So, hi, welcome. I'm David Huerta. This is the talk that I'm doing. It's called Alice and Bob are Slightly Less Confused.
Just to kind of go off of the kind of biography, like, who is this?
So, I'm Digital Security Fellow at Freedom Press Foundation. I also organize scripted parties in New York City and Phoenix.
A lot of the kind of experiences that I've had with, like, user frustrations and things come from kind of the front lines of, like, showing people how to, quote-unquote, use Signal, use Tor.
And then before that, I come from kind of a weird mix of a developer and design background.
I work in an AI lab that did mostly data visualization for really complicated things.
There's my Twitter. It's mostly just me yelling at the F train nonstop.
And then this is actually SQL. So, this is a talk, like, the continuation of a talk that I did in 2015.
So, let's talk about that.
So, 24 months ago, actually 24 months ago, I did a talk on kind of usability, privacy, and just, like,
these are the issues that people ran into at crypto parties.
And here's some suggestions on, like, what to do based on things like human interface guidelines,
which are kind of the rules that different platforms have for, like, making things feel more like the platform that they were designed for,
among other kind of design concepts.
So, these, I'm just going to, like, recap kind of, like, the very, like, the very kind of cliff notes just of what that talk was about.
The new Mac interface guidelines that are online leave out all the UX fundamentals.
So, they'll just be, like...
You know, put an arrow here instead of a hamburger menu or whatever.
But if you find this, like, really old 1983 copy of the Macintosh human interface guidelines,
it goes through kind of the baseline fundamentals of user experience, which apply to, like, everything.
This is kind of at the forefront of, like, people doing things with, like, graphical user interfaces
before, of course, there was a command line at the beginning.
And this is, like, kind of the way to, like, deal with user interfaces that are based inside screens.
And so, just kind of the recap of what that basically talks about
if you don't want to spend, like, $4 at a used bookstore on it.
So, there's these concepts that we think about in UX.
Modelessness.
So, the idea of, like, having to depend on human memory to remember what state you can do certain things in versus others.
This is a lot of, like, a lot of Emacs people are, like, this is why you don't like them.
Because you have to remember what state you're in, whether you're in write or whether you're, like, in a commands.
Entry.
And the problem that is kind of specific to a lot of cryptography software
is it's usually kind of, like, bolted on top of some other insecure protocol.
This is especially the case of, like, PGP, for example, where it's, like, people generally, not generally,
but, like, some people use it for email.
So, in this case, email is just not designed to be, by modern standards, a secure protocol.
And you have to remember to, like, do things in a certain way to have it be in an encrypted.
But there's, like, an unsecure mode and a secure mode that gets, like,
mentally modeled on top of that.
And having to remember that is a problem.
Perceivability.
So, this is, like, the idea of the UI kind of reflecting what's actually going on behind the scenes.
Mostly, a lot of the points that it was making in 1993 were mostly about, like,
making sure that if something is working really well behind the background,
that the front end reflects that so that people don't automatically assume that, like,
you know, oh, no, there's an error.
Where it, that, because in, especially in, like, security software,
a lot of users' assumption won't be, like, you know, computers are garbage, code is garbage,
nobody did tests on it, but mostly, oh, no, something went wrong, I must have been hacked.
So, you really don't want to, like, cause anxiety, you don't want to freak users out.
Another book that I recommend actually kind of speaking on anxiety and design is called,
oh, yeah, sorry.
Another book that is not mentioned, aside, thank you,
from, aside from the fact that, aside from the original Mac Higg,
is also, uh,
I think, a list apart, publishes something called the, uh,
Designing for Motion, which is another good book, which is really good, highly recommended.
Mostly talks about web design, but kind of applies to a lot of other, uh, applications as well.
So, we have, uh, user testing, and that is basically exactly what it sounds like.
In this case, like, what you make will make sense to you because you built it,
if you're a developer, for example,
but you want to put it in front of people that are not like you, in a sense,
so they use it to see whether the same assumptions that you have about how this works
are the same assumptions that they have, uh, and that is why user testing is super important.
