WEBVTT 00:00:00.001 --> 00:00:06.840 We all know that privacy regulations are getting more strict and that many of our users no longer believe that privacy is dead. 00:00:06.840 --> 00:00:17.540 But for even medium-sized organizations, actually tracking how we are using personal information in our myriad of applications and services is very tricky and error-prone. 00:00:17.540 --> 00:00:28.900 On this episode, we have Thomas LaPiana from the FIDES project here to discuss privacy in our applications and how the FIDES project can enforce and track privacy requirements in your Python applications. 00:00:29.420 --> 00:00:34.800 This is Talk Python To Me, episode 409, recorded March 23rd, 2023. 00:00:34.800 --> 00:00:51.060 Welcome to Talk Python To Me, a weekly podcast on Python. 00:00:51.060 --> 00:00:52.800 This is your host, Michael Kennedy. 00:00:52.800 --> 00:01:00.280 Follow me on Mastodon, where I'm @mkennedy, and follow the podcast using @talkpython, both on fosstodon.org. 00:01:00.280 --> 00:01:02.880 Be careful with impersonating accounts on other instances. 00:01:02.880 --> 00:01:03.840 There are many. 00:01:03.840 --> 00:01:08.920 Keep up with the show and listen to over seven years of past episodes at talkpython.fm. 00:01:09.480 --> 00:01:12.960 We've started streaming most of our episodes live on YouTube. 00:01:12.960 --> 00:01:20.500 Subscribe to our YouTube channel over at talkpython.fm/youtube to get notified about upcoming shows and be part of that episode. 00:01:20.500 --> 00:01:25.080 This episode is sponsored by Microsoft for Startups Founders Hub. 00:01:25.080 --> 00:01:30.840 Check them out at talkpython.fm/foundershub to get early support for your startup. 00:01:31.340 --> 00:01:33.100 And it's brought to you by Sentry. 00:01:33.100 --> 00:01:35.340 Don't let those errors go unnoticed. 00:01:35.340 --> 00:01:36.360 Use Sentry. 00:01:36.360 --> 00:01:39.200 Get started at talkpython.fm/sentry. 00:01:39.200 --> 00:01:42.060 Thomas, welcome to Talk Python To Me. 00:01:42.060 --> 00:01:43.400 Hey, thank you so much for having me. 00:01:43.400 --> 00:01:44.960 Yeah, it's great to have you here. 00:01:44.960 --> 00:01:47.380 I'm excited to talk about privacy. 00:01:47.380 --> 00:01:53.660 I feel like there was this period where everyone just gave up and decided privacy doesn't matter, 00:01:53.660 --> 00:01:58.600 either because it was a good tradeoff for them at the time or they decided it was, you know, 00:01:58.600 --> 00:02:02.000 trying to push a rock up a hill that was never going to make it to the top. 00:02:02.000 --> 00:02:03.620 And so I just don't stress about it. 00:02:03.620 --> 00:02:09.820 But I feel, you know, like things are coming back a little bit and, you know, we all get to be semi-autonomous beings again. 00:02:09.820 --> 00:02:16.700 Yeah, there's definitely been that feeling that, and I think actually it a little bit mirrors the way things are going with AI now, right? 00:02:16.700 --> 00:02:18.300 Where people feel like the genie's out of the bottle. 00:02:18.300 --> 00:02:19.120 How do we put it back? 00:02:19.320 --> 00:02:24.420 But I think we've actually seen that happen successfully with privacy where there was a long time when, you know, 00:02:24.420 --> 00:02:26.820 you would talk to your parents about, hey, maybe don't use Facebook. 00:02:26.820 --> 00:02:28.700 I know this happens to me at least, right? 00:02:28.700 --> 00:02:29.400 Personal anecdotes. 00:02:29.400 --> 00:02:30.600 So, hey, maybe don't use Facebook. 00:02:30.600 --> 00:02:31.620 You sell your data. 00:02:31.620 --> 00:02:33.840 And the response was always like, well, who cares? 00:02:33.840 --> 00:02:36.000 You know, I'm not doing anything bad anyway. 00:02:36.000 --> 00:02:36.780 Why does it matter? 00:02:36.780 --> 00:02:46.060 And I think we've seen very much a reversion to, hey, actually, maybe I don't want my insurance company to know everything about me and my family's medical history type of thing. 00:02:46.060 --> 00:02:47.720 And people are starting to care about it again. 00:02:47.720 --> 00:02:51.020 And somehow we're getting that genie back in the bottle, which is great. 00:02:51.020 --> 00:02:54.120 The internet used to be, it's this thing on the side. 00:02:54.120 --> 00:02:57.040 It was like a hobby or something you were interested in. 00:02:57.040 --> 00:03:04.900 Like, oh, I'll go on the internet and I'll read some user forums or I'll search for some interesting thing that I might be interested in. 00:03:04.900 --> 00:03:06.920 And now it's become all encompassing, right? 00:03:06.920 --> 00:03:24.260 Tech and everything else is interwoven so much that I think people are starting to realize, like, oh, if all these companies can buy, sell, and exchange too much information about me, then that might actually have a real effect in my regular life, my day-to-day life. 00:03:24.260 --> 00:03:29.000 It's not just like, oh, I get weird ads on my hobby time off that I fiddle with the screen. 00:03:29.000 --> 00:03:31.400 Like, no, this is everything, right? 00:03:31.400 --> 00:03:38.700 And so we're going to talk a little bit about the laws and the rules that are coming into place, a little bit of these changes. 00:03:38.700 --> 00:03:54.020 But mostly some platforms that you all are creating to allow companies, especially large companies with complex data intermingling, to abide by these laws and be good citizens of this new world that we're talking about. 00:03:54.020 --> 00:03:54.920 Yeah, absolutely. 00:03:54.920 --> 00:04:07.360 And I think that's another thing we've seen as part of this shift of consumers caring about privacy is you also have individual engineers or individual contributors or managers or people within the organizations that regardless of what laws may require them to do, 00:04:07.360 --> 00:04:12.480 they also do care about building privacy, respecting software, just as the right thing to do. 00:04:12.480 --> 00:04:15.600 And I think we've, yeah, we've seen kind of a general trend in that as well. 00:04:15.600 --> 00:04:16.960 So that's been good to see. 00:04:16.960 --> 00:04:17.400 Yeah. 00:04:17.400 --> 00:04:21.700 Well, I'm looking forward to exploring the ideas and then the platform as well. 00:04:21.700 --> 00:04:23.980 Before we get to that, though, let's start with your story. 00:04:23.980 --> 00:04:27.800 How did you get into programming, Python, privacy, all these things? 00:04:27.800 --> 00:04:33.520 So I actually studied politics in college, but my best friend was a computer science major. 00:04:33.520 --> 00:04:41.740 And when I found out that in college, he was already freelancing, working at home and making way more money than I did in my part time job, I was like, hold on. 00:04:41.740 --> 00:04:44.380 I think it's a computer science thing might have a future. 00:04:44.380 --> 00:04:46.160 So I was just kind of self taught. 00:04:46.160 --> 00:04:49.260 And I ended up doing some data. 00:04:49.260 --> 00:04:53.760 I got a data intelligence job right out of school, despite having zero relevant experience or knowledge. 00:04:53.760 --> 00:05:02.160 And I was told like a week or two in to, I was working on this, this case that we had, and I had to pull stuff from API and put it in database. 00:05:02.160 --> 00:05:05.060 And I had basically never really written a line of code before. 00:05:05.060 --> 00:05:10.440 And I somehow ended up on Python and somehow ended up with, you know, my SQL and I made it work. 00:05:10.440 --> 00:05:17.660 And just from there, just fell in love with the, really the problem solving aspect of coding and just creating value from basically nothing. 00:05:17.660 --> 00:05:17.940 Right. 00:05:18.200 --> 00:05:18.460 Yeah. 00:05:18.460 --> 00:05:20.620 I can just see how that search goes. 00:05:20.620 --> 00:05:23.400 You know, how do I easily pull data from API? 00:05:23.400 --> 00:05:25.040 Well, use requests in Python. 00:05:25.040 --> 00:05:25.420 I know. 00:05:25.420 --> 00:05:25.700 Okay. 00:05:25.700 --> 00:05:26.820 Let's give this a try. 00:05:26.820 --> 00:05:28.140 It was probably something similar. 00:05:28.140 --> 00:05:35.100 I think, I think I had, I had a friend, you know, in a Slack team at the time that was in, you know, into Python or something. 00:05:35.100 --> 00:05:39.140 And I think I just ended up on Python and it's been one of the best accidents of my life. 00:05:39.140 --> 00:05:42.120 Now, you know, however many years later, still working with Python daily. 00:05:42.640 --> 00:05:43.040 Yeah. 00:05:43.040 --> 00:05:43.740 Excellent. 00:05:43.740 --> 00:05:46.220 And now what are you doing for a job? 00:05:46.220 --> 00:05:46.720 Yeah. 00:05:46.720 --> 00:05:48.160 So I'm working at a company called Ethica. 00:05:48.160 --> 00:06:03.280 So we focus on privacy tooling for engineers specifically, or in a broader sense these days, working on privacy tools in general, that can be kind of a meeting point between engineers and compliance professionals. 00:06:03.280 --> 00:06:03.540 Right. 00:06:03.540 --> 00:06:10.960 So like the Kleinstein lawyers, things of that nature, your company, trying to build a common ground for them to kind of build off of and work together. 00:06:10.960 --> 00:06:11.600 Excellent. 00:06:11.600 --> 00:06:12.460 It sounds really fun. 00:06:12.460 --> 00:06:16.040 And you've got a cool platform that you all have open sourced. 00:06:16.040 --> 00:06:20.520 And we're going to talk about that in a minute, but let's keep it at high level for a moment. 00:06:21.180 --> 00:06:26.720 I talked about the swinging pendulum where it went to like YOLO. 00:06:26.720 --> 00:06:27.460 I don't care. 00:06:27.460 --> 00:06:28.420 Internet's fun. 00:06:28.420 --> 00:06:28.780 It's free. 00:06:28.780 --> 00:06:29.840 It doesn't matter to you. 00:06:29.840 --> 00:06:30.780 Oh my gosh, it matters. 00:06:30.780 --> 00:06:32.020 I want my privacy back. 00:06:32.020 --> 00:06:36.520 I can't believe people are doing X, Y, and Z and not just showing me ads with this. 00:06:36.520 --> 00:06:46.720 So we got the GDPR, obviously that made such a huge splash that made me personally scramble to match, to meet the requirements. 00:06:46.720 --> 00:06:52.120 And what I think is really interesting about that is those kinds of laws, and maybe I could get your thoughts on this. 00:06:52.120 --> 00:06:56.180 I think it's a bit of a problem or a challenge. 00:06:56.180 --> 00:06:59.520 And these kinds of laws, you can just see through the veil. 00:06:59.520 --> 00:07:04.740 Like, okay, it talks about internet company or something, but what they mean is Facebook, Google. 00:07:04.740 --> 00:07:12.360 You know, like there are five huge companies or something in the world, most of them on the West Coast of the U.S. 00:07:12.360 --> 00:07:13.800 that are like bullseye. 00:07:13.800 --> 00:07:17.980 The sites are on them and these laws trying to apply to them. 00:07:17.980 --> 00:07:18.620 Yes. 00:07:18.620 --> 00:07:25.940 In general, outside of it too, but like it's those five or whatever that really, you know, were the catalyst for this. 00:07:25.940 --> 00:07:37.460 Whereas, you know, small companies like me are like, oh, well, I have to have a recorded history of an opt-in, not just an opt-in in principle, but I need a date and a time and I need a record. 00:07:37.560 --> 00:07:43.540 So I got to go rewrite my systems so that I can have a record of opt-in for communications if I have it. 00:07:43.540 --> 00:07:49.220 And when there's one or two of you at a company, that shuts the company down for weeks. 00:07:49.220 --> 00:07:53.640 When there's 10 people at Google that I got to stop and go do that, Google just keeps going. 00:07:53.940 --> 00:07:54.120 Right. 00:07:54.120 --> 00:08:08.980 And so there's this tension of, I think, unintended harm that can come from these by asking for a blanket equal compliance when they're really what the laws are written for. 00:08:08.980 --> 00:08:14.980 And people have in mind are like these mega trillion dollar companies that have unlimited money to solve these problems. 00:08:15.380 --> 00:08:17.120 How do you see that in the world? 00:08:17.120 --> 00:08:18.420 Yeah, it's been. 00:08:18.420 --> 00:08:25.680 So I think specifically with the CCPA, which is the California Consumer Privacy Act, they kind of notice that. 00:08:25.680 --> 00:08:27.180 And there is actually a cutoff, I believe. 00:08:27.180 --> 00:08:30.280 I want to say something like revenue or valuation under 50 million. 00:08:30.280 --> 00:08:41.900 And so there is kind of a safety clause for smaller businesses, because like you said, when GDPR came in and it just went after everyone, right, irrespective of size or resources. 00:08:41.900 --> 00:08:51.040 And it was actually more of a punishment for smaller companies, because like you said, if they come for you, Michael, and they say, hey, talk Python, you know, you're doing great. 00:08:51.080 --> 00:08:55.400 You've got all this data, all these people are buying courses, but you're not keeping track of consent or whatever. 00:08:55.400 --> 00:08:57.500 And like you're, you know, you're one or two person team. 00:08:57.500 --> 00:08:59.260 You know, now you've got to stop for weeks. 00:08:59.260 --> 00:09:06.860 And Google and Facebook, they have the privilege and the ability to, yeah, they're going to hire privacy engineers and they're going to try to do things the right way. 00:09:06.860 --> 00:09:09.960 But if they could find a few hundred million, it's just the cost of doing business, right? 00:09:09.960 --> 00:09:14.540 They are calculating these fines as part of their, you know, annual spend. 00:09:14.540 --> 00:09:16.260 And that's just how they do it. 00:09:16.300 --> 00:09:21.520 Whereas for you, that could be, you know, something that ends your business or puts you in hot water or does something else, right? 00:09:21.520 --> 00:09:27.240 Or maybe, or maybe just, you don't even want to do business in the EU anymore because it's too much of a hassle compared to what it was before. 