, let's say, that I learned earlier on that it's very good if it's possible  in the project culture to give the contributors who don't get money and who are contributing  lots of things also a say in how things are done.  Longer-term money is, that's a bit of a more involved discussion.  We are also like, if data chat grows like bigger than it is now, then we might also  just try to go for more donations.  There's also upcoming organizations who want to use data chat, a university in Germany,  for example, who wants to deploy it everywhere, not only in their stuff, but also with Microsoft  Exchange.  It works.  It's standard-based.  It uses IMAP and SMTP.  It's fine.  It works.  You don't need to change your email infrastructure for data chat.  You can just use it as is, usually.  And we are also thinking about special pay apps to go for.  So no VC money.  I think venture capital money and this kind of endeavor is a dangerous thing.  And we don't want to go for that.  Okay, maybe as a, and I think I stopped it at that, I think in 2005 I gave at the CCC  in Berlin a talk with Beatrice During, who was also involved in the PIPI project, about  agile programming, which was a big thing, scrum and so on.  In 2005, and we talked, you go back to the talk, we talked about lessons learned and  how it doesn't really fit the bill.  And then, I don't know, two months ago or so, I was 2019, some student came to me, oh,  I can't hear this new agile thing.  It's very strange.  I mean, I don't know.  Anyway, I think it's time to move on.  One thing that I kind of keep advertising or talking about is that I think it's good to  not have too many round tables, to not have, not base everything on assembly where everybody  discusses and decides everything.  It seems like a very natural thing.  I don't have the time now to go very much into this, but I think it's also, and I've  done my fair share of assemblies.  Let's say probably more than most of you.  I've done a couple of hundred assemblies and plenaries in all kinds of collective projects.  And I think it's overestimated and also dangerous, and because it's exclusive, like you can make  whatever kind of rules in terms of talking with each other, that everybody gets a fair  share and talking and so on, and you want to be very inclusive and so.  But in the end, you're going to be on a table, and some people will talk, others will not  talk, and others will not even be there and participate in the talk for various reasons.  That's always the case.  In any given project that has a regular practice of doing assemblies, usually 20 to 30 percent  actually show up to do this kind of discussion.  So it's problematic.  Also in terms of deadlines and schedules, we try to not do it.  We have some rough ones where we want to be, but we don't keep a timetable, like exact  times when anything should be ready.  That worked despite all the languages, despite all the platforms we are involved in and not  like that much money, worked quite well for us.  And we try to take up, if somebody comes to this brand or to the gathering and wants to  do something particular and tries it out and it seems to work, it might actually shift  the project towards that direction.  It just happened in April because before April, we didn't have a full Rust call library.  That only happened in April because Friedel discovered this wonderful tool called C2Rust.  So if you have plain C, you can just translate it to Rust.  And he said, let's try it.  And it was not on our plan.  We wanted to get stable releases out in May because that's one of the promises we made  to the funder.  But if somebody has the expertise and really wants to do something and it makes a sense  on a certain level, then we try to go for it.  Even though that was counter to some other things we wanted to do.  So that's what I call situational developments.  Yes.  So I think I'd like to leave it at that and maybe just mention tomorrow.  So tomorrow, the sprint topics, there's a number of things you can also bring something  and diverge.  On the one hand, dealing and playing a bit with the data chat bindings, write some chat  bots, maybe the beginning of a gaming bot or so.  And there's also an idea together with Florian here from Qt browser fame to actually see  about kickstarting QT-based desktop client.  Because everybody knows Electron is horrible, right?  You know Electron, the JavaScript-based Chrome, big, whatever.  Well, it has also advantages to have this kind of framework.  But I think a QT-based one based on the nice Python bindings we have that now eventually  work would be an interesting project.  OK, thanks everybody.
Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_0_131.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_132_1559.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_1560_4439.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_4440_7703.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_7704_7775.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_7776_10415.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_10416_11111.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_11112_12671.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_12672_14375.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_14376_14495.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_14496_14543.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_14544_15623.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_15624_18383.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_18384_19199.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_19200_21311.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_21312_23075.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_23076_25439.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_25440_28475.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_28476_29843.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_29844_35555.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_35556_35615.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_35616_37163.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_37164_41099.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_41100_41327.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_41328_43835.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_43836_47351.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_47352_47579.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_47580_48179.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_48180_50099.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_50100_50387.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_50388_50531.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_50532_51167.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_51168_51383.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_51384_51443.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_51444_53999.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_54000_55103.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_55104_56939.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_56940_56987.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_56988_57635.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_57636_58199.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_58200_59867.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_59868_60119.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_60120_60167.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_60168_61247.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_61248_61499.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_61500_61991.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_61992_62315.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_62316_63047.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_63048_63395.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_63396_63671.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_63672_63743.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_63744_63791.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_63792_63839.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_63840_63887.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_63888_63935.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_63936_64007.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_64008_64187.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_64188_64235.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_64236_64379.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_64380_64523.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_64524_64643.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_64644_64727.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_64728_64847.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_64848_65087.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_65088_65339.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_65340_66179.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_66180_66323.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_66324_66803.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_66804_69455.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_69456_69539.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_69540_70475.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_70476_72263.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_72264_73043.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_73044_74255.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_74256_76199.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_76200_76847.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_76848_78443.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_78444_80267.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_80268_82715.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_82716_82967.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_82968_84359.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_84360_85811.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_85812_89075.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_89076_89135.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_89136_91187.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_91188_92987.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_92988_93107.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_93108_93191.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_93192_93239.png Holger_Krekel_-_Delta_Chat__CFFI__pytest_and_all_the_Rust_prfgtpdeoNA_93240_93275.png