This is actually pretty well established, as far as, like, the methodologies for this.
Uh, Katie Smith did a talk, I think, two hopes ago, about user testing that I recommend checking out.
Uh, metaphors, it's also just, like, as far as, like, describing what a thing does,
like, having a analog kind of equivalent of that to compare it to is a good way for people to understand what it is.
Uh, so, you know, you have, like, your notepad, for example, this is, like, you write down notes in, or text, or whatever,
and, uh, that is a common, like, thing that gets used a lot.
I'm just gonna move this mic around.
So, there's, uh, user testing, metaphors, uh, the problem is that, like, in cryptography, like,
public key cryptography is weird, and it's hard to describe, um, and, you know, back in the day, we had keys and cryptography,
and a public key is, like, a cryptography key, but it really works more like a lock with a private key as a key.
So, it's one of those things where we have to think about, like, metaphors that make sense,
to really describe the function of what different things within a system do.
Uh, and then there's key lesson from 2015, so this is also from my own talk, of just, like, things that were not covered in 1993,
but, like, the idea of, uh, undoing, for example, uh, we usually want to have, like, in software development,
a way to do that really easily.
But in cryptography, like, if, as far as, like, privacy in hand is concerned,
as far as the technology goes, like, for example, if you're in the old version of mail below,
you start typing a message, you go and encrypt it, but too late, it's already saved this draft in your Google draft.
So, uh, it's one of those things that, like, it's harder to pull off and more of a challenge,
more of a design challenge than it would be in other apps.
Uh, there's also the idea of just, like, you have too many tools and too many things and moving parts that a user has to manually deal with.
So, in, like, crypto parties, for example, you will have to go through, like, oh, well, if you want to, like,
say you want to do the standard kind of cross-platform setup,
of Thunderbird, Enigmail, uh, GPG tools, or GPG for when, like, you're installing three different things,
you're doing, you're downloading three different things, you're doing checksums on three different things,
looking for checksums, researching how you actually use checksums,
because literally no place that offers a download for these things actually mentions how to use them.
Uh, and then going from there, as far as, like, making sure that everything's installed correctly
and knowing what order to install things in.
Uh, there's also just kind of a, I don't know, there's probably a better name for this, uh,
like, more experienced designers have for this,
like, I'm going to do a thing, I'm going to do a thing.
Oh, by the way, I can't do a thing.
Like, at the very last step of this long process that I've just gone through,
it realized that this is actually impossible.
Uh, this is a problem with, like, the YubiKey support in, like, OpenPGP, for example,
where, like, the way it reads the card, like, if you start typing a...
Okay, cool. I am going to have it right in front of my face.
Does that work for everybody?
It's noticeably better. I can tell. Thank you.
Cool. And honestly, like, up until this point, this was basically my talk from 2015,
so you didn't miss out on anything new yet.
Alright. So, uh, yeah, let users know. So GPTools is kind of notorious for this.
There's, like, a specific thing where, like, oh, I'll start writing a thing in Thunderbird,
but then I plug in my YubiKey, and then it's like, oh, I don't recognize it.
You haven't entered your PIN, but it doesn't prompt for it because it only looks for that
at the point before the mail client is opened when the, like, GPT daemon in the background runs it
and, like, it's like, oh, okay, here it is.
So you literally have to, like, put your laptop to sleep and then Mac OS X, it'll basically
re-kick in the GPT background process and be like, okay, now you can prompt, get prompted for
your key. Uh, so that's what, like, the concept for false hope. The other thing is also just,
like, the internet is full of, like, garbage documentation. So, like, even if you, like,
describe everything absolutely perfectly to your users or your audience or whoever it be,
somebody on the internet will explain it really poorly, confuse them, and cause more of a
problem. So you have to anticipate, like, what other people are using to describe things in
order to explain why they're either wrong or why that might be confusing to explain it that way.