00:09:27.240 --> 00:09:33.220 So I think, yes, I think GDPR really misstepped there and it did end up punishing a lot of smaller businesses. 00:09:33.220 --> 00:09:35.080 But I think they've learned from that. 00:09:35.080 --> 00:09:36.600 They're, they're trying to iterate on it. 00:09:36.600 --> 00:09:38.980 I think cookie consent is a big one. 00:09:38.980 --> 00:09:42.840 They're now kind of revisiting that and saying, hold on, did we implement this the right way? 00:09:42.840 --> 00:09:44.100 Did everyone implement this the right way? 00:09:44.120 --> 00:09:47.320 And I think the CCPA is building on that in a really good way. 00:09:47.320 --> 00:09:49.200 And we can see there's also a lot of shared language. 00:09:49.200 --> 00:10:01.520 So I think that even though GDPR was, it was disruptive and it probably hurt the people that it didn't mean to hurt, at least initially, that it was still a pretty good base for us to work off of just in terms of a general privacy framework. 00:10:01.520 --> 00:10:07.840 And we'll hopefully get us to a place that's a little bit more equitable in terms of who's being punished and who's actually dangerous. 00:10:07.840 --> 00:10:11.980 And like you said, it was like a few outliers that brought about this requirement, right? 00:10:12.000 --> 00:10:16.920 It was, it was Facebook acquiring WhatsApp and then doing uncool things with, with access to both data. 00:10:16.920 --> 00:10:19.100 So it was things like that, that this was designed to stop. 00:10:19.100 --> 00:10:23.360 I think slowly we're getting to a place where it's being wielded more in that, in that vein. 00:10:23.360 --> 00:10:23.860 Yeah. 00:10:23.860 --> 00:10:28.860 The U.S. Supreme Court is not ruled yet on Section 230, but who knows what that's going to unleash. 00:10:28.860 --> 00:10:29.440 Yeah. 00:10:29.480 --> 00:10:30.360 That's a whole nother topic. 00:10:30.360 --> 00:10:37.000 We're not on that one, but you know, I mean, there's still, there's still large waves like that could crest and crash and whatnot. 00:10:37.000 --> 00:10:46.940 I do want to come out and say explicitly, I'm not against the GDPR and I'm not unhappy that I changed my systems around to comply to it. 00:10:46.940 --> 00:10:48.600 Like it's really important to me. 00:10:48.600 --> 00:10:53.700 I've talked to advertisers and told them, no, we're not inserting tracking pixels. 00:10:53.700 --> 00:10:57.460 We're not inserting other types of retargeting stuff for you. 00:10:57.460 --> 00:11:02.020 If you need that more than you need to talk to my audience, you go find some other audience. 00:11:02.020 --> 00:11:03.660 Like seriously, I've told them to go away. 00:11:03.660 --> 00:11:04.160 Yeah. 00:11:04.160 --> 00:11:05.880 And usually they're like, ah, okay, fine. 00:11:05.880 --> 00:11:07.880 We'll, we'll, we'll work around it. 00:11:07.880 --> 00:11:10.840 But, I also just want to kind of put that out. 00:11:10.840 --> 00:11:17.340 There's like a, look, these rules come in aimed at the top and sweep up a bunch of other people as well. 00:11:17.340 --> 00:11:17.540 Right. 00:11:17.540 --> 00:11:20.740 So I think there's like this mixed bag, I guess is what I'm trying to say. 00:11:20.740 --> 00:11:22.100 Yeah, there, there definitely is. 00:11:22.100 --> 00:11:23.320 And funny you mentioned that. 00:11:23.320 --> 00:11:28.100 Like there are, I was, I was shocked for you to see, to find out that there are podcasts I'm subscribed to, not yours. 00:11:28.100 --> 00:11:28.620 So don't worry. 00:11:28.620 --> 00:11:37.540 A podcast I've subscribed to that I can't even download on a VPN because there's, it is just like, there's some tracking requirement that my VPN blocks that it won't even let me download. 00:11:37.540 --> 00:11:42.160 The episode, which is, it's just crazy to think that that's kind of the point where we're at, even with podcasts. 00:11:42.160 --> 00:11:43.520 It's really terrible. 00:11:43.520 --> 00:11:48.020 And a lot of that I think comes from people wanting to do dynamic ad insertion. 00:11:48.020 --> 00:11:48.260 Yeah. 00:11:48.260 --> 00:11:48.780 Right. 00:11:48.780 --> 00:11:54.300 They want to go, okay, this person is coming from this IP address in this town. 00:11:54.300 --> 00:11:59.900 And we have this extra information we've gathered from like these nefarious back channels. 00:11:59.900 --> 00:12:07.200 And we're pretty sure, pretty sure that's Thomas and he works in tech and we're going to offer, we're going to dynamically insert 00:12:07.200 --> 00:12:13.140 this thing, you know, and if, if they, if there's walls that stop that, then, then maybe, maybe no. 00:12:13.140 --> 00:12:16.060 Let me go on one more really, really quick rant here. 00:12:16.060 --> 00:12:21.500 Just to mention the cook, though, this, this cookie consent, I'll try to not be on the soapbox too much for this. 00:12:21.500 --> 00:12:29.840 But I think right here at the CCPA, the California law, this right to non-discrimination for exercising your rights. 00:12:30.080 --> 00:12:36.260 When I look at the web these days, those, all these cookie pop-up notifications, they're like the plague. 00:12:36.260 --> 00:12:37.560 They're just everywhere. 00:12:37.560 --> 00:12:40.780 Many of them just say, you have to just say, okay, or go away. 00:12:40.940 --> 00:12:44.700 And, you know, it's like, okay, well, that's not a lot of control I have. 00:12:44.700 --> 00:12:48.300 On the other hand, we have a lot of technology control. 00:12:48.300 --> 00:12:54.620 I have on my network, I have NextDNS, which will block almost all the tracking and retargeting and all of that stuff. 00:12:54.620 --> 00:12:57.140 I use Vivaldi with the ad blocker on. 00:12:57.140 --> 00:13:00.060 And I'll go to these places and they'll say, turn off your ad blocker. 00:13:00.060 --> 00:13:04.140 And if they'll show you the cookie thing and they'll say, turn off your ad blocker. 00:13:04.940 --> 00:13:07.180 If you don't turn it off, you don't get to come in. 00:13:07.180 --> 00:13:15.740 I think what they should have done instead of having a law that says, you have to tell people you're tracking them and then make them press okay and then track the heck out of them. 00:13:15.740 --> 00:13:24.020 Say, like kind of this last line here in the CCPA, say there's a right to non-discrimination for exercising your privacy. 00:13:24.020 --> 00:13:33.460 And say, you should be able to have an ad blocker or other tracking protection mechanisms without being punished or blocked compared to the other visitors. 00:13:33.560 --> 00:13:38.280 That would have solved it and there'd be no need for these pop-ups everywhere. 00:13:38.280 --> 00:13:46.320 We could just, if as an informed citizenship, if we decide we want to run ad blockers or other types of tracking blockers, we can. 00:13:46.320 --> 00:13:47.820 And we just go about our business, right? 00:13:47.820 --> 00:13:54.120 Like that would have been a more sophisticated solution, I think, than making everybody say, okay, I agree. 00:13:54.120 --> 00:13:54.660 You're tracking me. 00:13:54.660 --> 00:13:55.100 Let's go. 00:13:55.100 --> 00:13:58.860 Yeah, this is, yeah, obviously I think it's been contentious, right? 00:13:58.860 --> 00:14:04.300 Like I can barely remember the internet now, despite it being just a few years ago when, and now it's just so normal. 00:14:04.300 --> 00:14:06.340 You go to a website and you're just waiting, right? 00:14:06.340 --> 00:14:08.820 You're waiting for the other shoe to drop and the thing pops up and you click the thing. 00:14:08.820 --> 00:14:09.660 Where's the cookie thing? 00:14:09.660 --> 00:14:10.240 Okay, I got it. 00:14:10.240 --> 00:14:10.580 I got it. 00:14:10.580 --> 00:14:10.800 It's out. 00:14:10.800 --> 00:14:11.160 Exactly. 00:14:11.160 --> 00:14:12.860 Is it in the top or the bottom of this one? 00:14:12.860 --> 00:14:13.120 Yeah. 00:14:13.120 --> 00:14:15.160 It's a minigame every time you go to a new website. 00:14:15.540 --> 00:14:20.260 And there are even browsers now that have a toggle of like, just project, just don't show 00:14:20.260 --> 00:14:20.880 me cookie consent. 00:14:20.880 --> 00:14:21.660 Just do it for me. 00:14:21.660 --> 00:14:21.960 Yes. 00:14:21.960 --> 00:14:23.220 I accept them. 00:14:23.220 --> 00:14:24.420 I accept them. 00:14:24.420 --> 00:14:24.960 Yeah. 00:14:24.960 --> 00:14:28.820 And it's, you know, I understand why it was there, right? 00:14:28.820 --> 00:14:32.560 They want people to be aware of what's going on, but it's kind of like, you know, EULAs 00:14:32.560 --> 00:14:33.960 or end user license agreements or whatever. 00:14:33.960 --> 00:14:36.860 Like people don't, like people don't really stop to read. 00:14:36.860 --> 00:14:37.760 If you're informed, right? 00:14:37.760 --> 00:14:41.740 And again, this is where actually I think the, talking about non-discrimination and kind of 00:14:41.740 --> 00:14:44.280 the privilege of being more privacy, where there are a lot of people, right? 00:14:44.320 --> 00:14:48.280 If you look at, you know, someone like my parents who, you know, they're going to go 00:14:48.280 --> 00:14:52.080 to the websites, they're going to see the thing that's like, Hey, we were using, they don't 00:14:52.080 --> 00:14:55.840 know what a consent cookies have no idea what the concept of tracking on a website is. 00:14:55.840 --> 00:14:58.100 They don't know what the data is actually used for anything like that. 00:14:58.100 --> 00:15:02.080 So it's, again, it's just kind of an inconvenience that I don't think really increases anyone's 00:15:02.080 --> 00:15:06.840 privacy, especially because a lot of companies are still using the dark pattern of you can click 00:15:06.840 --> 00:15:08.160 yes, track everything. 00:15:08.160 --> 00:15:13.180 But if you want to reject, or you want to only give the required cookies, it's like another 00:15:13.180 --> 00:15:15.420 step or two and it's unobvious. 00:15:15.420 --> 00:15:18.980 And it's like, you know, just a tiny little hyperlink text you have to click on. 00:15:18.980 --> 00:15:20.740 It's not a big, big flashy button. 00:15:20.740 --> 00:15:22.520 Light gray on dark gray. 00:15:22.520 --> 00:15:24.420 Exactly. 00:15:24.420 --> 00:15:25.180 Yeah. 00:15:25.180 --> 00:15:25.460 Yeah. 00:15:25.460 --> 00:15:25.660 Yeah. 00:15:25.660 --> 00:15:25.860 Yeah. 00:15:25.860 --> 00:15:26.800 Something like that. 00:15:29.140 --> 00:15:29.860 Hey folks. 00:15:29.860 --> 00:15:31.020 Let's pause for an ad. 00:15:31.020 --> 00:15:33.900 Remember last time I had an ad for Microsoft for startups. 00:15:33.900 --> 00:15:38.480 This time around, I asked the AI to have some fun with it just to show you how powerful what 00:15:38.480 --> 00:15:39.960 they have on offer really is. 00:15:39.960 --> 00:15:40.700 Here we go. 00:15:40.700 --> 00:15:41.340 Me. 00:15:41.340 --> 00:15:46.820 Can you rewrite the founders hub ad in the style of a corporate executive using too many buzzwords? 00:15:46.820 --> 00:15:47.700 AI. 00:15:48.380 --> 00:15:48.780 Sure. 00:15:48.780 --> 00:15:51.800 Here's a rephrased version of the ad in corporate speak. 00:15:51.800 --> 00:15:56.740 This segment of talk Python to me is brought to you by the Microsoft for startups founders 00:15:56.740 --> 00:16:00.480 hub, a synergetic platform of innovation and digital transformation. 00:16:01.040 --> 00:16:05.780 As a visionary entrepreneur, you are invited to leverage the cutting edge technology solutions 00:16:05.780 --> 00:16:08.300 available through our collaborative ecosystem. 00:16:08.300 --> 00:16:14.240 Our offering is unparalleled with over six figures worth of benefits, including $150,000 00:16:14.240 --> 00:16:19.200 of Azure credit allocation, which is the epitome of value proposition in the cloud market. 00:16:19.200 --> 00:16:26.160 You will have access to the new Azure OpenAI service and OpenAI APIs, enabling you to infuse 00:16:26.160 --> 00:16:29.480 AI driven solutions into your applications with ease. 00:16:29.960 --> 00:16:34.380 Our dedicated technical advisory team will provide you with a tailored guidance on best 00:16:34.380 --> 00:16:39.080 practices for implementation, scalability, and security, while our network of mentors will 00:16:39.080 --> 00:16:41.960 provide you with valuable connections within the startup landscape. 00:16:41.960 --> 00:16:47.340 This program is designed to maximize the growth of your venture with expert support in areas 00:16:47.340 --> 00:16:50.900 such as product development, fundraising, and go-to-market strategies. 00:16:50.900 --> 00:16:56.400 There are no funding requirements, making it accessible to entrepreneurs at all stages of their journey. 00:16:56.820 --> 00:17:01.160 So take advantage of this disruptive opportunity and join Microsoft for startups founders hub 00:17:01.160 --> 00:17:01.240 today. 00:17:01.240 --> 00:17:06.840 The process is simple with an effortless five minute application process and the benefits are 00:17:06.840 --> 00:17:07.640 substantial. 00:17:07.640 --> 00:17:12.400 Transform your startup with the power of AI and become a leader in digital transformation. 00:17:12.400 --> 00:17:15.640 Visit talkpython.fm founders hub to enroll. 00:17:16.240 --> 00:17:20.940 Thank you to Microsoft for supporting the show and OpenAI for making this ad fun. 00:17:23.860 --> 00:17:26.340 So I think we're finding our way still. 00:17:26.340 --> 00:17:28.360 We're not totally figuring it out. 00:17:28.360 --> 00:17:32.460 There's attempts sometimes that don't really have the outcome. 00:17:32.460 --> 00:17:34.660 I think people intended like this cookie consent one. 00:17:34.660 --> 00:17:40.580 But there's still the idea behind it was pretty good, even if the way it came out wasn't that 00:17:40.580 --> 00:17:40.860 great. 00:17:40.860 --> 00:17:42.460 At least from my perception. 00:17:42.460 --> 00:17:46.120 I know some people really appreciate the ability to have those buttons, but I just say like, 00:17:46.200 --> 00:17:48.880 I'm just going to block it no matter what I answer is not coming through. 00:17:48.880 --> 00:17:49.660 So I don't care. 00:17:49.660 --> 00:17:53.440 But companies have to live in this world, right? 