Alright, so we kind of, in 2015, talked about a few different examples, uh, privacy enhancing
technology and, like, some of the problems and then kind of some of the progress some of them
made. So we're going to talk a little bit about that. Uh, we're, we're not going to talk about
Pigeon, though. It's, Pigeon's a little busy surfing right now. And, uh, we're going to talk a
little bit about, uh, there hasn't been much progress on that front. Neither has there really
been on Thunderbird since it's still kind of EOL and they're not doing anything but bug fixes at
this point. Uh, so we'll just, like, skip right over those. So going back into what I mentioned
about modality of, like, thinking about, like, an insecure versus a secure mode and what that
means. Uh, I kind of cited Chrome as a good example of this, where it was, like, well, here's
incognito. Here's, like, within this window, within this frame, which is, like, differentiated
from the way the other, like, insecure modes work. This is the way, like, it's like, like,
it gives you just, like, the briefest amount of information but it's not in your way so you're not,
like, clicking X buttons or OK buttons to, like, make something stop. It's there if you need it
and then it's not in the way if you don't. Uh, different browsers, like, they've improved.
They've, like, made it even more obvious that, like, this is different than the other windows,
uh, which is cool. And it's, like, one of those things where I think the Chrome team has been
doing a lot of user testing around that to see, like, how people make, avoid mistakes of, like,
accidentally, um, doing embarrassing searches on their non-securing, you know, like,
incognito modes. Uh, other browsers, of course, have this. Um, the, there's a bit of a problem,
though, that was kind of discovered recently due to user testing, uh, which was, uh, basically
discovered from this from a DuckDuckGo study is that a lot of people don't actually know what
private mode does. So, like, people can tell when they're in private mode or not. But as far as,
like, the mental models people have, the assumptions that people make around these things,
they're not super well described. Although, you know, there is a blurb of text explaining what it
is. But it turns out that, like, when you're in private mode and you're not in private mode,
um, paragraphs of texts that are kind of in the background maybe aren't necessarily the best way
to warn people about stuff or, like, really explain easily and quickly concepts like that. Uh,
but they're working on it. And I think this is actually, like, this seems like the tiniest, most
insignificant change. Um, but just looking at what it does to, like, say, like, yes and no as far as,
like, does this protect from my ISP? Does this protect from, like, other people using my
computer? Like, kind of having a more, like, threat model immediate, like, real world application
of just not being, like, talking about cookies specifically, but just, like, you know, your
little brother can see what you're looking for or, like, uh, your government can see what you're
looking for, et cetera. I think this could be applied in a few other places. Um, and I would
love to see that kind of proliferate in more places where you have kind of an insecure and a
differentiation between an insecure and secure mode. Cool. So, last time we were here, this is,
so this is Signal. This is literally a copy and paste screenshot from 2015. Um, and this is
a, uh, there was this idea that I had of just, like, well, this is kind of, just kind of where
things got thrown into as far as the settings page goes. And, like, we're all guilty of this as
developers. It's just, like, well, we got to have some stuff. It's, like, I don't know, let's
just throw in the setting page, whatever, like, leave it alone. Uh, it's improved since then,
actually, a lot. So, the issue with this, for example, two things. One, I hate the word
fingerprint because any time I've talked to people that are just new at computers, they immediately
think of a fingerprint reader, which are actually fairly common in a lot of laptops and smart phones
now. And they think it's related to that because they share the same namespace, um, in memory and
context. And it also doesn't say what to do with it. This is a problem that I have with, with the
way people offer checksums. It's, like, there's no instructions on what to do with this, like,
weird number that you're seeing. Uh, and that was the kind of case of what it was back then. Uh, the
protocol's changed, so actually the way people would even compare fingerprints is different. Uh,
the screen security, there's no explanation what it is. So that was kind of the main issue back
then. Now, you have exactly the same thing. Uh, you have, uh, you have the same number of