00:17:53.440 --> 00:17:56.100 They have to live in the world where the pendulum is swinging back. 00:17:56.100 --> 00:18:02.500 And so I guess, you know, we talked about GDPR and I really want to go too much more into it at this 00:18:02.500 --> 00:18:03.900 point because we talked about so much. 00:18:03.900 --> 00:18:07.740 There's an interesting article called the 30 biggest GDPR find so far. 00:18:08.340 --> 00:18:12.300 And it's not updated for this year, but people can look through and see what kind of, you know, 00:18:12.300 --> 00:18:16.600 it's the exactly the companies that I described for the most part, except for there's like some 00:18:16.600 --> 00:18:17.880 weird ones in here. 00:18:17.880 --> 00:18:25.020 I don't know if you've seen this article, but there's like H&M is German clothing company where 00:18:25.020 --> 00:18:28.760 they like film their employees and then like shared that internally. 00:18:28.760 --> 00:18:31.560 And that was the violation, which was unusual. 00:18:31.560 --> 00:18:34.440 But so these are the ones that people might know. 00:18:34.440 --> 00:18:34.820 Go ahead. 00:18:34.820 --> 00:18:35.520 What are you going to say about that? 00:18:35.520 --> 00:18:38.020 I was going to say, sorry, I was going to say that a lot of people actually forget. 00:18:38.120 --> 00:18:42.920 I think that's an interesting one specifically because GDPR has kind of different classes 00:18:42.920 --> 00:18:43.980 of people it protects. 00:18:43.980 --> 00:18:48.680 And actually employees is absolutely one of them because a thing that you will see is companies 00:18:48.680 --> 00:18:51.820 will use internal employee data and say, well, there are employees. 00:18:51.820 --> 00:18:54.100 They don't have data privacy rights because they work for us. 00:18:54.100 --> 00:18:55.760 So we can use their information however they want to be. 00:18:55.760 --> 00:18:56.940 You can't do that, right? 00:18:56.940 --> 00:18:59.860 GDPR says specifically, yeah, you can't sell your employees data. 00:18:59.860 --> 00:19:05.060 You can't use their, you know, biometrics for whatever you want to, all that kind of stuff. 00:19:05.060 --> 00:19:08.920 So I think it is really important also that H&M got fined for that because it's showing, 00:19:08.920 --> 00:19:12.880 hey, you have to treat your employees as well as your customers when it comes to data privacy. 00:19:12.880 --> 00:19:13.300 Interesting. 00:19:13.300 --> 00:19:13.780 Yeah. 00:19:13.780 --> 00:19:15.600 It's not just your web visitors. 00:19:15.600 --> 00:19:16.180 It's the people. 00:19:16.180 --> 00:19:16.960 Exactly. 00:19:16.960 --> 00:19:21.060 It's trying to protect everyone, no matter what their relation is to said company. 00:19:21.400 --> 00:19:27.060 Another one, I think, just highlights the greater subtlety of all of this is this article in 00:19:27.060 --> 00:19:33.040 the register entitled, Website Fined by German Court for Leaking Visitors IP Address Via Google 00:19:33.040 --> 00:19:33.800 Fonts. 00:19:33.800 --> 00:19:35.300 Are you familiar with this at all? 00:19:35.300 --> 00:19:37.400 Yeah, I'm vaguely familiar with it. 00:19:38.020 --> 00:19:43.180 I think it's an interesting case because you can see the fine is 100 pounds, right? 00:19:43.180 --> 00:19:46.480 Sorry, not 100 pounds, 100 euros, which ends up being 110 US dollars. 00:19:46.480 --> 00:19:50.460 And so I think it was very much meant to catch news headlines, right? 00:19:50.460 --> 00:19:56.180 And just kind of warn people, hey, we've now kind of decided the Google Fonts is not going to be great. 00:19:56.400 --> 00:20:00.400 And so this is a very inexpensive warning to everyone else that maybe you should start looking 00:20:00.400 --> 00:20:03.400 into if you're using Google Fonts or not. 00:20:03.400 --> 00:20:08.140 Yeah, I find this very interesting because, again, it's almost like the cookie can set thing. 00:20:08.140 --> 00:20:10.900 This will ripple across most websites, probably. 00:20:10.900 --> 00:20:11.380 Right. 00:20:11.380 --> 00:20:18.980 I think people think about Google Analytics and some of these other conversion tracking systems 00:20:18.980 --> 00:20:19.800 that you plug in. 00:20:19.800 --> 00:20:21.060 You're like, OK, I realize we're tracking. 00:20:21.200 --> 00:20:26.680 But even like really subtle little things like linking to an image of a YouTube video. 00:20:26.680 --> 00:20:27.240 Yeah. 00:20:27.240 --> 00:20:33.480 Like that will like drop cookies from YouTube and Google onto your visitors and all those 00:20:33.480 --> 00:20:33.700 things. 00:20:33.700 --> 00:20:34.360 You're like, wait a minute. 00:20:34.360 --> 00:20:37.180 I just pointed an image like that's nuts. 00:20:37.180 --> 00:20:38.560 And this is like this. 00:20:38.560 --> 00:20:42.720 When I read this, I thought, oh, maybe there's like one person that sued this company and they 00:20:42.720 --> 00:20:43.780 got $100 or something. 00:20:43.780 --> 00:20:44.300 I don't know. 00:20:44.300 --> 00:20:48.220 But what if they had 100 million visitors and everyone decided, oh, we'll do a class action 00:20:48.220 --> 00:20:48.520 lawsuit. 00:20:48.520 --> 00:20:50.520 I mean, it could explode. 00:20:50.640 --> 00:20:52.640 I think that's why it caught the headline so much. 00:20:52.640 --> 00:20:53.360 Yeah. 00:20:53.360 --> 00:20:57.360 And so most of the time it is like with these violations, and this is where it even gets 00:20:57.360 --> 00:21:03.240 a little bit sticky because individual countries, data protection kind of agencies will go after 00:21:03.240 --> 00:21:03.880 companies. 00:21:03.880 --> 00:21:04.060 Right. 00:21:04.060 --> 00:21:07.640 So like if you are, for instance, a lot of big ones happen in Ireland because, again, a 00:21:07.640 --> 00:21:11.260 lot of tech companies, especially like Silicon Valley tech companies have headquarters in Ireland. 00:21:11.260 --> 00:21:16.500 So you see the Irish privacy authority levy a lot of these fines in some cases. 00:21:16.500 --> 00:21:18.440 People are criticizing for being kind of lenient. 00:21:18.760 --> 00:21:22.660 But I think in this case, it was very specifically, you know, for like you said, for one reason 00:21:22.660 --> 00:21:26.960 or another, someone or the government just kind of decided, hey, we need to call out this 00:21:26.960 --> 00:21:30.720 Google hosted web font and kind of warned everyone else that, hey, maybe you shouldn't be using 00:21:30.720 --> 00:21:30.940 those. 00:21:30.940 --> 00:21:31.380 I don't know. 00:21:31.380 --> 00:21:32.220 It is very interesting. 00:21:32.220 --> 00:21:34.440 And I do feel like a lot of these go under the radar. 00:21:34.440 --> 00:21:35.320 I think they do. 00:21:35.320 --> 00:21:38.940 And I don't even think they name the company that this was applied to. 00:21:39.480 --> 00:21:42.520 By the way, people, if they're like, but what do we do? 00:21:42.520 --> 00:21:45.640 Fonts.bunny.net is a really cool option. 00:21:45.640 --> 00:21:51.980 Zero tracking, no logging, privacy first, you are compliant and a drop in replacement for 00:21:51.980 --> 00:21:52.500 Google fonts. 00:21:52.500 --> 00:21:55.000 So people should check that out. 00:21:55.000 --> 00:21:58.500 If they're like, I kind of want this functionality, but I kind of don't want it anymore. 00:21:58.500 --> 00:22:01.100 Yeah. 00:22:01.380 --> 00:22:03.240 So that's a pretty cool option. 00:22:03.240 --> 00:22:04.140 All right. 00:22:04.140 --> 00:22:11.240 So that sets the stage a little bit, but let's maybe talk about some of the problems that like 00:22:11.240 --> 00:22:12.740 large organizations have. 00:22:12.740 --> 00:22:18.460 So I know that you worked at a large organization where it was like, we have this, what data do 00:22:18.460 --> 00:22:19.760 you have about me request? 00:22:19.760 --> 00:22:21.500 Or how do you use my data request? 00:22:21.500 --> 00:22:28.880 And I can only imagine at like a multiple thousand person company, there's these databases and people 00:22:28.880 --> 00:22:30.440 like dip into them and take something. 00:22:30.600 --> 00:22:31.600 And then who knows where it goes? 00:22:31.600 --> 00:22:34.540 And then they hook with some third party other thing. 00:22:34.540 --> 00:22:36.320 And then like, it's off to the races. 00:22:36.320 --> 00:22:37.820 Like, tell me what you did with that. 00:22:37.820 --> 00:22:38.500 Like, I don't know. 00:22:38.500 --> 00:22:40.260 It's out. 00:22:40.260 --> 00:22:41.100 Yeah. 00:22:41.100 --> 00:22:45.100 It feels like the, maybe this is too much of an American cultural reference, but like a 00:22:45.100 --> 00:22:47.200 take a penny, leave a penny, but for data, right? 00:22:47.200 --> 00:22:48.800 Like, you might drop some in there. 00:22:48.800 --> 00:22:49.700 You might take some out. 00:22:49.700 --> 00:22:51.220 No one really knows where it went. 00:22:51.220 --> 00:22:54.380 It's just now circulating in the broader economy. 00:22:54.380 --> 00:22:58.560 And so with that company, this is my last company, also a startup. 00:22:58.560 --> 00:23:00.200 And I was a data engineer. 00:23:00.320 --> 00:23:03.080 So I've been mostly a data engineer until my current position. 00:23:03.080 --> 00:23:05.340 And it got to the point where, and this is going to sound crazy. 00:23:05.340 --> 00:23:10.200 We were luckily through the power of like, you know, Snowflake and DBT and things like 00:23:10.200 --> 00:23:10.420 that. 00:23:10.420 --> 00:23:14.420 We were able to actually replicate a data warehouse per country. 00:23:14.420 --> 00:23:17.500 So like all of our EU data stayed in the EU. 00:23:17.500 --> 00:23:19.000 All of our Canada data stay in Canada. 00:23:19.000 --> 00:23:21.860 We're basically just spinning up as many warehouses as we needed to. 00:23:21.860 --> 00:23:25.120 Like, so when CCPA came online, we were like, all right, we're spinning one up in California. 00:23:25.120 --> 00:23:26.960 And then the rest of the US has one somewhere else. 00:23:26.960 --> 00:23:27.160 Right. 00:23:27.160 --> 00:23:30.280 But it's just, obviously, that's just not sustainable. 00:23:30.280 --> 00:23:34.380 You know, we were a relatively small data engineering team and we automated most of it, but it was 00:23:34.380 --> 00:23:35.900 very clear that that became a huge problem. 00:23:35.900 --> 00:23:40.520 It might be sustainable if it's Europe, US, and other or something like that. 00:23:40.520 --> 00:23:40.920 Right. 00:23:41.000 --> 00:23:41.320 Exactly. 00:23:41.320 --> 00:23:42.640 Where the US people. 00:23:42.640 --> 00:23:45.220 Australia was slowly going to get on that list. 00:23:45.220 --> 00:23:48.560 We're like, all right, the US people, they get no protections. 00:23:48.560 --> 00:23:50.160 We sell them like crazy. 00:23:50.160 --> 00:23:53.840 The Europeans will be a couple of them and the Canadians, they're nice. 00:23:53.840 --> 00:23:54.880 We'll kind of be nice with them. 00:23:54.880 --> 00:24:00.320 But these are, we're seeing this stuff pop up more and more, like more regionally. 00:24:00.320 --> 00:24:02.400 And it's getting harder and harder to follow. 00:24:02.400 --> 00:24:03.220 That was the problem, right? 00:24:03.300 --> 00:24:06.660 When it's California and then the rest of the US, which at the time it was, this was 00:24:06.660 --> 00:24:07.200 a few years ago. 00:24:07.200 --> 00:24:07.820 Okay. 00:24:07.820 --> 00:24:12.060 So we have a data center in California to comply with CCPA. 00:24:12.060 --> 00:24:14.220 And then we have a data center outside of California and we're good. 00:24:14.220 --> 00:24:16.760 And now it's like, well, like Virginia just passed a security law. 00:24:16.760 --> 00:24:18.920 I don't think we have servers in Virginia. 00:24:18.920 --> 00:24:20.880 I'm like, oh, like Idaho just passed. 00:24:20.880 --> 00:24:22.920 I don't know if there's server farms in Idaho. 00:24:22.920 --> 00:24:25.900 It's like, you know, it became a problem like that where you can't, you're not going to 00:24:25.900 --> 00:24:28.700 spin up 50 data centers, one in each. 00:24:28.700 --> 00:24:30.620 Like Hawaii probably didn't have data centers. 00:24:30.620 --> 00:24:31.620 Any Jesus comes there. 00:24:31.900 --> 00:24:35.360 But they did, if they, if you need to spin them up, you need to do it in person and it's 00:24:35.360 --> 00:24:36.040 going to take a month. 00:24:36.040 --> 00:24:37.680 Yeah, exactly. 00:24:37.680 --> 00:24:38.180 Exactly. 00:24:38.180 --> 00:24:38.840 It's very true. 00:24:38.840 --> 00:24:39.160 Sorry. 00:24:39.160 --> 00:24:41.920 I got a bad tan, but the data center is coming along. 00:24:41.920 --> 00:24:43.940 Yeah. 00:24:43.940 --> 00:24:46.280 So it was, you know, so that complexity, right? 00:24:46.280 --> 00:24:47.400 So all these different laws. 00:24:47.400 --> 00:24:52.340 But then on top of that, like you said, putting in the access controls for figuring out where 00:24:52.340 --> 00:24:54.060 data is going and how. 00:24:54.060 --> 00:24:58.740 So definitely having a tool like DBT, which if people don't know, it's kind of like a very 00:24:58.740 --> 00:25:01.680 programming focused data analytics tool building models and such. 00:25:01.720 --> 00:25:04.580 So we had a good lineage graph of where all the data was coming from, what it was doing, 00:25:04.580 --> 00:25:10.280 but we still had to document our use because legally you have to have a valid use for every 00:25:10.280 --> 00:25:13.800 piece of data that you are storing in there and things like that. 00:25:13.800 --> 00:25:19.520 And so I was just spending more and more time in calls with our security team and our privacy 00:25:19.520 --> 00:25:24.400 professionals, our compliance team, just answering questions of just like, hey, here's a gigantic 00:25:24.400 --> 00:25:29.200 graph of all of our tables, all of our databases, just everything we could possibly be doing. 00:25:29.440 --> 00:25:30.940 Like how does data flow through here? 00:25:30.940 --> 00:25:34.860 Like explain to me how this PI goes from here to here and what it's used for exactly. 