those, and they don't know exactly what kind of Apple recommends for, like, explaining things in
general. So you have, like, a like, a short thing that this is when you're switching apps, and
that's the official name of what it's called in other Apple apps so you know what App Switcher
means, is kind of there. There is, um, other explanations for new features that didn't quite
exist back then. Uh, you also have block functionality, which is really important. I think,
unfortunately, there's a lot of focus that we tend to have in Informations Security on, like,
the most, you know,VEGO's jobs ended up not being clear questions that most people would be
making sure that we do things on the crypto side and on the math side really well but maybe not
thinking about a lot of the other attack vectors or like issues of what attack means in this case
like what if it actually means that like your creepy X will not stop sending you like you know
creepy texts for example. So this kind of takes care of that. It took a while for that to roll
out. Apparently there's been some IOS issues that have made that a little bit harder than it
sounds but this is one of those things that I think you really want to have implemented as far
as and this is why people do user testing because this is a concern that gets brought up in
addition to like I really don't want to share my phone number like it's another thing but like
that's kind of baked into the way this works so there's no changing that unfortunately. Kind of
similar thing so this is kind of what you do with fingerprints now where it has an entire kind
of screen that's dedicated to like a process of what you do. So like here it shows you the state
of what you're doing. So this is kind of what you do with fingerprints now where it has an entire
where it is. Which before you had to remember. You had to like you had to like basically throw
this into human memory to be did I already verify this person? Did I not? In the early days of
Signal there weren't that many users so it wasn't really seen as a problem probably. But as we
have more and more people on Signal that's like more spaces in your like media like neural
network to like save um basically to say like I already verified a person. I didn't verify this
person. Did I verify this person? Maybe I did before I got my new phone. So there's all these
things that have to be thought about. Uh.
Modes as far as like you know now you can do this one feature and this is what that screen is
for. Uh. And it also says why. So it kind of gives you an idea of what that is. Uh. It has a few
different options so you have the easy option but you can actually see the full fingerprint by
yourself so you can have some other means outside of the way it was designed for to compare by
other out of band uh verification processes. Uh. And there's a learn more thing which I'm
really a fan of. It's like people that want to learn more can learn more. Uh. Outside of that is
that though there's been some new issues. Uh. We have um kind of going back to the assumptions
people make of like how things work. Uh. Does anybody remember Path? The like kind of the weird
like people threw a shit ton of money at it. They were like it's the next Facebook. Uh.
Basically the idea behind that was there was a big controversy about it essentially like
uploading all your contacts and then like keeping them on their servers. So when people hear
about you know something on their site is able to see that I'm friends with some somebody on the
other side. The mental model people have and assume is that like stuff is on the server cause
that's the way it works for their email. That's the way it works for social media. That's the way
it works for like a lot of other things. And they're not going to necessarily understand like
well I did a hash on a thing and then we did another thing and that's how the server doesn't
know what's going on. Uh. And this is hard to explain because it's a very you know there's a lot
of unique security processes. But I think having uh so just as Threema they kind of do that as
far as like explanations go. Of like what's going on and what's not going on and what's not going
on. This is why we can see who else is on Threema while still like not giving away or keeping
your like phone number or contact or email address or whatever identifier they use. Uh. And
you get to the screen via uh this is like an ID. Via these like little more information icons
which are pretty common in a lot of mobile apps. So it's I'm a fan of them. Uh. Because some
people like for them it might not matter very much but for anybody that really wants to know
what's going on behind the scenes I think they should. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh.
Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh.
Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Uh. Oh this is like an easy way to
present that without having you know throwing the same thing at absolutely everybody. It's a
good way to distinguish that. Uh. Cool. Uh. Last time we also kind of covered Peerio. It's
changed pretty radically since then. Uh. The problems were the last time were that it felt a
lot like email because of that people had certain assumptions on like being able to send a
message to a contact without adding them first. Whereas now it because the design is so
centered it's basically like slack or like any other like kind of like that kind of like
like 800 chat apps that are out there now. Um, people assume that you have to be added to a
room or that you have to add people so that like mental model that people have about the way it
works kind of is more in line with what people are already used to. Uh, which is great. Uh,
oh, something really great about this. The other thing that I mentioned last time is like
period would be one of those things where like it's, it would be tricky to use your test for
because of the fact that you're dealing with the enforcement of a really long passphrase
that's dedicated normally to human memory. And when user testing is done, normally these are
like really short sessions. But in this case, like if you want to test like the strength of
forcing somebody to use a long passphrase and whether they will actually remember it, that has
to be done a little bit differently where you have to like test over time, over a series of
weeks, over a series of months to make sure that they still can. Um, in personal experience at
CryptoParty is that digital security trainings, like people did forget these a lot because it is
a long list of weird words. Um, so, um, so, um, so, um, so, um, so, um, so, um, so, um, so, um, so,
um, so, um, so, um, so, um, so, um, so, um, so, so, um, so, um, so, um, so, um, so, um, so, um, so, um, and
so, um, so, um, so, um, so, um, so, um, so, um, so, um, so, um, so, um, so, um, so, um, so, um, so, um, so, um,
so, it was a king and people could use to log in. So they would never have to remember it. But
then if they changed computers or did something else that would like, oh, no, I have to remember
my long passphrases again. And they don't. It's a common misconception that like if you use words
that will be memorable, that's not always the case. But what they did actually like kind of saw
the same behaviors in their own user testing eventually. And they created a new word list.
So rather than using kind of the common word lists that are out there for different languages,
the way they created a word list that was actually memorable was they would look at,
like, the way more people have, like, written language thrown at them. So going into the
fact that, like, a lot of humanity isn't, like, super into reading or at least, like,
hardcore, like, heavy book reading. Like, what do a lot of people watch is movies. So
what if we just took the subtitles from movies and created a word list out of that for each
language? So that's basically what they did. So we ended up with, like, very common words
that people recognize and know. And, you know, maybe has less, you know, there's a bigger
set of words. So it's, like, fewer amount of combinations. But even doing things like
requiring an extra word of more common words can help mitigate that. So there's, like, kind
of weird...
different ways of approaching things that has an effect on stuff. So the other thing that is
something to test about that is a little bit different than other testing situations is
testing for worst-case scenarios. So in this case, have any... are any of you from the
Northeast Corridor, the, like, Accela part of the country, like, Boston, New York,
Washington? Okay. You know my fields then. Have any of you used the, like, garbage Amtrak Wi-Fi?
Okay. Yeah. Okay. Yeah. Somebody... somebody will get this. The, uh, so Amtrak, uh, you know,
it's what we use to get around the East Coast. But there's free Wi-Fi. It's... It's very slow and
intermittent, and it drops a lot. So there's a lot... there's a very, like, kind of situation that
I think... And this is a known issue where you'll see people tweeting about it constantly. It's like,
what does the Amtrak Wi-Fi suck? Uh... It's... it's... it's a known issue. Uh... The, it's... it's a
And you have to, like, keep that in mind when you're testing things that depend on the
Internet, for example, or even whether certain aspects of a network are blocked, like Tor.
So this is onionashare. This is an older version. And this is an example from the real world
of, like, me sharing something with somebody on a broadband Internet connection somewhere
else in the world. But I'm running this as a server, so I'm running this, like, you
know, desktop app. And when I first did this, like, the Wi-Fi was fine. The Internet was
fine. I was, like, paying things. I had an IP address. It was all good. But then, of
course, the Wi-Fi dropped halfway between, like, Maryland and Delaware. And it doesn't
reflect that. It basically just has the same, like, green, like, everything's fine. It's
working. And, of course, it's not. And so there's just, like, back and forth outside of
that band of, like, what's going on. There's a lot of confusion. And that's the kind of
thing that I'm trying to do. And I'm trying to do it in a different way. I'm trying to
do something you want to avoid. Some apps do this better than others. Some will have, like,
an offline messaging thing. It will be, like, you seem to be offline. So there's, like, a
process behind the scenes that will just check to see whether it can connect to the Internet,
usually by pinging whatever API server it's connecting to behind the scenes. In this case,
there's no API server, but there's, like, other things that you can check to see, like, do I
have Internet? The other thing in this case, which is unique to Uninashare, is, like, do I
have Tor? Because there's some networks that block Tor. And being able to know that the reason
why this doesn't work is because Tor is blocked is something that you want to let
users know so they're not guessing. So that's something to keep in mind. Different ways to do
this. Slack does this as well. But, yeah, and this is what kind of the other side looks like.