00:25:34.860 --> 00:25:40.320 And that kind of, as we talked about before, it scales, sorry, it should be, I think just 00:25:40.320 --> 00:25:40.940 DBT. 00:25:40.940 --> 00:25:41.420 Yeah. 00:25:41.420 --> 00:25:42.080 DBT. 00:25:42.080 --> 00:25:42.680 That's the wrong one. 00:25:42.680 --> 00:25:42.940 I know. 00:25:42.940 --> 00:25:43.980 Probably happens. 00:25:43.980 --> 00:25:44.460 I'll find it. 00:25:44.460 --> 00:25:44.720 Keep talking. 00:25:46.620 --> 00:25:48.300 And, but that's not really scalable. 00:25:48.300 --> 00:25:52.360 So you, again, we talked about before this ended up punishing smaller companies a lot 00:25:52.360 --> 00:25:57.560 more because, so if you're Google, you can throw, you can just hire 20 people out of nowhere, 00:25:57.560 --> 00:25:58.640 call them privacy engineers. 00:25:58.640 --> 00:26:03.580 And, you know, just say, Hey, it is now your full-time job to just keep track of these things 00:26:03.580 --> 00:26:04.660 and help us stay compliant. 00:26:04.660 --> 00:26:09.180 But if you're a smaller company like we were, then a lot of that fell to like myself and the 00:26:09.180 --> 00:26:10.080 data engineering team. 00:26:10.200 --> 00:26:11.980 And then of course the product engineers as well. 00:26:11.980 --> 00:26:13.820 And so that makes it really difficult. 00:26:13.820 --> 00:26:16.500 That adds a pretty large burden to doing business. 00:26:16.500 --> 00:26:20.780 And after being there for a while, I then had an opportunity to come work at Ethica and 00:26:20.780 --> 00:26:22.940 I was absolutely sold on working at Ethica. 00:26:22.940 --> 00:26:27.960 And they said, you know, we're trying to build a platform that allows engineers to just handle 00:26:27.960 --> 00:26:29.920 this like engineers like to, right? 00:26:29.920 --> 00:26:32.520 Which is with automated tooling, with CI checks. 00:26:32.520 --> 00:26:33.240 Yeah. 00:26:33.240 --> 00:26:36.160 With the YAML files, with open source Python code. 00:26:36.160 --> 00:26:38.100 And I was like, Hey, this sounds great. 00:26:38.780 --> 00:26:41.140 I'm spending most of my day worrying about this anyway. 00:26:41.140 --> 00:26:43.480 I'd love to just get paid to solve this problem for other people. 00:26:43.480 --> 00:26:45.600 And that's how I ended up at Ethica. 00:26:45.600 --> 00:26:48.420 And it's been a journey ever since. 00:26:48.420 --> 00:26:52.040 And I think we're, one of the challenges of tackling something like this is like we just 00:26:52.040 --> 00:26:54.360 talked about, it's such a broad problem space. 00:26:54.360 --> 00:26:57.780 So you can come in and you can handle the cookie consent thing, right? 00:26:57.780 --> 00:27:01.060 But then they're going to say, well, to have a holistic private solution, we also need 00:27:01.060 --> 00:27:04.960 to handle knowing what our code does and data mapping and DSRs, which, you know, we're 00:27:04.960 --> 00:27:05.660 going to get to a second. 00:27:05.760 --> 00:27:08.120 So there's actually, it's like this multi-pronged data. 00:27:08.120 --> 00:27:09.440 DSR data. 00:27:09.440 --> 00:27:11.360 What's the DSR stand for? 00:27:11.360 --> 00:27:11.840 Yeah. 00:27:11.840 --> 00:27:13.680 So DSR is data subject request. 00:27:13.680 --> 00:27:14.580 And that is- 00:27:14.580 --> 00:27:16.620 Is that like what data you have about me kind of thing? 00:27:16.620 --> 00:27:17.120 Exactly. 00:27:17.120 --> 00:27:17.400 Exactly. 00:27:17.400 --> 00:27:21.500 So I think one that people have probably heard before is there's also like the right to 00:27:21.500 --> 00:27:23.440 be forgotten is included in that. 00:27:23.540 --> 00:27:28.880 So that's the ability for me to go to a company and say, hey, I would like to see what data 00:27:28.880 --> 00:27:29.780 you have about me. 00:27:29.780 --> 00:27:32.180 And so you actually, I'm going to give you my email, right? 00:27:32.180 --> 00:27:33.860 And that's my primary identify in your system. 00:27:33.860 --> 00:27:34.740 I'm going to give you my email. 00:27:34.740 --> 00:27:37.660 And then you need to go scour your entire infrastructure. 00:27:37.660 --> 00:27:42.740 And every piece of PII and data you have related to me, you need to give back to me in like a CSV 00:27:42.740 --> 00:27:46.040 format so that I can very easily see what you're tracking. 00:27:46.520 --> 00:27:48.460 Then you have, like I said, the right to be forgotten. 00:27:48.460 --> 00:27:54.300 So that is, you know, say I'm using BigCo's whatever email service, and I don't want to 00:27:54.300 --> 00:27:55.080 use their service anymore. 00:27:55.080 --> 00:28:00.740 And I say, hey, I'm sending you a request to delete all, any and all data related to myself. 00:28:00.740 --> 00:28:02.300 So I no longer want to be your customer. 00:28:02.300 --> 00:28:03.180 I've deleted my account. 00:28:03.180 --> 00:28:06.920 Everything with, you know, John at somecompany.com. 00:28:06.920 --> 00:28:10.400 You need to take that email, run it through your system and delete every single piece of 00:28:10.400 --> 00:28:11.400 PII related to it. 00:28:11.400 --> 00:28:11.780 Yeah. 00:28:11.780 --> 00:28:14.500 And so these are the kind of like privacy protections we're talking about. 00:28:14.500 --> 00:28:16.540 But that stuff is, is complicated. 00:28:16.540 --> 00:28:18.020 And so. 00:28:18.020 --> 00:28:18.620 Yeah. 00:28:18.620 --> 00:28:23.660 Well, I talked earlier about how it was really challenging for small, small companies. 00:28:23.660 --> 00:28:28.120 I think this thing you're talking about now is it's actually not that bad for small companies. 00:28:28.120 --> 00:28:33.460 I think it's killer for the medium sized business that doesn't have the Google size tech team 00:28:33.460 --> 00:28:34.120 to track it. 00:28:34.120 --> 00:28:34.520 Right. 00:28:34.520 --> 00:28:38.300 They've got a ton of people that mess with it and a ton of, ton of data. 00:28:38.300 --> 00:28:39.860 A lot of integrations. 00:28:39.860 --> 00:28:40.280 Yeah. 00:28:40.280 --> 00:28:40.680 Yeah. 00:28:40.680 --> 00:28:44.220 And that's, that's an interesting thing we've seen is that a lot of, a lot of times 00:28:44.220 --> 00:28:49.920 when people are out of compliance, it's, it's not actually because they are malicious and 00:28:49.920 --> 00:28:51.640 they don't care about people's privacy. 00:28:51.640 --> 00:28:54.520 It is because they just, they physically cannot. 00:28:55.340 --> 00:28:58.980 If you go to someone and say, Hey, you have a hundred thousand, this is not uncommon, 00:28:58.980 --> 00:29:00.800 like a hundred thousand Postgres tables. 00:29:00.800 --> 00:29:04.360 And you need to tell me exactly where every bit of PI is. 00:29:04.360 --> 00:29:06.340 And there's 100,000 Postgres tables. 00:29:06.340 --> 00:29:07.600 It's not going to happen. 00:29:07.600 --> 00:29:08.640 Like no, no one actually knows. 00:29:08.640 --> 00:29:08.820 Right. 00:29:08.820 --> 00:29:11.600 Like there's probably people that have left that may be new. 00:29:11.600 --> 00:29:14.760 And now there's some dangling Postgres database out there in AWS somewhere that has PI 00:29:14.760 --> 00:29:15.680 that they don't even know about. 00:29:15.680 --> 00:29:15.860 Right. 00:29:15.860 --> 00:29:17.420 It just doesn't even show up on their maps anymore. 00:29:17.580 --> 00:29:22.160 And that's the biggest challenge is that it's not, it's not people, you know, doing 00:29:22.160 --> 00:29:23.020 things out of malice. 00:29:23.020 --> 00:29:26.860 It is, is purely the technical scale of the problem is just huge. 00:29:26.860 --> 00:29:31.760 And again, like I said, even Google with an army of privacy engineers or, or meta with 00:29:31.760 --> 00:29:36.120 an army of privacy engineers, they still get fined all the time because it's just not really 00:29:36.120 --> 00:29:38.480 possible to catch everything manually at that scale. 00:29:38.480 --> 00:29:41.100 And that's what most people are still trying to do is to do everything manually. 00:29:43.580 --> 00:29:46.580 This portion of Talk Python To Me is brought to you by Sentry. 00:29:46.580 --> 00:29:52.760 Is your Python application fast or does it sometimes suffer from slowdowns and unexpected 00:29:52.760 --> 00:29:53.280 latency? 00:29:53.280 --> 00:29:55.900 Does this usually only happen in production? 00:29:55.900 --> 00:29:59.060 It's really tough to track down the problems at that point, isn't it? 00:29:59.060 --> 00:30:04.380 If you've looked at APM application performance monitoring products before, they may have felt 00:30:04.380 --> 00:30:05.940 out of place for software teams. 00:30:05.940 --> 00:30:11.600 Many of them are more focused on legacy problems made for ops and infrastructure teams to keep their 00:30:11.600 --> 00:30:13.840 infrastructure and services up and running. 00:30:13.840 --> 00:30:18.000 Sentry has just launched their new APM service. 00:30:18.000 --> 00:30:23.460 And Sentry's approach to application monitoring is focused on being actionable, affordable, and 00:30:23.460 --> 00:30:25.020 actually built for developers. 00:30:25.020 --> 00:30:29.660 Whether it's a slow running query or latent payment endpoint that's at risk of timing out 00:30:29.660 --> 00:30:35.640 and causing sales to tank, Sentry removes the complexity and does the analysis for you, surfacing 00:30:35.640 --> 00:30:38.760 the most critical performance issues so you can address them immediately. 00:30:38.940 --> 00:30:45.740 Most legacy APM tools focus on an ingest everything approach, resulting in high storage costs, noisy 00:30:45.740 --> 00:30:51.140 environments, and an enormous amount of telemetry data most developers will never need to analyze. 00:30:51.140 --> 00:30:56.360 Sentry has taken a different approach, building the most affordable APM solution in the market. 00:30:56.360 --> 00:31:01.480 They've removed the noise and extract the maximum value out of your performance data while passing 00:31:01.480 --> 00:31:06.980 the savings directly onto you, especially for Talk Python listeners who use the code Talk Python. 00:31:07.800 --> 00:31:14.120 So get started at talkpython.fm/sentry and be sure to use their code Talk Python, all 00:31:14.120 --> 00:31:17.120 lowercase, so you let them know that you heard about them from us. 00:31:17.120 --> 00:31:21.540 My thanks to Sentry for keeping this podcast going strong. 00:31:24.380 --> 00:31:25.900 What about bad actors? 00:31:25.900 --> 00:31:31.940 By that, I mean there are companies that try to do the right thing like mine. 00:31:31.940 --> 00:31:33.840 You can go to the course of the website. 00:31:33.840 --> 00:31:35.980 I spent a lot of this part of that two weeks. 00:31:35.980 --> 00:31:38.460 There's a button, download everything you know about me. 00:31:38.460 --> 00:31:42.900 And there's a nuke my account, completely wipe me off the face of the earth as far as you're 00:31:42.900 --> 00:31:43.260 concerned. 00:31:43.760 --> 00:31:47.520 And to my knowledge, those are totally accurate and sufficient. 00:31:47.520 --> 00:31:52.040 However, what if there's a company that says, here's all the data I have with you and here's 00:31:52.040 --> 00:31:53.100 the places I share it. 00:31:53.100 --> 00:31:56.640 And they leave out the three most important and dangerous ones. 00:31:56.640 --> 00:31:59.060 Like, do you know what recourse there is? 00:31:59.060 --> 00:32:00.660 Because it looks like they're complying. 00:32:00.660 --> 00:32:02.980 It looks like I requested the thing they gave it to me. 00:32:02.980 --> 00:32:03.900 I asked it to be deleted. 00:32:04.020 --> 00:32:08.760 They did, except for in that dark market where they're selling it to shadow brokers for ad 00:32:08.760 --> 00:32:10.480 data on credit card mix-ins. 00:32:10.480 --> 00:32:11.560 And that's way more valuable. 00:32:11.560 --> 00:32:12.180 We'll keep that. 00:32:12.180 --> 00:32:12.820 Yeah. 00:32:12.820 --> 00:32:16.860 I mean, this comes down to somehow they would just have to get found out. 00:32:16.860 --> 00:32:18.200 There'd have to be an internal whistleblower. 00:32:18.200 --> 00:32:19.700 There'd have to be an investigation. 00:32:19.700 --> 00:32:21.720 There would have to be some kind of audit. 00:32:21.720 --> 00:32:27.160 Because they do, as part of GDPR, you are required to submit things like a data map, 00:32:27.160 --> 00:32:30.320 which we'll talk about in a little bit, which is basically, where is data going? 00:32:30.320 --> 00:32:32.940 What is our valid use for said data? 00:32:32.940 --> 00:32:34.240 And all that kinds of stuff. 00:32:34.240 --> 00:32:38.880 But like you said, if there's a truly bad actor that is leaving things out of reports on purpose 00:32:38.880 --> 00:32:41.420 and not letting customers know that they're doing certain things with their data, 00:32:41.420 --> 00:32:44.120 I'm actually not sure how that would get kind of discovered. 00:32:44.120 --> 00:32:44.580 I think you're right. 00:32:44.580 --> 00:32:47.300 Maybe a whistleblower or maybe somebody says, 00:32:47.300 --> 00:32:49.880 there's no way this data got over there without going through there. 00:32:49.880 --> 00:32:50.720 Right. 00:32:50.720 --> 00:32:51.720 Exactly. 00:32:51.720 --> 00:32:56.620 I'm going to try to get some legal recourse to make you show us, make you testify. 00:32:56.620 --> 00:32:59.900 At least lie under oath instead of lie to EULA. 00:33:00.540 --> 00:33:03.280 And even this was, this actually was a big sticking point recently. 00:33:03.280 --> 00:33:06.660 Florida is also, you know, working on their own privacy law. 00:33:06.660 --> 00:33:11.100 And a big sticking point that I believe made it not go through was that they could not agree 00:33:11.100 --> 00:33:15.800 on whether individual citizens should be allowed to sue companies for data misuse or if it should 00:33:15.800 --> 00:33:17.880 be purely something the government handles. 00:33:17.880 --> 00:33:20.620 I mean, that's an interesting thing to think about. 00:33:20.860 --> 00:33:21.060 It is. 00:33:21.060 --> 00:33:22.520 It's one of those things that sounds amazing. 