And then this is what life on the northeast region looks like. And, yeah, oh, that's the
image I was trying to share. This is very important. I was very sad I wasn't able to share
this. But there are a lot of improvements being done. So just, like, as I'm critiquing these
things, like, know behind the scenes that they all are improving, basically. This is the
kind of design issue on that. Which brings me to another point of how I've been able to kind of
approach design issues with different projects. A lot of commercial projects will have kind of a
full set of, well, not a lot. Some will have a full set of teams made up of, like, a product
designer, you know, a product manager, a QA team, other folks, a security person. Like, with a lot
of this stuff, it's kind of open source software. It's very scrappy. It starts off with a real
really small team. And, you know, they're not hiring anybody. So there's no dedicated designer.
So, like, how do people get better at these things? And some people have, like, strived to just,
like, make design a focus of theirs. And I'm going to talk about one example of that. So, in
this case, Tails, which is the incognito live, like, that live Linux system that has Tor baked
into it, is something that we worked on a workshop on at Freeman Press Foundation last year with a
bunch of folks that were not from the tech world at all. They were here for the Laura Poitras
exhibition at AstroNoise at the Whitney Museum. So, basically, there were a few issues that we ran
into. I wrote them down and I basically just submitted it to a bug tracker as if it were, like,
you know, a software bug, a code bug, basically. There's some things that are kind of important
things to think about when developing other software. So, you know, there's a lot of things that
you can do. When you're creating documentation, people, like, might not necessarily see right
away that it's not inside the window or of the window or necessarily see that, like, oh, the
window dressing on this screen shot is different than the one on my desktop. These things are not
always caught right away. So we did something where, like, we noticed that in the instructions to
use the live USB writer for Windows, for example, people were, like, clicking on the web page
screen shot of what it was because it was the exact kind of side of the screen. So, like, we did a lot of
things to make sure that we had the right size dimensions of what the actual thing would be. So
don't do that. Basically make it smaller. That was an easy fix. Naming things counts because
people have different meanings for different words. So every Linux distribution has kind of a
default mode and a failsafe mode. So for all of us coming from the Linux world, which you saw my
Linux desktop, it made sense to me. Everybody else did not know what exactly that meant. So
people saw this because they were using it as a means of, like, safety as far as privacy and what
they associated with it. So, you know, there's a lot of things that you can do to make sure that
it's safe. So they assumed that that was the default mode. That there was an insecure mode, like
there wasn't PGP with, like, unencrypted e-mail, unencrypted e-mail. And they had to, like, go down
one level to failsafe to get into, like, the secure torrified mode. So that's something that we
changed by easily by renaming it. So if you boot tells now, you just see the regular default mode
and then you see a troubleshooting mode. So they know the reason why they would ever want to use
that option and, like, what action there is to do there. So it's very explicit. And we deliberate
on, like, what language to use. And, like, what language to use. And, like, what language to use.
Based on what Microsoft and Apple were using for meaning the same things. Because we really want
to, like, use language that is familiar in different situations in different contexts. So, like,
people will use troubleshoot to talk about other tech troubleshooting problems. So that's
basically where we ended up laying on that. The other thing, too, is just, like, making the
documentation available offline. So back in ‑‑ this was early 2016. There's a link to how
documentation ‑‑ which is what you go to. It's a link to how documentation works. It's a link to
if you want to, like, learn how something works. But what if the reason you're going to the
documentation is because you're having trouble connecting to the Internet? If your docs are
online, you're not going to be able to read them. So in this case, you're booting a live system.
So why not just have them offline and have them live in there? So that's what they did. And that
worked. So people are able to, like, read up on what to do if they can't connect to the Internet,
what could be the problems. Maybe their Wi‑Fi chip isn't working. But it's that way. They can
actually read the docs to see what the problem is. Some things can't be done. Like, if you're
using a Mac, it can't be fixed. So this is some Apple bullshit where if you have a live Linux USB
drive, it'll just show up as Windows because it just assumes that operating systems are just,
like, there's Mac OS X and I guess Windows and that's it. So that's something that we can't fix
the confusion for, unfortunately, at least for Mac users. And so with Intel you have the option
of creating a persistent storage, like, basically just like a looks partition. This is one of
those things where, like, people don't necessarily know what they're doing. They don't know how to
do it. They don't necessarily know that they would have to reboot to be able to, like, start saving
things there and have them stay in there and persist there. So just, like, having a note of that
within the, like, you know, the wizard that they set up for creating a persistent volume is
helpful. But I think it should go a little bit further. I think it actually should just have,
like, immediate button to just reboot right away because that should be the next action so they
don't commit that to human memory and depend on human memory to remember that they haven't rebooted
yet to do that. Just to make it that much easier.
So this is a new thing. Like, there's not really a lot of people that I know that report design
bugs. There's not a lot of designers in open source in general, which is a problem. And I think
that's more of a kind of difference in, like, the kind of experiences that people have as design
and what they associate with free or volunteer work versus what we do as developers when we, like,
work on open source. We're, like, if we're working on open source, it's kind of just community
and we're just working on a project together.
Whereas design, like, the neural network of a designer and a developer will be, like, basically
trained on different data sets where you have, like, experiences of, like, voluntarily working with other
people. And then the designer kind of data set where it's, like, oh, remember when you did that work
for free? It's because that asshole, like, ripped you off. And, like, no lawyer would let you take
them to small claims court because it was, like, too small to be worth their time. So people have
different expectations on what that means. So it's one of those things that, like, yeah, it would be
great if more designers were, like, just start working on stuff on open source. But for now, this is kind of the
closest way I've, like, asked designers to participate because it's worked out for me pretty well as far as
with Tails, with Signal, with Perio. It's just basically just adding something to their bug tracker and
being, like, this is the current behavior. This is what we want the behavior to be. These are some design
suggestions. This is the reference to, like, what I am, like, backing up this assumption with based on
the human interface guidelines of the operating systems that you're trying to build. So, like, I'm, like,
targeting, here's some screenshots and here's the user stories of people that were confused by it.
And there's also the consideration of just, like, who's actually going to do that. Certain systems for
doing that are easier than others. For example, for doing that for onion share, for example, that's a
GitHub ticket. That's super easy to use. Other platforms, like the Tor project, have their own
specific bug tracker and they have, you know, you, of course, want to search to see whether this has
already been discussed. So you're not just, like, re-opening or making it do what it's supposed to do.
It's a duplicate issue. And if you have an archive of, like, you know, six years' worth of bugs and bug
reports and discussions, that adds up over time. That's really hard to, like, really grep, especially if,
like, the search functionality of the bug tracker that you're using is a little bit more of a
challenge or time consuming to use. So the bug tracker is something that is also factors into a
particular kind of user experience that has to be taken in mind as well. Cool. So, yeah, and that's
Queen's Comfort. If you're ever in New York for Hope or whatever, you should definitely check out the
Google search. If you're ever in New York for whatever, like, take the N train to Astoria. It's,
like, if you like grease and butter and waffles, this is, like, heaven slash Valhalla of that. It's
pretty great. Cool. So that's kind of a quick wrap up talk. I wanted to, like, create as much time
as I could for Q&A. And, you know, any questions you have as far as what people see as far as, like,
using all these tools that we use or any ideas you have on, like, what makes sense for different
projects that you're working on, you have my ear on any design advice. So, yeah, microphones in the
center are presumably turned on. So, cool.