00:33:22.520 --> 00:33:23.400 Like, yes, sure. 00:33:23.400 --> 00:33:26.520 If you're abusing, you know, company X is abusing Thomas. 00:33:26.520 --> 00:33:31.560 Thomas should have some direct recourse, but you could easily destroy a company just by going like, 00:33:31.560 --> 00:33:37.340 let's get 50 people to all like, here's your cookie cutter letter that we send over as part of the legal process. 00:33:37.340 --> 00:33:39.180 And, you know, just knock them offline. 00:33:39.180 --> 00:33:39.560 Right. 00:33:39.560 --> 00:33:40.560 Knock about a business. 00:33:40.560 --> 00:33:43.280 So I can see both sides all over again. 00:33:43.280 --> 00:33:43.760 All right. 00:33:43.760 --> 00:33:44.700 So I kind of derailed you. 00:33:44.780 --> 00:33:50.420 We were talking about like the types of things that these medium scale organizations like really 00:33:50.420 --> 00:33:52.320 get hung up on and you touched on some, but. 00:33:52.320 --> 00:33:52.820 Yeah. 00:33:52.820 --> 00:33:54.920 So, sorry, let me, yeah, I'll, I'll go back. 00:33:54.920 --> 00:34:00.020 So number one is just the largest issue that we see in this scale is actually anywhere 00:34:00.020 --> 00:34:01.380 from medium to large, right? 00:34:01.380 --> 00:34:04.980 Even with Google and, you know, probably like Twitter size, you know, kind of the thing. 00:34:04.980 --> 00:34:07.200 I would also bet really good money. 00:34:07.200 --> 00:34:09.640 There's no one there that really knows where everything is. 00:34:09.640 --> 00:34:13.880 It's just, it's just too much to, to handle manually or within people's heads. 00:34:14.260 --> 00:34:16.500 So the number one problem is that people don't know where their data is. 00:34:16.500 --> 00:34:17.280 That's a huge issue. 00:34:17.280 --> 00:34:21.060 The number two problem is even if they know where all that data is, right? 00:34:21.060 --> 00:34:25.020 Theoretically in a perfect world, if someone gives you an email and says, Hey, you need 00:34:25.020 --> 00:34:29.280 to delete this email across all of your tables. 00:34:29.280 --> 00:34:29.640 And okay. 00:34:29.640 --> 00:34:35.000 I know we have this email and this PI and a hundred tables and three different APIs that 00:34:35.000 --> 00:34:35.500 we use. 00:34:35.500 --> 00:34:37.220 Cause we use whatever Zendesk and Salesforce. 00:34:37.220 --> 00:34:37.920 Okay. 00:34:37.920 --> 00:34:39.940 So now you've got that information in a perfect world. 00:34:39.940 --> 00:34:41.400 How do you actually execute that? 00:34:41.400 --> 00:34:43.880 Like there are plenty of companies that have someone. 00:34:43.880 --> 00:34:49.220 On staff full time that just fulfills these DSRs and right to be forgotten and things like 00:34:49.220 --> 00:34:49.460 that. 00:34:49.460 --> 00:34:54.360 So it is not really efficient to say, okay, I've now got to manually go run SQL queries 00:34:54.360 --> 00:34:57.620 in a hundred different, you know, database tables, a hundred different databases. 00:34:57.620 --> 00:34:59.580 I've now got to log into three different APIs. 00:34:59.580 --> 00:35:04.600 And it's just, it's not, it's again, not doable in an automated, you know, you, you need 00:35:04.600 --> 00:35:05.420 to automate it. 00:35:05.620 --> 00:35:09.700 So even if you know where everything is, how do you automate that? 00:35:09.700 --> 00:35:12.040 So that's another problem we were trying to solve. 00:35:12.040 --> 00:35:14.440 And then finally it's the data mapping piece, right? 00:35:14.440 --> 00:35:18.200 So you need to understand, you not only need to know where your data is, you need to know 00:35:18.200 --> 00:35:20.120 what type of data is and why you have it. 00:35:20.120 --> 00:35:25.120 And that's really difficult because maybe three years ago, I did some proof of concept where 00:35:25.120 --> 00:35:30.560 I was grabbing people's addresses and trying to figure out a way to find cheaper shipping 00:35:30.560 --> 00:35:33.660 for our e-commerce website and whatever the table's still there. 00:35:33.660 --> 00:35:36.400 And so then three years later, someone comes and says, Hey, I found all this PI in this 00:35:36.400 --> 00:35:36.820 database. 00:35:36.820 --> 00:35:38.120 Like, why did you collect this? 00:35:38.120 --> 00:35:38.840 Like what is this for? 00:35:38.840 --> 00:35:41.500 And I've already moved on to another company because, you know, it's startups. 00:35:41.500 --> 00:35:46.500 And that's a problem because you need to have a valid use for every bit of PI that you 00:35:46.500 --> 00:35:47.140 have in your system. 00:35:47.140 --> 00:35:52.760 And so it's this kind of this lack of documentation and knowledge that just brings about all these 00:35:52.760 --> 00:35:53.140 problems. 00:35:53.140 --> 00:35:56.940 And again, without, without automated tooling, it's just, I just don't think it's really 00:35:56.940 --> 00:36:01.060 feasible, which is kind of, again, where ethical saw a place to solve a huge problem. 00:36:01.060 --> 00:36:02.340 Probably also a little fear. 00:36:02.340 --> 00:36:08.020 By that, I mean the time, the short times that I spent at these larger companies, there 00:36:08.020 --> 00:36:10.040 were systems that were like, don't touch that. 00:36:10.040 --> 00:36:11.100 That runs. 00:36:11.100 --> 00:36:12.240 It's important. 00:36:12.240 --> 00:36:13.400 Nobody can make it. 00:36:13.400 --> 00:36:14.820 Nobody can fix it. 00:36:14.820 --> 00:36:16.500 We probably can't redeploy it. 00:36:16.780 --> 00:36:17.920 Just don't touch it. 00:36:17.920 --> 00:36:20.000 And what if it, what if it has a bit of data? 00:36:20.000 --> 00:36:23.020 It cannot have a nullable foreign key relationship. 00:36:23.020 --> 00:36:27.880 No, that's a strong, and I want to remove it from this table, but, but the thing that shall 00:36:27.880 --> 00:36:29.980 not be touched and no one can keep it running. 00:36:29.980 --> 00:36:31.940 It's my problem. 00:36:31.940 --> 00:36:33.460 If I break it, I don't want that problem. 00:36:33.460 --> 00:36:34.780 I could just stay. 00:36:34.780 --> 00:36:35.260 Yeah. 00:36:35.260 --> 00:36:35.960 That's a problem. 00:36:35.960 --> 00:36:36.480 Right. 00:36:36.480 --> 00:36:37.020 Yeah. 00:36:37.020 --> 00:36:38.120 That definitely becomes a problem too. 00:36:38.120 --> 00:36:41.800 Things to get forgotten about things that people don't want to touch things. 00:36:41.800 --> 00:36:45.440 They've lost kind of the institutional knowledge of how it got there and how to, 00:36:45.440 --> 00:36:47.320 how to even get out of it if they wanted to. 00:36:47.320 --> 00:36:50.760 Like you said, fear of, of downstream breaking changes. 00:36:50.760 --> 00:36:51.000 Right. 00:36:51.000 --> 00:36:53.520 So say, say I come in and mask this username. 00:36:53.520 --> 00:36:57.460 I have no idea what it's going to break some analytics tool. 00:36:57.460 --> 00:36:58.940 If it's going to ruin our marketing department. 00:36:58.940 --> 00:36:59.780 Like I have no idea. 00:36:59.780 --> 00:37:00.000 Right. 00:37:00.000 --> 00:37:00.500 Right. 00:37:00.500 --> 00:37:01.980 Why can't we send email anymore? 00:37:01.980 --> 00:37:03.220 Well, you see. 00:37:03.220 --> 00:37:04.640 Yeah, exactly. 00:37:04.640 --> 00:37:10.400 And so it's also this, this difficulty of communicating across the organization. 00:37:10.400 --> 00:37:10.880 Yeah. 00:37:10.880 --> 00:37:15.440 Because oftentimes you'll get privacy engineers and they'll, they'll be embedded into a product, 00:37:15.440 --> 00:37:16.140 into a team. 00:37:16.140 --> 00:37:19.600 And theoretically, there's just to talk across the entire org, but there's not like some 00:37:19.600 --> 00:37:20.500 centralized tool. 00:37:20.880 --> 00:37:25.060 There's no Zendesk of privacy where like, okay, a whole organization uses this one tool 00:37:25.060 --> 00:37:29.240 and we can put in, you know, we can put in tickets or we can see what the state of privacy 00:37:29.240 --> 00:37:31.580 is across the organization, et cetera, things like that. 00:37:31.580 --> 00:37:33.760 There's nothing like that that really, that really existed. 00:37:33.760 --> 00:37:39.540 And so that's when we kind of realized, okay, we need to build some kind of platform where 00:37:39.540 --> 00:37:43.480 it can just be like a one-stop shop for everything privacy engineering related. 00:37:43.680 --> 00:37:45.700 So that's going to be engineers and privacy professionals. 00:37:45.700 --> 00:37:47.280 The engineers do their work. 00:37:47.280 --> 00:37:48.900 It all flows upwards into this tool. 00:37:48.900 --> 00:37:52.580 And then the compliance professionals can get all the information they need out of that 00:37:52.580 --> 00:37:55.560 tool and trust that it's correct because it's done in a programmatic way. 00:37:55.560 --> 00:37:59.040 And it's automated and all the stuff that you need, right? 00:37:59.040 --> 00:37:59.280 Yeah. 00:37:59.280 --> 00:38:00.120 All right. 00:38:00.120 --> 00:38:04.200 Now, really one final question before we jump into your platform, which solves many of 00:38:04.200 --> 00:38:04.600 these problems. 00:38:04.600 --> 00:38:05.700 What about AI? 00:38:05.700 --> 00:38:10.760 What if it learned something through personal information and then you ask for your personal 00:38:10.760 --> 00:38:11.160 information? 00:38:11.340 --> 00:38:17.620 Like you can't go and show me like the node in the neural network that has my information. 00:38:17.620 --> 00:38:18.940 Yeah, exactly. 00:38:18.940 --> 00:38:21.200 But at the same time, it knows something about it, right? 00:38:21.200 --> 00:38:22.300 Correct. 00:38:22.300 --> 00:38:22.980 Yeah. 00:38:22.980 --> 00:38:23.820 So it is trained. 00:38:23.820 --> 00:38:27.220 There are different ways to deal with this. 00:38:27.220 --> 00:38:31.280 So for instance, but like you said, you can never really know. 00:38:31.280 --> 00:38:32.960 So, I mean, this is rabbit hole. 00:38:32.960 --> 00:38:39.760 So you can use AI to generate fake PII and then train a model on fake generated PII. 00:38:39.760 --> 00:38:40.320 That's one way. 00:38:40.320 --> 00:38:41.200 Right, right, right. 00:38:41.480 --> 00:38:45.180 But again, like you said, due to the very opaque nature of, and like you said, we're 00:38:45.180 --> 00:38:46.500 talking about actual neural nets. 00:38:46.500 --> 00:38:49.260 We're not just talking about, you know, machine learning, statistical learning models. 00:38:49.260 --> 00:38:51.320 It's like a neural net where that stuff becomes completely obfuscated. 00:38:51.320 --> 00:38:54.220 Like mid-journey, Dolly, these types of things. 00:38:54.220 --> 00:38:55.960 Yeah, it becomes truly a black box. 00:38:55.960 --> 00:38:58.280 There's really no way to know, right? 00:38:58.280 --> 00:39:03.620 And that comes down to regulators stepping in and again, just saying, hey, you cannot use 00:39:03.620 --> 00:39:09.180 PII in this model, regardless of the fact that eventually theoretically would be obfuscated. 00:39:09.180 --> 00:39:13.300 You know, that comes down to governments to just say, hey, that's not cool regardless. 00:39:13.820 --> 00:39:17.740 It's going to be so interesting as this evolves because if it was trained on that information, 00:39:17.740 --> 00:39:20.300 it kind of is corrupted in a sense. 00:39:20.300 --> 00:39:22.700 Like you can't take one person's information out. 00:39:22.700 --> 00:39:23.840 You'd have to redo the model. 00:39:23.840 --> 00:39:24.140 Exactly. 00:39:24.140 --> 00:39:24.780 That's so much work. 00:39:24.780 --> 00:39:25.740 Yeah, it's so tricky. 00:39:25.740 --> 00:39:27.140 So you've got to think of that up front. 00:39:27.300 --> 00:39:28.100 All right. 00:39:28.100 --> 00:39:30.880 So let's talk about your project, Fides. 00:39:30.880 --> 00:39:32.620 Tell us about Fides. 00:39:32.620 --> 00:39:33.340 Absolutely. 00:39:33.340 --> 00:39:40.340 So Fides is an open source, I guess, tool for a platform, maybe is a better word for it, 00:39:40.340 --> 00:39:42.240 an open source platform for privacy engineering. 00:39:42.240 --> 00:39:47.980 And it's really designed towards those two personas that I've talked about, where you have 00:39:47.980 --> 00:39:52.720 privacy professionals, you have a compliance team, and they need an easier and a more accurate 00:39:52.720 --> 00:39:56.680 way to interface and work with the engineering team, other than just calling cons or Zoom calls 00:39:56.680 --> 00:39:57.960 to ask them, hey, what does this table do? 00:39:57.960 --> 00:39:59.180 Which again, it's fine. 00:39:59.180 --> 00:39:59.840 Like that's their job. 00:39:59.840 --> 00:40:03.940 They're supposed to be doing that for protecting the company and protecting the privacy of the 00:40:03.940 --> 00:40:04.480 user's data. 00:40:04.480 --> 00:40:07.840 But then on the other side, you have engineers and engineers, they probably don't want to 00:40:07.840 --> 00:40:08.920 be in these Zoom calls all the time. 00:40:08.920 --> 00:40:13.280 And they would probably much rather interface with privacy engineering in a way that's more 00:40:13.280 --> 00:40:13.960 familiar with them. 00:40:13.960 --> 00:40:18.260 So CI checks, command line tools, YAML files, like we mentioned. 00:40:18.260 --> 00:40:22.100 And so we thought, okay, we need to build a tool that bridges that gap, right? 00:40:22.100 --> 00:40:26.440 Like we need to create an overlapping set of tools. 00:40:26.440 --> 00:40:28.420 And so we have a lot of tools that both sides will be happy with and that provide a good 00:40:28.420 --> 00:40:29.900 user experience for both sides. 00:40:29.900 --> 00:40:31.980 And so we have Fides, right? 00:40:31.980 --> 00:40:34.060 So Fides is primarily Python. 00:40:34.060 --> 00:40:35.340 Pretty much everything is Python. 00:40:35.340 --> 00:40:37.580 Most of us have TypeScript for the front end. 00:40:37.580 --> 00:40:39.200 We use a lot of other open source stuff. 00:40:39.200 --> 00:40:41.180 And we're also on GitHub. 00:40:41.440 --> 00:40:47.560 So anyone that wants to use this for themselves is totally able to, right? 00:40:47.560 --> 00:40:51.020 Because we kind of fundamentally, I think as a privacy company, it's important to believe 00:40:51.020 --> 00:40:52.640 that privacy is a human right. 00:40:52.640 --> 00:40:58.260 And so while we do have some paid features, the vast majority are completely available. 00:40:58.260 --> 00:41:01.860 Like compliance is completely available for free and open source. 00:41:02.080 --> 00:41:04.980 We don't think we should be saying, you know, hey, your privacy is really important, but 00:41:04.980 --> 00:41:06.580 only if you pay us. 00:41:06.580 --> 00:41:12.480 But we think any engineers should be able to come and look at our repo and grab Fides and 00:41:12.480 --> 00:41:17.980 then start working off of it and be able to respect user privacy within their applications 00:41:17.980 --> 00:41:19.720 without having to really pay anything. 00:41:19.720 --> 00:41:20.280 Right. 00:41:20.420 --> 00:41:25.880 And since you brought it up, so Fides is this open source project that people can grab 00:41:25.880 --> 00:41:30.560 and fulfill and automate much of what we've been talking about here, which is awesome. 00:41:30.560 --> 00:41:37.440 And your business model with Ethica is, I guess, what you would probably classify as open core, 00:41:37.440 --> 00:41:37.740 right? 00:41:37.740 --> 00:41:38.620 Yeah. 00:41:38.620 --> 00:41:40.180 That's how we refer to it internally. 00:41:40.180 --> 00:41:41.220 Is that how you consider it? 00:41:41.220 --> 00:41:41.380 Yeah. 00:41:41.380 --> 00:41:42.260 Yeah. 00:41:42.260 --> 00:41:42.660 Open core. 00:41:42.660 --> 00:41:45.980 So we have, you know, internally we'll call it like Fides core, right? 00:41:45.980 --> 00:41:49.180 Which is this repo, which is where a lot of the work, it's not like you'll see me, 00:41:49.180 --> 00:41:50.880 most of my PRs are in there. 00:41:50.880 --> 00:41:53.420 So Fides core is really what we build on. 00:41:53.420 --> 00:41:56.500 And then we have an additional, what we call Fides plus. 00:41:56.500 --> 00:42:01.880 And that is where you would git additional features that are really more like enterprise 00:42:01.880 --> 00:42:02.700 focused, right? 00:42:02.700 --> 00:42:06.140 So if you are, like I said, we're talking about those medium to very large enterprises where 00:42:06.140 --> 00:42:10.920 you have a hundred thousand tables and maybe you want a machine learning classifier to help 00:42:10.920 --> 00:42:15.580 you figure out what kind of data is in those tables, then like that'd be a paid feature. 00:42:15.580 --> 00:42:16.940 But if you just want to- 00:42:16.940 --> 00:42:17.660 It's like you kind of bootstrap it. 00:42:17.660 --> 00:42:21.480 Like we have this data, go look at it and tell me what you think about it. 00:42:21.480 --> 00:42:22.060 Something like that. 00:42:22.060 --> 00:42:22.960 Yes, exactly. 00:42:22.960 --> 00:42:23.440 Exactly. 00:42:23.440 --> 00:42:23.680 Okay. 00:42:23.680 --> 00:42:28.500 So it'll walk databases, tables, you know, fields, all that kind of stuff and say, Hey, 00:42:28.500 --> 00:42:29.660 this is probably this type of data. 00:42:29.660 --> 00:42:30.820 This is probably this type of data. 00:42:30.820 --> 00:42:33.420 You know, obviously as accurate as we can get it. 00:42:33.420 --> 00:42:36.260 For the most part, things are going to be happening in open core. 00:42:36.260 --> 00:42:43.880 So in the open core product, we are going to tackle the three major things that we think 00:42:43.880 --> 00:42:47.700 are going to be required for any kind of privacy first application. 00:42:47.700 --> 00:42:52.860 So first we're going to let people, and you can see for all the YouTube viewers, video viewers 00:42:52.860 --> 00:42:54.360 on the right side here, we've got YAML files. 00:42:54.360 --> 00:42:58.560 So YAML files are where you're going to define kind of the primitives you want to use for your 00:42:58.560 --> 00:42:59.080 application, right? 00:42:59.080 --> 00:43:02.860 So we have like data uses, we have different data category types, and you can define systems, 00:43:02.860 --> 00:43:08.460 data sets, kind of the building blocks of how you're going to describe and define your application 00:43:08.460 --> 00:43:09.780 from a privacy perspective. 00:43:09.780 --> 00:43:13.520 Once you've done that, right, once we have all this information that you've given us as 00:43:13.520 --> 00:43:17.280 metadata, you've given us about your application and your data sets, we're then able to start 00:43:17.280 --> 00:43:18.720 enforcing that automatically. 00:43:18.720 --> 00:43:24.340 We're able to start building those data maps and telling you, you know, Hey, based on what 00:43:24.340 --> 00:43:27.860 you told us in your metadata annotations, this is everywhere your data lives. 00:43:27.880 --> 00:43:29.500 And this is the type of data that lives there. 00:43:29.500 --> 00:43:34.620 Additionally, based on those, we're going to say, Hey, if you give us an email, we have 00:43:34.620 --> 00:43:37.420 actually an execution engine with a bunch of different connectors. 00:43:37.420 --> 00:43:41.020 And we're going to say, okay, so you've told us you have a Postgres database here, and you 00:43:41.020 --> 00:43:44.500 have a Mongo database here, and we're looking for this email. 00:43:44.500 --> 00:43:46.780 And like these tables are going to be where the PAI is. 00:43:46.780 --> 00:43:48.740 So it'll automatically go and execute that, right? 00:43:48.740 --> 00:43:52.540 Like it builds, it's built on top of Dask, but we're kind of doing our own logic for some 00:43:52.540 --> 00:43:54.220 kind of directed acyclic graph, right? 00:43:54.220 --> 00:43:56.800 To go out and find that data and delete it in the right order. 00:43:57.120 --> 00:43:59.860 Or to retrieve it in the right order and then give it to user request. 00:43:59.860 --> 00:44:05.520 So we're really leveraging this power of using metadata to go ahead and automate all these 00:44:05.520 --> 00:44:06.020 tasks. 00:44:06.020 --> 00:44:10.720 We'll also, more and more as we go into the future, we're trying to figure out ways to just 00:44:10.720 --> 00:44:11.800 automate it completely. 00:44:11.800 --> 00:44:16.220 So if we got to a point where engineers didn't even have to write these YAML files, and we 00:44:16.220 --> 00:44:21.040 could just introspect the code and figure out quite programmatically what was actually going 00:44:21.040 --> 00:44:22.420 on there, what we need to be concerned about. 00:44:22.640 --> 00:44:26.480 That's kind of where we want to get to and where we see the future of privacy being is, 00:44:26.480 --> 00:44:30.540 especially with the incredible explosion of these large language models and things like 00:44:30.540 --> 00:44:31.820 chat, QBD, and OpenAI, right? 00:44:31.820 --> 00:44:35.540 Doing some kind of natural language processing to allow us to understand what the code is doing 00:44:35.540 --> 00:44:39.840 without burdening developers with writing YAML is where we hope to get to eventually as well. 00:44:40.300 --> 00:44:43.620 That's ambitious, but five years ago, I would have said, oh, that's insane. 00:44:43.620 --> 00:44:45.840 Not anymore. 00:44:45.840 --> 00:44:51.480 You can give these large language models good chunks of code, and they have a really deep 00:44:51.480 --> 00:44:52.640 understanding of what's happening. 00:44:52.640 --> 00:44:53.140 It's scary. 00:44:53.140 --> 00:44:54.120 Yeah. 00:44:54.120 --> 00:44:55.100 So it's very impressive. 00:44:55.100 --> 00:44:57.860 So for now, we're still in YAML land. 00:44:57.860 --> 00:44:59.740 Hopefully, engineers are pretty comfortable there. 00:44:59.740 --> 00:45:02.680 We've been there for a while, I think, with Kubernetes and all kinds of other tools. 00:45:02.680 --> 00:45:08.580 But yeah, hopefully, we just want to keep lowering the barrier to entry for privacy compliance 00:45:08.580 --> 00:45:13.020 and for building applications that are private by design. 00:45:13.020 --> 00:45:13.440 Right. 00:45:13.440 --> 00:45:19.400 So in the parlance of YAML's website, that's privacy checks as code in continuous integration. 00:45:19.400 --> 00:45:25.080 The two other things are programmatic subject requests and automated data mapping. 00:45:25.080 --> 00:45:29.040 It sounds like you touched on the automated data mapping, but talk about the programmatic 00:45:29.040 --> 00:45:29.540 subject request. 00:45:29.540 --> 00:45:29.700 Yeah. 00:45:29.700 --> 00:45:34.140 So the programmatic subject request is what I mentioned briefly about kind of how we build 00:45:34.140 --> 00:45:38.040 an execution graph for when those data requests come in. 00:45:38.040 --> 00:45:39.500 So again, like I said, we have that metadata. 00:45:39.500 --> 00:45:41.820 We know where your data lives and what type of data it is. 00:45:41.820 --> 00:45:44.720 So when a user says, hey, here's my email. 00:45:44.720 --> 00:45:47.060 Please get rid of all the information you have about me. 00:45:47.060 --> 00:45:51.640 We're able to do that subject request programmatically because we know, okay, we're going to reach out 00:45:51.640 --> 00:45:52.940 to the Salesforce API. 00:45:52.940 --> 00:45:57.660 We're going to reach out to this Postgres database user's table where we know that data lives. 00:45:57.660 --> 00:45:59.180 And we're going to do that for you automatically. 00:45:59.180 --> 00:46:04.800 Because like I mentioned before, there are plenty of relatively large and relatively small enterprises 00:46:04.800 --> 00:46:09.320 where there is someone on staff full time waiting for these emails to come in. 00:46:09.320 --> 00:46:11.680 And then they say, okay, this email needs to get deleted. 00:46:11.680 --> 00:46:12.340 And I've done this before. 00:46:12.340 --> 00:46:13.440 So I'm not above this. 00:46:13.440 --> 00:46:15.980 When I was a data engineer, we had to do this as well in Snowflake, right? 00:46:17.080 --> 00:46:20.080 You know, something comes in and they say, okay, I've got this email. 00:46:20.080 --> 00:46:25.400 Now I need to go to these 20 systems and run all these manual scripts and hope that I don't do it in the wrong order. 00:46:25.400 --> 00:46:28.380 Because like you said, if there's like foreign key constraints, you need to know about that. 00:46:28.380 --> 00:46:31.120 Because if you do it in the wrong order, it's going to mess things up. 00:46:31.120 --> 00:46:33.440 So we basically handle that for you based on the metadata. 00:46:33.440 --> 00:46:35.780 Cannot complete transaction. 00:46:35.780 --> 00:46:38.360 There's a foreign key constraint violation. 00:46:38.360 --> 00:46:38.880 Sorry. 00:46:38.880 --> 00:46:39.500 Correct, right? 00:46:39.500 --> 00:46:42.520 And it's like knowing that and being able to figure that out, that stuff is important. 00:46:42.520 --> 00:46:43.940 So we will handle that. 00:46:44.260 --> 00:46:50.260 And then, like I mentioned with the data mapping, so this is really, really important for compliance professionals. 00:46:50.260 --> 00:46:51.780 Because this is kind of like their bread and butter. 00:46:51.780 --> 00:46:56.400 Like they have to be able to produce these data maps to show compliance with GDPR. 00:46:56.400 --> 00:47:01.080 And that's going to show all the systems, you know, within their application, within their enterprise. 00:47:01.080 --> 00:47:04.280 And then what those systems are doing and with what kind of data. 00:47:04.280 --> 00:47:05.300 And that's really, really important. 00:47:05.300 --> 00:47:08.440 And again, we can generate all this based off of the YAML file. 00:47:08.440 --> 00:47:14.220 And for engineers, the thing that we have is, you know, what we call privacy checks to CI code. 00:47:14.540 --> 00:47:16.260 Or privacy checks as code in CI. 00:47:16.260 --> 00:47:18.560 Where we're shifting privacy left. 00:47:18.560 --> 00:47:20.880 Kind of the same way that we saw with security, right? 00:47:20.880 --> 00:47:23.480 Where you went from, okay, we pushed our application out. 00:47:23.480 --> 00:47:27.160 And now a security team is just going to play with the production version and figure out where there are problems. 00:47:27.160 --> 00:47:28.040 Right. 00:47:28.040 --> 00:47:30.280 We're going to disregard security and give it to you. 00:47:30.280 --> 00:47:31.600 And then you tell us how you broke it. 00:47:31.600 --> 00:47:32.580 Yeah. 00:47:33.000 --> 00:47:35.340 But that's how a lot of companies treat privacy now too. 00:47:35.340 --> 00:47:37.600 Is like, we'll kind of figure it out in production, right? 00:47:37.600 --> 00:47:38.260 Like ship it. 00:47:38.260 --> 00:47:39.300 We'll figure it out in production. 00:47:39.300 --> 00:47:46.080 And now you see, oh, actually there are really great static analysis tools for code, right? 00:47:46.080 --> 00:47:46.740 You have Snyk. 00:47:47.000 --> 00:47:53.260 You have, you know, various other open source versions that were like, hey, let's, we're going to scan your code before this commit even. 00:47:53.260 --> 00:47:55.140 And are like, are you leaking secrets? 00:47:55.140 --> 00:47:57.240 Have you stored anything that maybe shouldn't be? 00:47:57.240 --> 00:48:00.140 And so we're trying to do that for privacy as well, right? 00:48:00.140 --> 00:48:10.180 So we're shifting privacy left and based on this metadata and based on the policies you defined, we can say, hey, you've added this new feature and you've annotated it in YAML. 00:48:10.180 --> 00:48:17.840 And now you're stating that this like system is using, you know, user data for third-party advertising and we're going to fail your CI check. 00:48:17.840 --> 00:48:27.200 We're going to throw an error and say, hey, there's a violation here of this privacy policy that your company has because you define you're using, you know, user data in this way. 00:48:27.200 --> 00:48:28.700 And that's going to break that. 00:48:28.780 --> 00:48:34.540 So again, that's just a way for, to like short circuit that whole thing of, okay, the engineers have shipped it. 00:48:34.540 --> 00:48:37.800 And now someone comes running back and says, hey, hey, why did you ship this? 00:48:37.800 --> 00:48:40.200 You're using, you know, personal data in a way you're not supposed to be. 00:48:40.200 --> 00:48:51.640 We're trying to kind of get around that by saying, you know, pretty early on we'll know what's going on and we can, you know, avoid pushes to main or deploys that don't pass these CI checks. 00:48:51.960 --> 00:49:05.560 Okay. So as an engineer writing software in this sort of guarded by this, it's my, I have to be proactive and state how I'm using data if I'm bringing new data into the system or does it somehow get discovered? 00:49:05.900 --> 00:49:11.780 No. So that is, that is currently what is required is it is up to the engineers to maintain that YAML. 00:49:11.780 --> 00:49:14.540 So we're working on ways to automate that. 00:49:14.540 --> 00:49:18.540 And we actually have automated it for data sets because it's obviously much more programmatic. 00:49:18.540 --> 00:49:23.220 So if you, if you say, hey, here's my application database, here's my Postgres database. 00:49:23.220 --> 00:49:27.300 And I have, you know, I've annotated every field and all that kind of stuff. 00:49:27.300 --> 00:49:28.380 So we can automatically scan that. 00:49:28.380 --> 00:49:33.780 We'd say, hey, in your, in your YAML definition, you've left out these two columns, right? 00:49:33.780 --> 00:49:35.300 Which you maybe you added in this PR, right? 00:49:35.300 --> 00:49:35.300 Right. 00:49:35.300 --> 00:49:44.980 And so before that PR goes in, it's going to remind you, hey, you need to, you need to add these two new columns to your dataset.yml file so that we know what's going on in those new database columns. 00:49:44.980 --> 00:49:52.540 Okay. I can see how you might do a lot of, sorry, I can see how you might do a lot of introspection, like, oh, I'm using SQL model. 00:49:52.540 --> 00:49:55.060 And here's the Pydantic thing describing the table. 00:49:55.060 --> 00:49:56.580 And here's the two new things. 00:49:56.580 --> 00:50:04.100 But then you could also, you know, traverse the usages of that, that those two columns and see where they're used elsewhere. 00:50:04.100 --> 00:50:11.900 And possibly, is there any API call that is like that data is being passed to, for example, and like, oh, is it coming out of exactly? 00:50:11.900 --> 00:50:12.480 All right. 00:50:12.480 --> 00:50:15.240 You might be able to find the common integrations and see what's happening there. 00:50:15.240 --> 00:50:20.820 And yeah, that's, that's exactly what we're, we're looking at next with, like I said, looking for, looking for ways to automate this. 00:50:20.820 --> 00:50:20.980 Right. 00:50:20.980 --> 00:50:29.200 So we, even if we just had a really basic dictionary of like, Hey, these APIs are going to be related to storing or sending, you know, user data. 00:50:29.200 --> 00:50:29.360 Right. 00:50:29.360 --> 00:50:30.400 And making sure that's annotated. 00:50:30.400 --> 00:50:34.360 And like you said, maybe some of those, like those code level annotations we were using. 00:50:34.360 --> 00:50:39.120 Like if you think about, you know, Pydantic, right, where you can have the field object and you can define, okay, here's a field. 00:50:39.120 --> 00:50:40.120 Here's a, here's the default. 00:50:40.120 --> 00:50:41.700 Here's the, here's the description. 00:50:41.700 --> 00:50:42.700 here's the description. 00:50:42.700 --> 00:50:49.040 And then if there was like another field that was like, you know, privacy category, data category, whatever data use or data subject, something like that. 00:50:49.040 --> 00:51:00.080 That's absolutely something we've been looking at as well, of kind of like the next step, because we know, again, this comes down to, this is still partially manual and therefore still potentially error prone. 00:51:00.080 --> 00:51:09.440 so as long as we're scanning databases, that gives us some guarantee that, okay, there's probably not going to be an entirely new, you know, thing that we miss out on. 00:51:09.440 --> 00:51:09.640 Yeah. 00:51:09.640 --> 00:51:13.080 But if it's sending you like third, third party APIs or something, it would still be possible. 00:51:13.080 --> 00:51:17.840 So that's kind of the holy grail we're trying to get to is how do we just make this even easier for developers? 00:51:17.840 --> 00:51:19.400 How do we lower the barrier even further? 00:51:19.400 --> 00:51:25.720 Because we know this is still somewhat of a barrier to entry, but also hopefully still a huge step up from nothing. 00:51:25.720 --> 00:51:27.440 Yeah, no, it's, it's great. 00:51:27.440 --> 00:51:41.900 And, you know, if, if your job is to put together a system that can explain how it's using data and how that's enforced and how you're checking that, then something like this seems way better than code review, but not instead of, but it's certainly a huge bonus. 00:51:41.900 --> 00:51:42.340 Yeah. 00:51:42.340 --> 00:51:42.840 Yeah. 00:51:42.840 --> 00:51:43.200 Correct. 00:51:43.200 --> 00:51:43.920 In addition to. 00:51:43.920 --> 00:51:44.440 Yeah. 00:51:44.740 --> 00:51:53.480 So what we discussed here, this part feels like a GitHub action type of plugin as part of a CI step or something along those lines. 00:51:53.480 --> 00:51:54.120 Mm-hmm . 00:51:54.120 --> 00:51:55.520 What about the other one? 00:51:55.520 --> 00:52:04.300 So for example, the programmatic subject request, that's going to cruise through the data and pull out the things, either show people what they got because they asked for it or delete it. 00:52:04.300 --> 00:52:07.240 Is that like, how does that run? 00:52:07.240 --> 00:52:09.080 Is that something you plug into your app? 00:52:09.080 --> 00:52:12.100 Is that a service that just has access to your data? 00:52:12.100 --> 00:52:12.540 Yeah. 00:52:12.540 --> 00:52:14.620 So that would be something. 00:52:15.080 --> 00:52:17.680 So we actually do have a hosted version of FIDES, right? 00:52:17.680 --> 00:52:25.360 So for companies that don't want to bother kind of hosting their own, you know, a database and web server and things of that nature, we host it. 00:52:25.360 --> 00:52:29.400 But all this is stuff that you could self-host as well, like you can deploy in your own instance. 00:52:29.400 --> 00:52:37.200 So we have something called a privacy center, which again is a thing that you spin up and you run on your side that actually would then link to. 00:52:37.200 --> 00:52:43.600 And that is then what would direct the privacy requests to your backend FIDES web server instance. 00:52:43.600 --> 00:52:47.180 And then that's where you would go and you would go, we call it the admin UI, right? 00:52:47.180 --> 00:52:49.240 Like the admin would log in or the privacy question would log in. 00:52:49.240 --> 00:52:51.320 They would see, oh, these are all the requests that have come in. 00:52:51.320 --> 00:52:52.220 I can approve these. 00:52:52.220 --> 00:52:55.160 I can deny these, et cetera, et cetera, based on what's going on there. 00:52:55.160 --> 00:52:56.160 Yeah. 00:52:56.160 --> 00:53:02.320 So we have the kind of the pre-deployment of the code would be the checks in CI and writing all those YAML files. 00:53:02.320 --> 00:53:07.200 And then once you deploy the application, we have these runtime tools, like you said, these subject requests. 00:53:07.200 --> 00:53:09.200 And that's all stuff you would deploy. 00:53:09.200 --> 00:53:13.200 Most people would do it doing Docker containers that we build and publish. 00:53:13.200 --> 00:53:16.200 And, or you could just download and run it and run it directly. 00:53:16.200 --> 00:53:17.200 PIP install. 00:53:17.200 --> 00:53:17.700 Yeah. 00:53:17.700 --> 00:53:18.200 Okay. 00:53:18.200 --> 00:53:19.200 Interesting. 00:53:19.200 --> 00:53:24.200 So basically there's a web app that you log into and you can either self-host it or that can be yours. 00:53:24.200 --> 00:53:27.200 And then it goes and does its magic at that point. 00:53:27.200 --> 00:53:28.200 Yeah. 00:53:28.200 --> 00:53:30.200 What about the data mapping bit? 00:53:30.200 --> 00:53:31.200 Yeah. 00:53:31.200 --> 00:53:37.200 And the data mapping is something where you can either log into the web portal, because it's going to be assumed, 00:53:37.200 --> 00:53:43.200 that most privacy professionals, most of them have legal backgrounds are probably not going to want to mess with command line tool. 00:53:43.200 --> 00:53:44.200 Although we do have a command line tool, right? 00:53:44.200 --> 00:53:45.200 For the engineers. 00:53:45.200 --> 00:53:59.200 So if you're an engineer, you can of course run a command line, you know, command that will give you the properly formatted, you know, Excel document or CSV if you want it with all of the rows in there that you need. 00:53:59.200 --> 00:54:03.200 Or again, like I said, if you're a privacy professional, you can log into the UI and download it that way. 00:54:03.200 --> 00:54:04.200 And just have it generate it. 00:54:04.200 --> 00:54:07.200 It'll hit an endpoint and then it will just give you the file back. 00:54:07.200 --> 00:54:08.200 Okay. 00:54:08.200 --> 00:54:09.200 Seems really neat. 00:54:09.200 --> 00:54:18.200 So, again, where you talked a bit about this, like automated checks with looking at the code to try to reduce the need for explicitly stating how things work. 00:54:18.200 --> 00:54:24.200 And you've got this ML higher order piece that will hunt down the private information. 00:54:24.200 --> 00:54:25.200 Where else are you? 00:54:25.200 --> 00:54:27.200 What's the roadmap beyond those things? 00:54:27.200 --> 00:54:29.200 Where is it going? 00:54:29.200 --> 00:54:30.200 Just. 00:54:30.200 --> 00:54:31.200 As much as you can talk about. 00:54:31.200 --> 00:54:32.200 Yeah. 00:54:32.200 --> 00:54:33.200 Yeah. 00:54:33.200 --> 00:54:34.200 I mean, just more and more automation, right? 00:54:34.200 --> 00:54:39.200 Because again, if we look at the ultimate goal is how do we just make privacy easier? 00:54:39.200 --> 00:54:40.200 Because it's not going away. 00:54:40.200 --> 00:54:42.200 It's only going to get more stringent. 00:54:42.200 --> 00:54:44.200 The fines are only going to get bigger. 00:54:44.200 --> 00:54:49.200 I think it's interesting that that kind of GDPR fine list ended it, you know, May, was it May or something? 00:54:49.200 --> 00:54:50.200 March 2022. 00:54:50.200 --> 00:54:53.200 Since then, fines have actually only been getting bigger, right? 00:54:53.200 --> 00:54:57.200 They're basically making fines larger and larger and larger because they realize that tech companies just don't care for the most part. 00:54:57.200 --> 00:55:00.200 And so it's becoming more and more dangerous for people that aren't compliant. 00:55:00.200 --> 00:55:03.200 So, okay, how do we just make this as easy as possible? 00:55:03.200 --> 00:55:06.200 We know that there are people that probably don't want to maintain a bunch of YAML. 00:55:06.200 --> 00:55:14.200 So it's really just anything along those lines of how do we lower the barrier to entry for people that want to be privacy compliant and use FIDA. 00:55:14.200 --> 00:55:22.200 So like you said, that's going to take the form of probably more machine learning models, NLP models that are going to help us introspect the code. 00:55:22.200 --> 00:55:26.200 It could be things like the in-code annotations, right? 00:55:26.200 --> 00:55:36.200 We're like, okay, maybe there's now, you know, in Pydantic, there's now a field to add privacy information or maybe in DBT, the analytics, we talked about before, which I know is used by a lot of companies. 00:55:36.200 --> 00:55:45.200 Maybe we add metadata in there where people can now define what PI is being used in there and then we can just kind of natively read from those files instead of having to have our own file format, things of that nature. 00:55:45.200 --> 00:55:52.200 Really, we're just looking at any possible place and getting feedback from people of where their pain points are and how we can help solve them. 00:55:52.200 --> 00:55:55.200 Sure. Do you have any runtime things that you're thinking about? 00:55:55.200 --> 00:55:58.200 You've got the deploy stuff with the YAML. 00:55:58.200 --> 00:56:04.200 You've got the on request stuff with the other things, but you know, we saw this JSON document come in. 00:56:04.200 --> 00:56:05.200 Yeah, yeah, yeah, yeah. 00:56:05.200 --> 00:56:06.200 It has a thing called email. 00:56:06.200 --> 00:56:07.200 We don't know, you know? 00:56:07.200 --> 00:56:08.200 Yeah. 00:56:08.200 --> 00:56:09.200 So interesting you ask that. 00:56:09.200 --> 00:56:13.200 So we have done some research and some proof of concepts. 00:56:13.200 --> 00:56:15.200 I don't know if you're familiar with something called eBPF. 00:56:15.200 --> 00:56:16.200 No. 00:56:16.200 --> 00:56:17.200 It is a way at eBPF. 00:56:17.200 --> 00:56:29.200 It is a way to use the Linux kernels to actually monitor the traffic going back and forth between basically over the network, right? 00:56:29.200 --> 00:56:38.200 And so what we've been able to do is if you have an application running in Kubernetes, then we'll deploy something called a system scanner. 00:56:38.200 --> 00:56:43.200 And it is runtime and what it's doing is it'll actually watch the traffic that's happening across your application in Kubernetes. 00:56:43.200 --> 00:56:47.200 And it will come back to you and say, hey, you've got these systems. 00:56:47.200 --> 00:56:51.200 They're talking to each other in this way and basically build a map kind of automatically. 00:56:51.200 --> 00:57:04.200 So this is a really useful tool for you're already running everything and you just want someone to tell you what you have running and kind of build the topography for you and tell you all your systems, tell you all your data sets, tell you what the traffic looks like across your application. 00:57:04.200 --> 00:57:08.200 Then yes, we are working on a tool that can do this. 00:57:08.200 --> 00:57:12.200 Okay. Yeah. This eBPF at eBPF.io looks nuts. 00:57:12.200 --> 00:57:17.200 Dynamically programmed the Linux kernel for efficient networking, observability, tracing and security. 00:57:17.200 --> 00:57:23.200 And yeah, you could just say things like, these are all the outbound connections, all of our systems are making. 00:57:23.200 --> 00:57:24.200 Exactly. 00:57:24.200 --> 00:57:29.200 And these IP addresses resolve too. We know this one is MailChimp. We know that one's Zendesk. What's this one? 00:57:29.200 --> 00:57:31.200 Correct. Yeah, exactly. So it's like, okay. 00:57:31.200 --> 00:57:37.200 So we see that we're making a bunch of calls to MailChimp, but you haven't, you've never mentioned in your metadata that you're talking to MailChimp. 00:57:37.200 --> 00:57:39.200 We now know that that's something we need to worry about. Right. 00:57:39.200 --> 00:57:42.200 So this is also something that we have. 00:57:42.200 --> 00:57:45.200 Yeah, this is a little bit of what I was thinking about at runtime stuff. 00:57:45.200 --> 00:57:51.200 Like, yeah, like, can you watch the data flow and go, okay, this is inconsistent with what you've told me is happening. 00:57:51.200 --> 00:57:58.200 Yes, exactly. So you would, the way it works now is you would deploy our system scanner into your environment, into your Kubernetes environment. 00:57:58.200 --> 00:58:02.200 It just, it sits off as its own, you know, set of nodes and it does its thing. 00:58:02.200 --> 00:58:06.200 And then it'll, after a certain amount of time, it'll just come back to you with, hey, this is what we, this is what we saw. 00:58:06.200 --> 00:58:08.200 And it'll build you, it'll actually build the EMO files for you. 00:58:08.200 --> 00:58:09.200 Oh my goodness. Okay. 00:58:09.200 --> 00:58:12.200 And say this is, this is kind of the definition of what we saw. 00:58:12.200 --> 00:58:16.200 Very wild. All right. That's, that's cool. That's cool. 00:58:16.200 --> 00:58:28.200 Well, so we're getting real short on time here. I guess maybe give us just the quick report or thoughts on how the open core business models going for you all. 00:58:28.200 --> 00:58:35.200 I, I feel like going through the life cycle of this podcast, just had the eight year anniversary for running the podcast. 00:58:35.200 --> 00:58:36.200 I've talked to a lot of people. 00:58:36.200 --> 00:58:37.200 Oh, congratulations. 00:58:37.200 --> 00:58:56.200 Yeah. Thank you very much. Eight, eight years ago, it was a lot of, ah, we accept donations and, and mostly to me, it looked like what the successful story for open source mostly, at least traditionally at that point had been, I'm a maintainer or major participant of this important library. 00:58:56.200 --> 00:59:04.200 So I got a really good paying job at high end tech company and high end tech company gives me 20% time to work back on it. Right. 00:59:04.200 --> 00:59:12.200 Kind of like I've, I've got a benefactor like employer a little bit and it's moving more and more towards open core and other things. 00:59:12.200 --> 00:59:19.200 So I'd say both GitHub sponsors and open core and then incredibly some like really interesting VC stuff that's happening as well. 00:59:19.200 --> 00:59:31.200 And those are not disjointed necessarily. Right. Anyway, I think a long story short, I think the open core stuff, people have really hit on with something that's seemed like it's kind of working for sustaining open source. 00:59:31.200 --> 00:59:48.200 Yeah, I think we've seen the similar, very similar thing. I think that we are, it is really hard to walk that line, but kind of where we've come down on it is, you know, with the belief that privacy is a human right, all the tools required to be compliant need to be open source kind of like full stop. 00:59:48.200 --> 01:00:02.200 So, so for instance, like data mapping, that is a legal requirement. We're not going to put that behind the paywall. Handling those privacy requests by building those, those graphs and being able to go execute this thing. That is a requirement. You have to have that to be compliant. We're not going to paywall that. 01:00:02.200 --> 01:00:12.200 That's, that's the line that we're trying to ride. Is it okay? Anything that makes it super easy, the machine learning stuff, the kind of runtime scanning, all that kind of more advanced stuff. 01:00:12.200 --> 01:00:21.200 That's more cutting edge, more R and D then we'll probably put that on the paid offerings. Right. But anything required to just get things running. 01:00:21.200 --> 01:00:36.200 Cause we know we actually have some very, very large companies that are using FIDES purely open source. Like they don't, they have zero contract with us. They don't really have any contact with us, but we know they're using, we know they're using FIDES regularly to do their internal privacy. And that's, I think that's a good place to be. Right. 01:00:36.200 --> 01:00:46.200 If, if three years ago when you had to implement GDPR stuff for talk python.fm and you stumbled across this tool that could just help you do that. And instead of two weeks, it was two or three days. 01:00:46.200 --> 01:00:58.200 Like for me, that still feels like a huge win. And there's still enough, there's still enough enterprise customers who have a hundred thousand Postgres tables that want us to help them classify. Right. There's still enough of those people out there to make it sustainable. 01:00:58.200 --> 01:01:10.200 And it's also a competitive advantage. I think it's easier. It's easy for people to just think that, Oh, because it's open source, you are, you're, you're kind of, you know, throwing away contracts you would have had. 01:01:10.200 --> 01:01:24.200 Otherwise we've had a lot of people engage with us because we're open source. Right. And it's not even, it's not even that they don't want to pay. They're just saying, Hey, we like your paid offering, but the fact that you also are open source and you have an open core model, we can go look at and contribute to and, and put ideas into. 01:01:24.200 --> 01:01:29.200 That's really attractive for a lot of engineering teams. Because again, that's, that is one of our target markets. 01:01:29.200 --> 01:01:39.200 Yeah. I think traditionally looking back quite a ways, there was, I need a company and a private commercial software behind this. So I have a SLA and someone to sue when things go wrong. 01:01:39.200 --> 01:01:48.200 And that's still the, you might be able to do that. You might be able to crush that company because they did you wrong, but you're still not going to get your, your bug fixed in your software working any better because of it. Right. 01:01:48.200 --> 01:01:54.200 Right. And I think people are starting to see open source as the escape hatch, right? Like I can work with a company. 01:01:54.200 --> 01:02:01.200 I can work with a company that has this premium offering on top of open source, but if worse come to worse, we'll just fork the repo and keep on living. You know what I mean? 01:02:01.200 --> 01:02:08.200 And that's a way more, I think useful and constructive way than we're going to try to sue them to make them do our deal. Right. 01:02:08.200 --> 01:02:16.200 Yeah. Exactly. Yeah. Talking about, you know, privacy engineering is being about risk mitigation, right? Having, having an open source product is also quite a bit of risk mitigation. 01:02:16.200 --> 01:02:26.200 You know, it gives engineers time to get comfortable with it. Like you said, they can, they can fork it. They can, you know, we're, we're very open to pull requests and, you know, people opening issues and feature requests and things of that nature. 01:02:26.200 --> 01:02:40.200 So it just, it just really makes it a much more pleasant process when you're just more transparent and more open. People can go and look at the code themselves. You know, they can, if they report a bug, they can probably go see it getting fixed in real time, et cetera, things like that. 01:02:40.200 --> 01:02:49.200 Yeah. Yeah. I think it's definitely the way that I prefer working as an engineer. You know, I can't speak for management or anything, but it's definitely more fun to be able to engage with the community in that way. 01:02:49.200 --> 01:02:56.200 Awesome. Well, I'm happy to see you all making, making your way in the world based on your open source project. That's really cool. 01:02:56.200 --> 01:03:03.200 So I think we're about out of time to keep going on the subject. So we'll have to just wrap it up with the final two questions here. 01:03:03.200 --> 01:03:10.200 So if you're going to write some code, work on feed as, or something else, Python based, what editor using these days? 01:03:10.200 --> 01:03:26.200 It's, it's VS Code. I think, I think it was pretty hardcore Vim until I think at one point you had someone on your podcast, it was evangelizing VS Code. And I went and tried it and I was like, Oh, I, I'm very obviously more productive now. So I stuck with VS Code ever since then. 01:03:26.200 --> 01:03:32.200 That was great. Thank you for, thank you for doing that. Yeah, you bet. And a notable PI PI package. 01:03:32.200 --> 01:03:43.200 Yeah, I'm going to give two here pretty quickly. So the first one is Knox. I believe I also learned about it from this podcast. This is, I do talk Python.fm driven development. 01:03:43.200 --> 01:04:04.200 Anyway, so, so, so we were using, you know, make files before, because I do a lot of work on the kind of dev experience DevOps side. And so I was a big make file user. And when I basically heard, Hey, it's like make, but more powerful. And then Python, I immediately went and tried it out. And I think spent like the next few days just completely rewriting our make file in Knox. 01:04:04.200 --> 01:04:11.200 It is. And it's been great. This has been, it has been so empowering for the other developers. Whereas before make files pretty archaic and it was pretty much only myself that would touch it. 01:04:11.200 --> 01:04:22.200 now the other developers feel very comfortable jumping into Knox. and also being cross platform, I developed on windows and literally everyone else at the company develops on, on max. 01:04:22.200 --> 01:04:27.200 So it gives us a much more cross platform way to handle, scripting and building things like that. 01:04:27.200 --> 01:04:31.200 Yeah. Make files are quite different over on the windows side. 01:04:31.200 --> 01:04:44.200 Yes. Yes. I learned this the hard way. It was like, you know, it was very, very often. There was like, you know, it works on my machine, type of stuff going on there. and then finally just, another notable package is rich click. 01:04:44.200 --> 01:04:58.200 and that is, people don't know rich is a package in Python that makes text output like terminal output look very, very nice. And that is a nice wrapper on click that makes click look very, very, very nice. because it's wrapped in rich. 01:04:58.200 --> 01:05:11.200 So, our CLI uses this, I think it looks great because of it. so I'd also highly recommend that if you're, if you're into looking for a more modern feeling CLI, with a lot of, you know, flexibility and format ability. 01:05:11.200 --> 01:05:19.200 So it gives you kind of automated colorized help text and usage text and, like option. 01:05:19.200 --> 01:05:27.200 Yeah. Yeah. And you can, and you can customize that. a really, really powerful thing also is that it will, it will understand markdown in your doc strings. Right. 01:05:27.200 --> 01:05:38.200 So if you want to get a little more fancy, it also has kind of its own language that you can use. so yeah, it's, it's been really nice. cause I was feeling a little bit jealous. 01:05:38.200 --> 01:05:44.200 Our UI looks really nice and our CLI didn't. And so I went and wanted to find something that would make the CLI look a little bit nicer for probably engineers. 01:05:44.200 --> 01:05:55.200 It seems like, ah, that's kind of superficial. Like who cares color for your silly CLI. It makes a big difference. Like the information bandwidth is so much higher. 01:05:55.200 --> 01:05:58.200 Yeah. Yeah. It makes, it really does make a huge difference. 01:05:58.200 --> 01:06:09.200 Awesome. Well, I think we're going to leave it here, with this, but Thomas, thanks for being on the show. It's been really great to have you here and a lot of fun to talk privacy. Yeah. Good luck with the project. It looks great. 01:06:09.200 --> 01:06:12.200 Thank you. Talk to you later. Yeah. Yeah. See you later. 01:06:12.200 --> 01:06:13.200 Thank you. 01:06:13.200 --> 01:06:25.200 This has been another episode of talk Python to me. Thank you to our sponsors. Be sure to check out what they're offering. It really helps support the show. Don't miss out on the opportunity to level up your startup game with Microsoft for startups founders hub. 01:06:25.200 --> 01:06:49.200 Get over six figures and benefits, including Azure credits and access to OpenAI APIs, APIs. Apply now at talk Python.fm slash founders hub. Take some stress out of your life. Get notified immediately about errors and performance issues in your web or mobile applications with century. Just visit talk Python.fm slash century and get started for free. And be sure to use the promo code talk Python. All one word. 01:06:49.200 --> 01:07:06.200 All one word. Want to level up your Python. We have one of the largest catalogs of Python video courses over at talk Python. Our content ranges from true beginners to deeply advanced topics like memory and async. And best of all, there's not a subscription in sight. Check it out for yourself at training.talkpython.fm. 01:07:06.200 --> 01:07:19.180 Be sure to subscribe to the show, open your favorite podcast app and search for Python. We should be right at the top. You can also find the iTunes feed at /itunes, the Google play feed at /play and the direct RSS feed at /play. 01:07:19.180 --> 01:07:39.060 RSS on talk Python. We're live streaming most of our recordings these days. If you want to be part of the show and have your comments featured on the air, be sure to subscribe to our YouTube channel at talk Python.fm slash YouTube. This is your host, Michael Kennedy. Thanks so much for listening. I really appreciate it. Now get out there and write some Python code. 01:07:39.060 --> 01:07:58.940 I'll see you next time. 01:07:58.940 --> 01:08:28.920 Thank you.